Discuss

discuss@lists.centos.org

3 participants
34748 discussions

Re: About strongs passwords! -- PAM
by Bryan J. Smith <b.j.smith＠ieee.org> 13 May '05

13 May '05

From: israel.garcia(a)cimex.com.cu > 1. My users have to work on the shell because, they run a C++ > scritp to work in tha database.. If it's just 1 or 2 scripts, consider limiting access to programs with another shell and/or a web or other front-end that only lets them launch a specific process. > 2. So I want to force my users to pick a strong password.. Is there some > command, tool to do this? Actually, modifying PAM rules are highly recommended for this. So it not only does it for a single program, but all programs that change the password. But ideally, you should consider _not_ using passwords for SSH. You should enable either public key authentication or Kerberos. It increases security ten-fold because the actual communication sent is a challenge -- i.e., a one-time, random password that is not good ever again. In the case of public key authentication, you'll want to use passphrases, and enforce strong rules on those. The passphrases protect the private key on the client, which you never want to store whole. You'll need to research how to enforce that with "ssh-keygen" and the local "/etc/ssh/*config*" on each system where they are using the SSH client. If you're really anal, you can use smart cards. Then no system ever has even the private key. It's actually easier to setup for SSH than most people think. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Re: [CentOS] Mini-centOS
by Bryan J. Smith <b.j.smith＠ieee.org> 13 May '05

13 May '05

From: Doug Koobs <dkoobs(a)dkoobs.com> > If it helps any, I'm running CentOS4 on an old PII 400Mhz, 192MB laptop. Under > Gnome, it's not exactly snappy, but it is usable. Unser XFCE4.2, i'm quite ahppy > with it. I know you stated that you need Gnome, and I also prefer it. But if you > haven't tried some of the lightweight alternatives, give them a shot, you may be > surprised. The nice thing about XFCE is that it is a _total_ session+file+window solution, like KDE and GNOME. And if you don't like XFCE's session+file managers, you can always use Rox-Filer (which works flawlessly with XFCE's xfwm window manager). > Intereating article about the new lightweight Windows OS. There's _no_ such thing on the retail shelf or in volume Windows license. Unless you link from the _Embedded_ NT/2000/XP releases, you can't "unlink" all sorts of crap that "leeches" on the NTkernel, GDI, etc... These so-called "lightweight" Windows OS releases are nothing more than some things not bundled. It's a 100% marketing gimmick. Unfortunately, "Chicago"-designed MS IE is required by all apps since the mid-'90s, which is the crux of the resource and, more relevantly, security in the current bastardization of Win32 we call NT5.1 (XP/2003). So it's hard to get rid of if you run anything that was developed with Visual Studio. It's really sad. Some Windows architects are really sharp guys, but the "applications" developers still develop like NT is DOS7 "Chicago" -- assuming the world is safe and users have full access over the system. No wonder Marc left for Google! > However, I don't think it will meet your needs, as it will be extremely crippled, > to the point it won't even run MS Office if I read correctly. Depends on what is left out. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] Mini-centOS
by kenkensmile＠netscape.net 13 May '05

13 May '05

Chris Mauritz <chrism(a)imntv.com> wrote: >kenkensmile(a)netscape.net wrote: > >>I am using centOS for my server and centOS is extremely stable. I almost love centOS more than my wife. However, centOS is a bit heavy to run on my notebook (P III 1G, 256MB RAM). I need gnome, firefox, openoffice, realplayer, gaim, acrobat and thunderbird on my notebook, but if I install all of them (plus base-system), my notebook becomes very slow. I wish I could have a lighter version of centOS for notebooks and old desktops. Is there any project that I could have a mini-centOS in the future??? >> >> >> > > >The slowness isn't really CentOS's fault. That's not really enough >memory for an X+gnome environment if you're going to be running piggy >applications like openoffice. Also, I suspect an older P3 notebook >probably has rather slow video hardware which may make things seem worse >than they really are. The best thing you can do to speed things up is >to bump your memory up to 512mb. I suspect that will make a big >difference in perceived speed. > >Cheers, > >C > Thanks for the reply. Yes, you are exactly right. My notebook has a slow video hardware(8MB). Unfortunately, I cannot upgrade memory up to 512MB, because 256MB is the maximum capacity. I have also found an article that MS is making a new OS for old computers, so I just simply thought I would like to have a mini-centOS. http://news.com.com/2100-1016_3-5705456.html Cheers, Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

5 4

Re: [CentOS] About strongs passwords!
by israel.garcia＠cimex.com.cu 13 May '05

13 May '05

Message: 5 Date: Thu, 12 May 2005 08:41:20 -0400 From: Matt Hyclak <hyclak(a)math.ohiou.edu> Subject: Re: [CentOS] About strongs passwords! To: centos(a)centos.org Message-ID: <20050512124120.GB5989(a)math.ohiou.edu> Content-Type: text/plain; charset="us-ascii" On Thu, May 12, 2005 at 08:35:03AM -0500, israel.garcia(a)cimex.com.cu enlightened us: > List, It's amazing the soon the messages on this list are answered, I am > glad and I want to thank you all for that... > > Here is my question, I have a DataBase CentOS server working with about > 150 users connected via ssh, so I want to set up for all users strongs > passwords, I mean, 8 or more caracters, with ,.;* , ect....... Is there > some option, bash command which do that? > Great, but: 1. My users have to work on the shell because, they run a C++ scritp to work in tha database.. 2. So I want to force my users to pick a strong password.. Is there some command, tool to do this? Regards, Israel The mkpasswd command included in the expect RPM can generate them for you. A little shell scripting will change the passwords for the users. Matt

2 1

When .. isnt the same? (not a problem
by Ulrik S. Kofod 13 May '05

13 May '05

I dont understand why ".." isnt working the same way for "ls" and "cd" when inside a symbolic link. The reason I ask is that I made a link to a directory with some scripts that saves output in "../output.txt" and I could not find the output until I found that ".." isnt the directory you see when you do a $pwd. I solved the problem by making a directory and then make a link to each script in there. I would just like to know: 1) if there is a good reason to this behaviour. 2) if there is a rule, so you know when ".." is level up from $ pwd and when it is one level up from the link target. 3) if there is an alternativ way to point to the parent directory. Personally I can't see why you would ever need ".." to be one level up from the link target. Example: $ ln -s /home link_to_home; cd link_to_home $ ls .. bin dev home lib misc $ cd ..;ls link_to_home Have a nice weekend Ulrik -- This message has been scanned for viruses and dangerous content by OpenProtect(http://www.openprotect.com), and is believed to be clean.

2 1

RE: [CentOS] When ".." isn't the same? (not a problem
by Marc Powell 13 May '05

13 May '05

> -----Original Message----- > From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On > Behalf Of Maciej Zenczykowski > Sent: Friday, May 13, 2005 9:19 AM > To: CentOS mailing list > Subject: RE: [CentOS] When ".." isn't the same? (not a problem > > > I believe I understand what you're describing and it's been a long time > > since I've had this 'issue' but if I remember correctly, it's a function > > of your shell, which I believe is going to be bash. It tries to be > > intelligent about its symlink handling. It remembers the cd path you > > used to get to that symlink and 'cd ..' sends you back the same way you > > got in. It basically treats symlinks as real directories, not pointers. > > This can be very useful but it can also be annoying. I'll bet if you use > > tcsh, which uses a more literal interpretation of the file-structure, it > > would work as you expect. I wasn't ever interested in it enough to see > > if it could be disabled in bash. > > I believe the proper option is -P as in "set -P" in bash to disable this > feature (IMHO very useful). Indeed -- -P If set, the shell does not follow symbolic links when executing commands such as cd that change the current working directory. It uses the physical directory structure instead. By default, bash follows the logical chain of directories when performing commands which change the current directory. -- Marc

1 0

Apache config for Squirrelmail?
by James B. Byrne 13 May '05

13 May '05

This is my corrected configuration file for squirrelmail over ssl if anyone is interested: # squirrelmail.conf 2005 May 13 James B. Byrne JBB8 # # SquirrelMail is a webmail package written in PHP. # This configuration file forces users to connect via SSL # # If the incoming request is already https:// then this # file will only be processed if the directive: # # Include /etc/httpd/conf.d/squirrelmail.conf # # is appended to ssl.conf for the default server or added # to the virtual host configuration file of the virtual # host used to process webmail. Note that ssl requires # IP addressed virtual hosts to work and that the necessary # Listen directives must be placed in the appropriate # configuration files as well. # Alias /webmail /usr/share/squirrelmail <Directory /usr/share/squirrelmail> AllowOverride None Options ExecCGI Order allow,deny Allow from all </Directory> RewriteEngine on RewriteLog "/var/log/httpd/rewrite_log" RewriteLogLevel 0 # AIDE-MEMOIRE # Arguments $1, $2 etc. refer to () matches in the # CURRENT RewriteRule line. # Arguments %1, %2 etc. refer to () matches in the # LAST matched RewriteCond. # Do not process established ssl squirrelmail sessions RewriteCond %{HTTPS} on RewriteCond %{REQUEST_URI} ^/webmail(/?|/.*)$ RewriteRule (^.*$) - [L,R] # Rewrite short form URLs whether SSL or not for forms # webmail.anything.dom and www.webmail.anything.dom RewriteCond %{HTTP_HOST} ^(www\.)?(webmail\.)(..+\.)(..+)$ [NC] RewriteCond %{REQUEST_URI} !^/webmail/ RewriteRule (^.*$) https://webmail.%3%4/webmail/ [L,R] # Force SSL otherwise RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} ^/webmail(/?|/.*)$ RewriteCond %{HTTP_HOST} ^(.*\.)?(..+\.)(..+)$ [NC] RewriteRule (^.*$) https://webmail.%2%3/webmail/ [L,R] #EOF -- *** e-mail is not a secure channel *** mailto:byrnejb.<token>@harte-lyne.ca James B. Byrne Harte & Lyne Limited vox: +1 905 561 1241 9 Brockley Drive fax: +1 905 561 0757 Hamilton, Ontario <token> = hal Canada L8E 3C3

1 0

RE: [CentOS] When ".." isn't the same? (not a problem
by Marc Powell 13 May '05

13 May '05

> -----Original Message----- > From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On > Behalf Of Ulrik S. Kofod > Sent: Friday, May 13, 2005 2:25 AM > To: centos(a)centos.org > Subject: [CentOS] When ".." isn't the same? (not a problem > > I don't understand why ".." isn't working the same way for "ls" and "cd" > when inside > a symbolic link. The reason I ask is that I made a link to a directory > with some > scripts that saves output in "../output.txt" and I could not find the > output until I > found that ".." isn't the directory you see when you do a $pwd. I solved > the problem > by making a directory and then make a link to each script in there. > > I would just like to know: > 1) if there is a good reason to this behaviour. > 2) if there is a rule, so you know when ".." is level up from $ pwd and > when it is > one level up from the link target. > 3) if there is an alternativ way to point to the parent directory. > I believe I understand what you're describing and it's been a long time since I've had this 'issue' but if I remember correctly, it's a function of your shell, which I believe is going to be bash. It tries to be intelligent about its symlink handling. It remembers the cd path you used to get to that symlink and 'cd ..' sends you back the same way you got in. It basically treats symlinks as real directories, not pointers. This can be very useful but it can also be annoying. I'll bet if you use tcsh, which uses a more literal interpretation of the file-structure, it would work as you expect. I wasn't ever interested in it enough to see if it could be disabled in bash. -- Marc

2 1

Re: Mini-centOS -- static libraries, XFCE
by Bryan J. Smith <b.j.smith＠ieee.org> 13 May '05

13 May '05

kenkensmile(a)netscape.net wrote: > However, centOS is a bit heavy to run on my notebook (P III 1G, 256MB > RAM). I need gnome, firefox, openoffice, realplayer, gaim, acrobat and > thunderbird on my notebook, but if I install all of them (plus base- > system), my notebook becomes very slow. I wish I could have a lighter > version of centOS for notebooks and old desktops. CentOS isn't the issue, but your application selection. In fact, I have a 4 year-old Toshiba Satellitte 2805-S402 with a P3-850MHz, 256MB of RAM that runs Fedora Core 3 just fine -- with _full_ GNOME. OpenOffice 1.x, Acrobat and RealPlayer have their own, statically-linked widget-sets. I'm sure that's massively bloating the memory footprint. Consider switching to OpenOffice 2.0 [betas] (natively GTK+ now I believe?), HelixPlayer (GTK+ based) with the RealPlayer libraries added (HelixPlayer is from Real, and the new RealPlayer is Helix+non-free libs). As far as Acrobat 7, I'm not sure, but I think it's still statically linked Motif. But that leaves only one application that is not native. I don't leave Acrobat running, which really saves me. As far as GNOME, you do _not_ need to run GNOME session with nautilus and metacity (GNOME 2.x file/window) to get full GNOME compatibility. Run XFCE session with xffm and xfwm (XFCE file/window) and you'll see your footprint go way down. Shortly after Fedora Core 2 (what I call "RHCL4.0") was introduced with XFCE as a new, 3rd session/file/window standard option, which RHEL4 inherited its selection, I remember Alan Cox boasting he was running it on a WinChip2 225MHz with only 48MB of RAM. XFCE is GTK+ based, but much, much lighter than a full GNOME environment, while being 100% GNOME compatible at the same time. Johnny Hughes wrote: >It won't get much faster if you choose those products :) As I mentioned, OpenOffice 2.0 and the new HelixPlayer are far more "native" in their libraries. OpenOffice 2.0 is in beta and HelixPlayer should (?) be included in FC3/RHEL4, and it's simply a matter of adding the non-free libraries which turns it into RealPlayer. I have to give Real a "thank you" for doing everything they could to make their offering to the community. >There is XFCE-4.2 that you could install instead of GNOME or KDE Well, you typically want to install XFCE _along_with_ GNOME, so it can use GNOME components when necessary. But just have the user (as well as system for new users) default to XFCE. XFCE takes some getting used to, but it's definitely worth it for older systems. >If you want to change permanently ... do: >switchdesk XFCE That's the 1 command I make sure I let _everyone_ know when they are installing FC/RHEL on any new system and memory is going to be limited. I really tire of the "Red Hat is bloated" comments, especially as of FC2+. Yes, you _do_ need a i686 class (PPro, K6, M2), but that's more to do NPTL and other details than "bloat." You can make Fedora-based distros as "lean" or as "bloated" as you want. And it's only going to get better in the future with more Fedora development and a YUM-integrated installer. > You can get a minimum install by doing a minimal install from > anaconda ... Yet another excellent recommendation that I see people forget about. 600MB of everything you should need to get using the system. In actuality, there is also a really, really "lean" 90MB install that you can do from any FC2+ distro, but not from Anaconda. > then doing: > yum groupinstall XFCE-4.2 "X Window System" "Office/Productivity" > then install the individual things you want via yum... > I'll do that on a test box and tell you how much space it is :) With that said, I've seen no less than 5 YUM GUIs. What does everyone like? -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

CentOS-announce Digest, Vol 3, Issue 6
by centos-announce-request＠centos.org 13 May '05

13 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:412-01: Moderate CentOS 2 i386 openmotif security update (John Newbigin) 2. CEBA-2005:428 BUG fix CentOS 3 ia64 bonobo-activation - bug fix update (Pasi Pirhonen) 3. CEBA-2005:428 BUG fix Centos 3 s390(x) bonobo-activation - bug fix update (Pasi Pirhonen) 4. CEBA-2005:428 BUG fix CentOS 3 i386 bonobo-activation - bug fix update (Tru Huynh) 5. CEBA-2005:428 BUG fix CentOS 3 x86_64 bonobo-activation - bug fix update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Fri, 13 May 2005 09:58:58 +1000 From: John Newbigin <jnewbigin(a)ict.swin.edu.au> Subject: [CentOS-announce] CESA-2005:412-01: Moderate CentOS 2 i386 openmotif security update To: centos-announce(a)centos.org Message-ID: <4283EDC2.9070508(a)ict.swin.edu.au> Content-Type: text/plain; charset=us-ascii; format=flowed The following errata for CentOS-2 have been built and uploaded to the centos mirror: RHSA-2005:412-01 Moderate: openmotif security update Files available: openmotif-2.1.30-13.21AS.5.i386.rpm openmotif-devel-2.1.30-13.21AS.5.i386.rpm More details are available from the RedHat web site at https://rhn.redhat.com/errata/rh21as-errata.html The easy way to make sure you are up to date with all the latest patches is to run: # yum update -- John Newbigin Computer Systems Officer Faculty of Information and Communication Technologies Swinburne University of Technology Melbourne, Australia http://www.ict.swin.edu.au/staff/jnewbigin ------------------------------ Message: 2 Date: Fri, 13 May 2005 06:23:26 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CEBA-2005:428 BUG fix CentOS 3 ia64 bonobo-activation - bug fix update To: centos-announce(a)centos.org Message-ID: <20050513032326.GO13577(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CEBA-2005:428 https://rhn.redhat.com/errata/RHBA-2005-428.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/bonobo-activation-2.2.2-1.2E.ia64.rpm updates/ia64/RPMS/bonobo-activation-devel-2.2.2-1.2E.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss