devil-linux-develop Mailing List for Devil-Linux (Page 45)

Hi,

Serge Leschinsky wrote:

> Unfortunately kernel update hasn't helped. I made series
> 'mrproper-build-install-test iso' and may say that the thing which breaks the
> iptables functionality is patch-o-matic.

the module which breaks iptables functionality is extra/pptp-conntrack-nat.
Should we disable it or try to find update for the module?

--
Serge Leschinsky

On Thu, August 23, 2007 08:32, Bruce Smith wrote:
> Just a thought ... but where is the mysql user account info?
>
>
> If it's on LDAP or NIS or some other remote location which is not
> accessible at the time during boot when mysql starts, it may fall back to
> root as the user.  If it's in the local passwd file, never mind.  :-)

All local

> Other other thought is maybe grsecurity is screwing you up.  Try the
> server edition?

Yeah that may be worth a try.
Will have to wait until my 1.3 compile finishes, so I can create a new
version with the latest sources.

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

Just a thought ... but where is the mysql user account info?

If it's on LDAP or NIS or some other remote location which is not
accessible at the time during boot when mysql starts, it may fall back
to root as the user.  If it's in the local passwd file, never mind.  :-)

Other other thought is maybe grsecurity is screwing you up.  Try the
server edition?

 - BS


> I have trouble getting mysql started on bootup, but once the system is up
> and I do it on the command line it works...
> I want to make sure it's not related to my machine. Anybody else
> experiencing this issue?
> 
> This is from the mysql.err
> 070822 17:07:56 [ERROR] Fatal error: Please read "Security" section of the
> manual to find out how to run mysqld as root!
> 070822 17:07:56 [ERROR] Aborting
> 
> When I start it manually everything is cool and the daemon runs under the
> mysql user.

DONE

Heiko

On Wed, August 22, 2007 16:50, Oliver Niesner wrote:
> Hi!
>
>
> I made a minimal change in the make script of openldap-2.3.37
> because it doesn't like to compile on my MP-system. Hope this is useful!
>
>
> cheers,
>
> Oliver
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>
> http://get.splunk.com/_______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>
>


-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

Hey,

I have trouble getting mysql started on bootup, but once the system is up
and I do it on the command line it works...
I want to make sure it's not related to my machine. Anybody else
experiencing this issue?

This is from the mysql.err
070822 17:07:56 [ERROR] Fatal error: Please read "Security" section of the
manual to find out how to run mysqld as root!
070822 17:07:56 [ERROR] Aborting

When I start it manually everything is cool and the daemon runs under the
mysql user.

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

Hi!

I made a minimal change in the make script of openldap-2.3.37
because it doesn't like to compile on my MP-system.
Hope this is useful!

cheers,

Oliver

I found that problem today, too.
Remove the perl support from openldap for now.

I can't change it in CVS right now, my build machine is off and I'm at
work...

Heiko

On Tue, August 21, 2007 13:06, Stefan Engel wrote:
> Hi,
>
>
> I tried to compile Devil-Linux v1.2 (latest CVS) configured to only
> contain a subset of programs. This worked fine until the recent cvs update,
> where OpenLDAP has been updated and along with this update the configure
> parameters in scripts/openldap changed to contain the switch
> --enable-perl. Everything compiled ok (make build) but failed
> to install OpenLDAP with the following error:
>
> ... snip ...
> cd back-passwd; make -w all make[4]: Entering directory
> `/data/build/tmp/openldap-2.3.37/servers/slapd/back-passwd'
> make[4]: Nothing to be done for `all'.
> make[4]: Leaving directory
> `/data/build/tmp/openldap-2.3.37/servers/slapd/back-passwd'
>
>
> cd back-perl; make -w all make[4]: Entering directory
> `/data/build/tmp/openldap-2.3.37/servers/slapd/back-perl'
> make[4]: *** No rule to make target
> `/usr/lib/perl5/5.8.0/i486-linux/CORE/EXTERN.h', needed by `init.lo'.
> Stop.
> make[4]: Leaving directory
> `/data/build/tmp/openldap-2.3.37/servers/slapd/back-perl'
> make[3]: *** [.backend] Error 1
> make[3]: Leaving directory `/data/build/tmp/openldap-2.3.37/servers/slapd'
>  make[2]: *** [all-common] Error 1
> make[2]: Leaving directory `/data/build/tmp/openldap-2.3.37/servers'
> make[1]: *** [all-common] Error 1
> make[1]: Leaving directory `/data/build/tmp/openldap-2.3.37'
>
>
> At this point Perl hasn't been installed yet, thus /usr/lib/perl5/...
> does not exist. Whereas Perl support is not required for compiling, the
> installation needs it. But adding 'perl' to the Required-Start entry in
> scripts/openldap and doing a make prepare results in a
>
> insserv: There is a loop between service perl and cyrus-sasl
>
>
> openldap (without perl and failing install): # Required-Start:
> $basebuildtools glibc libmcrypt libgcrypt gdbm db-4
> openssl krb5
>
> cyrus-sasl:
> # Required-Start: $basebuildtools glibc db-4 openssl gdbm openldap mysql
>
>
> perl:
> # Required-Start: $basebuildtools $libs
>
>
> scripts/config/buildorder.conf contains: $libs	glibc uclibc gmp ncurses
> zlib ncurses popt readline libol db-4 libxml2 libusb libpcap libjpeg lzo
> cyrus-sasl bzip2 opt gdbm glib pkgconfig fam libmcrypt libgcrypt
> openldap   pwlib attr acl krb5 wvstreams postgresql mysql gnupg mcrypt
> mhash tcp_wrappers expat libpng libxslt gd imap pcre gdchart libdvdread
> libdvdcss tiff libungif
>
> $libs contains 'openldap'. Thus CyrusSASL requires OpenLDAP (as a
> backend I guess). OpenLDAP in turn requires Perl (for installation) and
> Perl in turn requires OpenLDAP (because of the base libs).
> Reminds me of chicken-and-egg  ;-)
>
>
> As I do not need Perl support in OpenLDAP I will remove --enable-perl
> from the OpenLDAP configure.
>
> Any idea how to fix this in the Devil-Linux CVS sources (remove Perl
> support from OpenLDAP, remove OpenLDAP from base libs, ...)?
>
> Regards,
> Stefan
>
>
> -------------------------------------------------------------------------
>  This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>
>


-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

Hi,

I tried to compile Devil-Linux v1.2 (latest CVS) configured to only
contain a subset of programs. This worked fine until the recent cvs
update, where OpenLDAP has been updated and along with this update
the configure parameters in scripts/openldap changed to contain the
switch --enable-perl. Everything compiled ok (make build) but failed
to install OpenLDAP with the following error:

... snip ...
  cd back-passwd; make -w all
make[4]: Entering directory
`/data/build/tmp/openldap-2.3.37/servers/slapd/back-passwd'
make[4]: Nothing to be done for `all'.
make[4]: Leaving directory
`/data/build/tmp/openldap-2.3.37/servers/slapd/back-passwd'

  cd back-perl; make -w all
make[4]: Entering directory
`/data/build/tmp/openldap-2.3.37/servers/slapd/back-perl'
make[4]: *** No rule to make target
`/usr/lib/perl5/5.8.0/i486-linux/CORE/EXTERN.h', needed by `init.lo'.  Stop.
make[4]: Leaving directory
`/data/build/tmp/openldap-2.3.37/servers/slapd/back-perl'
make[3]: *** [.backend] Error 1
make[3]: Leaving directory `/data/build/tmp/openldap-2.3.37/servers/slapd'
make[2]: *** [all-common] Error 1
make[2]: Leaving directory `/data/build/tmp/openldap-2.3.37/servers'
make[1]: *** [all-common] Error 1
make[1]: Leaving directory `/data/build/tmp/openldap-2.3.37'

At this point Perl hasn't been installed yet, thus /usr/lib/perl5/...
does not exist. Whereas Perl support is not required for compiling,
the installation needs it. But adding 'perl' to the Required-Start
entry in scripts/openldap and doing a make prepare results in a

   insserv: There is a loop between service perl and cyrus-sasl

openldap (without perl and failing install):
# Required-Start: $basebuildtools glibc libmcrypt libgcrypt gdbm db-4
openssl krb5

cyrus-sasl:
# Required-Start: $basebuildtools glibc db-4 openssl gdbm openldap mysql

perl:
# Required-Start: $basebuildtools $libs

scripts/config/buildorder.conf contains:
$libs	glibc uclibc gmp ncurses zlib ncurses popt readline libol db-4
libxml2 libusb libpcap libjpeg lzo cyrus-sasl bzip2 opt gdbm glib
pkgconfig fam libmcrypt libgcrypt   openldap   pwlib attr acl krb5
wvstreams postgresql mysql gnupg mcrypt mhash tcp_wrappers expat libpng
libxslt gd imap pcre gdchart libdvdread libdvdcss tiff libungif

$libs contains 'openldap'. Thus CyrusSASL requires OpenLDAP (as a
backend I guess). OpenLDAP in turn requires Perl (for installation)
and Perl in turn requires OpenLDAP (because of the base libs).
Reminds me of chicken-and-egg  ;-)

As I do not need Perl support in OpenLDAP I will remove --enable-perl
from the OpenLDAP configure.

Any idea how to fix this in the Devil-Linux CVS sources (remove Perl
support from OpenLDAP, remove OpenLDAP from base libs, ...)?

Regards,
Stefan

Hello,

roy barnard wrote:
> 
> Firstly, I can not get DL first boot to copy the initial config file 'etc.tar.bz2' onto my
> configuration media compact flash /dev/hdc2.
> Copy just silently fails.....
> My workaround is to copy etc.tar.bz2 onto second partition using the 'install-on-usb' script.
I've tested it on CD - the file has been copied without problem. If I can find a
 usb-drive I'll check it once again.

> 
> Secondly, DL boot fails.
> This appears to be that 'mdev -s' fails to make /dev/loop0, so the cdrom image fails to mount.
> My workaround for this is to set INITRD_MODULES="loop" in /etc/sysconfig/config
> so 'load_modules' loads loop.ko and this populates /sys so 'mdev -s' makes the /dev/loop0
> Anybody point me in the right direction for the real fix for this?
It's my fault. I transfered loop module out of drivers/block/ dir...
It should be ok now. Please sync scripts/loop-AES from cvs and try again.

--
Serge Leschinsky

I have a some more build issues.
I deleted everything and stared will a completed fresh development download.

Staring point
	lfssystem-SVN-20070314-cleaned.tar.bz2 with asm_types.h.patch
	lftp-2.6.11.tar.bz2 compiled and installed
	CVS taken on 18 August 2007.
	Full DL Source download on 18 August 2007.
	Used the default profile but unchecked "run build with nice"
unpack,build
	ncftp Failed to compile...Set config file to NOT include ncftp!
	(problem as I described in one of my previous emails)
build,install,iso,dist
Everything OK up to this point
I used 'install-on-usb' to set up my Compact flash...

Firstly, I can not get DL first boot to copy the initial config file 'etc.tar.bz2' onto my
configuration media compact flash /dev/hdc2.
Copy just silently fails.....
My workaround is to copy etc.tar.bz2 onto second partition using the 'install-on-usb' script.

Secondly, DL boot fails.
This appears to be that 'mdev -s' fails to make /dev/loop0, so the cdrom image fails to mount.
My workaround for this is to set INITRD_MODULES="loop" in /etc/sysconfig/config
so 'load_modules' loads loop.ko and this populates /sys so 'mdev -s' makes the /dev/loop0
Anybody point me in the right direction for the real fix for this?

Many Thanks,

Roy.



      ___________________________________________________________ 
Want ideas for reducing your carbon footprint? Visit Yahoo! For Good  http://uk.promotions.yahoo.com/forgood/environment.html

Hi,

Oliver Niesner wrote:

> With a little luck the kernel update from Heiko will do the trick.
> Let me know if i can help out with testing etc.

Unfortunately kernel update hasn't helped. I made series
'mrproper-build-install-test iso' and may say that the thing which breaks the
iptables functionality is patch-o-matic.
Now we have to make other series of experiments to find what module does it.
I'd like to ask you (if it's possible) to check what group of p-o-m (
	Netfilter updates patches
	Netfilter pending patches
	Netfilter base patches
	Netfilter extra patches  )
contains 'the bad module'.
Your help will be very appreciated!

--
Serge Leschinsky

Hello Borys!

Heiko Zuerker wrote on 14.08.2007 14:33 MET:
> 
> can anybody comment on the request below?
> I'm not a quagga user, so it's hard for me to make a decision on this.
> 
> ---------------------------- Original Message ----------------------------
> Subject: Quagga and realms
> From:    "Borys Semenowicz" <bs...@el...>
> Date:    Mon, August 13, 2007 03:07
> To:      dev...@li...
> --------------------------------------------------------------------------
> 
> Hi Im using DL since 0.5 ver, and have question:
> can quagga in DL support realms?
> (patch: http://vcalinus.gemenii.ro/quaggarealms.html)
> I need to transfer IP`s from BGP to iptables and htb,
> or otherwise use iptables with AS numbers.

Looking at <ftp://ftp.devil-linux.org/pub/devel/sources/1.2> you will see
which quagga source we build on and which patches we apply to it.

Currently we don't include the patch mentioned. Might I therefore suggest
that you set up a build environment, include the aforementioned patch,
adapt the quagga build script and then submit a patch to it so we can
include the quagga patch into future releases.

-- 
MfG / Regards
Friedrich Lobenstock

Hey everyone,

can anybody comment on the request below?
I'm not a quagga user, so it's hard for me to make a decision on this.

Heiko

---------------------------- Original Message ----------------------------
Subject: Quagga and realms
From:    "Borys Semenowicz" <bs...@el...>
Date:    Mon, August 13, 2007 03:07
To:      dev...@li...
--------------------------------------------------------------------------

Hi Im using DL since 0.5 ver, and have question:
can quagga in DL support realms?
(patch: http://vcalinus.gemenii.ro/quaggarealms.html)
I need to transfer IP`s from BGP to iptables and htb,
or otherwise use iptables with AS numbers.
Best regards
Borys Semenowicz




-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

>
>> I've rebuilt ISO without l7 and got the same error. So, it's not l7. I
>> guess the downgrade iptables from 1.3.8 to 1.3.7 should fix this problem
>> but I consider it as a hot-fix. The proper way is to find what exactly
>> brakes nat functionality (imq patch?).
>>
>>
>> I'll try to fix it ASAP.
>>     
>
> I'm currently updating DL with kernel 2.4.35, that may help too.
>
>   

Thanks, Serge for verifying this!
I think the only problem is that iptables isn't compiled against the 
right kernel sources.
I had no problems with layer7 and iptables-1.3.8 on a 2.6.22 kernel.
But i have no experience with 2.4 so far.
With a little luck the kernel update from Heiko will do the trick.
Let me know if i can help out with testing etc.

Oliver

On Fri, August 10, 2007 13:46, Serge Leschinsky wrote:
> Hi Oliver,
>
>
> Oliver Niesner wrote:
>
>> Hi, again!
>>
>>
>> After a clean build today i tested the new iso - everything looked
>> fine. But i found out that MASQUERADING doesn't work anymore.
>> I didn't change anything, nat/masquerading-modules are all loaded.
>> All i got is an "invalid argument" error.
>>
>>
>> Could it be that the latest layer7 changes broke something?
>>
> I've rebuilt ISO without l7 and got the same error. So, it's not l7. I
> guess the downgrade iptables from 1.3.8 to 1.3.7 should fix this problem
> but I consider it as a hot-fix. The proper way is to find what exactly
> brakes nat functionality (imq patch?).
>
>
> I'll try to fix it ASAP.

I'm currently updating DL with kernel 2.4.35, that may help too.

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

Hi Oliver,

Oliver Niesner wrote:
> Hi, again!
> 
> After a clean build today i tested the new iso - everything looked fine.
> But i found out that MASQUERADING doesn't work anymore.
> I didn't change anything, nat/masquerading-modules are all loaded.
> All i got is an "invalid argument" error.
> 
> Could it be that the latest layer7 changes broke something?
I've rebuilt ISO without l7 and got the same error. So, it's not l7. I guess the
downgrade iptables from 1.3.8 to 1.3.7 should fix this problem but I consider it
as a hot-fix. The proper way is to find what exactly brakes nat functionality
(imq patch?).

I'll try to fix it ASAP.

--
 Serge Leschinsky

Heiko,

Heiko Zuerker wrote:

> Super FreeS/WAN and strongSwan both add additional patches. Some of the are
> X.509, NAT-Traversal, better crypto algorithms and more.
> 
Oops... I'm so stupid... I've read the documents on web-site and I really like
the project (especially in part of XAUTH).
I'm voting to change open to super.

--
Serge Leschinsky

Hey,

Super FreeS/WAN and strongSwan both add additional patches. Some of the are
X.509, NAT-Traversal, better crypto algorithms and more.

Heiko

On Fri, August 10, 2007 00:58, Serge Leschinsky wrote:
> Hello Heiko,
>
>
> Are there any reasons to not use openswan? I use it for a quite long time
> and have no problem. I may be wrong but looks like we use exactly _open_
> swan in 1.2. Am I wrong?
>
> http://www.openswan.org/
>
>
> The current version of openswan is 2.4.9 (2.4.6 on DL ftp).
>
>
> Heiko Zuerker wrote:
>
>> Hey guys,
>>
>>
>> the Super FreeS/WAN  doesn't seem to like the latest 2.4 kernel.
>> Looking
>> at their website it also didn't get updated. Does anybody have a problem
>> if I see if we can replace it with strongSwan  ?
>>
>> URLs:
>> Super FreeS/WAN  http://www.freeswan.ca/
>> strongSwan  http://www.strongswan.org/
>
> --
> Serge Leschinsky
>
>
> -------------------------------------------------------------------------
>  This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>
>


-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

Hello Oliver,

Oliver Niesner wrote:

> Could it be that the latest layer7 changes broke something?
...
> I'm a little bit lost here, maybe someone can help to check this?
> 

I'll check and send the report by the end of my day.

--
Sincerely
 Serge Leschinsky

Hello Heiko,

Are there any reasons to not use openswan? I use it for a quite long time and
have no problem.
I may be wrong but looks like we use exactly _open_ swan in 1.2. Am I wrong?

http://www.openswan.org/

The current version of openswan is 2.4.9 (2.4.6 on DL ftp).

Heiko Zuerker wrote:
> Hey guys,
> 
> the Super FreeS/WAN  doesn't seem to like the latest 2.4 kernel. Looking
> at their website it also didn't get updated.
> Does anybody have a problem if I see if we can replace it with strongSwan  ?
> 
> URLs:
> Super FreeS/WAN  http://www.freeswan.ca/
> strongSwan  http://www.strongswan.org/

--
Serge Leschinsky

Hi, again!

After a clean build today i tested the new iso - everything looked fine.
But i found out that MASQUERADING doesn't work anymore.
I didn't change anything, nat/masquerading-modules are all loaded.
All i got is an "invalid argument" error.

Could it be that the latest layer7 changes broke something?


After searching for a while i found the following on the netfilter website:

> 3.20 'iptables: Invalid argument' after kernel update (nat table)
> 
> You have just upgraded your kernel and suddenly some of the commands (especially in the 'nat' table), and you experience something like:
> 
>     # iptables -A POSTROUTING -t nat -o ppp0 -j MASQUERADE
>     iptables: Invalid argument
> 
> This happens when the structure size between kernel and userspace changes. 
> You will need to recompile the iptables userspace program using the include files of your new kernel. 
> This only happens if you (or the vendor of your kernel) has applied some patches either only to the old or only to the new kernel. 
> It is not supposed to happen between vanilla kernel.org kernels. If it does, please inform the netfilter-devel mailinglist.



I'm a little bit lost here, maybe someone can help to check this?

Thanks

Oliver

Hey guys,

the Super FreeS/WAN  doesn't seem to like the latest 2.4 kernel. Looking
at their website it also didn't get updated.
Does anybody have a problem if I see if we can replace it with strongSwan  ?

URLs:
Super FreeS/WAN  http://www.freeswan.ca/
strongSwan  http://www.strongswan.org/

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

On 8/6/07, Heiko Zuerker <he...@zu...> wrote:
>
> On Sun, August 5, 2007 22:19, John Bridleman wrote:
> > I got a brand new Dell PowerEdge SC440 the other day. It has a
> > Broadcom Gigabyte Ethernet adapter built in. I was trying to install
> > DL 1.2.13 on it but I couldn't get the tg3 module to load. After some
> > Googling i ran across this:
> > http://www.math.ucla.edu/~jimc/documents/optiplex-745.html
> >
> > I then loaded opensuse 10.2 on it and the tg3 driver for that works just
> > fine.
> >
> > Maybe DL needs a tg3 driver upgrade?
>
> Here is an updated 1.2 release which has the tg3 module:
> ftp://ftp.devil-linux.org/pub/devel/testing/devil-linux-1.2.14-2007-05-24-i586-SMP.tar.bz2

Works great! Thanks Heiko!
-- 
John Bridleman

On Sat, August 4, 2007 08:41, Philippe Marzouk wrote:
> Hi,
>
>
> Is there a reason why scripts/config/config_net-tools.h has
>
>
> #define HAVE_AFINET6 0
>
>
> instead of 1 or is it simply an oversight?
>
> I had no trouble compiling it that way and it works well (I need ipv6
> support in route to add a default IPV6 route when my ppp0 is established, I
> couldn't do it with iproute2).

I don't remember a reason why we would have disabled it.
If nobody complains I'm fine with turning it on.

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

On Sun, August 5, 2007 22:19, John Bridleman wrote:
> Hi!
>
>
> I got a brand new Dell PowerEdge SC440 the other day. It has a
> Broadcom Gigabyte Ethernet adapter built in. I was trying to install
> DL 1.2.13 on it but I couldn't get the tg3 module to load. After some
> Googling i ran across this:
> http://www.math.ucla.edu/~jimc/documents/optiplex-745.html
>
>
> I then loaded opensuse 10.2 on it and the tg3 driver for that works just
> fine.
>
> Maybe DL needs a tg3 driver upgrade?

Here is an updated 1.2 release which has the tg3 module:
ftp://ftp.devil-linux.org/pub/devel/testing/devil-linux-1.2.14-2007-05-24-i586-SMP.tar.bz2


-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org