mtpti5iD/redhat-docs_dataset huggingface dataset:
B.33.3. RHSA-2011:0281 - Important: java-1.6.0-openjdk security and bug fix update Updated java-1.6.0-openjdk packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) associated with each description below. These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. CVE-2010-4465 A flaw was found in the Swing library. Forged TimerEvents could be used to bypass SecurityManager checks, allowing access to otherwise blocked files and directories. CVE-2010-4469 A flaw was found in the HotSpot component in OpenJDK. Certain bytecode instructions confused the memory management within the Java Virtual Machine (JVM), which could lead to heap corruption. CVE-2010-4470 A flaw was found in the way JAXP (Java API for XML Processing) components were handled, allowing them to be manipulated by untrusted applets. This could be used to elevate privileges and bypass secure XML processing restrictions. CVE-2010-4448 It was found that untrusted applets could create and place cache entries in the name resolution cache. This could allow an attacker targeted manipulation over name resolution until the OpenJDK VM is restarted. CVE-2010-4450 It was found that the Java launcher provided by OpenJDK did not check the LD_LIBRARY_PATH environment variable for insecure empty path elements. A local attacker able to trick a user into running the Java launcher while working from an attacker-writable directory could use this flaw to load an untrusted library, subverting the Java security model. CVE-2010-4472 A flaw was found in the XML Digital Signature component in OpenJDK. Untrusted code could use this flaw to replace the Java Runtime Environment (JRE) XML Digital Signature Transform or C14N algorithm implementations to intercept digital signature operations. Note Note that all of the above flaws can only be remotely triggered in OpenJDK by calling the "appletviewer" application. Bug Fix BZ# 676019 This update provides one defense in depth patch. All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Commands:
14.5.2. Port Forwarding SSH can secure otherwise insecure TCP/IP protocols via port forwarding. When using this technique, the SSH server becomes an encrypted conduit to the SSH client. Port forwarding works by mapping a local port on the client to a remote port on the server. SSH can map any port from the server to any port on the client. Port numbers do not need to match for this technique to work. Note If you want to use reserved port numbers, please note that setting up port forwarding to listen on ports below 1024 requires root level access. To create a TCP/IP port forwarding channel which listens for connections on the localhost , use a command in the following form: For example, to check email on a server called mail.example.com using POP3 through an encrypted connection, use the following command: Once the port forwarding channel is in place between the client machine and the mail server, direct a POP3 mail client to use port 1100 on the localhost to check for new email. Any requests sent to port 1100 on the client system will be directed securely to the mail.example.com server. If mail.example.com is not running an SSH server, but another machine on the same network is, SSH can still be used to secure part of the connection. However, a slightly different command is necessary: In this example, POP3 requests from port 1100 on the client machine are forwarded through the SSH connection on port 22 to the SSH server, other.example.com . Then, other.example.com connects to port 110 on mail.example.com to check for new email. Note that when using this technique, only the connection between the client system and other.example.com SSH server is secure. Port forwarding can also be used to get information securely through network firewalls. If the firewall is configured to allow SSH traffic via its standard port (that is, port 22) but blocks access to other ports, a connection between two hosts using the blocked ports is still possible by redirecting their communication over an established SSH connection. Important The connection is only as secure as the client system because forwarding connections in this way allows any user on the client system to connect to that service. If the client system becomes compromised, an attacker can also access the forwarded services. If preferred, disable this functionality on the server by specifying a No parameter for the AllowTcpForwarding line in the /etc/ssh/sshd_config file and restarting the sshd service.

Commands:
ssh -L local-port : remote-hostname : remote-port username @ hostname
~]USD ssh -L 1100:mail.example.com:110 mail.example.com
~]USD ssh -L 1100:mail.example.com:110 other.example.com
Chapter 1. Introduction 1.1. Virtualized and Non-Virtualized Environments A virtualized environment presents opportunities for both the discovery of new attack vectors and the refinement of existing exploits that may not previously have presented value to an attacker. It is therefore important to take steps to ensure the security of both the physical hosts and the guests running on them when creating and maintaining virtual machines. Non-Virtualized Environment In a non-virtualized environment, hosts are separated from each other physically and each host has a self-contained environment, consisting of services such as a web server, or a DNS server. These services communicate directly to their own user space, host kernel and physical host, offering their services directly to the network. The following image represents a non-virtualized environment: Figure 1.1. Non-Virtualized Environment Virtualized Environment In a virtualized environment, several operating systems can be housed (as "guests") within a single host kernel and physical host. The following image represents a virtualized environment: Figure 1.2. Virtualized Environment When services are not virtualized, machines are physically separated. Any exploit is therefore usually contained to the affected machine, with the obvious exception of network attacks. When services are grouped together in a virtualized environment, extra vulnerabilities emerge in the system. If there is a security flaw in the hypervisor that can be exploited by a guest instance, this guest may be able to not only attack the host, but also other guests running on that host. This is not theoretical; attacks already exist on hypervisors. These attacks can extend beyond the guest instance and could expose other guests to attack.

Commands:
8.247. tuna 8.247.1. RHBA-2014:1404 - tuna bug fix update Updated tuna packages that fix several bugs are now available for Red Hat Enterprise Linux 6. The tuna packages provide an interface for changing both scheduler and IRQ tunables, at whole CPU, per-thread or per-IRQ levels. tuna allows CPUs to be isolated for use by a specific application and threads and interrupts to be moved to a CPU simply by dragging and dropping them. This update also fixes the following bugs: Note The tuna package has been upgraded to upstream version 0.10.4, which provides a number of bug fixes over the version. (BZ# 1029591 ) This update also fixes the following bugs: Bug Fixes BZ# 1035795 Previously, if the scheduler priority was not specified, the "tuna -t USDPID -p OTHER" command failed with the following error: ValueError: invalid literal for int() with base 10: 'OTHER' This error occurred also when different parameters, such as RR or FIFO, were passed to the -p option. This bug has been fixed and the value error no longer occurs. BZ# 1059685 Due to a bug in the tuna package, the "tuna -CP" command failed to list processes, returning the following message: NameError: global name 'cgroups' is not defined This bug has been fixed and the name error no longer occurs when executing "tuna -CP". The tuna package has been upgraded to upstream version 0.10.4, which provides a number of bug fixes over the version. (BZ#1029591) Users of tuna are advised to upgrade to these updated packages, which fix these bugs.

Commands:
Chapter 2. Performance Tuning Quickstart You can tune your Satellite Server based on expected managed host counts and hardware allocation using built in tuning profiles included in Satellite that are available using the installation routine's tuning flag. For more information, see Tuning Satellite Server with Predefined Profiles in Installing Satellite Server in a Connected Network Environment . There are four sizes provided based on estimates of the number of managed hosts your Satellite manages. You can find the specific tuning settings for each profile in the configuration files contained in /usr/share/foreman-installer/config/foreman.hiera/tuning/sizes . Name Number of managed hosts Recommend RAM Recommend Cores default 0 - 5000 20 GiB 4 medium 5000 - 10000 32 GiB 8 large 10000 - 20000 64 GiB 16 extra-large 20000 - 60000 128 GiB 32 extra-extra-large 60000+ 256 GiB+ 48+ Procedure Select an installation size: default , medium , large , extra-large , or extra-extra-large . The default value is default . Run satellite-installer : Optional: Run a health check. For more information, see Section 6.1, "Applying configurations" . Optional: Tune the Ruby app server directly using the Puma Tuning section. For more information, see Section 6.2, "Puma Tunings" .

Commands:
satellite-installer --tuning " My_Installation_Size "
Chapter 11. Fixed issues in Red Hat Decision Manager 7.13.2 Red Hat Decision Manager 7.13.2 provides increased stability and fixed issues listed in this section. 11.1. Business Central You cannot save a DMN model if you use the ()not function [ RHDM-1895 ] You cannot deploy a KJAR to a remote maven repository that requires access via a proxy in Business Central[ RHPAM-4509 ] The Table 'rhpam.taskEvent' doesn't exist error appears after upgrading to 7.12.0 or later [ RHPAM-4578 ] The commit history of the Metrics tab is not refreshed on branches other than the main branch [ RHPAM-2603 ] 11.2. KIE Server Cannot commit a session during a retry of the parent process [ RHPAM-4499 ] Unable to connect to a PostgresSQL DB over SSL from a kieserver image [ RHPAM-4400 ] When a process has variable of type java.util.Date , if the showTime attribute on the generated form is set to true , you cannot inser the time part [ RHPAM-4513 ] The ISPN000474 error is generated by kie-server when two nodes are configured to support failover [ RHPAM-4223 ] 11.3. Red Hat OpenShift Container Platform Cannot use special characters in passwords in the Business Central operator [ RHPAM-4529 ] The baseFilter(AUTH_LDAP_BASE_FILTER) filter is incompatible with versions earlier than 7.12.0 [ RHPAM-4147 ] Upgrade Red Hat JBoss EAP version to 7.4.8 on Red Hat Process Automation Manager image [ RHPAM-4616 ] 11.4. Decision engine Equality conditions between the BigDecimal property and a numeric value does not work correctly in a non-executable model [ RHDM-1944 ] An unexpected rule fires after upgrading from 7.10.1 to 7.12.1 when capitalized property is updated in modify block [ RHDM-1945 ] The non-executable-model does not react to the bind-only Map property with map access operator [ RHDM-1952 ] Even after modifying, a non-matching rule is fired again when modified facts are provided by a from statement [ RHDM-1951 ]

Commands:
Chapter 1. Upgrading from OptaPlanner 8.13 to Red Hat Build of OptaPlanner 8.38 To upgrade from OptaPlanner 8.13 to Red Hat Build of OptaPlanner 8.38, merge the versions of OptaPlanner in the following order: From 8.13.0.Final to 8.14.0.Final From 8.19.0.Final to 8.20.0.Final From 8.22.0.Final to 8.23.0.Final From 8.27.0.Final to 8.28.0.Final From 8.28.0.Final to 8.29.0.Final From 8.31.0.Final to 8.32.0.Final From 8.33.0.Final to 8.34.0.Final From 8.36.0.Final to 8.37.0.Final Procedure Open the OptaPlanner Upgrade Recipe 8 page in a browser. Complete the instructions for first version that you want to upgrade, for example From 8.13.0.Final to 8.14.0.Final . Repeat the instructions until you have upgraded to 8.37.0.Final.

Commands:
Chapter 7. Security 7.1. Securing connections with SSL/TLS AMQ JavaScript uses SSL/TLS to encrypt communication between clients and servers. To connect to a remote server with SSL/TLS, set the transport connection option to tls . Example: Enabling SSL/TLS var opts = { host: "example.com", port: 5671, transport: "tls" }; container.connect(opts); Note By default, the client will reject connections to servers with untrusted certificates. This is sometimes the case in test environments. To bypass certificate authorization, set the rejectUnauthorized connection option to false . Be aware that this compromises the security of your connection. 7.2. Connecting with a user and password AMQ JavaScript can authenticate connections with a user and password. To specify the credentials used for authentication, set the username and password connection options. Example: Connecting with a user and password var opts = { host: "example.com", username: "alice" , password: "secret" }; container.connect(opts); 7.3. Configuring SASL authentication AMQ JavaScript uses the SASL protocol to perform authentication. SASL can use a number of different authentication mechanisms . When two network peers connect, they exchange their allowed mechanisms, and the strongest mechanism allowed by both is selected. AMQ JavaScript enables SASL mechanisms based on the presence of user and password information. If the user and password are both specified, PLAIN is used. If only a user is specified, ANONYMOUS is used. If neither is specified, SASL is disabled.

Commands:
var opts = { host: "example.com", port: 5671, transport: "tls" }; container.connect(opts);
var opts = { host: "example.com", username: "alice" , password: "secret" }; container.connect(opts);
4.3. GFS2 File System Hangs and Requires Reboot of All Nodes If your GFS2 file system hangs and does not return commands run against it, requiring that you reboot all nodes in the cluster before using it, check for the following issues. You may have had a failed fence. GFS2 file systems will freeze to ensure data integrity in the event of a failed fence. Check the messages logs to see if there are any failed fences at the time of the hang. Ensure that fencing is configured correctly. The GFS2 file system may have withdrawn. Check through the messages logs for the word withdraw and check for any messages and call traces from GFS2 indicating that the file system has been withdrawn. A withdraw is indicative of file system corruption, a storage failure, or a bug. At the earliest time when it is convenient to unmount the file system, you should perform the following procedure: Reboot the node on which the withdraw occurred. Stop the file system resource to unmount the GFS2 file system on all nodes. Capture the metadata with the gfs2_edit savemeta... command. You should ensure that there is sufficient space for the file, which in some cases may be large. In this example, the metadata is saved to a file in the /root directory. Update the gfs2-utils package. On one node, run the fsck.gfs2 command on the file system to ensure file system integrity and repair any damage. After the fsck.gfs2 command has completed, re-enable the file system resource to return it to service: Open a support ticket with Red Hat Support. Inform them you experienced a GFS2 withdraw and provide logs and the debugging information generated by the sosreports and gfs2_edit savemeta commands. In some instances of a GFS2 withdraw, commands can hang that are trying to access the file system or its block device. In these cases a hard reboot is required to reboot the cluster. For information on the GFS2 withdraw function, see Section 3.11, "The GFS2 Withdraw Function" . This error may be indicative of a locking problem or bug. Gather data during one of these occurrences and open a support ticket with Red Hat Support, as described in Section 4.2, "GFS2 File System Hangs and Requires Reboot of One Node" .

Commands:
/sbin/reboot
pcs resource disable --wait=100 mydata_fs
gfs2_edit savemeta /dev/vg_mydata/mydata /root/gfs2metadata.gz
sudo yum update gfs2-utils
fsck.gfs2 -y /dev/vg_mydata/mydata > /tmp/fsck.out
pcs resource enable --wait=100 mydata_fs
B.66. php B.66.1. RHSA-2011:0195 - Moderate: php security update Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) associated with each description below. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. CVE-2010-4645 A flaw was found in the way PHP converted certain floating point values from string representation to a number. If a PHP script evaluated an attacker's input in a numeric context, the PHP interpreter could cause high CPU usage until the script execution time limit is reached. This issue only affected i386 systems. CVE-2009-5016 , CVE-2010-3870 A numeric truncation error and an input validation flaw were found in the way the PHP utf8_decode() function decoded partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use these flaws to perform a cross-site scripting attack. CVE-2010-3709 A NULL pointer dereference flaw was found in the PHP ZipArchive::getArchiveComment function. If a script used this function to inspect a specially-crafted ZIP archive file, it could cause the PHP interpreter to crash. All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Commands:
5.4. Optimizing Red Hat Gluster Storage Volumes for Virtual Machine Images If you have not already selected Optimize for Virt Store while creating a volume, select this option now to optimize your storage for virtual machine images. This has the same effect as adding the volume to the virt group. On the Volumes tab, select the volume to configure and click Optimize for Virt Store . The volume is configured and group , storage-owner-uid , and storage-owner-gid options are set. Figure 5.4. Volume Options For more information on each volume set tunable options, see Managing Red Hat Gluster Storage Volumes in the Red Hat Gluster Storage Administration Guide : https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.5/html/administration_guide/chap-managing_red_hat_storage_volumes .

Commands:
Chapter 9. Idling applications Cluster administrators can idle applications to reduce resource consumption. This is useful when the cluster is deployed on a public cloud where cost is related to resource consumption. If any scalable resources are not in use, OpenShift Container Platform discovers and idles them by scaling their replicas to 0 . The time network traffic is directed to the resources, the resources are unidled by scaling up the replicas, and normal operation continues. Applications are made of services, as well as other scalable resources, such as deployment configs. The action of idling an application involves idling all associated resources. 9.1. Idling applications Idling an application involves finding the scalable resources (deployment configurations, replication controllers, and others) associated with a service. Idling an application finds the service and marks it as idled, scaling down the resources to zero replicas. You can use the oc idle command to idle a single service, or use the --resource-names-file option to idle multiple services. 9.1.1. Idling a single service Procedure To idle a single service, run: USD oc idle <service> 9.1.2. Idling multiple services Idling multiple services is helpful if an application spans across a set of services within a project, or when idling multiple services in conjunction with a script to idle multiple applications in bulk within the same project. Procedure Create a file containing a list of the services, each on their own line. Idle the services using the --resource-names-file option: USD oc idle --resource-names-file <filename> Note The idle command is limited to a single project. For idling applications across a cluster, run the idle command for each project individually. 9.2. Unidling applications Application services become active again when they receive network traffic and are scaled back up their state. This includes both traffic to the services and traffic passing through routes. Applications can also be manually unidled by scaling up the resources. Procedure To scale up a DeploymentConfig, run: USD oc scale --replicas=1 dc <dc_name> Note Automatic unidling by a router is currently only supported by the default HAProxy router. Note Services do not support automatic unidling if you configure Kuryr-Kubernetes as an SDN. Note In OpenShift Container Platform 4.7, idled services do not become active again when they receive network traffic if they were idled while the leader ovnkube-master process was restarted or after the ovnkube-master leader changed. For more information, refer to Idled services cannot wake up automatically after restart of ovnkube-master in Red Hat OpenShift Container Platform 4 .

Commands:
oc idle <service>
oc idle --resource-names-file <filename>
oc scale --replicas=1 dc <dc_name>