Re: [CentOS] Use postfix and spamd on CentOS 6 - looking for a shortest guide

2014-08-12 Thread Alexander Farber
Hello again,

here is my solution on how to use Postfix + Spamassassin on CentOS in 4
steps:

1) yum install spamassassin

2) useradd spam

3) Add the following line to /etc/postfix/header_checks:

/^Subject: \[SPAM\]/ DISCARD

4) Add the following lines to /etc/postfix/master.cf:

smtp inet n - n - - smtpd -o content_filter=spamassassin
spamassassin unix - n n - - pipe user=spam argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}

More details:

http://serverfault.com/questions/619537/use-postfix-and-spamassassin-packages-on-centos-6-to-reject-spam-without-custo

Regards
Alex
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] Use postfix and spamd on CentOS 6 - looking for a shortest guide

2014-08-12 Thread Alexander Dalloz
Am 12.08.2014 um 00:09 schrieb David Beveridge:

> Another alternative to milters is the postfix policy daemons.
> The best one to use for block and reject is policyd-weight.
> found here http://www.policyd-weight.org/
>
> This gives spam a weight based on a number of factors.
> I setup to do this
> score <0 accept immediately
> score <10 greylist then verify sender, then spf, then spamassassin if not
> spf pass.
> score >10 reject immediately
>
> dave

You should have mentioned that policyd-weight has nothing to do with 
integrating spamassassin into Postfix. The scores you speak about are 
not spam scoring points coming from spamassassin.

Alexander


___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


[CentOS] CentOS-announce Digest, Vol 114, Issue 6

2014-08-12 Thread centos-announce-request
Send CentOS-announce mailing list submissions to
centos-annou...@centos.org

To subscribe or unsubscribe via the World Wide Web, visit
http://lists.centos.org/mailman/listinfo/centos-announce
or, via email, send a message with subject or body 'help' to
centos-announce-requ...@centos.org

You can reach the person managing the list at
centos-announce-ow...@centos.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of CentOS-announce digest..."


Today's Topics:

   1. CEBA-2014:1030  CentOS 6 plymouth Update (Johnny Hughes)
   2. CESA-2014:1038 Low CentOS 6 tomcat6 Update (Johnny Hughes)


--

Message: 1
Date: Mon, 11 Aug 2014 18:03:47 +
From: Johnny Hughes 
Subject: [CentOS-announce] CEBA-2014:1030  CentOS 6 plymouth Update
To: centos-annou...@centos.org
Message-ID: <20140811180347.ga26...@n04.lon1.karan.org>
Content-Type: text/plain; charset=us-ascii


CentOS Errata and Bugfix Advisory 2014:1030 

Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1030.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

i386:
7568b606796a506f71743a9ecfcf173289d3c585b05ebbeda42226068fd23794  
plymouth-0.8.3-27.el6.centos.1.i686.rpm
973a03c2e84adadbe891d373a58d3af6db377cd0388c655baf90a6d6f2cbf278  
plymouth-core-libs-0.8.3-27.el6.centos.1.i686.rpm
056cf72c1481ed70265bf8d5ed75129e51a5d27384fd67c5a555320c0a3161a8  
plymouth-devel-0.8.3-27.el6.centos.1.i686.rpm
19d971d21afc18d8ce467adeb9a03b8829056020065058d018dc0cc2a082e2c9  
plymouth-gdm-hooks-0.8.3-27.el6.centos.1.i686.rpm
079e877497f68d38daafc9c240be99c3ed8756e8be7ef82d43d2d3211538e962  
plymouth-graphics-libs-0.8.3-27.el6.centos.1.i686.rpm
dfc10d3faebb5e2bc0824bafbc8379aea11c4bfa7b6272015fe7634de0f9567f  
plymouth-plugin-fade-throbber-0.8.3-27.el6.centos.1.i686.rpm
b2d8841de5ec7113033e46546479ab251a99b22dee8de7ce585bd83e12930564  
plymouth-plugin-label-0.8.3-27.el6.centos.1.i686.rpm
6dd6900747a71950ce1a6b940691f0b47127c2eff9d221c4d9e90425d1bee013  
plymouth-plugin-script-0.8.3-27.el6.centos.1.i686.rpm
ca60a9792a080d2a9e5ef3c7c868bdb116c5f8224009ca81408b6a357a4c1b97  
plymouth-plugin-space-flares-0.8.3-27.el6.centos.1.i686.rpm
9cdaec4c9fde656de0abcef8ffee1eb5e4a1ecabd0e43858da89577857b18332  
plymouth-plugin-throbgress-0.8.3-27.el6.centos.1.i686.rpm
0b966d04bf4bb40d43c4cfee210c3a64393bd6dd3cd253eb935d9214f081575a  
plymouth-plugin-two-step-0.8.3-27.el6.centos.1.i686.rpm
3a5317b38367ed63b8826d98549e65afdd2d8f86857cf9c3ecf7d88835bfd59d  
plymouth-scripts-0.8.3-27.el6.centos.1.i686.rpm
5ba143327bf4a936ce4376dba0db8990b3777e8eafaf29764c9056972e7595a6  
plymouth-system-theme-0.8.3-27.el6.centos.1.noarch.rpm
0f2bb0fb73a08df09fbb69e3d0d00d3a0ed5622639d4f7b161c32435e0491ed0  
plymouth-theme-fade-in-0.8.3-27.el6.centos.1.noarch.rpm
d85c60009cf61d2275248488f3ed3b5b8d7f9839c9199764c2a73caf3f25d66b  
plymouth-theme-rings-0.8.3-27.el6.centos.1.noarch.rpm
147a72348c9a4ac228229c204105234ec6025096c57efd00f16b7442e11e1365  
plymouth-theme-script-0.8.3-27.el6.centos.1.noarch.rpm
893d5878d4185af0adaa26a5b7b464cd1fb086329f945b04f46656e699e4fa35  
plymouth-theme-solar-0.8.3-27.el6.centos.1.noarch.rpm
cdd4244ea66efe5b504a8d8eb46f0cedc68917e3297807db505511c79f886e54  
plymouth-theme-spinfinity-0.8.3-27.el6.centos.1.noarch.rpm
c2e504cce74b5fa0f8ad020047483eb1f683bba3bdb384f3ca3971dde86c2cc6  
plymouth-utils-0.8.3-27.el6.centos.1.i686.rpm

x86_64:
7c256cc4b5e2f17ab04c62ba30e3835aa99c81756408c02dae9d20f6232d0fd8  
plymouth-0.8.3-27.el6.centos.1.x86_64.rpm
973a03c2e84adadbe891d373a58d3af6db377cd0388c655baf90a6d6f2cbf278  
plymouth-core-libs-0.8.3-27.el6.centos.1.i686.rpm
a7450913b1b5a398447e555b29df5e38b89ebee7c7451b2962672c486351166c  
plymouth-core-libs-0.8.3-27.el6.centos.1.x86_64.rpm
056cf72c1481ed70265bf8d5ed75129e51a5d27384fd67c5a555320c0a3161a8  
plymouth-devel-0.8.3-27.el6.centos.1.i686.rpm
b484c1dde3979bb6a21953cc2bdf555bfaa7346af6eee647808d9e76ee7470a4  
plymouth-devel-0.8.3-27.el6.centos.1.x86_64.rpm
08e458127bf25f8ed130320e9e276e5df8666334d41ace5284e29d4d941b0a35  
plymouth-gdm-hooks-0.8.3-27.el6.centos.1.x86_64.rpm
079e877497f68d38daafc9c240be99c3ed8756e8be7ef82d43d2d3211538e962  
plymouth-graphics-libs-0.8.3-27.el6.centos.1.i686.rpm
13ed3f9b216d9d04ac6df7570d9ea21aeae62351359893a2512b9787bc7b5154  
plymouth-graphics-libs-0.8.3-27.el6.centos.1.x86_64.rpm
d718c13d0b834b4107c325e6c4e5e6c648a072e80bce9b49aca014643369739e  
plymouth-plugin-fade-throbber-0.8.3-27.el6.centos.1.x86_64.rpm
e9795e79cde9a0375706982ac06972e8c2535a275a3b035f2f1694f4a391e2c2  
plymouth-plugin-label-0.8.3-27.el6.centos.1.x86_64.rpm
45dcc256e14833d101fc13e6cef9045de7e29b18ec4158e107832769b711297f  
plymouth-plugin-script-0.8.3-27.el6.centos.1.x86_64.rpm
cc4181a2217c37f3ba9f8ad813eb3e06533609ffcaf63a0871c603a2cb90b476  
plymouth-plugin-space-flares-0.8.3-27.el6.centos.1.x86_64.rpm
8008278dc1aaf03b18c

Re: [CentOS] when will docker 1.1.2 for rhel7 be released?

2014-08-12 Thread Jim Perrin


On 08/11/2014 07:02 PM, Dennis Jacobfeuerborn wrote:

> Looks like docker-io-1.0.0 is available in EPEL:
> http://dl.fedoraproject.org/pub/epel/beta/7/x86_64/repoview/docker-io.html

This package is due to be removed from EPEL soon, because of EPEL's
policy of not competing/conflicting with base offerings. I wouldn't rely
on this particular package


> If you really want to use the latest version of docker you cannot rely
> on RHEL packages though as they only get updated with important fixes
> and usually only with point releases (unless it's a security bug).


Keep in mind that docker is part of upstream's 'Extras' repository,
which doesn't have the same lifecycle that the rest of EL7 has. It's a
shorter 18 month cycle I believe, so you might very well see re-basing
going on there.

-- 
Jim Perrin
The CentOS Project | http://www.centos.org
twitter: @BitIntegrity | GPG Key: FA09AD77
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Jonathan Billings
On Fri, Aug 08, 2014 at 04:55:15PM -0500, Neil Aggarwal wrote:
> I am looking at the documentation of the new firewalld service in CentOS 7.
> It looks like no matter what I configure with it, outgoing connections are
> still going to be allowed.  That does not seem very secure.

Looking at the documentation closer, there does appear to be a way to
add rules to the OUTPUT table, using the rich rules syntax.

Red Hat documents it in this KB, that is only open to subscribers:
https://access.redhat.com/solutions/1121463

Here's basically how it's done:

# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p tcp -m 
tcp --dport=80 -j ACCEPT
success
# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -p tcp -m 
tcp --sport=80 -j ACCEPT
success
# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 99 -j DROP
success

# firewall-cmd --permanent --direct --get-all-rules
ipv4 filter OUTPUT 0 -p tcp -m tcp --dport=80 -j ACCEPT
ipv4 filter OUTPUT 1 -p tcp -m tcp --sport=80 -j ACCEPT
ipv4 filter OUTPUT 99 -j DROP

That restricts outgoing traffic to only port 80 as the source and
destination port. 

Hopefully Red Hat opens up that KB, it would have been nice to find
this earlier in the thread.  It's still an overly complex way of doing
things, although not much more so than running the iptables command.


-- 
Jonathan Billings 
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Alexander Dalloz
Am 2014-08-08 23:55, schrieb Neil Aggarwal:
> Hello all:
> 
> I am looking at the documentation of the new firewalld service in 
> CentOS 7.
> It looks like no matter what I configure with it, outgoing connections 
> are
> still going to be allowed.  That does not seem very secure.
> 
> I always set my servers to default policy of DROP for everything 
> incoming
> and outgoing and then add rules to allow very specific traffic through.
> 
> Is this possible using the new firewalld service or should I disable it 
> and
> go back to using iptables?
> 
> Thanks,
>   Neil


Those with a RHEL subscription can find a Red Hat knowledge base articel 
under

  https://access.redhat.com/solutions/1121463

about the question "How to filter outbound or outgoing network traffic 
in RHEL7?"

It pretty much explains how to achieve outbound filtering using 
FirewallD.

Alexander


___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Neil Aggarwal
Jonathan:

> Looking at the documentation closer, there does appear to be a way to
> add rules to the OUTPUT table, using the rich rules syntax.

Do you see a way to set the default policy to DROP?

Thanks,
  Neil

--
Neil Aggarwal, (972) 834-1565
We lend money to investors to buy or refinance single family rent houses.
No origination fees, quick approval, no credit check.

___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] when will docker 1.1.2 for rhel7 be released?

2014-08-12 Thread Daniel J Walsh
We are working on an update to docker within RHEL7.  First we are
releasing it to our High Touch Beta process.  If you are on HTB you
should see a release in the next week.


On 08/12/2014 08:54 AM, Jim Perrin wrote:
>
> On 08/11/2014 07:02 PM, Dennis Jacobfeuerborn wrote:
>
>> Looks like docker-io-1.0.0 is available in EPEL:
>> http://dl.fedoraproject.org/pub/epel/beta/7/x86_64/repoview/docker-io.html
> This package is due to be removed from EPEL soon, because of EPEL's
> policy of not competing/conflicting with base offerings. I wouldn't rely
> on this particular package
>
>
>> If you really want to use the latest version of docker you cannot rely
>> on RHEL packages though as they only get updated with important fixes
>> and usually only with point releases (unless it's a security bug).
>
> Keep in mind that docker is part of upstream's 'Extras' repository,
> which doesn't have the same lifecycle that the rest of EL7 has. It's a
> shorter 18 month cycle I believe, so you might very well see re-basing
> going on there.
>

___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Jonathan Billings
On Tue, Aug 12, 2014 at 09:26:17AM -0500, Neil Aggarwal wrote:
>
> Jonathan:
> 
> > Looking at the documentation closer, there does appear to be a way to
> > add rules to the OUTPUT table, using the rich rules syntax.
> 
> Do you see a way to set the default policy to DROP?

Most likely, just adding the rich rule with the DROP in it will make
the OUTPUT rule drop by default.  I haven't tested it.

-- 
Jonathan Billings 
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Valeri Galtsev
Wonderful!

Can you do with firewalld an equivalent of the following done with iptables:

:SSHSCAN - [0:0]
-A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN
-A SSHSCAN -m recent --set --name SSH
-A SSHSCAN -m recent --update --seconds 300 --hitcount 10 --name SSH -j DROP
-A INPUT -p tcp --dport 22 -j ACCEPT

I use it for years (lifted from some cleverer than I person of the
internet). This effectively thwarts brute force password attacks from the
network. It allows only 10 _new_ connection within 5 min window. Of
course, it counts all successful and unsuccessful connections (with
sshguard on FreeBSD I do better: only react on unsuccessful connections),
but it still does pretty good job.

I guess, we all have accumulated some set of nice tools, and we don't like
to just throw them away - in exchange for what? Long ago I learned a rule
(what users will expect from a good sysadmin): do not make any changes
unless they are absolutely necessary. I find myself expecting the same
from system vendor, or at least an understanding why this or that change
is necessary. So far I don't see any reasons other than giving an ability
to administer the system to every computer user without special
knowledge... Which is pretty good, we need free (and much better!)
alternatives to M$ Windows. As far as our demands for servers are
concerned: they can be fulfilled by other alternatives (FreeBSD being one
of them).


Thanks again for education us in how we can do what we need using firewalld!

Valeri

On Tue, August 12, 2014 8:21 am, Jonathan Billings wrote:
> On Fri, Aug 08, 2014 at 04:55:15PM -0500, Neil Aggarwal wrote:
>> I am looking at the documentation of the new firewalld service in CentOS
>> 7.
>> It looks like no matter what I configure with it, outgoing connections
>> are
>> still going to be allowed.  That does not seem very secure.
>
> Looking at the documentation closer, there does appear to be a way to
> add rules to the OUTPUT table, using the rich rules syntax.
>
> Red Hat documents it in this KB, that is only open to subscribers:
> https://access.redhat.com/solutions/1121463
>
> Here's basically how it's done:
>
> # firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p tcp
> -m tcp --dport=80 -j ACCEPT
> success
> # firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -p tcp
> -m tcp --sport=80 -j ACCEPT
> success
> # firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 99 -j
> DROP
> success
>
> # firewall-cmd --permanent --direct --get-all-rules
> ipv4 filter OUTPUT 0 -p tcp -m tcp --dport=80 -j ACCEPT
> ipv4 filter OUTPUT 1 -p tcp -m tcp --sport=80 -j ACCEPT
> ipv4 filter OUTPUT 99 -j DROP
>
> That restricts outgoing traffic to only port 80 as the source and
> destination port.
>
> Hopefully Red Hat opens up that KB, it would have been nice to find
> this earlier in the thread.  It's still an overly complex way of doing
> things, although not much more so than running the iptables command.
>
>
> --
> Jonathan Billings 
> ___
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247

___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Always Learning

On Tue, 2014-08-12 at 09:59 -0500, Valeri Galtsev wrote:

> Long ago I learned a rule
> (what users will expect from a good sysadmin): do not make any changes
> unless they are absolutely necessary.

The English (non-American) version is

"If it ain't broke, don't fix it."


So, to use in C7's firewalld (some of, because it is doubtful all
exists) the functionality of IP Tables, one must first convert one's
adequately expressed IP Tables wishes into a pseudo language which then
changes the longer and more convoluted firewalld 'instruction' back into
normal IP Tables syntax ?

Some may innocently believe this is wonderful for Red Hat's eventual
Lindoze Linux but how is this making life easier for
computer-knowledgeable people ?  Is it genuinely sensible ?


-- 
Regards,

Paul.
England, EU.

   Centos, Exim, Apache, Libre Office.
   Linux is the future. Micro$oft is the past.

___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Always Learning

On Mon, 2014-08-11 at 21:19 -0700, Kirk Bocek wrote:


> I have now been alerted by two list members to the behavior of the 
> individual involved. I will not allow myself to be baited again.

I have blocked his normal and private email addresses on every incoming
MTA. Details available.


-- 
Regards,

Paul.
England, EU.

   Centos, Exim, Apache, Libre Office.
   Linux is the future. Micro$oft is the past.

___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Jonathan Billings
On Tue, Aug 12, 2014 at 09:59:17AM -0500, Valeri Galtsev wrote:
>
> Wonderful!
> 
> Can you do with firewalld an equivalent of the following done with iptables:
> 
> :SSHSCAN - [0:0]
> -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN
> -A SSHSCAN -m recent --set --name SSH
> -A SSHSCAN -m recent --update --seconds 300 --hitcount 10 --name SSH -j DROP
> -A INPUT -p tcp --dport 22 -j ACCEPT

Yes, I believe that's possible with the 'firewall-cmd --direct
--addchain ...' and 'firewall-cmd --direct --add-rule ...' syntax:

# firewall-cmd --permanent --direct --add-chain ipv4 filter SSHSCAN
success
# firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow -p 
tcp --dport 22 -m state --state NEW -j SSHSCAN
success
# firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow 0 -p 
tcp --dport 22 -m state --state NEW -j SSHSCAN
success
# firewall-cmd --permanent --direct --add-rule ipv4 filter SSHSCAN 0 -m recent 
--set --name SSH
success
# firewall-cmd --permanent --direct --add-rule ipv4 filter SSHSCAN 1 -m recent 
--update --seconds 300 --hitcount 10 --name SSH -j DROP
success
# firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow 1 -p 
tcp --dport 22 -j ACCEPT
success

This has the handy side-effect of being able to just drop this in
/etc/firewalld/direct.xml:

# cat /etc/firewalld/direct.xml


  
  -p tcp 
--dport 22 -m state --state NEW -j SSHSCAN
  -p tcp 
--dport 22 -j ACCEPT
  -m recent --set 
--name SSH
  -m recent 
--update --seconds 300 --hitcount 10 --name SSH -j DROP



You could also make sure that it's added to other zones other than
'public' (by using something other than IN_public_allow).

This is a *great* example of why firewalld wins over the old
monolithic /etc/sysconfig/iptables.  It's just a file I can manage
with my CM tools.  Changes to other firewall rules (such as allowing
in port 80 for web servers) doesn't rewrite editing this file.


-- 
Jonathan Billings 
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] CentOS 7 - Firewall always allows outgoing packets?

2014-08-12 Thread Valeri Galtsev
Great, thanks!

It looks like I will survive even if they drop "iptables-service" in some
future to come. Just for my understanding which of the following is
incorrect:

1. firewalld is a front end to the iptables kernel module (pretty much as
"iptables-service" is)
2. therefore the rules syntax is pretty much the same (well, is pretty
close), only in config file(s) all is wrapped into xml (to please GUI
front end used by GUI people).
3. in the past we had both kernel module and front end written by the same
team of programmers (iptables), from now on we are using front end by one
team of programmers for kernel module written by another team.

Thanks for all your help in understanding where do we stand now!

Valeri

On Tue, August 12, 2014 10:58 am, Jonathan Billings wrote:
> On Tue, Aug 12, 2014 at 09:59:17AM -0500, Valeri Galtsev wrote:
>>
>> Wonderful!
>>
>> Can you do with firewalld an equivalent of the following done with
>> iptables:
>>
>> :SSHSCAN - [0:0]
>> -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN
>> -A SSHSCAN -m recent --set --name SSH
>> -A SSHSCAN -m recent --update --seconds 300 --hitcount 10 --name SSH -j
>> DROP
>> -A INPUT -p tcp --dport 22 -j ACCEPT
>
> Yes, I believe that's possible with the 'firewall-cmd --direct
> --addchain ...' and 'firewall-cmd --direct --add-rule ...' syntax:
>
> # firewall-cmd --permanent --direct --add-chain ipv4 filter SSHSCAN
> success
> # firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow
> -p tcp --dport 22 -m state --state NEW -j SSHSCAN
> success
> # firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow
> 0 -p tcp --dport 22 -m state --state NEW -j SSHSCAN
> success
> # firewall-cmd --permanent --direct --add-rule ipv4 filter SSHSCAN 0 -m
> recent --set --name SSH
> success
> # firewall-cmd --permanent --direct --add-rule ipv4 filter SSHSCAN 1 -m
> recent --update --seconds 300 --hitcount 10 --name SSH -j DROP
> success
> # firewall-cmd --permanent --direct --add-rule ipv4 filter IN_public_allow
> 1 -p tcp --dport 22 -j ACCEPT
> success
>
> This has the handy side-effect of being able to just drop this in
> /etc/firewalld/direct.xml:
>
> # cat /etc/firewalld/direct.xml
> 
> 
>   
>   -p
> tcp --dport 22 -m state --state NEW -j SSHSCAN
>   -p
> tcp --dport 22 -j ACCEPT
>   -m recent
> --set --name SSH
>   -m recent
> --update --seconds 300 --hitcount 10 --name SSH -j DROP
> 
>
>
> You could also make sure that it's added to other zones other than
> 'public' (by using something other than IN_public_allow).
>
> This is a *great* example of why firewalld wins over the old
> monolithic /etc/sysconfig/iptables.  It's just a file I can manage
> with my CM tools.  Changes to other firewall rules (such as allowing
> in port 80 for web servers) doesn't rewrite editing this file.
>
>
> --
> Jonathan Billings 
> ___
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247

___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


[CentOS] Package hwloc-1.5-2.el6_5.x86_64.rpm is not signed

2014-08-12 Thread Leonard den Ottolander
Package hwloc-1.5-2.el6_5.x86_64.rpm is not signed

-- 
mount -t life -o ro /dev/dna /genetic/research


___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] Package hwloc-1.5-2.el6_5.x86_64.rpm is not signed

2014-08-12 Thread Karanbir Singh
On 08/13/2014 12:37 AM, Leonard den Ottolander wrote:
> Package hwloc-1.5-2.el6_5.x86_64.rpm is not signed
> 

fixed, signed rpms now posted. thanks for the heads up

-- 
Karanbir Singh
+44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh
GnuPG Key : http://www.karan.org/publickey.asc
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos