| kgoetz | hi all. has anyone here tried no-TLS postfix under gutsy? | 03:34 |
|---|---|---|
| kgoetz | we've disabled it in the configuration, but its still been requested somehow | 03:35 |
| pschulz01 | kgoetz: That's a very good question. | 03:37 |
| pschulz01 | kgoetz: We are having the same problem here. | 03:37 |
| kgoetz | guess i'll have to wait then ;) | 03:37 |
| kgoetz | pschulz01: its smtpd_tls_security_level = encrypt | 03:57 |
| kgoetz | just comment it out :P | 03:57 |
| Caplain | hey i have 4 ethernet adapters in my box which is acting as a bridge, 1 is wireless and connects to the router for the internet, i can ping it from the box, i can ping my bridge from my client but i cant ping the router from my client | 04:34 |
| CyberMad | i would like to install virtual machine at ubuntu-server, but i confuse to choose between VMware-server or VirtualBox, which one do you recommend ? | 05:11 |
| kraut | moin | 07:41 |
| === fernando_ is now known as fernando | ||
| === dendro-away is now known as dendrobates | ||
| J-_ | Is there anyway to install an encrypted server? If so, will that prevent it from getting hacked, or have better preventative measures against getting hacked? I'm running a LAMP server, and I think I got hacked becuuse it's not working proper. And looking at exim, 2 IP's have been download content, I don't think when viewing a website that a regular user would pull 8+mb of data. | 13:16 |
| ivoks | ? | 13:17 |
| ivoks | what is encrypted server? | 13:17 |
| ivoks | you can encrypt filesystem, you can provide cypted service | 13:17 |
| ivoks | but crypted server? | 13:17 |
| J-_ | WELL, obviously you know A BIT more than me, so rather than flame. SUGGEST something that I would have ment. | 13:18 |
| J-_ | or could | 13:18 |
| J-_ | whatever | 13:18 |
| J-_ | SO YES, encrypted filesystem is what I ment. | 13:20 |
| J-_ | I guess that was your effort. FLAME someone, then don't suggest anything. | 13:21 |
| * J-_ chuckles | 13:22 | |
| ivoks | ? | 13:22 |
| ivoks | J-_: where did i flame? i asked | 13:22 |
| ivoks | and encrypted filesystem is an option during install | 13:23 |
| ScottK | J-_: It's probably not the most productive thing to whine at the people that are trying to help you. | 13:23 |
| * ScottK was too late. missed it by that much. | 13:23 | |
| ivoks | and encrypted filesystem won't save you from net attacks | 13:24 |
| ivoks | and i'm not sure how exim could provide logs about LAMP :) | 13:24 |
| ivoks | oh, he left :) | 13:26 |
| ivoks | didn't notice that :D | 13:26 |
| _ruben | heh | 13:28 |
| _ruben | minor detail | 13:28 |
| heno | has anyone tested the latest server images on real metal (or vmware even). It still doesn't boot in virtual box | 13:28 |
| heno | installs fine though | 13:28 |
| === zobbo_ is now known as zobbo | ||
| zeasier | hiya, trying to migrate samba accounts from one machine to the next. what files do i need to copy? using the smbpasswd backend | 15:26 |
| zeasier | found /var/lib/samba/passdb.tdb, but is that the only file needed? | 15:27 |
| sommer | zeasier: don't forget /var/lib/samba/secrets.tdb | 15:28 |
| sommer | and /var/lib/samba/group_mapping.tdb | 15:28 |
| sommer | if you have issues you might copy all the files in /var/lib/samba | 15:29 |
| zeasier | hmm | 15:29 |
| zeasier | that sounds promising but i'd still like to find some documentation about this online | 15:30 |
| zeasier | those files names will help a lot | 15:30 |
| sommer | zeasier: you can look through the samba docs: http://samba.org/samba/docs/man/Samba-HOWTO-Collection/index.html | 15:32 |
| sommer | I'm not sure how much you'll find on replicating accounts though. | 15:33 |
| zeasier | that might be faster than searching for keywords across the web, thanks | 15:33 |
| sommer | np... if you don't need the second machine up right away the best thing may be just to copy the files and see if the accounts are there. | 15:35 |
| sommer | if not copy another file, and so on | 15:35 |
| zeasier | actually maybe we should switch to pam auth | 15:35 |
| zeasier | that way we won't have to deal with multiple passwords anymore | 15:36 |
| sommer | that works too, also using LDAP works too | 15:36 |
| zeasier | one of these days i'd like to get a centralized authentication system going | 15:37 |
| zeasier | even for plain user accounts | 15:37 |
| sommer | IMHO LDAP is the way to go | 15:38 |
| zeasier | yeah i need to bite the bullet the figure it out one of these days | 15:39 |
| === heno_ is now known as heno | ||
| zeasier | what's the default windows workgroup for xp? | 16:05 |
| zeasier | i forget if it's WORKGROUP or MSHOME | 16:06 |
| sommer | zeasier: I think workgroup | 16:06 |
| mralphabet | workgroup | 16:06 |
| soren | Really? | 16:07 |
| sommer | "I think"... been a while since I've used XP | 16:07 |
| mralphabet | perhaps it varies per flavor of xp, but I just installed xp on a machine a week ago and I swear it was workgroup | 16:08 |
| zeasier | ah yes, browsing our network all our unconfigured boxes are there | 16:08 |
| zeasier | so it's workgroup | 16:08 |
| soren | We changed our default (in Samba) to MSHOME to match Windows. | 16:08 |
| soren | Did they change it at some point? | 16:08 |
| zeasier | maybe it depends on what eddition of xp you have | 16:08 |
| mralphabet | perhaps on XP Home it is MSHOME and on XP Pro or the Corp install it is WORKGROUP | 16:09 |
| sommer | is it MSHOME for vista? | 16:09 |
| mralphabet | not on ultimate | 16:09 |
| zeasier | switching to WORKGROUP that's what 2k used by default and that's the best version of windows anyway | 16:10 |
| zeasier | even if no one uses it anymore | 16:10 |
| mralphabet | I still deploy it ;) | 16:11 |
| zeasier | if you have to use windows it's the best if you can get away with it | 16:12 |
| zeasier | doesn't support ie7 but then again you shouldn't using ie at all anyway | 16:12 |
| zeasier | btw looks like those tdb files worked | 16:13 |
| zeasier | just copied all of them | 16:13 |
| zeasier | looks like they all were needed according to the docs | 16:13 |
| sommer | zeasier: party! | 16:18 |
| zeasier | http://samba.org/samba/docs/man/Samba-HOWTO-Collection/install.html#tdbpermfiledesc | 16:19 |
| zeasier | thanks for the help | 16:24 |
| sommer | np | 16:25 |
| === zobbo_ is now known as zobbo | ||
| mikone | hey, i just did a dist-upgrade from feisty to gutsy 32bit and now my machine does not boot properly anymore. it seems like the boot process is not running as root. when it should mount the partitions it tells me "you need to be root to do that". did anyone else experience this problem and maybe knows a solution? | 18:06 |
| === nxvl_work_ is now known as nxvl_work | ||
| sommer | anyone else order one of those OLPC XO laptops? | 20:16 |
| kshah | okay, i'm not sure, but I think someone keeps trying to ssh into my server that shouldn't be there, i just happened to find /var/log/auth.log and found hundreds of login attempts from the same ip | 21:22 |
| kshah | my server is not at all secure | 21:22 |
| kshah | this is the first time i've ever had to administrate my own server | 21:22 |
| kshah | what do I do? how do I secure this box | 21:22 |
| kshah | its all from 62.205.163.157.. like a billion attempts to login | 21:23 |
| DM| | what does "sendmail: fatal: open /etc/postfix/main.cf" no such file or dir mean? it pops up everytime i try to run a sudo command | 21:24 |
| sommer | kshah: if you have ssh open to the Internet I'd add this config option to /etc/ssh/sshd_config: AllowUsers username | 21:26 |
| sommer | AllowUsers is a space seperated list, then restart ssh | 21:27 |
| kshah | okay | 21:27 |
| kshah | I mean, I don't know *anything* about what i'm doing | 21:27 |
| kshah | this is my first time using linux letting alone administrating a server let alone securing one | 21:27 |
| kshah | what are the general measures I should be taking | 21:27 |
| sommer | kshah: you can also look into hosts.deny, I've never used it, but I know people do. | 21:27 |
| kshah | firewalls, all that good stuff | 21:27 |
| DM| | Anyone? | 21:29 |
| kshah | should i change my ssh port for the hell of it? | 21:29 |
| sommer | kshah: sure iptables is the firewall shipped with Linux | 21:29 |
| kshah | i've never used that, learning curve? | 21:29 |
| kshah | what is pam_unix | 21:30 |
| sommer | kshah: can be a little steep, but there are gui "editors" that can help you create configs... I think firestarter and shorewall are a couple | 21:30 |
| kshah | i'm not running x on the server | 21:30 |
| kshah | that would be bad, right? | 21:31 |
| sommer | pam_unix is the authentication system (Pluggable Authentication Module... I believe) | 21:31 |
| kshah | l | 21:31 |
| kshah | kl | 21:31 |
| sommer | kshah: if you're running a ubuntu desktop I believe you can install firestarter on it then copy the script to the server. | 21:31 |
| kshah | win:( | 21:31 |
| kshah | AllowUsers user, will only allow that user to login? | 21:32 |
| sommer | here's an iptables guide: https://help.ubuntu.com/community/IptablesHowTo | 21:32 |
| kshah | do I have to enabled the Allow only option somewhere? | 21:32 |
| sommer | kshah: only allow that user/s to login using ssh... any user can still login from the console | 21:32 |
| kshah | thank you sommer | 21:35 |
| kshah | i'm going to play around | 21:36 |
| kshah | its a bit scary when you see a hundred failed login attempts | 21:36 |
| sommer | np... another quick precaution is to change your password, making sure it's hard to guess symbols, numbers, upper case and all that | 21:37 |
| mralphabet | hrm, I thought sshd_config had PermitRootLogin set to no by default | 21:40 |
| kshah | sommer: i typically randomly generate an 8 character pass | 21:42 |
| DM| | what does "sendmail: fatal: open /etc/postfix/main.cf" no such file or dir mean? it pops up everytime i try to run a sudo command | 21:42 |
| kshah | do you have a mailbox filled with unauthorized access attempt notes? :) | 21:43 |
| DM| | I dont even have a mailbox | 21:44 |
| DM| | this is a new install | 21:44 |
| nealmcb | nijaba, soren - where do we stand on getting the iso to work with qemu or xen? Last I tried in qemu, I got stuck at an initramfs prompt | 21:45 |
| nijaba | nealmcb: for 7.10, no go | 21:46 |
| DM| | dmesg | 21:46 |
| DM| | oops | 21:46 |
| nijaba | nealmcb: but for 8.04 it should and will be solved. I think soren is working on it | 21:47 |
| DM| | kshah any idea? | 21:47 |
| kshah | did you install mail? | 21:47 |
| kshah | mailx | 21:48 |
| kshah | sudo apt-get install mail | 21:48 |
| nealmcb | can the problem at least be documented? what sort of fix is soren looking at? | 21:50 |
| === heno_ is now known as heno | ||
| DM| | kshah Im really not sure | 21:52 |
| kshah | DM| what happens when you type 'mail' | 21:52 |
| DM| | kshah lemme try | 21:53 |
| DM| | no mail for dmserver | 21:53 |
| kshah | sommers: so iptables seems straightforward enough, but when I specify --dport ssh, i'm not specifying the port (which is not longer 22 btw :) | 21:53 |
| nealmcb | nijaba: or can the build script be referenced so folks can fix it themselves? I just hate the idea of 6 months of saying to folks "our chosen virtualization target platform doesn't run our iso (since we decided that either qemu or xen is the platform of choice - did we ever get back to that discussion? I recall a posting to the devel list being the next thing to do?) | 21:53 |
| kshah | sommers: does it just figure it out from the service, or should I actually specify --dport xxx instead of --dport ssh | 21:53 |
| DM| | kshah i removed mailx for now.. but still giving me that error | 21:54 |
| nijaba | nealmcb: AFAIK that's our choice for Hardy, right? | 21:54 |
| kshah | DM|: i wish I could help you but I am far far far from someone knowledgable, maybe someone here can help | 21:54 |
| DM| | : ( | 21:54 |
| DM| | kshah ok do you know about sudoers though? | 21:55 |
| kshah | yeah, i know of the file, and how to edit it | 21:55 |
| kshah | sudo visudo | 21:55 |
| nealmcb | nijaba: well I'm still digging for more info, but the choice I'm thinking of for gutsy is telling folks how to make a fixed iso. can isos go in ppas? | 21:56 |
| nealmcb | is there an open bug for this? | 21:56 |
| soren | nealmcb: The problem was getting the ends to meet, i.e. making the kernel and qemu agree on a usable driver for things. | 21:56 |
| kshah | are you guys core developers or something? | 21:56 |
| soren | kshah: Some of us are. | 21:57 |
| nealmcb | qemu works great with the linux-virtual kernel for what I've done | 21:57 |
| nealmcb | it is the iso that seems to stop dead | 21:57 |
| kshah | woah | 21:57 |
| nealmcb | on reboot, after install | 21:57 |
| soren | Er.. Why do you boot the iso after you've installed? | 21:58 |
| DM| | kshah lol it doesnt complete and gives that same error message | 21:58 |
| nealmcb | I'm not booting the iso, I'm booting the disk I installed it on | 21:58 |
| soren | 22:57:27 < nealmcb> it is the iso that seems to stop dead | 21:58 |
| soren | ? | 21:58 |
| kshah | DM| are you logged in as the user you first created when you installed? | 21:58 |
| nealmcb | (after installing from iso in that case) | 21:58 |
| DM| | yep | 21:58 |
| soren | nealmcb: Oh... | 21:59 |
| nealmcb | so I can run kvm or qemu with the virtual kernel and ubuntu-jeos-builder just fine. but when I install from iso, I can't boot the disk I installed to | 21:59 |
| lamont | DM|: your sendmail error means that sudo is attempting to send mail without bothering to see if it should. | 21:59 |
| kshah | DM| you have something far wronger with your system than I (will ever) know how to fix | 21:59 |
| DM| | lamont so how do i get rid of it | 21:59 |
| soren | nealmcb: that's really... odd. | 21:59 |
| soren | nealmcb: They ought to be just the same. | 22:00 |
| sommer | kshah: --dport xxxx you can use --dport ssh because ssh is listed in /etc/services I believe | 22:00 |
| sommer | kshah: so if you change it you'll need to specify | 22:00 |
| kshah | sommer: okay, yeah, i saw it automatically associated 80 with www, slick | 22:00 |
| nealmcb | of course I might have done the install wrong or something - it is such a slow pain to try again.... | 22:00 |
| DM| | lamont i want to just get rid of mail for now, but im new to the server world, so can you offer your help | 22:00 |
| lamont | ln /bin/true /usr/sbin/sendmail :) | 22:01 |
| nealmcb | nijaba, soren - does a wiki page https://wiki.ubuntu.com/JeOS-Builder make sense for me to work on? | 22:01 |
| lamont | or install a mailer and configure it | 22:01 |
| nijaba | nealmcb: IMO, yes, definitely ! | 22:02 |
| soren | nealmcb: Apart from the fact that it'll get renamed real soon, sure. | 22:02 |
| nealmcb | i.e. the name, and choice of the wiki since it is pre-release | 22:02 |
| nealmcb | soren: that's what I'm asking..... | 22:02 |
| soren | nealmcb: We can rename pages on the wiki, no problem. | 22:02 |
| nijaba | nealmcb: should not prevent you from working on it :) | 22:02 |
| nealmcb | but we can't re-point links - what name are you thinking of? | 22:02 |
| DM| | lamont since im not that exp yet, im not going to attempt to configure a mailer, | 22:03 |
| nijaba | nealmcb: yes, but we can maintain a redirect page... | 22:03 |
| nealmcb | of course - I just prefer to get it right and avoid confusing folks | 22:04 |
| nijaba | nealmcb: the naming issue is still something we have to figure out. It should not prevent us from working on the tool | 22:04 |
| nealmcb | what is the process for figuring it out? | 22:05 |
| nijaba | nealmcb: discussion? | 22:05 |
| nijaba | nealmcb: and a bit of marketing of course... | 22:06 |
| soren | Well, there are two options: | 22:06 |
| soren | a) Come up with a good, flashy name | 22:06 |
| soren | or | 22:06 |
| soren | b) rename it to ubuntu-vm-builder (because I say so) | 22:06 |
| soren | :) | 22:06 |
| DM| | lamont same error | 22:06 |
| soren | If a) doesn't happen within... um... let's say two weeks, I'll go with b). | 22:07 |
| nealmcb | how is virt-manager looking? | 22:07 |
| nijaba | soren: even though I think ubuntu-vm-builder makes sense, I think we should bring it up with other people, such as gerry... | 22:07 |
| nealmcb | virt-install etc | 22:08 |
| soren | nijaba: Indeed. | 22:08 |
| soren | nealmcb: virtinst just got built an hour ago. | 22:08 |
| nijaba | soren: do you want me to put it in my todo list for monday? | 22:08 |
| nealmcb | :-) | 22:08 |
| soren | nijaba: That would be much appreciated. | 22:08 |
| nijaba | soren: will do then | 22:08 |
| lamont | soren: finish default-mta packaging yet? :-) | 22:08 |
| soren | nealmcb: It took a while for it to go trough NEW, but now we're getting somewhere. | 22:08 |
| nealmcb | soren: is there a chance we'd just go with it? | 22:09 |
| soren | nealmcb: Not if I have any say in it. | 22:09 |
| nealmcb | built in a ppa, or for hardy alpha 1?? | 22:09 |
| soren | nealmcb: alpha 1 was yesterday. | 22:09 |
| nealmcb | soren: and who would give YOU any say in it? | 22:10 |
| nealmcb | :-) | 22:10 |
| soren | nealmcb: Er... Sorry, I got confused, apparantly. | 22:10 |
| soren | nealmcb: "is there a chance we'd just go with it?" what is "it"? | 22:10 |
| soren | lamont: gah... /me looks | 22:10 |
| nealmcb | I think you got it right - q was if adapting virt-install would be preferable to ubuntu-jeos-builder | 22:11 |
| nealmcb | soren: so did it build for hardy? or still just in your ppa? | 22:12 |
| soren | nealmcb: The source is in the official archive now. | 22:12 |
| soren | nealmcb: The binaries are in the NEW queue. | 22:12 |
| nealmcb | sounds good | 22:12 |
| soren | lamont: My biggest problem right now is the long description. I've rewritten it three times and I'm still not happy with it. | 22:13 |
| nealmcb | and how would you compare what it can or should be able to do with your very nifty builder script? | 22:13 |
| nealmcb | I'm just thinking that pushing a whole free virtual machine infrastructure is a big job, and wondering where it makes sense to invest time and effort | 22:14 |
| soren | Quite. I need to look into it a bit more. I've been blocked by a few bugs in it, so I haven't been able to look too much at it. | 22:15 |
| * nealmcb needs to just look at it more himself, but has lots of other things still cooking.... | 22:15 | |
| nealmcb | soren: you do manage to get an amazing amount of stuff done..... | 22:16 |
| lamont | soren: feel free to toss it at me and I'll mess with it and upload it and we can deal with the inevitable bug reports. :) | 22:16 |
| soren | lamont: Should it just depend on exim4 or something more specific? | 22:17 |
| soren | nealmcb: It doesn't feel that way. | 22:17 |
| nealmcb | Where might I go to gather more info about this bothersome initramfs prompt? I haven't found much relevant documentation. or might I just ship you the vm that I built from the iso for qemu? | 22:17 |
| lamont | for debian, I think it's exim4... not sure. | 22:17 |
| soren | nealmcb: I've ticked *one* think off on my todo list this week. | 22:17 |
| soren | s/think/thing/ | 22:17 |
| soren | nealmcb: Er.. I can probably look into it some time early next week. | 22:18 |
| nealmcb | can you be more specific about the mismatch between the kernel and qemu you were talking about? | 22:18 |
| nealmcb | i.e. which driver might be an outage for qemu? | 22:19 |
| * nealmcb needs to just do a proper bug report, like he should have done weeks ago, rather than just posting on the forum thread about it | 22:20 | |
| soren | nealmcb: I forget the exact details. Gutsy is old hat. :) | 22:21 |
| nealmcb | should I file the iso reboot bug on ubuntu-jeos? or on the kernel somehow? or ??? | 22:23 |
| soren | That's a might good question. | 22:23 |
| nealmcb | installer? initramfs? | 22:24 |
| soren | The trouble is that it's unlikely to be severe enough to warrant an SRU anyway. | 22:24 |
| soren | lamont: http://people.ubuntu.com/~soren/dmta/ <-- The current stuff | 22:25 |
| nealmcb | well, getting it documented for hardy is a good start.... | 22:25 |
| soren | nealmcb: Hopefully, the problem won't exist in hardy :) | 22:25 |
| nealmcb | well it still needs a bug.... | 22:26 |
| soren | nealmcb: I suppose. | 22:27 |
| nealmcb | soren: you seem unsure - I'm confused | 22:28 |
| soren | nealmcb: It's just that there's a lot of focus on exactly these things.. qemu and kvm and the kernel running inside them.. It's unlikely to not be fixed regardless of whether you spend time reporting the bug. | 22:29 |
| nealmcb | my point is just that qemu and the existing kernel seem fine - it is just the iso that is having problems. xen may be a whole different issue - I haven't tried it | 22:30 |
| nealmcb | iso or install process or whatever | 22:30 |
| soren | nealmcb: Ah. | 22:32 |
| soren | nealmcb: Erm.. I'm not sure what I'd report it against. | 22:33 |
| nealmcb | any good doc on the initramfs busybox prompt? | 22:33 |
| soren | nealmcb: Not that I know of. | 22:33 |
| nealmcb | and how to figure out how I got there | 22:33 |
| soren | nealmcb: You land there if the early userspace stuff fails to get you a proper root. | 22:34 |
| nealmcb | I just just run it in a vm and watch what happens. oh yeah - I am.... | 22:34 |
| soren | nealmcb: This can be for any number of reasons. | 22:34 |
| soren | nealmcb: So to reproduce this, I just take which iso and do what? | 22:35 |
| nealmcb | install jeos iso via qemu, reboot, ignore error, restart qemu with the new disk, see initramfs prompt | 22:36 |
| nealmcb | (ignore the "you've still got a cdrom loaded" error) | 22:36 |
| soren | nealmcb: Added to my todo list. I'll figure out what to report it against. | 22:38 |
| nealmcb | :-) | 22:39 |
| Innatech | Hello. Could someone point me in the right direction in terms of installing a shorewall package from 7.10 on a 7.04 box? Or just in getting shorewall updated to 2.3.2 or better? | 23:18 |
| Innatech | how do I go about using Prevu to try a 7.10 .deb on 7.04 ? | 23:38 |
| === Drazha739 is now known as Drazha | ||
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!