- luv-main - luv.asn.au

bind chroot, bind mounts and selinux
by Tom Robinson 11 Sep '15

11 Sep '15

Hi All, I'm migrating a CentOS 6 bind instance (chrooted) to a CentOS 7 box and am curious of people's opinions on chrooting vs selinux as a way of securing bind. The bind-chroot on CentOS 7 also comes with a script (/usr/libexec/setup-named-chroot.sh) that sets up the much maligned systemd and, through bind mounts, creates and extra level of chroot hierarchy giving: /var/named/chroot/var/named/chroot/var/named which seems totally unnecessary. I'm sure that bind-chroot would be happy enough running without the bind mounts but would I be loosing anything in terms of security? Also, would I bother with chrooting at all if selinux can secure the environment for me? My own opinions aside what do others think and has anyone had experience with this? Kind regards, Tom -- Tom Robinson 19 Thomas Road Mobile: +61 4 3268 7026 Healesville, VIC 3777 Home: +61 3 5962 4543 Australia GPG Key: 8A4CB7A7 CONFIDENTIALITY: Copyright (C). This message with any appended or attached material is intended for addressees only and may not be copied or forwarded to or used by other parties without permission.

4 5

NFSv4 on CentOS without Kerberos - getting rid of nobody
by Peter Ross 08 Sep '15

08 Sep '15

Hi all, I just spin off two CentOS6 VMs to replicate a problem I had on Friday afternoon at work. I want use NFSv4 to share folders. Short, from memory, I have on the server: - /etc/exports populated - domainname configured - domain in /etc/idmapd.conf - rcpidmapd running On the client, I have - /etc/fstab entries with nfsvers=4 - SecureNFS=no in /etc/sysconfig/nfs - domainname configured - domain in /etc/idmapd.conf - rcpidmapd running When I mount, it works, but all files belong to nobody.. What do I miss? If I start rpcimapd in verbose, it complains about /proc/net/nfsv4/nfstoid or something similar missing(sorry, I am not there yet with my replicas) but I am not sure whether this matters. DuckDuckGo and Google did not help much yesterday. I do not have Kerberos or LDAP configured, the firewall (2049 connection only) restricts me and I 'don't mind' that the two machines trust each other. The environment is quite isolated and under tight control. Thanks for ideas Peter

2 4

Kind of service/VM/host/IP/location/asset register (and more)
by Peter Ross 04 Sep '15

04 Sep '15

Hi all, I am looking for an easy way to keep things in sync with reality.. Means: IP addresses, DNS, out of bounds IPs, blade centre, ESXi hosts etc. - and if possible physical location, asset register, monitor configuration, password safe etc. The current mix of DNS on Active Directory, Excel spreadsheets etc. "doesn't cut it". It's incomplete, it's redundant, it's not consistent.. and we spend sometimes too much time to find critical information just to get a few little things done, and things are overlooked etc. I had actually things in some "password-style" (with ":" as the separator) files before, and that was in version control and worked quite well, but from a certain point onwards it becomes a bit complex (I have much more variation in setup here, e.g) and you cannot convince other people that old-fashioned files are not that bad;-) So all ideas are welcome. Regards Peter

3 2

Microsoft Exchange Alternative??
by craig.luv＠shakenautomotive.com.au 02 Sep '15

02 Sep '15

Hi, I'm getting the Microsoft Exchange pressure here at work again. We have survived with postfix/dovecot and sieve for quite a number of years. However I have to admit the needs for calendar sharing, meeting requests etc is getting pretty strong. Any suggestions? Or advice about the following? (must work with MS Outlook) ref: https://www.linux.com/learn/tutorials/338482-microsoft-exchange-alternative… These two seem like the best fit so far.. * Zimbra * Open-Xchange Regards, Craig

7 8

Phone number for room access
by Russell Coker 01 Sep '15

01 Sep '15

0490049589 Call the above number to get in after the meeting starts. -- Sent from my Samsung Galaxy Note 3 with K-9 Mail.

1 0

beginners SIG event idea
by Russell Coker 30 Aug '15

30 Aug '15

I'm thinking of running a beginners SIG event for setting up a mail server. I would give everyone a virtual machine and a NS record of their choice under the unixapropos.com domain. Then you can setup a DNS server and a mail server. This wouldn't be running on the big server and will only have space for maybe 14 virtual machines with 400M of RAM each. The limited number of VMs would mean that people would have to work in groups if it's as popular as the last training event. Who's interested? Also who's available to help in training? I'm good at Postfix and Dovecot but it would be good to have people with experienece with other software. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

3 2

Faking a file on a filesystem
by Sean Crosby 27 Aug '15

27 Aug '15

I have a need for a way for a regular user (i.e. non root) to "override" a file on a filesystem with one of their own, but just for the lifetime of a script. I'll give you an example. One of my users runs a program which is distributed in a package (i.e. not changeable by them). That program is looking for a file, /path1/file1. My user would like to change this file to a different version of the file in different scripts. I'm not aware of one, but is there a way to redirect file open calls for /path1/file1 to /path2/file2 in a script? It only has to be for file open/read calls, and not write. The /path1 filesystem is not writeable by the user. Is there maybe a FUSE filesystem which will allow this, or something else? Cheers, Sean

7 8

Cannot Free USB Disk Space
by David Zuccaro 26 Aug '15

26 Aug '15

I'd like to report a strange problem. I was backing up my desktop last night to an external usb disk last night. The backup failed to complete because I completely filled up the disk. df -h /dev/sdf1 1.4T 1.4T 0 100% /media/dz/5540d70d-... So this morning I deleted (using sudo rm -rf) an old directory on the usb disk which had about 30 GB of data in it. Now the problem is that df still reports the disk is completely full -- even after rebooting. /dev/sdf1 1.4T 1.4T 0 100% /media/dz/5540d70d-... Can someone please explain to what is going on here? Thanks David Zuccaro BSc (Chemistry, University Of Melbourne), GradDipCompSci (Monash), GradDipEd (Melbourne)

10 26

Re: Cannot Free USB Disk Space
by David Zuccaro 20 Aug '15

20 Aug '15

On 20/08/15 15:22, majoosh chacko wrote: > Strange. Can you see what you get on lsof /media | grep -i delet ? > No output

1 0

my first systemd problem
by Tim Connors 19 Aug '15

19 Aug '15

65959,7> aptitude install swapspace The following NEW packages will be installed: swapspace 0 packages upgraded, 1 newly installed, 0 to remove and 1 not upgraded. Need to get 30.1 kB of archives. After unpacking 116 kB will be used. Get: 1 http://mirrordirector.raspbian.org/raspbian/ stable/main swapspace armhf 1.10-4 [30.1 kB] Fetched 30.1 kB in 2s (12.1 kB/s) Selecting previously unselected package swapspace. (Reading database ... 124324 files and directories currently installed.) Preparing to unpack .../swapspace_1.10-4_armhf.deb ... Unpacking swapspace (1.10-4) ... Processing triggers for man-db (2.7.0.2-5) ... Processing triggers for systemd (215-17+deb8u1) ... Failed to execute operation: Connection timed out dpkg: error processing package systemd (--unpack): subprocess installed post-installation script returned error exit status 1 Errors were encountered while processing: systemd [ Rootkit Hunter version 1.4.2 ] ... 65961,9> ps axuf | grep D USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 35 0.0 0.0 0 0 ? S< Aug16 0:00 \_ [DWC Notificatio] root 1 0.0 0.8 5636 3664 ? Ds Aug16 0:20 /sbin/init ... Congratulations Poettering. Writing an init that gets stuck in the D state is a feat of magnificent incompetence. Tentacling it so badly into the rest of the system that the system can't proceed out of this state is just fantastic. -- Tim Connors

7 11