[CentOS] Apache + SSL: default configuration rated "C" by Qualys Labs

2017-04-25 Thread Nicolas Kovacs
Hi, I'm currently experimenting with a public server running CentOS 7. I have half a dozen production servers all running Slackware Linux, and I intend to progressively migrate them to CentOS, for a host of reasons (support cycle, package availability, SELinux, etc.) But before doing that, I have

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Phoenix, Merka
Robert, in regards to your Postfix and Dovecot issue with MySQL and SELinux, > Apr 26 01:25:45 z9m9z dovecot: dict: Error: > mysql(/var/lib/mysql/mysql.sock): Connect failed to database > (postfix): Can't connect to local MySQL server through socket > '/var/lib/mysql/mysql.sock' (13) - waiting

Re: [CentOS] saslauth logging

2017-04-25 Thread John R Pierce
On 4/25/2017 10:19 PM, Jobst Schmalenbach wrote: Good answer, makes sense. As for the higher layer used - can be either sendmail or imaps as both use the saslauth. Just need to find a way to "connect" the sasl request to the caller that issued the sasl request ... doesn't sendmail and your im

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/26/2017 08:21 AM, Rob Kampen wrote: On 26/04/17 17:29, Robert Moskowitz wrote: On 04/26/2017 04:22 AM, Gordon Messmer wrote: On 04/25/2017 03:25 PM, Robert Moskowitz wrote: This made the same content as before that caused problems: I still don't understand, exactly. Are you seeing

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/26/2017 08:04 AM, Gordon Messmer wrote: On 04/25/2017 10:29 PM, Robert Moskowitz wrote: did not work. it was set off, so I turned it on and tried it out. Got the same errors: Apr 26 01:25:45 z9m9z dovecot: dict: Error: mysql(/var/lib/mysql/mysql.sock): Connect failed to database (po

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Rob Kampen
On 26/04/17 17:29, Robert Moskowitz wrote: On 04/26/2017 04:22 AM, Gordon Messmer wrote: On 04/25/2017 03:25 PM, Robert Moskowitz wrote: This made the same content as before that caused problems: I still don't understand, exactly. Are you seeing *new* problems after installing a policy?

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Gordon Messmer
On 04/25/2017 10:29 PM, Robert Moskowitz wrote: did not work. it was set off, so I turned it on and tried it out. Got the same errors: Apr 26 01:25:45 z9m9z dovecot: dict: Error: mysql(/var/lib/mysql/mysql.sock): Connect failed to database (postfix): Can't connect to local MySQL server throu

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/26/2017 07:29 AM, Robert Moskowitz wrote: On 04/26/2017 04:22 AM, Gordon Messmer wrote: On 04/25/2017 03:25 PM, Robert Moskowitz wrote: This made the same content as before that caused problems: I still don't understand, exactly. Are you seeing *new* problems after installing a po

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/26/2017 04:22 AM, Gordon Messmer wrote: On 04/25/2017 03:25 PM, Robert Moskowitz wrote: This made the same content as before that caused problems: I still don't understand, exactly. Are you seeing *new* problems after installing a policy? What are the problems? # The file '/v

Re: [CentOS] saslauth logging

2017-04-25 Thread Jobst Schmalenbach
On Tue, Apr 25, 2017 at 07:14:56PM -0700, Gordon Messmer (gordon.mess...@gmail.com) wrote: > On 04/25/2017 07:00 PM, Jobst Schmalenbach wrote: > > What I want is the IP address and if possible the incorrect password (just > > to see how far they are off). > > Is this possible? > > I hope not. T

Re: [CentOS] saslauth logging

2017-04-25 Thread Jobst Schmalenbach
On Tue, Apr 25, 2017 at 07:15:43PM -0700, John R Pierce (pie...@hogranch.com) wrote: > On 4/25/2017 7:00 PM, Jobst Schmalenbach wrote: > > snip > > client request originated from, so logging the IP of the failed request had > best be done at a higher layer. Good answer, makes sense. As for the hi

[CentOS] kde panels not retaining launcher icon

2017-04-25 Thread geo.inbox.ignored
greetings one and all. new install of centos 6.8. 3 kde panels @ left, top, right sides. left and top panel are for program selection. right panel for active running programs. added 'launcher' icons to left and top panels, but panels are not retaining launcher icons. when i close kde to save

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Gordon Messmer
On 04/25/2017 03:25 PM, Robert Moskowitz wrote: This made the same content as before that caused problems: I still don't understand, exactly. Are you seeing *new* problems after installing a policy? What are the problems? # The file '/var/lib/mysql/mysql.sock' is mislabeled on your sy

Re: [CentOS] saslauth logging

2017-04-25 Thread John R Pierce
On 4/25/2017 7:00 PM, Jobst Schmalenbach wrote: Is it possible on to log a bit more detail when auth failure occurs when using saslauthd? saslauthd[2119]: do_auth : auth failure: [user=DELETED] [service=smtp] [realm=DELETED] [mech=pam] [reason=PAM auth error] What I want is the IP address

Re: [CentOS] saslauth logging

2017-04-25 Thread Gordon Messmer
On 04/25/2017 07:00 PM, Jobst Schmalenbach wrote: What I want is the IP address and if possible the incorrect password (just to see how far they are off). Is this possible? I hope not. That's a terrible idea. Every time a user fat-fingers their password, your plain-text logs have a copy of

[CentOS] saslauth logging

2017-04-25 Thread Jobst Schmalenbach
Hi Not sure whether this is the correct list to ask ... if it's not please direct me to the correct one. Is it possible on to log a bit more detail when auth failure occurs when using saslauthd? saslauthd[2119]: do_auth : auth failure: [user=DELETED] [service=smtp] [realm=DELETED] [mech=pam

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 06:45 PM, Gordon Messmer wrote: On 04/25/2017 01:58 AM, Laurent Wandrebeck wrote: Quick’n’(really) dirty SELinux howto: Alternate process: 1: setenforce permissive 2: tail -f /var/log/audit/audit.log | grep AVC 3: use the service, exercise each function that's constrained by

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 09:34 PM, Gordon Messmer wrote: On 04/25/2017 12:05 PM, Robert Moskowitz wrote: How do I undo the damage the last attempt caused? I'm not sure what damage you mean. If you installed a custom selinux module already and want to remove it, look at the files in /etc/selinux/ta

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 09:34 PM, Gordon Messmer wrote: On 04/25/2017 12:05 PM, Robert Moskowitz wrote: How do I undo the damage the last attempt caused? I'm not sure what damage you mean. If you installed a custom selinux module already and want to remove it, look at the files in /etc/selinux/tar

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Gordon Messmer
On 04/25/2017 12:05 PM, Robert Moskowitz wrote: How do I undo the damage the last attempt caused? I'm not sure what damage you mean. If you installed a custom selinux module already and want to remove it, look at the files in /etc/selinux/targeted/modules/active/modules/. Those are the mo

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 06:45 PM, Gordon Messmer wrote: On 04/25/2017 01:58 AM, Laurent Wandrebeck wrote: Quick’n’(really) dirty SELinux howto: Alternate process: 1: setenforce permissive 2: tail -f /var/log/audit/audit.log | grep AVC 3: use the service, exercise each function that's constrained by

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Gordon Messmer
On 04/25/2017 01:58 AM, Laurent Wandrebeck wrote: Quick’n’(really) dirty SELinux howto: Alternate process: 1: setenforce permissive 2: tail -f /var/log/audit/audit.log | grep AVC 3: use the service, exercise each function that's constrained by the existing policy 4: copy and paste the output

[CentOS] Odd disk automount issue on C7.3.1611

2017-04-25 Thread Lamar Owen
I'm posting here before going through all the fun to do up a real bug report to see if anyone else has seen this behavior. I have two identical Dynex external USB3 drive enclosures with identical 3TB drives in each enclosure. The dmesg output shows: $ dmesg |grep TOSHIBA [ 59.942546] scsi 7

Re: [CentOS] sha256sum a dvd

2017-04-25 Thread Robert Nichols
On 04/24/2017 12:39 PM, Jonathan Billings wrote: On Mon, Apr 24, 2017 at 12:53:36PM -0400, James B. Byrne wrote: CentOS-6.9 I am trying to verify a locally created dvd. I am using sha256sum in this fashion: sha256sum /dev/sr0 Which gave this result: sha256sum: /dev/sr0: Input/output error

Re: [CentOS] Bonding mode balance-alb (6): How to control the assigned MAC address?

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 12:32 PM, Frank Thommen wrote: Hi, we are trying to switch our bonding modes from 1 (active-backup) to 6 (balance-alb). However it seems, that these bond devices are not always getting the MAC address from the same slave. Sometimes the device gets the MAC address of the firs

[CentOS] Bonding mode balance-alb (6): How to control the assigned MAC address?

2017-04-25 Thread Frank Thommen
Hi, we are trying to switch our bonding modes from 1 (active-backup) to 6 (balance-alb). However it seems, that these bond devices are not always getting the MAC address from the same slave. Sometimes the device gets the MAC address of the first and sometimes of the second slave. Since onl

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 11:41 AM, Laurent Wandrebeck wrote: Le mardi 25 avril 2017 à 11:36 +0200, Robert Moskowitz a écrit : On 04/25/2017 11:29 AM, Laurent Wandrebeck wrote: Le mardi 25 avril 2017 à 11:19 +0200, Robert Moskowitz a écrit : /usr/lib/ld-2.17.so This file is not part of CentOS 7, nor Ce

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Laurent Wandrebeck
Le mardi 25 avril 2017 à 11:36 +0200, Robert Moskowitz a écrit : > > On 04/25/2017 11:29 AM, Laurent Wandrebeck wrote: > > Le mardi 25 avril 2017 à 11:19 +0200, Robert Moskowitz a écrit : > >> /usr/lib/ld-2.17.so > > This file is not part of CentOS 7, nor CentOS 6 ? > > I am running Centos 7 armv

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 11:29 AM, Laurent Wandrebeck wrote: Le mardi 25 avril 2017 à 11:19 +0200, Robert Moskowitz a écrit : /usr/lib/ld-2.17.so This file is not part of CentOS 7, nor CentOS 6 ? I am running Centos 7 armv7hl So it IS possible that I am missing something that did not get built right

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Laurent Wandrebeck
Le mardi 25 avril 2017 à 11:19 +0200, Robert Moskowitz a écrit : > /usr/lib/ld-2.17.so This file is not part of CentOS 7, nor CentOS 6 ? -- Laurent Wandrebeck ___ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 11:12 AM, Laurent Wandrebeck wrote: Le mardi 25 avril 2017 à 11:07 +0200, Robert Moskowitz a écrit : On 04/25/2017 10:58 AM, Laurent Wandrebeck wrote: Le mardi 25 avril 2017 à 10:39 +0200, Robert Moskowitz a écrit : Thanks Laurent. You obviously know a LOT more about SELinux t

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Laurent Wandrebeck
Le mardi 25 avril 2017 à 11:07 +0200, Robert Moskowitz a écrit : > > On 04/25/2017 10:58 AM, Laurent Wandrebeck wrote: > > Le mardi 25 avril 2017 à 10:39 +0200, Robert Moskowitz a écrit : > >> Thanks Laurent. You obviously know a LOT more about SELinux than I. I > >> pretty much just use command

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
On 04/25/2017 10:58 AM, Laurent Wandrebeck wrote: Le mardi 25 avril 2017 à 10:39 +0200, Robert Moskowitz a écrit : Thanks Laurent. You obviously know a LOT more about SELinux than I. I pretty much just use commands and not build policies. So I need some more information here. From what y

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Laurent Wandrebeck
Le mardi 25 avril 2017 à 10:39 +0200, Robert Moskowitz a écrit : > Thanks Laurent. You obviously know a LOT more about SELinux than I. I > pretty much just use commands and not build policies. So I need some > more information here. > > From what you provided below, how do I determine what i

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
Thanks Laurent. You obviously know a LOT more about SELinux than I. I pretty much just use commands and not build policies. So I need some more information here. From what you provided below, how do I determine what is currently in place and how do I add your stuff (changing postgresql with

Re: [CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Laurent Wandrebeck
Le mardi 25 avril 2017 à 10:04 +0200, Robert Moskowitz a écrit : > I thought I had this fixed, but I do not. I was away from this problem > working on other matters, and came back (after a reboot) and it is still > there, so I suspect when I thought I had it 'fixed' I was running with > setenfo

[CentOS] NOT Solved - Re: SELinux policy to allow Dovecot to connect to Mysql

2017-04-25 Thread Robert Moskowitz
I thought I had this fixed, but I do not. I was away from this problem working on other matters, and came back (after a reboot) and it is still there, so I suspect when I thought I had it 'fixed' I was running with setenforce 0 from another problem (that is fixed). So anyone know how to get d