Home / user-3739

tronda's questions

Martin Hope
tronda
Asked: 2011-11-18 00:38:16 +0800 CST
  • 2

I'm running Glassfish 3.1 on a CentOS 6 solution and by default SELinux is enabled. I have installed Sun's JDK version 1.6.0_29 on the server and extracted the Glassfish 3.1.1 to /opt/glassfish-3.1.1 with a link /opt/glassfish pointing to the latest Glassfish version. I've also created a system user named glassfish with a home directory /home/glassfish.

When running with SELinux enabled I get all sorts of errors. For instance I'm not able to create the domain. I kind of like the concept of SELinux, and would like to be able to have SELinux enabled. I have the following requirements for the Glassfish server:

  • Listening to port 8080 and 8081
  • Other ports 7676: JMS 8686: JMX monitoring, 4848: Admin console
  • Forwarding from apache to Glassfish through mod_jk and port 8009
  • Starting OpenMQ as an separate process which listens to 7676 and it's JMX monitoring port 7776
  • Able to read and write files at a specified area (different from home directory)
  • Able to use /tmp/ for temporary files

I am aware of the audit2allow tool when running in permissive mode, but I struggle with understanding the rules that is generated from this tool, and thought that setting up these rule manually the first time would help me understand the SELinux rules better than the simplistic examples that I've seen so far.

Can someone with SELinux experience help me form these SELinux rules with comments describing each part of the rules?

centos security glassfish selinux centos6
Martin Hope
tronda
Asked: 2010-11-20 02:17:02 +0800 CST
  • 1

The Archive Storage Engine is not enabled by the default build of MySQL in CentOS/RHEL. I would like to enable it on our CentOS 5.4 server. My initial reaction was to modify the SPEC file for the SRPMS file, but this indicates that this might not be that easy. There's always the option to build from MySQL source, but I would prefer if possible to stay within the RPMS/Yum world.

Does anybody have a successful approach to this by using RPMS/SRPMS/Yum? Some patches which makes this work flawless with SRPMS?

centos mysql rpm
Martin Hope
tronda
Asked: 2010-08-25 05:32:11 +0800 CST
  • 0

I need to test an issue with running our application behind a proxy server with different type of configurations, so I installed ISA 2006 Enterprise on a desktop computer. Since this computer only has a single network card and I want to start out easy, I chose the "Single Network Adapter" template. We have a internal NAT'ed network which is in the 10 range.

I have defined the internal network on the ISA server to be

10.XXX.YY.1 - 10.XXX.YY.255

I also have the Default rule which denies all traffic, but I've added the following Rule:

Policy - Protocols     - From             - To
Accept   HTTP            Internal           External
         HTTPS           Local Host         Internal
         HTTS Server                        Localhost

Then I configured Internet Explorer on a virutal machine running XP within virtualbox with Brigded network (gets same network address range as regular computers on our network) similar to this

Instead of the server name I used the IP address. When I try to access a web page, this doesn't go through and I get the following log messages on the proxy server:

Original Client IP  Client Agent    Authenticated Client    Service Referring Server Destination Host Name  Transport   HTTP Method MIME Type   Object Source   Source Proxy    Destination Proxy   Bidirectional   Client Host Name    Filter Information  Network Interface   Raw IP Header   Raw Payload GMT Log Time    Source Port Processing Time Bytes Sent  Bytes Received  Cache Information   Error Information   Authentication Server   Log Time    Client IP   Destination IP  Destination Port    Protocol    Action  Rule    Result Code HTTP Status Code    Client Username Source Network  Destination Network URL Server Name Log Record Type
10.XXX.YY.174               -       TCP -   -                       -               24.08.2010 13:25:24 1080    0   0   0   0x0 0x0 -   24.08.2010 06:25:24 10.XXX.YY.174   10.XXX.YY.175   80  HTTP    Initiated Connection    MyHTTPAccess    0x0 ERROR_SUCCESS           Internal    Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:24 2275    0   0   0   0x0 0x0 -   24.08.2010 06:25:24 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Initiated Connection        0x0 ERROR_SUCCESS           Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:25 2275    0   0   0   0x0 0x0 -   24.08.2010 06:25:25 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Closed Connection       0x80074e20 FWX_E_GRACEFUL_SHUTDOWN          Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:25 2276    0   0   0   0x0 0x0 -   24.08.2010 06:25:25 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Initiated Connection        0x0 ERROR_SUCCESS           Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:26 2276    0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Closed Connection       0x80074e20 FWX_E_GRACEFUL_SHUTDOWN          Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:26 2277    0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Initiated Connection        0x0 ERROR_SUCCESS           Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.159               -       UDP -   -                       -               24.08.2010 13:25:26 68  0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.159   255.255.255.255 67  DHCP (request)  Denied Connection   [Enterprise] Default rule   0xc004000d FWX_E_POLICY_RULES_DENIED            Internal    Local Host  -   PROXYTEST   Firewall
10.XXX.YY.166               -       UDP -   -                       -               24.08.2010 13:25:26 68  0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.166   255.255.255.255 67  DHCP (request)  Denied Connection   [Enterprise] Default rule   0xc004000d FWX_E_POLICY_RULES_DENIED            Internal    Local Host  -   PROXYTEST   Firewall
0.0.0.0 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Yes Proxy       10.XXX.YY.175   TCP GET     Internet    -   -       -   Req ID: 096c76ae; Compression: client=No, server=No, compress rate=0% decompress rate=0%    -   -   -   24.08.2010 13:25:27 0   2945    2581    446 0x0 0x40        24.08.2010 06:25:27 10.XXX.YY.174   10.XXX.YY.175   80  http    Failed Connection Attempt   MyHTTPAccess        10061   anonymous   Internal    Local Host  http://www.vg.no/   PROXYTEST   Web Proxy Filter
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:27 2277    0   0   0   0x0 0x0 -   24.08.2010 06:25:27 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Closed Connection       0x80074e20 FWX_E_GRACEFUL_SHUTDOWN          Local Host  Local Host  -   PROXYTEST   Firewall
isa-server proxy http-proxy
Martin Hope
tronda
Asked: 2010-04-21 05:37:20 +0800 CST
  • 5

I have successfully installed OpenManage on a CentOS 5.4 server and I'm able to use OpenManage through the web interface running on port 1311, but I would like to be able to expose this information through the SNMP server. I don't know SNMP particularly well so the configuration is a result of trial and error.

I've tried to follow the description pointed out in the Open Manage Server Administrator User Guide. I've followed the documentation regarding SNMP configuration, but without success.

I've created a small snmpd.conf file:

com2sec notConfigUser default public
group notConfigGroup v1 notConfigUser
group notConfigGroup v2c notConfigUser
view systemview included .1.3.6.1.2.1.1
view systemview included .1.3.6.1.2.1.25.1.1
access notConfigGroup "" any noauth exact all all none
view all included .1
rwcommunity public 10.200.26.50
syslocation "Somewhere"
syscontact [email protected]
pass .1.3.6.1.4.1.4413.4.1 /usr/bin/ucd5820stat
smuxpeer .1.3.6.1.4.1.674.10892.1

When I try to fetch SNMP information by using snmpwalk I get the following output:

SNMPv2-MIB::sysDescr.0 = STRING: Linux myserver.test.com 2.6.18-164.15.1.el5 #1
SMP Wed Mar 17 11:30:06 EDT 2010 x86_64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1180389) 3:16:43.89
SNMPv2-MIB::sysContact.0 = STRING: [email protected]
SNMPv2-MIB::sysName.0 = STRING: myserver.test.com
SNMPv2-MIB::sysLocation.0 = STRING: "Somewhere"
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORID.1 = OID: SNMPv2-MIB::snmpMIB
SNMPv2-MIB::sysORID.2 = OID: TCP-MIB::tcpMIB
SNMPv2-MIB::sysORID.3 = OID: IP-MIB::ip
SNMPv2-MIB::sysORID.4 = OID: UDP-MIB::udpMIB
SNMPv2-MIB::sysORID.5 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
SNMPv2-MIB::sysORID.6 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
SNMPv2-MIB::sysORID.7 = OID: SNMP-MPD-MIB::snmpMPDCompliance
SNMPv2-MIB::sysORID.8 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
SNMPv2-MIB::sysORDescr.1 = STRING: The MIB module for SNMPv2 entities
SNMPv2-MIB::sysORDescr.2 = STRING: The MIB module for managing TCP implementations
SNMPv2-MIB::sysORDescr.3 = STRING: The MIB module for managing IP and ICMP implementations
SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for managing UDP implementations
SNMPv2-MIB::sysORDescr.5 = STRING: View-based Access Control Model for SNMP.
SNMPv2-MIB::sysORDescr.6 = STRING: The SNMP Management Architecture MIB.
SNMPv2-MIB::sysORDescr.7 = STRING: The MIB for Message Processing and Dispatching.
SNMPv2-MIB::sysORDescr.8 = STRING: The management information definitions for the SNMP User-based Security Model.
SNMPv2-MIB::sysORUpTime.1 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORUpTime.2 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORUpTime.3 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORUpTime.4 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORUpTime.5 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORUpTime.6 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORUpTime.7 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORUpTime.8 = Timeticks: (0) 0:00:00.00

I suspect that I should get some DELL specific information when I use the snmpwalk utility. Is there a configuration in snmpd.conf file which is wrong, or do I have to configure on the OpenManage side in order to get the hardware information accessible from SNMP?

Update: Could mib files help me interpret the information returned from snmpwalk? I see that several mib files is located under /opt/dell/srvadmin/.

Update 2: I've verified that the SNMP daemon doesn't return any of Dell OIDs which means that either the snmpd.conf file is wrong or else there's some OpenManage configuration which is missing.

centos snmp dell configuration dell-openmanage