Discuss

discuss@lists.centos.org

2 participants
34758 discussions

Start a nNew thread

Mod_radius_auth for apache?
by Eero Volotinen 27 Apr '16

27 Apr '16

Any package with srpm available for radius auth on apache? Eero

1 0

Re: [CentOS] Bourne shell deprecated?
by Gordon Messmer 27 Apr '16

27 Apr '16

On 04/27/2016 05:20 AM, Joerg Schilling wrote: > While older versions of the Bourne Shell are not POSIX compliant, recent > versions only miss the feature "arithmetic expansion" and are otherwise > probably closer to POSIX than bash or dash. Note that "dash" does not support > multi-byte characters and thus cannot be certified for a full UNIX system but > only for embedded UNIX systems. That's good to know. But, since there seem to be several forks of Bourne shell, currently, is there a reference for the differences between them? > As far as I can see, this was related to "mailx" and not to the shell. I looked for substantiation of the original claim that the bourne shell had security problems. Apparently I should have looked closer. Thanks for catching that.

1 0

Semi-OT: very weird vi behaviour
by m.roth＠5-cent.us 27 Apr '16

27 Apr '16

This is weird. As in, *deeply* weird. I ssh as root from one box to another (there are keys involved), and I go to vi a file, such as # line 1 # # line 2 # # line 3 # line 4 And what I see in vi is # line 3 # line 4 BUT, if I scroll the cursor over each line with the arrow key... I see all four lines. I've also looked at another file, and same thing. Just checked it out on the server I ssh'd in from, and no problem. And now, I just ssh'd in from another windows, same way... and the weirdness isn't there. Anyone have any clues as to what's going on with that one session? mark file

6 7

Re: [CentOS] Apache/PHP Installation - opinions
by m.roth＠5-cent.us 27 Apr '16

27 Apr '16

Alice Wonder wrote: > On 04/27/2016 01:21 AM, Brandon Vincent wrote: >> On Wed, Apr 27, 2016 at 1:10 AM, Rob Kampen <rkampen(a)kampensonline.com> wrote: >>> Sounds good, but how many domain MX servers have set up these >>> fingerprint keys - 1%, maybe 2%, so how do you code for that? I guess I'm thinking >>> it uses it if available. So even if you do post it on your DNS, how many clients out there are using DANE on their set up? By the time it becomes more than a tiny % and generally useful, it will be in CentOS 8. It >>> also requires certificates to be implemented more ubiquitously than at present - although we do now have affordable solutions, so this one may resolve >>> more quickly. >> > Security and Privacy on the Internet are both severely broken. > > If you read the white papers from when the Internet was first being designed, security was rarely even mentioned. <snip> Just as a point of information, when those RFCs were written, the Internet was *only* for US gov't, and selected research and educational organizations, and NO ONE else. The open 'Net only came in in the nineties - so security wasn't broken and insecure, back then there was physical security and careful selection as to who was allowed on, at all. mark

3 3

Re: [CentOS] Bourne shell deprecated?
by m.roth＠5-cent.us 27 Apr '16

27 Apr '16

Scott Robbins wrote: > On Tue, Apr 26, 2016 at 07:27:26PM -0700, Alice Wonder wrote: >> >> Some of the BSDs use to have a bourne shell and maybe some do, I don't know. >> > Yup. > >> bash is mostly compatible with bourne (can run most bourne scripts) which is why /bin/sh is a symlink to /bin/bash on GNU and most other *nix systems. > > Bash can run Bourne, but not necessarily vice versa, which can be problematic if, say, moving a Linux script to a BSD or AIX box. I remember something I'd done which used, IIRC, $UID, without realizing it was a bashism, instead of using id -u. I'll also note that all *production* scripts were once required to be bourne, but by the mid-ninties, management was starting to mandate that they be Korn shell, instead, for many reasons - capabilities, etc. Bash - I don't think I saw that till I started running RH 5.1, I think it was, about 18 years ago.... mark

2 1

Apache/PHP Installation - opinions
by Tim Dunphy 27 Apr '16

27 Apr '16

Hey guys, I tend to work on small production environments for a large enterprise. Never more than 15 web servers for most sites. But most are only 3 to 5 web servers. Depends on the needs of the client.I actually like to install Apache and PHP from source and by hand. Although I know that's considered sacrilege in some shops. I do this because on RH flavored systems like CentOS the versions of Apache, php and most other software are a little behind the curve in terms of versions. And that's intentionally so! Because the versions that usually go into the various repos are tested and vetted thoroughly before going into the repos. I like to use the latest, stable versions of apache and php for my clients without having to create a custom RPM every time a new version comes out. So what I'd like to know is it better in your opinion to install from repos than to install by source as a best practice? Is it always better to use puppet, chef, ansible etc even if the environment is small? I'm sure this is a matter preference, but I would like to know what your preferences are. Thanks, Tim Sent from my iPhone

10 17

DNSSEC / Security stats (forked from php thread)
by Alice Wonder 27 Apr '16

27 Apr '16

I don't have a source, I'd have to dig through my browser history, but I looked at some of these stats just last month. Roughly 2% of the top 1000 domains in the United States had deployed DNSSEC - which I *think* is double what it was a year ago. Roughly 7% of ISP recursive DNS servers enforce DNSSEC. Comcast does and Google's public DNS does. Those are the big ones that enforce DNSSEC on their recursive servers. I do not see any statistics for DANE adoption, either on port 443 or port 25 (the two where it is most common currently) Roughly 20% of all e-mail traffic in the United States was not encrypted. Of the e-mail traffic that was not even encrypted, a large percentage of it was spam. What wasn't spam was often sent by scripting languages (e.g. php) running blogs or other web services. Only a small percentage of e-mail sent by clients through a SMTP server was not encrypted in the MTA to MTA transfer. -=-=- What we can do as sysadmins, we can run unbound on our local machines, it defaults to DNSSEC enforcing. That way we don't have to worry if the recursive resolver our ISP uses is part of the 7%. Linode enforced last time I checked, but I don't know about other hosting services. Still safer to just run unbound listening only on the localhost, and configure /etc/resolv.conf to point to ::1 (or 127.0.0.1) If at all possible, deploy DNSSEC on any zones you have control over. Even without DANE, DNSSEC greatly improves security for the 7% (and growing) recursive resolvers that enforce DNSSEC. Before deploying DNSSEC do a lot of reading on it, because if you screw it up, those 7% enforcing recursive resolvers won't resolve your zone. I personally use a 2048-bit KSK and a 1024-bit ZSK. The KSK is what you have to get the DS record for uploaded to your TLS, and it should be rotated once a year. The ZSK is just in your zone, best practice says to rotate once a month but I rotate once a week, every Sunday. It should be automated, so it doesn't hurt to do it more often than the once a month. Doing it once a week means if my zone signing server is down or under DDoS when the signing happens, it isn't a big deal, because it happens 4X the best practices recommended anyway. With our web applications that send e-mail, don't use the SMTP services of the scripting language. Yes it is cool that you can play SMTP server with PHP etc. and yes, if PHP is built against a TLS library it can encrypt, but don't use PHP to play SMTP. Run postfix on the web server and have your web applications connect to the SMTP on the local host. This isn't just for the benefit of encrypting, it also lets you do things like sign the message with DKIM and if your postfix is new enough, check the DANE records of the MX record the message is being sent to. I don't know why so many web applications try to play SMTP themselves, it is a very bad habit and usually results in mail being sent without TLS and sometimes rejected by spam filters if the domain it allegedly comes from uses DKIM but the web application doesn't. -=-=- Hope I didn't bore too many people, or offend anyone, these are just my opinions and this is a topic I am passionate about. I think system administrators need to do a better job at securing Internet infrastructure.

1 0

CentOS-announce Digest, Vol 134, Issue 14
by centos-announce-request＠centos.org 27 Apr '16

27 Apr '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2016:0695 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 26 Apr 2016 23:59:06 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:0695 Critical CentOS 7 firefox Security Update Message-ID: <20160426235906.GA46943(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:0695 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-0695.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 7ad87030365ab1016abb60f1e290685ad331c5a5f1562bde57106a7ccacaf69b firefox-45.1.0-1.el7.centos.i686.rpm 9d5a9f3245ea81a0750082d056031816b6d1d05fe278641a0aad4fd44f367c05 firefox-45.1.0-1.el7.centos.x86_64.rpm Source: ea6c6ab0a63372cae9b1c76d642de69e23866e790dc41d5a91f56b99d352ec34 firefox-45.1.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 134, Issue 14 ************************************************

1 0

Storage cluster advise, anybody?
by Valeri Galtsev 27 Apr '16

27 Apr '16

Dear Experts, I would like to ask everybody: what would you advise to use as a storage cluster, or as a distributed filesystem. I made my own research of what I can do, but I hit a snag with my seemingly best choice, so I decided to stay away from it finally, and ask clever people what they would use. My requirements are: 1. I would like to have one big (say, comparable to petabyte) filesystem, accessible on more than one machine, composed of disk space leftovers on a bunch of machines having 1 gigabit per second ethernet connections 2. It can be a bit slow, as filesystem one would need for backups onto it (say, using bacula or bareos), and/or for long term storage of large datasets, portions of which can be copied over to faster storage for processing if necessary. I would be thinking in 1-2 TB of data written to it daily. 3. It would be great to have it single machine failure/reboot resilient 4. metadata machines should be redundant (or at least backup medatada host should be manually convertible into master metadata host if fatal failure to master or corruption of its data happens) What I would like to avoid/exclude: 1. Proprietary commercial solutions, as: a. I would like to stay on as minimal budget as possible b. I want to be able to predict that it will exist for long time, and I have better experience with my predictions of this sort about open source projects as opposed to proprietary ones 2. Open source solutions using portions of proprietary closed source binaries/libraries (e.g., I would like to stay away from google proprietary code/binaries/libraries/modules) 3. Kernel level modifications. I really would like to have this independent of OS as much as I can, or rather available on multiple OSes (though I do not like Java based things - just my personal experience with some of them). I have a bunch of Linux boxes and a bunch of FreeBSD boxes, and I do not want to exclude neither of them if possible. Also, the need to have custom Linux kernel specifically scares me: Linux kernels get critical updates often, and having customizations lagging behind the need of critical update is as unpleasant as rebooting the machine because of kernel update is. I'm not too scared of a "split nature" projects: proprietary projects having open source satellite. I have mixed experience with those, using open source satellite I mean. Some of them are indeed not neglected, and even though you may be missing some features commercial counterpart has, some are really great ones: they are just missing commercial support, and maybe having a bit sparse documentation, thus making you to invest more effort into making it work, which I don't mind: I can earn my sysadmin's salary here. I would say I more often had good experience with those than bad one (and I have a list of early indications of potential bad outcome, so I can more or less predict my future with this kind of projects). <rant> I really didn't mean to write this, but I figure it probably will surface once I start getting your advices, so here it is. I did my research having my requirements in mind and came up with the solution: moosefs. It is not reviewed much, no reviews with criticism at all, and not much you can ("I could" I should say) find howtos about customizations, performance tuning etc. It installs without a hitch. It runs well, until you start stress writing a lot to it in parallel, then it started performing exponentially badly for me. Here is where extensive attempts to find performance tuning documentation faces lack of success. What made my decision to never ever use it in a future was the following. I started migrating data back from moosefs to local UFS (that is FreeBSD box) filesystem using rsync command. What I observed was: source files after they have been touched by rsync changed their timestamps. As if instead of creation timestamp it is an access timestamp on moosefs. This renders rsync from moosefs useless, as you can not re-run failed rsync, and you obliterate some of metadata of the source ("creation" timestamp). I wrote e-mail to sourceforge moosefs mail list, mentioning all this and the fact that I am using open source moosefs. Next day they replied asking whether I use version 3."this" or version 3."that", as they want to know in which of them they have a bug. Whereas latest open source version they have everywhere, including sourceforge is older version: 2.0.88. Basically, my decision was made. Sorry for venting it out here, but I figured, it will happen some moment when I will get your advises. </rant> Thanks a lot for all your advises! Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

6 7

username.pem
by m.roth＠5-cent.us 26 Apr '16

26 Apr '16

Hi, folks, Our system gets/creates /var/lib/ssh-x509-auth/<username>,pem, then deletes it when the log out. selinux (in permissive mode) complains. First, I changed the context to cert_t, and *now* it complains that ksh93 wants write, etc access on the directory. grep ssh-x509-auth /var/log/audit/audit.log | audit2allow offers me this: #============= sshd_t ============== allow sshd_t cert_t:dir write; allow sshd_t var_lib_t:file { write getattr create open ioctl }; So: first, is this an expected behavior; second, is that the correct fcontext, and, finally, is it safe for me to create this as a local policy? Thanks in advance. mark

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss