<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v = "urn:schemas-microsoft-com:vml" xmlns:o = "urn:schemas-microsoft-com:office:office" xmlns:w = "urn:schemas-microsoft-com:office:word" xmlns:st1 = "urn:schemas-microsoft-com:office:smarttags"><HEAD> <META http-equiv=Content-Type content="text/html; charset=us-ascii"> <META content="MSHTML 6.00.6000.16608" name=GENERATOR><o:SmartTagType name="PersonName" namespaceuri="urn:schemas-microsoft-com:office:smarttags"></o:SmartTagType> <STYLE>@font-face { font-family: Tahoma; } @page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; } P.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } LI.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } DIV.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } A:link { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlink { COLOR: blue; TEXT-DECORATION: underline } A:visited { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlinkFollowed { COLOR: blue; TEXT-DECORATION: underline } P { FONT-SIZE: 12pt; MARGIN-LEFT: 0in; MARGIN-RIGHT: 0in; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto } PRE { FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Courier New" } SPAN.EmailStyle18 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal-reply } DIV.Section1 { page: Section1 } </STYLE> </HEAD> <BODY lang=EN-US vLink=blue link=blue bgColor=white> <DIV dir=ltr align=left>I would consider the network topology. If the box is behind a firewall or access lists, thus iptables being an additional (or internal) means of defense, I have no problem stopping it temporarily. If the box is sitting wide open on the Internet, I would probably tinker with the logging. Considering how much junk I have seen on firewall interfaces with brand new IPs with no publicized services, I would not put anything unprotected "out there", even temporarily.</DIV> Thanks, Scott <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left> <HR tabIndex=-1> From: redhat-sysadmin-list-bounces@redhat.com [mailto:redhat-sysadmin-list-bounces@redhat.com] On Behalf Of Richard Riley Sent: Monday, March 03, 2008 4:46 PM To: redhat-sysadmin-list@redhat.com Subject: RE: can't get OS to use LDAP for accounts </DIV> <DIV></DIV> <DIV class=Section1> I fully agree that security is priority, but some times it is so much quicker to determine if iptables or selinux is the culprit by stopping them just long enough to test and see if the service now works. If it does, then you know quickly where to concentrate your effort. If iptables is the culprit, then I would enable logging to help identify the specifics.<o:p></o:p> I have found that if I enable logging initially on a busy machine, I may lose hours searching the log files only to discover that iptables was not the culprit in the first place.<o:p></o:p> <o:p> </o:p> <DIV> Richard Riley<o:p></o:p> Linux System Administrator<o:p></o:p> Ariba, Inc. <o:p></o:p></DIV> <DIV style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: blue 1.5pt solid; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"> <DIV> <DIV class=MsoNormal style="TEXT-ALIGN: center" align=center> <HR tabIndex=-1 align=center width="100%" SIZE=2> </DIV> From: redhat-sysadmin-list-bounces@redhat.com [mailto:redhat-sysadmin-list-bounces@redhat.com] On Behalf Of Sutton, Harry (MSE) Sent: Monday, March 03, 2008 4:30 PM To: <st1:PersonName w:st="on">redhat-sysadmin-list@redhat.com</st1:PersonName> Subject: Re: can't get OS to use LDAP for accounts<o:p></o:p></DIV> <o:p> </o:p> I'm a firm believer that it's never a good idea to shut off security features to get things working. Significant improvements in the SELinux administrative and troubleshooting tools make it much easier to get that working properly without having to disable it. As for iptables, I think it's a much better idea to enable logging, even on a temporary basis, to determine which packets are being blocked and then adding rules to allow them. There's a really good article / short video in Red Hat Magazine at <A href="http://www.redhatmagazine.com/2007/08/01/video-tip-from-rhces-firewalls/">http://www.redhatmagazine.com/2007/08/01/video-tip-from-rhces-firewalls/</A> that explains this really well. /Harry Sutton, RHCA Hewlett-Packard Company Richard Riley wrote: <o:p></o:p><PRE wrap="">Try stopping iptables on both machines during the test.<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>Richard Riley<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE> <o:p></o:p></PRE> <BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite"> <BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite"><PRE wrap="">-----Original Message-----<o:p></o:p></PRE><PRE>From: <A href="mailto:redhat-sysadmin-list-bounces@redhat.com">redhat-sysadmin-list-bounces@redhat.com</A> [<A href="mailto:redhat">mailto:redhat</A>-<o:p></o:p></PRE><PRE><A href="mailto:sysadmin-list-bounces@redhat.com">sysadmin-list-bounces@redhat.com</A>] On Behalf Of Douglas J Hunley<o:p></o:p></PRE><PRE>Sent: Monday, March 03, 2008 9:34 AM<o:p></o:p></PRE><PRE>To: <A href="mailto:redhat-sysadmin-list@redhat.com">redhat-sysadmin-list@redhat.com</A><o:p></o:p></PRE><PRE>Subject: Re: can't get OS to use LDAP for accounts<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>On Monday 03 March 2008 09:10:08 Steven Kalisky wrote:<o:p></o:p></PRE><PRE> <o:p></o:p></PRE> <BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite"><PRE wrap="">Try turning off SELinux and then test.<o:p></o:p></PRE><PRE> <o:p></o:p></PRE></BLOCKQUOTE><PRE wrap="">SELinux had previously been disabled. That didn't change anything<o:p></o:p></PRE><PRE>:(<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>--<o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE>--<o:p></o:p></PRE><PRE>redhat-sysadmin-list mailing list<o:p></o:p></PRE><PRE><A href="mailto:redhat-sysadmin-list@redhat.com">redhat-sysadmin-list@redhat.com</A><o:p></o:p></PRE><PRE><A href="https://www.redhat.com/mailman/listinfo/redhat-sysadmin-list">https://www.redhat.com/mailman/listinfo/redhat-sysadmin-list</A><o:p></o:p></PRE><PRE> <o:p></o:p></PRE></BLOCKQUOTE></BLOCKQUOTE><PRE wrap=""><o:p> </o:p></PRE><PRE>--<o:p></o:p></PRE><PRE>redhat-sysadmin-list mailing list<o:p></o:p></PRE><PRE><A href="mailto:redhat-sysadmin-list@redhat.com">redhat-sysadmin-list@redhat.com</A><o:p></o:p></PRE><PRE><A href="https://www.redhat.com/mailman/listinfo/redhat-sysadmin-list">https://www.redhat.com/mailman/listinfo/redhat-sysadmin-list</A><o:p></o:p></PRE><PRE><o:p> </o:p></PRE><PRE> <o:p></o:p></PRE> <o:p> </o:p></DIV></DIV></BODY></HTML>