| sommer | mindframe-: mrtg works great for that | 00:02 |
|---|---|---|
| owh | sommer: I've written up what I've found so far: https://wiki.ubuntu.com/OnnoBenschop/ubuntu-server/cron-bug | 00:08 |
| sommer | cool | 00:09 |
| sommer | looks good | 00:09 |
| owh | I'm just wondering if its something weird like, reboot - add script - fail, vs reboot - reload - add script - success - add script - success | 00:10 |
| sommer | have you tested cron.hourly? ...wondering if it may be effected as well | 00:11 |
| owh | Hmm, I thought that I invented that on my system, hardy has it too :) I'll check. | 00:12 |
| owh | sommer: So far two out of three act normally, but the one we care about missed the job by about 46 seconds, so I'll have to wait an hour :) | 00:21 |
| sommer | wow... maybe something with the hardware? | 00:22 |
| owh | I'm beginning to wonder if its an anacron interaction. The hourly job doesn't use anacron. | 00:22 |
| sommer | ah... makes sense | 00:22 |
| owh | As for hardware, the gutsy-server is a HP proliant, the gutsy-workstation is a Thinkpad and the hardy-server is a vmware-server | 00:23 |
| gregbrady | Good evening everyone. | 00:52 |
| gregbrady | What is the best way to go about setting up a proxy server in my home network in order to block certain sites from individual users? | 00:52 |
| andguent | evenin' :) (i'm thinking most of the room is fairly quiet...) | 00:52 |
| andguent | are you already running Ubuntu on a server, or server-esk box? | 00:53 |
| Kamping_Kaiser | you'll need an authenticating proxy | 00:53 |
| gregbrady | Ubuntu on a desktop | 00:53 |
| gregbrady | All ubuntu machines. 5 in all | 00:53 |
| gregbrady | Over wireless | 00:54 |
| Kamping_Kaiser | gregbrady, do you have one user per system? | 00:54 |
| andguent | is your router running ubuntu as well? or just 5 desktops | 00:54 |
| gregbrady | No the three of us have access to all computers, except one main one. | 00:54 |
| gregbrady | Router is a standard Belkin Pre-N | 00:54 |
| andguent | if you know exactly which websites you want to block, or exactly which websites you want to allow, squid will be the most popular proxy out there to learn | 00:55 |
| gregbrady | No, not exact websites. | 00:56 |
| gregbrady | But I guess I could build a list over time | 00:56 |
| andguent | if you want it to be a 'smart' filter that just blocks certain types of websites, that gets slightly harder, but still doable | 00:56 |
| Kamping_Kaiser | dansguardian is the only filtering proxy i have used, so its the only one i can really recomend | 00:56 |
| gregbrady | Kamping_Kaiser, yup, I understand completely. I'm looking for something maybe more generic, if that makes sense. | 00:57 |
| andguent | same, dansguardian is a very nice key word based filter, but it usually is run with squid | 00:57 |
| Kamping_Kaiser | andguent, i'm aware of it running with anything else | 00:57 |
| gregbrady | dansguardian just seems a bit daunting to install and manage. | 00:58 |
| Kamping_Kaiser | gregbrady, are you after keyword filtering/sitelists, what sort uf stuff? | 00:58 |
| Kamping_Kaiser | its not as hard as you think, exept it has the hidden overhead of needing to configure squid | 00:59 |
| gregbrady | Kamping_Kaiser, keyword and content | 00:59 |
| gregbrady | I would also like to monitor sites visited | 00:59 |
| Kamping_Kaiser | all proxys will log | 01:00 |
| gregbrady | Yup, I know. | 01:01 |
| andguent | if you have a good guide, or are familiar with squid & dans, it can be 3 config files and maybe 10 lines of config entries, not bad for what it does | 01:02 |
| gregbrady | -no guide, and not familiar with squid or dans | 01:02 |
| Kamping_Kaiser | 3 files? | 01:03 |
| andguent | squid.conf, dansguadian.conf, dansguardianf1.conf, ack, and /etc/default/dansguardian | 01:03 |
| andguent | ok, 4 :) | 01:03 |
| Kamping_Kaiser | you dont /need/ to edit f1 *i havent* | 01:04 |
| Kamping_Kaiser | i dont remember default/dans | 01:04 |
| andguent | going off of memory, its possible i'm wrong, anywho, the point is it isn't difficult at all | 01:05 |
| Kamping_Kaiser | agreed on the point :) | 01:05 |
| andguent | trying to track down a good guide | 01:06 |
| gregbrady | Yeah, so am I! | 01:06 |
| Kamping_Kaiser | https://wiki.ubuntu.com/EdubuntuProxy any help? | 01:07 |
| gregbrady | let me check. Be aware that I'm just running Ubuntu | 01:07 |
| andguent | eh, its all the same, just different software installed by default | 01:08 |
| gregbrady | That's my understanding. I'm relatively new so I just wanted to clarify. | 01:09 |
| andguent | as long as you can install dansguardian and squid, it really doesn't matter what you run it on | 01:10 |
| andguent | its actually possible to at least run squid on a commodity linksys router, but thats another project :P | 01:10 |
| andguent | Kamping_Kaiser's link looks good, I found this guide as well which keeps it short and sweet:http://www.brianmathis.net/2007/11/30/howto-squid-and-dansguardian-with-dapper/ | 01:11 |
| owh | gregbrady: Just to break in here, but many domestic wifi routers have filtering capacity built in. | 01:11 |
| andguent | I feel like they are both missing a few httpd_accel lines for squid | 01:11 |
| gregbrady | owh, yes, but it is pay by the month on my router | 01:13 |
| owh | gregbrady: Huh? In a domestic environment? How are you connected to the 'net? | 01:14 |
| gregbrady | owh rogers and a belkin router | 01:14 |
| owh | gregbrady: The belkin router is in your home? | 01:14 |
| gregbrady | owh yes | 01:15 |
| gregbrady | Belkin Pre-N 530200 | 01:15 |
| owh | gregbrady: Then my point still stands. Many domestic routers have filtering built in, that is, you can access their web interface and setup some form of URL filtering. Not all, but many. | 01:15 |
| owh | gregbrady: Most of them are running some form of linux anyway :) | 01:16 |
| gregbrady | This one relies on a service that you subscribe to | 01:16 |
| * owh is googling. | 01:17 | |
| owh | gregbrady: I get no hits at all with that model number. | 01:17 |
| gregbrady | Sorry, Ubuntu froze and crashed. | 01:20 |
| Kamping_Kaiser | :o | 01:20 |
| owh | gregbrady: That sounds like a bigger problem than filtering. I've only had that happen with hardware faults. | 01:20 |
| gregbrady | yeah, first time for everything. | 01:20 |
| gregbrady | Too bad, I was doing a lot of long running processes in the background | 01:21 |
| owh | Did you see my last comment: gregbrady: I get no hits at all with that model number. | 01:21 |
| gregbrady | owh, second please. I have about 5 process to get started again. | 01:22 |
| gregbrady | Man, and they were running for the last about 4 hours....... | 01:23 |
| gregbrady | Ok, back in business! | 01:26 |
| gregbrady | Belkin F5D8230-4 | 01:26 |
| owh | gregbrady: http://whirlpool.net.au/index.cfm?a=h_view&model_id=327 - look for manual, click the link, look for manual, download. | 01:31 |
| gregbrady | owh, it only has them for win/mac | 01:33 |
| gregbrady | nope, found it | 01:33 |
| owh | gregbrady: Integrated Parental Control Web Content Filter: Belkin Parental Control allows you to set up your own policies and block any website you want. There is also an optional reporting feature (fee-based) that allows you to get a report showing you every website that was visited from your network (refer to your Parental Control User Manual for more information). | 01:36 |
| gregbrady | exactly, fee based | 01:36 |
| owh | gregbrady: Read it properly | 01:36 |
| gregbrady | owh, sorry page 10. Parental controls. | 01:37 |
| owh | Let me make it clearer for you gregbrady: Integrated Parental Control Web Content Filter: Belkin Parental Control allows you to set up your own policies and block any website you want. | 01:37 |
| andguent | owh: I think he was looking for keyword/smart filtering of some sort | 01:38 |
| gregbrady | Parental control is free for 6 months, which includes blocking anysite | 01:38 |
| gregbrady | The last paragraph says what is included in the Parental controls, if subscribed to | 01:38 |
| gregbrady | owh, I could live with tracking and manual list creation if required | 01:39 |
| gregbrady | owh, maybe I'e misread it. | 01:40 |
| gregbrady | Is this a really unusual request for Ubuntu users to make? | 01:43 |
| owh | Well, on a ubuntu-server group, yes :) | 01:43 |
| Kamping_Kaiser | gregbrady, request what? | 01:43 |
| gregbrady | owh, could be. | 01:43 |
| gregbrady | Kamping_Kaiser, requesting an easy method for managing web access. | 01:44 |
| andguent | gregbrady: I'm more than happy to help getting squid and dansguardian up and running with you, i was just letting you check out alternate options in case they really did work for what you needed | 01:45 |
| gregbrady | andguent, nope, I understand your intent. | 01:45 |
| gregbrady | andguent, I guess I had hopes it would be easier. I've never tried this before | 01:45 |
| andguent | there may be other better ways to do it, but the squid and dans combo has been around for a while, and its the one i know [works] | 01:45 |
| andguent | i've heard smoothwall can be an easy install, but i've never used it | 01:46 |
| gregbrady | andguent, I will attempt to follow the directions I've already been given | 01:46 |
| andguent | the long and the short of it is that there is no harm in trying it, at least not until you start permanently forcing custom iptables entries at boot, then you just need to remember where you made that change 6 months ago :) | 01:47 |
| owh | gregbrady: Everything in the manual indicates that the only part that is fee based is the reporting. I do not have access to the "Parental Control User Manual", but as the owner of the device you presumably do. | 01:47 |
| gregbrady | owh, nope and when you try to use the function, it asks you to login in and register, which of course does not work. | 01:48 |
| owh | gregbrady: If your domestic router does what you need then that will be far simpler to implement than anything else - unless you already have a central gateway linux box. | 01:48 |
| gregbrady | owh, I agree. | 01:48 |
| owh | gregbrady: Did you look on the CD that came with the device? | 01:48 |
| andguent | gregbrady: I can even try setting the same filter up here with you, i don't really have a need for it right now though | 01:48 |
| gregbrady | owh, I just googled and found out that that service no longer works. | 01:50 |
| gregbrady | owh, they were indeed subscription based, but it does not function anymore. | 01:50 |
| owh | gregbrady: Then perhaps contact Belkin and ask them what you need to do to enable filtering. Perhaps they have a new firmware version for you. | 01:51 |
| gregbrady | owh, I tried to get help with them before with VPN and that was a useless adventure. No more Belkin products for me! But, I'm stuck with what I have at the moment. | 01:51 |
| owh | andguent: I completely understand your response and it is correct if the router cannot do this, but only then. It might be a trivial thing to initially setup, apt-get install xyz, but maintaining it will be a challenge across several machines. | 01:52 |
| gregbrady | owh, exactly!!!!! | 01:52 |
| gregbrady | owh, that is why I wanted LSTP to work, but it does not work with a wireless server | 01:52 |
| owh | Huh? | 01:53 |
| owh | Says who? | 01:53 |
| gregbrady | I tried, with lots of help in the chatrooms, no luck | 01:53 |
| andguent | its all about deciding how complicated you want it, depending on the technical skill of those being filtered :) | 01:53 |
| owh | gregbrady: There is no earthly reason that I can think of, other than perhaps available bandwidth that might cause issues. (Bugs not withstanding.) | 01:54 |
| gregbrady | I thought LSTP sounded like a dream to me. Maintain one main machine only......the rest are just thin clients with nothing to do on them. Simple in theory. | 01:54 |
| owh | I suppose you could point all browsers at the same proxy server and lock that redirection down, then run the proxy/filter in one place and maintain it there. It will require that workstation to be on for anyone to browse, but it would work. | 01:55 |
| Kamping_Kaiser | owh, the key issue is devices dont netboot | 01:55 |
| Kamping_Kaiser | * netboot wireless | 01:55 |
| Kamping_Kaiser | anyway. afk | 01:55 |
| owh | Kamping_Kaiser: So, put an initrd on the device and get it to connect. | 01:55 |
| gregbrady | The whole thing is a lot more complex then I thought at first. | 01:55 |
| owh | gregbrady: It always is, which is why I was diverting you toward fixing your router :) | 01:56 |
| gregbrady | owh, Oh, I understand you completely and it would be awesome! | 01:56 |
| gregbrady | owh, Ubuntu is so easy to upkeep on individual machines....if I could just manage net access at one point, that would be awesome. | 01:57 |
| owh | gregbrady: As I said, configure one machine with andguent's assistance if so inclined, then redirect the proxy from all the other workstations to that same machine. Magic. | 01:58 |
| gregbrady | owh, or buy a proper router | 01:58 |
| owh | gregbrady: You can often throw money at anything to solve a problem :) | 01:59 |
| gregbrady | owh, good point, but this decision is not trivial. I will have to maintain it as well. | 01:59 |
| andguent | afk for a bit, be back | 01:59 |
| gregbrady | owh, and this server has a bunch of hard drives in it that consume power.....more than a router I would imagine | 02:00 |
| owh | gregbrady: By several orders of magnitude. | 02:01 |
| owh | sommer: In case you're awake, the hourly jobs didn't run on hardy either. | 02:02 |
| gregbrady | owh, and I'm not really sure I understand exactly how the whole squid/dansguardian actually works, so if there is a problem it will be hard to fix. | 02:08 |
| gregbrady | owh, I like to understand the things I implement | 02:09 |
| faulkes- | gregbrady: a good policy | 02:21 |
| faulkes- | but nothing a bit of time and determination won't solve | 02:21 |
| faulkes- | squid is fairly straight forward once you do your config to your tastes | 02:21 |
| gregbrady | faulkes- no doubt, I'm investing now. | 02:21 |
| faulkes- | I havent used dans so | 02:21 |
| gregbrady | faulkes- I just have a problem blindly installing something. It may work, but as soon as there is a glitch, and there will be glitches, then the real nightmare starts | 02:22 |
| gregbrady | squid and dans maybe perfect, I just have to read more to understand | 02:24 |
| Kamping_Kaiser | i love the way its set+forget after the iniital install | 02:25 |
| gregbrady | Kamping_Kaiser, I'm still reading..... | 02:26 |
| hatter | I have a problem where the ubuntu server network lags intermittently for 3 or 4 seconds, the server is primarily samba, I have changed every piece of hardware, any1 got any clues ? | 02:27 |
| Kamping_Kaiser | gregbrady, not rushing you :) | 02:27 |
| gregbrady | Kamping_Kaiser, nope, none taken. I appreciate the help! | 02:27 |
| andguent | I'm back -- gregbrady: I'm more than happy to help with things, but it doesn't make sense for half a dozen people to all give you ideas at once :) I will keep quiet unless asked for something | 02:33 |
| gregbrady | andguent, thanks and no problem. I'm just doing some research here for my own peace of mind. | 02:37 |
| andguent | there are multiple ways on how to implement it, some are dead easy to revert (so easy that if you have 12 year olds+, it might not be effective..) | 02:39 |
| andguent | but definitely read what you need | 02:40 |
| Kamping_Kaiser | afk. back as kgoetz in about 30 | 03:00 |
| gregbrady | Ok, trying to install | 03:18 |
| gregbrady | tons more to read in squid.conf! | 03:21 |
| andguent | gregbrady: Questions for you (if you want to do some design planning...) What would you consider the highest computer skill level of those being blocked is? (IE does this filtering config need to be protected by passwords) Are you sure that the proxy server box you are setting up will always be on and available? Will that box have a static IP address? | 03:21 |
| gregbrady | Skill level is minimal.....My son is 8. | 03:22 |
| gregbrady | The server can always be on | 03:23 |
| gregbrady | Server can be static, I don't see an issue there. | 03:24 |
| andguent | good good, if it hops around, family members will complain, including the one who shares your bed :) | 03:24 |
| gregbrady | hahahaha | 03:24 |
| andguent | although, i'm guessing most wives are more agreeable to porn filters then say.... rewiring all of the phones to go through voip, and then voip crashing.... | 03:25 |
| gregbrady | I don't care about porn for the wife. | 03:25 |
| gregbrady | I only need to protect my son. On all machines, except the server | 03:25 |
| andguent | yea, i know, but i'm sure she likes the idea... anywho, i'm getting us off topic | 03:26 |
| gregbrady | hahahah, for sure! | 03:26 |
| andguent | are you following a guide of any sort? most guides I have seen don't test things in phases very well, and you end up with a 4 part process that is broken somewhere in the middle :) | 03:27 |
| gregbrady | https://wiki.ubuntu.com/EdubuntuProxy | 03:28 |
| gregbrady | I've only installed the software and opened gedit | 03:28 |
| gregbrady | with squid.conf | 03:28 |
| andguent | ok good, I would say get squid.conf adjusted as needed, and then pause there to test it and verify functionality | 03:29 |
| gregbrady | I must read to understand what I'm adjusting though. I'm working on that now. | 03:30 |
| andguent | take your time | 03:30 |
| gregbrady | It says the default settings should be fine | 03:36 |
| andguent | only one way to find out for sure :) I usually adjust things, but lets try the easy way first | 03:37 |
| gregbrady | So just turn it on? | 03:37 |
| andguent | yea, lets try that start command, and see if manually pointing your browser to your proxy gets you any connectivity | 03:38 |
| gregbrady | failed | 03:38 |
| gregbrady | no worries. I've never had one single thing work out of the box with default settings. | 03:39 |
| andguent | squid failed to start? did it give a message? usually I would say avoid pasting numerous lines in a chat room, but we seem quiet enough in here tonight :) | 03:39 |
| gregbrady | * Starting Squid HTTP proxy squid * Creating squid spool directory structure | 03:39 |
| gregbrady | FATAL: Could not determine fully qualified hostname. Please set 'visible_hostname' | 03:39 |
| gregbrady | Squid Cache (Version 2.6.STABLE14): Terminated abnormally. | 03:39 |
| gregbrady | CPU Usage: 0.004 seconds = 0.004 user + 0.000 sys | 03:39 |
| gregbrady | Maximum Resident Size: 0 KB | 03:39 |
| gregbrady | Page faults with physical i/o: 0 | 03:39 |
| gregbrady | Aborted (core dumped) | 03:39 |
| gregbrady | FATAL: Could not determine fully qualified hostname. Please set 'visible_hostname' | 03:39 |
| gregbrady | Squid Cache (Version 2.6.STABLE14): Terminated abnormally. | 03:39 |
| gregbrady | CPU Usage: 0.012 seconds = 0.004 user + 0.008 sys | 03:39 |
| gregbrady | Maximum Resident Size: 0 KB | 03:39 |
| gregbrady | Page faults with physical i/o: 0 | 03:39 |
| gregbrady | Aborted (core dumped) | 03:39 |
| andguent | ok, lets try what it asks then, do you have a line in squid.conf that starts with 'visible_hostname' ? | 03:40 |
| gregbrady | already working on that | 03:40 |
| kgoetz | back :) | 03:41 |
| andguent | excellent, forgive me if I ask silly questions :) | 03:41 |
| andguent | kgoetz: we are just starting into basic squid configuring, both of us got distracted a bit while you were out :) | 03:42 |
| gregbrady | andguent, no problem | 03:42 |
| gregbrady | ok, everything is commented out except the http_port line | 03:42 |
| andguent | i believe you can set visible_hostname to anything you want, just keep tinkering until squid restarts without complaining -- I could get my own squid started up here for good measure too.... | 03:43 |
| andguent | Can I assume you are familiar with http://paste.ubuntu-nl.org/ just in case we need to exchange config files? | 03:45 |
| gregbrady | I only used that once | 03:46 |
| kgoetz | andguent: cool. i'm trying to get setup here, and having tecchnical issues ;| | 03:48 |
| gregbrady | I'm not sure what the hostname should be | 03:48 |
| gregbrady | What format? In quotes? | 03:48 |
| andguent | shouldn't need quotes unless you have spaces or fancy characters | 03:48 |
| gregbrady | and the name is irrelevant? | 03:49 |
| andguent | I just put in a line on its own like this: 'visible_hostname goober' | 03:49 |
| andguent | yea, put it in as 'youPeskyKidsMadeMeResortToThisJustToShieldYourEyes' :) | 03:49 |
| gregbrady | ok, squid started | 03:49 |
| gregbrady | confirming now | 03:49 |
| gregbrady | keithclark@keithclark-desktop:~$ ps aux | grep squid | 03:50 |
| gregbrady | root 20819 0.0 0.0 4780 652 ? Ss 23:49 0:00 /usr/sbin/squid -D -sYC | 03:50 |
| gregbrady | proxy 20824 0.3 0.3 7000 4528 ? S 23:49 0:00 (squid) -D -sYC | 03:50 |
| gregbrady | 1000 20859 0.0 0.0 2976 756 pts/0 R+ 23:50 0:00 grep squid | 03:50 |
| andguent | via 'ps aux|grep squid' I assume? -- I have another confirm command to run: 'netstat -nltp|grep squid' | 03:50 |
| andguent | I get: tcp 0 0 0.0.0.0:3128 0.0.0.0:* LISTEN 28667/(squid) | 03:51 |
| gregbrady | I guess that means no then | 03:51 |
| gregbrady | (Not all processes could be identified, non-owned process info | 03:52 |
| gregbrady | will not be shown, you would have to be root to see it all.) | 03:52 |
| kgoetz | check your logs too | 03:52 |
| andguent | your command output was good, but netstat should show one line.... hmm, maybe 'sudo netstat -nltp|grep squid' | 03:52 |
| gregbrady | yup.... | 03:53 |
| gregbrady | sorry, a home distraction.... | 03:53 |
| andguent | happens :) | 03:53 |
| gregbrady | ok, it was the tv | 03:53 |
| gregbrady | so, success at the moment | 03:53 |
| andguent | ok, i personally like to test every phase so we know if we are standing on good ground or not, point your firefox manual proxy through localhost port 3128.... I can find exact menus in a sec | 03:54 |
| gregbrady | Should I not set my ip as static now for this machine? | 03:54 |
| gregbrady | And, should I be using my laptop to try this out now? | 03:54 |
| andguent | eh, lets confirm squid first, setting static IP can be the next step | 03:55 |
| kgoetz | personally i'd think ip is first, sine you want squid to listen on it | 03:55 |
| andguent | currently, its listening on all IPs, squid won't even care if you hop IPs, it will only matter to other computers, and none of them know about it yet | 03:56 |
| andguent | In firefox, can you go Edit -> Preferences -> Advanced -> Network -> Settings -> Manual Proxy.... | 03:57 |
| andguent | remember this location, we will need to undo it later.... | 03:57 |
| gregbrady | not a problem | 03:57 |
| andguent | Check off "Use this proxy server for all protocols", and enter for HTTP proxy: localhost, port 3128 | 03:57 |
| andguent | then get a new tab up and just check your connection to google | 03:58 |
| gregbrady | localhost=ip of server? | 03:58 |
| andguent | you should actually be able to put that english in, exactly as spelled | 03:58 |
| andguent | IP would work too, but we might be changing that in a minute :) | 03:58 |
| gregbrady | ok, google works fine. how do I confirm it went through the proxy server? | 03:59 |
| gregbrady | I actually understand this so far! | 03:59 |
| andguent | try 'tail /var/log/squid/access.log' | 03:59 |
| andguent | it should show your page hit, and your IP among other things | 04:00 |
| gregbrady | yup, it worked | 04:00 |
| gregbrady | so really, at this point, if I changed my other machines to point to this proxy server, tracking would be working? | 04:01 |
| andguent | good good, in the end you will end up with two logs like that, dans will have its own | 04:01 |
| andguent | yes, at minimum, if you repeated the firefox proxy settings on every box, you could at least see what sites they are visiting | 04:01 |
| andguent | but note that squid usually logs time stamps in non-english format | 04:02 |
| gregbrady | Awesome, you are good. I actually followed this | 04:02 |
| gregbrady | andguent, I understand....I'm just happy with the progress | 04:02 |
| andguent | dans will have some easier logging to follow, i like to change date stamp to easier readable format, but thats later :) | 04:03 |
| gregbrady | now, I'm assuming, dansguardian sits between the proxy server and the net? | 04:03 |
| andguent | actually, the other way around, dans likes to get everything first, and then passes everything to squid | 04:03 |
| andguent | but close :) | 04:03 |
| gregbrady | That is what I meant | 04:04 |
| andguent | squid is mostly there for speed and redirection functionality | 04:04 |
| andguent | ah ok | 04:04 |
| gregbrady | internet to dans, dans to squid, squid to client, client to browser? | 04:04 |
| gregbrady | and viseversa? | 04:04 |
| andguent | either way, a static IP is a good idea before we get too far into this, feel free to undo your proxy settings in firefox before we forget about them... | 04:04 |
| andguent | mmmm, close... | 04:05 |
| gregbrady | ok, still learning | 04:05 |
| gregbrady | proxy reset | 04:05 |
| andguent | for outbound connections, the chain is workstation app (firefox) -> Dans on server -> Squid on server -> router -> internet, the return trip would be flipped | 04:05 |
| gregbrady | got you. | 04:06 |
| kgoetz | iptables redirects > firefox settings | 04:06 |
| gregbrady | yeah, this is where I get a little confused. | 04:07 |
| andguent | definitely an option, with an 8 year old though, we can get away with the easy manual proxy for now if we want | 04:07 |
| gregbrady | I would have thought that dans would be installed and configured first then? | 04:07 |
| andguent | i think of squid as being the foundation, start from the link closest to the internet, and test backwards from there | 04:07 |
| kgoetz | andguent: i'd think iptables would be easier overall, as you dont need to reconfigure each client | 04:07 |
| gregbrady | So far my son does not mean to do what he does. | 04:08 |
| gregbrady | I got you..... | 04:08 |
| gregbrady | Sorry, just trying to figure all this out as we go. | 04:08 |
| andguent | mmm, iptables will need to be run on each workstation, unless this server is becoming the router, either way we are touching each workstation | 04:08 |
| kgoetz | i just assumed the server would become the default route | 04:09 |
| gregbrady | ok, then the server will dole out ip addresses? | 04:09 |
| gregbrady | dns serving duties? | 04:09 |
| andguent | it can be, but that requires some advanced firewalling --- none of this is required, but can be done | 04:09 |
| andguent | you can leave dhcp and dns exactly as is if you want to keep it simple | 04:10 |
| gregbrady | no....the hardware firewall seems to be working....and I lend out some wireless to my neighbour | 04:10 |
| gregbrady | I dont' want his machine to be affected | 04:10 |
| * kgoetz bites back a suggestion involving more complexty | 04:11 | |
| kgoetz | bad me! | 04:11 |
| gregbrady | kgoetz, please let me hear them | 04:11 |
| andguent | i would say keep things as is, make the changes that are easiest to undo :) run with it for a week, and then make it more complex :) | 04:11 |
| gregbrady | I will keep simple, but I want to hear options | 04:11 |
| andguent | or throw another nic in the server, install shorewall, pull the belkin behind the new router, and make it a transparent proxy for all :) | 04:12 |
| gregbrady | Maybe I should have said this....I have a neighbour that cant' afford the internet access, so I let him use mine via wireless. I don't want to change his settings. | 04:12 |
| kgoetz | set the gateway to be the default route for everything (so everything gets the option of using squid), and drop an iptables rule to route the neighbour through to th net directly not via squid | 04:12 |
| gregbrady | andguent, if I were to throw another nic in, I would just buy another router with everything built in. | 04:12 |
| andguent | if you have ubuntu (or really anything with iptables --- linux kernel 2.4 and up), its dead easy to force ALL port 80 outbound traffic to your filtering | 04:13 |
| andguent | you could, but running a full linux server as a router is a massive amount of power, not only knowing what websites people have been to, but who is hogging all of that download speed, monitoring all ports, not just web traffic | 04:13 |
| andguent | iptraf is your friend, but its only useful if your server sees the connections going out to the internet | 04:14 |
| gregbrady | andguent, yes, I understand the benefits. | 04:14 |
| andguent | either way, all of that stuff can be added later if you feel so inclined, not required for tonight :) | 04:14 |
| andguent | kgoetz: I agree you could definitely set his proxy box as the default gateway, but again, more complexity :) | 04:15 |
| DrIP | hi all | 04:15 |
| DrIP | i need to install my server without internet help! | 04:15 |
| gregbrady | my goal is to be able to get Matthew back online tomorrow with the least amount of trouble and the most amount of understanding so that I can manage it | 04:15 |
| gregbrady | But I would so enjoy learning more with you guys! | 04:15 |
| kris_ph | hello.. where can php.ini be located in gutsy? | 04:16 |
| andguent | DrIP: Any way the box can temporarily migrate to a place with internet? You probably don't need it for the cd installer, but its nice | 04:17 |
| andguent | kris_ph: 'locate php.ini' | 04:17 |
| andguent | gregbrady: are you ok setting the IP static or would you like help? | 04:17 |
| DrIP | andguent: sadly, no... | 04:17 |
| gregbrady | andguent, just point me....I think I know. | 04:17 |
| DrIP | i have resources to download a 'full dvd' if possiable | 04:17 |
| andguent | DrIP: how far can you install without the connection? a basic cd should work unless you know it will be missing software you want | 04:18 |
| kris_ph | Is it a good practice to hide the versions of apache and php in http head request? | 04:18 |
| DrIP | it goes to about 83% | 04:18 |
| DrIP | kris_ph: yes | 04:18 |
| andguent | gregbrady: if you have gui on that box, it may be easiest to just use network manager to set things, default gateway and dns server can both probably be your belkin | 04:18 |
| gregbrady | System, Administration, Network.... | 04:18 |
| kris_ph | DrIP: I got the list of php.ini already.. but the thing is.. which php.ini location I need to modify to hide php details? | 04:19 |
| andguent | gregbrady: IP address can be any similar address as the other units on your network, as long as the last number is different | 04:19 |
| andguent | kris_ph: usually /etc/php/apache/php.ini, but don't quote me on that :) | 04:20 |
| kris_ph | DrIP: I just want to modify expose_php to OFF.. | 04:20 |
| kris_ph | andguent: thanks.. | 04:20 |
| DrIP | kris_ph: andguent should better hear that question :p i have yetr to get a working install of ubuntu server >.< | 04:20 |
| DrIP | err yea | 04:20 |
| DrIP | andguent: is there a dvd of server? | 04:21 |
| andguent | kris_ph: the real test is to figure out how to detect if that info is showing, adjust something, and see if the info dissapears | 04:21 |
| DrIP | i can not use internet... it *has* to be a serile server | 04:21 |
| kris_ph | andguent: yeah.. I tested it already.. and I detected it that it is showing its apache version and php information.. | 04:22 |
| kris_ph | andguent: that's why I'm going to modify it.. ") | 04:22 |
| andguent | DrIP: any special software you will need to install? are you able to sneaker net any extra needed debs from another location? | 04:22 |
| DrIP | andguent: i just need wireless for my internet... but i can't use ndiswrapper and the linksys WMP11 isn't supported :( | 04:24 |
| DrIP | (and yes, i'm trying to get a server on wireless | 04:24 |
| DrIP | ) | 04:24 |
| gregbrady | ok, I think it is set | 04:24 |
| gregbrady | should I logoff and back on to the network to be sure? | 04:24 |
| andguent | DrIP: http://www.ubuntu.com/getubuntu/downloadmirrors has dvd links at the bottom | 04:25 |
| gregbrady | ok, that did not work | 04:25 |
| DrIP | ahhhh | 04:25 |
| andguent | gregbrady: can you get a second computer available for IRC and then break your server network settings again so we can see how far it got? | 04:26 |
| DrIP | andguent: thanks :) | 04:26 |
| andguent | DrIP: np :) | 04:26 |
| gregbrady | I got as far as setting my static settings, then failure | 04:26 |
| gregbrady | system | 04:27 |
| gregbrady | admin | 04:27 |
| andguent | gregbrady: I'm assuming you are chatting from a different box then? is it still broken? | 04:27 |
| gregbrady | network | 04:27 |
| gregbrady | wireless connection | 04:27 |
| gregbrady | properties | 04:27 |
| gregbrady | uncheck roaming | 04:27 |
| andguent | yup, following.... if at all possible, it would be good if the sever was wired, but if it can't happen (and wireless has been working fine) then so be it | 04:28 |
| andguent | with you so far | 04:28 |
| gregbrady | again, server is wireless | 04:28 |
| gregbrady | Everything is wireless | 04:28 |
| andguent | it will work, as long as your wireless has been behaving :) | 04:29 |
| DrIP | andguent: eep those dvds are all client :| | 04:29 |
| andguent | DrIP: oh really? bleh, i thought there was a server edition | 04:29 |
| gregbrady | My wireless has worked for over 4 years, it should be ok today | 04:29 |
| DrIP | yea :( | 04:29 |
| DrIP | how can i get my server installed without internet... | 04:29 |
| kris_ph | Is there anybody here who uses phpsysinfo? | 04:30 |
| DrIP | brb... i need my lappy... | 04:30 |
| gregbrady | Then I find the Network Name, password type,password, I choose ip address subnet and so on | 04:30 |
| andguent | gregbrady: ok, where does the connection fail? | 04:30 |
| gregbrady | when I close and reconnect | 04:30 |
| gregbrady | It does not connect | 04:31 |
| gregbrady | you know what, this is probably a propriety driver problem | 04:31 |
| andguent | after hitting that reconnect, can you confirm the IP address was properly set via ifconfig? | 04:31 |
| gregbrady | that is why the lstp did not work | 04:31 |
| andguent | i couldn't tell you, it seems strange that any driver could do dhcp, but not static.... however it sounds like you have beat that bush to death already | 04:32 |
| DrIP | bbl | 04:33 |
| andguent | i assume youve double checked your gateway address, and still can't ping your gateway or anything? | 04:33 |
| gregbrady | yup, all my wireless cards across 6 machines in total are not supported | 04:33 |
| gregbrady | I have to use ndiswrapper, I believe | 04:34 |
| andguent | that still should allow static IPs though... | 04:34 |
| andguent | ....should.. | 04:34 |
| gregbrady | No, I came across this before | 04:34 |
| gregbrady | belkin+linux=no good | 04:35 |
| andguent | well, then i guess we stick with dhcp then, put it back to roaming | 04:35 |
| andguent | can you sign into your router and see about setting a dhcp reservation? anything you can do to prevent your server from changing IPs the better | 04:35 |
| gregbrady | no, too much of a pain for me as administrator to redirect when my server decides to change the address | 04:35 |
| gregbrady | Belkin has very simple, easy to use hardware. Not powerful but very easy to setup under Windows, Unfortunately | 04:37 |
| andguent | any basic router should have that option, as long as you don't change routers you won't have a problem.... even if you do, if we keep the setup simple, you will just have to go into firefox and disable the proxy to bypass | 04:37 |
| gregbrady | I remember that Windows handles this problem......Belkin writes drivers for it, but not Linux. | 04:41 |
| andguent | i'm assuming you are able to web into your router? | 04:41 |
| gregbrady | yup | 04:41 |
| andguent | have you confirmed that you can't set a reservation for your server? | 04:42 |
| gregbrady | yup | 04:42 |
| andguent | (sorry if ive asked this before) | 04:42 |
| andguent | bleh | 04:42 |
| andguent | i've never seen one not have the option in years, but I will leave it to Belkin to prove me wrong :) | 04:42 |
| gregbrady | Well, if you hear of a Belkin again, don't waste your time helping them out. | 04:43 |
| andguent | we still can do the internet filter, i just don't know how often your server box changes IPs | 04:44 |
| gregbrady | There is no VNC option, LSTP does not work, no internet filters and also no static ips | 04:44 |
| gregbrady | It kind of makes it secure! | 04:44 |
| andguent | no VNC?? are you able to do file sharing at all or anything? | 04:45 |
| gregbrady | nope | 04:45 |
| gregbrady | no tunnelling | 04:45 |
| andguent | can you ping another workstation? | 04:45 |
| gregbrady | yes | 04:45 |
| gregbrady | sorry, no vnc over the wan | 04:45 |
| andguent | try setting up firefox on another computer to use your server's proxy IP... | 04:45 |
| andguent | just for kicks | 04:46 |
| gregbrady | that will work | 04:46 |
| gregbrady | but if I try to setup a vnc from outside, no go | 04:46 |
| gregbrady | no settings for it | 04:46 |
| andguent | ok, i misread you then, that would seem like a basic feature, but it shouldn't stop your internet filter project | 04:47 |
| gregbrady | no, it will work, but it is us the the dns server to have the same address, or me running around making changes | 04:47 |
| gregbrady | *up to the dns server | 04:47 |
| andguent | the dns server is allowed to change, that shouldn't affect the filtering | 04:48 |
| gregbrady | no, just he proxy settings of all clients | 04:48 |
| andguent | even if name lookups go direct to the internet, the actual page loading will still be filtered | 04:48 |
| gregbrady | ok, hang on then, I misunderstand | 04:48 |
| andguent | i'm not sure if i'm understanding you... heh | 04:49 |
| gregbrady | ok, sorry..... | 04:49 |
| andguent | I will hold my tongue a sec, mind explaining what you mean once more? | 04:49 |
| gregbrady | the server will not have a set ip address | 04:49 |
| gregbrady | how can my clients find it? | 04:49 |
| gregbrady | hahaha, you can answer now! | 04:50 |
| andguent | normally, computers don't change IP very often, even if using DHCP | 04:50 |
| andguent | it does happen, but it shouldn't be a regular thing | 04:50 |
| gregbrady | ok, maybe I misunderstood, let's carry on then!!!! | 04:51 |
| andguent | i'm looking into dhcp client man pages now to see if there is a way you can keep it asking for the same address | 04:51 |
| gregbrady | I will also reseach, but let's carry on for now, agreed? | 04:51 |
| andguent | another option is to see if name lookups work properly on your network.... samba style name broadcasts may take care of your problem (set proxy filter IP to server name) | 04:52 |
| andguent | yes, carry on we shall :) | 04:52 |
| gregbrady | I seem to also have a problem with samba name lookups....they take forever | 04:52 |
| andguent | ok, squid works, lets get dans up and running, going back to the guide it says change one line, i think i want to do slightly more then that... | 04:53 |
| andguent | get yourself into that dansguardian.conf, we can page down together, i agree that you want to loose the UNCONFIGURED line | 04:54 |
| gregbrady | ok, let me get that far. | 04:55 |
| gregbrady | shoot, I lost the address for the instructions after the network loss...do you have what I sent you? | 04:56 |
| andguent | yup | 04:56 |
| andguent | https://wiki.ubuntu.com/EdubuntuProxy | 04:56 |
| gregbrady | yup, I'm into the editing | 05:00 |
| andguent | ok good, loose the UNCONFIGURED line if you havin't already, some other options in here are good to know about, but not required | 05:01 |
| andguent | loglevel = 3 is sometimes excessive, you can bump it down, but you start loosing track of what websites people have successfully gotten to | 05:02 |
| andguent | remember your /var/log/squid/access.log -- exact same concept, but for dans | 05:02 |
| gregbrady | ok, so save it? | 05:03 |
| andguent | i actually recommend one other change | 05:03 |
| gregbrady | ok, no problem | 05:03 |
| andguent | about 5-6 pages down (depending on page size), track down virusscan = on | 05:03 |
| andguent | this is a nice feature when it works, but leaving virusscanning on can cause headaches, and since you are all ubuntu, who the heck cares about viruses anyway? :) | 05:04 |
| gregbrady | it is on | 05:04 |
| andguent | turn it off, earmark it as something to tinker with later | 05:04 |
| gregbrady | I will turn it off | 05:04 |
| andguent | ok, save, quit that file | 05:05 |
| gregbrady | ok, saved | 05:05 |
| andguent | one more file that the guide doesn't touch.... same directory dansguardianf1.conf | 05:05 |
| andguent | in here, note how many other directories dans checks, that first page worth is just an fyi for things to browse through | 05:06 |
| andguent | naughtynesslimit is something to note and tweak later, especially if while visiting medical websites, you and your wife get denied too often | 05:07 |
| gregbrady | file not found | 05:07 |
| andguent | mmmm... /etc/dansguardian/dansguardianf1.conf ? | 05:07 |
| gregbrady | nevermind......(turning red) | 05:08 |
| andguent | its all good :P I'm amazed I'm still typing this coherently :) | 05:08 |
| gregbrady | I'm sorry to keep you up...... | 05:09 |
| gregbrady | I owe you a few drinks of choice | 05:09 |
| andguent | no no, quite alright | 05:09 |
| Wrathtide | would a LAMP server be suitable for usage as a file server? | 05:09 |
| andguent | amusingly enough, i havin't done this filter setup in a while, i need the practice | 05:09 |
| andguent | Wrathtide: it definitely can, but it will have extra programs running | 05:10 |
| andguent | as long as it is on a home network, and not exposed to the outside internet, it really doesn't matter either way -- do you trust the people on your network not to break your stuff? :) | 05:10 |
| gregbrady | I'm sorry guys, I appreciate the extra suggestions, but could we just keep it simple for tonight? We've been at it for hours....I'd love to learn further about all options though! | 05:11 |
| Wrathtide | andguent: they would break it if they could :\ | 05:11 |
| Wrathtide | inept fools, i just had to reformat the household pc | 05:11 |
| andguent | gregbrady: i'm assuming you got into dansguardianf1.conf? did you see my notes above? | 05:11 |
| gregbrady | oh yeah | 05:12 |
| gregbrady | and I'm ready | 05:12 |
| andguent | Wrathtide: in that case, just do the normal install, setup samba with password requirements or read only the whole way, drop the lamp | 05:12 |
| andguent | gregbrady: I have not experimented with bypass options, but it might be worth tinkering with later, especially if your wife doesn't have the sudo password on this box :) | 05:13 |
| gregbrady | she has sudo | 05:13 |
| Wrathtide | andguent: right now i have FreeNAS running an ssh server which is giving me better speeds than cif/nfs | 05:13 |
| gregbrady | (and other tools) | 05:13 |
| andguent | and virusscan reappears in this file, turn it off again for good measure (i think turning it off once is enough, but lets kill it until its dead) | 05:13 |
| Wrathtide | andguent: meh, ill just stick to freenas till i restore all the data back | 05:14 |
| andguent | Wrathtide: speed is good, if it does what you want, dont kill yourself on something new :) | 05:14 |
| Wrathtide | =) | 05:14 |
| Wrathtide | thanks | 05:14 |
| andguent | gregbrady: I think we are done with this file, save quit | 05:14 |
| gregbrady | done | 05:14 |
| andguent | ok, back to the guide, their next two steps sound good | 05:15 |
| andguent | start, ps aux, cross fingers (in no particular order) | 05:15 |
| andguent | sudo /etc/init.d/dansguardian start && ps aux | grep dansguardian | 05:15 |
| gregbrady | andguent...you are addressing whom? | 05:16 |
| andguent | gregbrady: you, sorry, i assumed the room went empty again :) | 05:16 |
| andguent | kgoetz: You still around? :) | 05:17 |
| gregbrady | ok, seems to have gone ok | 05:17 |
| andguent | good good, lets do my netstat test again: 'sudo netstat -ntlp|grep dans' | 05:17 |
| gregbrady | and now to test? | 05:17 |
| andguent | should give you 0.0.0.0:8080 | 05:17 |
| gregbrady | tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 27394/dansguardian | 05:17 |
| andguent | eeeeexcellent | 05:18 |
| gregbrady | I'm excited here! | 05:18 |
| andguent | go back to your firefox proxy settings, change the port from 3128 to 8080 | 05:18 |
| gregbrady | ok | 05:18 |
| andguent | after that, lets see if basic web visits still work | 05:18 |
| gregbrady | works ok....I hope that is a good thing! | 05:19 |
| andguent | if you have success, your web visit should be logged in two places: 'tail /var/log/dansguardian/access.log' and 'tail /var/log/squid/access.log | 05:20 |
| gregbrady | wooooooooooohoooooooooooooo | 05:21 |
| andguent | it might show a little differently, but your visit should get logged twice, telling you that your connection went through both programs | 05:21 |
| andguent | now for the real test: visit badboys.com | 05:21 |
| gregbrady | You are good! | 05:21 |
| andguent | you should get a big red NO SOUP FOR YOU message | 05:21 |
| gregbrady | Access denied | 05:22 |
| andguent | wonderful | 05:22 |
| andguent | you have a functioning internet filter | 05:22 |
| gregbrady | You are very very good! | 05:22 |
| andguent | :) I have practice | 05:22 |
| andguent | a few more tweaking files to consider... all in /etc/dansguardian: | 05:23 |
| gregbrady | I thank you for you understanding and putting up with my tantrums | 05:23 |
| kgoetz | andguent: sorry, yes i am | 05:23 |
| kgoetz | im/ rebuilding a system, so i'm paying attention to that | 05:24 |
| andguent | bannedexeceptionlist will cause some grief, will prevent you from downloading exe's, avi's, isos, and other sillyness, start commenting some of these out | 05:24 |
| andguent | kgoetz: no problem at all, just curious if anyone was watching | 05:24 |
| kgoetz | andguent: no, no one at all :) | 05:25 |
| andguent | gregbrady: Making sure you caught that file mention before I give more | 05:26 |
| gregbrady | andguent, you know what, I'm happy for today....thank you.......let's leave the rest until later! | 05:28 |
| kgoetz | exeptionsitelist is a good on too | 05:28 |
| kgoetz | incase it hasnt been meantioned ;) | 05:28 |
| andguent | definitely, i didn't want to dump my top 10 just yet, i think he might be off showing his wife or something :) | 05:28 |
| gregbrady | I hope it is ok if I come back here to learn again. You have been great. | 05:29 |
| andguent | bannedexceptionlist just drives me batty, especially on a network with hundreds of windows boxes and all I want is a stinkin driver download | 05:29 |
| andguent | yup yup, i probably will be around :) please read all of the file names in /etc/dansguardian and be aware they are there, if you want to block a site, or unblock a site, start there | 05:30 |
| andguent | like kgoetz mentioned, exceptionsitelist can be important (more so if you have windows boxes trying to hit updates.microsoft.com) | 05:30 |
| kgoetz | or archive.ubuntu.com ... | 05:31 |
| andguent | go nuts setting proxy server settings in firefox and see who hits the wall first :) I'm sure there are ways to be notified if someone gets a denied message | 05:31 |
| * kgoetz is afk for 20-3o min - getting mroe water | 05:32 | |
| andguent | also note what is within ./phraselists/, there are a lot of naughty words in there. I hear there are massive updated lists you can track down from somewhere, but i never got that far, the current setup does fairly well | 05:35 |
| gregbrady | shoot, now all my machines have no wireless access | 05:42 |
| andguent | uhhh, don't know what to do for you there.... reset the router? | 05:43 |
| gregbrady | nope | 05:43 |
| andguent | everything we did today should be completely opt-in, its not going to take anything over automatically | 05:44 |
| gregbrady | I think I will reinstall Linux on all machines and not worry about networking....it is not it's strong point. | 05:44 |
| gregbrady | Everytime I try to share directories or files in linux it is just a hassle | 05:45 |
| andguent | ?? uhm, ok seems like a lot of work, sorry to hear that wifi is such a pain | 05:45 |
| andguent | maybe tomorrow night we can play with samba :) | 05:45 |
| gregbrady | No, wifi under xp is no problem | 05:45 |
| kgoetz | wifi always has ben (and will b for th forseable future) a pain | 05:46 |
| kgoetz | *sp | 05:46 |
| gregbrady | nope, worked under xp with no issues | 05:46 |
| kgoetz | i'm not talking about xp... | 05:46 |
| gregbrady | oh, sorry | 05:46 |
| gregbrady | andguent, I appreciate the try though! | 05:47 |
| gregbrady | I have a ton of re-installing to do before I sleep! | 05:47 |
| andguent | are you wiping linux off or something? | 05:47 |
| andguent | or just reinstalling fresh | 05:47 |
| gregbrady | I need the protection working | 05:48 |
| kgoetz | pity you hav to use samba. | 05:48 |
| kgoetz | ssh/nfs are so much easier | 05:48 |
| andguent | i've always found samba easier, but ive also been playing with it for roughly 7 years more | 05:49 |
| gregbrady | No, I must go back to Windows! | 05:49 |
| kgoetz | andguent: how can samba posably be easier then anything else :o | 05:50 |
| andguent | just keep one linux box for the filtering, you said wifi worked fine for 4 years!! | 05:50 |
| gregbrady | andguent, on your belief, I will keep linux until tomorrow | 05:51 |
| andguent | if it worked for 4 years, one night down is ok, really it is :) | 05:51 |
| gregbrady | No, one night of porn....remember the reason | 05:51 |
| gregbrady | Any OS can direct all sites | 05:52 |
| andguent | samba: set share level, create share, set perms on share, samba restart -- i do it in my sleep | 05:52 |
| gregbrady | This seems to be a real hurt point for linux....if a solution can be found, maybe we could take advantage of it! | 05:53 |
| kgoetz | andguent: nfs: add share to export, optional extra controls, nfs reload | 05:53 |
| andguent | kgoetz: i'm sure its very easy, i've just never had a need, yeay for lowest common denomenator | 05:54 |
| kgoetz | andguent: heh, no joke | 05:55 |
| gregbrady | shoot, my internet is down except for the server now | 05:55 |
| kgoetz | ssh is better | 05:55 |
| andguent | ? | 05:55 |
| kgoetz | but lets leave that alone | 05:55 |
| andguent | when you say down, you mean before or after firefox got additional proxy filter settings? | 05:56 |
| kgoetz | bbs | 05:56 |
| andguent | via sshfs? fun toys there.... | 05:56 |
| andguent | samba seems to be able to pay bills better, most business users want windows, don't care what the server is as long as it works, nfs is only for linux users really.. | 05:57 |
| gregbrady | Shoot, the connection does not even come up | 05:58 |
| andguent | gregbrady: revert all browser proxy settings before assuming the connection is down :) if one is up, something must be working | 05:58 |
| andguent | ?? | 05:58 |
| kgoetz | andguent: s/linux/unix | 05:59 |
| kgoetz | sshd+unix desktops vfs== win | 05:59 |
| andguent | kgoetz: i stand corrected | 05:59 |
| gregbrady | no browser | 05:59 |
| andguent | well, sit corrected... | 05:59 |
| gregbrady | new boot | 05:59 |
| andguent | nfs is only for *nix users really.. | 06:00 |
| gregbrady | Ok, none of my 5 machines boots to a workable network now. I'm offline | 06:00 |
| andguent | gregbrady: ? how are you chatting? | 06:00 |
| gregbrady | why? | 06:01 |
| andguent | are you using one of those 5 computers for irc? | 06:01 |
| gregbrady | Yes, the server | 06:01 |
| gregbrady | good point | 06:02 |
| andguent | so, when you say the network is down, have you tested anything other than firefox? can anyone ping google? | 06:02 |
| gregbrady | I cant' get on the net | 06:02 |
| andguent | what message do you get when you ping www.google.com | 06:03 |
| gregbrady | I get ping results | 06:04 |
| andguent | ok, if it gives you numbers, then your wireless is fine | 06:04 |
| gregbrady | ok, so now it works! | 06:05 |
| gregbrady | Why is that? | 06:05 |
| andguent | when you were using firefox to get to a site, what message was it giving? was it saying proxy unavailable, or malformed url? | 06:06 |
| gregbrady | unavailable | 06:06 |
| andguent | if you have any wireless weirdness, web browsing will now see the weirdness twice as often.... everyone has to go to your server, and then back out to the internet | 06:06 |
| andguent | there are too many possible reasons why it dropped | 06:07 |
| gregbrady | Ok, so the solution is? | 06:07 |
| andguent | but if pinging google.com works, and the web browser doesn't, double check to make sure both filtering programs are running | 06:07 |
| andguent | also keep in mind, if you restarted the server, it may take a minute for squid and dans to finish starting up | 06:08 |
| gregbrady | No, all works well on the laptop....it just took 15 mins | 06:08 |
| andguent | dansguardian has an awful lot of data to search through in its own phraselists, squid is anal about its cache files, they both double check stuff on startup | 06:08 |
| andguent | did this happen immediately after the server restarted? | 06:09 |
| kris_ph | Hello... is there a way to prevent users from accessing restricted sites with the use of proxysites like www.anonymouse.org? | 06:09 |
| kgoetz | stop users getting to those sites? | 06:10 |
| andguent | i dont think anonymouse is trying to offer that type of feature, but i only glanced at the page just now | 06:11 |
| pnukeid | heloo there | 06:12 |
| gregbrady | I will have to pay back somehow, thanks! | 06:12 |
| pnukeid | i was trying to install mysql 5.1 from source | 06:12 |
| kgoetz | grrr. now i'm having network issues *grin* | 06:12 |
| kris_ph | yeah.. preventing them going to restricted sites using anonymouse.. a good proxysite is www.proxycentre.com | 06:12 |
| pnukeid | but i always have problem | 06:12 |
| pnukeid | anybody can help me ? | 06:12 |
| kris_ph | if the user knows that site.. even if in your firewall you denied them accessing friendster.com or youtube.com... they could still be able to access those sites.. | 06:13 |
| kgoetz | depends on your proxy | 06:13 |
| andguent | gregbrady: good luck, i might be back on tomorrow night, or there should be hundreds of other people able to help, just don't install XP, its baaaad :) Goodnight everyone, good luck on your projects | 06:14 |
| kris_ph | I don't think so.. IPcap can't even filter it... | 06:14 |
| kgoetz | ipcap being IP level? | 06:14 |
| gregbrady | andguent, you are correct, I just got fustrated@ | 06:14 |
| kris_ph | did you get what I mean? | 06:14 |
| kgoetz | kris_ph: i'm not sure i did | 06:15 |
| kgoetz | pnukeid: try #mysql, or are you installing from ubuntu source? | 06:15 |
| pnukeid | no i try install mysql from source | 06:16 |
| kgoetz | pnukeid: try #mysql | 06:16 |
| pnukeid | ok thx.. | 06:16 |
| kris_ph | kgoetz: okay.. this is the case.. I want users in the LAN as well as in WLAN not be able to access www.friendster.com and www.youtube.com since it is an educational institution...but when they will now using proxysites like those ones I mentioned....well too bad..they could gain access | 06:16 |
| kris_ph | *know | 06:17 |
| pnukeid | may be in here have experience with my problem too | 06:17 |
| kgoetz | kris_ph: i havent tried going to proxy sites in dans, so i dont know if it would catch stuff | 06:17 |
| * kgoetz tries it out | 06:17 | |
| kris_ph | kgoetz: okay..try it out.. and tell me what happens... | 06:18 |
| kgoetz | kris_ph: whats a proxy i can try and use? | 06:19 |
| kris_ph | kgoetz: in your router or in any firewall...try to deny users to access those sites... you try www.proxycentre.com | 06:19 |
| kris_ph | kgoetz: let's say... you block them accessing www.friendster.com then try to access www.friendster.com using www.proxycentre.com and tell me what happens.. | 06:20 |
| kgoetz | kris_ph: i cant see a place to put in a custom site. | 06:21 |
| kris_ph | kgoetz: ows.. I can't understand what you meant.. | 06:22 |
| kgoetz | kris_ph: i want to try and visit 4chan (i know my proxy will block that) - but i cant see a way to do that at proxycentre | 06:23 |
| kris_ph | kgoetz: in Enter the URL Address: you type the website URL ....then hit enter... and tell me what happens... | 06:25 |
| kris_ph | kgoetz: you could find Enter the URL Address: in the webpage of www.proxycentre.com | 06:25 |
| kgoetz | ah, i didnt see that option | 06:25 |
| kgoetz | kris_ph: dansguardian blocks this link (4chan) http://www.proxycentre.com/index.php?q=aHR0cDovL3d3dy40Y2hhbi5vcmcv | 06:27 |
| kgoetz | reason is: | 06:27 |
| kgoetz | ... has been denied for the following reason: | 06:27 |
| kgoetz | Weighted phrase limit exceeded. | 06:27 |
| kgoetz | "2008.3.15 16:56:26 - 192.168.0.2 http://www.proxycentre.com/index.php?q=aHR0cDovL3d3dy40Y2hhbi5vcmcv *DENIED* Weighted phrase limit of 50 : 240 " (i've cut off teh text it blocked on) | 06:28 |
| kgoetz | infact, using the proxy it was more sevearly blocked then without: " 2008.3.15 16:48:59 - 192.168.0.2 http://www.4chan.org/ *DENIED* Weighted phrase limit of 50 : 73" | 06:29 |
| kris_ph | kgoetz: you mean.. dansguardian was able to filter it? | 06:30 |
| kgoetz | kris_ph: i mean exactly that | 06:30 |
| * kgoetz wonders if he just shattered kris_ph 's filtering world | 06:45 | |
| * kgoetz must have | 07:01 | |
| MacKulkin | anybody knows how to make a streaming server on linux using ipcam ? | 07:49 |
| Jeeves_ | Morning | 08:02 |
| Jeeves_ | Does anyone know if rsync 3.0 will make it into hardy? | 08:06 |
| === MacKulkin is now known as MacKulkinn | ||
| === MacKulkinn is now known as MacKulkinnn | ||
| === MacKulkinnn is now known as MacKulkin | ||
| === MacKulkin is now known as Mackullkin | ||
| === Mackullkin is now known as MaccKulkin | ||
| === MaccKulkin is now known as MaacKulkin | ||
| === MaacKulkin is now known as MmacKulkin | ||
| === MmacKulkin is now known as |Quest| | ||
| === |Quest| is now known as MacKulkin | ||
| === MacKulkin is now known as |Quest| | ||
| === |Quest| is now known as MacKulkin | ||
| pschulz01 | Evening... | 10:22 |
| pschulz01 | Can anyone here recommend an SNMP tool that they actualll use? | 10:22 |
| pschulz01 | (I am using cacti for some stuff..) | 10:22 |
| === MacKulkin is now known as Mackkulin | ||
| kris_ph | Is there a way to automatically update the ubuntu box everyday by its own? | 11:48 |
| spiekey | hey! | 11:49 |
| spiekey | whats wrong with this interfaces config? http://pastebin.ca/ | 11:49 |
| spiekey | errr...http://pastebin.ca/943568 | 11:49 |
| nijaba | morning | 11:51 |
| spiekey | hi | 11:51 |
| spiekey | i get: SIOCSIFFLAGS: Cannot assign requested address | 11:52 |
| nijaba | kris_ph: just install unattended-upgrade | 11:52 |
| kris_ph | what are the pros and cons with it? | 11:53 |
| zul | pros you dont have to worry about it, cons you worry about it breaking your system | 12:44 |
| kris_ph | I've been receiving emails with these details: from Cron Daemon ; subject: Cron <smmsp@****> test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp; Message: /usr/share/sendmail/sendmail: line 875: /usr/sbin/sendmail-msp: No such file or directory | 13:14 |
| kris_ph | how would I solve it? I will not be using sendmail anymore... | 13:15 |
| kris_ph | >I've been receiving emails with these details: from Cron Daemon ; subject: Cron <smmsp@****> test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp; Message: /usr/share/sendmail/sendmail: line 875: /usr/sbin/sendmail-msp: No such file or directoryhow would I solve it? I will not be using sendmail anymore... | 13:18 |
| faulkes- | I take it you uninstalled sendmail via apt? | 13:33 |
| === joerlend__ is now known as XiXaQ | ||
| faulkes- | dpkg -P <package> | 13:35 |
| faulkes- | which should purge anything (like config files) which are still kicking around | 13:35 |
| === cjwatson_ is now known as cjwatson | ||
| faulkes- | nijaba: gonna grab a new copy of the survey and go after some of the recently submitted bugs | 13:58 |
| kris_ph | hello... can anybody here point me to a link with guide on how to install fastcgi in ubuntu gutsy? | 14:29 |
| gregbrady | good morning all. | 15:01 |
| gregbrady | Is there a good dansguardian log analyzer out there? | 15:14 |
| === joerlend_ is now known as XiXaQ | ||
| soulc | anyone here? | 17:03 |
| soulc | ahhhhh | 17:37 |
| soulc | anyone know how to fix the eyecandy stuff ? | 17:37 |
| gregbrady | Is there a way to set a computer running ubuntu up to use a proxy server, no matter what? I changed Firefox for my son, but then I see that he also uses other browsers, which defeat the purpose! | 19:19 |
| timboy | hey setting up dns here on my end my box's ip is 192.168.0.7 do I set that as nameserver in resolv.conf? | 19:49 |
| timboy | or do i set my isp's nameserver ip? | 19:50 |
| timboy | nevermind I got it | 19:51 |
| keithclark | Hey every one, what is going on? Pretty quiet in here! | 20:34 |
| keithclark | Kamping_Kaiser, this dansguardian is working wonders! Thanks! | 20:55 |
| takedown_ | hi, l'd like to now which more secure ubuntu or debian(not just out of the box), where security fixes comes faster or this same? I know ubuntu build with stack-protection features and have built-in apparmor support, when debian doesnt | 21:17 |
| takedown_ | or give me a link please for a objective comparsion | 21:20 |
| rgl | hi. | 22:30 |
| rgl | will hardy support xen out-of-box? | 22:31 |
| Kamping_Kaiser | rgl, being a xen client? i belive so | 22:35 |
| Kamping_Kaiser | takedown_, what sort of answer are you expecting in *ubuntu*-server? | 22:35 |
| Kamping_Kaiser | afk. heading out | 22:36 |
| rgl | Kamping_Kaiser, being a dom0. the xen packages seem to live in "universe" rather than in the normal archive :/ | 22:36 |
| Kamping_Kaiser | rgl, is dom0 a host or.../ | 22:36 |
| Kamping_Kaiser | s#/#? | 22:36 |
| takedown_ | Kamping_Kaiser: idk, whatever | 22:37 |
| rgl | Kamping_Kaiser, dom0 is the host. domU is the guest(?). | 22:37 |
| Kamping_Kaiser | rgl, host i'm not sure about, but i expect it will | 22:37 |
| soneil | rgl, I gather it's totally workable, just not the "supported" option. ubuntu are going with kvm, but nothing stopping you using xen | 22:37 |
| rgl | soneil, oh I found the https://wiki.ubuntu.com/UbuntuWeeklyNewsletter/Issue76 which says just that. thx. | 22:38 |
| alstone | ah here we are | 22:54 |
| alstone | how do I get the distro name plz? | 23:03 |
| ScottK2 | alstone: Look in /etc/lsb-release | 23:04 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!