[00:00] kirkland: I'm on my livecd, help me CHROOT into my server install? [00:00] kirkland: putting on my sysadmin hat, I am not sure there is a sane default [00:01] we don't have a server that we can target our authentication/authorization lookups against [00:01] as such, it's all manual [00:02] kirkland: I'm on my livecd, help me CHROOT into my server install? Please? [00:02] jdstrand: i was thinking we should allow users with uid Invisionfree: are you at a command prompt? [00:02] Terminal, and by the time you tell me what to type I will be :P [00:03] kirkland: right, I understand, but what is 'N'-- some people may want to override some groups/users for some reason [00:03] Invisionfree: do you know the device that has your / partition? [00:03] hda1 [00:03] jdstrand: at the very least 0/root [00:03] jdstrand: i don't there's ever a case where root would ONLY exist in LDAP [00:03] kirkland: no, that is true [00:03] Invisionfree: mount /dev/hda1 /mnt [00:03] Invisionfree: chroot /mnt [00:04] kirkland: but, you can't get that fine-grained with libc/nss lookups, only pam [00:04] jdstrand: i know, i know, inadvisable to login as root [00:05] jdstrand: perhaps users in the admin group? [00:05] jdstrand: we specify those in pam [00:05] kirkland: yeah, pam_krb5 has a minimum_uid setting [00:05] eg account sufficient pam_krb5.so minimum_uid=1001 [00:05] I'm checking pam_ldap now, but am almost 100% it has it too [00:05] jdstrand: that's kinda the opposite, though [00:06] * kirkland smacks kirkland, nevermind [00:06] * Invisionfree smacks kirkland for the hell of it [00:06] :D [00:10] kirkland: man pam_ldap-- ignore_unknown_user [00:23] is it pam or nss thats causing the issue on boot? [00:54] Help [00:54] bipolar? [00:55] hmm? [00:55] The following packages have unmet dependencies: [00:55] libsasl2-modules-gssapi-heimdal: Depends: libsasl2-modules (= 2.1.22.dfsg1-12) but 2.1.22.dfsg1-9ubuntu2 is to be installed [00:55] E: Broken packages [00:55] How do I fix that? [00:55] how did you get there? [00:55] A Debian shell script to install ldap [00:56] umm.... what shell script? [00:56] http://noc.cluenet.org/distconf2.allinone.sh [00:57] that script calls other scripts. it must be part of a package you downloaded. [00:58] How do I get that version it needs? [00:58] it probbly doesn't work on ubuntu [00:58] .. [00:58] All it needs is a different version, why the hell wouldn't it? [00:59] ubuntu packages aren't always exact replicas of the debian packages with different numbers on them [01:00] Invisionfree: are you running gutsy? [01:00] Yes. [01:01] Invisionfree: the first thing I would try is running 'apt-get -f install' just to see if it can clean itself up. [01:01] I did, no solve. [01:04] libsasl2-modules-gssapi-heimdal may be broken [01:04] packages.ubuntu.org says exactly the same thing apt is telling you [01:05] it requres libsasl2-modules (= 2.1.22.dfsg1-12) but ubuntu has libsasl2-modules (2.1.22.dfsg1-9ubuntu2) [01:05] I would remove that package, unless you absolutly need it. [01:05] I absolutely need it. [01:06] I'm afriaid your screwed [01:06] would rebuilding it from the source package (And modifying it's dependancy manually) resolve this? [01:07] or at least, get past the dependancy issue (while potentially creating new issues down the line) [01:08] it's strange, the universe package looks newer then the non-universe one. [01:08] bipolar: [01:08] E: Version '2.1.22.dfsg1-12' for 'libsasl2-modules' was not found [01:08] yes, because 2.1.22.dfsg1-9ubuntu2 is what is available [01:09] How can I get that version then.. [01:10] You would need to download the source package, modify it's config file, and recompile [01:11] that version is not in the repositories [01:11] which is strange. [01:13] Maybe you could download the deb, and install it manualy [01:14] tell dpkg to ignore dependancys [01:15] Invisionfree: here is someone else with the same issue: http://ubuntuforums.org/showthread.php?t=599141 [01:16] Invisionfree: and there is already a bug reported for this issue: https://bugs.launchpad.net/ubuntu/+source/cyrus-sasl2-heimdal/+bug/157035 [01:16] Launchpad bug 157035 in cyrus-sasl2-heimdal "libsasl2-modules-gssapi-heimdal not installable" [Undecided,Fix released] [01:17] looks like it's fixed for Hardy [01:19] ok so im working on getting a wap setup... iv followed a few guides and am stuck... i can connect to the network, and when i try to ping to the outside world, dns resolves the ip address but no ping [01:19] any ideas? [01:21] is IP forwarding enabled? [01:22] is WAP a wireless access point? if so, do you need to NAT wireless clients (have you got appropriate rules in iptables for this?) [01:23] if dns works but not the ping... ip tables? bridge? [01:23] yes ip fowarding is [01:23] i have these ip table rules.... [01:23] * Deeps hopes he pastebins [01:24] you can dump nice output using iptables-save (if no args specified it outputs on stdout) [01:25] k just a sec [01:26] http://pastebin.com/dbc2e250 [01:29] ok, which is your lan interface, which is your external interface, and is your wireless point a wireless card in your linux machine, or an external wap connected within your lan? [01:30] eth0 is the lan connected to the internet; ath0 is the wap (in this linux machine) [01:30] and eth1? [01:31] actually nm, eth0 always matches first [01:32] from a wireless client, can you ping a) the ip assigned to ath0, b) the ip assigned to eth0? [01:32] i can ping 10.1.1.1 which is the network setup by ath0 [01:32] not 192.168.1.44 the ip address assigned to eth0 [01:34] but when i ping (for example www.google.com); it resolves the ip address, just no return ping [01:34] what's your nameserver ip? [01:34] same as ath0? [01:35] nameserver is 192.168.1.1; the network assigned to eth0 [01:36] what OS on the wireless client? [01:36] ubuntu desktop [01:37] same thing happens with windows though [01:37] tested both [01:37] my thought was that it was possible that dns was being cached from an earlier state [01:38] no, i thought that too, but google has so many different addresses that it changes per each ping almost... [01:38] so i dont know what is stopping me [01:38] what's the output of route -n [01:39] from what you've told me, unless i'm being dense, it should look like: [01:39] 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 [01:39] 10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 ath0 [01:39] 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0 [01:40] yup [01:40] exactly except on eth0 flags = UG; Metric = 100 [01:41] you dont have any other routes for destination 0.0.0.0? [01:42] ok, double check that "cat /proc/sys/net/ipv4/ip_forward" returns 1 [01:42] and possibly cat /proc/sys/net/ipv4/ip_dynaddr" also returns 1, if your WAN ip isn't static [01:43] 2nd command returns 0 [01:43] 1st command returns 0 [01:44] ok, if the 1st returns 0, then that's definately your problem, you dont have IP forwarding enabled (the first thing i asked ;) [01:44] echo 1 > /proc/sys/net/ipv4/ip_forward [01:44] and try your pings again [01:44] hold on a sec, this is what i did to enable it... (i thought i had it on, oops) [01:45] nano /etc/sysctl.conf [01:45] net.ipv4.conf.forwarding=1 [01:46] that'll enable it at startup [01:46] so if you've not rebooted, you still need to enable it now [01:46] either through /proc/sys [01:46] and i restarted... any idea why that didnt work? [01:46] or through calling sysctl [01:47] oh [01:47] oh, that looks like the ipv6 forwarding [01:47] in ipv6, its net.ipv6.conf.forwarding, in ipv4, it's net.ipv4.ip_forward [01:48] although you can do the conf route too, you need to specify the interface(s) you want to enable forwarding on [01:48] minus the .conf and foward instead of fowarding? [01:48] cd /proc/sys/net/ipv4 [01:48] see the files that exist in there [01:49] follows the same hierarchy as the sysctl calls [01:49] i suspect net.ipv4.ip_forward=1 and net.ipv4.conf.all.forwarding=1 both do the same thing [01:50] just a sec, let me see if those changes changes fixed the problem [01:50] if echo 1 > /proc/sys/net/ipv4/ip_forward [01:50] has resolved your problem, then that was definately it [01:52] sure did [01:52] so how do i make those changes permanent? [01:52] cool worked [01:52] modify your /etc/sysctl.conf to contain net.ipv4.ip_forward=1 [01:52] instead of net.ipv4.conf.forwarding=1 [01:52] so how do i make those changes permanent? [01:52] save the file? [01:53] ctrl+x i think, Y, enter [01:53] and thats it? [01:53] pretty much [01:54] with that setup i have for ipconfig, does that allow everything through without any restrictions? im pretty new to ipconfig... [01:54] iptables? [01:55] sorry, yea [01:56] http://pastebin.com/m53f1d0d0 [01:56] i've removed the 'eth1' entries [01:56] i'm not sure what that is, but having a second masquerade rule isn't going to be matched against anyway [01:57] urrr [01:57] mistakes in there [01:57] http://pastebin.com/m5c04e4f9 [01:57] line 19: should be -o ath0 and not -d ath0 [01:58] ic k [01:59] so will those rules allow anything other than port 80 through? [01:59] those rules will allow everything, and log port 80 [01:59] twice [02:00] ahh yea, so i need to delete line 16 also then [02:01] if you only want it logged once, and then the connection dropped: [02:01] http://pastebin.com/pastebin.php?diff=m55773a4e [02:01] i guess [02:02] well i want everything fowarded through so i can use it like it were attached to any other server [02:02] btw, i really appreciate the assistance [02:02] then remove the DROP line [02:02] line 17 [02:03] k [02:03] when dumping traffic, 2 easy ways to do it is with -j DROP or -j REJECT [02:03] DROP silently drops the packets, resulting in a timeout [02:03] REJECT dumps the traffic and responds with an icmp unreachable [02:04] so the other machine knows fairly quickly that the connection cant be made [02:04] ok so when i start closing the ports up to secure it, use one of the two... [02:05] the approach i tend to take is drop all, accept specific ports that i want [02:05] is there a good guide to getting all that setup? [02:06] no idea [02:06] i went from getting a chat like this to google to giving this chat, heh. [02:07] i want everything between the wap --> clients open and then close things off between the server and the internet [02:07] so you just googled all this? [02:07] no, when i was in your position i spent a lot of time on google [02:07] finding and reading guides [02:08] ohh ok [02:08] i was going to say, thats pretty impressive if you did, lol [02:08] hell, i still do, trying to work out routing between multiple links [02:08] so... http://pastebin.com/m5c04e4f9 will allow all the traffic between the wap & client? [02:09] yep [02:10] the best approach is to play around [02:10] worst that can happen is you prevent any traffic from reaching the machine [02:10] sweet... so whats the basics to disabling ports, if lets say i wanted to disable ports on eth0? or even easier to allow just a select number of ports? [02:10] yea [02:10] given that it's local, hook up and keyboard + monitor and undo it [02:11] well you want to drop all traffic coming into eth0 [02:11] but still allow inbound traffic with state related,established, otherwise you wont get any replies from remote machines when you make requests [02:11] (like you've done with clients behind ath0) [02:12] (only it's not forwarding data now, its incoming data to that machine) [02:12] and then to allow specific ports, -I INPUT -p --dport [02:13] so with my iptables now everything is being fowarded to ath0 and skipping eth0? [02:13] eg -I INPUT -p tcp --dport 1000:2000 would allow input to ports 1000-2000 inclusive [02:13] no, if a wireless client requests, say, a webpage [02:14] wifi client [request] -> ath0 -[nat]-> eth0 -> [interweb] [02:14] [interweb responds] -> eth0 -[nat, state related/established]-> ath0 -> wireless client [02:15] [interweb tries to create new connection] -> eth0 -> [if there's a service running on the target port, it handles it, if not, it rejects the request] [02:15] in your current state [02:16] k, so if lets say [client outside network] ---ssh request--> [eth0 responds by default] [02:16] indeed [02:17] in your current setup, anyone able to reach the machine will be able to get a response from ssh [02:18] oh, be careful, if you set a root password on your machine (instead of using sudo), it's worth updating yor /etc/ssh/sshd_config to reflect PermitRootLogin no (defaults to yes) [02:18] your* [02:18] gotcha, so the basics are that if a wireless client makes a request, it can get that specific request back... [02:18] yep. [02:19] so lets say i just want to only allow specific ports period to eth0, which command would i use in iptables? [02:19] 02:11:09 < Deeps> well you want to drop all traffic coming into eth0 [02:20] 02:11:27 < Deeps> but still allow inbound traffic with state related,established, otherwise you wont get any replies from remote machines when you make requests [02:20] 02:11:49 < Deeps> (like you've done with clients behind ath0) [02:20] 02:12:06 < Deeps> (only it's not forwarding data now, its incoming data to that machine) [02:20] 02:12:49 < Deeps> and then to allow specific ports, -I INPUT -p --dport [02:20] ahh ok, i thought that was a little different [02:21] http://pastebin.com/m2439a18e [02:21] things i've changed: your default INPUT policy to REJECT [02:21] added a rule to allow tcp/22 from anywhere [02:22] and allowing all established traffic already back in [02:23] so if i send a request out for something, it all can come back... except for ssh, which can recieve also [02:23] just trying to get this straight [02:23] that said, i dont think you can set polciy to reject [02:24] so you probably wanna change that to DROP [02:24] that's correct [02:24] means ssh can listen for new connections [02:24] while any other random ports cant, they can only listen for established connections already [02:25] will this setup cause any complications if... i run a file server off of that box, just for the wireless clients? [02:25] shouldn't do [02:25] k so change :INPUT REJECT to :INPUT DROP [02:25] yep [02:25] you can dump all of that in a file btw (remove the line numbers) [02:25] and then iptables-restore < /path/to/file [02:25] to have your rules replaced entirely [02:26] iptables-save > /path/to/file to see what the file should look like [02:27] if you don't mind me asking, what are you using your box for? [02:27] which one? [02:27] heh [02:28] most closely matched to you, i've got one routing my adsl connection [02:28] haha [02:28] usb adsl modem, 2 10/100 ethernet nics [02:29] then you set a server behind that? [02:29] no, that is the server [02:30] server has the usb adsl modem plugged into it, so my wan ip presents itself on atm0 [02:30] my local lan is on eth0, and the flat downstairs is on eth1 [02:31] the box doesn't do much eles [02:31] icic, so what kinda servers are you running? [02:31] I know this is slightly off topic but I was wondering if anyone could tell me from your experience which hardware raid has been faster 5 or 10? [02:31] mrtg graphing, simple web serving from there [02:32] nullbnx: got a few boxes online that i used to host services on for friends and family [02:32] currently sitting idle as i cant think of anything to do with them anymore [02:33] lol ic [02:33] well i appreciate the help [02:34] no problem [02:34] * Kamping_Kaiser puts his ubuntu mirror on a diet [02:34] im thinking about putting my removable (usb) hard drive on the server and using samba to share it [02:34] wonder how much room i'll have after this :D [02:34] gl [02:35] any advice? [02:35] guides on how to use samba are on ubuntu.com :) [02:35] haha i know how to do that [02:35] most of the problems you'll encounter have already been resolved on ubuntuforums.org [02:35] i think ill remove all permissions other than read after mounting the hard drive (other than read) so i dont risk someone removing anything [02:39] hmmm oops, xorg crashed on me [02:40] do you need to restart before iptables become active? [02:41] you never need to restart [02:41] unless you've installed a new kernel (and even that has ways around it) [02:42] you can either apply the rules manually, or you can apply the through iptables-restore as i explained earlier [02:42] so the new iptables should be good to go? [02:42] i applied the tables in the .conf, and thats it? [02:42] in which conf? [02:42] iptables.conf [02:42] there's an iptables.conf? [02:43] /etc/iptables.conf [02:43] ok, you've created that yourself [02:43] yea, i was just following a guide [02:44] ok, well then i'd recommend finishing that guide as to how to apply the rules [02:44] if you've used the same format as would be generated by using iptables-save, you can apply the rules with iptables-restore < /etc/iptables.conf [02:47] i found what looks to be a pretty good guide, im going to read a whole bunch... i appreciate the help [02:48] Good plan! A well written guide will do more for you than I can. :) [02:48] you checked out 8.04 yet? [02:49] nope, i dont do well with beta software, barely have the patience for stuff that's considerred stable, heh [02:50] lol [02:50] im just wondering how secure 8.04 will be when it first comes out... [02:50] has me a little worried, i might upgrade my lappy but not the server [02:51] not sure if this usb port is USB 1.1 or 2 :S. deleting 40gb at 40mb/s will take a while [02:51] wouldn't worry about that kind of thing, security is rarely a concern with new releases, stability on the other hand... [02:51] that and the upgrade process [02:52] i kid, ubuntu's been through many upgrade cycles now, i'd expect the gutsy->hardy upgrade to be as smooth as a baby's bottom [02:52] ..within a month of release, at least, heh. [02:52] heh [02:53] yea... do you have any other recommendations for the server security other than iptables n no root ssh [02:53] hah, well i was reading around, seems like they got it well setup bc so many brave souls tried the beta & upgrading [02:54] dont run lots of random daemons that you dont need, if you do run them, have them bind only to interfaces that need them (ie, if it's only that machine, bind to localhost, if it's only for wireless clients, to ath0's ip, etc.) [02:55] have a strong secure password, dont give shell access to anyone you cant trust until you've learnt to harden up the machine [02:55] make sure you apt-get update + upgrade regularly [02:55] dont forget to lock your machine when you're not at it ;) [02:55] dont leave root shells lying around ;) [02:55] lol, i knew #2, 3, 4, 5 [02:55] ill have to look into bind [02:56] bind has 2 meanings [02:56] pretty easy to setup bind? [02:56] bind, the application [02:56] ScottK: you around? [02:56] or binding to interfaces, where an application picks what IPs to accept connections on [02:57] is there a quick and easy way to do that? [02:57] eg, chances are your ssh server is listening for connections on 0.0.0.0:22 (and ::22 if you have ipv6 enabled), ie, all interfaces [02:57] lamont: Yes. [02:57] I'm looking at the delta between 2.5.2-rc{1,2}.... [02:57] however, if you need, say, an snmp daemon, but only for local logging/monitoring purposes, you'd configure it to only listen on 127.0.0.1 (localhost) [02:57] OK. [02:58] each application has it's own configuration file [02:58] ic [02:58] sudo netstat -anp will show you all applications that are running, sockets that they're using, sockets that they're listening on [02:58] if we pulled the warn_if_reject check back into 2.5.1-ubuntu, is it worth separating out the qmgr fix that's there as well? [02:59] my life would be easier if Wietse just released 2.5.2 [02:59] lamont: I don't know. I was aware of the warn if reject one because it was discussed on the ML. [02:59] * ScottK just got back into down and just downloaded 1749 new mails. [02:59] heh [03:01] deeps, well iv only got ssh and named available to all..., so prolly not a huge problem [03:01] lamont: Without looking, I'd say upload the RC and we'll deal with it. [03:01] deeps, prolly don't need named to the outside either [03:01] lamont: Then if it's not released before we do, just SRU to the final. [03:01] I really don't want an RC in the LTS... [03:02] the alternative is to upload a 2.5.1 that happens to have a few backported fixes. [03:02] bzr commit -m'[LJ, trivial] dist-upgrade' [03:02] my favorite commit ever [03:02] Yeah, and then if 2.5.2 happens to make it, we go with it, if not, oh well. [03:03] * lamont will stare at the diff en toto, and then maybe poke you again in a bit. [03:03] K [03:08] what would be the purpose of running a dns server on a home server? === thesyko is now known as lilsyko [03:09] nullbnx: learning [03:09] Nafallo, haha other than that... [03:10] nullbnx: and well... the "because I can" thing is usually a strong one as well :-) [03:10] Nafallo, haha, so no real use running named in a network that looks like this... [03:11] nullbnx: well... caching would be good I guess :-) [03:11] depends on if you use to go to the same addresses a ot. [03:11] lot even [03:12] [internet] <---> [dsl modem] <----> [ubunut server (home network) w/ named] <----> [wireless clients] [03:12] (named was installed during installation by accident and im debating shutting it down [03:12] ) [03:13] :-P [03:14] from my lan: [03:14] chocha.truman.lan has address 192.168.1.49 [03:14] 49.1.168.192.in-addr.arpa domain name pointer chocha.truman.lan. [03:14] forward and reverse dns created automatically by dhcpd when it assigns the client's IP [03:14] reverse dns is almost entirely asthetic, forward proves useful if i want to connect to another machine, e.g. one not using NetBIOS [03:15] can connect to it's name rather than trying to work out it's ip [03:15] yea, so no real point... [03:16] i have dhcp set up also, and that takes care of everything internally [03:18] what does bind9 do? [03:20] dns [03:20] what you're calling named [03:20] (that's the user it runs as ) [03:21] ok thats what i thought, how do stop it from starting during boot? [03:21] i know i can stop it by /etc/init.d/bind9 stop [03:29] update-rc.d [03:29] update-rc.d -f bind9 remove [03:32] can you setup wpa on a wap? [03:32] i dont see why not [03:33] hopefully this works... [03:35] hello? [03:36] heyt [03:36] hello I am having trouble with an Ubuntu mysql server [03:37] I am getting a "cannot connect to remote server" error upon attempting to connect remotely to it [03:37] I can ping it and access it locally, but not remotely [03:37] there is no firewaill between the 2 LAN'd machines [03:37] any suggestions? [03:38] do you connect through a cable/dsl modem/router? [03:38] no, they are on a LAN [03:38] TCP/IP, same subnet [03:39] can ping each other [03:39] and your sure that you dont have iptables (the default ubuntu firewall) blocking you? [03:39] no, the only firewall is the NAT router itself [03:40] between the servers and the internet [03:40] hmmmm not to sure then.... [03:43] how would i be able to monitor what computers are connecting through my server? [03:44] by IP? try netstat [03:44] see the man page [03:44] also try snort [03:44] for logging [03:47] thanks =) [03:47] netstat by itself doesnt show it... [03:48] my computer is a access points other pcs connect through, im trying to figure out which pcs (by ip) are connecting [04:49] ScottK: 214933: sounds like 'fix released' to me... :) [04:57] can anyone recommend me a CLI download accelerator that allows you to use http basic authentication? Axel is great apart from that last point... can't find anything on how to to the authentication with it [05:07] Hi, how can I grant sudo access to LDAP users? [05:08] I have Ubuntu with Likewise, and can log in fine, bu must log in as local account to do admin activities. This is inconvenient. [05:08] There must be a way to add some group to sudoers. [05:08] . [05:08] ? [06:29] hello.. how to make ubuntu to fuse two separate networks? === SinTux is now known as Syntux [08:08] moin [09:06] anyone had any experience with IRC proxys? [09:06] * Kamping_Kaiser waves [09:06] no i havent, but hello [09:06] lol hiya kamping [09:07] yeah, i'm using U! [09:07] I can't imagine that its that hard to setup... I hope [09:08] n6rej: in which case? [09:08] I don't get though how connecting to the server via SSH would hep? [09:08]