Hot answers tagged

33

Make sure you have the iptables-services package installed. This legacy package provides the systemd scripts for the previous iptables invocation. This package is not always installed, depending on your installation choices when you installed (or upgraded). yum install iptables-services And of course, if possible, you should use the new firewalld system. ...


23

As noted in https://access.redhat.com/articles/3311301 CVE-2017-5715 (variant #2/Spectre) is an indirect branching poisoning attack that can lead to data leakage. This attack allows for a virtualized guest to read memory from the host system. This issue is corrected with microcode, along with kernel and virtualization updates to both guest and host ...


20

The version of firewalld in RHEL 7.0 has no "save" script and no way to copy the running firewall configuration to the permanent configuration. You save a firewall change with firewalld by adding --permanent to the command line making the change. Without it, any change you make is temporary and will be lost when the system restarts. For example: firewall-...


16

Bash allows you to connect to TCP and/or UDP ports by redirecting to special files: /dev/tcp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, Bash attempts to open the corresponding TCP socket. /dev/udp/host/port If host is a valid hostname or Internet address, and port is an integer ...


16

UPDATE: it seems the microcode update released with OS updates are binary patches to the running microcode, rather than full-blown microcode replacement. In other words, they require a specific, base ucode version in the BIOS/processor to be able to patch it. For this reason, on all machines I had at hand a BIOS/firmware update is required, and this very ...


15

You (your company) most likely signed an enterprise agreement to requires you have sufficient subscriptions to cover your entire install base. By administrating/managing your subscriptions correctly you ascertain compliance.


14

You should install iptables-services package. Then service iptables save will work. Also these commands will work too: # iptables-save > /etc/sysconfig/iptables # ip6tables-save > /etc/sysconfig/ip6tables AFAIK, systemctl doesn't have any option to save iptables-services' configuration. Note: systemctl syntax is as follow : systemctl <operation&...


11

Have you tried changing the channel via subscription-manager? What is the output of sudo subscription-manager list --consumed Either way, you won't need a reinstallation. From a licensing perspective, the answer depends on the hardware you've installed onto... Think of it like this: RHEL Desktop (aka Client) is meant for single-socket computers. ...


9

Using the --permanent flag writes your changes to the persistent configuration, but not the running configuration. Run the same command again without the --permanent flag to have it take effect immediately. Beginning with RHEL 7.1 and current versions of Fedora, you can also copy the running configuration to the permanent configuration with: firewall-cmd --...


9

With the help of our VMware admin, we were able to figure out that the customization script required perl. This isn't installed with RHEL7's @core package group. To summarize, you need the following RHEL7 packages to have customization work: open-vm-tools open-vm-tools-deploypkg net-tools perl Hope this helps others.


9

Though Ncat does not yet support -z, you can get the same behavior with shell redirection: $ ncat google.com 80 </dev/null >/dev/null && echo "yes" yes $ ncat google.com 81 </dev/null >/dev/null && echo "yes" Ncat: Connection timed out. $ ncat scanme.nmap.org 1234 </dev/null >/dev/null && echo "yes" Ncat: Connection ...


9

The vast majority of things in the RHEL documentation will apply to CentOS without change. The main things that need adjustment are those that have to do with licensing and subscription, such as: Registering the system: Not necessary on CentOS. Adding software channels (such as High Availability, Enterprise Virtualization, Software Collections, etc.): ...


9

I've been using the Spectre Meltdown Checker script to get a quick accounting of my physical and virtual systems' status since I'm dealing with a lot of kernel and platform variants. See: https://github.com/speed47/spectre-meltdown-checker The output is showing that a BIOS update is needed on hypervisor hosts and bare-metal servers. This is a vendor issue ...


8

Funny, I just did exactly this the other day after finding my RHEL instance on EC2 only had 6GB or so of the 10GB space allocated to it... [root@ip-172-31-20-177 ~]# xfs_info / meta-data=/dev/xvda1 isize=256 agcount=4, agsize=393216 blks = sectsz=512 attr=2, projid32bit=1 = crc=0 ...


8

The program which modified the sender was postfix. By default crontab/mail will use username as email sender without domain parts. So the sender becomes myuser Because postfix sees sender doesn't domain name, by default postfix will append hostname as its domain. See parameter append_at_myorigin and myorigin in /etc/postfix/main.cf. The sender becomes ...


8

Congratulations, you found an error in the RHEL documentation. The iptables rule shown here uses the tcp matcher but then attempts to specify the udp protocol. This doesn't work; the tcp matcher can only be used with protocol 6, which happens to be tcp. Thus the error you received. To correct the rule you have to first figure out which is wrong, the ...


8

Actually, it's a legitimate use case to set up IPA servers to eventually replace existing, running DNS servers for a domain. The "go purchase a new domain" answers fail to address the underlying technical issue. This case can be handled by specifying ipa-server-install --allow-zone-overlap option, documented here.


7

You need to enable the RHEL optional and/or extras channels. yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional


7

Funny, I just happened to reboot a CentOS 7 system last night, and so I have a nice log of just this to look at. In the case of a crash, obviously nothing is logged between the time of the crash and the system restart. In the case of a reboot, it is pretty obvious, as you get a log of (nearly) everything systemd is doing to shut down the system. One such ...


7

Red Hat's Official Response: On further investigation, I have found that mentioned booblean was removed on RHEL 7.3. We have already filed a bugzilla for the same, BZ:1406542 https://bugzilla.redhat.com/show_bug.cgi?id=1406542 It appears that , ftp users may be able to access their home directory by default on RHEL 7.3. If it doesn't ...


7

The difference is that chronyd by default uses a random source port for each client request. If the firewall doesn't allow client requests from other ports than 123, you will need to specify the port by adding acquisitionport 123 to chrony.conf. The directive is documented here.


6

You just need to fix your typo. You entered: http_sys_content_t But it is correctly: httpd_sys_content_t


6

each rpm specifies a list of files and directories that it installs. Two rpms cannot install the same files or directories. In your spec file (or whatever file you use to describe the rpm you build) you should not install the /etc/systemd/ and /etc/systemd/system/ directories. In a spec file; you should NOT use: %files /etc/systemd/ but %files /etc/...


6

This is possible by adding the parameter as follows to /etc/default/grub. $ echo "GRUB_DISABLE_LINUX_UUID=true" >> /etc/default/grub $ grub2-mkconfig -o /boot/grub2/grub.cfg If you want to double check the result before. $ grub2-mkconfig | less Update To completely disable the UUID in GRUB, you need to add the line as follows to /etc/sysconfig/...


5

Check the cheat sheet for native commands. But you can still use chkconfig. And ntsysv still shows up in the EL7 package list.


5

An old question but this is no longer true. Here is a link to the CentOS 7 + MariaDB 10.0 repo config tool: https://downloads.mariadb.org/mariadb/repositories/#mirror=coreix&distro=CentOS&distro_release=centos7-amd64&version=10.0


5

I figured it out and I can see why I got the "read the manual" type comment. The issue was rather simple and I'm sure any sysadmin would have figured it out right away. But for us programmer types who have to do sysadmin stuff out of necessity here's what was going on. Short answer: My MAC address was incorrect in my /etc/sysconfig/network-scripts/ifcfg-...


5

IPsec creates a tunnel between the specified IPs only, i.e. packets intended for IP B from IP A gets encrypted and all other packets from IP A can pass through without encryption. Am I missing something here? Yes. IPSec creates a tunnel between two specified endpoints, left and right. But the traffic that uses that tunnel, ie the traffic that is ...


5

I don't particularly like the answer, but it's an answer we got from RH. I'm posting it here in case it helps someone else. One possible way is to grep for rsyslogd in /var/log/messages. A graceful shutdown would have exiting on signal 15. A crash would not. tac /var/log/messages | grep 'rsyslogd.*start\|rsyslogd.*exit' Two consecutive start lines may ...


5

It may be better to not configure system services to listen on specific IP addresses, and to control access to them via the host firewall if necessary. If you really need to be able to bind to specific IP addresses before they are configured on a network interface, you can work around the timing issue by setting the sysctl net.ipv4.ip_nonlocal_bind for IPv4 ...


Only top voted, non community-wiki answers of a minimum length are eligible