5tFTW: Fedora 21, 22, and 19, firewall discussion, and holiday
by Matthew Miller
break
Reply-To:
Reposted from <http://fedoramagazine.org/5tftw-2014-12-17/>.
Fedora is a big project, and it’s hard to keep up with everything that
goes on. This series highlights interesting happenings in five
different areas every week. It isn’t comprehensive news coverage — just
quick summaries with links to each. Here are the five things for
December 17th, 2014:
Fedora 21 Retrospective: What was awesome? What wasn’t?
-------------------------------------------------------
While Fedora 22 is already rolling into the target zone, we do want to
make sure we look back at this previous cycle and identify things we
can improve — ideally, specific and actionable changes. In the end, we
came out with (another!) great release, but there is always something
to learn. In particular, we ended _yet again_ in a last minute scramble
to get a release we could feel good about signing off on out before the
holidays, and next time around it would be nice to put less stress on
all of our contributors (including the quality assurance team and the
developers needed to make those late fixes.)
There will be more to it than this, but to get started, we have a F21
Retrospective wiki page, to help collect comments and ideas.
* https://fedoraproject.org/wiki/Fedora_21_Retrospective
Fedora 22: Coming up fast!
--------------------------
FESCo (the Fedora Engineering Steering Committee, the elected
organization which oversees technical decisions in the project) has
indicated that we’re back to aiming for the traditional May/October
Fedora release cycle, and although the F22 schedule isn’t finalized yet,
we have a tentative plan calling for a release about 6 months from
now. When you work back from that, it means that there’s really not much
time to think about change proposals for F22, especially if we
subtract out holiday time. So, if you’re thinking of working on
something big, please start getting your proposal formalized — the
tentative deadline is January 20th, 2015.
Fedora 19: End of Life
----------------------
And on the other end of the cycle: it’s time to say farewell to Fedora
19. If you’re running this release, please plan to update before January
6th, 2015, when the last updates will go out. After that, there will be
no further security fixes. The good news is that Fedora 20 was a great
release, and Fedora 21 is *even better*, and I think you’ll be happy
with the upgrade.
* http://fedoramagazine.org/fedora-19-eol-01-06-2015/
Fedora Workstation firewall discussion
--------------------------------------
This week’s big devel-list thread concerned the default firewall
settings in Fedora Workstation. The Fedora Workstation Working Group was
not happy with the user experience offered by blocking incoming “high
ports” by default. Out of the box, nothing is listening on these, but if
one installs software that expects to, it won’t work, and because we
don’t have a good way yet to tie *attempts* to access ports to listening
applications and communicate that to the user, the resulting failure is
invisible.
On the other hand, if you install something and it starts listening and
you didn’t know that, that’s *also* invisible. So, pretty much everyone
recognizes this as a not ideal situation. Everyone involved in the
discussion also is concerned with enhancing user security in practice —
the question is just how to best get there from an imperfect state.
Originally, the Workstation WG asked to disable the firewall entirely.
FESCo asked instead that it be left available, possibly with a
less-restrictive out-of-the-box configuration — the path taken for F21.
If you’re not running Workstation, this doesn’t affect you. If you are,
and would like a different configuration, run the firewall configuration
tool and either edit the Fedora Workstation zone or change the default
zone. (There’s a long list of options, but “public” is a
generally-restrictive choice.)
You can also change the per-network zone. Unfortunately currently wired
networks are all considered as one per interface, but wireless networks
are distinguished individually. This can be done in a number of ways,
but the easiest is to run the network configuration tool (in GNOME
control center — press the overview key and start typing “network”),
select the wifi network in question, press the little gear icon next to
it, go down to Identity (?!), and choose the appropriate firewall zone.
(Again, there’s a long list — go back to the firewall config tool to see
exactly what they all do.)
This is clearly, not the most friendly approach; it’s my understanding
that the desktop designers, network tools team, and security team are
going to work together to develop a better overall solution for Fedora
22 and beyond.
Overall, the mailing list thread stayed relatively positive and
constructive and avoided personal attacks, although there were some
accusations of bad faith actions which do not seem warranted based on
the actual history. It is, however, a case where more transparent
discussion and communication could have helped; that’s something we’re
continually working at making better and might make for a good component
of the F21 retrospective mentioned above.
* https://lists.fedoraproject.org/pipermail/devel/2014-December/205010.html
Christmas break
---------------
Of course things in Fedora never really stop, but it’s vacation time for
many of us. Before I was a Red Hat employee, I was used to seeing
extended days off as ideal for getting in some serious work on Fedora.
Now, things are strangely inverted, and I’m going to use the time to
unplug a bit. I’ll be back in January all recharged, and will catch up
with everything that’s happened in the meantime — FtFTW will resume the
week of January 15th — or possibly the week before, but let’s save the
hard-to-keep resolutions for New Year’s Day. :)
Check out the Fedora vacation calendar to see who else will be away,
and make sure to add yourself if you will be too. (There's even a
Fedora badge for doing so!)
* https://apps.fedoraproject.org/calendar/vacation/
* https://badges.fedoraproject.org/badge/vacation
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Fedora Project Leader mattdm(a)fedoraproject.org <http://fedoraproject.org/>
9 years, 4 months
"Cannot contact any KDC for realm" since upgrading to Fedora 21
by Braden McDaniel
I upgraded a Kerberos server box from Fedara 20 to 21. Since doing so,
other Fedora machines (which are still using Fedora 20) can no longer
authenticate:
$ kinit
kinit: Cannot contact any KDC for realm 'ENDOFRAME.NET' while getting
initial credentials
On the server:
# systemctl status krb5kdc
● krb5kdc.service - Kerberos 5 KDC
Loaded: loaded (/etc/systemd/system/krb5kdc.service; enabled)
Active: active (running) since Tue 2014-12-16 08:27:54 EST; 24h
ago
Process: 22776 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid
$KRB5KDC_ARGS (code=exited, status=0/SUCCESS)
Main PID: 22777 (krb5kdc)
CGroup: /system.slice/krb5kdc.service
└─22777 /usr/sbin/krb5kdc -P /var/run/krb5kdc.pid
And I'm able to kinit just fine locally on the server.
I've tried completely disabling firewalls; that didn't help.
/var/log/krb5kdc.log on the server looks like this:
otp: Loaded
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](Error): preauth
pkinit failed to initialize: No realms configured correctly for pkinit
support
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): setting up
network...
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 12: udp 0.0.0.0.88 (pktinfo)
krb5kdc: setsockopt(13,IPV6_V6ONLY,1) worked
krb5kdc: Invalid argument - Cannot request packet info for udp socket
address :: port 88
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): skipping
unrecognized local address family 17
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): skipping
unrecognized local address family 17
krb5kdc: setsockopt(13,IPV6_V6ONLY,1) worked
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 13: udp fe80::21c:c0ff:fedf:4b55%eth0.88
krb5kdc: setsockopt(14,IPV6_V6ONLY,1) worked
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 15: tcp 0.0.0.0.88
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 14: tcp ::.88
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): set up 4
sockets
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22777](info): commencing
operation
Dec 17 08:52:59 knock.endoframe.net krb5kdc[22777](info): AS_REQ (6
etypes {18 17 16 23 25 26}) 192.168.1.10: ISSUE: authtime 1418824379,
etypes {rep=18 tkt=18 ses=18}, braden(a)ENDOFRAME.NET for
krbtgt/ENDOFRAME.NET(a)ENDOFRAME.NET
Where should I be looking?
--
Braden McDaniel
<braden(a)endoframe.com>
9 years, 4 months
"xinit -- :1" Not working for F21
by Philip Rhoades
People,
I occasionally start a second X display from a console login with:
"xinit -- :1
but after upgrading to F21 it just hangs with an underscore in the top
left of the screen and I have to do a remote log in and kill the
process. I attach the log but I am not sure if it indicates what the
problem is . .
Thanks,
Phil.
--
Philip Rhoades
GPO Box 3411
Sydney NSW 2001
Australia
E-mail: phil(a)pricom.com.au
9 years, 4 months
selinux relabel at boot
by Tom Horsley
Just a note for someone who might care about this:
I foolishly forgot to disable selinux in a system
I created by copying all the files from a virtual image.
When it booted, it said "I've got to relabel everything,
this may take a while."
So I figured I'd just wait for it, then a few minutes
later a message came up about a watchdog expiring
and it rebooted the system.
What fun :-). I assume it could have done that all day,
but I took advantage of the reboot to disable selinux.
9 years, 4 months
Re: (fedora) Re: Fedora and Windows fighting for the bootsector
by Jouk Jansen
Chris Murphy wrote on 16-DEC-2014 21:49:23.97
>On Tue, Dec 16, 2014 at 12:07 PM, Jouk Jansen
><joukj at hrem.nano.tudelft.nl> wrote:
>
>> BootCurrent: 0005
>> Timeout: 0 seconds
>> Bootorder: 0005,0003,0000,0001,0002
>> Boot0000* Fedora
>> Boot0001* UEFI: IP4 Realtek PCIe FE Family Controller
>> Boot0002* UEFI: IP6 Realtek PCIe FE Family Controller
>> Boot0003* Windows Boot Manager
>> Boot0005* grub
>
>It's UEFI, and you have two GRUBs now, the Fedora prebaked one as part
>of the grub2-efi package, which is the Boot0000 Fedora entry and is
>found in /boot/efi/EFI/fedora, and the grub2-install one which is the
>Boot0005 grub entry and is found in /boot/efi/EFI/grub. They also have
>different grub.cfgs; the Fedora one goes in /boot/efi/EFI/fedora and
>the grub one goes in /boot/grub2.
Thanks for the explenation. This is my first UEFI machine, so it is easy to
make mistakes.
>Please do this first and post all results:
>$ parted /dev/sda u s p
>$ efibootmgr -v
>$ tree /boot/efi
>$ os-prober
>
>And then to fix the NVRAM extra grub entry and reset the boot order
>and make a new grub.cfg:
>
>$ efibootmgr -b 0005 -B
>$ efibootmgr -o 0000,0003,0001,0002
>$ grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg
>
>Optional:
>
?$ rm -rf boot/efi/EFI/grub
I'm away from the laptop now. I will try in the next couple of days. But
this looks like the right thing to do. I will let you now if it is succesful.
>If you can put the new grub.cfg somewhere to download that'd be
>useful, I'd like to confirm it finds \efi\microsoft\boot\bootmgfw.efi
>and has the entry correct.
>
>> Error message:
>>
>> error: file `EFI/Microsoft/Boot/bootmgfw.efi' not found
>> error: you need to load the kernel first.
>>
>> Press any key to continue...
>
>OK this is a GRUB error message, not a Windows boot loader error
>message. GRUB can't find the Windows EFI OS Loader for some reason, so
>hopefully things will either be fixed or enlightened after I see the
>tree output and the new grub.cfg.
I hope the change in boot-order as decribed above, will solve the problem.
Thanks
Jouk Jansen
Pax, vel iniusta, utilior est quam iustissimum bellum.
(free after Marcus Tullius Cicero (106 b.Chr.-46 b.Chr.)
Epistularum ad Atticum 7.1.4.3)
Touch not the cat bot a glove
>------------------------------------------------------------------------------<
Jouk Jansen
joukj(a)hrem.nano.tudelft.nl
Technische Universiteit Delft tttttttttt uu uu ddddddd
Kavli Institute of Nanoscience tttttttttt uu uu dd dd
Nationaal centrum voor HREM tt uu uu dd dd
Lorentzweg 1 tt uu uu dd dd
2628 CJ Delft tt uu uu dd dd
Nederland tt uu uu dd dd
tel. 31-15-2782272 tt uuuuuuu ddddddd
>------------------------------------------------------------------------------<
9 years, 4 months
Canon LIDE 120 scanner - should I expect this never to work?
by Joe Feely
Just got a Canon LIDE 120 scanner. Neither Simple scan nor xsane detect it,
though lsusb sees that it's connected.
I bit of Googling makes me wonder if I need to exchange it.
Is there a way to get it to work?
I'm using fc20 + MATE.
Thanks,
Joe
9 years, 4 months
How is the default value of PATH environment variable being set in Fedora?
by Piotr Dobrogost
Hi!
When I login using terminal (for instance after pressing CTRL+ALT+F2)
the `PATH ` environment variable looks like this:
`/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin/:/usr/sbin:/home/user/.local/bin:/home/user/bin`
However when I open new Konsole window it looks like this:
`/usr/lib64/qt-3.3/bin:/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/home/user/.local/bin:/home/user/bin`
Notice, that in the first case `/usr/local/bin` precedes
`/bin:/usr/bin` whereas in the second case it's the other way around.
What mechanism governs this and how can I configure it so that in the
second case `/usr/local/bin` precedes `/usr/bin`?
I took a look in `/etc/profile` but there I see only `/usr/local/sbin`
and `/usr/sbin` being set:
# Path manipulation
if [ "$EUID" = "0" ]; then
pathmunge /usr/sbin
pathmunge /usr/local/sbin
else
pathmunge /usr/local/sbin after
pathmunge /usr/sbin after
fi
In the `/etc/environment` I have nothing that sets or changes `PATH`.
I know I can overwrite `PATH` in one of bash rc scripts but I would
like to know how this default `PATH` is being set in the first place.
I'm on KDE spin of Fedora 21.
Thank you in advance.
Regards,
Piotr Dobrogost
9 years, 4 months
Re: (fedora) Re: Fedora and Windows fighting for the bootsector
by Jouk Jansen
Ralf wrote on 16-DEC-2014 19:16:02.04
>On 12/16/2014 06:54 PM, Jouk Jansen wrote:
>> Hi all,
>>
>> I have a Toshiba (Satelite C50-B-14C). Window 8 was preinstalled. I turned
>> it into a dual boot by shrinking the Windows partition and installing F20.
>> All was fine until I installed some Windows-updates the other day. The
>> machine then only booted windows.
>
>On my GPT/UEFI Win + F21 system, the last round of Win patches had
>modified the boot order of the UEFI boot devices.
>
>The solution had been to enter the BIOS and move Fedora up in the
>UEFI-Boot order setup.
This is a laptop with one device and F20 and Windows on 2 partitions. So I
have no idea how to change the boot-order.
Regards
Jouk
Pax, vel iniusta, utilior est quam iustissimum bellum.
(free after Marcus Tullius Cicero (106 b.Chr.-46 b.Chr.)
Epistularum ad Atticum 7.1.4.3)
Touch not the cat bot a glove
>------------------------------------------------------------------------------<
Jouk Jansen
joukj(a)hrem.nano.tudelft.nl
Technische Universiteit Delft tttttttttt uu uu ddddddd
Kavli Institute of Nanoscience tttttttttt uu uu dd dd
Nationaal centrum voor HREM tt uu uu dd dd
Lorentzweg 1 tt uu uu dd dd
2628 CJ Delft tt uu uu dd dd
Nederland tt uu uu dd dd
tel. 31-15-2782272 tt uuuuuuu ddddddd
>------------------------------------------------------------------------------<
9 years, 4 months
OT: disabling <ctrl><shift>f produces a "find" menu.
by Rolf Turner
Struggling with this and don't know who else to ask ....
I have just found out how to produce accented characters when typing,
e.g., an email, via <ctrl><shift>u<code> where "<code>" is the unicode
hex number for producing the desired symbol. E.g. <ctrl><shift>ue9
produces e-acute.
Fine. Except ... any hex numbers that involve "f" result in a "find"
menu popping up --- instead of the character I want being produced.
I figure there *must* be a way to switch off or disable this annoying
useless pop-up menu so that it does not interfere with getting accented
characters. But I'm damned if I can find a way. Can anyone point me in
the right direction?
The annoying phenomenon seems to be associated with the Gnome terminal;
I have just realized that it *doesn't* arise when I am actually
composing an email (in a Thunderbird email window). In the Gnome
terminal there is a "Search" item on the menu bar and that indicates
that <ctrl><shift>f is a "short-cut" for "Find".
Thanks for any insights.
cheers,
Rolf Turner
--
Rolf Turner
Technical Editor ANZJS
9 years, 4 months