[00:25] !ebox [00:25] ebox is a web-based GUI interface for administering a server. It is designed to work with Ubuntu/Debian style configuration management. See https://help.ubuntu.com/community/eBox [00:45] Deeps following the DHCP conversation we had, there's no way of define different subnets behind the same router using DHCP right? Is just that I keep reading examples of people that define a subnet by just changing one part of the IP address, which lead me to think that the machines in the example are behind the same router. for example here: http://en.wikipedia.org/wiki/Subnetwork#Subnets_and_host_count or here http://searchnetworking.techta [00:45] rget.com/sDefinition/0,,sid7_gci213065,00.html [00:45] sorry: http://searchnetworking.techtarget.com/sDefinition/0,,sid7_gci213065,00.html [00:46] in my house i have 1 router and 3 subnets [00:47] the router has 3 network interfaces though [00:48] if you're attempting to use a single router with a single network interface, you need vlan aware switches between your router and your clients [00:51] Deeps that's supported by any router? multiple interfaces? because I can't find it in mine [00:53] i have 3 network cards in my router [00:53] with 3 wires coming out [00:53] ok [00:54] eth0 runs to the gbit switch for wired connections, eth1 to the wireless access point, eth2 to the neighbours flat [00:55] (we'll skip past the atm, sit, tap and tun interfaces, heh) [00:57] ok, that explain it to me, thanks [00:58] I just wanted to know which are the posibilities [00:58] how come you need multiple subnets? [01:06] I don't need it. I just didn't knew how could I set differents subnets behind one router [01:06] since the definitions and examples I found lead me to think that, was pretty confusing [01:06] very* === jjesse_ is now known as jjesse [02:40] New bug: #230147 in openssh (main) "package openssh-server 1:4.7p1-8ubuntu1.1 failed to install/upgrade: " [Undecided,New] https://launchpad.net/bugs/230147 [03:15] I'm going to install xubuntu on my server as a sort of backup/mantaince mode, should i install ubuntu-server then the xubuntu metapackage, or install from the xubuntu (from the alt cd if it matters) and then switch to the server kernel? [03:18] up to you [03:18] So it doesn't make a difference? [03:21] Ashfire908: I'd highly recommend not installing a gui on your server ... but if you must ... install ubuntu-server first, and then xfce on top of it [03:22] Well this is not going to be the primary system [03:22] there's nothing useful about a gui for "backup/maintenance" -- in fact, it's likely to break far more often than the rest of the OS [03:23] I will/have use/used it to do full backups of the drives and to do stuuf like manual fsck..... [03:23] that's not related to xfce though, nor can it be done with xfce [03:24] what does it matter if when i'm using that system if it has a gui? [03:24] I'm not going to run services while in it. [03:25] alright ... I have no idea what you're talking about now [03:25] but go ahead [03:25] i'm installing a second os onto the server, and it's only going to be used to do stuff that i mentioned. [03:26] wait, a second OS? [03:26] second install of ubuntu [03:26] you mean, you're planning to dual-boot different installs of ubuntu? [03:27] one is a gui-less ubuntu server hardy, for when running it normally, then a second for only mantinece stuff of ubutnu server/xubuntu [03:27] there's really no need to do that [03:27] it's excessive, and will add to management time, security update efforts, and a whole host of things [03:28] a) you don't need a separate OS to do anything you've described ... b) for the things you've described, separating partitions would be the best way to handle fsck and backup/permissions issues on partitions [03:29] c) if you really did need a separate os ... a live cd would be much better for those instances than an entire install [03:29] ubuntu livecds fail at boot [03:29] what command should i be occasionly running to do security updates? [03:29] they drop into busybox, and fail to fully create the file system [03:29] it doesn't need to be an ubuntu cd -- but you don't need a separate OS to do anything you've described [03:30] slicslak: apt-get update && apt-get upgrade (as root) [03:30] fine, whatever. [03:30] but ... I wouldn't really advise putting that in cron, if that's what you're planning [03:30] put what in cron? [03:31] that was directed at slicslak [03:31] oh [03:31] lol [03:31] sorry [03:32] giovani, thanks. just read https://lists.ubuntu.com/archives/ubuntu-security-announce/2008-May/000705.html it seems after upgrading i just need to restart ssh server and it iwll generate new keys correct? [03:32] slicslak: you'll need to do an -- apt-get update && apt-get dist-upgrade for that particular security update (because it installs a new package, rather than just updated ones) [03:32] Ok everyone, I don't know where else to turn here. I have a mySQL database on a server that does not allow remote access to it. I need to be able to access it via OpenOffice Base but I have no idea how to go about that! Is there a way to import/address the .sql backup file? [03:33] yes, it will restart the ssh server, and regenerate for you ... it'll notify you ... so you can't do it in an automated fashion [03:33] When i boot i get an error about an address not initialized, and to update the bios or force the addr. [03:33] Ashfire908: I wouldn't know anything about the ubuntu live cd ... it's hardly the best option for server mainenance -- something with a lot of disk-fixing tools oriented at server-rescue would be better [03:34] wow! ya, it really get's your attention on [03:34] no, this is at normal hard drive install. [03:34] *at a [03:34] Ashfire908: you should be using the alternate install cd [03:34] I do. [03:34] so the install cd isn't functioning at all? [03:34] no [03:35] this is with the already installed system [03:35] did you check the md5 of the iso? and verify the burn? [03:35] wait, are you trying to boot from the install cd? [03:35] no [03:35] i've already installed [03:35] the atl and server cds work fine. [03:35] then what are you trying to do? [03:36] It's a notice on boot. [03:36] in the section where it loads the drives [03:36] *drivers [03:36] does it fail to boot? [03:36] or does it just issue a warning, and continue? [03:36] issues a warning [03:37] then I suggest you get a word-for-word copy of the error, and bring it here [03:37] the server also temp. hangs at one of two places at boot. [03:37] one sec... [03:37] er about 3 min [03:41] I took a picture, one sec [03:44] piix4_smbus 0000:00:f.0: SMB base address uninitialized - upgrade BIOS or use force_addr=0xaddr [03:44] (I removed the kernel timestamp from the front of it) [03:45] During boot it either hangs for a bit after displaying that message, or after "Loading, please wait..." [03:48] well I'd take out the situation-specific parts of the errors ... and google it [03:48] i am [03:49] -- piix4_smbus SMB base address uninitialized upgrade BIOS -- should suffice as a search term [04:05] Do you know is force_addr is a kernel/boot option? [04:09] nvm [04:20] with the openssl bug fixed today there's nothing to do to the apache certificates ?? [04:25] These are SSL/TLS certificates? [04:25] ScottK: are the https certs [04:26] Yes. It does affect those. [04:26] ScottK: so we need to regenerate those certs ? [04:27] ScottK: or just reload with the new openssl? [04:27] Both. [04:32] ScottK: I know that when using public key auth the attacker can log on the system but for https ?? what can be done ? [04:32] leonel: you can check your private key with openssl-vulnkey. If it is ok, than you do not need to regenerate [04:33] leonel: Ask yourself why you have https and would you care if you didn't all of a sudden. [04:33] If the key is vulnerable ... [04:33] leonel: it is part of the openssl-blacklist package [04:33] dendrobates-: thanks [04:34] ScottK: so for the attack on https the attacker needs to be in the middle and can decrypt the data ?? [04:35] leonel: that or a tcpdump of the session. and then they would have to brute force it. [04:35] leonel: Yes. But for the attacks https is meant to defend against, that's always the case. [04:36] dendrobates-: openssl-blacklist ?? or is openssh-blacklist ? [04:36] One sarcastic comment from another forum today, "I wouldn't worry too much about SSH key cracking. It's not like the bad-guys have access to millions of compromised CPUs......" [04:37] dendrobates-: Is that going to work for X.509 certs (openssl-vulnkey)? [04:37] leonel: openssl-vulnkey for ssl keys and ssh-vulnkey for ssh keys [04:38] Ah. [04:38] ScottK: it should work on the private key that encrypts the cert, so yes. [04:38] OK. [04:39] Maybe in my copious free time I'll go into my backups and check. By the time those were out today, I'd already regenerated everything. [04:40] dendrobates-: I'm guessing you've had a 'fun' day. [04:43] dendrobates-: openssl-blacklist is in gutsy ?? [04:43] leonel: After you install the security updates. [04:46] I've installed the updates and there wasn't a openssl-blacklist did apt-get update and there it is [04:47] You need so apt-get dist-upgrade to get the new package. [04:48] ScottK: did that for openssh and installed openssh-blacklist [04:48] didn't installed openssl-blacklist [04:48] installed now [04:48] Ah. I don't think I've seen the openssl-blacklist either now that you mention it. [04:48] dendrobates-: ?? [04:51] I don't think it's depended on like openssh-blacklist is [04:52] hm, openvpn depends on it [04:52] (at least on hardy) [04:54] ScottK ajmitch: it will be a dependancy of the ssl-cert package [04:54] which will be updated soon. [04:55] leonel: yes it is in gutsy [04:56] I just say "Caedite eos. Novit enim Dominus qui sunt eius." [04:58] sounds fair for some [04:58] though getting new SSL certificates signed isn't necessarily simple [04:58] Yeah. I don't have to deal with anything that's not self-signed. [05:00] I do, but it's only a couple of ssh host keys that I really need to replace [05:04] Two hours of bug hunting... Slap of the forehead.... Add one line of code... It works ... Head desk. [05:07] that sounds like a usual day for me [05:07] * ajmitch is glad to not get paid by lines of code :) [05:09] Unfortunately in this instance I'm providing a service, so the less time I have to spend on it, the more profitable it is for me. [05:10] and people don't really see much of a service in 1-line fixes, usually [05:15] This was service working and customer happy versus service not working and customer annoyed. [05:16] My code for my service. No hourly rates at all. [05:16] hi all [05:16] when i use keybased ssh and change the keys on my client, the server should refuse entry. is that correct? [05:18] Unless you give it the new cert. Yes. [05:19] sigh. bad start [05:19] thanks ScottK [05:22] odd. i changed my user+laptop keys, but the server kept allowing me in until i removed the .authorized_hosts file [05:22] hope that was pebkac on me [06:00] Bambi_BOFH: was an ssh-agent (or seahorse-agent?) caching the key for you [06:03] nealmcb: good though - i do have seahorse running. that might be what caused that... anomaly [06:03] * Bambi_BOFH cleans his cache [06:23] ScottK: dendrobates- Thank YOU ! [07:32] hello! [07:32] could someone please check what mx address bortal.de has? [07:40] spiekey: /msg'ed. [07:43] thanks! [07:44] that looks good, but i still get mil on the old server *grrr* [07:51] <\sh> spiekey, dns cache is awesome...and sometimes doesn't honour ttls [07:53] want a 2nd report? :) (dont know if the dns will look different this side of the world) [08:11] Hi! Am I safe to do the openssh-server updates over an ssh connection? [08:11] assuming your link is stable yes [08:12] so it does depend on keeping that ssh connection open? [08:12] if it drops out you cant/will have trouble settin up a new one. [08:12] also make sure you can log in using passwords before doing the sshd restart [08:13] s/restart/upgrade [08:13] ok, thanks. [08:14] no worries. [08:23] Hello [08:23] Guys I really need help: I have regenerated my openvpn certificates and keys, but still ERROR: 'xxxxx.key' is a known vulnerable key. See 'man openssl-vulnkey' for details. [08:26] Im not alone: http://forum.ubuntuusers.de/topic/174817/?p=1405337 [08:27] Anyone an idea? OpenVPN seems to be unusable since this security update... [08:28] i dont know, but i'm about to try setting up ovpn again too [08:29] falstaff_: Same here!!! [08:31] As far as I see the things, the log message is generated by the openvpn binary [08:32] So my guess is that the openvpn binary does _NOT_ use the /usr/sbin/openvpnssl-vulnkey to verify if it is an vulnerable key or not [08:33] /usr/sbin/openvpnssl-vulnkey says to me that the key is not blacklistet... [08:34] falstaff_: yup.. same here. [08:34] openvpn client is not restarting after upgrade. [08:35] Which ubuntu version are you using? Im still on 7.10.... [08:36] us too [08:38] pschulz01: And you? [08:39] falstaff_: us is me and pschulz01 :) [08:43] <_ruben> hrm .. bug in init script of openipmi .. lets see if there's a lp entry yet for it [08:43] <_ruben> (cant touch lockfile due lack of /var/lock/subsys/) [08:44] ok :-) [08:45] http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1.diff.gz is interessting [08:45] openvpn is using "/usr/sbin/openssl-vulnkey -q %s" [08:46] to check the keyfile... do you use shared keyfile or private keyfiles? [08:46] falstaff_: Bambi_BOFH recreating new keys.. [08:49] generated new keys and the client starts [08:49] so its a case of 'ignore helper tool' [08:50] moin [08:52] <_ruben> ah crap .. /var/lock is a tmpfs mount .. so even if a pkg would create /var/lock/subsys/ it'd be destroyed [08:58] Hello all, I'm having an irritating issue with a couple packages on my server. aptitude full-upgrade works, except for: update-manager-core depends on python-apt (>= 0.6.16.2); however: [08:58] Package python-apt is not configured yet. [08:58] I've ran dpkg --configure -a .. and it kicks back the same'ish error .. help? [08:58] <_ruben> i wonder what would be the best way of making sure /var/lock/subsys/ is created at boot time (after its mounted with tmpfs) [08:58] I've tried to re-install both packages, and they both tell me they can't be configured .. [08:59] our vpn is working again \o/ i'im heading off for dinner ;) [09:07] Bambi_BOFH: Just regenerating keys? i regenertad the keys too, but doesn't work for me... [09:33] hello i have problem configuring cupd server [09:33] i can't access from the web interface [09:33] i have added Listen 631 [09:34] DefaultEncryption Never [09:35] and in the [09:35] allow from 192.168.1.0/24 [09:38] Okey fixing a vulnerable and build a new one is not what ubuntu should do, isnt it? [10:57] <_ruben> bah .. my hardy machine hangs on shutdown, reboot works fine tho [13:35] Are the cert changes the SSL tool makes logged anywhere? [13:44] ScottK: good question. The place to start looking seems to be /var/lib/dpkg/info/openssh-server.postinst and I guess the ssh-vulnkey code [13:45] Well I wish the process were transparent. [13:45] I went through (I thought) and regenerated everything that needed doing yesterday. [13:46] My laptop told me it was fixing something, but I have on idea what (I'm guessing snakeoil). [13:46] This would have been the ssl one, not the ssh one anyway. [13:46] you can look for *.broken files [13:47] I'm certainly not going to run that tool on a server with production SSL/TLS certs without some clue. [13:47] OK. Thanks. [13:47] oops - right - ssl... [13:48] Nothing .broken. [13:49] ScottK: afaik ssh-vulnkey by itself does not change anything [13:49] yeah - the consequences of vulnerable .ssh keys used for login are very different from the consequences of bad ssh host keys or ssl certs.... [13:50] nijaba: The ssl tool does regenerate something. [13:57] I am trying to ssh into my server at home but I get the following :@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ [13:57] @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ [13:57] @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ [13:57] IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! [13:57] Someone could be eavesdropping on you right now (man-in-the-middle attack)! [13:57] It is also possible that the RSA host key has just been changed. [13:57] The fingerprint for the RSA key sent by the remote host is [13:57] How to solve? [13:57] i have the $PS1 vas setup un /etc/bash.bashrc aswell as each user ~/.bashrc, and it works fine while anyone logins via ssh, but when someone is already logged and changes users with 'su someone' the $PS1 is lost, where is that default located? [13:58] johnnybravo: just delete that key in ~/.ssh/known_hosts === Navop__ is now known as Navop [13:59] johnnybravo: see usn-2 [14:00] wait for link [14:00] johnnybravo: http://www.ubuntu.com/usn/usn-612-2 [14:01] pablasso, that did it thanks. [14:02] emgent I'm looking into the link now.... [14:07] johnnybravo: note also the -R option to ssh-keygen - may be easier than editing the file [14:10] I assume that this warning is just that, a warning. I've check my logs and nobody has logged in by brute force [14:22] johnnybravo: given the recent USN, that is most likely. but for the paranoid, of course, an attacker could often fix the logs to cover traces [14:26] nealmcb, true enough, and if that would be the case they are sharper than I, so let them go nuts [14:50] johnnybravo: delete the machines entry in ~/.ssh/known_hosts [15:01] Morning everyone [15:01] if i have several physical drives... would it be better to put swap across multiple drives or just dump it on the 1? === sergevn_ is now known as sergevn [15:03] pteague, I think splitting it up will give you better write performance of the swap but less read performance, so this might just be a personal decision [15:03] <_ruben> pteague: add more ram so swap becomes a (nearly) non-issue [15:04] Hi. I just upgraded a freshly installed dapper system to hardy using update-manager-core and now the kernel log daemon, klogd, needs ages to restart itself. Is that a known issue? [15:04] <_ruben> and i dont think there's much performance difference, there's no raid logic applied afaik [15:04] old hardware i'm repurposing as a mythbuntu box - amd 2.6ghz with 1gb ram i think [15:05] \sh: didn't you manage to do that? :) [15:08] gnarf. I restarted and can't login now because it (most likely) hangs loading the klogd [15:12] * dennda restores and tries again... annoying [15:13] Hey everyone. Installing the openssh-blacklist package will prevent users with weak ssl keys from connecting to my server correct? [15:13] <\sh> dennda, nope :) [15:13] <\sh> dennda, I need to do it still on my old rooty ;) [15:14] cyris|: ssh/ssh, but yes. [15:14] ScottK, ah yes that what i ment :D [15:14] \sh: I was under the impression that I read a posting of yours where you happily claimed you updated your ubuntu boxes to hardy RC [15:15] if this fails again I'll need to annoy somebody :) [15:15] He did, but from Gutsy, not Dapper. I've done a bunch of Gutsy -> Hardy upgrades with no trouble I didn't bring on myself. [15:17] ScottK: this is a completely basic dapper install. I did not do anything to it other than adding dapper-updates, installing update-manager-core and executing the upgrade dapper -> hardy. and that failed. I'll give it another shot [15:17] <\sh> dennda, nope...I installed the RCs on a virgin box... [15:17] ah ok [15:17] I don't have physical access [15:18] dennda: Reporting bugs is useful. It's 8.04.1 that's aimed at supported Dapper -> Hardy upgrades. [15:18] someone know who is DaD sysadmin ? [15:18] emgent: Lutin or Adri2000 [15:18] ScottK: oh. that's the first time I read that [15:18] ScottK: thanks [15:18] I'm not findnig the openssh-blacklist package in the repo's, anyone else having this problem? [15:18] http://www.ubuntu.com/getubuntu/upgrading#head-e059d5452a24b50d09c64df48058ef2d834eb197-2 <-- doesn't say anything about it [15:19] dennda: It's in the Hardy release notes. [15:20] I'm setting up a high load samba server. What is the best filesystem to use? [15:20] gnah, 3rd of july [15:20] definitely can't wait that long [15:23] Actually I looked and it's not in the release notes. I swear it was there at one point. [15:23] In any case developers are still working on making upgrades go better, so reporting bugs in Dapper -> Hardy upgrades is useful. [15:24] any way I'll need a punching ball in case it fails again :) [15:24] yeah I'll do that [15:25] .oO(though I am a bit surprised how recent the django version of dapper is...) [15:29] again... starting klogd lasts forever [15:32] sounds like a missing loopback device or broken localhost entry in /etc/hosts [15:34] after installing the openssh-blacklist, is a restart of the openssh-server required? or another futher configuration? [15:35] ogra: are you talking to me, oliver? [15:36] cyris|: When you install the update it gets restarted. [15:36] dennda, well, was just a comment generally spoken o the room ... :) but yes, referring to your klogd [15:36] s/o/to/ [15:37] ogra: I can tell you what the contents of the files are if you like [15:37] maybe you have an idea what is wrong [15:37] ifconfig -a .... check if loopback is up [15:37] and look into /etc/hosts [15:38] UP LOOPBACK RUNNING [15:38] aaand: [15:39] ScottK, ok I think I have a problem then. I know that a particular user account has a weak ssl key, and yet after installing the blacklist package they can still shell in. [15:39] ogra: http://paste.pocoo.org/show/50164/ [15:39] cyris|, sudo ssh-vulnkey -a [15:39] cyris|, what does that give you ? [15:40] ogra, hello :D um I don't have ssh-vulnkey, I was using the dowkd.pl script to test for weak keys [15:40] dennda, hm, looks fine [15:40] after 10 minutes or so it is now reported that restarting of klogd FAILed [15:40] cyris|, dont do that and finish your upgrae first :) [15:41] (dont use dowkd.pl i mean, its known to not catch all keys) [15:41] cyris|: Do what ogra says. [15:41] at least I let it finish now [15:41] let's see what happens [15:42] Wow, ok I ran apt-get upgrade yesterday and I'm sure it updated openssl, but now there is new upgrades? [15:42] they were held because you didnt install the blacklist package yet [15:42] OH! makes sense I guess [15:43] Ok so with this update, will it regenerate all keys detected as weak? or am I going to have to do this? [15:43] (and thats why i asked you to check with the vulnkey proggy, that comes only with the upgrade, so i know you are outdated still ;)) [15:44] GRUB loading, please wait... \ Error 17 [15:44] it will regenerate what it can ... i.e. ssh server/host keys but not the user keys [15:44] woohoo! [15:44] gnarfgnarfgnarf [15:44] * dennda files a bugreport and curses [15:45] Ok. so now I'm up to date. So it regenerates the host keys for this server correct? [15:45] dennda, thats a real machine or one of the hosteurope vhosts ? === joerlend_ is now known as XiXaQ [15:45] cyris|, sudo ssh-vulnkey -a will now tell you [15:46] it checks all keys it can find [15:46] ogra: vps [15:47] you know that doesnt allow to upgrade the kernel right ? [15:47] yes [15:47] it uses the host kernel [15:47] I know [15:47] which definately leads to probs [15:47] what do you suggest? disabling klogd? [15:47] ogra, Some compromised keys were detected [15:48] dennda, talk to hosteurope support [15:48] dennda, well, and as short term solution yes, disable what breaks [15:49] cyris|, fix these then [15:50] the output should tell you the filenames [15:50] ogra: they will tell me that hardy is not supported [15:51] well, they know why [15:51] ogra: just put exit 0; before anything else in the startscript? [15:52] mv the S file in /etc/rc2.d to be a K file [15:52] else upgrades will overwrite your changes [15:52] or rcS.d wherever klogd sits [15:55] ogra, the only problem i'm having now is the entries in my /root/.ssh/authorized_keys2 . should I just remove this file or clear it? [15:55] or the lines in doubt [15:55] as you like [15:58] ogra: mv S11klogd K11klogd ? [15:58] dennda, right [15:58] that way update-rc.d in the package wont touch the setup (just removing it or changing the content would bring it back on updates) [15:59] * dennda just left repair mode. let's see if it works [16:00] dennda, the question is really what else is broken [16:00] i bet udev might run into probs with an old kernel as well for example [16:01] so you suggest using dapper until the problems are sorted out? [16:01] (if they are ever being sorted out) [16:01] alright, so if ssh-vulkey -a doesn't detect any compromised keys, am I good to go get a coffee? :D [16:01] well, the problem is on hosteurope side nothing ubuntu could do about that [16:01] cyris|, enjoy as long as its hot :) [16:02] didn't work anyway [16:02] well, let's hope that dappers packages are recent enough for me then [16:02] django seems to be [16:02] ogra, one more question tho if you don't mind. Do each of my users have a ssl key since they use ssh ? I have about 20 users who shell in. [16:03] well, you should check their keys as well indeed [16:04] ssh-vulnkey takes filenames as option [16:04] ogra, ssh-vulkey won't detect these keys? [16:04] ogra, hrm no fast way to do this? [16:04] ogra: I shall not report a bug then? [16:05] ogra, as you can see, i have some reading to do, but im just wanting to get this machine all patched up :D [16:05] whilst we are at it: dapper is not affected by those ssl bugs, is it? [16:06] dapper isnt [16:06] dennda, well, ymmv no idea where you get with such a bug, mention in any case the setup and the vhost [16:08] ogra, do users use the host keys on the system ? [16:09] users use their keys in ~/.ssh usualy [16:10] ogra, hrm ok. so can a user shell in if they dont have a .ssh directory? [16:11] New bug: #230174 in openssh (main) "[Gutsy] ssh installation results in COMPROMISED keys" [Undecided,New] https://launchpad.net/bugs/230174 [16:11] ogra, or are those directories used to store know_hosts ? [16:12] that as well [16:15] mathiaz: for the dovecot SRU im just writing up the testcase now so they setup dovecot with SSL, Run the create user script and then they run the test script correct? [16:16] zul: yeah - you could also add to set the login_max_process_count option to 4 [16:17] zul: hardy should timeout quickly [16:17] coolio thanks [16:19] ogra, thanks for your help today, going to have a coffee and I'm going to start fixing up this other machine now :S [16:25] good luck :) [16:25] mathiaz: dovecot uploaded [16:25] to hardy-proposed [16:34] whee! grub error 17 again... guessing i need to fix an mbr [16:46] Hi all [16:47] Anyone with info about held back packages, OpenSSH server and client for Hardy. Launchpad nada [16:48] Sorry kept back packages [16:48] install openssh-blacklist [16:49] troja: sudo apt-get dist-upgrade [16:49] That will install the new package. [16:49] Yup... installing :) [16:50] We have a mess in Sweden with archive servers 1 week behind and all the notes about this issue. USN 614-1 to 4 [16:52] Security updates should come from security.ubuntu.com, not from a mirror. [16:52] * delcoyote hi [16:53] ScottK... nope nada but after changing sources.list it was OK except the blacklist package and kept back packages.... [16:53] <_Nicke_> ScottK: My upgrade from Gutsy to Hardy changed my sources.list to use se.archive for hardy-security too, fwiw [16:54] <_Nicke_> not sure if that's caused by me or something... [16:55] <_Nicke_> uhm, never mind.. gutsy-security was handeled by se. for me too it seems (now I wonder when that happened) [16:57] Dunno. Mine all say http://security.ubuntu.com/ubuntu. [16:57] <_Nicke_> yeah.. I have security. commented out for feisty-security.. but that's it.. oh well, probably my fault somewhere [16:58] Hmm. in my case it also downloads from fr.archive.ubuntu.com [16:58] for security [16:59] I suppose when you select a specific source server in the GUI it changes them all [16:59] another reason not to use that gui [16:59] mine is security.ubuntu.com for gutsy [17:00] Koon: I don't think that the -security are changed. [17:00] Mine was totally default, installed 1 week ago. [17:00] Bug ? [17:00] mathiaz: testing right now [17:00] Okay. The LVM configuration during the install doesn't make sense to me. [17:00] better to always point to security.ubuntu.com for -security. [17:00] security updates are copied to -updates and thus hit the mirrors in a matter of days. [17:02] mathiaz: it changes them all [17:02] all uncommented deb abd deb-src lines [17:04] I thought you'd create the PV, then you'd partition [17:05] but you separate the PV into partitions, then add them to LVM?? [17:18] SSH restarded but [17:18] "Read from socket failed: Connection reset by peer" [17:18] Client keys removed within the host_known file ... [17:18] The client also got a bunch of packages....installed [17:18] Time for the keyboard and screen again for the server....??? [17:19]