Discuss

discuss@lists.centos.org

5 participants
34752 discussions

RE: [CentOS] How to create a secure user only for ssh login?
by King, John (Greg) (LMIT-HOU) 14 Jun '06

14 Jun '06

One way is the wheel group in /etc/group. Uncomment the following line in /etc/pam.d/su: auth required /lib/security/$ISA/pam_wheel.so use_uid Uncommenting this line allows only the users in the wheel group to become root by using the su command and entering the root password. All other users will receive a message stating the password is incorrect. You will also want to create the wheel group in /etc/group and add users to it if it does not exist (CentOS 4 I know does but some older redhat implementations did not if I recall correctly). I am unsure of how this interacts with sudo though. If you allow users to use sudo command, make sure they cannot 'sudo su root'. -Greg > -----Original Message----- > From: centos-bounces(a)centos.org > [mailto:centos-bounces@centos.org] On Behalf Of M. Fioretti > Sent: Wednesday, June 14, 2006 11:57 AM > To: centos(a)centos.org > Subject: [CentOS] How to create a secure user only for ssh login? > > Hello, > > I've read on several howtos that one way to make ssh more secure, or > at least reduce the damage if somebody breaks in, is to NOT allow > direct ssh login from root, but allow logins from another user. So you > have to know two passwords in order to do any real damage. > > Does this make sense? IF yes, what is the right way to create an user > only for this purpose, that is one that can only login to give me a > local prompt to become root, but has no privilege, no possibility to > create files, or do anything at all? > > TIA, > Marco > > -- > Marco Fioretti mfioretti, at the server mclink.it > Fedora Core 3 for low memory http://www.rule-project.org/ > > Don't you wish you had more energy... or less ambition? > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos >

1 0

RE: [CentOS] Tape drive throughput
by Bowie Bailey 14 Jun '06

14 Jun '06

Joshua Gimer wrote: > Bowie Bailey wrote: > > I have a backup spooling onto a DLT drive. Is there any tool that > > will let me monitor the data throughput on the device? > > You can use iostat which is part of the sysstat package. > > yum install sysstat > > You can set up an interval and a count and have it redirected to a > file for later reference > > iostat 10 20 >> filename Now why didn't I think of that? :) It doesn't appear to be able to show me the tape device directly, but I can get a pretty good idea from watching the disk reads since this system isn't doing anything else at the moment. Thanks. -- Bowie

1 0

RE: [CentOS] Tape drive throughput
by Bowie Bailey 14 Jun '06

14 Jun '06

Bowie Bailey wrote: > I have a backup spooling onto a DLT drive. Is there any tool that > will let me monitor the data throughput on the device? Based on all of the conversation this question generated, it sounds like the answer is "no". Interesting discussion, tho. :) Thanks for all the suggestions. -- Bowie

3 2

Re: [CentOS] Restoring data from disk w/ messed up partition tables
by techlists＠comcast.net 14 Jun '06

14 Jun '06

Unfortunately, I do *not* remember the original partition settings. I was hoping to find a live CD that could fix such disasters (i.e. systemrescueCD, or some such thing). I did find a Windows based program that's supposed to do the trick. The evaluation edition lets you see if it can see your lost data; you have to buy it ($79) to actually be able to recover the data. This was at: http://www.stellarinfo.com/linux-data-recovery.htm I'm sure there must be an open source trick somewhere that should work though. Paul -------------- Original message ---------------------- From: "William L. Maltby" <BillsCentOS(a)triad.rr.com>

4 4

Cleaning Up My Process Table
by Michael B Allen 14 Jun '06

14 Jun '06

I'm upgrading my primary server from RH 7.2 to CentOS-4.3.ServerCD. I REALLY like the ServerCD. Who needs all the fluff that comes with a standard distro? If I want a system-config-gooey I can run Xnest [1] and ssh -X from my laptop. Anyway I have two questions: 1) How can I collectively stop all the NFS, portmap, whatever? I'm hoping it can be manipulated as a group because occationally I actually will want to use NFS. 2) Can I safely turn off dbus, hal, and/or xfs? Or will something really bad happen if I try to run the system-config-gooey's without them? Thanks, Mike [1] Although I haven't managed to figure out how to run it without -ac. PID TTY STAT TIME COMMAND 1 ? S 0:00 init [3] 2 ? SN 0:00 [ksoftirqd/0] 3 ? S< 0:00 [events/0] 4 ? S< 0:00 \_ [khelper] 5 ? S< 0:00 \_ [kacpid] 16 ? S< 0:00 \_ [kblockd/0] 26 ? S 0:00 \_ [pdflush] 27 ? S 0:00 \_ [pdflush] 29 ? S< 0:00 \_ [aio/0] 1055 ? S< 0:00 \_ [kauditd] 1095 ? S< 0:00 \_ [kmirrord] 1096 ? S< 0:00 \_ [kmir_mon] 17 ? S 0:00 [khubd] 28 ? S 0:00 [kswapd0] 103 ? S 0:00 [kseriod] 178 ? S 0:00 [kjournald] 980 ? S<s 0:00 udevd 1115 ? S 0:00 [kjournald] 1743 ? Ss 0:00 syslogd -m 0 1747 ? Ss 0:00 klogd -x 1774 ? Ss 0:00 portmap 1793 ? Ss 0:00 rpc.statd 1819 ? Ss 0:00 rpc.idmapd 1883 ? S 0:00 /usr/sbin/smartd 1892 ? Ss 0:00 /usr/sbin/acpid 1903 ? Ss 0:00 cupsd 1956 ? Ss 0:00 /usr/sbin/sshd 2482 ? Ss 0:00 \_ sshd: root@pts/0 2484 pts/0 Ss 0:00 \_ -bash 2650 pts/0 R+ 0:00 \_ ps fax 1977 ? Ss 0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid 1992 ? SLs 0:00 ntpd -u ntp:ntp -p /var/run/ntpd.pid 2001 ? Ss 0:00 crond 2022 ? Ss 0:00 xfs -droppriv -daemon 2039 ? Ss 0:00 /usr/sbin/atd 2048 ? Ssl 0:00 dbus-daemon-1 --system 2058 ? Ss 0:00 hald 2087 tty1 Ss+ 0:00 /sbin/mingetty tty1 2092 tty2 Ss+ 0:00 /sbin/mingetty tty2 2093 tty3 Ss+ 0:00 /sbin/mingetty tty3 2094 tty4 Ss+ 0:00 /sbin/mingetty tty4 2095 tty5 Ss+ 0:00 /sbin/mingetty tty5 2096 tty6 Ss+ 0:00 /sbin/mingetty tty6 2625 ? Ssl 0:00 /usr/sbin/named -u named -t /var/named/chroot -- Michael B Allen PHP Extension for SSO w/ Windows Group Authorization http://www.ioplex.com/

4 3

changing the eye candy on the default screensaver
by Larry Vaden 14 Jun '06

14 Jun '06

Has anyone already worked out the files involved in changing from the rather pedestrian screensaver to some more pleasing eye candy like Fedora Core 5 uses? thnx/ldv

3 5

Simple backup program
by Bowie Bailey 14 Jun '06

14 Jun '06

I am looking for a simple backup program that I can use to backup a CentOS box to a local tape drive. Hopefully someone here can give me a recommendation. This is what I need: - Simple launching of manual backups (preferably from the command line) - Ability to span tapes for a large backup - Proper treatment of hardlinked files - Notification via email or similar when it is ready for the next tape. I tried mondo-rescue, but decided against it after it spent 4 hours just trying to index the files (it never actually started the backup). I am considering Amanda, but the setup is a bit complex and, based on the docs, the tape spanning capability isn't the best. Anyone have any suggestions? I would think that there would be a simple program out there to backup and restore from tape without all of the extra scheduling and indexing features. -- Bowie

6 5

DELL openmanage question
by Robin Mordasiewicz 14 Jun '06

14 Jun '06

Has someone created a how to or a tutorial for installing/configuring DELL openmanage on centos ? --

5 8

SSL fingerpring mismatch and issuer certificate problem
by M. Fioretti 13 Jun '06

13 Jun '06

I have a remote server running centos 4.3 and a home desktop running suse 10.1. I have generated an SSL certificate on the server, copied it on the desktop and run on the desktop: >openssl x509 -in mynewcertCert.pem -fingerprint -subject -issuer -serial -hash -noout >c_rehash . getting this warning: > > Doing . > WARNING: mynewcertPrivateKey.pem does not contain a certificate or CRL: skipping > mynewcertCert.pem => 2764d17c.0 Now I have noted two things: 1) the fingerprint generated from the openssl command above is different when I run it on centos or on suse 10.1. Why? 2) if I run fetchmail here with these options: I get: fetchmail: 6.3.2 querying my.remote.server (protocol POP3) at Tue 13 Jun 2006 07:22:34 PM CEST: poll started fetchmail: Issuer Organization: The M Zone fetchmail: Issuer CommonName: my.remote.server fetchmail: Server CommonName: my.remote.server fetchmail: my.remote.server key fingerprint: the one obtained running openssl on the server fetchmail: my.remote.server fingerprints match. fetchmail: Server certificate verification error: unable to get local issuer certificate 26227:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:894: fetchmail: SSL connection failed. fetchmail: socket error while fetching from m-mail(a)fm.vm.bytemark.co.uk What is the "local issuer" problem? What am I missing? Is it a consequence of problem 1) ? What is happening, and what must I do to use this certificate? TIA, Marco -- Marco Fioretti mfioretti, at the server mclink.it Fedora Core 3 for low memory http://www.rule-project.org/ I don't even have an email address. I have reached an age where my main purpose is not to receive messages. U. Eco, quoted in the New Yorker

1 1

Restoring data from disk w/ messed up partition tables
by techlists＠comcast.net 13 Jun '06

13 Jun '06

I had the electricity go out the other day. When my Centos 4.3 workstation came up, I said yes when it got to the prompt "Unclean shutdown, force filesystem check?" prompt. It ground away for awhile and then said something about a bad superblock. Yikes! I thought, that's a bad sign. After a reboot, I got nothing but a grub> prompt. I tried booting into rescue mode using the install CD, and got a message "No valid partitions found". I tried to mount /dev/hda, and got a message "no /etc/fstab found". I tried running the install CD, and went into Disk Druid to see if it could see any existing partitions on the drive, and got the message "Partition table corrupted, must re-initialize disk, and reformat". Not a good sign. I backed out at that point, not wanting to go beyond a point of no return. I have about 4 years of archived e-mails, and some other misc stuff on that drive that I don't want to lose. Anyone have any suggestions what steps to take next? Paul

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss