Discuss

discuss@lists.centos.org

3 participants
34748 discussions

RealPlayer on CentOS 4
by Hugh Tollan 25 May '05

25 May '05

Any ideas folks?? have installed RealPlayer10GOLD on CentOS 4, I have tried to uninstall it with the rpm -e command but I am being told it doesn't exist...when I try to download it again I am told that it is already installed! many thanks in advance _________________________________________________________________ Want to block unwanted pop-ups? Download the free MSN Toolbar now! http://toolbar.msn.co.uk/

4 4

Release date for 3.5
by User Lists 24 May '05

24 May '05

Hi all, Somebody knows when centos 3.5 will be released?? Thank you very much. _________________________________________________________ Do You Yahoo!? Información de Estados Unidos y América Latina, en Yahoo! Noticias. Visítanos en http://noticias.espanol.yahoo.com

2 1

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > I still disable it though 'cause its a real pain.... Yes, because it's new, the defaults are immature, and the majority of both developers and system administrators don't know much about it. So disable it and let others deal with it if the want to. You have that choice. ;-> But by making it the standard in its EL4 line (including FC2+, with changes in FC3+ which RHEL4 inherited), it forces everyone to start learning it, start reporting good defaults, and get it adopted as a standard by everyone. Red Hat does this all-the-time, and doesn't blink when people start screaming about compatibility because it really only does it when it's really, really a necessary adoption. ;-> As I said before, one person I really feel for is Jorg. The guy is "on-the-ball" with POSIX developments, and reguarly gets chastized for breaking compatibility to do so -- especially when some implementations (e.g., GNU Tar) were non-standard in the first place! ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Ted Kaczmarek <tedkaz(a)optonline.net> > Thanks for the excellent post, no defense experience but dealing with > the street side for quite a while now. I've worked at banks where the developers put the same routines for "ATM withdrawl" in the same scope and access as the "back-end debits/credits." Their same attitude is, "oh, the system is secured by others." And when you don't give up, they are arguing, "oh, it'll push back the release date." Some go as far as talking to management to get an override. And then they _really_hate_you_ when you modify their code and show how easy it is to actually make sure software, or implement MACs at the system-level that do the same thing (but is incompatible with the software). In a nutshell, there are a lot of coders out there that believe their software and routines should access the entire system, no restrictions. Although UNIX is typically better than Windows, largely because Microsoft's application division still writes code for "Chicago" (including MS IE to date), there are still cases where I can't trust it. And I definitely need to make sure a compromise of one component is well outside the access and scope of a more critical item it uses. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Feizhou <feizhou(a)graffiti.net> > What is really needed is the ability to limit access to a file on a per > user account basis (acls), not by locking down via a group permission. And that's POSIX's ACLs, c/o the "Austin Group" work of the IEEE POSIX committee circa 2001 and the X/Open Single UNIX Specification (SUS) version 3. XFS on Linux has had POSIX ACL support since day one (using its own codebase), and it's largely XFS's GPL contributions (and direct port from Irix, unlike IBM who ported JFS from OS/2 and not AIX) to kernel 2.6 (POSIX ACL's were standardized as of the 2.5.3 development branch, thanx largely to SGI). Ext3 has had a varied history in the 2.4.x timeframe, and even Red Hat gave up on them in Red Hat Linux 8.0 until kernel 2.6 in FC2+. But even POSIX ACLs are _still_ Discretionary Access Controls (DAC), atop of the legacy UNIX DACs we're all used to. They just augment discretionary control, and don't solve the MAC problem. MAC limits you, not augments you with delegation, on purpose.. People tend to hate MAC when they are first presented with the conepts, because they expect them to work like DAC. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > As you have pointed out it restricts the security granularity of the > system, which in turn will lead to other "work arounds" to achieve > better granlarity and those work arounds will ultimately lead to > sloppiness, making Johns point very valid indeed. First off, SELinux is _optional_ on a system-wide basis. Secondly, SELinux does not have to affect various services, different distros are free to ship different defaults. Third, in typical Red Hat fashion, they adopt "new technologies with good practices/standards" all-the-time. We have to thank for forcing us back to the GNU C Libraries and an ANSI C++ compiler which has drastically improved run-time/binary compatibility. Lastly, Red Hat, like many others, actually stick to standards. I very much dislike when people complain about "compatibility issues" when all someone is trying to do is "get back to the standard" or "be compliant with the new, universal standard." E.g., several GNU projects -- from GCC 2.x's non-ANSI C++ implementation (and especially the entire, multi-yser GCC 2.9.x "beta" merge of GCC 2.x and EGCS) to GNU Tar through 1.13 -- were forks from standards. And when people finally forced the issue of standards compliance, they get chastized. Heck, one of the people I will always appreciate is Jorg, who has gotten reamed left and right on cdrtools, star, etc... He's probably one of the best Linux developers leading full POSIX 2001 compliance (adding all the new IEEE/SUS "Austin Group" developments in various programs). Now SELinux isn't a half-bad design by the NSA and others. Linux sorely needed MAC and, to a lesser extent, Role Based Access Controls (RBAC) as it's "legacy-only" UNIX access controls was not only falling behind NT, but even most proprietary UNIX flavors. But, again, it's _optional_. Turn if off if you wish, but I think it's about time a distro offered it, and attempted some secure defaults. It is not "sloppy" or "broken," just immature in application of defaults yet -- especially since both developers and sysadmins are not used to it being enabled. So how SELinux any different than any other shift-adoption in Red Hat's history? Now my background is largely in defense with several years in financial (which is, ironically, a major overlap in systems/network accounting, as well as crypto, etc...). And a lot of my job has been to go around and ensure developers and integrators are adhering to security standards. And I'm not just one of those "complainy" types either -- because I'm also a software engineer who regularly refutes the "I have to have root" or "we have to do this" non-sense right back in their own language. Especially when such cases are not really a security issue, but an engineering workflow issue in the first place. E.g., an software engineering development system -- even with run-time and/or target on the same system -- should _never_ be designed so the development, run-time and/or target have full control of the system. All should be sandboxed in different ways so it's very easy for the developer to tear down and rebuild the run-time/target from the development tools. If not, then the development environment is incomplete. I don't know how many times I've seen engineers (and I'm one of them too, so I know how they think) waste time fighting a system mis-configuration they introduced because their development, run-time and/or target environments are not finite and contained. They believe they need full root on the system when they don't. And damn do I hate it when the network admins get on my case because someone put a NIC in permisciuous mode -- the engineer shouldn't even be able to do that! With that said, the person who said that he's worked on Classified Networks and said MAC is not a requirement needs to be re-briefed. Access controls are _always_ implemented, and if a system is unable to conform to the required standard, there is a variance or other exception, and the risk must be mitigated _and_ an "effective enough" manual procedure implemented. I _explicitly_ used the term "accountable" because there are two types of Classified Information -- "non-accountable" (typically US DoD "Confidential" and most "Secret") and then their are "accountable" (various, higher classifications). You can typically get away with common variances and other exceptions with minimal, additional manual accounting for "non-accountable." But any automation helps. When it comes to "accountable," MAC/RBAC really helps a crapload -- and the NSA really "got the ball rolling" for Linux, which was really necessary. As far as financial networks, don't even get me started. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > > On Tue, 2005-05-24 at 08:08, Micha Silver wrote: > > > > > > The best thing to do is add this to /etc/selinux/config > > > > > > SELINUX=disabled > > > > > > And then get on with the real jobs.... > > > > > > > Listening to all the pros and cons of SELinux. > > I'd like to improve the security of our regional web server > using SELinux. > > We have a main regional web site and several virtual > domains, kept up by > > private users, all on the same server. Some of the private > users want to run > > php and database apps on their websites. Up till now I > steered away from > > allowing users to run anything on their sites, since a > breakin to any > > private virtual domain would endanger the whole http > process, including the > > main regional site. I'm preparing to switch over to a new (CentOS 4) > > machine, and I thought to set up a different SELinux > context for each > > virtual domain, so that a vulnerability in someones private > web site would > > be isolated and not be able to crash the other domains. > > Is this achievable *without* SELinux?? > > The simple-minded way has always been to run a separate http > instance bound to a different port or IP address, running as > a different user. If you only have one IP address and need > to appear to be on port 80, you can arrange this with a > virtualhost on the main server that uses proxypass or a > rewriterule that results in a proxy connection to the server > running under the other uid. > Thanks Les, With several virtual domains, setting each up on a separate port with rewrite rules, and running several httpd processes under different UIDs would quickly become not so "simple-minded" Regards, Micha > --- > Les Mikesell > lesmikesell(a)gmail.com > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos >

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > The best thing to do is add this to /etc/selinux/config > > SELINUX=disabled > > And then get on with the real jobs.... > Listening to all the pros and cons of SELinux. I'd like to improve the security of our regional web server using SELinux. We have a main regional web site and several virtual domains, kept up by private users, all on the same server. Some of the private users want to run php and database apps on their websites. Up till now I steered away from allowing users to run anything on their sites, since a breakin to any private virtual domain would endanger the whole http process, including the main regional site. I'm preparing to switch over to a new (CentOS 4) machine, and I thought to set up a different SELinux context for each virtual domain, so that a vulnerability in someones private web site would be isolated and not be able to crash the other domains. Is this achievable *without* SELinux?? Thanks, Micha

2 1

CentOS-announce Digest, Vol 3, Issue 13
by centos-announce-request＠centos.org 24 May '05

24 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:435 Important CentOS 3 ia64 mozilla - security update (Pasi Pirhonen) 2. CEEA-2005:434 Important CentOS 3 ia64 - centosplus firefox security update (Pasi Pirhonen) 3. CESA-2005:434 Important CentOS 4 i386 firefox - security update (Johnny Hughes) 4. CESA-2005:434 Important CentOS 4 x86_64 firefox - security update (Johnny Hughes) 5. CESA-2005:435 Important CentOS 4 i386 mozilla - security update (Johnny Hughes) 6. CESA-2005:435 Important CentOS 4 x86_64 mozilla - security update (Johnny Hughes) 7. CESA-2005:435 Important CentOS 3 s390(x) mozilla - security update (Pasi Pirhonen) 8. CESA-2005:435-01: Important CentOS 2 i386 mozilla security update (John Newbigin) 9. CEEA-2005:434 Important CentOS 3 s390(x) - centosplus firefox security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 May 2005 15:09:44 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:435 Important CentOS 3 ia64 mozilla - security update To: centos-announce(a)centos.org Message-ID: <20050523120944.GE1929(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2005:435 https://rhn.redhat.com/errata/RHSA-2005-435.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/mozilla-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-chat-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-dom-inspector-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-js-debugger-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-mail-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-devel-1.7.8-1.1.3.1.centos3.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

Betr.: [CentOS] VPN
by Thom van der Boon 24 May '05

24 May '05

IF you are not stuck to IPSec, you might want to take a look at OpenVPN (www.openvpn.org) I found OpenVPN easier to install than FreeSWAN (an IPSEC VPN) and have setup an OpenVPN solution between my German office and our mainoffice in a matter of hours. Thom van der Boon E-Mail: Thom.van.der.Boon(a)vdb.nl ===== Thom.H. van der Boon b.v. Havens 563 Jan Evertsenweg 2-4 NL-3115 JA Schiedam Tel.: +31 (0)10 4272727 Fax: +31 (0)10 4736620 E-Mail: info(a)vdb.nl Home Page: http://www.vdb.nl/ >>> simone72(a)email.it 23.05.2005 18:18:56 >>> Hi list, I am trying to create a VPN between two different locations. On the first location we have a cisco pix 525 Natting the internal 192.168.100.x network, while on the second location we have a Centos3 box Natting via iptables the internal 192.168.10.x netowrk. My goal is to connect this 2 over the internet via IPsec. I created the IPsec Net2Net via the network configuration graphic tool, and I configured the cisco following the howto http://www.johnleach.co.uk/documents/freeswan-pix/freeswan-pix.html . From my understanding, I should have an ipsec0 network device showing up, so that I could route all traffic from 192.168.10.x directed to 192.168.100.x through it. The thing is that when I try to ifup ipsec0 I get the following errors: modprobe: modprobe: Can't locate module ripemd160 modprobe: modprobe: Can't locate module cast128 modprobe: modprobe: Can't locate module lzs modprobe: modprobe: Can't locate module lzjh So, after googling and reading a lot with no success, I would like to ask for advice on this, and successfull story :). I really need to have this VPN running, and I am not tied to this one solution only, linux-to-linux VPN, openVPN or anything else you could suggest would be great. Thanks in advice Simone _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

5 9

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss