Tag Info

New answers tagged

0

you need the uuidd deamon up and running. maybe "chkconfig uuidd on" and reboot.


1

In my opinion it's a really bad idea. NTP servers that lie almost always end up causing problem - just look on ServerFault - not least for themselves. The requirement that the CentOS system the faulty ntpd is running on still needs to know the right time should clarify why this won't end well (you could have a small, sacrificial VM that knew only the wrong ...


1

# yum install --enablerepo=ius-archive php53u-mysql # yum install --enablerepo=ius-archive phpMyAdmin3 Works now on RHEL 5.5


1

For the next user that needs to do this, the correct answer is, if you are using sssd for ldap, then inside the /etc/pam.d/db2 file created as part of the IBM directions, replace "pam_ldap.so" with "pam_sss.so" and it will work.


1

The problem you have is using rid idmap. This uses an algorithm to generate a random number for the UID between the limits that you set in the range, which will always be different between hosts. What you need is the ads idmap, however, this means that the id's need to exist in AD and ldap. If you are only concerned about accessing the UNIX groups and basic ...


2

.. assuming the CentALT repo doesn't mysql-devel rpm, you'd need to re-install mysql-server, by un-installing the one that you already have and installing it from base before installing mysql-devel (both has to be installed from same place). yum remove mysql yum install mysql-devel


0

Your mysql version differs from the mysql-devel version you're trying to install. This is because you have installed mysql from CentALT repo according to your output. Try yum --enablerepo=CentALT install mysql-devel


0

What are the directory permissions ? Apache usually runs as a specific user - as far as I remember "apache" on Centos. You should ensure that apache user can read and execute directory where your files are. For example you can try this to check if apache can see the files: sudo -u apache ls -l /usr/bin/tee-clc/tf Also I suggest to stop doing any bash ...


0

Some clients (notably Windows 7) constantly sends DHCPIFORM messages if there is no WPAD option specified in the DHCPACK response. You can fix this for dnsmasq by adding the following to the dnsmasq.conf file: dhcp-option=252,"\n" for ISC DHCP you can do this by adding the following lines to your config: option wpad code 252 = text; subnet xxx { ...


-1

You can check if you're vulnerable by running the following commands (code provided by the CSA). Open a terminal window and enter the following command at the $ prompt: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" If your bash is NOT up to date, it'll print: vulnerable this is a test If your bash is up to date, you'll only see: ...


2

The only way to know if your server is compromised is to have somewhere a signature of your files and to compare your current files to it. Nevertheless you can see if you are vulnerable. you can't. It is reasonnable to assume if your machine is indeed compromised, your usual monitoring tools (ps, top, lsof,...) have been replace with similar tools whose ...


0

Instead of using udev rules to maintain the name, you have a couple of options: With the iscsi target, you should be able to use the WWID instead by using the /dev/disk/by-id/scsi-.... address. If you list the contents of that directory, a symbolic link should exist to the relevant iscsi disk (/dev/sda2). This target will not change even if the device ...


1

There's also an SELINUX boolean policy called httpd_can_sendmail.... I'm pretty sure this has to be set to true also.


0

You should not use anything from the Suse repo except crmsh and pssh so you should add a line to the repo file which says includepkgs=crmsh,pssh so that it does not overwrite the CentOS supplied corosync etc. The only supported method of using corosync on CentOS 6.4 is to use it via cman so you no longer start corosync directly, you start cman and then you ...


4

I just had the pleasure to clean up a compromised older Plesk system. The first thing that gave it away were numerous processes that were started listening to a number of ports and others trying to download code from the original scanning server. lsof -i -n ... perl 1899 user100 3u IPv4 227582583 0t0 TCP ...


1

Check CloudWatch monitoring to see what the CPU as doing. If the CPU was max'ed out, you would not have been able to make a HTTP or SSH connection. If you're running something like Wordpress on an EC2 instance, prolonged CPU spikes are common.


1

Turns out the puppet module https://github.com/thias/puppet-nagios has a bug causing the commands to be referenced from a non existent folder /usr/libexec/nagios/plugins/' vs/usr/lib64/nagios/plugins/`.


3

This answer is not especially related to Shellshock but for any system you may think compromised second note: you cannot be sure to have recovered from a compromised to root system. Your only action is to destroy and re-provision the system Try to get a clean static build of rpm and run command rpm --verify --all. It will tell you which files belonging to ...


1

The key to this problem is the (13), which means "Permission Denied" (via perror). Because I can connect from the command line, the permission must be in the web app. Since I know that the credentials in the web app match the ones on the command line, the only thing left is the web server. Via an strace, I discovered SELinux was blocking it. To fix: ...


1

Each of your compute nodes will need a default route of 192.168.1.2 (head node eth2). You will then need to configure IP forwarding on the head node to allow the compute nodes access through it. You don't need to worry about the managed switch for this - it is "invisible" for the task you're trying to accomplish. You can also, if desired, enable masquerading ...


1

A kind soul named Lewis Rosenthal has placed updated Bash RPMS for CentOS 4 up on his FTP server. The bash-3.0-27.3 RPM is believed to address CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187. He has a README with more information, and there was some discussion on the CentOS forums. Don't forget this helpful all-in-one check script--note that ...


1

You appear to be using a internal mirror of lstn.net / limestonenetworks.com. That mirror is probably out of sync. You should contact them and make sure they sync the mirror. As the vulnerability you are trying to patch is critical, I'd advise to use a different mirror until they have synced theirs. Until then switch to the external ones provided by the ...


1

Maybe the best thing to prevent hd sleep and firmware caching is the reading of a random sector of your disk: * * * * * bash -c 'dd if=/dev/sda of=/dev/null count=1 skip=$RANDOM' It worked just fine for me.


0

PAM is not a problem here since logs show the user was authenticated. The real problem comes from hosting FTP server on a cloud. The most common caveat: FTP Passive mode requires additional ports to be open on a server. Your logs above show that port 55254 was not open to connect from outside. To fix this, allocate specific ports to ProFTPd by adding ...


-1

It seems you are using CentALT repository. Error messages say mysql rpm from CentALT is installed; it is the source of the problem. Remove the mysql rpm and disable CentALT repository; after then, try to install mysql-devel again. Or you can temporarily disable CentALT to install mysql-devel: #remove mysql from CentALT yum remove mysql #install mysql and ...


4

Since there are several attack vectors for Shellshock, some of them yet being unknown for general public or caused by a custom CGI script, there is no definite way to tell if you are compromised or not. In addition to usual "let's see if some system files have changed or something else suspicious has happened lately" approach you might want to keep your eye ...


-1

Well, you are trying to install a devel package for a previous mysql version. Package mysql-devel.x86_64 0:5.1.73-3.el6_5 will be installed Requires: mysql = 5.1.73-3.el6_5 Installed: mysql-5.5.29-1.el6.x86_64


3

According to the man page for cron(8) (the daemon that actually sends the message): -m This option allows you to specify a shell command string to use for sending cron mail output instead of sendmail(8). This command must accept a fully formatted mail message (with headers) on stdin and send it as a mail message to ...


1

A quick Google shows me that /etc/sysconfig/crond is the file that defines what mailer is used by cron.


2

You need to create the metadata. In the dir with the RPMS for example run createrepo .


4

I would echo the answer from suprjami and say that if your system is vulnerable then you should treat it as compromised. If you are running apache you can check the logs for Shellshock intrusion attempts with the following command: [root@server ~]# grep cgi /var/log/httpd/access*|egrep "};|}\s*;" This command extracts all lines containing "cgi" from ...


1

First, some space is reserved for rootuser. You can check how much space is reserved for root,with: tune2fs -l /dev/mapper/vg_bgsvn-lv_root This will give you the block count reserved for root user, multiply it by the block size and you will get the size of reserved space (in bytes). Second, most probably some file descriptors are still in use. That ...


-3

How to find if your linux box is compromised. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" If if returns vulnerable this is a test you are. To run the update, under root run the following command sudo yum update bash


5

Could be a false positive - Make sure the 'echo' file does not exist from an earlier test on your bad machine, then retest. Failing that, could also be a false negative - Check you can touch a file on your good machine, then retest.


20

shellshock isn't a worm so there are no files to look for. Shellshock is a way to attack a network to gain entry. Once inside who knows what the attacker will do.


2

(update your OS... no excuse to be running EL6.2 today) I have the LibreOffice (formerly OpenOffice) headless server running on some of my production systems for batch processing of .XLS documents. The init script used for this is available here. The running command line looks like the following. Port selection should be self-explanatory: ...


32

How do I know if my server is already compromised due to the Shellshock bug? You don't. That's the idea of a security vulnerability. If you had to click Let the crackers in? OK/Cancel it wouldn't be much of a vulnerability. You may have some luck checking the logs of your attack vectors, but given that so many services are vulnerable and not all of ...


5

I have seen one attempt at exploiting the bug, which would install an IRC bot as /var/tmp/x. But in general there are no particular files to look for, since they could be anywhere or nowhere. If you got compromised through the web server then any new file or process owned by the web server user would be suspicious. In case an attacker used first the bash ...


-1

https://www.npmjs.org/package/gist-cli https://github.com/settings/applications#personal-access-tokens or this one: https://github.com/defunkt/gist Use gist command to upload and download


0

The other option I found was to disable these properties tests completely. If you edit /etc/rkhunter.conf and look for the DISABLE_TESTS line and change it to: DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps properties" The properties test is the one checking and returning false positives on the file hashes.


0

Upgrades from RHEL 4 to 5 are not supported; the same would apply to CentOS. You should backup the server and perform a fresh installation of your CentOS version of choice. Although anaconda provides an option for upgrading from earlier major versions of Red Hat Enterprise Linux to Red Hat Enterprise Linux 5.11, Red Hat does not currently support this. ...


0

I had the same problem. I took a stab at creating some Python code to pull together Yum Updates and advisories from the steve-meier Errata site mentioned above (I filter it based on installed packages). In case it helps, here is the source: https://github.com/wied03/centos-package-cron


0

I think that problem is in path. ip command is in /sbin directory. Usually - this directory isn't in path except root user, so - using it in scripts may cause problems. Try use /sbin/ip instead of ip command.


0

The issue was with my IP Tables at the OS level. I ran the following commands on CentOS to allow communication on port 20, 21 and 22. sudo iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT sudo iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT sudo iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp ...


0

The problem turned out to be a failed build of the APR library. I was using Ansible to deploy Tomcat, and an apparent bug in the "shell" command caused the APR configuration to fail silently. Details of this issue with Ansible can be seen here: Ansible playbook not working trying to run make & configure with complex switches


0

Just create an image with whatever you like (say Partimage) and restore to the physical machine. You might have to edit the grub loader to make sure it points to the right partitions etc...


0

how about PREROUTING -i eth0 -p udp --match multiport --dport 10000-14999 -j DNAT --to 192.168.110.101 or PREROUTING -i eth0 -p udp --match multiport --dport 10000-14999 -j DNAT --to 192.168.110.101:10000-14999 edit -t nat -A PREROUTING -i eth0 -p udp --match multiport --dport 10000-14999 -j DNAT --to 192.168.110.101 -t nat -A POSTROUTING -s ...


1

Turns out I had bad repositories! Edit /etc/yum.repos.d/CentOS-Base.repo: [base] name=CentOS-$releasever - Base baseurl=http://ftp.osuosl.org/pub/centos/$releasever/os/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 [updates] name=CentOS-$releasever - Updates ...


2

Do you have enabled the updates repository? Confirm with yum repolist all that the updates repository is available and enabled. If you have the updates repository disabled you can enable the repository for a single yum command with: yum --enablerepo=updates update bash or permanently by editing the /etc/yum.repos.d/CentOS-Base.repo configuration file. ...


2

As SvW already covered the SuSE part, here is the answer for CentOS: Only the latest CentOS minor versions get patches -- as always. Update to CentOS 6.5. There won't be patches for 6.4. Patches for CentOS 6.5 are already released.



Top 50 recent answers are included