krisdigitx's questions

我在 centos 上安装了 freeipa，重新启动服务后似乎失去了“kadmin”的身份验证

[root@pcm-ipa-01 ~]# kadmin init
Authenticating as principal root/[email protected] T with password.
kadmin: Client not found in Kerberos database while initializing kadmin interface

但是我可以直接使用用户“admin”进行身份验证

[root@pcm-ipa-01 ~]# kadmin -p admin
Authenticating as principal admin with password.
Password for [email protected]: 
kadmin:  list_principals
get_principals: Operation requires ``list'' privilege while retrieving list.
kadmin:  

更新：

[root@ipaserver tmp]# ipa user-show admin
ipa: ERROR: did not receive Kerberos credentials


[root@pcm-ipa-01 tmp]# klist
klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)

我正在运行 centos 6.2

最近我注意到 apache 在启用 selinux 的情况下运行

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=Permissive
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

我注意到这些错误出现在 dmesg 上

type=1400 audit(1354453732.704:9056368): avc:  denied  { name_connect } for  pid=39006 comm="httpd" dest=11211 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:memcache_port_t:s0 tclass=tcp_socket
type=1400 audit(1354453735.777:9056369): avc:  denied  { name_connect } for  pid=39046 comm="httpd" dest=6379 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket

然后我启用

 /usr/sbin/setsebool httpd_can_network_connect=1

这阻止了错误，网页也开始工作。

我的问题是，如果 selinux 处于宽容模式，selinuxtype=targeted 会强制执行任何策略吗？

如果不是，它是如何解决 apache 的问题的，因为 selinux 已经处于宽容模式？

服务器内存不足并开始终止进程​​，顶部使用的应用程序消耗的总 PSS 内存（从常驻内存使用的实际内存）小于系统上的总内存，我想找出这种额外的内存使用情况发生在哪里？任何想法，下面是 meminfo、smem、free -m 的输出，

任何建议将不胜感激？？？

cat /proc/meminfo

MemTotal:        5976008 kB
MemFree:          138768 kB
Buffers:            2292 kB
Cached:            57444 kB
SwapCached:        85980 kB
Active:           324332 kB
Inactive:         121836 kB
Active(anon):     309264 kB
Inactive(anon):    77992 kB
Active(file):      15068 kB
Inactive(file):    43844 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:       8159224 kB
SwapFree:        6836184 kB
Dirty:               572 kB
Writeback:             0 kB
AnonPages:        372160 kB
Mapped:            13976 kB
Shmem:               472 kB
Slab:             328216 kB
SReclaimable:      92544 kB
SUnreclaim:       235672 kB
KernelStack:        4824 kB
PageTables:        14732 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:     8159224 kB
Committed_AS:    4940480 kB
VmallocTotal:   34359738367 kB
VmallocUsed:      102424 kB
VmallocChunk:   34359584392 kB
HardwareCorrupted:     0 kB
AnonHugePages:         0 kB
HugePages_Total:       0
HugePages_Free:        0
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 kB
DirectMap4k:        6384 kB
DirectMap2M:     2080768 kB
DirectMap1G:     4194304 kB

SMEM usage:

30971 root     python /usr/local/scripts/s     2432      660      860     1204
23296 root     /usr/bin/spamd -d -c -m5 -H    58296     1460     1564     1868
 2763 ufc      csrv -c /home/ufc/ufclient/   116000    12768    12792    13084
55819 root     /usr/bin/python /bin/smem          0    22356    22988    24364
 2101 root     clamd                         189228    41224    41280    41700
32914 root     /opt/safesquid/safesquid/sa   831120     5808   138619   271844


[root@server sysadmin]# free -m
             total       used       free     shared    buffers     cached
Mem:          5835       5695        140          0          1         19
-/+ buffers/cache:       5674        161
Swap:         7967       1315       6652

更新：

服务器现在恢复正常，但内存使用呈指数级增长，直到 7 小时后应用程序被终止

Out of memory: Kill process 14585 (safesquid) score 81 or sacrifice child
Killed process 16141, UID 500, (python) total-vm:79284kB, anon-rss:2656kB, file-rss:680kB



 top - 21:58:16 up 16 days, 11:10,  1 user,  load average: 0.46, 0.74,
    0.78 Tasks: 243 total,   1 running, 242 sleeping,   0 stopped,   0 zombie Cpu(s):  5.7%us,  5.8%sy,  0.0%ni, 88.3%id,  0.1%wa,  0.0%hi, 
    0.1%si,  0.0%st Mem:   5976008k total,  5830648k used,   145360k free,    35724k buffers Swap:  8159224k total,   445384k used,  7713840k free,  3684540k cached


PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND  
4960 ssquid    20   0 1000m 534m 3068 S 20.6  9.2  90:19.40 safesquid  
2101 clamav    20   0 4153m  85m 1672 S  2.0  1.5 536:42.26 clamd 
23333 root      20   0  244m  50m 1940 S  0.0  0.9   2:10.84 spamd  
2763 ufc       20   0 1628m  32m  25m S  1.0  0.5 399:12.74 csrv 
61303 root      20   0 97876 4380 3304 S  0.0  0.1   0:00.28 sshd 
23296 root 20   0  227m 3424  928 S  0.0  0.1   0:07.87 spamd

该盒子正在运行 rulespace、clam 和 safesquid 代理。

在内存图中，最大的下降是当应用程序被杀死时，我重新启动了 safesquid 服务......