=== Malder [n=Yourmom@netblock-68-183-40-214.dslextreme.com] has joined #ubuntu-server [12:19] should I worry about how I partition my server as far as security is concerned? Most articles I've been reading about security are very brief about this topic... [12:19] a couple considerations [12:19] like if you'll be having people keep user directories, you may consider keeping them on a seperate drive/partition/filesystem [12:19] often times people do /boot and /root as well [12:20] like having a xxGB partion /home ? or are we talking about /usr [12:20] it depends [12:20] what is the box for [12:20] hehe [12:20] i was referring to /home though [12:20] ok [12:21] it serves a couple small website and also a file server for a small office [12:21] so it is not dedicated in either way and really can't be... [12:21] ah... it really wouldn't matter [12:21] although best practices would dictate you cared [12:21] I wouldn't though :) [12:21] is the web server public facing? [12:22] yes [12:22] ehhh [12:22] it's not necessary [12:22] you can though [12:22] It got cracked a couple days ago and I'm starting from scratch with 7.04 [12:22] permissions takes care of the majority of issues [12:22] cracked? how? [12:22] what? [12:22] hgehe [12:23] my best guess is brute force (weak password... I was lazy) [12:23] that'll do it every time [12:23] there were multiple accepted logins from a Bulgarian IP address through ssh [12:23] ;( [12:24] got a few thousand error messages from postfix saying that xyz domain is bad or some such... not from anytthing I did... [12:25] how do you know you were hacked? [12:25] admin password didn't work. Looked at auth.log and it was growing by about 10x each day.... [12:27] so you would advise to just go with basically one big partition and then just lock everything down with file permissions? Don't worry about trying to mess with boot options for security...? [12:27] and obviously strong passwords... [12:29] don't activate your root account [12:29] there is a nifty iptables script I saw to prevent brute forcing of ssh via looking at multiple connections [12:30] I think I am going to go with fail2ban for that... pretty neat little package... [12:30] I didn't have any root account active, but still did no good. Everything was done through sudo [12:31] I didn't turn off root login for ssh, but didn't think that would matter since there was essentially no root user... right? [12:31] do you need to permit password login? [12:31] I just use public key [12:31] I'm not sure. I would like to look into just using keys.. is that what you're thinking? [12:31] yea [12:32] I've turned off all other ways of logging in. [12:32] that and serial cable :-) [12:32] do you have a reference article on that? When are passwords necessary? I've never used keys... [12:32] hehe [12:32] I never uses passwords anymore. I think there is something on help.ubuntu.com/community about that. [12:32] I do have physical access so I can do that too... always nice [12:33] or rather. I use passwords for sudo :-) [12:33] right, but that's after login to SSH with your key, right? [12:33] yes [12:34] Sounds good to me [12:34] ok. Off to partition. Thanks for the help. [12:34] no problem :-) [12:55] sorry about that Malder, had to go AFK [12:56] you may try also installing rkhunter, apf, and bfd [12:56] i've used them before, and they work great for brute force attacks [12:56] http://www.rfxnetworks.com/proj.php [12:57] I hope you meant against :-) [12:57] hehe [12:58] maybe! === defendguin [n=supertux@cpe-72-181-7-135.houston.res.rr.com] has joined #ubuntu-server [12:59] i'm trying to install feisty server and it's telling me it can't mount my cdrom drive [12:59] obviously its able to read the cdrom or it wouldn't have booted [01:00] what kind of controller is the cdrom attached to? [01:00] ide [01:00] mobo? [01:01] yeah right to the motherboard [01:01] nothing very special about the box no odd hardware [01:02] well, if feisty isn't finding the cdrom when you load up the installer, 100% of the time it's because your controller isn't supported through normal channels [01:02] what motherboard? [01:02] i couldn't tell you off hand [01:02] ah [01:03] it was supported when i installed edgy desktop [01:03] a good example of it would be my jmicron controller is hated by 99% of the distros out there [01:04] does server edition support less hardware than desktop? [01:04] no [01:05] besides wireless card [01:06] hmmm i wonder why it had no problem with edgy [01:06] distros change [01:06] but without knowing the specific hardware, there's no way of knowing for sure [01:07] well i can just boot up without the CD and let you know what hal says [01:09] that is why big orgs keep testing hardware around [01:10] what item am i looking at in the device manager [01:10] ? [01:11] says intel brookdale chipset [01:11] if it is wireless, do you need the firemaer [01:12] no wireless on this computer [01:12] defendguin: what's under either RAID controller or IDE/ATA/ATAPI controllers? [01:12] intel 82801BA ide U100 [01:13] that it? [01:13] oem vendor HP [01:14] pci_8086_244b === foo [n=foo@unaffiliated/foo] has joined #ubuntu-server [01:17] i'm just poking through what the hal device manager says is there a specific field you would like to know about? [01:18] no just the device names under ide controller, i'm just a little slammed right now [01:19] maybe i could just do a dist upgrade [01:19] you could [01:19] nah i like fresh installs [01:21] how could the installer even get started if the cdrom isn't supported === mipe [n=05049bb3@gate-so-1.actebis.com] has left #ubuntu-server [] [01:22] i guess i could rip the CD to an iso on this machine and mount the iso and do a net install? [01:26] well [01:26] it will boot because your BIOS takes care of that [01:27] to actually copy files from the cd to your hard drive, it needs a driver to mount it [01:27] not quite the best explanation of it, but like I said, i'm slammed [01:28] i understand === Atlas95 [n=Atlas@84.5.54.145] has joined #ubuntu-server [02:38] hello [02:38] anybody here pleasE? [02:38] i have a big problem [02:38] i follow perfect setup guide [02:39] and i have this error when i try to install some packages: [02:39] E: Le sous-processus /usr/sbin/dpkg-preconfigure --apt || true a renvoy un code d'erreur (100) === ToonArmy [n=chris@88-105-163-143.dynamic.dsl.as9105.com] has joined #ubuntu-server === dj-fu [i=aj@unaffiliated/dj-fu] has joined #ubuntu-server === sahafeez [n=sahafeez@ip68-6-223-156.sd.sd.cox.net] has joined #ubuntu-server [06:15] is the only diff between desktop and server what is installed by default? [07:08] sahafeez: the default kernel is slightly different [07:08] can you install desktop and then apt-get the server kernel [07:12] yes [07:23] i take it that the desktop installs tons of stuff and it is better to just do server and then install a gui if you need it. [07:23] desktop installs a desktop. if its not going to be a desktop, its probably a bad choice of intall [07:23] *install [07:24] i am replacing a w2k3 server at work and have tried sles, rhel. i think i am settling on ubuntu [07:24] i need to have ldap+samba+postfix+cryusimap+postgress+opengroupware [07:24] and everything needs to auth on ldap === dj-fu [i=aj@aj.noc.maxnet.co.nz] has joined #ubuntu-server [07:26] i havent tried setting up those services, so i cant comment. ldap+samba+postfix+postgres are in the repos, not sure about the other two you meantion [07:26] install the server, then install what you need [07:29] ok, thanks. [07:29] then you can absolutely control what is on the server [07:30] desktop will leave you with all kinds of stuff you don't need [07:30] I would also spread out those services across multiple servers [07:31] ldap+samba on one, mail on the other [07:32] it is for 10 people. [07:33] still worth it [07:33] hardware is cheap [07:33] one box with 2gb of ram, 3ware raid5 and core 2 is easier [07:33] then kvm it up [07:33] trying to cut down on the support. [07:34] have another box running slack + asterisk pbx [07:34] ahh [07:34] have openbsd box for vpn/firewall [07:34] I would have a common platform [07:35] and the w2k3 sbs file+exchange. guess which box gives me issues? [07:35] except asterisk is not in main [07:35] going to move the asterisk box to whatever disto i put on the file server. so ubuntu if it works out. [07:35] i will do asterisk from source [07:36] hmm, I distrust source [07:36] security updates are a headache [07:36] naw, asterisk is simple. [07:37] setting it up is a royal pain [07:37] and debugging is a bigger one [07:37] took me forever the 1st time. [07:38] after that it got simple. just had to learn it [07:38] we have a lot of moving pieces, with two offices [07:38] server installs compile tools by default or no? [07:38] no [07:38] server installs enough to run the hardware and login [07:38] that is it. No open ports, no running services, nothing [07:39] 2 offices, one east one west, openbsd vpn. 3 houses with vpn and remote phones. all ip phones. just works [07:39] very openbsd like [07:39] i am a bsd person. i am forced onto linux by hardware/or software that i need. [07:39] ahh [07:42] personally, I like having a common server platform [07:42] having 3 distros like that means 3 times as much security [07:42] settled on opengroupware for the exchange replacement so i need to run it on linux for the most part. it runs on bsd, etc but its a pain to setup and i need the blackberry push stuff [07:43] i would run every thing on solaris if i could or openbsd. those would be my main choices [07:44] i would do gentoo for linux however i need something a bit simpler because others may have to touch it. i started looking at SLES and RHEL because of that. [07:44] RHEL sucks === volvoguy [n=volvoguy@c-68-60-52-220.hsd1.mi.comcast.net] has joined #ubuntu-server [07:44] can i ask you guys a support question or is this just a dev channel? [07:45] and SLES is very very good cept the updated make the system unbootable as the hardware is too new and i do not feel like figuring it out [07:45] volvoguy: both [07:45] woohoo! [07:45] I have heard good things about SLES [07:45] very clean and polished. comes out of the box with samba+ldap setup correct. YAST is a great tool. [07:46] i'd like to upgrade my breezy server to at least edgy, if not feisty. the support pages recommend not using apt-get for this, but i don't exactly have "update-manager" which they DO recommed. is there a safe way to use non-gui tool? [07:46] some of the integration stuff is better in SLES/RHEL [07:46] volvoguy: release cycle was breezy --> dapper --> edgy [07:47] I would keep servers on dapper, as it is supported longer [07:47] sadly, there is no tool yet [07:47] oh, i'm sorry. i meant I'm on dapper, not breezy. [07:47] ahh [07:47] if you update past dapper, you will have to update a lot [07:47] just to be aware [07:47] that's what i want to avoid though - having to upgrade through many releases. [07:48] then you should stay on dapper until the next LTS [07:48] in april 2008 [07:48] I am a very conservative person when it comes to my servers, however [07:48] and not bother with performance/feature updates until then? [07:49] less headaches > a bit of performance [07:49] Burgundavia, yeah - i can understand that. this is a simple file server and part-time web-dev server. it doesn't do much. [07:49] backup your data and do the edgy update manually [07:50] then use the edgy --> feisty update [07:50] Burgundavia, so you'll do a clean install for every LTS release? [07:50] i would love to see zfs ported to linux. that would be the best of all worlds, well zfs and pf [07:50] no, LTS --> LTS supported [07:50] right. [07:50] thus 6.06 will update to 8.04 [07:50] and will do so with less complication? [07:51] or you can do 6.06 --> 6.10 --> 7.04 --> 7.10 [07:51] (assuming that 8.04 is LTS, and that significant work is put in to support upgrades) [07:51] ajmitch: the latter is assumed. Canonical has large paying customers that will demand it [07:51] and what better way to test an update tool than on the community, no? [07:52] what I mean is that many packages will need to be checked & modified for upgrades [07:52] ajmitch, that was my concern. it seemed to me that smaller updates made more sense, but if canonical is going to try to make a smooth upgrade path to 8.04 - i'll wait for that. [07:52] little things like directories moving around, symlinks, handling corner cases in maintainer scripts [07:52] it'll take a bit of work, but I'd say that it's expected [07:52] ok. cool. :) [07:53] the cool stuff is on the desktop anyway [07:53] the next LTS release would probably end up with less cool new stuff, and more time spent polishing [07:53] yeah. feisty looks great. [07:53] Burgundavia: pfft, server is getting cool stuff :) [07:53] the fact that i can buy support is the reason i am looking at ubuntu [07:53] so I keep my laptop running the absolutely latest and my servers and work desktops running the LTS [07:55] my "production" server is a virtual ubuntu server at unixshell. hopefully their xen system will be upgradable to 8.04 easily too. :) [07:56] they're probably one of those paying customers though - so they'll be one demanding it. hehe. [07:57] well, thanks for the quick updates guys. i'm not involved and online anymore as much as i'd like to be, but i know i can always turn to you for help! talk to you later. [07:57] cya [08:13] what is with the delay in the partitioning when doing anything - switching between stuff, lvm, etc. [08:13] on the installer? [08:13] yes [08:13] no idea [08:13] it could tell you something you know. [08:13] sahafeez: known issue [08:14] it was in the release notes.. there is a bug linked from there [08:14] it's only annoying but it doesn't affect final installation or functionality [08:14] no, but it makes the install take, oh, 2 hours longer ;) [08:15] i know.. it adds 3 minutes wait on each lv you create [08:15] there is really nothing we could do to fix it when i first found out of the problem [08:15] it was too late in the release process :( [08:15] oh well. just happy it is not just me [08:15] it's a good excuse for a cup of coffee === sahafeez thinks i should read this release note things [08:16] the bug is generic.. === sahafeez has a beer [08:16] that'd work too :) [08:16] this is my 1st install of ubuntu. i was having debian flash backs. === sahafeez hates debian [08:18] still waiting .... [08:19] sahafeez: as i said... 3 minutes for each lv you created === fabbione goes back to bed [08:20] well i am on 6 mins now and all i am trying to do is active an existing lvm setup [08:20] sahafeez: read the bug or you will keep waiting and asking herre [08:20] here even [08:20] yes, i am reading now.. === fabbione & [08:21] since i have the time and all. [08:22] between this and the broken ide on my sparc copying files.... [08:22] :) === foxiness [n=nayif@unaffiliated/foxiness] has joined #ubuntu-server [08:24] i am kinda wondering why your servers got so hammered, being large network scaling guy [08:27] lots and lots of people [08:27] we did better than suse and fedora last releas [08:27] they went off the air [08:27] yah, but it is so simple to fix [08:27] sahafeez: well, it depends, if you can answer me why suddenly there were thousands of CLOSE_WAITs on my mirrors, filling up all the apache slots? [08:28] with 0 bytes in send-q too [08:28] nice. [08:28] how many servers [08:28] for my mirror? 6 === sahafeez is still trying to find a server that will let me look at the release notes [08:28] (i'm se.releases.ubuntu.com) [08:29] how does your SLB work? [08:29] maswan: you guys are the big ones, no? [08:29] what's slb? :) [08:29] ah, server load balancers [08:29] Burgundavia: we peaked at 3.8Gbit/s, so yeah. [08:30] ah, large requests (.isos etc) get http-redirected to one of the frontends depending on hash (so that one iso always ends up on the same backend, to keep cache locality) [08:30] was it a load issue or an apache bug issue. 3.8 is not alot [08:30] sahafeez: don't know, afaik they blame eachother [08:31] or go "huh?" when reported [08:31] what box is doing that? a linux box or switch hardware [08:31] the frontend[s] that's in dns, they have to handle the small files (deb:s etc that can't be http-redirected), and also ftp&rsync [08:32] individual isos that have more demand than one frontend can satisfy, we manually identify and spread out on more frontends [08:32] it actually works really well, except when we get that CLOSE_WAIT issue [08:33] was the traffic balanced over the servers - after action - looking that the mrtg or whatever you use [08:33] http://www.acc.umu.se/technical/statistics/ftp/monitordata/index.html.en [08:33] rrdtool [08:34] so, not very well balanced, but then the servers are not equal either [08:34] well enough balanced after 21:00 local time yesterday though [08:34] question, and this is because i am not a linux guy, using ext3 on a lvm for a postgress db. any mount options i should look at [08:34] ok. it would be interesting to see the network drawing. [08:35] i love this kind of stuff. [08:35] setup a network that took a 10gb/s DoS once and kept working [08:35] well, remember, this is just my mirror at the academic computer club at umea university [08:36] we're depending on what hardware gets donated to us, and whatever bandwidth the university feel like giving us [08:36] ok. [08:36] the canoncial setup (main servers) is not public, AFAIK [08:36] no big. i am a nut about network design. [08:37] so in short, out of those machines orion,vega,napoleon are on a separate 2Gbit/s network [borrowed machines from the hpc center at the uni] , the rest share a 2Gbit/s uplink too. [08:38] then it ends up roughly like this: http://www.umdac.umu.se/netmaster/net/Campusnetpresentationumu.jpg [08:38] and then: http://stats.sunet.se/stat-q/load-map/optosunet-kunder,,traffic,peak [08:39] and sorry, can't think of anything for your mount options question [08:39] no prob [08:40] interesting. it looks abit over complex for my taste...the network [08:40] the campus one or the optosunet? [08:42] the 2nd one. [08:42] the campus - those are routed or layer2 links [08:42] between the cisco switches [08:43] sahafeez: remmeber that on the second one, all those names are different universities accross sweden that requires redundant paths [08:44] the campus one shows the routers on campus, not all the dumb switches [08:44] based on as the cable runs and build out time no doubt vs what would be logical [08:45] ok, so you are using the 65xx as swtich/routers to distribute [08:45] 6509 is a switch cisco just added a router card as an after thought [08:45] yeah, that's my understanding of it. the next-gen campus network is in next year or so === loVolt [n=rick@s216-232-87-188.bc.hsia.telus.net] has joined #ubuntu-server [08:46] well, there aren't very big routing decisions that needs to be made within campus [08:46] whatever you do do not fill them with gige ports and run them flat out. it will crash ;) [08:46] :) [08:46] mind if I pose a fiesty/samba question ? [08:46] as i am trying to setup samba myself sure [08:46] loVolt: go ahead, don't be surprised if noone is around to answer [08:46] thx , I give it a try [08:47] walking though any number of howto's [08:47] sahafeez: actually, the optosunet one is based on the returns of a single tender for dark fiber across sweden [08:47] I can get everything cept' getent passwd/group to work [08:47] like nssswitch is ignored [08:48] like bank in 2000/2001 [08:48] er bank/back [08:48] wbinfo and others work fine [08:48] sahafeez: and the weirdness comes from requiring a "red" and a "green" network connection to all sites, and there not being enough fiber in the ground to make the most logical extension to all sites [08:48] is there a ubuntu-samba chan? [08:49] loVolt: 'winbind enum users = true' in smb.conf [08:49] that allows enumeration of users with getent [08:49] it should be able to resolve normally anyway [08:49] sahafeez: http://basun.sunet.se/karta/opto2.gif a bit more geographical [08:49] yes [08:49] ah, makes sense. [08:50] maswan thanks for sharing the info. i love looking at this stuff [08:50] getent only show local pass/groups [08:51] shot in the dark [08:51] sahafeez: btw, sthml is clickable on the optosunet map and you can get to nordunet that way too [08:51] and you restarted winbind after changing that option? [08:51] I ran cvs and samba4 last night on fiesty ...semms to go well [08:51] looking.. [08:51] ajmitch, rebooted even [08:52] loVolt: sorry, it's 'winbind enum users = yes' [08:52] and the corresponding one for groups [08:52] ajmitch, yeah users and groups [08:52] getting users/groups off an AD server? [08:52] yeah [08:52] security=ads, and realm is set? [08:53] yeup [08:53] sahafeez: everything goes into the a[123] sth routers, using virtual routers in those junipers, AIUI [08:53] wbinfo -u returns the right info? [08:53] yes [08:53] wbinfo -g as well [08:53] junipers are the best routers right now so that is good. [08:54] loVolt: you could increase the debug output on winbindd [08:54] checking [08:54] in /etc/default/winbind === ajmitch recently had issues with this, and it just took the smb.conf options for getent to work properly [08:56] log level = 3 in defaults/winbind do ? [08:56] what is the deal with using a custom kernel on ubuntu. no issues? [08:57] sahafeez, haven't found any issues [08:57] lots of apt-getting :) [08:57] ok, cool. [08:57] i want to mount an mac hfs drive ;) [08:58] don't forget autoconf if you want other pcakacges [08:58] loVolt: no, I'd put "-d 3 -n" in WINBINDD_OPTS [08:58] k [08:58] heh screaming about invalid option :) [08:58] fixing === sahafeez is new to ubuntu and is trying to get my head around it. used to gentoo for linux [09:00] I've got two boxes , one fiesty dns only no devl tools and 2nd is fiesty dns with devl / samba4 [09:00] darned is samba4 didn't "just work" === loVolt shivvered [09:01] k' started again , lets tail the chaos [09:03] cool idmap went boom [09:03] fatal error uid range full [09:03] wonderful [09:04] max 200000 [09:04] lets up that a bit [09:05] enum users/groups may not be a good thing if you have that many :) [09:05] I don't [09:05] about 150 not inc a/d spare parts [09:05] doubled it and rebooting [09:06] load average: 5.64, 5.71, 5.64 [09:06] different box [09:06] :) [09:08] wierdness [09:09] still says full , could not lookup domain user luser [09:10] wonder if I lower the level [09:12] trying 2000-10000 [09:15] same [09:15] I need coffee to live === sahafeez [n=sahafeez@ip68-6-223-156.sd.sd.cox.net] has joined #ubuntu-server [09:39] silly question. how do i see what to install when i do not know the package name. i want to install sshd [09:41] sahafeez: for ssh the package name is openssh-server [09:41] in general, you use apt-cache search for package search [09:41] ok. i need to read about apt as it is new to me. [09:41] thanks [09:52] gnite === DisabledDuck [n=duck@c-24-129-213-76.hsd1.fl.comcast.net] has joined #Ubuntu-Server === ivoks [n=ivoks@4-39.dsl.iskon.hr] has joined #ubuntu-server === dj-fu [i=aj@home.junglist.gen.nz] has joined #ubuntu-server === jsgotangco [n=jsg123@ubuntu/member/jsgotangco] has joined #ubuntu-server === ivoks [n=ivoks@37-230.dsl.iskon.hr] has joined #ubuntu-server [12:11] hi, am on step of create " Virtual Server Scenario " url: https://help.ubuntu.com/community/RubyOnRails? , on this line sudo nano /etc/apache2/sites-available/ , = ??? its not clear to me if i need to or domin.net or domaindotnet [12:17] it is irrelevant [12:17] you can put there 000-mambo-jambo [12:18] content of that file is important [12:26] k,now it clear thanks i need now to figure out ,next step port 80 [12:27] heh [12:27] first time configuring apache? [12:28] :) yes [12:28] grab a book or something :D [12:28] host@home [12:29] book? or something? , like what ? [12:29] howtos, tutorials, etc.. [12:29] i have two apache books, both are over 300 pages :) [12:30] and these are small apache books [12:30] bbl; bye === ||arifaX [n=||arifaX@pd9e78468.dip0.t-ipconnect.de] has joined #ubuntu-server === ra1nb0w [n=davide@213-156-55-129.fastres.net] has joined #ubuntu-server === ||arifaX_ [n=||arifaX@pD9E78468.dip0.t-ipconnect.de] has joined #ubuntu-server === ra1nb0w [n=davide@213-156-55-129.fastres.net] has joined #ubuntu-server === vciaglia [n=vciaglia@host53-17-dynamic.11-87-r.retail.telecomitalia.it] has joined #ubuntu-server === ivoks [n=ivoks@4-147.dsl.iskon.hr] has joined #ubuntu-server === ToonArmy [n=chris@88-105-163-143.dynamic.dsl.as9105.com] has joined #ubuntu-server === jsgotangco [n=jsg123@ubuntu/member/jsgotangco] has joined #ubuntu-server === soothsay [n=soothsay@bas5-montreal02-1096554204.dsl.bell.ca] has joined #ubuntu-server === sahafeez [n=sahafeez@ip68-6-223-156.sd.sd.cox.net] has joined #ubuntu-server [09:03] Hm, what's your mta of preference? exim? postfix? hopefully not sendmail. [09:04] postficx [09:04] postfix [09:04] telnet mail 25 [09:04] ;) [09:05] Nafallo: What's your reasoning? Have you used exim? Someone recently told me to check out ensim, I'm a postfix fan too [09:07]