Discuss

discuss@lists.centos.org

1 participants
34730 discussions

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

--- Chris Mauritz <chrism(a)imntv.com> wrote: > The original poster was after a 54mbit wifi card and so > far, all of the > recommendations have been for 11mbit cards. Not true, the WG511 that I recommended is a 54mbit card. > I'd also be > interested if > anyone has positive things to say about any readily > available 54mbit > wifi cards + CentOS/Linux. > > Cheers, > > C > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Lee Parmeter Emperor, linXos - The Flying Penguin http://www.linXos.com Linux Registered User #337161 'It's free. It works. Duh.'" - Eric Harrison The United States is NOT a democracy, it was founded as a Republic! God is not a republican or a democrat nor is His government a democracy! - Lee Parmeter __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Michael 24 May '05

24 May '05

Greetings: I'm just installed Centos-4 on an IBM T-21 laptop. So far so good. Now I'd like to pop in a wireless lan adapter. I'm looking at a buying a Linksys WPC54G adapter (although I haven't done so yet). After doing some searching, it looks like the best way to get this card working is via ndiswrapper [http://ndiswrapper.sourceforge.net] and then to use Windoze drivers. So I downloaded ndiswrapper and during the install, I received a warning message referring to "4K Stacks" and that NOT disabling 4k stacks can cause some drivers to crash. The docs went on to suggest I recompile the kernel to disable CONFIG_4KSTACKS. Question: For really like to stick to the stock CentOS-4 kernel and not create/use a custom one. Has anyone had a problem using the Linksys WPC54G Cardbus adapter + Centos-4 and NOT had to use a custom kernel? For that matter, since I haven't purchased the card yet, can I get a recommendation or two about a workable wlan cardbus (g) adapter that could most likely be found at Best Buy/CompUSA/Fry's ? I'd like to be able to easily return the card if things don't work... I did some searching a decent card and it seems that a number of good wlan chipsets are discontinued or hard to find, so I'm slightly confused as to what to get. Thank you. Michael Chinn

2 1

RealPlayer on CentOS 4
by Hugh Tollan 24 May '05

24 May '05

Any ideas folks?? have installed RealPlayer10GOLD on CentOS 4, I have tried to uninstall it with the rpm -e command but I am being told it doesn't exist...when I try to download it again I am told that it is already installed! many thanks in advance _________________________________________________________________ Want to block unwanted pop-ups? Download the free MSN Toolbar now! http://toolbar.msn.co.uk/

4 4

Release date for 3.5
by User Lists 24 May '05

24 May '05

Hi all, Somebody knows when centos 3.5 will be released?? Thank you very much. _________________________________________________________ Do You Yahoo!? Información de Estados Unidos y América Latina, en Yahoo! Noticias. Visítanos en http://noticias.espanol.yahoo.com

2 1

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > I still disable it though 'cause its a real pain.... Yes, because it's new, the defaults are immature, and the majority of both developers and system administrators don't know much about it. So disable it and let others deal with it if the want to. You have that choice. ;-> But by making it the standard in its EL4 line (including FC2+, with changes in FC3+ which RHEL4 inherited), it forces everyone to start learning it, start reporting good defaults, and get it adopted as a standard by everyone. Red Hat does this all-the-time, and doesn't blink when people start screaming about compatibility because it really only does it when it's really, really a necessary adoption. ;-> As I said before, one person I really feel for is Jorg. The guy is "on-the-ball" with POSIX developments, and reguarly gets chastized for breaking compatibility to do so -- especially when some implementations (e.g., GNU Tar) were non-standard in the first place! ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Ted Kaczmarek <tedkaz(a)optonline.net> > Thanks for the excellent post, no defense experience but dealing with > the street side for quite a while now. I've worked at banks where the developers put the same routines for "ATM withdrawl" in the same scope and access as the "back-end debits/credits." Their same attitude is, "oh, the system is secured by others." And when you don't give up, they are arguing, "oh, it'll push back the release date." Some go as far as talking to management to get an override. And then they _really_hate_you_ when you modify their code and show how easy it is to actually make sure software, or implement MACs at the system-level that do the same thing (but is incompatible with the software). In a nutshell, there are a lot of coders out there that believe their software and routines should access the entire system, no restrictions. Although UNIX is typically better than Windows, largely because Microsoft's application division still writes code for "Chicago" (including MS IE to date), there are still cases where I can't trust it. And I definitely need to make sure a compromise of one component is well outside the access and scope of a more critical item it uses. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Feizhou <feizhou(a)graffiti.net> > What is really needed is the ability to limit access to a file on a per > user account basis (acls), not by locking down via a group permission. And that's POSIX's ACLs, c/o the "Austin Group" work of the IEEE POSIX committee circa 2001 and the X/Open Single UNIX Specification (SUS) version 3. XFS on Linux has had POSIX ACL support since day one (using its own codebase), and it's largely XFS's GPL contributions (and direct port from Irix, unlike IBM who ported JFS from OS/2 and not AIX) to kernel 2.6 (POSIX ACL's were standardized as of the 2.5.3 development branch, thanx largely to SGI). Ext3 has had a varied history in the 2.4.x timeframe, and even Red Hat gave up on them in Red Hat Linux 8.0 until kernel 2.6 in FC2+. But even POSIX ACLs are _still_ Discretionary Access Controls (DAC), atop of the legacy UNIX DACs we're all used to. They just augment discretionary control, and don't solve the MAC problem. MAC limits you, not augments you with delegation, on purpose.. People tend to hate MAC when they are first presented with the conepts, because they expect them to work like DAC. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > As you have pointed out it restricts the security granularity of the > system, which in turn will lead to other "work arounds" to achieve > better granlarity and those work arounds will ultimately lead to > sloppiness, making Johns point very valid indeed. First off, SELinux is _optional_ on a system-wide basis. Secondly, SELinux does not have to affect various services, different distros are free to ship different defaults. Third, in typical Red Hat fashion, they adopt "new technologies with good practices/standards" all-the-time. We have to thank for forcing us back to the GNU C Libraries and an ANSI C++ compiler which has drastically improved run-time/binary compatibility. Lastly, Red Hat, like many others, actually stick to standards. I very much dislike when people complain about "compatibility issues" when all someone is trying to do is "get back to the standard" or "be compliant with the new, universal standard." E.g., several GNU projects -- from GCC 2.x's non-ANSI C++ implementation (and especially the entire, multi-yser GCC 2.9.x "beta" merge of GCC 2.x and EGCS) to GNU Tar through 1.13 -- were forks from standards. And when people finally forced the issue of standards compliance, they get chastized. Heck, one of the people I will always appreciate is Jorg, who has gotten reamed left and right on cdrtools, star, etc... He's probably one of the best Linux developers leading full POSIX 2001 compliance (adding all the new IEEE/SUS "Austin Group" developments in various programs). Now SELinux isn't a half-bad design by the NSA and others. Linux sorely needed MAC and, to a lesser extent, Role Based Access Controls (RBAC) as it's "legacy-only" UNIX access controls was not only falling behind NT, but even most proprietary UNIX flavors. But, again, it's _optional_. Turn if off if you wish, but I think it's about time a distro offered it, and attempted some secure defaults. It is not "sloppy" or "broken," just immature in application of defaults yet -- especially since both developers and sysadmins are not used to it being enabled. So how SELinux any different than any other shift-adoption in Red Hat's history? Now my background is largely in defense with several years in financial (which is, ironically, a major overlap in systems/network accounting, as well as crypto, etc...). And a lot of my job has been to go around and ensure developers and integrators are adhering to security standards. And I'm not just one of those "complainy" types either -- because I'm also a software engineer who regularly refutes the "I have to have root" or "we have to do this" non-sense right back in their own language. Especially when such cases are not really a security issue, but an engineering workflow issue in the first place. E.g., an software engineering development system -- even with run-time and/or target on the same system -- should _never_ be designed so the development, run-time and/or target have full control of the system. All should be sandboxed in different ways so it's very easy for the developer to tear down and rebuild the run-time/target from the development tools. If not, then the development environment is incomplete. I don't know how many times I've seen engineers (and I'm one of them too, so I know how they think) waste time fighting a system mis-configuration they introduced because their development, run-time and/or target environments are not finite and contained. They believe they need full root on the system when they don't. And damn do I hate it when the network admins get on my case because someone put a NIC in permisciuous mode -- the engineer shouldn't even be able to do that! With that said, the person who said that he's worked on Classified Networks and said MAC is not a requirement needs to be re-briefed. Access controls are _always_ implemented, and if a system is unable to conform to the required standard, there is a variance or other exception, and the risk must be mitigated _and_ an "effective enough" manual procedure implemented. I _explicitly_ used the term "accountable" because there are two types of Classified Information -- "non-accountable" (typically US DoD "Confidential" and most "Secret") and then their are "accountable" (various, higher classifications). You can typically get away with common variances and other exceptions with minimal, additional manual accounting for "non-accountable." But any automation helps. When it comes to "accountable," MAC/RBAC really helps a crapload -- and the NSA really "got the ball rolling" for Linux, which was really necessary. As far as financial networks, don't even get me started. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > > On Tue, 2005-05-24 at 08:08, Micha Silver wrote: > > > > > > The best thing to do is add this to /etc/selinux/config > > > > > > SELINUX=disabled > > > > > > And then get on with the real jobs.... > > > > > > > Listening to all the pros and cons of SELinux. > > I'd like to improve the security of our regional web server > using SELinux. > > We have a main regional web site and several virtual > domains, kept up by > > private users, all on the same server. Some of the private > users want to run > > php and database apps on their websites. Up till now I > steered away from > > allowing users to run anything on their sites, since a > breakin to any > > private virtual domain would endanger the whole http > process, including the > > main regional site. I'm preparing to switch over to a new (CentOS 4) > > machine, and I thought to set up a different SELinux > context for each > > virtual domain, so that a vulnerability in someones private > web site would > > be isolated and not be able to crash the other domains. > > Is this achievable *without* SELinux?? > > The simple-minded way has always been to run a separate http > instance bound to a different port or IP address, running as > a different user. If you only have one IP address and need > to appear to be on port 80, you can arrange this with a > virtualhost on the main server that uses proxypass or a > rewriterule that results in a proxy connection to the server > running under the other uid. > Thanks Les, With several virtual domains, setting each up on a separate port with rewrite rules, and running several httpd processes under different UIDs would quickly become not so "simple-minded" Regards, Micha > --- > Les Mikesell > lesmikesell(a)gmail.com > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos >

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > The best thing to do is add this to /etc/selinux/config > > SELINUX=disabled > > And then get on with the real jobs.... > Listening to all the pros and cons of SELinux. I'd like to improve the security of our regional web server using SELinux. We have a main regional web site and several virtual domains, kept up by private users, all on the same server. Some of the private users want to run php and database apps on their websites. Up till now I steered away from allowing users to run anything on their sites, since a breakin to any private virtual domain would endanger the whole http process, including the main regional site. I'm preparing to switch over to a new (CentOS 4) machine, and I thought to set up a different SELinux context for each virtual domain, so that a vulnerability in someones private web site would be isolated and not be able to crash the other domains. Is this achievable *without* SELinux?? Thanks, Micha

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss