similar to: glibc-2.5-58.el5_6.2.i686 broken?

Hi, Reading http://www.centos.org/modules/newbb/viewtopic.php?topic_id=30939&forum=37 I noticed a warning about an upcoming bugged update xorg-x11-server-utils-7.1-5.el5_6.1 I would advise everyone to add exclude=xorg-x11-server-utils-7.1-5.el5_6.1 to their updates repo config. Regards, Leonard. -- mount -t life -o ro /dev/dna /genetic/research

Any word on approximate release date of Centos 6? Cheers, JD

Hi all, I downloaded latest CentOS 5.5 DVD i386 image from one of FTP's in a list. I've burned that image to DVD and created new DVD to use for fresh installations. Now when I install fresh CentOS 5.5 (in VM) I am getting info that there are 50 packages updates. This is ok when I have good internet speed (@work) but when I am home, this update takes a lot of time. I guess I can skip

"The upstream maintainer of yum, Seth Vidal, had the following to say about 'yum priorities' in September 2009: Gosh, I hope people do not set up yum priorities. There are so many things about priorities that make me cringe all over. It could just be that it reminds me of apt 'pinning' and that makes me want to hurl." This note was placed on the wiki

Hello John, On Thu, 2017-02-09 at 16:33 +0000, John Hodrien wrote: > On Thu, 9 Feb 2017, Leonard den Ottolander wrote: > > > How about my request for checksums in the git repo? > > What checksums would you actually want in git? SRPMS are signed which allows the integrity of the contents to be checked. Such an integrity check is missing from the git repo. Either a checksum

Hello team, Just wondering how the build of 5.10 is coming along. Is there a resource that informs us on these matters? Thanks! Regards, Leonard. -- mount -t life -o ro /dev/dna /genetic/research

On 10/19/2016 11:34 AM, Leonard den Ottolander wrote: > Hello Gordon, > *snip* > > Personally I would be more concerned whether or not to enable ECDSA > algorithms (https://blog.cr.yp.to/20140323-ecdsa.html). > > Regards, > Leonard. > For web server ECDSA certs is currently a concern because the only curves with popular support across browsers have parameters that were

On Wed, Sep 2, 2015 at 1:59 PM, Leonard den Ottolander < leonard at den.ottolander.nl> wrote: > Hello Mike, > > On Wed, 2015-09-02 at 13:05 -0400, Mike - st257 wrote: > > I've been through the virt-install manpage a few times now to no avail. > > What is wrong with my syntax here (seen below)? > > > ~]# virt-install --connect qemu:///system -n blahhost

Hello Johnny, On Wed, 2017-02-15 at 09:47 -0600, Johnny Hughes wrote: > 2. They already have shell access on the machine in question and they > can already run anything in that shell that they can run via what you > are pointing out. No, assuming noexec /home mounts all they can run is system binaries. > 3. If they have access to a zeroday issue that give them root .. they >

Hi, The fact that apparently the last tigervnc update from upstream was missed triggered me to check for missing updates and packages in 6.3. Here are my results. Sorry for any false positives that might have crept in, but note that some of the 6_x updates actually are updates and not a parsing error. And perhaps an occasional false positive due to having to compare upstream SRPMS vs downstream

On Thu, 2017-02-02 at 13:40 -0800, Gordon Messmer wrote: > Escalation *requires* attacking a program in a security context other > than your own. Not necessarily. Suppose the adversary is aware of a root exploit/privilege escalation in a random library. Then the heap spraying allows this attacker to easily trigger this exploit because he is able to initialize the entire contents of the

Hi All; I'm currently trying to expand my Samba env by including my IBM z/800 mainframe running 64 bit RHEL v3.0, CUPS printing environment into Samba. When I start Samba, the nmbd dies almost immediately. Any insight would be greatly appreciated. [root@stlpr003 root]# rpm -qa | egrep "kern|samba" kernel-2.4.21-9.0.1.EL ... samba-common-3.0.2-6.3E samba-3.0.2-6.3E

Hello list, To my astonishment the openssh versions on both C6 and C7 will by default negotiate an MD5 HMAC. C6 client, C7 server: debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none C7 client & server: debug2: mac_setup: setup hmac-md5-etm at openssh.com debug1:

Hi, In a recent security review some systems I manage were flagged due to supporting "weak" ciphers, specifically the ones listed below. So first question is are people generally modifying the list of ciphers supported by the ssh client and sshd? On CentOS 6 currently it looks like if I remove all the ciphers they are concerned about then I am left with Ciphers

On 10/19/2016 08:30 AM, Leonard den Ottolander wrote: > Where did you get the idea that AES (~ Rijndael) is a weak cipher? It's not the cipher, but the mode. CBC has several known weaknesses in TLS, and is frequently regarded as potentially insecure as a result. https://www.openssl.org/~bodo/tls-cbc.txt

On Thu, 2017-02-02 at 06:40 -0800, John R Pierce wrote: > On 2/2/2017 6:22 AM, Leonard den Ottolander wrote: > > However, the fact that the binary in the example is setuid is orthogonal > > to the fact that heap spraying is a very serious attack vector. > > without privilege escalation, what does it attack ? pkcheck might not be directly vulnerable. However, pkexec is.

Hi, I am trying to install a C6 VM on C6 using the text installer using: # virt-install -n C6_1 -r 3072 --os-variant=rhel6 -l \ ftp://ftp.nluug.nl/site/centos.org/CentOS/6.3/os/x86_64/ --disk \ path=/dev/VG1/vm_c6_1 -w network:default --nographics \ -x "console=ttyS0" --autostart /dev/VG1/vm_c6_1 has been successfully created. The installation starts but once I get to the disk

Hello, On Thu, 2015-04-02 at 14:25 +0100, Karanbir Singh wrote: > On 04/02/2015 11:45 AM, Leonard den Ottolander wrote: > > Just noticed that the distro tag used in openssl is different from > > upstream. Upstream and the last update (openssl-1.0.1e-30.el6_6.7) use > > "el6_6" where as the latest update (openssl-1.0.1e-30.el6.8) uses > > "el_6". Any

Hello Jonathan, On Wed, 2016-12-14 at 15:03 -0500, Jonathan Billings wrote: > On Wed, Dec 14, 2016 at 07:29:19PM +0100, Leonard den Ottolander wrote: > > > get_sources.sh > > > > The name suggests this is what we need (or do we??) If only I could find > > that script anywhere... > > Johnny said it at the beginning of his email. I'll paste it again so

On Sun, Sep 25, 2016 at 04:38:39PM +0200, Leonard den Ottolander wrote: > The qemu-kvm option "-enable-nesting" that I dug up in the source looks > promising. No mention in the man page on either C6 or C7 but it is > mentioned here: > https://www.redhat.com/archives/libvir-list/2012-October/msg01138.html > > How do I pass the "-enable-nesting" option to