Hi, <br>when I try "yum update", it gives these dependency error messages.<br>What should I do?<br><br>Loaded plugins: fastestmirror<br>Loading mirror speeds from cached hostfile<br> * extras: <a href="http://mi.mirror.garr.it">mi.mirror.garr.it</a><br>
* BlueOnyx: <a href="http://bb-one.blueonyx.it">bb-one.blueonyx.it</a><br> * updates: <a href="http://mi.mirror.garr.it">mi.mirror.garr.it</a><br> * base: <a href="http://mi.mirror.garr.it">mi.mirror.garr.it</a><br> * addons: <a href="http://mi.mirror.garr.it">mi.mirror.garr.it</a><br>
* Solarspeed.net: <a href="http://blueonyx.solarspeed.net">blueonyx.solarspeed.net</a><br>Setting up Update Process<br>Resolving Dependencies<br>--> Running transaction check<br>---> Package apr.i386 0:1.2.7-11.el5_3.1 set to be updated<br>
---> Package base-network-locale-de_DE.noarch 0:1.1.0-82BQ27.centos5 set to be updated<br>---> Package base-network-glue.noarch 0:1.1.0-82BQ27.centos5 set to be updated<br>---> Package base-vsite-locale-ja.noarch 0:3.0-132BQ55.centos5 set to be updated<br>
---> Package base-power-capstone.noarch 0:1.1.0-65BQ15.centos5 set to be updated<br>---> Package base-network-capstone.noarch 0:1.1.0-82BQ27.centos5 set to be updated<br>---> Package base-network-locale-ja.noarch 0:1.1.0-82BQ27.centos5 set to be updated<br>
---> Package base-power-glue.noarch 0:1.1.0-65BQ15.centos5 set to be updated<br>---> Package base-vsite-locale-de_DE.noarch 0:3.0-132BQ55.centos5 set to be updated<br>---> Package base-console-glue.noarch 0:1.1.0-0BX09 set to be updated<br>
---> Package base-console-locale-de_DE.noarch 0:1.1.0-0BX09 set to be updated<br>---> Package base-network-ui.noarch 0:1.1.0-82BQ27.centos5 set to be updated<br>---> Package base-swupdate-ui.noarch 0:1.2.0-1BQ15.centos5 set to be updated<br>
---> Package base-swupdate-locale-de_DE.noarch 0:1.2.0-1BQ15.centos5 set to be updated<br>---> Package subversion.i386 0:1.4.2-4.el5_3.1 set to be updated<br>---> Package base-ssl-locale-de_DE.noarch 0:1.1.0-68BQ13.centos5 set to be updated<br>
---> Package proftpd.i386 0:1.3.2a-1BX3 set to be updated<br>---> Package sausalito-cce-server.i386 0:0.80.4-1BQ44.centos5 set to be updated<br>---> Package base-ssl-capstone.noarch 0:1.1.0-68BQ13.centos5 set to be updated<br>
---> Package base-vsite-locale-en.noarch 0:3.0-132BQ55.centos5 set to be updated<br>---> Package base-swupdate-locale-da_DK.noarch 0:1.2.0-1BQ15.centos5 set to be updated<br>---> Package base-console-locale-en.noarch 0:1.1.0-0BX09 set to be updated<br>
---> Package base-console-locale-ja.noarch 0:1.1.0-0BX09 set to be updated<br>---> Package libxml2.i386 0:2.6.26-2.1.2.8 set to be updated<br>---> Package base-vsite-glue.noarch 0:3.0-132BQ55.centos5 set to be updated<br>
---> Package base-ssl-ui.noarch 0:1.1.0-68BQ13.centos5 set to be updated<br>---> Package apr-util.i386 0:1.2.7-7.el5_3.2 set to be updated<br>---> Package base-power-locale-ja.noarch 0:1.1.0-65BQ15.centos5 set to be updated<br>
---> Package base-ssl-locale-da_DK.noarch 0:1.1.0-68BQ13.centos5 set to be updated<br>---> Package base-swupdate-capstone.noarch 0:1.2.0-1BQ15.centos5 set to be updated<br>---> Package pam.i386 0:0.99.6.2-5BX01.centos5 set to be updated<br>
---> Package base-power-locale-de_DE.noarch 0:1.1.0-65BQ15.centos5 set to be updated<br>---> Package base-swupdate-locale-ja.noarch 0:1.2.0-1BQ15.centos5 set to be updated<br>---> Package base-vsite-ui.noarch 0:3.0-132BQ55.centos5 set to be updated<br>
---> Package base-vsite-locale-da_DK.noarch 0:3.0-132BQ55.centos5 set to be updated<br>---> Package base-power-locale-en.noarch 0:1.1.0-65BQ15.centos5 set to be updated<br>---> Package sausalito-cce-client.i386 0:0.80.4-1BQ44.centos5 set to be updated<br>
---> Package libxml2-python.i386 0:2.6.26-2.1.2.8 set to be updated<br>---> Package base-ssl-glue.noarch 0:1.1.0-68BQ13.centos5 set to be updated<br>---> Package base-power-ui.noarch 0:1.1.0-65BQ15.centos5 set to be updated<br>
---> Package base-vsite-capstone.noarch 0:3.0-132BQ55.centos5 set to be updated<br>---> Package base-ssl-locale-en.noarch 0:1.1.0-68BQ13.centos5 set to be updated<br>---> Package base-network-locale-en.noarch 0:1.1.0-82BQ27.centos5 set to be updated<br>
---> Package base-swupdate-locale-en.noarch 0:1.2.0-1BQ15.centos5 set to be updated<br>---> Package base-console-locale-da_DK.noarch 0:1.1.0-0BX09 set to be updated<br>---> Package base-swupdate-glue.noarch 0:1.2.0-1BQ15.centos5 set to be updated<br>
---> Package base-network-locale-da_DK.noarch 0:1.1.0-82BQ27.centos5 set to be updated<br>---> Package base-console-capstone.noarch 0:1.1.0-0BX09 set to be updated<br>---> Package base-ssl-locale-ja.noarch 0:1.1.0-68BQ13.centos5 set to be updated<br>
---> Package base-console-ui.noarch 0:1.1.0-0BX09 set to be updated<br>---> Package mod_dav_svn.i386 0:1.4.2-4.el5_3.1 set to be updated<br>---> Package base-power-locale-da_DK.noarch 0:1.1.0-65BQ15.centos5 set to be updated<br>
--> Processing Dependency: /lib/security/pam_loginuid.so for package: openssh-server<br>--> Finished Dependency Resolution<br>openssh-server-4.3p2-29.el5.i386 from installed has depsolving problems<br> --> Missing Dependency: /lib/security/pam_loginuid.so is needed by package openssh-server-4.3p2-29.el5.i386 (installed)<br>
Error: Missing Dependency: /lib/security/pam_loginuid.so is needed by package openssh-server-4.3p2-29.el5.i386 (installed)<br><br><br><br><br><div class="gmail_quote">On Mon, Aug 10, 2009 at 1:09 PM, Michael Stauber <span dir="ltr"><<a href="mailto:mstauber@blueonyx.it">mstauber@blueonyx.it</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi all,<br>
<br>
Tired about those brute force login attempts against your server(s)?<br>
<br>
Well, this time we did something against it and extended BlueOnyx with a<br>
default mechanism which detects and blocks those attempts.<br>
<br>
Don't worry, it will not conflict with any existing install of APF+BFD, Dfix,<br>
DenyHosts or similar custom tool that you have aboard, as it uses entirely<br>
different methods. Firewalling offending IPs off is still the best approach,<br>
but our implementation is quicker upon detecting brute force login attempts<br>
and has less overhead.<br>
<br>
Now this update is somewhat extensive, so this somewhat longer than usual<br>
message walks you through all need to knows.<br>
<br>
The HTML version of this message can be found here:<br>
<br>
<a href="http://www.blueonyx.it/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=37&cntnt01origid=15&cntnt01returnid=54" target="_blank">http://www.blueonyx.it/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=37&cntnt01origid=15&cntnt01returnid=54</a><br>
<br>
---<br>
<br>
The following updates for BlueOnyx were released today and are now available<br>
through YUM:<br>
<br>
==========<br>
Package<br>
==========<br>
<br>
Updating:<br>
base-console-capstone<br>
base-console-glue<br>
base-console-locale-da_DK<br>
base-console-locale-de_DE<br>
base-console-locale-en<br>
base-console-locale-ja<br>
base-console-ui<br>
base-network-capstone<br>
base-network-glue<br>
base-network-locale-da_DK<br>
base-network-locale-de_DE<br>
base-network-locale-en<br>
base-network-locale-ja<br>
base-network-ui<br>
pam<br>
proftpd<br>
sausalito-cce-client<br>
sausalito-cce-server<br>
<br>
Transaction Summary<br>
============================<br>
Install 0 Package(s)<br>
Update 18 Package(s)<br>
Remove 0 Package(s)<br>
<br>
<br>
These package addresses the following issues:<br>
<br>
base-console, pam and sausalito-cce-server:<br>
================================<br>
<br>
Feature update: This updates accomplish a few things in one go. Most<br>
importantly it extends BlueOnyx with a basic (but effective) brute force<br>
password discovery attacks protection trough the implentation of pam_abl.<br>
<br>
General explanation:<br>
-------------------------<br>
<br>
pam_abl provides auto blacklisting of hosts and (optionally!) users<br>
responsible for repeated failed authentication attempts.<br>
<br>
Brute force password discovery attacks involve repeated attempts to<br>
authenticate against a service using a dictionary of common passwords. While<br>
it is desirable to enforce strong passwords for users this is not always<br>
possible and in cases where a weak password has been used brute force attacks<br>
can be effective.<br>
<br>
The pam_abl module monitors failed authentication attempts and automatically<br>
blacklists those hosts (and optionally also accounts) that are responsible for<br>
a configureable numbers of failed attempts. Once a host is blacklisted it is<br>
guaranteed to fail authentication even if the correct credentials are<br>
provided.<br>
<br>
Blacklisting is triggered when the number of failed authentication attempts in<br>
a particular period of time exceeds a predefined limit. Hosts which stop<br>
attempting to authenticate will - after a period of time - be un-blacklisted<br>
automatically.<br>
<br>
Detailed explanation:<br>
--------------------------<br>
<br>
Our implementation of pam_abl protects pretty much any network service that<br>
uses the pluggable authentication mechanism (PAM). On BlueOnyx that includes<br>
SSH, Telnet, FTP, SMTP-Auth, POP3, IMAP and so on. pam_abl records failed<br>
logins into a temporary database, which is purged periodically. During such<br>
purges old entries with no frequent activity are expired. If someone exceeds a<br>
certain (configurable) amount of failed logins, then anyone from the offending<br>
IP will be unable to authenticate - even if they try a valid username and<br>
password combination.<br>
<br>
Please note: pam_abl is not a firewall. It just ties into the autentication<br>
mechanism that all services use and blocks on that level. So if you already<br>
have some brute force detection mechanism, then this update will not conflict<br>
with it.<br>
<br>
The most visible aspects of this new update are the two new GUI pages under<br>
"Server Manegement" / "Security". They are called "Failed Logins" and "Login<br>
Manager".<br>
<br>
"Login Manager" allows you to configure the settings of pam_abl. Like how long<br>
entries without recent activity remain in the database before they are purged<br>
from it. And more importantly: How many failed authentication attempts trigger<br>
a lock out of the offending host or (optionally) user. Generally you should<br>
only block hosts - this is the default.<br>
<br>
The "Failed Logins" page shows a list of hosts that had failed password<br>
attempts. It also shows how many failed login attempts they had, if they are<br>
currently blocked, or if they (still - or again) are able to login. Like said:<br>
Bans are temporary and expire after one hour of no further activity from that<br>
host.<br>
<br>
That page also shows you a list of usernames that were used during the failed<br>
login attempts.<br>
<br>
And of course the page allows you to reset all host and/or user bans.<br>
<br>
Built in safeguards:<br>
-----------------------<br>
<br>
Of course any mechanism to restrict access to the server has the potentical to<br>
backfire. Users could lock themselves out because they repeatedly login with<br>
the wrong username and/or password. However, we set reasonable defaults, so<br>
this should be a rare event. Of course you can change the default values<br>
through the GUI, or could disable the automatic temporary blocking in general.<br>
<br>
At the worst you could lock yourself out, too. So we built in a few safeguards<br>
which allow you to do something about that - even if you locked yourself out.<br>
<br>
Safeguard #1: Regardless if pam_abl has your IP address blocked or not, you<br>
will always be able to login to the GUI interface with the servers admin<br>
account. From there you can use the buttons on the "Failed Logins" page to<br>
reset all blocks - or just the one involving your IP.<br>
<br>
Safeguard #2: If the server is rebooted, the pam_abl database and all blocks<br>
are reset.<br>
<br>
Safeguard #3: If you still have acces to the command line of the server (from<br>
another IP or from a "root" session that is still open), then simply run<br>
"/etc/init.d/pam_abl stop" to manually initiate a flush of the pam_abl<br>
database.<br>
<br>
Command line usage:<br>
--------------------------<br>
<br>
The following new commands allow you to receive a bit more information about<br>
pam_abl on the command line:<br>
<br>
/etc/init.d/pam_abl<br>
<br>
Options: start|stop|status|purge<br>
<br>
start or stop: Flush the databases, delete all blocks and erase the failed<br>
login history.<br>
<br>
status: Shows detailed information about all recorded events - including date<br>
and time stamps.<br>
<br>
purge: Allows to manually expire events from the database which are older than<br>
the defined record keeping settings.<br>
<br>
/usr/bin/pam_abl<br>
<br>
Command line tool of pam_abl. Run it with the -h switch to see all available<br>
options.<br>
<br>
<br>
<br>
ProFTPd:<br>
=======<br>
<br>
This update brings ProFTPd to the latest version. Additionally we had to<br>
modify the autehtication mechanisms of ProFTP a little to make it work with<br>
pam_abl. Unfortunately this breaks ProFTPd's built in support for<br>
authentication against LDAP or MySQL. But as those aren't used by default on<br>
BlueOnyx we considered that acceptable.<br>
<br>
Our new ProFTPd also has the custom module mod_ban now compiled in by default.<br>
<br>
The mod_ban module is designed to add dynamic "ban" lists to proftpd. A ban<br>
prevents the banned user, host, or class from logging in to the server; it<br>
does not prevent the banned user, host, or class from connecting to the<br>
server. mod_ban is not a firewall. The module also provides automatic bans<br>
that are triggered based on configurable criteria.<br>
<br>
Beyond the protection that pam_abl already provides, mod_ban adds another<br>
layer of security that can be finely tuned.<br>
<br>
To edit the mod_ban settings see /etc/proftpd.conf<br>
<br>
Caveats:<br>
-----------<br>
<br>
This ProFTPd update is potentially troublesome, because we had to rewrite<br>
sections of /etc/proftpd.conf in order to make things happen.<br>
<br>
The most straightforward way to do this was to simply replace the existing<br>
/etc/proftpd.conf with a new one and then simply add the required VirtualHost<br>
containers back with the help of the script<br>
/usr/sausalito/sbin/fixproftpd_conf.pl.<br>
<br>
If you manually made any changes to your ProFTPd configuration, those will<br>
unfortunately get lost during the upgrade. However, a copy of your old<br>
proftpd.conf will be kept as /etc/proftpd.conf.pre-1.3.2a<br>
<br>
<br>
<br>
base-network:<br>
===========<br>
<br>
The GUI page from which you can configure your servers host- and domain name,<br>
DNS and network related settings had issues when you had more than two network<br>
cards.<br>
<br>
These bugs then prevented you from saving the changes.<br>
<br>
That problem has been fixed.<br>
<br>
<br>
--<br>
With best regards<br>
<br>
Michael Stauber<br>
<br>
_______________________________________________<br>
Blueonyx mailing list<br>
<a href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</a><br>
<a href="http://www.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://www.blueonyx.it/mailman/listinfo/blueonyx</a><br>
</blockquote></div><br>