Saurabh Barjatiya's questions

I use

quotacheck -m /home

in cron.daily to check quota everyday. The server OS is CentOS-5.3. I am getting error

quotacheck: Quota for users is enabled on mountpoint /home so quotacheck might damage the file.
Please turn quotas off or use -f to force checking.

since last few days in logwatch and even on manually running the command. Should I use -f or there is some better way to keep quota files accurate. I felt quota files were not being updated at all until I call quotacheck. Can kernel automatically update quota files when file size changes?

I have used Fedora for hosting servers a lot of times. I have never faced any problem. Still all the new users come and tell Fedora is not secure. We should use Ubuntu / CentOS or some other distribution but not Fedora. I never understand what is the problem with Fedora. What makes other distributions more secure.

Few points: 1. Fedora comes with iptables configured to allow only SSH. Plus we can always configure iptables to even block SSH if we want too. So no short coming on firewall.

2. Fedora releases updates regularly (both security and general patches).

3. People say distro X releases new version once in 5 years and Fedora once in 6 months. How come releasing once in 5 years makes things secure. IF you feel 5 year old things are secure install five year old OS or dont upgrade for 5 years even if new version comes. Personally I feel not giving new version for 5 years does not adds to security. You would have to release patches for 5 years as and when bugs get detected. So using very old OS just means more patches. If we use recently released version then we have to apply less updates / patches. How releasing once in 5 years makes things secure I have never understood.

4. All OS uses similar packages like Gnome, Open-Office, KDE, Open-SSH, Apache. Do other distribution developers spend time reading source code of these packages and correcting security errors, if any? Even if they do wont they publish those flaws and all other distributions would release patches for it including Fedora. Or would they secure their own distributions and not bother to notify others. This all assuming they do read all millions of lines of codes of packages as big as apache, gcc, Open-Office. If this things are same in every distribution, what makes Fedora more vulnerable.

5. Fedora comes with seLinux preinstalled and nicely configured.

6. Bind runs in chroot by default in fedora. Now with Fedora 11 DNSSEC support is also present by default. See question DNS Server on Fedora 11 where some one pointed Fedora in not good for hosting DNS. I do not know why.

In fact one of the new admins installed Cent-OS 5.3 on one of the test machines. I used it to ping one IP which was not there. I got ping replies. I was astonished since it was not possible. I tried to find out the location from where replies are coming but failed. At end after trying for more than a hour, I removed network cable from CentOS machine. I was still able to ping the IP. Then I tried to ping IP address of the machine. I could ping that too. So I was able to ping two IPs (not others, I tried them too) when machine was configured with one IP and no aliases (eth0:1, etc.) were present. I checked ifconfig output too. I lost complete trust in so called server distributions and installed Fedora 11 on all test machines. Now I do not face such strange problems for things as basic as ping.

I would really appreciate if I could get real life examples which indicate Fedora is unsecure and if in that case it were any other distribution things would have been fine. Do not give examples were admin made mistakes. We cant blame a distribution for that. Also do not give very old Fedora 1, 2 or Fedora 3 examples. Fedora project is very mature now especially last two versions 10, 11. If you have faced security issues which are particular to only them, please share your experiences.

I have four 512 MB RAM modules in one server. The fourth RAM is showing error for only one bit when I use memtest86+ to test the RAMs. Even when I swap the RAM in fourth slot with some other RAM I still get error in RAM in fourth slot at exact same location. So I wanted to block one particular address (or 4kb page, if necessary) of RAM from being used by server. Server is having fedora 11 and is used for test purposes only. It is not hosting any user application. Any idea on how I can block certain portion of RAM from being used? or on what is causing error to come at particular byte irrespective of RAM module installed.

I have blocked emails to some addresses by using line like

To:[email protected]                  ERROR:"550 Mailbox disabled for this recipient"

But I am getting lot of messages from "Mail Delivery Subsystem ". How do I disable getting MAILER-DAEMON notifications only for this user? I can do this in my email client but I was hoping for more efficient method to stop server from sending such emails.

I do not want the other mails from "Mail Delivery Subsystem " to be stopped. The error message should not be sent for the addresses which I have manually blocked in access map.

How many maximum partitions can we create on a single drive? I remember getting error once when I had created somewhere around 16 partitions on same disk. Why put this limit? What is the problem with unlimited partitions?

I know that there can be four primary partitions for historical reasons and they get stored in first 512 bytes. So we use last partition info to point to another partition table. And after that we sort of create linked list of partitions. I just wanted to know why put a limit at all? There must be some benefit. Just because at that time no one created more than 16 partition, does not make sense putting a limit for 16 partition. There should be some gain to by putting a limit. Or some theoretical reason like we have for maximum supported file size on partition.

How can be reset password on Mac OS X? Is there something like single mode that Linux provides. I have installer CDs and DVDs of Mac with me.

I have a utility called rEFIt installed on that Mac. It allows to boot by default into other OS like Linux. As soon as I boot I get rEFIt options of booting into Mac OS X, Linux and some efi shell.

I tried alt +S but either I am not able to press it soon enough after selecting to boot from Mac or the shortcut is not working at all. Any other methods other then alt+s?

Luckily I could edit the file /efi/refit.conf without being root and rEFIt has accepted the changes. So there is no emergency now to change / reset password. Still is there some sure way for future reference?

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create certificate are taken from one tutorial website and are:

openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr 
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

After this in ssl.conf file I have specified under VirtualHost section along with old settings done by other admin

SSLEngine on
SSLCertificateFile <full_path>/server.crt
SSLCertificateKeyFile <full_path>/server.key

On starting the server I am getting following messages in log file and server fails to start.

In error_log file messages are

 [Mon Jun 01 23:52:46 2009] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

In ssl_error_log file messages are

 [Mon Jun 01 23:52:46 2009] [error] Init: Private key not found
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

I would really appreciate if some one can explain how to solve this. I have tried a few other tutorial website on self signed SSL certificates but none of the steps they mention are working.