[00:00] kgoetz: you are right .. [00:03] kgoetz: any luck with ldap? [00:04] lamont: fraid not, i've been busy with other work. i managed to get ldapsearch going ok ( http://pastebin.ca/801040 ) and from my reding of that i can connect to ldap [00:05] kgoetz: are you doing ldaps or ldap in the end? [00:06] lamont: /etc/ldap.conf -> uri ldap://127.0.0.1/ . ldapi "wasnt working " as i recall [00:07] you want some spamage here, or pastebin, or where? [00:07] pastebin woul be fine. [00:08] avoid turning the channel against us ;) [00:08] step 1 is to get ldap://127.0.0.1/ working. Then we can worry about making a cert and getting ldaps happy [00:08] i have ldaps enabled, dont remember if i mad a cert for it or not [00:08] i just didnt see a reason to ldaps: onto localhost [00:09] in /etc/default/slapd i put SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///" [00:11] http://pastebin.ca/801110 [00:12] in there, s/foobaz/whatever/ [00:12] and comment out the TLS_CACERT [00:12] looking atm :) [00:12] TLS_REQCERT should be uh... something [00:12] 'never' [00:13] and rootbinddn should be god-of-ldap (whatever you said when you configured slapd) [00:14] _THEN_ ldapsearch -x -h localhost -D cn=admin,dc=foobaz,dc=com -W "(uid=kgoetz)" uid [00:14] that'll prompt you for the passphrase, which should be what's stored in /etc/ldap.secret [00:15] and if _that_ query works, then all we have to do is argue with nsswitch.conf [00:15] *starts looking for all those files/lines in files [00:16] kgoetz: I just finished smacking my config into usability again for gutsy [00:16] in the process, I fear I actually understand pam now. [00:16] don't tell anyone [00:16] :-) [00:16] hehehe. i got famiar with pam_radius and a few related bits... i wish i still rememberd :) [00:20] any ideas what might be the problem with hotplug if "cat /proc/kernel/sys/hotplug" -> cat: /proc/kernel/sys/hotplug: No such file or directory (2.6.22-14-xen) [00:20] ? [00:20] your file or directory isnt there? [00:21] but it shoul, shouldn't it? [00:21] lamont: teh TLS_REQCERT -i dont see that in my config. can i just add it? [00:21] s/teh/the [00:21] find /proc | grep plug [00:21] /proc/sys/kernel/hotplug [00:22] uh oh o.O [00:22] kgoetz: I expect so. That's almost exactly what the file looks like on my machine... worst case it just mutters about lines it doesn't understand [00:23] # here because "lamont said" [00:23] TLS_REQCERT demand [00:24] you want TLS_REQCERT never [00:24] for now [00:24] ok. [00:24] because we're not doing ldaps yet. just ldap. [00:25] ok [00:27] shouldi comment out the extra lines that you dont have? [00:29] oooh. it worked :o [00:30] ls: /etc/libnss-ldap*: No such file or directory [00:30] but the query workd :) [00:34] libnss-ldap* will need to be there when we say 'getent shadow |grep kgoetz' [00:34] which we want to see two lines from, hence the fetcheverythingandgrep solution [00:34] apt-get install libnss-ldap [00:35] and may as well install libpam-ldap too [00:35] both are already installed [00:35] and finger-ldap :-) [00:35] ah, on gutsy? [00:35] yes. [00:36] the symlinks may or may not be needed... I'm to lazy to figure it out - they're certainly needed on dapper. :-) [00:36] and I have dapper machines, too. [00:36] sudo /etc/init.d/nscd restart [00:36] they dont seem to be needed anmore ;) [00:36] *any more :) [00:36] actually, do a stop and then a start - restart doesn't always give me the love I want [00:37] and the uri in /etc/ldap.conf is ldap://127.0.0.1/, not the ldaps://ldap.foobaz.com/, right? [00:37] /query lamont and paste /etc/ldap.conf :-) [00:38] i dont have an nscd [00:39] * kgoetz cuts out comments from config file [00:40] no nscd just means that you'll query the ldap server alot. OTOH, it also means that nscd won't be stepping in the middle and LYING to you [00:43] pm flooded [01:18] did anyone ever tried `rsync` over WebDAV? does it works?? [02:16] Nov 28 16:05:21 mmjgroup postfix/local[15044]: warning: pipe_command_read: read time limit exceeded [02:16] * lamont grumbles [02:39] hi. where would i find a list (or an RSS feed) of packages that are updated in universe/multiverse? [02:39] i have a server running edgy and perdition was updated for security fixes but i couldn't find that announced anywhere [02:47] danp: ubuntu.nl has feeds [02:48] danp: https://lists.ubuntu.com/archives/ubuntu-devel/2005-August/009392.html [02:49] thanks, seems to be gone now though [02:50] they are there still [02:50] just moved [02:50] just trying to find them [02:52] danp: http://blogs.ubuntu-nl.org/dennis/2007/10/21/hardy-heron-changes-feed/ [03:07] thanks! [03:56] Burgundavia: hmm, this still only seems to be changes to main. perdition is in universe [04:00] danp: there have been no changes to edgy since release, as only main is security supported [04:00] any (easy) way to increase teh logging prouced by pam? i'm unable to get multiple logins over ssh using ldap backend (i also have issues with sudo) [04:01] danp: https://lists.ubuntu.com/archives/edgy-changes/2007-November/thread.html [04:01] danp: and why are you still running an edgy server? [04:01] it is not supported for all that much longer (6months) [04:02] that's still only main changes...perdition is in universe and was recently updated [04:02] http://changelogs.ubuntu.com/changelogs/pool/universe/p/perdition/perdition_1.17-7ubuntu0.6.10.1/changelog [04:03] hmm, wonder why they are not showing up [04:03] and i'm still running edgy because it's supported for another 6 months :P [04:04] at which point you need to upgrade to Feisty, for another 6 months [04:04] and then to Gutsy and then to Hardy [04:08] Burgundavia: There have been edgy-security uploads for Universe packages. I've done a couple myself. [04:09] ScottK: yes, but not many [04:09] not that I would trust a production server to [04:09] i'm on ubuntu-security and i never got a notice for perdition [04:09] Well you take that risk pretty much whenever you run Universe stuff. [04:09] because -security doesn't carry universe stuff [04:09] this is a fairly serious issue, the lack of notification [04:09] danp: Even when Universe packages get updated, they won't do a USN. [04:10] it should at a minimum, go to -changes [04:10] Agreed. [04:10] is there at least a published list of the changes? [04:10] let me put it on the tech board agenda [04:10] danp: there is the mailing list. I have no idea why this upload did no make it there [04:10] LP developers dropped security from -changes because the fact that it was there before was a 'bug' and not by design. [04:10] ugh, that is dump [04:10] dumb, rather [04:10] They've been thrashed and promise to put it back Real Soon Now. [04:11] Well it's LP. That's redundant [04:11] I am very strongly of the opinion that LP is mostly just a giant non-free rathole [04:11] this is just an example, but in a more general sense i'm looking for a way to get notified/informed of *any* changes to whatever release i'm using [04:12] this is one of those holes [04:12] Burgundavia: Agreed. [04:12] is my best bet right now to track the package list files? [04:12] When I asked, "If it's a bug, where's the spec that describes how it's supposed to work?" [04:12] Answer I got was, "will you help us write one" [04:13] danp: -changes should have everything. This is a bug [04:13] https://wiki.ubuntu.com/TechnicalBoardAgenda [04:13] added both items to the next TB meeting [04:14] https://wiki.ubuntu.com/UbuntuDevelopment/PackageArchive/SoyuzUserDocumentationDraft is what now exists for documentation. it's a bit, um, thin. [04:14] thanks! [04:15] My larger answer on the help write the spec issue is that I have a consulting rate for proprietary system development work. [04:15] Which is where the non-free bit kicks in. [04:15] so at the moment what is going to -changes? [04:15] For Edgy, you would get edgy-updates. [04:16] Backports too, I think. [04:20] cool [04:27] Burgundavia: bzgrep ^Package: ubuntu/dists/gutsy-security/universe/binary-i386/Packages.bz2 |wc -l [04:27] 55 [04:28] universe gets security updates, it's just not something that canonical funds doing, other than best-effort by keescook et al. [04:29] The larger point that Burgundavia makes is valid though. There's no announcement mechanism. [04:29] lamont: yep, I get that. This is more about making certain what updates do get done get notifications created [04:29] "notification" == advisory? [04:29] not necessarily [04:30] I've don't -security updates for packages that were in Universe in some releases and in Main in others and the USN just talked about the Main ones (leaving one to reasonably infer the other releases weren't affected when they were( [04:30] (/) [04:30] Burgundavia: and launchpad has nothing to do with -security packages getting built. [04:30] i personally just want a way to be notified of every possible change to a release [04:30] lamont: I didn't say it did [04:30] I was talking about mailing lists [04:30] hopefully not as low-level as reviewing changes to the Packages files myself [04:31] most of the stuff that builds in -security is built while it's embargoed. hence no notice to -changes. the embargo is also the root cause of LP not being involved. [04:31] but that is a bug that can be fixed [04:31] since launchpadlibrarian has no concept of read restrictions [04:31] Burgundavia: fixed how? [04:31] I can't send you a notification when i build it. [04:31] lamont: by sending the notification only when it is unembargoed [04:32] lamont: At some point LP learns of the change. Then. [04:32] I _can_ send you a notification when its unembargoed. I've only seen that notification in the form of a security advisory. [04:32] for _any_ software distro [04:32] LP learns of the change once it's unembargoed [04:32] I think. [04:33] it must be importing -secuity back from the dak archive [04:33] right, I am not arguing implementation at the moment [04:33] so at the point that LP imports the -security bits from dak, it could generate a -changes mail [04:33] * lamont is speculating on that bit of process. [04:34] right, those are details I don't know, nor do I really specifically care, given I am not an LP dev [04:38] The key bit is that it used to be there and was removed. What man has once accomplished he can aspire to achieve again. [04:40] wow, it's cold in here and i've just put a nice heat-blower straight on my feet! [04:40] * lousygarua is delighted [04:40] i just found my ldap is far more broken then i thought [04:40] * kgoetz is upset [04:41] how can an ldap get broken? [04:41] Burgundavia and ScottK, thanks for the tips. i look forward to -changes being my answer soon :) [04:42] my lookups arnt working properly somehow. I have no name!@newmoon:/root$ [04:42] danp: no worries. Sorry we cannot help you in the imm. [04:43] it's cool. i can make do with looking at Packages in the mean time. but i'm sure other people would appreciate that information if it was readily available [04:44] lamont: you aroud? i cant seem to figure out some issues [04:44] heh [04:44] :( [04:44] fire away [04:45] * lamont waits for "how do we find the girl? If we do find the girl, how do we get away?" [04:46] i can run 'id $USERNAME' and it lists out the users IDs, but bash/anything else cant map the IDs [04:46] i can ssh in as the user, but it seems only once at a time [04:46] make life easier: apt-get install nscd [04:47] which, amusingly, shouldn't change anything [04:47] intalling now [04:48] reasonably small config file [04:48] it has a config file? [04:48] :-) [04:49] yes... dont i need it? :\ [04:49] I expect so. [04:49] I never even noticed [04:49] as in, it won't need any edits [04:49] ok [04:49] how is bash trying to map the id? [04:50] (as in, what do you mean that it can't? what's your testcase?) [04:51] installing that makes a difference o [04:51] s/ o// [04:51] lamont: i typed in 'bash' [04:51] and got "I have no name!@newmoon:/root$" back [04:51] is /etc/ldap.conf readable by mortals? [04:51] now i get "kim@newmoon:/etc/pam.d$ [04:51] " [04:52] /etc/nsswitch.conf? [04:52] (/etc/ldap.secret should be root:root, 600 [04:52] yes they are. [04:52] the others, should be 644 [04:52] yep [04:52] so installing nscd fixed it? [04:53] yes [04:53] if you figure out why, I'd love to know [04:53] you are a genius :) [04:53] thanks [04:54] I should really put the whole mess into a howto on the wiki sometime [04:56] i was goign to work on one/two as well. getting it working became a higher priority then writing about it though ;) [04:56] I wonder if it's because nscd runs as root [04:56] * lamont automated ssh key replication to clients from ldap [04:57] * lamont is lazy [04:58] .... your writing the guide :P [05:05] heh [05:12] hm. root@newmoon:~# ldapaddgroup kgoetz 1179 [05:12] grep: /etc/pam_ldap.conf: No such file or directory [05:12] is pam_ldap.conf still in use? iirc i read its been retired [05:13] if it's being used, it should be a symlink to /etc/ldap.conf [05:13] _I_ have it. :0)( [05:15] reading /usr/share/doc/libpam-ldap/README.Debian is interesting [05:16] yeah. that and the manpage for pam.conf were very eye opening on monday night [05:17] stupid pam [05:18] heh. pam is love, man. [05:19] polletheme pam :\ [05:19] win 32 [07:08] is there a metapackage for the lamp server that you install from the server cd [08:11] moin [08:22] <_ruben> mornin [08:37] zero-9376: No, but if you had bothered to stick around for more than 27 seconds, someone might have told you what to do.. [08:46] <_ruben> ;) [08:47] <_ruben> well .. 6 minutes a bit longer than 27 secs .. but still :-) [09:18] soren: I see him being in channel for 5 minutes at least [09:20] Burgundavia: Potato, potato. [09:20] Doesn't really work in writing, does it? [09:20] Burgundavia: 5 minutes is still an annoyingly short time to stick around for when you've asked a question. [11:50] ive just installed ubuntu-server 7.10 on a laptop but its wireless pcmcia card is being recognised (i think, it shows up in iwconfig at eth2) but returns errors when trying to connect to the network (this card was working before in xubuntu 7.04) === Pumpernickle is now known as Pumpernickel [13:22] joycetick: why do you install ubuntu-server on a laptop? [13:23] its a 800Mhz machine so i wanted to install fluxbox or similar on it [13:24] joycetick: what about Xubuntu? [13:24] and my isp mirrored the iso so it was easier to get than fluxbuntu (which i just found through google) [13:25] i was using that before i installed ubuntu-server, might have to go back to it [14:11] any xen expert around ? [14:19] !ask [14:19] Don't ask to ask a question. Just ask your question :) [14:19] i'm not an expert [14:20] or try #ubuntu-xen ;) [15:36] libc6 is what is commonly known as glib isn't it? [15:36] *glibc [15:57] how can you force ubuntu to write directly onto usb stick, without caching? [15:57] is this a mount option? [16:24] spiekey: I don't remember if "flush" works? [16:24] spiekey: mount -o flush -t vfat /dev/whatever /media/whereever [16:24] spiekey: Otherwise, "-o sync" is what you're looking for. [16:25] spiekey: It'll kill your usb stick, though. [16:25] spiekey: They're only built to handle a certain amount of writes to them. If you mount it with sync, and you have a particularly stupid application write to it, just writing a single file to it can cause it to be written to several thousand times. === dendrobates is now known as dendro-away [17:14] hi all [17:15] I have a cron job in /etc/cron.hourly that fails when cron executes it ("Exec Bad Format" or similar message). If I execute it manually, it runs fine. Any ideas? [17:15] script is at http://pastebin.com/d13dc62ab [17:25] darrend: that looks right . . . the bad format is from syslog? [17:31] mralphabet: the message was being added to the email that cron was sending (which was ending up in ~/dead.letter but is now being accepted by the remote mail server and ending up in a black hole [17:31] let me try to disable the mail output so I see the messages again. [17:31] keescook: are you the apparmor guy? [17:32] Nov 29 10:01:22 mix kernel: [739593.226765] audit(1196355682.459:35): type=1503 operation="inode_permission" requested_mask="r" denied_mask="r" name="/etc/ldap/ldap.conf" pid=16512 profile="/usr/sbin/cupsd" [17:32] how do I tell it that it's OK? [17:32] lamont: well, mathiaz and I both work on it [17:32] why is cups trying to read ldap.conf? but anyway, sudo vi /etc/apparmor.d/*cups [17:32] add: /etc/ldap/ldap.conf r, [17:33] then sudo /etc/init.d/apparmor reload [17:33] and then restart cups [17:33] nope [17:33] well, I did the first two steps... [17:33] the aa reload will just update the running process's confinement [17:34] you can do sudo aa-status to see what aa thinks of the world [17:34] if you did apparmor stop/start you're SOL, and you need to restart cups [17:34] aalib is part of apparmor? :-) [17:34] that would rule [17:34] "I'm pwning you in ASCII!" [17:35] I might have done /etc/init.d/apparmor restart [17:35] mind you, I'd rather see us make selinux happier [17:35] restart == reload so that's okay [17:35] lamont: sure, we're just waiting on some upstream patches to roll out for that [17:36] lamont: where does aa-status report cupsd? [17:36] 2 profiles are in enforce mode. [17:36] /usr/sbin/cupsd [17:36] /usr/lib/cups/backend/cups-pdf [17:36] 1 processes are in enforce mode : [17:36] /usr/sbin/cupsd (18409) [17:36] mralphabet: error message is.. "run-parts: failed to exec /etc/cron.hourly/00backup: Exec format error" [17:37] (also, you added the ldap.conf to the cupds section not the cups-pdf section of /etc/apparmor.d/*cupsd ? [17:37] Nov 29 10:36:12 mix kernel: [741679.573259] audit(1196357772.436:39): type=1503 operation="inode_permission" requested_mask="r" denied_mask="r" name="/etc/ldap/ldap.conf" pid=18573 profile="/usr/sbin/cupsd" [17:37] no. [17:37] abstractions/cups-client [17:37] * lamont does the right file [17:38] ah, yeah, the cups-client is for stuff trying to talk to the cups server, etc. [17:39] mralphabet: I think google may know the answer.. looks like I need /bin/sh and not /bin/bash [17:39] yeah! helps to fix the right file. [17:39] thansk [17:40] darrend: heh [17:40] hmm.. no - still fails [17:41] brb [17:43] ;( [17:45] would it be better if i used iptables to forward GRE and port 1723 to access a RRAS VPN (PPTP) server, or just setup the VPN stuff on my ubuntu server and use LDAP for authenticating...what would be the best package with ldap support for doing this? [17:51] * nealmcb congratulates jdstrand on Ubuntu Membership :-) [17:52] thanks again nealmcb! :) === gamble6x is now known as gamble|mission [18:28] i have a question [18:29] anyone there? [18:30] !ask [18:30] Don't ask to ask a question. Just ask your question :) [18:30] well here's my question "everytime I use apt-get install on my ubuntu servers they want me to put in the DVD, how can I get it to instead of taking the packages from the DVD to take them fromt the reprostories [18:34] I have SSH acess to both of them [18:34] how may have it source.list to get it from dvd i think [18:35] nano /etc/apt/sources.list [18:35] take out the cdrom entries [18:35] k thanks [18:35] I feel a bit of a newb asking this question [18:36] this is just my first time running ubuntu without gnome [18:38] i am working on getting both of them ready to go into my basement, and part of that is not having to run down and put a DVD in everytime I need to install something === gamble|mission is now known as gamble6x === macd_ is now known as macd [22:43] lamont: I think Bug #172925 is worth you having a look at. [22:43] Launchpad bug 172925 in postfix "postfix upgrade does not add 'retry' service" [Medium,Confirmed] https://launchpad.net/bugs/172925 [22:58] gah. [22:58] will do