default SSL enabled in Oracle Internet Application Server 10gr2 ias10gr2

So, if you dont have a directive for "data id="start-mode" value="ssl-enabled"" in your opmn.xml file then any directives in your ssl.conf don't get loaded due to the IfDefine SSL thats in by default the httpd.conf and ssl.conf files.

Idiots in the industry.

"You can buy 10 idiots to perform the tasks of what 2-3 highly qualified individuals can, IF customers don't care."

SELinux, Oracle, and RedHat Enterprise Linux revisited...

Ran into some more issues with SELinux and Oracle. We have some libraries stored in another location that are compiled with -fpic -shared (CFLAGS) and the program linking to it wasn't, and neither are any of the other libraries it links to (provided by Oracle... 10gr2 DB software)

SELinux is set to enforcing, but targeted.

So whats the fix...Well you either set all the libraries to a textrelocatable context ala chcon -t texrel_shlib_t /u01/app/oracle/product/10.2/client/lib/*.so

for 64bit. Then, like I ran into with using an external php as it tries to call oracle libraries, you  must set the exec stack... execstack -c /path/to/library.so

Ok, thats one way to do it..
The other is to `setsebool -P allow_execmod=1` to allow execmods across relocatable text...

Thats how I did it...because Oracle can't compile their libraries right, and my DBA was tired of waiting...I'd prefer to not have to do this at all though eh?

SELinux, Apache and PHP 5.

Recently at work we hired a contractor to come in and do some work.  The department that hired him requested a machine for him. Instead of giving the guy admin access on a CentOS machine, I decided he could run everything in user space.  Thats fine...and I figured I'd duplicate the environment he'd use just so I could make sure it would work.  I don't like to provision machines and give anyone but myself or my system administrators admin access.

The guy wanted PHP5, Apache 2 (I used 2.2), Moodle (Some Courseware php program), and PostgreSQL.

Everything compiled without a hitch (mostly, since I had to look up what all php modules he needed compiled in...also added Suhosin for good measure since who knows what this guy will be doing.)

After fighting a bit with PHP modules I then discovered that SELinux was denying access to libphp5.so in the apache httpd/modules directory.

This was an error : "cannot restore segment prot after reloc: Permission denied" - Of course, disabling SELinux fixed this...but I dont always want to disable SELinux...

Someone suggested running execstack against libphp5.so to enable a flag on the file so SELinux would let Apache load the module...That didn't work.

I'll update this post later with some answers...I hope. For now, I'm leaving the office.

yum rollback feature / rpm rollback feature

Doing some upgrades this week on a production system and don't want anything to break...So, I looked into this.

One of the least-known secrets about rpm is that it can rollback (undo) package changes. It can take a fair bit of storage space to track the information necessary for rollback, but since storage is cheap, it’s worthwhile enabling this feature on most systems.
Here are cut-to-the-chase directions on using this feature:

1. To configure yum to save rollback information, add the line tsflags=repackage to /etc/yum.conf.
   
2. To configure command-line rpm to do the same thing, add the line %_repackage_all_erasures 1 to /etc/rpm/macros.
   
3. Install, erase, and update packages to your heart’s content, using pup, pirut, yumex, yum, rpm, and the yum automatic update service.
   

If/when you want to rollback to a previous state, perform an rpm update with the –rollback option followed by a date/time specification. Some examples: rpm -Uhv –rollback ‘9:00 am’, rpm -Uhv –rollback ‘4 hours ago’, rpm -Uhv –rollback ‘december 25′.

php5 / suhosin extension (not patch) on CentOS or RHEL

Red Hat / CentOS Linux Install Suhosin PHP 5 Protection Security Patch

Q. Wordpress and many other open source application developers asks users to protect PHP apps using Suhosin patch to get protection from the full exploit. Suhosin is an advanced protection system for PHP installations. It was designed to protect your servers from various attacks. How do I install Suhosin under RHEL / CentOS / Fedora Linux?

A. Suhosin was designed to protect your servers against a number of well known problems in PHP applications and on the other hand against potential unknown vulnerabilities within these applications or the PHP core itself including wordpress and many other open source php based apps.

Install Suhosin as extension

Download latest version of Suhosin, enter:
# cd /opt
# wget http://download.suhosin.org/suhosin-0.9.27.tgz
Make sure you have php-devel installed:
# yum install php-devel

Compile Suhosin under PHP 5 and RHEL / CentOS Linux

Type the following commands:
# cd suhosin-0.9.27
# phpize
#./configure
# make
# make install

Configure Suhosin

Type the following command to create Suhosin configuration file:
# echo 'extension=suhosin.so' > /etc/php.d/suhosin.ini

Restart web server

Type the following command to restart httpd:
# service httpd restart
If you are using lighttpd, enter:
# service lighttpd restart

Verify Suhosin installation

Type the following command:
$ php -v
Sample output:

PHP 5.1.6 (cli) (built: Jun 12 2008 05:02:36)
Copyright (c) 1997-2006 The PHP Group
Zend Engine v2.1.0, Copyright (c) 1998-2006 Zend Technologies
    with XCache v1.2.2, Copyright (c) 2005-2007, by mOo
    with Suhosin v0.9.27, Copyright (c) 2007, by SektionEins GmbH

You can find more information by running phpinfo():

phpinfo();
?>

Sample output:

Fig.01: Suhosin information and settings displayed by phpinfo()

setup bridging br0 eth0 on Centos or RHEL for KVM virtual machines

There were several places online I could've visited to help me get bridging going on my system...They all seemed to be written for a home user though.

I recently setup a new CentOS 5.4 workstation on a machine here at work, and have been planning on moving everything over to that from my Mac Management station. Currently using a Macbook Pro as a management station but I'd like to free it up to do other things...

Also I wanted to do some KVM virtualizing because thats how RedHat does it, and thats our vendor...so...

For starters, I needed to let any VM's I created have bridged access to the network... This was probably the most difficult part, because it was just a mixed-bag when it came to how other people had done it. Here's how I did it, and it works for me.

The interface is an Intel gigabit card (wasn't supported until 5.3 out of the box!), so 1 physical interface formerly known as eth0.

`yum install bridge-utils` will install the proper utilities to enable bridging, and should also enable the kernel module on most distros.

I guess the tricky thing is, when you use bridging, you're actually kind of saying "ok bye eth0, we're going to replace you with br0 and then let br0 hand out access to any other interfaces" - This is hard for some people to grasp...

So goto /etc/sysconfig/network-scripts and `cp ifcfg-eth0 ifcfg-br0`

Then edit ifcfg-br0 to contain the following information:
DEVICE=br0
BOOTPROTO=static
ONBOOT=yes
NETMASK=255.255.255.0
IPADDR=x.x.x.x
GATEWAY= x.x.x.1
TYPE=Bridge
USERCTL=no
IPV6INIT=no
PEERDNS=yes



Then edit ifcfg-eth0, it should just have
DEVICE=eth0
ONBOOT=yes
BRIDGE=br0

-
You should then reboot. your main interface will have become br0, and eth0 will just be sitting there...waiting...for something.

Anyway,
You can use brctl show to show the current bridges on your system, and it gets more complicated from there on out.

You can then assign eth0 to virtual machines in the Virt Manager and the vm will use that as its bridge access. ;)

pidgin, otr, and random number generation

on a new centos plus workstation (5.4) i was trying to IM with pidgin and otr with my friends. we use OTR for private communication.

the key generation was failing, hanging actually, strace showed some problem with timeouts and /dev/urandom.

On the advice of someone who ran into the same problem, I used rngd to feed /dev/urandom into /dev/random

rngd -o /dev/urandom -r /dev/random

This worked and key generation completed successfully. Joy.

Pam Update, security pam_limits and 64 bit libs

ok, so, you have an x64 server and you updated pam, and you want to use pam_limits - cool story. until you try to login...and you're like, why isn't it working? because you added the line:

session required /lib/security/pam_limits.so

to /etc/pam.d/login

but you CAN login remotely and you check your log files and see 'Module unknown' when someone tries to login locally. This is because you're a 64bit server using a 32bit library...from /lib...so change that line to

session required /lib64/security/pam_limits.so

Then local logins work. =)

Updated on SSH Key authentication.

Public key authentication is great, as most of us have known for years, but I'm still in the middle of converting everyone to it who use the systems where I work.  Its actually a pretty big task since so many people do have to connect into our servers in order to get information...and if those accounts cannot connect then...well, stuff starts breaking.

We've done really well and our systems are really stable, of course they're still running HP Unix, but the new systems that are on their way into production are RedHat Linux (RHEL 5), so we have our work cut out for us. No problem -- They seem to be quite resilient and stable.  I wish we could get some Oracle on BSD. Grr.

Anyway, a lot of interesting changes going on in the workplace right now, so, I'll leave those for another time. Just wanted to give a quick update to all the readers out there... I'm still alive. Thanks for your emails.