/srv/irclogs.ubuntu.com/2005/07/10/#ubuntu-kernel.txt

=== Seveaz [~seveas@seveas.demon.nl] has joined #ubuntu-kernel
fabbionemorning05:23
=== chmj [~chmj@196.36.161.235] has joined #ubuntu-kernel
=== swarm [~swarm@151.97.253.245] has joined #ubuntu-kernel
=== karlheg [~karlheg@host-250-237.resnet.pdx.edu] has joined #ubuntu-kernel
=== ogra [~ogra@p5089EC57.dip.t-dialin.net] has joined #ubuntu-kernel
ografabbione, ping12:11
fabbioneogra: pong?12:11
ogralooks like i have to run a firewall on the ltsp server for edubuntu :-/ do we have any uml capable kernel image ?12:12
fabbioneno12:12
ograor do you think xen will be alternatively ready for breezy 12:12
fabbioneprobably...12:13
ograi thought about a chroot jail, but that wont help for a firewall12:13
fabbionexen is up for google atm12:13
ogras i'll need a extra vm...12:13
ogras/s/so12:13
fabbioneand how do you think xen/uml will help you?12:13
fabbionewhat is exactly the problem12:13
ogradont i run a independent kernel instance with them ?12:13
fabbioneyes, but what is the problem you need to address exactly12:14
ograi dont want to run the FW on the server directly.... if i set netfilter option in a chroot they will affect the host too, or am i wrong ?12:14
fabbionewrong12:14
fabbionexen or uml won't help you at all12:15
ograoh... i though it would...12:15
fabbionei don't understand why do you want to run netfilter in a chroot...12:16
fabbionenetfilter or iptables is kernel stuff12:16
fabbioneyou want to run it as soon as possible12:16
ograto have it separated from the server.... its a school environment.. so if someone hacks the FW he shouldnt have any access to the server processes....12:16
fabbionedoes need to run on the same machine?12:16
ograbut mark requires me to run both on one machine12:17
ograyes12:17
ogra:/12:17
fabbioneamen12:17
fabbionelet me think one second12:17
fabbionehow many network cards do you have?12:18
ogratwo i guess12:18
ograi could make 3 a requirement if that helps...12:18
fabbionei am thinking :)12:18
ogra:)12:19
fabbione2 are enough....12:19
fabbioneand you can use xen12:19
ogragreat :) 12:19
fabbionebut the setup is NOT tricky12:19
ograyou mentor it, right ? 12:19
fabbionei am mentoring xen, but only for the packaging12:20
fabbionenot for these kind of weird setups :)12:20
ograi have to make only one default setup... its unlikely that anybody will touch it... the firts edubuntu shall be a out of the box solution12:20
ograbut additional HW is a "no go" :/12:21
fabbionei am not 100% sure 2 cards are enough tho12:21
ogracan you use aliases across the kernel/xen envionments ?12:22
ogra(alias interfaces that is)12:22
fabbionethe problem i think is:12:22
fabbione(or are)12:22
fabbione- FW needs 2 interfaces12:23
ograyep12:23
fabbione- Server needs one interface12:23
=== fabbione attempts to think...
=== Seveas [~seveas@seveas.demon.nl] has joined #ubuntu-kernel
fabbioneare there any users allowed to login on the server other than the admin?12:24
ogranope...12:24
fabbioneprobably.. what you can do is:12:24
ograall users are locked in the ltsp envionment... only the NFS roots are accessible12:24
fabbionebtw.. do you know how xen works?12:25
ogranope12:25
fabbioneor do i need to explain?12:25
fabbioneok12:25
fabbionebasically it works this way..12:25
ograits a additional VM as far as i understood it12:25
fabbione- you boot the real machine with a kernel called dom012:25
fabbionesuch a kernel is the one that access the real hw12:25
fabbioneand it exports it via an internal backplane to the guests12:26
fabbione- each guest boots its own kernel called domU12:26
fabbionethat access virtual disks/net interfaces via the backplane12:26
ograok, so i'll need two guests then.. 1. ltsp server 2. firewall...12:26
fabbioneyes.. but the problem is how to share the hw12:27
fabbionebecause a FW needs 2 interfaces12:27
ograi'm fine with a 3 netcard requirement...12:27
fabbionethe server needs one (real to run dhcp)12:27
fabbionethe FW needs at least one real12:27
fabbioneprobably...12:27
fabbionewhat you can do is:12:27
fabbionerun the host without real cards12:28
fabbioneconfigure the guests to run a dom0 kernel and use one virtual interface towards the host and one real card towards the world12:28
fabbioneat that point...12:28
fabbionethe FW real card goes towards internet12:28
fabbionethe FW virtual interface towards the host12:29
fabbionethe host will bridge with the Server 12:29
fabbione(they will feel like on the same LAN12:29
fabbiones/feel/look)12:29
fabbionethe Server uses the virtual interface towards the host to talk with the firewall12:29
ograhmm, so i could even build a little DMZ ? sounds cool12:29
fabbioneogra: exactly12:30
ograwow, xen is cool12:30
fabbionethe DMZ will be a virtual lan running inside the host12:30
fabbionethe real interface of the server will go towards the internal lan12:30
fabbionenow what i am afraid of is:12:30
fabbione- how to partition the hw so that iface X is associate with xen guest X12:30
fabbione(i know it can be done, but i never tried it)12:31
fabbione- you will need a spectacular amount of netfilters running on FW, host and Server12:31
ograits my job to find hat out... :)12:31
fabbione- access to the host for admin purpose might be a problem if server goes down12:33
fabbioneogra: in any case.. do you realize that with this setup:12:33
fabbionea) you are going to lose performance on each single "machine"12:33
fabbioneb) you triplicate the amount of maintainance (if not more)12:33
ograhum.... thats not good12:34
fabbionec) you will still need to run netfilter/iptables on all 3 the machines?12:34
ograthats no problem12:34
fabbionexen adds overhead.. in many directions12:34
fabbionei can't think of anything simpler with that requirements12:35
ograperformance loss is very bad for ltsp....12:35
fabbionebut imho... if you just use something like:12:35
fabbioneiptables -t filter -F INPUT12:35
fabbioneiptables -t filter -P INPUT DROP12:35
fabbioneiptables -t filter -A INPUT -j ACCEPT -d 192.168.2.6 -m state --state ESTABLISHE12:36
fabbioneD,RELATED12:36
fabbioneyou basically closed the machine from the outside12:36
fabbioneand you can still navigate from the inside12:36
fabbionethat rule (or a similar one) will just close *12:36
ograyep12:36
fabbioneimho all the xen mess is not worth...12:37
fabbionebut well...12:37
ogramy main concern is to run both on one HW... since the FW has to do transparent proxying....12:38
fabbioneyou will also need to test the above setup...12:38
fabbioneyeah but transparent proxy is not an issue12:38
fabbioneyou still don't need to listen with services on the outside interface12:38
ograyep...12:38
ograbut from the inside i need a GW to put the content filter on... having both on one machine hurts my stomach12:39
fabbioneok.. but my question is.. is it only your stomach or a specific requirement for the specs?12:40
ograbut your explanation shows that xen/uml seems not to be a good way around if i loose performance12:40
fabbioneyou lose performance..12:40
fabbioneyou are adding:12:41
ograthe requirement is to have transparent proxing for parental control without having additional HW12:41
fabbione- vm overhead12:41
fabbione- 2 extra hops in the network12:41
ograi dont care about extra hops12:41
fabbione- removing memory (due to partitioning) from one server12:41
ograthats the worst12:41
fabbione- using the internal backplane to share hw12:41
fabbionei mean.. the backplane is fast12:41
fabbionebut it is still overhead12:42
fabbioneand the main issue is the RAM really12:42
ograloosing memory in a ltsp environment is a vry bad thing12:42
ograevery byte is speed there12:42
fabbionethe issue is that xen needs to know how much ram you assign to each domain12:42
fabbione(including the host)12:42
fabbionethe host doesn't need much12:42
ograa FW probably doesnt need mor the 64MB either12:43
ogramore then12:43
fabbionelike 256MB would do12:43
fabbionethe FW at least 128MB12:43
fabbionethe Server all the rest12:43
ograheh... the server will be somewhere in the GB area..... 4GB are common12:43
fabbione+ an extra 64Mb hidden by xen management12:44
ogra(for a 20-30 client setup)12:44
fabbioneyou know that our kernel needs to be recompiled on x86 machines with more than 4GB?12:44
fabbioneanyway..12:45
fabbioneyou will still need to test that all the above will ever work12:45
ograi think we dont have mainboards yet that support moe then 4GB on single x86, do we ?12:45
fabbioneprobably not on home pc12:45
ograyes, i know ...12:45
fabbionei am pretty sure they do on servers12:45
ograhmm, 32bit on a single CPU can handle more then 4GB ?12:46
ograi didnt know that12:46
fabbionein terms of disk space.. the FW/HOST don't need more than 1G each12:46
fabbionethe rest can go to server12:46
ogradisk space is cheap and not an issue 12:46
fabbioneogra: there is an option to extend that to 64GB12:46
ograwoah...12:46
fabbionebut it's disabled because it adds overhead12:46
fabbionethe limit for a single process is still 4GB12:47
ogramight becoman an option for edubuntu.... 12:47
ograbecome an12:47
fabbioneyes, that means an extra edubuntu kernel :)12:47
fabbione( i need a smoke.. brb )12:47
ograit could be that i need a own kernel anyway... finally you got me in the kernel usiness then :)12:47
fabbioneahah welcome to pleasure of pain12:48
ograheh12:48
chmjand suffering 12:49
=== ogra [~ogra@p5089EB75.dip.t-dialin.net] has joined #ubuntu-kernel
zulhola02:07
chmjfabbione: do you know if concordia is down ?02:24
fabbionechmj: nope.. i didn't login since yesterday02:24
fabbionehey zul02:24
chmjseems to be 02:24
fabbioneconcordia.ubuntu.com [82.211.81.168]  22 (ssh) : No route to host02:24
fabbioneit is02:24
=== doko [~doko___@dsl-084-059-087-027.arcor-ip.net] has joined #ubuntu-kernel
=== jbailey [~jbailey@modemcable014.133-131-66.mc.videotron.ca] has joined #ubuntu-kernel
=== JaneW [~JaneW@146.232.64.52] has joined #ubuntu-kernel
fabbionehey jbailey 03:24
fabbionehey JaneW 03:24
JaneWhi fabbione03:25
jbaileyHeya Fabio03:25
jbaileyI guess this means the move was successful.03:25
jbailey'net just got installed.03:25
jbaileyNow I just need to buy a fridge and stove..03:25
fabbionecool03:26
fabbionecongratulation03:26
fabbionesee i have an extra fridge here....03:26
fabbioneand an extra stove03:26
fabbionejbailey: you moved to the wrong place03:26
=== ogra sees JaneW around... does this meen we get a new nutty kernel again ?
ogramean even03:26
JaneWogra: hi - I am at a conf, but just found wireless access, so I couldn;t resist hopping on...03:31
ograhehe03:31
ograaddicted03:31
zulwelcome to waa...wirleess addicts annoymous03:31
ograheh03:34
JaneWzul: thanks ;)03:35
fabbioneehhe03:36
jbaileyfabbione: Well, whether it's right or it's wrong, I'm sure as hell not doing that again soon.03:37
fabbioneahhaha03:38
fabbionejbailey: i did it so many times that i don't even want to think to move03:38
fabbioneif not for the tax rates :)03:38
jbaileyThis is the first time that I've moved a whole house to another province.03:39
jbaileyWhen we moved to Toronto we got rid of all of our stuff first.03:39
fabbioneeh...03:39
fabbionei still have some stuff in italy03:39
fabbionesooner or later i will need to rent a little truck and do the ride again03:39
fabbione2400KM brrrr....03:40
fabbioneactually a bit more..03:40
fabbionebut well03:40
jbaileyOuch.03:40
fabbionearound that line03:40
jbaileyThis was at least only like 600-700km03:40
fabbionejbailey: when i moved to dk, i loaded my father's car and drove alone for 2 days....03:41
jbaileyAnd sais hi. =)03:41
fabbionejbailey: basically the passenger seat had 4 bags with all the normal life stuff03:41
jbaileyAngie, rather.03:41
fabbionethe rest was computer equipment :)03:41
fabbionehi Angie!03:41
jbailey*lol*03:42
fabbioneit took me around 24 hours of pure driving03:43
jbaileyI have to go back to Toronto this month to pick up my SGI, my Alpha and my Itanium.03:43
jbaileyThere just wasn't room.03:43
fabbione+ i got lost on the german motorway03:43
fabbionethat added another good hour03:43
=== jbailey blinks
jbaileyIs Germany between Italy and Denmark?03:44
fabbioneyeah as well as swiss/austria03:44
fabbioneitaly -> {swiss,austria} -> germany -> dk03:44
fabbionei got lost after the austria's border line03:44
fabbionebecause the indication sucked03:45
fabbioneand ended up in the wrong direction03:45
ografabbione, you cant get lost on german motorways, thats a rumor ;)03:45
ogra*g*03:45
fabbioneogra: not when you pretend to have a city called "Aschufart" that's not on any of the maps03:46
ogralol03:46
=== ogra wipes the laughing tears from his eyes....
fabbioneogra: only in germany you write "exit" at the motorway exit, instead of the name of the place it takes you03:47
ograAusfahrt is german for exit.... :)03:47
fabbioneso it took me a little while to realize that there can't be a city called "exit" longer than 50km03:47
ograheh03:47
ograbut at least you saw something of germany despite the motorway :)03:48
fabbioneyeah an extra gas station03:48
=== chmj [~chmj@196.36.161.235] has joined #ubuntu-kernel
chmjfabbione: ping 03:49
fabbionechmj: yes?03:50
chmjproblems 03:51
chmjhold on, I'm uploading dmesg output03:52
chmjfabbione: ipw2100 failed after I dist-upgraded 03:53
chmjhttp://people.ubuntu.com/~charles/dmesglog03:54
chmjerm, I can't execute anything from bash, just hangs the kernel 03:54
fabbionechmj: known bug..03:54
fabbionefix upstream.. kthxbye03:54
chmjhmmm 03:55
zuljbailey: if you want you can leave your SGI, Alpha, and Itanium in ottawa ;)03:55
fabbionebut given that you have an ipw2100, you can test a kernel for me03:55
fabbionewhen i will have the time to do a test build :)03:55
chmjok, for some reason, every process ends with this : Killed by signal 1.03:56
chmjon this kernel : Linux darklord 2.6.10-5-386 #1 Tue Apr 5 12:12:40 UTC 2005 i686 GNU/Linux03:56
chmjthis is all after dist-upgrade 03:56
fabbionethat's only ssh03:57
fabbionenot every process03:57
fabbioneknown bug that one too03:57
fabbioneoh03:57
fabbioneno03:57
fabbionehmmmm03:57
fabbionei am not sure you can actually use .10 in breezy anymore03:57
chmjoh yes, scp + ssh 03:58
fabbioneare you sure it's all processes?03:58
fabbioneah ok03:58
fabbionetsk03:58
fabbioneas above.. ssh problem03:58
chmjI use .10 on breezy, works better than .12 :( 03:58
chmj.12 just hangs :( 03:59
fabbionechmj: you are part of the kernel-team.. testing/patches/bugfixes are welcome ;)03:59
fabbionechmj: it hangs only on ipw2100...03:59
fabbionethat is yet another piece of external crap that apparently lusers can't live without03:59
fabbionethansk god it's going upstream03:59
fabbioneso it will break less03:59
fabbioneand be more obsoleted faster03:59
fabbionebut at least i have an excuse for not updating it04:00
chmjhmm, problem with tesing/patching is that I have very limited resources 04:00
chmjwill do some triage though 04:01
fabbionechmj: we know what the problem is04:01
fabbioneand if upstream doesn't fix it, i can only workaround it04:01
fabbionebasically the ipw2100 and ipw2200 drivers share a set of common modules04:01
fabbionethe ieee8something04:02
fabbioneand the code is maintained duplicated! in both repos04:02
fabbionewith the last upgrade of the drivers they went out of sync04:02
fabbioneso the ieee code that's from the ipw2200 works for the latter04:02
fabbionebut not for the ipw210004:02
zulmuhahaha04:02
fabbioneif i take the code from the ipw2100 it will break ipw220004:02
fabbioneso there is only one untested solution04:03
chmjoh my 04:03
fabbioneremove this common code04:03
fabbioneand compile it all static into the respective ipw2x00 modules04:03
fabbionein the hope that it works04:03
fabbioneand you will test that kernel for me :)04:03
chmjok :) 04:04
chmjeta ?04:04
fabbionebut it's not very high priority...04:04
fabbioneprobably one or two days04:04
fabbionei have userland work to finish04:04
chmjnoted 04:07
=== svenl_ [~luther@AStrasbourg-251-1-20-215.w82-126.abo.wanadoo.fr] has joined #ubuntu-kernel
chmjhttp://bugzilla.ubuntu.com/show_bug.cgi?id=12417 this just came in 04:35
fabbionetought luck... it's still the same ieee layer causing problems04:44
fabbionei am off for today04:45
fabbionecya tomorrow guys04:46
chmjenjoy 04:51
zularrgh!!!07:43
=== lamont__ [~lamont@15.238.6.251] has joined #ubuntu-kernel
fabbionehey lamont08:12
lamont__howdy08:13
zulmeh...dont know what to do08:19
fabbionezul: are you bored?08:20
fabbionefix some more bugs :)08:20
zulstill debating08:20
zulfabbione: ill fix some tonight08:23
fabbionedon't trash too much :P08:23
zulill try not to :P08:24
fabbioneso lamont__ how is going with the new job?08:33
fabbioneyou almost disappeared.. so i guess it keeps you busy ;)08:34
lamont__a bt08:35
lamont__a bit, even08:35
jbaileyHe's working at a site with a better 'net connection now, he can go back to surfing pr0n.08:35
zulthey are suppose to be getting fiber here at work08:37
lamont__jbailey: feh08:37
lamont__besides - they monitor.08:37
lamont__which is a great waste of time and money, truthfully08:37
lamont__and a significant liability in the making.08:38
fabbione+ nobody really checks the logs..08:38
jbaileyYeah.  I spent ages arguing at my last job that as long as someone was consistantly performing, who cares what they did, and if they weren't, then to deal with them directly and solve the issue without the over application of technology.08:38
lamont__HP lives in fear of RIAA08:40
lamont__hence BT is disallowed, unless you have a business need for a particular IP to be allowed to participate.08:40
lamont__as a client only, of course.08:40
lamont__since everyone knows that the only use for BT is to exchange copyrighted material in violation of copyright08:40
fabbioneBT?08:42
zulbritish telecom? :)08:42
lamont__bittorrent08:43
fabbioneahh08:43
zulooooh..08:43
lamont__I mean, who would use it to release large tarballs/isos of free stuff???08:43
fabbionehttp://dva.gbrit.com/~dougadams/Jokes/index.php?s=3.jpg08:44
fabbioneAHHA08:44
fabbione(the rest of the site is NOT safe)08:44
fabbioneso don't go one dir up :)08:44
=== lamont__ has seen that one before
lamont__iz good08:45
fabbionethe joke or the site?08:45
lamont__fabbione: is that a gtk bug, I wonder???08:45
lamont__joke08:45
fabbioneahah08:45
lamont__will have to see what other jokes are there tonight08:45
fabbionelamont__: mostlikely08:45
fabbionenah the others aren't that funny08:46
lamont__ah, ok.  thanks08:46
fabbionemostlikely naked stuff08:46
lamont__feh08:46
jbaileyYeah, I'll read the BDSM stuff some time when my mother in law isn't wandering around my house. =)08:46
fabbionejbailey: exactly :) my wife is wathing TV.. i need to entertrain myself somehow :)08:47
zulwhy dont you watch tv with her...08:49
fabbionebecause there is a special about bush visiting dk08:49
fabbioneand houneslty i can't care less08:49
zulheh...you said bush08:49
fabbioneamerican people did pay his nice AirForce one travel08:50
jbaileyRight, instead you can read about tying her up and spanking her instead.08:50
fabbioneon a 3 day visit, one was half drunk08:50
jbailey"It's research, dear."08:50
fabbionethe ohter has been playing golf08:50
fabbioneand of 5 things he said on danish tv one was: "... you swallow. LISTEN TO YOUR MOTHER!"08:50
fabbionenow.. i wonder .. what job did this porro mother do?!08:51
fabbiones/porro/poor08:51
fabbionejbailey: ahhaa08:51
fabbionejbailey: i am not reading all of it yet.. but it seems a pretty hounest author08:52
jbaileyCool08:53
=== Seveaz [~seveas@seveas.demon.nl] has joined #ubuntu-kernel

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!