Arlukin's questions

I have a REST-api in one pod that needs to whitelist all hostnames or ips that connects to it. In another deployment/pod I have my own kotlin program that tries to connect to the REST-api

Both deployment are exposed with ClusterIp services. I can do a "ping" request. So that works fine.

I thougt that one way was to use the service dns-name of the kotlin service. But that ip is not the same as that from the kotlin-pods.

The REST-api doesn't support subnet masks. And I can't really add all ips in the k8s cluster.

Why does apache give me this error message in my logs? Is it a false positive?

[warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)

I have recently upgraded from Centos 5.7 to 6.3, and by that to a newer httpd version. I have always made my ssl virtualhost configurations like below. Where all domains that share the same certificate (mostly/always wildcard certs) share the same ip. But never got this error message before (or have I, maybe I haven't looked to enough in my logs?) From what I have learned this should work without SNI (Server Name Indication)

Here is relevant parts of my httpd.conf file. Without this VirtualHost I don't get the error message.

NameVirtualHost 10.101.0.135:443

<VirtualHost 10.101.0.135:443>
  ServerName sub1.domain.com

  SSLEngine on
  SSLProtocol -all +SSLv3 +TLSv1
  SSLCipherSuite ALL:!aNull:!EDH:!DH:!ADH:!eNull:!LOW:!EXP:RC4+RSA+SHA1:+HIGH:+MEDIUM
  SSLCertificateFile /opt/RootLive/etc/ssl/ssl.crt/wild.fareoffice.com.crt
  SSLCertificateKeyFile /opt/RootLive/etc/ssl/ssl.key/wild.fareoffice.com.key
  SSLCertificateChainFile /opt/RootLive/etc/ssl/ca/geotrust-ca.pem
</VirtualHost>

<VirtualHost 10.101.0.135:443>
  ServerName sub2.domain.com

  SSLEngine on
  SSLProtocol -all +SSLv3 +TLSv1
  SSLCipherSuite ALL:!aNull:!EDH:!DH:!ADH:!eNull:!LOW:!EXP:RC4+RSA+SHA1:+HIGH:+MEDIUM
  SSLCertificateFile /opt/RootLive/etc/ssl/ssl.crt/wild.fareoffice.com.crt
  SSLCertificateKeyFile /opt/RootLive/etc/ssl/ssl.key/wild.fareoffice.com.key
  SSLCertificateChainFile /opt/RootLive/etc/ssl/ca/geotrust-ca.pem
</VirtualHost>

I'm trying to setup a mysql replication over an SSH tunnel. The odd thing about this setup is that I have one master with mysql 5.0.60sp1-enterprise-gpl-log and one slave with mysql 5.0.67-community-log. Could it be so that it's not possible to replicate between community and enterprise edition?

As you can see in my log below, it's possible to login on the remote server with the mysql client. But the replication get "Can't connect to MySQL server on '127.0.0.1' (13)"

Is it any log file I have forgotten to look in, to get more info?

[root@mysql1-av ~]# mysql -uroot -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 73
Server version: 5.0.67-community-log MySQL Community Edition (GPL)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

The version of the slave mysql

[root@mysql1-av ~]# autossh -f -M 20001 -L 3307:10.200.200.200:3306 [email protected] -N

[root@mysql1-av ~]# mysql -h127.0.0.1 --port 3307 -uroot -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 5189
Server version: 5.0.60sp1-enterprise-gpl-log MySQL Enterprise Server (GPL)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> Aborted

Login to the master mysql with the mysql client over the ssh tunnel.

[root@mysql1-av ~]# mysql -uroot -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 75
Server version: 5.0.67-community-log MySQL Community Edition (GPL)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> change master to master_host='127.0.0.1', MASTER_PORT=3307, master_user='xxxx', master_password='xxxx', master_log_file='bin.000001';
Query OK, 0 rows affected (0.00 sec)

mysql> start slave;
Query OK, 0 rows affected (0.00 sec)

mysql> show slave status \G
*************************** 1. row ***************************
             Slave_IO_State: Connecting to master
                Master_Host: 127.0.0.1
                Master_User: replNSG
                Master_Port: 3307
              Connect_Retry: 60
            Master_Log_File: bin.000001
        Read_Master_Log_Pos: 4
             Relay_Log_File: relay.000001
              Relay_Log_Pos: 98
      Relay_Master_Log_File: bin.000001
           Slave_IO_Running: No
          Slave_SQL_Running: Yes
            Replicate_Do_DB: 
        Replicate_Ignore_DB: 
         Replicate_Do_Table: 
     Replicate_Ignore_Table: 
    Replicate_Wild_Do_Table: 
Replicate_Wild_Ignore_Table: 
                 Last_Errno: 0
                 Last_Error: 
               Skip_Counter: 0
        Exec_Master_Log_Pos: 4
            Relay_Log_Space: 98
            Until_Condition: None
             Until_Log_File: 
              Until_Log_Pos: 0
         Master_SSL_Allowed: No
         Master_SSL_CA_File: 
         Master_SSL_CA_Path: 
            Master_SSL_Cert: 
          Master_SSL_Cipher: 
             Master_SSL_Key: 
      Seconds_Behind_Master: NULL
1 row in set (0.00 sec)

Start the replication, but it breaks on IO.

[root@mysql1-av ~]# tail /var/log/mysqld.log
120921 22:17:59 [Note] Slave I/O thread killed while connecting to master
120921 22:17:59 [Note] Slave I/O thread exiting, read up to log 'bin.000001', position 4
120921 22:17:59 [Note] Error reading relay log event: slave SQL thread was killed
120921 22:29:36 [Note] Slave SQL thread initialized, starting replication in log 'bin.000001' at position 4, relay log '/var/lib/mysql/relay.000001' position: 4
120921 22:29:36 [ERROR] Slave I/O thread: error connecting to master '[email protected]:3307': Error: 'Can't connect to MySQL server on '127.0.0.1' (13)'  errno: 2003  retry-time: 60  retries: 86400

Because it can't connect to the master server.

I just installed a minimal centos 6 through a usb dvd writer. It worked fine. But now I can't mount the dvd writer. I can't even found the /dev/dvd device. I guess a drivers is missing, but how do I find the driver?

Some output from the system.

[root@]# lsusb
Bus 002 Device 003: ID 0000:0000  
Bus 002 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 0409:0056 NEC Corp. 
Bus 001 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

The NEC device is my DVD writer.

[root@]# lsusb -v # Only output for Nec driver.
Bus 001 Device 003: ID 0409:0056 NEC Corp. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x0409 NEC Corp.
  idProduct          0x0056 
  bcdDevice            0.00
  iManufacturer           1 TSST corp
  iProduct                2 USB Mass Storage Device
  iSerial                 3 000000000001
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xc0
      Self Powered
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      5 SFF-8070i
      bInterfaceProtocol     80 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered

Everything related to usb in the /dev folder.

[root]# cd /dev
[root]# find | grep usb
./.udev/links/input\x2fby-path\x2fpci-0000:00:1d.0-usb-0:1.1:1.1-mouse
./.udev/links/input\x2fby-path\x2fpci-0000:00:1d.0-usb-0:1.1:1.1-mouse/c13:33
./.udev/links/input\x2fby-id\x2fusb-ServerEngines_SE_USB_Device_40151554C56504-mouse
./.udev/links/input\x2fby-id\x2fusb-ServerEngines_SE_USB_Device_40151554C56504-mouse/c13:33
./.udev/links/input\x2fby-path\x2fpci-0000:00:1d.0-usb-0:1.1:1.1-event-mouse
./.udev/links/input\x2fby-path\x2fpci-0000:00:1d.0-usb-0:1.1:1.1-event-mouse/c13:68
./.udev/links/input\x2fby-id\x2fusb-ServerEngines_SE_USB_Device_40151554C56504-event-mouse
./.udev/links/input\x2fby-id\x2fusb-ServerEngines_SE_USB_Device_40151554C56504-event-mouse/c13:68
./.udev/links/input\x2fby-path\x2fpci-0000:00:1d.0-usb-0:1.1:1.0-event-kbd
./.udev/links/input\x2fby-path\x2fpci-0000:00:1d.0-usb-0:1.1:1.0-event-kbd/c13:67
./.udev/links/input\x2fby-id\x2fusb-ServerEngines_SE_USB_Device_40151554C56504-event-kbd
./.udev/links/input\x2fby-id\x2fusb-ServerEngines_SE_USB_Device_40151554C56504-event-kbd/c13:67
./.udev/db/usb:1-1.4
./.udev/db/usb:2-1.1
./.udev/db/usb:2-1
./.udev/db/usb:1-1
./.udev/db/usbmon:usbmon0
./.udev/db/usb:usb1
./.udev/db/usb:usb2
./.udev/db/usbmon:usbmon2
./.udev/db/usbmon:usbmon1
./input/by-path/pci-0000:00:1d.0-usb-0:1.1:1.1-mouse
./input/by-path/pci-0000:00:1d.0-usb-0:1.1:1.1-event-mouse
./input/by-path/pci-0000:00:1d.0-usb-0:1.1:1.0-event-kbd
./input/by-id/usb-ServerEngines_SE_USB_Device_40151554C56504-mouse
./input/by-id/usb-ServerEngines_SE_USB_Device_40151554C56504-event-mouse
./input/by-id/usb-ServerEngines_SE_USB_Device_40151554C56504-event-kbd
./usbmon2
./bus/usb
./bus/usb/002
./bus/usb/002/003
./bus/usb/002/002
./bus/usb/002/001
./bus/usb/001
./bus/usb/001/003
./bus/usb/001/002
./bus/usb/001/001
./usbmon1
./usbmon0

Output from /var/log/messages

Dec  1 15:24:31 vh01-tp kernel: usb 1-1.4: new high speed USB device using ehci_hcd and address 3
Dec  1 15:24:31 vh01-tp kernel: usb 1-1.4: New USB device found, idVendor=0409, idProduct=0056
Dec  1 15:24:31 vh01-tp kernel: usb 1-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Dec  1 15:24:31 vh01-tp kernel: usb 1-1.4: Product: USB Mass Storage Device
Dec  1 15:24:31 vh01-tp kernel: usb 1-1.4: Manufacturer: TSST corp
Dec  1 15:24:31 vh01-tp kernel: usb 1-1.4: SerialNumber: 000000000001
Dec  1 15:24:31 vh01-tp kernel: usb 1-1.4: configuration #1 chosen from 1 choice
Dec  1 15:24:39 vh01-tp init: tty (/dev/tty1) main process ended, respawning

Some output from /var/log/dmsg

usb 1-1: new high speed USB device using ehci_hcd and address 2
usb 1-1: New USB device found, idVendor=8087, idProduct=0020
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1: configuration #1 chosen from 1 choice
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 6 ports detected
ata4: SATA link down (SStatus 0 SControl 300)
ata3: SATA link down (SStatus 0 SControl 300)
usb 2-1: new high speed USB device using ehci_hcd and address 2
usb 2-1: New USB device found, idVendor=8087, idProduct=0020
usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 2-1: configuration #1 chosen from 1 choice
hub 2-1:1.0: USB hub found
hub 2-1:1.0: 8 ports detected
usb 1-1.4: new high speed USB device using ehci_hcd and address 3
usb 1-1.4: New USB device found, idVendor=0409, idProduct=0056
usb 1-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1.4: Product: USB Mass Storage Device
usb 1-1.4: Manufacturer: TSST corp
usb 1-1.4: SerialNumber: 000000000001
usb 1-1.4: configuration #1 chosen from 1 choice
ata2.00: SATA link down (SStatus 0 SControl 300)
ata2.01: SATA link down (SStatus 0 SControl 300)
ata1.00: SATA link down (SStatus 0 SControl 300)
ata1.01: SATA link down (SStatus 0 SControl 300)
sd 0:0:0:0: [sda] 1953459632 512-byte logical blocks: (1.00 TB/931 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 6b 00 00 08
sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
 sda: sda1 sda2
sd 0:0:0:0: [sda] Attached SCSI disk
usb 2-1.1: new full speed USB device using ehci_hcd and address 3
usb 2-1.1: New USB device found, idVendor=0000, idProduct=0000
usb 2-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1.1: Product: SE USB Device
usb 2-1.1: Manufacturer: ServerEngines
usb 2-1.1: SerialNumber: 40151554C56504
usb 2-1.1: configuration #1 chosen from 1 choice

Output from /proc/bus/usb/devices. As I suspected, no driver seams to be installed.

T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=01 Dev#=  3 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0409 ProdID=0056 Rev= 0.00
S:  Manufacturer=TSST corp
S:  Product=USB Mass Storage Device
S:  SerialNumber=000000000001
C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=  2mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=05 Prot=50 Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Should I look somwhere else, or is the right info just in front of me?

Where should I load iptables modules, for example ip_conntrack and ip_conntrack_ftp.

Places I have found that might be candidates, but are they?

• The IPTABLES_MODULES variable in /etc/init.d/iptables
• In /etc/modprobe.conf
• In /etc/modprobe.d/xxxx.conf

I don't get any information in my log file for openldap on my Centos 6 server. This is how i configured it. SELinux is disabled at the moment.

First created a folder where I'd like to store the log files.

mkdir /var/log/slapd
chmod 755 /var/log/slapd/
chown ldap:ldap /var/log/slapd/

Then did the configuration.

ldapsearch -D "cn=admin,cn=config" -w secret -b cn=config cn=config
dn: cn=config
changetype:modify
replace: olcLogFile
olcLogFile: /var/log/slapd/slapd.log
-
replace: olcLogLevel
olcLogLevel: conns filter config acl stats shell
EOF

Just to be safe I restarted the service

service openldap restart

It does create the file, but don't write anything into the file. Of course I did some searches and updates to the LDAP-server, so it gets connections and stuff to log.

$ ls -alh
total 12K
drwxr-xr-x. 2 ldap ldap 4.0K Oct 25 14:27 .
drwxr-xr-x. 6 root root 4.0K Oct 25 14:10 ..    
-rw-r--r--. 1 ldap ldap    0 Oct 25 14:33 slapd.log

My LDAP-setup can be found here (now slightly modified on my own server)

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

Regarding to 'man slapo-auditlog' I should just need to add the following.

dn: olcOverlay=auditlog,olcDatabase={1}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /tmp/auditlog.ldif

First the "olcOverlay=auditlog" is not installed by default on Centos 6. So i cant add this to anything. If I remove "changetype: add" I will get this error.

additional info: objectClass: value #1 invalid per syntax

I found out that I could create my own cn=module, and after that olcAuditLogConfig existed, and I could execute the above LDIF. But I still don't get any auditlogs.

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib64/openldap/
olcModuleLoad: auditlog.la

My LDAP-setup can be found here (now slightly modified on my own server)

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

Where do I find information about how a specific package in centos is build. Ie. what flags has been used on ./configure etc.

At the moment I'm trying to figure out how slapd (openldap-servers) are build. Did they use "--enable-modules" when the package was configured. I guess not, but it would be interesting to get it verified.

During the last couple of days I have been using a lot of F-words, while browsing Internet for good documentation about how to setup an LDAP-server. So far I have found none, but plenty that are less than good, but better than bad. So I had to do it the usual Linux way, read, test, scream, read, test and scream.

My goals for the LDAP-server are:

• Install LDAP on a Centos 6 minimum installation, both for server and clients.
• Install in the way that the developers of OpenLDAP intended.
• Install LDAP securely with LDAPS, iptables, SELinux etc. enabled.
• Use SSSD on the clients for the "authentication" connections to the LDAP-server.

This is the kind of question that I usually answer myself, but I would appreciate suggestions about how to do the installation even better.

Does it exist any official installation documentation about how to setup an LDAP server that I can connect my clients to with authconfig. I'm will be Centos 6 and RHEL 6.1.

What I can find is this. But I don't need to learn how to restart the services, I'd more like to know what kind of stuff I need to enter in my LDIF files, any SELinux things that needs to be done, how to execute the authconfig tool and stuf that people write in their how to blogs.

Does any thing like that exist? Or do I need to get that information from unupdated blogs and by reading in linux man pages and maybe from openldap.org which has way to much information about things I don't need to know to setup authentication.

I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized python script that can be found here. But basically it's imports, repo add, profile add, reposync and other standard commands.

During the installation SELinux was in permissive mode, and added lots of stuff to the /var/log/audit/audit.log.

After the installation I did execute the following to generate SELinux rules.

    cat /var/log/audit/audit.log | audit2allow -m sycocobbler

Which gave me.

    module sycocobbler 1.0;

    require {
      type semanage_store_t;
      type syslogd_t;
      type sysfs_t;
      type var_lock_t;
      type rpm_var_cache_t;
      type httpd_sys_content_t;
      type proc_net_t;
      type file_context_t;
      type semanage_read_lock_t;
      type lib_t;
      type sysctl_modprobe_t;
      type security_t;
      type cobblerd_t;
      type modules_conf_t;
      type rpm_var_lib_t;
      type tftpdir_rw_t;
      type modules_dep_t;
      type devlog_t;
      type sysctl_kernel_t;
      type modules_object_t;
      type default_context_t;
      class rawip_socket { getopt create };
      class capability { net_admin net_raw fsetid sys_ptrace };
      class file { rename setattr read lock create write getattr unlink open };
      class netlink_audit_socket create;
      class sock_file { write getattr };
      class lnk_file { read create getattr };
      class unix_dgram_socket { create connect sendto };
      class dir { rename search setattr read create write getattr rmdir remove_name open add_name };
    }

    #============= cobblerd_t ==============
    allow cobblerd_t default_context_t:dir search;
    allow cobblerd_t devlog_t:sock_file { write getattr };
    allow cobblerd_t file_context_t:dir search;
    #!!!! The source type 'cobblerd_t' can write to a 'dir' of the following types:
    # cobbler_var_lib_t, tftpdir_rw_t, cobbler_cache_t, httpd_cobbler_rw_content_t, public_content_rw_t

    allow cobblerd_t httpd_sys_content_t:dir { rename write rmdir setattr remove_name create add_name };
    allow cobblerd_t httpd_sys_content_t:file { write rename create unlink setattr };
    #!!!! The source type 'cobblerd_t' can write to a 'dir' of the following types:
    # var_lib_t, var_log_t, named_zone_t, var_t, cobbler_var_lib_t, tftpdir_rw_t, etc_t, cobbler_cache_t, httpd_cobbler_rw_content_t, public_content_rw_t, root_t

    allow cobblerd_t lib_t:dir { write remove_name add_name };
    allow cobblerd_t lib_t:file { write create unlink };
    allow cobblerd_t modules_conf_t:dir { read search open };
    allow cobblerd_t modules_conf_t:file { read getattr open };
    allow cobblerd_t modules_dep_t:file { read getattr open };
    allow cobblerd_t modules_object_t:dir search;
    allow cobblerd_t modules_object_t:file { read open };
    allow cobblerd_t proc_net_t:file { read getattr open };
    #!!!! The source type 'cobblerd_t' can write to a 'dir' of the following types:
    # cobbler_var_lib_t, tftpdir_rw_t, cobbler_cache_t, httpd_cobbler_rw_content_t, public_content_rw_t

    allow cobblerd_t rpm_var_cache_t:dir { search read create write getattr remove_name open add_name };
    allow cobblerd_t rpm_var_cache_t:file { rename create unlink open setattr };
    #!!!! The source type 'cobblerd_t' can write to a 'dir' of the following types:
    # var_lib_t, var_log_t, named_zone_t, cobbler_var_log_t, var_t, cobbler_var_lib_t, tftpdir_rw_t, etc_t, cobbler_cache_t, httpd_cobbler_rw_content_t, public_content_rw_t, root_t

    allow cobblerd_t rpm_var_lib_t:dir { write search getattr };
    allow cobblerd_t rpm_var_lib_t:file open;
    allow cobblerd_t security_t:dir read;
    allow cobblerd_t self:capability { net_admin net_raw fsetid sys_ptrace };
    allow cobblerd_t self:netlink_audit_socket create;
    allow cobblerd_t self:rawip_socket { getopt create };
    allow cobblerd_t self:unix_dgram_socket { create connect };
    allow cobblerd_t semanage_read_lock_t:file { read lock open };
    #!!!! The source type 'cobblerd_t' can write to a 'dir' of the following types:
    # var_lib_t, var_log_t, named_zone_t, var_t, cobbler_var_lib_t, tftpdir_rw_t, etc_t, cobbler_cache_t, httpd_cobbler_rw_content_t, public_content_rw_t, root_t

    allow cobblerd_t semanage_store_t:dir { read write search };
    allow cobblerd_t semanage_store_t:file { read getattr open };
    allow cobblerd_t sysctl_kernel_t:dir search;
    allow cobblerd_t sysctl_modprobe_t:file read;
    allow cobblerd_t sysfs_t:dir { search getattr };
    allow cobblerd_t sysfs_t:file { read getattr open };
    allow cobblerd_t syslogd_t:unix_dgram_socket sendto;
    allow cobblerd_t tftpdir_rw_t:lnk_file { read create getattr };
    allow cobblerd_t var_lock_t:dir search;
    allow cobblerd_t var_lock_t:file getattr;

Am I supposed to add this to the SELinux policy? Or is it any official policy that I have missed? Is the above correct, my current SELinux skills are not good enough determine that.

As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros.

For example

    cp /usr/share/selinux/targeted/cobbler.pp.bz2 ~
    bunzip2 cobbler.pp.bz2 
    MAGIC_SELINUX_CMD cobbler.pp

What is the correct way to setup a bonded bridge on Centos 6 for KVM guests?

I'd currently playing around with a setup of two KVM-hosts which will each host several guests. I have two HP DL380:s with 4 nics each. I'd like to use two nics (eth0, eth1) in a active-backup (mode=1) bond, for failover reasons, facing internet. Then i'd like to have the two other nics (eth2, eth3) also in a active-backup bond, facing a admin/back net.

On top of the bond I need a bridge that the KVM guests will use to access front or back network.

On the interwebz I have found many different ways to configure this. Some are just mentioning bonding, some just bridging and some are tring to combine it. None that I have found has metioned what will happen if I use a front and back net with many hosts.

Some of my problems/questions are.

• I got a fetich on correct config files, the way the developers thought they should be, not just working config files.
• I got error "kernel: bond0: received packet with own address as source address". Both for bond0 and bond1.
• Will the traffic automtically be forwarded from the back-net to the front-net. Should I use ebtables/iptables or something to disable the forwarding traffic?
• Do I need to use Spanning Tree Protocol (STP)?
• Do I need any specific routes?

Here is a nice picture how the environment looks (at least a part of it.)

Here are my relevant config files.

/etc/sysconfig/network

NETWORKING=yes
HOSTNAME=host1
GATEWAYDEV=br0
NETWORKING_IPV6=no

/etc/sysconfig/network-scripts/ifcfg-eth0 -- ifcfg-eth3

DEVICE="ethX"
NM_CONTROLLED="no"
ONBOOT=yes
HWADDR=xx:xx:xx:xx:xx:xx
SLAVE=yes
MASTER=bondX
HOTPLUG=no
BOOTPROTO=none

/etc/sysconfig/network-scripts/ifcfg-bond0 -- ifcfg-bond1

DEVICE=bondX
BONDING_OPTS="miimon=100 mode=1"
ONPARENT=yes
BOOTPROTO=none
BRIDGE=brX

/etc/sysconfig/network-scripts/ifcfg-br0

DEVICE=br0
TYPE=Bridge
ONBOOT=yes
DELAY=0
BOOTPROTO=none

/etc/sysconfig/network-scripts/ifcfg-br1

DEVICE=br1
TYPE=Bridge
ONBOOT=yes
DELAY=0
BOOTPROTO=static
IPADDR=10.0.1.100
NETMASK=255.255.255.0

Update 1

• Added /etc/sysctl.conf
• Removed ip from ifcfg-br0. The host shouldn't be accessible from internet, only from admin net.

* Update 2*

• Removed changes to /etc/sysctl.conf. Don't need to enable iptables.

I have a firewall with two network cards. From internet it's possible to access the external-ip and then be forwarded to an internal server. But when on the DMZ and accessing the external-ip, I'm not forwarded back into the internal server.

I guess this is the rules that are relevant to this question. Shouldn't they be enough.

$IPTABLES -t nat -A PREROUTING -p TCP -d $MAIL_IP --dport 122 -j DNAT --to-destination $DMZ_MAIL_IP:22

$IPTABLES -A FORWARD -p TCP  -o $DMZ_IFACE -d $DMZ_MAIL_IP -m multiport --dports 122 -j allowed

I have lot's of other rules, and infact two other network cards, just isolating the question here.

SOLUTION:

I had a to restrictive SNAT rule.

Something like this solved the problem. iptables -t nat -I POSTROUTING -s $INTERNAL_CLIENT -j SNAT --to-source $MAIL_IP

I have a bunch of pdfs and other textfiles. I would like some software that scans a folder with all my files, and the presents them on an html page. Preferable some kind of search tool added to it also.

I'm runnings linux, currently centos and ubuntu.

Does a software for that exist, something that is a little bit better then "directory listing"? Or do I need to hack something up myself.