Discuss

discuss@lists.centos.org

34758 discussions

Re: Centos 5 OpenVPN / SElinux
by Bernd Bartmann 30 May '07

30 May '07

On 5/30/07, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > Easiest thing to do is update policy with these two rules. > > # grep openvpn /var/log/audit/audit.log | audit2allow -M myopenvpn > # semodule -i myopenvpn.pp > > This will add the following rules: > allow openvpn_t pppd_t:fd use; > allow openvpn_t self:process execstack; > > The pppd_t:fd is probably a leaked file descriptor and could probably be > dontaudited. > The execstack is potentially a problem in openvpn_t. This is probably a > coding problem and should be reported as a bug/ Daniel, do you mean a bug in SElinux or OpenVPN? Best regards, Bernd.

1 0

Xen and overall system load
by gen2 30 May '07

30 May '07

> In a CentOS 5 dom0, how does one find out the overall system load? xentop may help

2 1

Centos 5 OpenVPN / SElinux
by Bernd Bartmann 30 May '07

30 May '07

Hi, I'm running Centos 5 32bit and installed openvpn-2.0.9-1.el5.rf from Dag Wieers Repo. When OpenVPN is started during boot-up it just shows an SElinux related error message. When I start OpenVPN manually after the system has come up completely it works fine. Here are all the messages from /var/log/messages that are SElinux related: May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.395:10): avc: denied { use } for pid=3012 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.395:11): avc: denied { use } for pid=3012 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.395:12): avc: denied { use } for pid=3012 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.458:13): avc: denied { execstack } for pid=3012 comm="openvpn" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:openvpn_t:s0 tclass=process May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.465:14): avc: denied { use } for pid=3014 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.465:15): avc: denied { use } for pid=3014 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.465:16): avc: denied { use } for pid=3014 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:39:15 srsblnfw01 kernel: audit(1180381151.466:17): avc: denied { execstack } for pid=3014 comm="openvpn" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:openvpn_t:s0 tclass=process May 28 21:40:06 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 21:40:06 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.319:10): avc: denied { use } for pid=3010 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.319:11): avc: denied { use } for pid=3010 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.319:12): avc: denied { use } for pid=3010 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.382:13): avc: denied { execstack } for pid=3010 comm="openvpn" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:openvpn_t:s0 tclass=process May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.390:14): avc: denied { use } for pid=3012 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.390:15): avc: denied { use } for pid=3012 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.390:16): avc: denied { use } for pid=3012 comm="openvpn" name="null" dev=tmpfs ino=1396 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=fd May 28 21:44:26 srsblnfw01 kernel: audit(1180381461.390:17): avc: denied { execstack } for pid=3012 comm="openvpn" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:openvpn_t:s0 tclass=process May 28 22:18:52 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "use" access to /dev/null (pppd_t). For complete SELinux messages. run sealert -l 5701a4da-1d96-4c86-9747-e31b3d5d2219 May 28 22:18:52 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:18:52 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "use" access to /dev/null (pppd_t). For complete SELinux messages. run sealert -l 5701a4da-1d96-4c86-9747-e31b3d5d2219 May 28 22:18:52 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:26:00 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "use" access to /dev/null (pppd_t). For complete SELinux messages. run sealert -l 5701a4da-1d96-4c86-9747-e31b3d5d2219 May 28 22:26:00 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:26:00 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "use" access to /dev/null (pppd_t). For complete SELinux messages. run sealert -l 5701a4da-1d96-4c86-9747-e31b3d5d2219 May 28 22:26:00 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:42:03 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "use" access to /dev/null (pppd_t). For complete SELinux messages. run sealert -l 5701a4da-1d96-4c86-9747-e31b3d5d2219 May 28 22:42:03 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:42:03 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "use" access to /dev/null (pppd_t). For complete SELinux messages. run sealert -l 5701a4da-1d96-4c86-9747-e31b3d5d2219 May 28 22:42:03 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:42:05 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:42:05 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:56:42 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 May 28 22:56:42 srsblnfw01 setroubleshoot: SELinux is preventing /usr/sbin/openvpn (openvpn_t) "execstack" access to <Unknown> (openvpn_t). For complete SELinux messages. run sealert -l 0b738097-f92a-44c4-952b-7247d88a40e0 In Centos4 one could enable / disable SElinux for certain services using system-config-securitylevel. This is not possible anymore in Centos5. One can only either enable or disable SElinux completely. Any ideas how to fix the problem so that OpenVPN starts-up correctly during boot-up? Best regards, Bernd

2 1

HP DL380G4 with 4Gb RAM, how?
by Antonio da Silva Martins Junior 30 May '07

30 May '07

Hi, I'm installing CentOS5 on a HP DL380-G4 server with 4Gb RAM. It had SLES9 on it, and SLES9 find all the RAM. But now CentOS5 x86_64 can't find all the RAM. From free: [root@Suzuka ~]# free total used free shared buffers cached Mem: 3986376 1591996 2394380 0 113896 1180852 -/+ buffers/cache: 297248 3689128 Swap: 4194296 0 4194296 Can someone had a hint on where is the remaining memory? Thanks, Antonio. -- +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Antonio S. Martins Jr. - Support Analist | "Only The Shadow Knows | | Universidade Estadual de Maringá - Brasil| what evil lurks in the | | NPD - Núcleo de Processamento de Dados | Heart of Men!" | | E-Mail: asmartins(a)uem.br / shadow(a)uem.br | !!! Linux User: 52392 !!! | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -- Esta mensagem foi verificada pelo sistema de antiv�rus e acredita-se estar livre de perigo.

2 1

wich apc ups?
by Euroka 30 May '07

30 May '07

Hi, I want to buy a UPS wfor a PE2800 but I'm mnot sure wich one to choose. is 1000 VA enough or do I need the 1500 VA version? 1) APC Smart-UPS 1000 VA Black SMART UPS 1000 VA BLACK 1000 VA LINE-INTERACTIV [SUA1000I] 2) Power Supply Apc-ups 1500va Floorstand Incl Control Cable Usb And Com Port Output Power 980w Other suggestions are also welcome As long as they can talk to the apcd service of that centos 4.4 box. euroka

15 17

Desperate to upgrade from RedHat 9 to CentOS 4.4
by Andy Allen 30 May '07

30 May '07

I'm desperately trying to upgrade from RedHat 9 to CentOS 4.4, but the one thing that's really causing me problems is migrating from Evolution 1.2.2 (bundled with RedHat 9) to 2.0.2 (bundled with CentOS 4.4. When running Evolution 2.0.2 for the first time, with Evolution 1.2.2 folders and files in evolution folder in same partition, the automatic migration process starts up and seems to run OK, migrating all folders up to Sent folder successfully. Then disaster - it terminates fatally (error message "..quit unexpectedly..." - no indication of what the problem is). I've even thought about installing Evolution 1.2.2 in CentOS 4.4 (because it works OK for my purposes!), but there are too many problems with this - even though I have the Evolution 1.2.2 rpm, it won't install in CentOS because of missing packages. I really want to upgrade my main system to CentOS 4.4 for the improvements it offers over RedHat 9, but this email thing is a real sticking point at the moment. Is this a known problem or bug with the migration process - should I give up trying to do this, forget about all my previous email stuff and just start again with Evolution 2.0.2? Any suggestions please? Andy

5 4

Where to find RHDS (Red Hat Directory Server) ?
by Wei Yu 30 May '07

30 May '07

Hi! In the release notes it is said RHDS will replace OpenLDAP. However, I can only find OpenLDAP in CentOS5. I tried to google the web but it returned nothing useful. Does anyone know about this? Thanks. Regards, Wei Yu

5 17

Re: [Evolution] Desperate to upgrade from RedHat 9 to CentOS 4.4
by Andy Allen 30 May '07

30 May '07

Hi Pete, Thanks for the reply - I take your point! I'll try moving the Sent folder elsewhere as you suggest and see if that fixes the problem - great if it does. Andy On Wed, 2007-05-30 at 11:38, Pete Biggs wrote: > On Wed, 2007-05-30 at 11:19 +0100, Andy Allen wrote: > > I'm desperately trying to upgrade from RedHat 9 to CentOS 4.4, but the > > one thing that's really causing me problems is migrating from Evolution > > 1.2.2 (bundled with RedHat 9) to 2.0.2 (bundled with CentOS 4.4. > > The reason you aren't getting much help is because these versions are > ancient. The people who knew about them worked for Ximian, then Ximian > was bought by Novel, and the people who worked on Evolution at the time > have since been deployed elsewhere. > > > > > When running Evolution 2.0.2 for the first time, with Evolution 1.2.2 > > folders and files in evolution folder in same partition, the automatic > > migration process starts up and seems to run OK, migrating all folders > > up to Sent folder successfully. Then disaster - it terminates fatally > > (error message "..quit unexpectedly..." - no indication of what the > > problem is). > > Try moving the Sent folder from ~/evolution and see if it upgrades > everything successfully. Once you have the bulk of the system in place > you can import the Sent folder later - it is just an mbox file afterall. > > > > > I've even thought about installing Evolution 1.2.2 in CentOS 4.4 > > (because it works OK for my purposes!), but there are too many problems > > with this - even though I have the Evolution 1.2.2 rpm, it won't install > > in CentOS because of missing packages. I really want to upgrade my main > > system to CentOS 4.4 for the improvements it offers over RedHat 9, but > > this email thing is a real sticking point at the moment. > > Why don't you upgrade to CentOS 5 ? > > P. > > _______________________________________________ > Evolution-list mailing list > Evolution-list(a)gnome.org > http://mail.gnome.org/mailman/listinfo/evolution-list

1 0

The CentOS Project at Linux Tag 2007
by Johnny Hughes 30 May '07

30 May '07

LinuxTag 2007, the World's #1 Linux Expo and Conference, takes place in Berlin from the 30th of May until 2nd of June 2007. LinuxTag - since its beginning in 1996 - has been organized by a team of volunteers as a meeting point for Developers, commercial Linux Vendors and Users. This year's LinuxTag stands under the motto "Where .COM meets .ORG". The CentOS project will be represented at LinuxTag 2007 by four of our Core Development Team members (Lance Davis, Ralph Angenendt, Dag Wieers and Daniel De Kok) as well as by members of the CentOS community from Europe. The CentOS project will have a booth at LinuxTag (Booth 35 in Hall 12), where we will present our newest Release: CentOS 5. You can also see presentations about Xen, using CentOS 4.5 running inside of CentOS 5. Also some nice 3D graphics with compiz on the CentOS Desktop. We're open for discussions about our project, Enterprise Distributions in general and would like to answer any questions you have about our project. So if you are in Berlin and can attend LinuxTag - please feel free to join us at the CentOS booth. Website: http://www.linuxtag.org/2007/ Map: http://www.linuxtag.org/2007/en/besucher/ausstellung/gelaendeplan.html Hall 12 (CentOS is Booth 35): http://www.linuxtag.org/2007/fileadmin/linuxtag/downloads/besucher/Halle12.… Thanks, Johnny Hughes

2 1

Remote system up/down monitoring tool?
by tony＠softins.clara.co.uk 30 May '07

30 May '07

I have a small number of boxes in different locations, and currently have a fairly crude cron job running on each, which does a ping of one or more of the other boxes, and if the ping fails, it emails me to say the other box might be down. It then emails me again the next time the other box appears to be up. Of course, this can't distinguish between the remote box really being down and there being a network problem somewhere between the local and remote boxes. I've been mulling over the idea of a more sophisticated scheme, where a number of boxes send each other messages, indicating not only their presence, but which other boxes they believe to be up. Then if a box goes down, the other boxes all see it has gone and agree that it really is down. However, if there is instead a network outage or routing flap so that a box is reachable from some places but not all, it might be possible to distinguish this case. So my question is: does anyone know of an existing too that does this sort of thing? Cheers Tony -- Tony Mountifield Work: tony(a)softins.co.uk - http://www.softins.co.uk Play: tony(a)mountifield.org - http://tony.mountifield.org

8 9

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss