Aaron Copley's questions

alg: drbg: could not allocate DRNG handle for ...

I only see this error on the console during the boot process of virtual machines we create. EDIT: 2/5/16 - I see it on some bare-metal installations, too. (It does proceed to boot completely.) I assume it has something to do with the virtualized hardware and lack of a (compatible) random number generator. The problem is I can't assess the severity. Is the encryption strength compromised? (Should I even care about this error?) How can I fix it?

We are using QEMU/KVM under CentOS 6.7. I can do a virsh dumpxml of a example system if you really think it will help. We are using the Anaconda default cipher/key size. (aes-xts-plain64/512)

This is the earliest reference I found on the linux-crypto mailing list. Unfortunately, it's a bit over my head.

http://www.mail-archive.com/linux-crypto%40vger.kernel.org/msg10398.html

Cross posting this from Ask@PuppetLabs. (There simply isn't enough traffic there.)

I've seen a number of examples for adding users to %wheel with Augeas. These are all variations of the same thing; inserting a user node at the end.

• Quick Tip: Add users to a group with augeas
• How to manage configurations in Linux with Puppet and Augeas
• Puppet Group Management Module

What I need to do is also remove users that are added outside of configuration management. For Puppet to manage the group, only users defined in my Puppet class should be present and any others removed.

Seems like exec'ing a simple Sed command would be much easier, but so many people say to try to stay away from exec. Is it such a bad solution in this case?

If I need to deploy Red Hat 7 from template, I would like to take the recommended steps to make my "golden image" clean. It should boot to the first boot prompt and guide the user through the typical steps.

In Red Hat 5/6, I followed the documentation provided by the vendor. However, I cannot find the equivalent for Red Hat 7. Specifically, touch /.unconfigured does not trigger the first boot setup.

9.3.1. Sealing a Linux Virtual Machine for Deployment as a Template

Summary
Generalize (seal) a Linux virtual machine before making it into a template. This prevents conflicts between virtual machines deployed from the template.

Procedure 9.6. Sealing a Linux Virtual Machine

Log in to the virtual machine. Flag the system for re-configuration by running the following command as root:

1. # touch /.unconfigured
2. Remove ssh host keys. Run:
   # rm -rf /etc/ssh/ssh_host_*
3. Set HOSTNAME=localhost.localdomain in /etc/sysconfig/network
4. Remove /etc/udev/rules.d/70-*. Run:
   # rm -rf /etc/udev/rules.d/70-*
5. Remove the HWADDR= and UUID= line from /etc/sysconfig/network-scripts/ifcfg-eth*.
6. Optionally delete all the logs from /var/log and build logs from /root.
7. Shut down the virtual machine. Run:
   # poweroff

Edit: Steps 1 & 7 can be combined by running sys-unconfig last. Or, have a look at virt-sysprep from libguestfs-tools-c which does much, much more.

 [user@hostname ~]$ virt-sysprep --list-operations
 abrt-data * Remove the crash data generated by ABRT
 bash-history * Remove the bash history in the guest
 blkid-tab * Remove blkid tab in the guest
 ca-certificates   Remove CA certificates in the guest
 crash-data * Remove the crash data generated by kexec-tools
 cron-spool * Remove user at-jobs and cron-jobs
 delete * Delete specified files or directories
 dhcp-client-state * Remove DHCP client leases
 dhcp-server-state * Remove DHCP server leases
 dovecot-data * Remove Dovecot (mail server) data
 firewall-rules   Remove the firewall rules
 firstboot * Add scripts to run once at next boot
 flag-reconfiguration   Flag the system for reconfiguration
 hostname * Change the hostname of the guest
 kerberos-data   Remove Kerberos data in the guest
 logfiles * Remove many log files from the guest
 lvm-uuids * Change LVM2 PV and VG UUIDs
 machine-id * Remove the local machine ID
 mail-spool * Remove email from the local mail spool directory
 net-hostname * Remove HOSTNAME in network interface configuration
 net-hwaddr * Remove HWADDR (hard-coded MAC address) configuration
 pacct-log * Remove the process accounting log files
 package-manager-cache * Remove package manager cache
 pam-data * Remove the PAM data in the guest
 password * Set root or user password
 puppet-data-log * Remove the data and log files of puppet
 random-seed * Generate random seed for guest
 rhn-systemid * Remove the RHN system ID
 rpm-db * Remove host-specific RPM database files
 samba-db-log * Remove the database and log files of Samba
 script * Run arbitrary scripts against the guest
 smolt-uuid * Remove the Smolt hardware UUID
 ssh-hostkeys * Remove the SSH host keys in the guest
 ssh-userdir * Remove ".ssh" directories in the guest
 sssd-db-log * Remove the database and log files of sssd
 tmp-files * Remove temporary files
 udev-persistent-net * Remove udev persistent net rules
 user-account   Remove the user accounts in the guest
 utmp * Remove the utmp file
 yum-uuid * Remove the yum UUID

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function;

What is the recommended strategy for temporary account locking in Red Hat 6?

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.)

I expect to see on the 4th attempt:

Account locked due to 3 failed logins

No combination of required or requisite or the order in the file seems to help. This is under Red Hat 6, and I am using /etc/pam.d/password-auth. The lockout does work as expected but the user does not receive the error described above. This causes a lot of confusion and frustration as they have no way of knowing why authentication fails when they are sure they are using the correct password.

Implementation follows NSA's Guide to the Secure Conguration of Red Hat Enterprise Linux 5. (pg.45) It's my understanding that that only thing changed in PAM is that /etc/pam.d/sshd now includes /etc/pam.d/password-auth instead of system-auth.

If locking out accounts after a number of incorrect login attempts is required by your security policy, implement use of pam_tally2.so.

To enforce password lockout, add the following to /etc/pam.d/system-auth. First, add to the top of the auth lines:

auth required pam_tally2.so deny=5 onerr=fail unlock_time=900

Second, add to the top of the account lines:

account required pam_tally2.so

EDIT:

I get the error message by resetting pam_tally2 during one of the login attempts.

user@localhost's password: (bad password)
Permission denied, please try again.
user@localhost's password: (bad password)
Permission denied, please try again.

(reset pam_tally2 from another shell)

user@localhost's password: (good password)
Account locked due to ...
Account locked due to ...
Last login: ...
[user@localhost ~]$

So, I can mount GVFS locations correctly (specifically CIFS) either from the Gnome "Places" menu, or via the command line gvfs-mount, but the filesystem is not mounted in the expected location; ~/.gvfs. In fact, running the mount command does not list any GVFS filesystem at all.

• This is reproducible for non-root users while the root user behaves as expected.
• Strace reveals a permissions error for the user mounting the filesystem for the path /home/username/.gvfs.
• Ownership and permissions are correct and there are no extended attributes for the path as revealed by lsattr.
• Also, /root/.gvfs and /home/username/.gvfs are on the same filesystem.
• All packages are current.

Any ideas?

EDIT:

After reading this question, I found that gvfs-fuse-daemon was not started and tried to run it manually.

$ /usr/libexec/gvfs-fuse-daemon ~/.gvfs fuse: failed to exec fusermount: Permission denied

So, the permission denied I saw in strace was on /bin/fusermount, not the destination path /home/username/.gvfs. However, /bin/fusermount is setuid so unprivileged users should be able to run it as root. I am not fond of mucking with permissions but gave /bin/fusermount o+rx to test. It executes and fixes the problem. So, why does this daemon have to be ran manually for non-root users? It seems to be an Ubuntu issue as well, but that went unanswered in the other question.

EDIT: 7/10/2012

I learned that instead of giving o+rx to /bin/fusermount I should add the user to the fuse group.

I am running the FTP daemon VSFTPD. I'd like to control FTP access by adding users to a group such that only members of the defined group can access the FTP services. I am thinking I can do this by modifying /etc/pam.d/vsftpd, but am not sure how to get started. Or is this only for virtual users in VSFTPD?

I am aware of user_list and this does not seem to support groups. This doesn't provide the function I am looking for which is described above. If I am mistaken though this would be great.

I'm not really sure how to phrase this, and maybe that's why I can't find anything, but I want to reuse the values enumerated by a wildcard in a command. Is this possible?

Scenario:

$ ls /dir 1 2 3 Contents of /dir are directories 1, 2, and 3.

$ cp /dir/*/file .

Results in file being copied from /dir/1 /dir/2 and /dir/3 to here.

What I would like to do is copy the files to a new destination name based on the wildcard expansion.

$ cp /dir/*/file ???-file would result in /dir/*/file being copied to 1-file, 2-file, and 3-file. What I can't figured out is the ??? portion to tell Bash I want to use the wildcard-expanded values.

Using the wildcard in the target nets a cp error:

cp: target `*-file' is not a directory.

Is there something else in Bash that can be used here?

The find command has {} to use with -exec which is similar to what I am looking for above.

I have hosts with and without keys in /root/.ssh. I've noticed before some on screen feedback for SSH key generation on start up (first time.) But I am not sure what the catalyst is. I have looked in /root/anaconda-ks.cfg and don't see anything different that could lead to this.

What was chosen/enabled for the servers that do versus the ones that do not?

Note: I know I can do it manually -- I am just looking to understand when / how it is inconsistently generated.

Sorry, it's just not that clear to me from the man pages, Wikipedia, etc.

I understand the concept of stratum 0 as an authoritative time source and stratum 1 as the connected server. However, I am not sure what to consider for a larger network that may have additional hops between the stratum 1 time server and ultimately the desktop. Do you consider stratum incremented with each hop as you would see in traceroute... or would these hosts be stratum 2 regardless of network "distance."