gmane.linux.centos.general

Re: PCI/DSS compliance on CentOS

Rui Miguel Silva Seabra — 2012-05-26T07:47:35

On Fri, 25 May 2012 13:47:12 -0400
m.roth< at >5-cent.us wrote:


It's always a matter of risk based analysis.

Were that three servers on the same network segment (logical and
physical)? Do you have good and restrictive firewalls around them, and
so on.

It's not good security or a good audit result if you just throb all the
nobs.

Rui
_______________________________________________
CentOS mailing list
CentOS< at >centos.org
http://lists.centos.org/mailman/listinfo/centos

Re: support for Broadcom BCM4313

Philippe Naudin — 2012-05-26T07:40:18

Le ven. 25 mai 2012 13:45:27 CEST, Akemi Yagi a écrit:


Oh. After re-reading my post, I found a couple of mistakes :
- the actual URL for the firmware is 
http://git.kernel.org/?p=linux/kernel/git/firmware/linux-firmware.git;a=commit;h=e4379d14549cd9b29988cf3c5b74b29d2051dd09
- and the ";" turned ":" in "depmod -a ; modprobe brcmsmac" 

Sorry for the inconvenience, and a lot of thanks for your job !

Re: PCI/DSS compliance on CentOS

Rui Miguel Silva Seabra — 2012-05-26T07:36:29

On Fri, 25 May 2012 22:52:13 +0530
Arun Khan <knura9< at >gmail.com> wrote:


Some advice from my practical professional knowledge...


There is always the scope to be understood.

If a server has card numbers somewhere, that server in on scope.
So is any other server on the same network segment.
So is any firewall delimiting these network segments.

Now... if you have a sufficiently large number of systems in scope,
it's more practical to suppose PCI:DSS is in scope on all servers.

This eases your maintenance as you won't have exceptions to deal with,
or justify, but if you have very few systems in scope rather than most
of the others which aren't, it'll be your decision considering the work
overload. I personally still advise to follow most rules on the non
scoped servers as they are in fact wise rules.


Not a good practice to say "6.2". Merely applying patches as time goes
on means in some time you'll be running 6.3. Say 6. :)


Beware that many instructions tell you to disable selinux. I found that
with a l

Re: PCI/DSS compliance on CentOS

Eero Volotinen — 2012-05-26T05:53:53

2012/5/26 Ken godee <ken-VWHxmN5vFgKVhEPSxk4UpgC/G2K4zDHf< at >public.gmane.org>:

"The client will be hosting it on their own office premise" sounds
really bad. Usually this kind of systems are located in really secured
datacenters.

--
Eero

Re: PCI/DSS compliance on CentOS

Ken godee — 2012-05-26T05:45:16

Yup, this is exactly what they don't want people to do and
I believe in the future they'll strive for just a handful
of processors that will meet there criteria.


I'm sure I'm talking way over my head at this point.... but
this must be for a fairly large merchant (1M+ transactions yearly).

Not quite sure why one wouldn't use one of processors gateway 
facilities, there's convenient api's that would handle anything to do
with cc's and at a "small fraction" of the price to set up and maintain.

Re: PCI/DSS compliance on CentOS

Eero Volotinen — 2012-05-26T05:23:33

2012/5/26 Arun Khan <knura9-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>:

Usually you also need to implement WAF (web application firewall) on
front of public webservers.

I think cheapest solution is use mod_security*) on apache and then
proxy valid requests to tomcat.

*) http://www.modsecurity.org/


--
Eero, RHCE, CISSP

Re: PCI/DSS compliance on CentOS

Arun Khan — 2012-05-26T05:19:31

Hi Eero,

On Sat, May 26, 2012 at 1:12 AM, Eero Volotinen <eero.volotinen-X3B1VOXEql0< at >public.gmane.org> wrote:

... snip ...


Thanks for your input on each points in OP.   I appreciate it.

Re: PCI/DSS compliance on CentOS

Arun Khan — 2012-05-26T05:17:47

I have to check this with the client.   Credit card information will
be encrypted and stored in client's own db.


The client will be hosting it on their own office premise (the
physical security aspect is being handled by another vendor).

Thanks,

Mysterious versioning reported by file command

Frank Cox — 2012-05-26T04:56:13

I just noticed this, which doesn't actually seem to affect anything but does
create a mystery:

[frankcox< at >mutt temp]$ cat test.c
#include <stdio.h>
int main(void)
{
printf("Hello world\n");
return 0;
}
[frankcox< at >mutt temp]$ gcc -o test test.c
[frankcox< at >mutt temp]$ file test
test: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked
(uses shared libs), for GNU/Linux 2.6.18, not stripped
[frankcox< at >mutt temp]$ uname -a
Linux mutt.melvilletheatre.net 2.6.32-220.17.1.el6.x86_64 #1 SMP Wed May 16
00:01:37 BST 2012 x86_64 x86_64 x86_64 GNU/Linux

Why does the output from file say "Linux 2.6.18" when the actual kernel in use
is 2.6.32?

Re: biggest disk partition on 5.8?

Rajagopal Swaminathan — 2012-05-26T03:40:04

Greetings,


On Wed, May 23, 2012 at 11:53 PM, Alan McKay <alan.mckay-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

You can perhaps think about using GFS apart from XFS

Re: yum problem with glibc

Timothy Murphy — 2012-05-26T01:16:42


Thanks for your response.

[tim< at >alfred glibc]$ uname -a
Linux alfred.gayleard.eu 2.6.32-220.17.1.el6.x86_64 #1 SMP Wed May 16 
00:01:37 BST 2012 x86_64 x86_64 x86_64 GNU/Linux


I have.
More than once.

Re: Upgrading FC2 to CentOS 5.* - anyone second this?

Les Mikesell — 2012-05-26T00:52:48

Even so, what's the point of an in-place upgrade compared to a fresh
5.x install?    Even if it works, there will be old cruft left around
that you don't need and that may cause surprises later.

Re: Upgrading FC2 to CentOS 5.* - anyone second this?

Max Pyziur — 2012-05-26T00:42:27


It's a test machine that replicates a production server. The production 
machine was setup in May 2011 when CentOS was in 5.8 and no 6.x had shown 
up.

So, I need a text 5.x box.

So do you (or anyone) second this or am I going to have to find out on my 
own and report back to you.



Max Pyziur
pyz-OYlXqSCrDlkAvxtiuMwx3w< at >public.gmane.org

Re: print job gui for remote access

Frank Cox — 2012-05-25T22:14:00

On Sat, 26 May 2012 00:05:40 +0200
Nicolas Thierry-Mieg wrote:


While that would work, I can imagine my phone ringing with questions about why
someone's printer disappeared.  I'm really just trying to front-end lpq and
lprm.

If I have to I'll write something to do this since it's not a complicated
thing and it's an excuse to play with gtk, but I don't want to re-invent the
wheel.

Re: Upgrading FC2 to CentOS 5.* - anyone second this?

Les Mikesell — 2012-05-25T22:10:42

It might possibly work, but I can't quite imagine why anyone would
want to do it at this point.  Why not back up anything you might want
to keep, install a nice clean Centos 6.x and put back the files you
wanted?

Re: print job gui for remote access

Nicolas Thierry-Mieg — 2012-05-25T22:05:40

if machine B is running cups, perhaps using the cups web interface? it 
should be running on port 631 (and has to be configured to allow this).

Upgrading FC2 to CentOS 5.* - anyone second this?

Max Pyziur — 2012-05-25T22:03:29

Greetings,

I *do* still have an FC2 box.

Would anyone second this procedure:
http://www.centos.org/modules/newbb/viewtopic.php?topic_id=14052&forum=37&post_id=47945

Thanks.

Max Pyziur
pyz-OYlXqSCrDlkAvxtiuMwx3w< at >public.gmane.org

print job gui for remote access

Frank Cox — 2012-05-25T21:46:41

Users on Machine A with rights to log into and run jobs on Machine B using ssh
want to be able to view and cancel print jobs on Machine B.

This is easily accomplished via the commandline with lpq and lprm, but is there
a GUI that I can give them?  I have them running things like scribus using
launchers like "ssh -X machineb scribus" and would like to provide similar
functionality for the printer job control.

Re: support for Broadcom BCM4313

Akemi Yagi — 2012-05-25T20:45:27

On Fri, May 25, 2012 at 7:45 AM, Philippe Naudin
<philippe.naudin-t7HN+OaWaD/Sqzrhul/Zcw< at >public.gmane.org> wrote:


Philippe,

Thank you for the note. The kmod-compat-wireless wiki page has been
updated using your lines as an example for installation.

Akemi

Re: PCI/DSS compliance on CentOS

Eero Volotinen — 2012-05-25T19:42:51

2012/5/25 Arun Khan <knura9-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>:

requirement "one primary function per server".


true also.


Usually needed, if you use https or similar protocols.


SELinux is not usually needed.


Ossec (www.ossec.net) can do this.


Some hardening needed.


Hardware and software firewall on each network segment with nat enabled.


Ossec can do this


Ossec server with samhain is good solution for that.


--
Eero

Re: Third party repo differences

Phil Schaffner — 2012-05-25T18:57:07

Bowie Bailey wrote on 05/25/2012 01:00 PM:
Yes.

Phil