Tag Info

Hot answers tagged

148

IPTables isnt made for this kind of work, where lots and lots of packets need to be analyzed to make these decisions. IPTables is partly the answer though! The real answer to this is the awesome and underused traffic control facilities in linux. Note that mucking around with this without knowing what is going on may lead to you losing network connectivity ...


79

You can look at the contents of /etc/redhat-release, which will look something like this: $ cat /etc/redhat-release CentOS release 5.4 (Final) The contents are different for an actual RHEL system. This technique works on all RedHat derivatives, including CentOS, Fedora, and others.


60

You can use the lsb_release command on recent linux distributions. If you issue: lsb_release -i -r it will tell you the Distribution and Version. This is a little bit more accurate than accessing files that may or may not have been modified by the admin or a software package. As well as working across multiple distros.


20

I prefer to use the /etc/issue file. $ cat /etc/issue I've seen many situations where /etc/redhat-release has been modified to meet software compatibility requirements (Dell or HP's management agents, for instance).


18

Put them in /etc/sysconfig/network-scripts/ifcfg-eth0, with a 2 or 3 etc. after them, such as: IPADDR2=192.0.2.48 NETMASK2=255.255.255.0 IPADDR3=192.0.2.49 NETMASK3=255.255.255.0 Unfortunately this seems to be undocumented (or I can't find it right now; it looks like Red Hat rearranged their web site yet again).


18

READ. YOUR. CONFIGS. And when that fails... READ. ALL. OUTPUTS. Do you see what's in ifcfg-bond0? No, do you understand what's in ifcfg-bond0? What in the world of slippery penguins is miimmon=100? Oh I'm sorry, did you mean miimon=100? Yeah, I think you meant miimon and not miimmon. Also, a big giveaway is that when you restart your network service ...


12

Yes, you have to have an active RHEL subscription to download packages from RHEL's repositories. If your machine has never been subscribed, or the subscription is expired, you will not be able to use any of the repositories provided by RHEL. Red Hat states, in relevant part: If you choose to let all your subscriptions expire and have no other active ...


12

We recommend everyone run through a reinstall rather than attempt an inplace upgrade from CentOS-4 or CentOS-5! Source: http://lists.centos.org/pipermail/centos-announce/2011-July/017645.html You can run this upgrade centos6 just by using yum upgrade --enablerepo=centosplus. Do not forget: each system running centos is individual (!). I recommend ...


12

The fix in RHEL6 or in derivatives of RHEL6 is to add the parameter multilib_policy=all in your /etc/yum.conf file and that should work out. It will enable fetching packages of all architectures and is not limited to the 64 bit versions only.


11

Push back... Red Hat Enterprise Linux doesn't work that way. Installing from source to meet audit requirements opens you to additional security issues and more management overhead. The approach Red Hat takes for its enterprise operating systems is to create a consistent target throughout the support lifecycle of the OS. Larger corporations and enterprise ...


10

I would not recommend downgrading the distribution OpenSSH version shipped with RHEL6. There are dependencies that would potentially break your server. So no, it's probably not okay... We can possibly help you troubleshoot the client's scp issue, though. Have you run the SSH daemon in debug mode? Have you done the same with the client system?


10

Use virsh define somefile.xml and virsh start domain-name, doing this the VM will be persistent. I can't check right now, but I think you can use virsh define on an already started VM and this will make it persistent.


9

Short Answer Install the equivalent centos-release package from a centos downloads location; This will enable the CentOS package repos where you can do a yum update or a yum install gcc Long(er) Answer With respect to the other answers, I felt a slight more full answer could be given to your question. CentOS aims to be 100% binary compatible with RHEL, ...


9

Better than fighting with udev to force a device name for a given device, a permanent solution is to use UUIDs. This is valid for any device known to the device-mapper. This way, you don't have to worry if you add extra disks to your host. The UUID identifier guaranties that the right device will be used.


8

Yes, the tool is called mock and it's in EPEL. Typical usage: rpmbuild -bs mypackage.spec mock -r epel-6-x86_64 mypackage-0.1-1.src.rpm This is actually the preferred way to build RPMs, precisely because it isolates the process from the system so that unexpected dependencies don't get pulled in. You can modify the files in /etc/mock to have it pull in ...


8

In my opinion, no. CentOS 6 is very much behind RHEL 6.1 and Scientific Linux 6.1. See: https://www.centos.org/modules/newbb/viewtopic.php?viewmode=flat&topic_id=32027&forum=14 The problem here is that the upstream distribution has moved on, so CentOS 6 isn't really a good target platform. I would wait until CentOS 6.1 is available or stick with ...


8

run uname -a see which kernel you have running, then use yum remove kernel- (one by one) to all BUT the one that you're running (also keep one extra in addition to the one that you're running just in case if you need to load older kernel for whatever reason)


7

Mike, there are generally a few sources of good guides out there for security hardening. The DISA STIGs The NSA SRGs NIST CIS Benchmarks Vendor guidance SANS Books specific to hardening At my work, we use a combination of the DISA STIGs, along with puppet for Linux. I'd be more likely to say that is inadequate and push for some of the recommendations ...


7

This functionality is provided by rpm, not yum: rpm -ql [packagename] From the documentation: The general form of an rpm query command is rpm {-q | --query} [PACKAGE_NAME] [query-options] Information selection options: -l, --list List files in package.


7

Don't do that ! Before you step outside the OS vendor's support structure you should verify that this is the right thing to do. Some PCI compliance tests will report that an application has vulnerabilities because it's reported version number is too low. This does not take into account backporting of security and bug fixes that many vendors employ. For ...


7

The fix: Apparently, the Oracle installation on this system injected Oracle's path into LD_LIBRARY_PATH... [root@dev1v etc]# export declare -x LD_LIBRARY_PATH="/home/oracle/app/oracle/product/11.2.0/client_1/lib" Unsetting the variable allowed yum to function properly again.


7

XFS and EL6 have fallen into an ugly state... I've abandoned XFS on EL6 systems for the time being due to several upstream features/changes slipping into the Red Hat kernel... This one was a surprise and caused some panic: Why are my XFS filesystems suddenly consuming more space and full of sparse files? Since November 2012, the XFS version shipping in ...


7

It's not the voltage regulation that causes the performance problem, but the debugging kernel interrupts that are being triggered by it. Despite some misinformation on Redhat's part, all of the linked pages are referring to the same phenomenon. The voltage regulation happens with or without the Performance profile, likely due to the Turbo Boost feature ...


7

No, it does not. If it's not running, it's merely a file in the file system. If an attacker manages to restart your system with this kernel, he has already full control over the system anyway.


6

Actually, the command string listed in the sudoers is requiring to be the exact match. In your example, you put the command string /usr/bin/yum update in the sudoers configuration line, but the command you finally executes is yum -y update. (the difference is the extra parameter -y). Then, the mismatch in command string caused the sudoers failed to hit ...


6

It's high because that saves effort. It takes effort to make memory free. And if you do that, it just takes effort to make it used again. So, to save effort, modern operating systems only make memory free if they have absolutely no other choice. If you're thinking "I want memory free now so I can use it later", banish that thought from your mind. Memory ...


6

You pay Red Hat for Extended Update Support. This is the only supported way to avoid updating to the latest service pack, and is subject to availability. It's not offered for all point releases.


6

rpm -ql packagename is roughly equivalent. You should think of yum as similar to apt-get and rpm as roughly equivalent to dpkg. yum deals with packages in terms of repositories, and rpm deals with individual packages. Ubuntu actually provides a cheat sheet on similar actions: Switching between RedHat and Ubuntu


6

Your system is having some sort of problem with your Red Hat subscription. Make sure you have an active entitlement assigned to the machine, and if you do, contact Red Hat to resolve the problem.


6

You really won't find support for something like this, as it's not something that will pass any sanity checks. So, think about it a bit. Your computer needs to know the gateway address in order to reach other machines outside it's local subnet. So, if you have a subnet 10.0.1.0/24 and your machine is 10.0.1.12, it would be able to reach any machine from ...



Only top voted, non community-wiki answers of a minimum length are eligible