[00:00] where are you from [00:00] ? [00:00] TANATHOS: Romania, why? [00:01] ca si eu is roman [00:01] da locuiesc in Anglia de o buna bucata de timp [00:01] :) [00:01] ma gandeam eu ca esti roman [00:01] auzi [00:02] si fain acolo? :) [00:03] * djdarkman goes to make a coffe as hard as h3ll === macd__ is now known as macd [01:00] kirkland: You around? [01:00] ScottK: hi [01:00] kirkland: I've got a question for you. Let me get the paste. [01:01] k [01:01] hey everyone, I'm installing kubuntu 8.10 RC via the alt disk, setup partitioning manually with encrypted lvm, when it gets to "configuring apt sources" it then asks me to insert media ("please insert disk labeled: kubuntu 8.10 _Intrepid Ibex_...") [01:01] the disk is already in and it's been installing from it up to that point [01:01] [20:58] is that supposed to work? [01:01] kirkland: ^^? [01:03] ScottK: hmm, i've never installed kubuntu from the alternate installer [01:04] It should be the same as Ubuntu in terms of such capabilities [01:04] ScottK: yeah, i'd think so [01:04] ScottK: does this only happen with encrypted lvm? [01:04] kirkland: Would you be willing to go talk to the reporter? He's in #ubuntu+1 right now. [01:04] kirkland: I'm just the middle man looking for an expert. [01:05] ScottK: watching a movie with the wife... i can spend a few minutes but not all night [01:06] ScottK: Rondomskk is the reported? [01:06] kirkland: Understand. I'd appreciate it if you'd at least talk to the guy and help him file a good bug if nothing else. [01:06] Yes. [01:07] kirkland: Thanks. [01:07] np [02:48] what would ^@ mean in a faillog ? [04:59] how many do your firefox 3 needs resMEM? i have 209M displaying NO website oO [05:01] fc sry [07:58] moin [08:27] hi, i have some prob installing e-box [08:27] followed the wiki, but still am not moving on [08:45] Logi_Khoo: Try in #eBox. [08:46] thanks soren [08:55] hi [09:03] New bug: #286063 in openldap (main) "slapd package cannot be installed" [Undecided,New] https://launchpad.net/bugs/286063 [09:08] Can't be installed? I don't like the sound of that.. [09:10] soren > how stable would you rate the kvm in your ppa? does the worst case scenario include "total VM breakdown, in a non recoverable state"? [09:10] I've got some mission critical windows vms to create, facing a big dilemma :) [09:11] yann2: The on in the ubuntu-virt ppa? [09:11] https://launchpad.net/~soren/+archive kvm72 here [09:12] so there is a ubuntu-virt ppa... :s [09:12] yann2: Yeah, that's the one you want. I don't recommend my personal one on anything even resembling production systems. I reserver the right to put completely random crack in there. [09:13] I'm much more well-behaved with the ubuntu-virt one :) [09:13] both versions have the same name? are they still different? [09:14] yann2: Let me check. [09:14] yann2: I believe so, yes. I think uploading it to my personal repo was a blunder. [09:16] soren > #ubuntu-virt :P [09:33] dendrobates: have you seen bug 289470? [09:33] Launchpad bug 289470 in open-iscsi "open-iscsi user-space does not match kernel module version" [Undecided,New] https://launchpad.net/bugs/289470 [09:35] mathiaz: no [09:35] dendrobates: seems that open-iscsi is borked in intrepid [09:36] mathiaz: damn [09:36] mathiaz: yep and just at the last minute. [09:48] dendrobates: according to pete there have been a lot of changes in the intrepid kernel wrt to iscsi [09:48] dendrobates: the user space part hasn't been updated since last may [09:49] dendrobates: most of the kernel updates have been made in July - that would explain why things are breaking :/ [09:50] mathiaz: it worked a lot more recently than July. [09:50] dendrobates: the last change in iscsi was made in september then [09:50] dendrobates: in the kernel === mdz_ is now known as mdz [10:29] dendrobates: after some basic testing on iscsi I don't think we have a release critical bug 289470 [10:29] Launchpad bug 289470 in open-iscsi "open-iscsi user-space does not match kernel module version" [Critical,Triaged] https://launchpad.net/bugs/289470 [10:30] dendrobates: iscsi is working - I was able to create an iscsi target, mount it in a client and create files on it [10:30] mathiaz: so is the bug report invalid? [10:30] dendrobates: no - it's valid [10:30] dendrobates: display all active sessions and connections [10:31] dendrobates: ^^ that doesn't work [10:31] dendrobates: but open-iscsi is working. [10:31] dendrobates: in the sense that we can mount an iscsi block device and files can be created. [10:31] mathiaz: ok, sounds like an sru candidate after release. [10:32] dendrobates: agreed. [10:37] dendrobates: I've dropped the importance to high and targeted intrepid-updates. === lipsinV1 is now known as lipsin [11:16] re bug 286063 [11:16] Launchpad bug 286063 in openldap "slapd package cannot be installed" [Medium,Incomplete] https://launchpad.net/bugs/286063 [11:16] mathiaz: ^ [11:17] I'm not sure I grok your last comment. /bin/sh is meant to point to dash. [11:18] soren: right - the error message only happens if /bin/sh point to bash [11:18] The bug seems valid enough to me. Looking at slapd.config, it does indeed try to declare a variable local in the global scope => nonsense. [11:18] soren: correct. That's a bug. [11:18] soren: However it doesn't fail if /bin/sh is dash [11:18] why point to /bin/sh at all? why not update scripts to point to directly to /bin/dash? [11:19] Deeps: why on earth would we do that? [11:19] instead of relying on symlinks that could easily be changed based on the admin's preference [11:19] i for one prefer /bin/sh to point to bash, rather than dash, for a number of scripts i have on various systems all point to /bin/sh which in turn points to bash [11:19] soren: I agree that this is a bug in the config script. The question is whether this release critical [11:19] i doubt i'm alone in that [11:20] tell me why i'm wrong? :D [11:20] Deeps: You're doing it wrong. [11:20] soren: the question is whether this is release critical or can be adressed in the a SRU. [11:20] Deeps: If your script depends on a specific implementation of the bourne shell, you shouldn't use #!/bin/sh [11:21] good point [11:21] i'll get my hat [11:22] mathiaz: You're right that it only happens with bash. Definitely an SRU thing, then. [11:22] mathiaz: Strange. I don't think I know of other quirks where bash is more picky than dash :) [11:29] is there a howto on how to use ecryptfs with gnome-keyring instead of pam? this would be useful for a mount "on demand" I'd like to implement for my laptop (hardy) [11:30] kirkland: ping? ^^ [11:35] philsf: He won't be around until a few hours from now, probably. [11:36] soren: k, thanks [11:37] I'll try in the afternoon (which in my locale will be in about 5h) [12:47] Hello all! [12:47] hi [12:49] I'm not an advance Linux server administrator. I have configure my iptables "Filter" with : sudo iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 22 -j ACCEPT [12:50] after i applied this configuration. it took me very long time to have SSH logon [12:51] !question | carbon_monoxide [12:51] carbon_monoxide: Please don't ask to ask a question, ask the question (all on ONE line, so others can read and follow it easily). If anyone knows the answer they will most likely answer. :-) [12:51] TANATHOS: understood [12:51] so, what's the question [12:53] i want to know any reason would cause SSH logon taking longer when i configure the default policy of iptables INPUT to "DROP" [12:53] carbon_monoxide: Is that all you've done? No default policy set or anything? [12:53] carbon_monoxide: Because reverse dns lookups are failing. [12:53] <_ruben> or any dns lookups for that matter [12:54] default policy drop without any inbound state rules would do that [12:54] Hi soren. yes, i have only configure the default policy to DROP for INPUT [12:54] carbon_monoxide: if that is all that you have done, then your server only accepts connection to port 22 [12:54] carbon_monoxide: Right. That will make dns queries fail. [12:55] carbon_monoxide: what are you trying to do ? [12:56] TANOTHOS: i'm trying to make my machine shadowed [12:57] TANOTHOS: cloak, I meant [12:57] -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT [12:57] iirc [12:57] carbon_monoxide: please use Tab autocomplete as I have highlight enabled when someone says my name [12:57] and that is not my name [12:57] lol hey tanothos :) [12:58] hey [12:58] sounds like he's wanting a stateful firewall, with particular inbound services allowed [12:59] TANATHOS: sorry =[ i'm new and rare to IRC. sorry for my manner [12:59] no problem [13:00] carbon_monoxide: you wanna cloack your machine ? as in only few ports opened? [13:00] actually i'm using xchat in windows Vista cause OpenSUSE 11 doesn't support my wireless adapter and i'm too lazy to deal with ndiswrapper [13:00] sorry? [13:01] TANATHOS: yes, it will only serve several services [13:01] carbon_monoxide: you are making me dizzy [13:01] :))) [13:01] how to use tab autocomplete? [13:01] carbon_monoxide: type the first few letters and press tab [13:01] carbon_monoxide: then install your services and open those ports [13:01] carbon_monoxide: and if you look up at the iptables rule i provided, it should resolve your slow ssh login issue [13:01] but I still didn;t get your question [13:02] oh that one [13:02] TANATHOS: yea i know my bad english and poor communication skills [13:02] !iptables [13:02] Ubuntu, like any other linux distribution, has firewall capabilities built-in. The firewall is managed using the 'iptables' command (see https://help.ubuntu.com/community/IptablesHowTo), or GUI applications such as Firestarter (Gnome) or Guarddog (KDE). [13:02] carbon_monoxide: the problem being that you're not allowing any inbound access except on port 22, DNS queries use arbitrary ports, and unless you allow for inbound traffic on connections you've made already (i.e. by checking the state on the connection), the result of the DNS query cant get through [13:03] Deeps. thanks! that is same as the shell! [13:03] carbon_monoxide: where are you from? [13:04] TANATHOS: china, hong kong [13:04] carbon_monoxide: what part of hong kong? [13:04] carbon_monoxide: my family live in midlevels [13:05] carbon_monoxide: about 5 mins from admiralty, near the city centre [13:05] Deeps: hong kong is not big =] Kowloon, Mongkok [13:05] nice [13:05] carbon_monoxide: Are you running Hardy or later? [13:05] there's a great cheung fun place in mong kok my uncle took me to, near the mobile phone mall [13:05] soren: i'm running 8.04 [13:06] carbon_monoxide: You should look at ufw. It does all you want. [13:06] need to go back soon! [13:06] Deeps: Mong Kok is a mess =D [13:07] soren: thanks! i'm googling it [13:07] carbon_monoxide: true [13:07] !ufw | carbon_monoxide [13:07] Sorry, I don't know anything about ufw [13:07] no me digas [13:07] shocking [13:08] lol [13:08] first time that i hear it says "Sorry, I don't know anything about sth" [13:09] ufw? [13:09] !iptables | carbon_monoxide [13:09] carbon_monoxide: Ubuntu, like any other linux distribution, has firewall capabilities built-in. The firewall is managed using the 'iptables' command (see https://help.ubuntu.com/community/IptablesHowTo), or GUI applications such as Firestarter (Gnome) or Guarddog (KDE). [13:10] I think this is what you wanted to do [13:10] thanks, TANATHOS! [13:10] ireading it [13:10] i'm reading it carefully *wink* [13:12] No. [13:12] carbon_monoxide: ufw is what you want. Really. [13:13] soren what is ufw? [13:13] uncomplicated firewall [13:13] :))) [13:13] https://wiki.ubuntu.com/UbuntuFirewall [13:13] ubuntu's nicer front end to iptables [13:13] but what i'm confusing now is that, dropping all inc connection except those from port 22 will cause DNS query failure. but i can still get my SSH login successfully. it just takes me longer to wait for the password prompt\ [13:14] yep, because the ssh server is trying to do a dns lookup on your ip, and until the request completes or times out, it doesn't proceed to prompt you for your password [13:14] the time you're waiting is the time it takes for the dns lookup to time out [13:15] Deeps: i see! [13:16] I'm quite sure ufw defaults to allowing established and related connections, and hence would not have this problem. [13:18] sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #this line seems like solving my problem [13:19] but ufw is a better choice [13:21] when one does 'sudo ufw enable' it blocks all incoming connections, and allows all outgoing, with connection tracking, so that a standalone computer can connect and use most any service available on a server [13:21] so, for example, one can do outgoing DNS queries, http, irc, etc [13:22] to allow incoming connections, simply do 'sudo ufw allow ' [13:22] sudo 'man ufw' for more details on its usage [13:24] s/sudo/see/ [13:30] thanks jdstrand_ [13:37] With a password of 14 random characters, I shouldn't have to worry about brute-force attacks on my SSH server, right? [13:45] thanks for the help from all of you! i gotta leave. will be hanging around here later. see you all! [13:45] jdstrand: I've spent alot of time trying to get ufw to allow outgoing hostname lookups, without succeeding. You seem very skilled, would you mind taking a look at this? http://pastie.org/301348 [13:51] New bug: #289856 in openvpn (universe) "openvpn 2.1~rc11 tls_read_plaintext error" [Undecided,New] https://launchpad.net/bugs/289856 [14:01] sandstrom: it appears that your /etc/ufw/*.rules files are not standard [14:02] sandstrom: you are missing all the connection tracking rules and icmp [14:02] philsf: there's no such howto that I know of [14:03] sandstrom: I suggest you: sudo dpkg --purge --force-depends ufw ; sudo apt-get install ufw [14:04] sandstrom: then add your rules back in. oh, you should 'sudo ufw disable' prior to running the above command [14:04] okey [14:04] will do [14:04] I get an error the first time I run ufw enable, linke this: root@k226741:/etc/ufw# ufw enable [14:04] ERROR: problem running init script [14:05] might be related to the absence of my etc/ufw/*.rules [14:05] sandstrom: uh, if you deleted /etc/ufw/*.rules, that would be problematic, yes [14:06] no, I didn't [14:06] absence was the wrong word. I ment the absence of my ufw/*.rules in my ip-tables [14:07] I get this when I ran your recommended command above: FATAL: Could not load /lib/modules/2.6.18-028stab053.17/modules.dep: [14:07] No such file or directory [14:07] ip6tables v1.3.8: can't initialize ip6tables table `filter': iptables who? (do you need to insmod?) [14:07] Perhaps ip6tables or your kernel needs to be upgraded. [14:08] sandstrom: so your kernel does not support ipv6? [14:09] might be. Unfortunately this production server is running on a VPS, so I don't have control over the kernel [14:09] sandstrom: what version of ufw are you using? ufw --version [14:09] 'ufw 0.16.2.3 [14:11] sandstrom: ok, there is an open bug with the way some people disable ipv6, but we can work around it [14:12] great! [14:12] I really appreciate your help [14:12] sandstrom: rather than removing ufw, let's just copy the original rules files in place: [14:12] sudo cp -a /usr/share/ufw/*.rules /etc/ufw [14:13] done [14:15] sandstrom: sudo /etc/init.d/ufw stop [14:15] done [14:15] please paste 'sudo iptables -L -n' [14:16] http://pastie.org/301379 [14:17] sandstrom: ok good. now do 'sudo ufw enable' [14:17] root@k226741:/etc/ufw# ufw enable; ERROR: problem running init script [14:17] right [14:17] I think this is where the problem starts. [14:17] now paste: sudo iptables -L -n [14:18] http://pastie.org/301380 [14:19] sandstrom: do you have time to help me debug this, and therefore develop a patch for ufw? [14:19] Thinking of this it might be that the state module isn't activated in my iptables, and thats why it hangs. [14:19] sure [14:20] good-- I don't have access to one of these VPS machines, and it will be very helpful [14:20] thats allright. [14:20] sandstrom: can you paste the output of 'lsmod' [14:20] perhaps we should move to a private conversation [14:20] sandstrom: if you'd prefer [14:21] for others, so we don't fill up the channel [14:21] people living nearby the channel could drown [14:21] sandstrom: Alternatively there isn't a lot else going on and someone else will likely learn something. [14:21] root@k226741:/etc/ufw# lsmod [14:21] Module Size Used by [14:22] ScottK: okey [14:25] jdstrand: http://pastie.org/301385 === lipsin_ is now known as lipsin [15:13] sandstrom: (for the irc logs) we determined that your kernel is a) monolithic and b) does not support netfilter connection tracking [15:14] ufw depends on connection tracking in the kernel, so it will not work for you. You will have to create stateless rules due to your kernel [15:15] Is that a kernel we ship or did he roll his own? [15:15] sandstrom: you have been very helpful, and I can have ufw detect for this and bail out with a helpful error message [15:15] sandstrom: thanks a lot! [15:15] ScottK: no-- it is with a hosting provider [15:15] Ah. [15:37] sandstrom: fyi-- filed bug #289906 [15:37] Launchpad bug 289906 in ufw "ufw fails when connection tracking is not available" [Medium,Triaged] https://launchpad.net/bugs/289906 [15:41] jdstrand: What's the kernel version there? [15:41] 2.6.18 [15:42] soren: it's non-Ubuntu [15:42] jdstrand: Right, got it. [15:47] jdstrand: Didn't nf_conntrack appear after 2.6.18? [15:48] Like 2.6.20-ish? [15:48] I don't know off-hand [15:53] I have a machine running 2.6.17. It doesn't have nf_conntrack either, but it does have connection tracking. [15:54] soren: I can probably be smarter about it, but the command that fails is: [15:54] # iptables -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT [15:54] iptables: No chain/target/match by that name [15:54] and yes, ufw-before-input exists :) [15:55] jdstrand: What's the advantage of ctstate over state? [15:56] conntrack [15:56] This module, when combined with connection tracking, allows access to [15:56] more connection tracking information than the "state" match. (this [15:56] module is present only if iptables was compiled under a kernel support‐ [15:56] ing this feature) [16:21] in bash conditionals, what's the difference between -L and -h? [16:22] in the bash reference i'm looking at, both appear to serve the same function - True if file exists and is a symbolic link. [17:59] afternoon everyone [18:10] does anyone have a suggestion for a SAS HCA card to connect to a dell md3000? [18:10] the SAS 5/E card that they ship doesn't work with ubuntu [18:11] i use LSI [18:13] trashguy: and that uses an infiniband cable? [18:13] I need to connect to a dell md3000 [18:14] Steve[cug]: lsi controllers come with all kinds of connectors [18:14] you can probably find the right model though [18:14] http://www.lsi.com/storage_home/products_home/internal_raid/megaraid_sas/index.html [18:14] hmmm [18:14] it IS an LSI [18:15] LSI Logic / Symbios Logic SAS1068 PCI-X Fusion-MPT SAS (rev 01) [18:15] i keep getting errors from the kernel however [18:15] Oct 27 12:19:57 nfs1 kernel: [ 688.929491] end_request: I/O error, dev sdc, sector 0 [18:16] then the problem likely isn't with kernel support [18:17] however the other machine (which is RHEL for testing) works fine [18:34] jcastro: hey - could I take Tuesday 18:00 UTC slot to make a intro the Server team session next week? [18:35] jcastro: I'm planning to change some of the parts I've used during the last presentation (changing the member presentation with a list of features that have been developed in intrepid) [18:39] mathiaz: sure, just move it to whatever empty slot you want [18:42] jcastro: great [18:58] Hello. [18:58] I'm trying to use ldap for authentication, via libpam-ldap. I succesfully populated my database, and now if I give the command "id battiston" ("battiston" is the name of a user), I (finally) correctly get: [18:58] uid=40626(battiston) gid=40626(battiston) groups=40626(battiston),10042(macchinisti) [18:58] but if I try "su battiston", I get: [18:58] Unknown id: battiston [18:58] At which level do you think the problem can be? [18:59] toobaz1, have a look at this... might give you the answer <> http://linuxadministration.us/2008/05/17/ubuntu-804-hardy-ldap-client/ [19:08] Weasel[DK]: Mmh... I'm taking a look at it, thanks [19:35] In my syslog I found the following: [19:36] Oct 27 20:36:11 poisson slapd[6686]: SASL [conn=141] Failure: no secret in database [19:36] Oct 27 20:36:11 poisson slapd[6686]: conn=141 op=2 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database [19:36] Oct 27 20:36:11 poisson slapd[6686]: conn=141 fd=17 closed (connection lost) [19:36] let me investigate some more === sylvaing is now known as sylvaing_ === sylvaing_ is now known as sylvaing === Pomiel is now known as DCPom [22:49] http://dpaste.com/87148/ With linux software raid 10, how do I tell which drives are mirroring eachother? === Rideh_ is now known as Rideh [23:57] hello [23:58] I'm upgrading my server from 6.06 LTS to 8.04 LTS [23:58] I'm doing a do-release-upgrade [23:58] http://pastebin.com/d647938ed [23:58] that;s the error I get [23:58] any clue how I can restart the upgrade process?