Hot answers tagged

158

IPTables isnt made for this kind of work, where lots and lots of packets need to be analyzed to make these decisions. IPTables is partly the answer though! The real answer to this is the awesome and underused traffic control facilities in linux. Note that mucking around with this without knowing what is going on may lead to you losing network connectivity ...


113

You can look at the contents of /etc/redhat-release, which will look something like this: $ cat /etc/redhat-release CentOS release 5.4 (Final) The contents are different for an actual RHEL system. This technique works on all RedHat derivatives, including CentOS, Fedora, and others.


80

You can use the lsb_release command on recent linux distributions. If you issue: lsb_release -i -r it will tell you the Distribution and Version. This is a little bit more accurate than accessing files that may or may not have been modified by the admin or a software package. As well as working across multiple distros.


35

Here's a one-liner I came up with for displaying request and response HTTP headers using tcpdump (which should work for your case too): sudo tcpdump -A -s 10240 'tcp port 4080 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | egrep --line-buffered "^........(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: " | sed -r 's/^...........


23

I prefer to use the /etc/issue file. $ cat /etc/issue I've seen many situations where /etc/redhat-release has been modified to meet software compatibility requirements (Dell or HP's management agents, for instance).


21

READ. YOUR. CONFIGS. And when that fails... READ. ALL. OUTPUTS. Do you see what's in ifcfg-bond0? No, do you understand what's in ifcfg-bond0? What in the world of slippery penguins is miimmon=100? Oh I'm sorry, did you mean miimon=100? Yeah, I think you meant miimon and not miimmon. Also, a big giveaway is that when you restart your network service ...


20

Put them in /etc/sysconfig/network-scripts/ifcfg-eth0, with a 2 or 3 etc. after them, such as: IPADDR2=192.0.2.48 NETMASK2=255.255.255.0 IPADDR3=192.0.2.49 NETMASK3=255.255.255.0 Unfortunately this seems to be undocumented (or I can't find it right now; it looks like Red Hat rearranged their web site yet again).


17

As per the recommendation of MadHatter here. I will post my answer here as an addendum to the answers here so that it may be used in conjunction with the answers suggested here. Taken from the following website ## Install yum utils ## yum install yum-utils ## Package-cleanup set count as how many old kernels you want left ## package-cleanup --oldkernels -...


14

Following command will remove ALL kernel versions, except for the one that you're currently running: sudo yum remove `rpm -q kernel | grep -v 'uname -r'` and for going forward, per ⁠7.4. Configuring Yum and Yum Repositories: ⁠installonly_limit=value …where value is an integer representing the maximum number of versions that can be installed ...


13

We recommend everyone run through a reinstall rather than attempt an inplace upgrade from CentOS-4 or CentOS-5! Source: http://lists.centos.org/pipermail/centos-announce/2011-July/017645.html You can run this upgrade centos6 just by using yum upgrade --enablerepo=centosplus. Do not forget: each system running centos is individual (!). I recommend you ...


13

The fix in RHEL6 or in derivatives of RHEL6 is to add the parameter multilib_policy=all in your /etc/yum.conf file and that should work out. It will enable fetching packages of all architectures and is not limited to the 64 bit versions only.


13

Use virsh define somefile.xml and virsh start domain-name, doing this the VM will be persistent. I can't check right now, but I think you can use virsh define on an already started VM and this will make it persistent.


12

Short Answer Install the equivalent centos-release package from a centos downloads location; This will enable the CentOS package repos where you can do a yum update or a yum install gcc Long(er) Answer With respect to the other answers, I felt a slight more full answer could be given to your question. CentOS aims to be 100% binary compatible with RHEL, ...


12

Yes, you have to have an active RHEL subscription to download packages from RHEL's repositories. If your machine has never been subscribed, or the subscription is expired, you will not be able to use any of the repositories provided by RHEL. Red Hat states, in relevant part: If you choose to let all your subscriptions expire and have no other active ...


11

Push back... Red Hat Enterprise Linux doesn't work that way. Installing from source to meet audit requirements opens you to additional security issues and more management overhead. The approach Red Hat takes for its enterprise operating systems is to create a consistent target throughout the support lifecycle of the OS. Larger corporations and enterprise ...


10

I would not recommend downgrading the distribution OpenSSH version shipped with RHEL6. There are dependencies that would potentially break your server. So no, it's probably not okay... We can possibly help you troubleshoot the client's scp issue, though. Have you run the SSH daemon in debug mode? Have you done the same with the client system?


9

This functionality is provided by rpm, not yum: rpm -ql [packagename] From the documentation: The general form of an rpm query command is rpm {-q | --query} [PACKAGE_NAME] [query-options] Information selection options: -l, --list List files in package.


9

Better than fighting with udev to force a device name for a given device, a permanent solution is to use UUIDs. This is valid for any device known to the device-mapper. This way, you don't have to worry if you add extra disks to your host. The UUID identifier guaranties that the right device will be used.


8

In my opinion, no. CentOS 6 is very much behind RHEL 6.1 and Scientific Linux 6.1. See: https://www.centos.org/modules/newbb/viewtopic.php?viewmode=flat&topic_id=32027&forum=14 The problem here is that the upstream distribution has moved on, so CentOS 6 isn't really a good target platform. I would wait until CentOS 6.1 is available or stick with 5.x....


8

The most reliable way when lsb_release is not installed is: # rpm -q --queryformat '%{VERSION}' redhat-release-server 6Server # rpm -q --queryformat '%{RELEASE}' redhat-release-server 6.4.0.4.el6 On minimal installs, lsb_release is missing. To get this working also with Red Hat clones (credit goes to comments): # rpm -q --queryformat '%{VERSION}' $(rpm ...


8

Yes, the tool is called mock and it's in EPEL. Typical usage: rpmbuild -bs mypackage.spec mock -r epel-6-x86_64 mypackage-0.1-1.src.rpm This is actually the preferred way to build RPMs, precisely because it isolates the process from the system so that unexpected dependencies don't get pulled in. You can modify the files in /etc/mock to have it pull in ...


8

Here's the schedule of tuned-adm configurations... I think it helps to see them in tabular form. The main thing to note is that the default RHEL6 settings suck!! The other thing is that the enterprise-storage and virtual-guest profiles are identical except for reduced swappiness on the virtual guest side (makes sense, right?). As for a recommendation on ...


7

Mike, there are generally a few sources of good guides out there for security hardening. The DISA STIGs The NSA SRGs NIST CIS Benchmarks Vendor guidance SANS Books specific to hardening At my work, we use a combination of the DISA STIGs, along with puppet for Linux. I'd be more likely to say that is inadequate and push for some of the recommendations ...


7

Delete at least one of the old kernels, as alexus said. Then: Edit /etc/yum.conf and specify the limit of the number of kernel versions to keep. It's set to 5 by default, but your system seems to be capable of handling only two: installonly_limit=2 Finally, complain to the VPS provider about the strange template. /boot is 500MB by default in a CentOS 6 ...


7

I had the same issue after installing Gitlab 6.4 on RHEL 6.5. No matter what i did i could not SSH using public keys for the main system user (git). Again the SSH keys were fine, as were the permissions on ~/.ssh (700) an ~/.ssh/authorized_keys (600). The issue was that seliunx was "enforcing" and the contexts in the .ssh directory were wrong, probably ...


7

rpm -ql packagename is roughly equivalent. You should think of yum as similar to apt-get and rpm as roughly equivalent to dpkg. yum deals with packages in terms of repositories, and rpm deals with individual packages. Ubuntu actually provides a cheat sheet on similar actions: Switching between RedHat and Ubuntu


7

Don't do that ! Before you step outside the OS vendor's support structure you should verify that this is the right thing to do. Some PCI compliance tests will report that an application has vulnerabilities because it's reported version number is too low. This does not take into account backporting of security and bug fixes that many vendors employ. For ...


7

The fix: Apparently, the Oracle installation on this system injected Oracle's path into LD_LIBRARY_PATH... [root@dev1v etc]# export declare -x LD_LIBRARY_PATH="/home/oracle/app/oracle/product/11.2.0/client_1/lib" Unsetting the variable allowed yum to function properly again.


7

XFS and EL6 have fallen into an ugly state... I've abandoned XFS on EL6 systems for the time being due to several upstream features/changes slipping into the Red Hat kernel... This one was a surprise and caused some panic: Why are my XFS filesystems suddenly consuming more space and full of sparse files? Since November 2012, the XFS version shipping in ...


7

The short answer is that any tuning is guesswork and only has value when backed up with empiricial data: Try it. Measure it. If you don't like it, tweak it. A longer answer: Increasing the dirty_ratio would probably mean higher write performance ...IO will be blocked for a considerably longer time No. Increasing the dirty ratio means that your system ...



Only top voted, non community-wiki answers of a minimum length are eligible