users January 2021

users@lists.fedoraproject.org

103 participants
113 discussions

highest time to have Signal - no?
by lejeczek 30 Jan '21

30 Jan '21

hi everybody. I see some good folks prepped Signal in "copr" but I'd say - if any maintainer/developer is reading - it's the highest time we had Fedora's official build of "Signal" available - no? regards, L.

2 1

auditd log processing tools?
by Alex 30 Jan '21

30 Jan '21

Hi, I have a fedora33 system and would like to get more involved with auditd. I understand the basics, but are there any tools to process the audit.log file, to make it easier to process, read and display? How about acting on specific events? What if I wanted to be alerted somehow when sudo was run more than five times in some period? Perhaps logwatch? I've seen references to using it with splunk but are there open source alternatives? I'm also aware of aureport, which appears to be great for producing summary reports, and maybe an event report, but what do people do with this information to make it useful? How do admins normally act on the information in the logs? Are they just using it to investigate a specific event, such as when privileges are escalated for some reason or ssh is being used? It's otherwise just too much information - who cares that ssh is being used or sudo was run, unless you thought that functionality was disabled, for example. Thanks, Alex

9 20

Identifying Firefox threads
by Patrick O'Callaghan 29 Jan '21

29 Jan '21

This may be slightly OT. If so, apologies. I find that Firefox tends to slow down and consume more memory over time, presumably because some tab is doing a lot of work. However the usual process listings from 'top' or 'glances' just show a bunch of fairly cryptic threads such as: 85.4 20.3 7.12G 3.11G 2704 poc 2h55:08 45 0 R 391K 0 /usr/lib64/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 291 -prefMapSize 29096 ... and so on, so it's hard to know which one is associated with which tab (or tabs). Does anyone have a cheat sheet to help in pinning down the culprit(s)? poc

6 7

Routing traffic of a VM to specific NIC of the host machine.
by Danishka Navin 29 Jan '21

29 Jan '21

Hi, I have a CentOS 7 (use KVM) box with two physical NICs. There is a fedora VM running. I need to route my VM traffic via one of the NIC. This need to persistent. Regards, -- Danishka Navin

2 3

F32 not booting
by GianPiero Puccioni 28 Jan '21

28 Jan '21

Hi, yesterday my laptop with F32 didn't boot. It goes in emergency mode and creates a rdsosreport file I usually don't do this but this time when I installed F I let the system create the partitions and I think it's LVM with XFS but I'm not sure of the latter and I am not familiar with this method. Is there something to do to try to recover something about this, like the files from /home as of course the USB stick I used for backups went crazy too and I could recover only a fraction of it. It doesn't seem that it was the HD that want all bad as the Win10 partition still works. If I run lvm_scan I get this: Scanning devices sda7 for LVM logical volumes fedora_shure/root fedora_shure/swap ACTIVE '/dev/fedora_shure/root' [50.00 GiB] inherit ACTIVE '/dev/fedora_shure/swap' [<3.88 GiB] inherit inactive '/dev/fedora_shure/home' [<166.95 GiB] inherit and in /dev/fedora_shure there is only root and swap I'll attach both the rdsosreport and output of journalctl(as suggested by the error message) Thanks for any help GiP P.S. I sent this before but it went into "moderation" as it exceeded the 60K limit, I gzipped the attachments and it should be fine now. G

3 4

Mail Reader -
by Bob Goodwin 28 Jan '21

28 Jan '21

I have Mail Reader listed in the menu on this computer. Can someone tell me what the procedure is to make it read/speak some text? It does not respond to the same number pad keys as Orca. Orca might work if I could adjust the voice to something intelligible, the default;;t seems to lose syllables from each word. As it is I have to use an iPad and ask Siri to read messages. Not a good system for me. Bob -- Bob Goodwin - Zuni, Virginia, USA FEDORA-32/64bit LINUX XFCE Fastmail POP3

11 28

rkhunter warnings
by François Patte 28 Jan '21

28 Jan '21

Bonjour, Since the last update of f32, rkhunter send a lot of warning (in spite of the --propupd I run after each update...): Warning: Checking for possible rootkit files and directories [ Warning ] Found file '/lib/libkeyutils.so.1.9'. Possible rootkit: Sniffer component Found file '/lib64/libkeyutils.so.1.9'. Possible rootkit: Sniffer component Found file '/usr/lib/libkeyutils.so.1.9'. Possible rootkit: Sniffer component Found file '/usr/lib64/libkeyutils.so.1.9'. Possible rootkit: Sniffer component Warning: The following processes are using suspicious files: Command: abrt-applet UID: 2995 PID: 2663 Pathname: 24376 Possible Rootkit: Spam tool component Command: abrtd UID: 0 PID: 1580 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: abrt-dbus UID: 0 PID: 3087 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: abrt-dump-journ UID: 0 PID: 1629 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: auditd UID: 0 PID: 1386 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: chrome<-----------------this one repeated several times---------> UID: 11750 PID: 11749 Pathname: 24376 Possible Rootkit: Spam tool component Command: cleanupd UID: 0 PID: 2062 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: cupsd UID: 0 PID: 1525 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: dnfdragora-upda UID: 3025 PID: 2621 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: evolution-addre UID: 3025 PID: 3168 Pathname: /usr/lib64/libkeyutils.so.1.9 Possible Rootkit: Spam tool component Command: evolution-alarm UID: 3007 PID: 2571 Pathname: 24376 Possible Rootkit: Spam tool component etc. etc. chkrootkit does not teturn any problem... What is the problem? Thank you. -- François Patte UFR de mathématiques et informatique Laboratoire CNRS MAP5, UMR 8145 Université Paris Descartes 45, rue des Saints Pères F-75270 Paris Cedex 06 Tél. +33 (0)6 7892 5822 http://www.math-info.univ-paris5.fr/~patte FSF https://www.fsf.org/blogs/community/presenting-shoetool-happy-holidays-from…

5 4

serious rkhunter warnings not seen before (by me).
by home user 28 Jan '21

28 Jan '21

I just finished doing my weekly patches for my F32 workstation. The sequence (done as root): 1. rkhunter --check (clean) 2. dnf --refresh upgrade dnf (nothing to do) 3. dnf upgrade (no hint of trouble) 4. reboot (no hint of trouble) 5. rkhunter --check (trouble!) I put the rkhunter log file on the google drive; here is the link: "https://drive.google.com/file/d/1asJQhjhffxOklGivzFLeKV5-gaEVCwYX/view?usp=…". The file properties checks warning are common after a weekly patching; ignore those. The first warning of concern is line #1470: "[12:33:02] Checking for file '/lib/libkeyutils.so.1.9' [ Warning ] [12:33:02] Checking for file '/lib64/libkeyutils.so.1.9' [ Warning ] [12:33:02] Checking for file '/usr/lib/libkeyutils.so.1.9' [ Warning ] [12:33:02] Checking for file '/usr/lib64/libkeyutils.so.1.9' [ Warning ]". The next is in line #1602: "[12:33:08] Warning: Checking for possible rootkit files and directories [ Warning ] [12:33:08] Found file '/lib/libkeyutils.so.1.9'. Possible rootkit: Sniffer component [12:33:08] Found file '/lib64/libkeyutils.so.1.9'. Possible rootkit: Sniffer component [12:33:08] Found file '/usr/lib/libkeyutils.so.1.9'. Possible rootkit: Sniffer component [12:33:08] Found file '/usr/lib64/libkeyutils.so.1.9'. Possible rootkit: Sniffer component". Both warnings above are in the section "[12:32:58] Info: Starting test name 'possible_rkt_files' [12:32:58] Performing check of possible rootkit files and directories", which starts at line 1388. Below this section are numerous other warnings about other processes using suspicious files. My workstation was clean; I patched; now rkhunter says my system is contaminated. I had nothing else running during the scanning and patching except a terminal (in which I did the patching), ksysguard, and xeyes. Are the warnings actual problems or false alarms? If the problems are real, how do I fix? Re-installing is impractical. Are there contaminated packages in the repositories? thanks, Bill.

8 17

Mail Reader -
by Bob Goodwin 27 Jan '21

27 Jan '21

I have Mil Reader listed in the menu on this computer. Can someone tell me what the procedure is to make it read some text? Bob -- Bob Goodwin - Zuni, Virginia, USA FEDORA-32/64bit LINUX XFCE Fastmail POP3

2 1

What does this smartd nonsense mean?
by Tom Horsley 26 Jan '21

26 Jan '21

In my logwatch this morning (for the first time that I remember): --------------------- Smartd Begin ------------------------ **Unmatched Entries** Device: /dev/nvme0, --capabilites is set, mail will be suppressed. : 2 time(s) Device: /dev/nvme1, --capabilites is set, mail will be suppressed. : 2 time(s) Device: /dev/nvme2, --capabilites is set, mail will be suppressed. : 2 time(s) What on earth does that mean? Google didn't seem to find any examples of that message.

2 2