Sometimes when running yum check-update on a CentOS system, yum will complain about a particular repomd.xml file being out of date. You might see output like this:

[root@host ~]# yum check-update
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
epel/x86_64/metalink
 * base: centos-distro.cavecreek.net
 * epel: d2lzkl7pfhq30w.cloudfront.net
 * extras: linux.cc.lehigh.edu
 * updates: reflector.westga.edu
base
extras
updates
Not using downloaded updates/repomd.xml because it is older than what we have:
  Current   : Thu Jul 16 09:45:59 2020
  Downloaded: Thu Jun 25 14:10:47 2020

This message can appear for any active repository on your system:

Not using downloaded base/repomd.xml because it is older than what we have
Not using downloaded epel/repomd.xml because it is older than what we have
Not using downloaded extras/repomd.xml because it is older than what we have
...etc

What's going on?

Notices about old repomd.xml ...

You may encounter the following error from iptables in dmesg or some other system log:

x_tables: ip_tables: udp match: only valid for protocol 17

This error indicates a parameter mismatch in one of your iptables rules. Specifically, one or more of the rule specifications isn't supported by the protocol you're trying to match.

For example, here's a rule intended to allow outbound NTP traffic, but it contains a typo:

iptables -A OUTPUT -p tcp -m udp --dport 123 -m state --state NEW -j ACCEPT

Here, the rule first attempts (wrongly) to match the TCP protocol, -p tcp, then tries to specify further matching based on the UDP module, -m udp. When iptables tries to process this rule, the rule will fail, and an error is logged:

x_tables: ip_tables: udp match: only valid for protocol 17

Because NTP is a UDP-based protocol, the inclusion of -p tcp in this rule was surely a brain fart. The corrected rule fixes the typo, specifying the correct prot...

This week I finally took the plunge and upgraded most of the servers I work with from PHP 7.1 to PHP 7.2. (Some of them still can't be brought forward due to dependencies that use mcrypt.) I ran into a few snags with the upgrade to 7.2 and thought I'd document them here. This may be useful if you:

• Run CentOS Linux 6.x,
• Want to install PHP 7.2,
• Need pthreads support in PHP, and
• Prefer to compile PHP from source

Executive summary

In order to build PHP 7.2 with pthreads on CentOS 6, you must upgrade autoconf to version 2.64 or higher, which must be done manually instead of via the yum package manager. You'll also have to first build PHP 7.2 without pthreads, then use this "bootstrap" copy to prepare the pthreads extension before compiling PHP a second time.

autoconf 2.69

Start by installing autoconf 2.69. The latest version available through yum is 2.63, which isn't sufficient to build PHP's configure script.

It's critical that you supply the --prefix=/usr option when...

This article outlines the deployment of a recursive, caching, authoritative DNS server running BIND 9.11.26 on CentOS 6.10. Why this combination? The BIND name server is the most feature-rich open source resolver, with decades of development behind it. And despite closing in on its nominal end-of-life, CentOS 6 remains a popular server OS due to its proven stability and the absence of systemd.

Preparing your environment

In order to set up your DNS server, you're going to need:

• A server running CentOS 6.10 (bare metal, VM, or VPS will all work)
• root ssh access to your server
• At least 64MB of available RAM for the named process
• wget or some other utility to download a file

There are also some software dependencies:

• The gcc compiler (yum -y install gcc)
• The file utility (yum -y install file)
• OpenSSL header files (yum -y install openssl-devel)

You don't necessarily ...

In an age where SSL/TLS certificates are free via Let's Encrypt, if you're running a Postfix mail server, you should make sure it's capable of speaking TLS.

Here's the output from postconf -n | grep tls on my machine, which lists all of the TLS options in main.cf that I've changed from their defaults:

    smtp_tls_CAfile = /etc/pki/tls/cert.pem
    smtp_tls_ciphers = medium
    smtp_tls_loglevel = 1
    smtp_tls_mandatory_protocols = !TLSv1, !SSLv2, !SSLv3
    smtp_tls_note_starttls_offer = yes
    smtp_tls_protocols = !SSLv2, !SSLv3
    smtp_tls_security_level = may
    smtpd_tls_CAfile = /etc/pki/tls/cert.pem
    smtpd_tls_auth_only = no
    smtpd_tls_cert_file = /etc/letsencrypt/live/my.example.com/fullchain.pem
    smtpd_tls_ciphers = medium
    smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
    smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem
    smtpd_tls_eecdh_grade = strong
    smtpd_tls_exclude_ciphers = aNULL, eNULL, EX...