Discuss

discuss@lists.centos.org

1 participants
34753 discussions

Iptables - PREROUTING
by David González Romero 20 May '05

20 May '05

I have a server whit 2 interfaces of network, where eth0 is the interfaces connetc to internet and eth1 to the internal network. This server hace a Squid only, but i setting the iptables for protection to the server. Iptables run from script and in this script i setting the redirection for the other server in my internal network to port 80 and 443. I follow the diferent how to and many manual, but the redirect no work, the NAT POSTROUTING work and the squid work to. My DNS is Ok, because the consult whit dig command the answer is the assigned ip. Here put the copy of my script: --------------- Begin the Script #Delete Rules iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -t nat -F ## Modules install modprobe ip_tables modprobe ip_nat_ftp modprobe ip_conntrack_ftp ## FLUSH of Rules iptables -F iptables -X iptables -Z iptables -t nat -F ## Default policy iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -t nat -P PREROUTING ACCEPT iptables -t nat -P POSTROUTING ACCEPT ##Filter Begin ##Note: eth0 is the network interface connect to router and ## eth1 comnect to lan ## The localhost full iptables -A INPUT -i lo -j ACCEPT ## DROP the ping for eth0 iptables -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP ## All pack of router acept. iptables -A INPUT -i eth0 -s rango_ip/29 -d 0/0 -p all -j ACCEPT iptables -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.211/32 -p all -j ACCEPT ##Redirect server web iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 iptables -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT iptables -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT iptables -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT iptables -A FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT ## DNS Full. ACEPT. iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT ## SQUID iptables -A INPUT -p tcp -m tcp --sport 3128 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT iptables -A INPUT -p udp -m udp --sport 3128 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 3128 -j ACCEPT # Close range of port know iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p tcp --dport 1:1024 -j DROP iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p udp --dport 1:1024 -j DROP # Close the port of webmin iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p tcp --dport 10000 -j DROP ## FORWARD # Do log all forward iptables -A INPUT -j LOG --log-level info iptables -A OUTPUT -j LOG --log-level info iptables -A FORWARD -j LOG --log-level info ## Fnish of table FILTER ## General of MASQUERADE iptables -t nat -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE #iptables -t nat -A POSTROUTING -s 172.16.0.1/32 -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE ## Do forward to the interfaces of network # Enable of forwarding echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/iptables -L -n > /etc/sysconfig/show /usr/bin/less /etc/sysconfig/show -----------------------------End of Script The output of command "iptables -L -t nat" show me this: Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere anywhere tcp dpt:www to:172.16.0.3:80 DNAT tcp -- anywhere anywhere tcp dpt:https to:172.16.0.3:443 Some solution?? Regards, David _________________________________________ Tec. David Gonzalez Romero Network/System Administrator CNAP- Centro Nacional Áreas Protegidas Linux counter: 242534 _________________________________________ _________________________________________ Tec. David Gonzalez Romero Network/System Administrator CNAP- Centro Nacional Áreas Protegidas Linux counter: 242534 _________________________________________

2 1

centos-announce spam
by Maciej Zenczykowski 20 May '05

20 May '05

Could we please keep the centos-announce messages in the correct format? Not centos low 3 but low centos 3? Cheers, MaZe

4 3

Re: pronunciation? -- loving CentOS doesn't mean you have to bash Red Hat
by Bryan J. Smith <b.j.smith＠ieee.org> 20 May '05

20 May '05

From: Martyn Drake <martyn(a)drake.org.uk> > To be quite honest with you - that's been and gone so quickly I can't > ever remember what my position was at that time. It actually happened over the span of 2 years before any name change. With the introduction of RHEL as a separate product, RHL was having an identity crisis. It used to be that ".2" was the "enterprise release" (and they even sold SLAs as RHL6.2E), but now there was a 2nd product. Some suits insisted that RHL was still a product -- and some even viewed it as a "competiting" product. I noticed this first hand when RHL7.3, RHL8.0 and RHL9 were "missing" a few things that suddenly "reappeared" later with FC1. Most developers wanted the "shackles off" because RHEL was now the "SLA" product, and RHL was just the incubator for that product now. There was also the continuing nags from CompUSA and other resellers about selling a product that is outdated every 6 months. The result is that Red Hat Linux was deprecated to a project, no longer a product. Vendors largely stopped certifying on RHL after RHL7.3 as the announcements came that updates would only be released for 1 year. Then there were the other projects that added RPMs, etc... and all that finally came to a head in the grand re-design. > I seem to remember it had something to do with Progeny and them > supporting the releases as part of their transition solution. Had _nothing_ to do with Progeny. Progeny just decided to take advantage of the situation and offer $5/month subscriptions in the absence of RHN as of 2003Dec31 (RHL6.2-7.3 EOL) and 2004Apr31 (RHL8.0-9 EOL). Of course, anyone who follows Fedora Legacy knows that even RHL7.3 continued to have updates -- and more ".0" releases like RHL8.0 were dropped due to lack of popularity. > Usually I've gone down the route of using dedicated server providers > that can supply RHEL with the system. That's _exactly_ one of the markets Red Hat was tapping. Red Hat either wants system integrators to use Fedora Core and support their own, or buy RHEL and share the burden with them. > What prompted me to buy my own subscription was that there > were at least two providers that had issues with getting their > RHN satellites/proxies/whatever working and left the machine in > a potentially vunerable state if their install image was a fair a bit > old. That doesn't sound like a Red Hat issue, but a system integrator one. Furthermore, the system integrator _could_ have provided you a YUM repository in the meantime. > Again, I've no problems with this whatsoever. I just wish I could > have purchased a cheaper service with less frills. When Red Hat reaches the economies-of-scale that Microsoft does, then that will happen. But right now, Red Hat has to sell at a price point that is 10x that of Microsoft to get equivalent operating funds for just development. People forget economies of scale is everything. ;-> Most of Red Hat's move into the black came from their Cygnus purchase, and not sales. It wasn't until the subscription model later that they started making a profit atop of their already profitable developer/services unit that Cygnus bought them. > Yggdrasil was my first too. I then worked my way up to Caldera > (spit! spit! spit!) Why? Caldera was a _good_ company until May 2003 (2 months after the original lawsuit, prior to the addedum). Caldera bought SCO and was going to have a split Monterey/IA-64 and Linux/x86 solution. 20 days after the purchase, IBM pulled out of Monterey, yet started to sell their Monterey/Power platform (aka AIX 5L). IBM essentially _squashed_ a _good_ Linux company overnight because it wanted to be the _only_ dual-UNIX/Linux vendor. It saw Monterey/IA-64 (UnixWare 8) as a competitor so it squashed it while it could. Caldera-SCO tried to continue for 18 months, but their entire future was built on low-volume, but high-end sales of UnixWare 8 while their Linux volumes increased. The result was the March 2003 filing, one that I questioned at first, _until_ I read items #50-55. That's when I realized Caldera-SCO was suing for: A) Breach of Contract: Withholding Monterey/IA-64 B) Breach of Non-Compete: Developing Linux/IA-64 Caldera-SCO figured IBM would want the rights to UNIX(R), and IBM would settle in short order. When IBM didn't, they expanded the lawsuit and put up a "smokescreen." They want people to believe their various contractual disputes with IBM, Autozone, Chrysler, etc... are about Linux IP, when they have _no_ ground to stand on. So far, the gambit has worked, largely thanx to the rabid Linux populous who knows nothing about Monetery, and the fact that even the most pro-Linux company is _not_ IBM's friend if you threatened their Power/AIX platforms. Just ask IBM customers who can't buy Linux/x86-64 systems from IBM because IBM tries to sell them Power/AIX, and what IBM does to them if they buy HP Linux/x86-64 systems. ;-> I felt a bit vindicated when Ransom Love, co-founder of Caldera, came out in a Fall 2003 interview with eWeek and basically verified it was all about Monterey, and he didn't agree at all with the May 2003 change of strategy. What really scares me is if and when Caldera-SCO _does_ win on a few counts against IBM, that people will think Caldera-SCO has asserted IP rights on Linux. So far, in all the rulings, on anything Linux, Caldera-SCO has gone no where. But on anything having to do with IBM's Monterey dealings, and possibly "non-compete" violation in the Linux/IA-64 space, the rulings have gone Caldera-SCO's way. I'm afraid a ruling on "non-compete" terms with regard to Linux might be taken as a Linux IP by the media -- and that is very justified given the type of articles we have seen (short of Ransom's interview). To date, Red Hat, Sun and HP have donated about 10x as much in GPL than IBM. People scrutinize Sun for their non-GPL licenses, but don't seem to do the same of IBM -- who has several "non-GPL compatible" licenses on the _majority_ of their so-called "donations." It's like there is the "Linux Quiz Show" and people are tuning in for the money, not the substance. The $1B went to maturing IBM's product line, not Linux donations. The latest $100M is to port 100% proprietary IBM software to Linux, but not open source it. IBM is not our friend. Thank God Linus & co. have watched every donation into the kernel, and made sure no IP was attached (which has held up many of IBM's donations). > but found my footing and went over to Red Hat from that point > onwards. These days I help look after many render farm boxes > and workstations running a combination of Red Hat 7.2 and Fedora Core > 1. We're still converting to FC1 and it's a long and laborious > process given the number of machines that need updating. I adopted APT-RPM for all Red Hat Linux 7+ systems a long time ago. I largely use APT repositories for configuration management. On x86-64, I try to use APT-RPM, but when I need to load both i386 and x86_64 packages, YUM-RPM gets the call. > From that point we'll then going to have to look at 64bit support. YUM-RPM does an outstanding job. My only complaint is that Red Hat stupidly doesn't put the i386 version of Firefox in its repositories alongside the x86_64 packages (it does both for Mozilla though). > Much of our needs are dictated by the software we run, and our > vendors will only support certain distributions. Which is why Studio > Linux http://www.studio-linux.org was born. Why not base it on Fedora Core x86-64? That's one of the things that I'm seeing in Fedora Core like Debian. Instead of just forking from Red Hat Linux never to return (such as Caldera, Mandrake, SuSE, etc... did), people are now forking, but returning to Fedora Core as a base for the next version. That's largely how Debian-based distros work too. > Difficult since we don't have CompUSA here in the UK ;) Or whatever superstores you do have. > The last time I saw a shrink-wrapped Red Hat anything was back in the > days of RH 7, 8 and 9. I even bought some of them to support Red Hat. I have Red Hat Professional Workstation from both RHEL 2.1 and 3. They renamed it (and added volume licenses) the Red Hat Desktop to get the IT media to stop mis-quoting Tiemann that Red Hat _never_ left the desktop. > I'll be good. Has nothing to be with "being good." ;-> I just find that people have an intrinsic feeling that they must define their choice in not only a like of their choice, but a dislike for another. It's not only self-defeating, but many times the facts are not correct. Or my personal favorite, I've seen people state things about Red Hat that actually affect their distro too. I've just seen far too many bugs listed as "Fedora Core-only" when they have been Linux 2.6, Parted, GRUB, cdrecord, etc... issues. -- Bryan J. Smith mailto:b.j.smith@ieee.org

5 5

mplayer repository for CentOS
by Adrian Coman 20 May '05

20 May '05

Hi, Is there a CentOS yum repository for mplayer&dependencies? Thanks, Adrian

2 1

CentOS-announce Digest, Vol 3, Issue 10
by centos-announce-request＠centos.org 20 May '05

20 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:238 Low CentOS 3 ia64 evolution - security update (Pasi Pirhonen) 2. CESA-2005:238 Low CentOS 3 s390(x) evolution - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Thu, 19 May 2005 21:33:00 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:238 Low CentOS 3 ia64 evolution - security update To: centos-announce(a)centos.org Message-ID: <20050519183300.GI13577(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CEBA-2005:238 https://rhn.redhat.com/errata/RHSA-2005-238.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/evolution-1.4.5-14.ia64.rpm updates/ia64/RPMS/evolution-devel-1.4.5-14.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

What I miss in yum.conf
by Petr Klíma 20 May '05

20 May '05

Is there an chance how to include an package from "checking" of repository? I can do exclude, but especialy from so big repositories as DAG I want include just a that few which are interesting for me. Is there any way how to do it? [dag] name=Dag RPMs for RHEL-3 exclude=mozilla* baseurl=http://apt.sw.be/redhat/el3/en/$basearch/dag -- Petr Klíma JIHOMILK a.s. Rudolfovská 246/83 370 50 České Budějovice Czech Rpublic phone: +420 389 136 209 e-mail: petr.klima(a)jihomilk.cz

4 3

Timezone Configuration
by kracker 20 May '05

20 May '05

Greetings All, How to does one go about reconfiguring centos's time zone configuration (to the eastern time zone (us)), via the command line? I have tested other GNU/Linux distribution's documentation, tools, files and relevant details with centos and have thus far been unable to find a compatible solution. My apologies if my question is very simple, I have done a fair amount of searching on the subject but have yet to find the command or text file which to use to achieve my goal. Also, I am using Centos 4 (C4) Respectfully, //kracker Sole: Dumb This Down

4 6

OT mod_security
by Franki 19 May '05

19 May '05

Hi guys, I've planning out my upgrade to CentOS4 and one of my plans for security is to impliment the mod_security apache module to filter out unwanted malicious intent. Not having used it before, I wanted to see if anyone here has implimented it and did it block any legit traffic or cause resource traffic/serious slowdowns of their systems? I've asked on the forum about secure virtual hosting and have considered many options but what I have decided on is a combination of vsftp/TLS to chroot users and mod_security to reduce the risk of outside intrusion attempts via HTTP. Is mod_security available as a package on CentOS4/RHEL4 ? I found packages for 3 but thus far none for 4. many thanks rgds Franki

4 6

Re: [CentOS] RE: pronunciation? -- loving CentOS doesn't mean you have to bash Red Hat
by Bryan J. Smith <b.j.smith＠ieee.org> 19 May '05

19 May '05

From: Martyn Drake <martyn(a)drake.org.uk> > When I did try that support, it didn't give me a favourable > impression. However, that's just my opinion. It's good enough that HP is losing lots of clients because HP (among other tier-1 OEMs short of IBM) is finding that Linux their support is sub-par. Even Dell and others are just farming support out to Red Hat. > Others wil no doubt have really benefitted from it. What I really > needed was the errata and updates rather than support, The Fedora Core and Legacy do a fine job for several years. Just not 5+ years like RHEL or SLES. Other than the Debian Project, I've yet to see another distro break 2 years of support. Red Hat used to support the last ".2" for a long time. Unfortunately, by RHL7, they got very popular. Companies where standardizing on ".1" and even, gasp, ".0" relesaes. At one point Red Hat was supporting Red Hat Linux 6.2, 7[.0], 7.1, 7.2, 7.3, 8.0 and 9 _simultaneously_. That was overkill and a waste. I like the current Core-Legacy strategy now. Basically the latest 2 versions are supported as "current," and the Legacy team supports the most popular of the old versions. Companies who want more than 1 year of guaranteed updates on any arbitrary version can now pay for it. > and an overall better overall lifecycle that RHEL promises and indeed, > delivers. I could have gone down the Fedora route, but wasn't too > thrilled with it's overall lifecycle. How was it any different than when Red Hat announced it would no longer support Red Hat Linux more than 1 year _well_before_ the Fedora Project was announced or Red Hat Linux became Fedora Core? I honestly don't blame Red Hat for not wanting to simultaneously support 6-7 revisions simultaneously. Dead beat companies who want to standardize on a release for 2+ years should pay for it. Those of us who either "keep current" _or_ use a very stable/popular release (e.g., Red Hat Linux 7.3, or Fedora Core 1) can stick with Fedora Legacy instead. > I'm a non-commercial user (but neither a charity or educational > establishment) and that $300 per year is a lot of money to pay for a > stable and constantly updated OS. You are paying for subscription, not a license. If you don't want the subscription, run a stable version of Fedora Core that will be supported by Fedora Legacy for a long time. That's what I do with my Fedora Core 1 systems. > You could argue I could use Debian or some other free distribution, Debian, like Fedora, is supported on contributors, in addition to the commercial companies that put paid development on it. Fedora Core is still primarily developed by Red Hat because Red Hat Enterprise Linux's stability is based on it. As such, a lot of Fedora Legacy packages are released by people at Red Hat along side RHEL package releases (although they are often in "testing" because it's up to the community to support them). I have no problem with this sub-1 year "official" support model, and it was announced well before the "name change." Red Hat got tired of expecting people them to support their free product for 3+ years. > but having been a Red Hat Linux user for many years it's what I know > best and feel the most comfortable around. You're talking to someone who started on Yggdrasil and, later, Slackware, and has been installing Red Hat Linux on corporate networks for more than just web services since Red Hat Linux 4.2. I have installed both RHEL as well as RHL/FC at financial companies. I've put a lot of Fedora Core into pilot production, and then when SLAs were required, we switched to RHEL. FC also makes a great "next RHEL generation" evaluation platform, and thanx to Fedora Core 2/3 deployments, many of my clients were able to evaluate how RHEL 4 would operate well in advance. > Now I didn't actually mind PAYING for RHEL, of course not, but I just > find they need to find a sweet spot price for those that may not need > the install/configuration support (like me), Haven't you see the $99 Red Hat Professional Workstation / Red Hat Desktop at your local CompUSA? It's RHEL WS in a shrink wrap package. > or the SLAs, but want the lifecycle the product delivers and the stability > it offers. Is $340 per year worth it for that? Actually, subscriptions are just $179/year. I haven't checked to see if it's only $99 for people who buy the retail shrink-wrapped version at CompUSA or other superstores. > I was paying ï¿½65 a year for the RHN for the last available versions of > the Red Hat Linux and that suited me just fine. That price is now > ï¿½184, and includes features I don't actually need or want. Again, check out your local CompUSA and look for the shrink wrapped version of RHEL WS for $99. ;-> As Michael Tiemann said (and was mis-quoted), at the volume right now, it is cheaper to give away their time in developing Fedora Core and not charging for it than to make a boxed product like Red Hat Linux. The expectations of support at the volume they sell is just not worth their bother. It's cheaper to give away Fedora Core and support it for less than a year, even if they still put people on Fedora Legacy and release updates for longer than that based on popularity and testing support (which they leave to the community). And I don't blame them. > Of course CentOS has now came along, and that's meeting my needs just > fine. Hence why I'm more than happy to make the odd donation when I can. And that's great! But just don't feel the need to demonize Red Hat at the same time. > I'm not bashing Red Hat. Bashing Red Hat would be something along the > lines of "Red Hat sucks; they've done nothing for the community; > they're just another greedy organisation" which would be wrong on all > accounts. Red Hat is also a business and needs to be profitable like > any other business. I recognise that. I also recognise what they've > done for the community as well. They are a good company. Okay. But don't make statements like the one you did then. ;-> > I'm sorry to have come across 'bashing' Red Hat. Not my intention, > most definately. Understood. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Re: [OT] FOSS or Freedomware? -- WAS: pronunciation/Red Hat
by Bryan J. Smith <b.j.smith＠ieee.org> 19 May '05

19 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > MUCH more FOSS oriented I've been taking an informal survey on this for awhile now. I know the new, official acronym is Free and Open Source Software (FOSS). But even before that acronym was popular, I had long argued that Stallman's insistence on calling it "Free Software" when that could be confused with "Freeware" or, worse yet, "Shareware" was a disseervice. I liken that problem to people who like to use the term "Hacker" in general, even though the original term was used to designate someone of creative or other technical skill. "Open Source" doesn't dictate that the source code is free of IP either. And the whole term "open" is overused, especially when people are thinking of "Open Systems" (at least one major Microsoft executive had an entire interview when he confused "Open Source" with "Open Systems") and people argue standards. Which is why I like the term, which I have been using for a long time, of "Freedomware." It conveys that it isn't free of cost, while conveying that it is freedom from many things in the way that at least Americans (if not many others) typically understand -- not always positive either. I actually have a slew of license categorizations on a 2D plot against source and standards: - Freedomware (open source, open standard) - Standardware (proprietary source, open standard) - Sourceware (open source, proprietary standard**) - Commerceware (proprietary source, proprietary standard) **NOTE: E.g., IP or other requirements. I like to differentiate between vendors who adhere to open standards but with proprietary source. E.g., I call the nVidia "nvidia" driver as "Standardware" because it is a standard GLX implementation. I also want to differentiate between "good" vendors who maintain proprietary standards over time, because they value their customers and their own property, and those who purposely don't even maintain internal, proprietary standards, and purposely change file formats regularly, and incompatibily. The former I call "Commerceware." The later is what I call intentional Hostageware: - Hostageware (unmaintainable source, unmaintainable standard) Any software can become Hostageware. If it is unmaintained, eccentric, etc..., that's a risk to the data contained in/produced by the software. Open Source doesn't necessarily mean Open Standard, or that the software will be a common standard. There are a lot of Open Source programs out there with eccentric formats. So any software is really about mitigating risk and not some philosophical non-sense. And I find that sells much better to clients than anything. And most seem to like the term Freedomware too. Because freedom can be both great, and a burden at the same time. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss