[00:05] Hi there, anybody here who has experience with EMC powerpath on ubuntu? Will it actually work? === JanC_ is now known as JanC [02:33] I just double clicked a samba share and it mounted, where is it acutally mounted though? [02:35] storrgie: ask /proc/mounts. This channel is for server support, not GUI stuff. [04:23] hey how can I port forward using ufw [04:26] HellMind: editing /var/lib/whatever, where the raw iptables-restore data lives. [04:26] The ufw wrapper pretty much restricts itself to hosts.allow functionality. [04:28] so isnt that easy [04:28] im having problem with udp [04:29] I must touch something extra to forward that? [04:29] I don't know offhand [04:30] HellMind: I'd edit /etc/ufw/after.rules to adding any extra custom rules (for forwarding or whatever else you need) ... then regenerate the scripts using ufw and your edits to after.rules are included into /var/lib/ufw/user.rules [04:32] I got the rules in the before.rules file [04:32] is that wrong? [04:41] I have two disks; one is 200GB and the other is 300GB. I'd like to combine them to make a 500GB partition. Speed is not the issue, I just want a big pool of diskspace. Later, I might want to add more disks to that partition. Should I use mdadm and create a software raid 0 or just lvm, or what should I do? I've neither configured software raid nor lvm. [04:51] XiXaQ: just remember one disk failure = entire data loss [04:51] more disks = more chance of failure [04:57] XiXaQ: sounds like you want lvm [05:00] jtaji, then I don't need raid? [05:00] Sam-I-Am, without raid 0 too? [05:01] concatenating disks has no redundancy [05:01] neither does raid0 [05:01] but whatever, backup [05:01] just a warning... if you need lots of space and dont care about the data, raid 0 works fine [05:02] XiXaQ: you can add/remove disks at will with lvm, not sure about raid0 [05:02] with raid0 I don't think you can remove a disk. [05:04] plus there's the nifty snapshot feature with lvm for backing up a consistent disk state [05:05] then there's always lvm on top of raid [05:08] yes, but as I said, speed is not important at all. [05:08] I would just do lvm then [05:08] this isn't important data either. I just want the ability to store more data in the same space. [05:08] I mean, in the same folders. [05:14] jtaji, yes, I've read about that snapshot feature. Seems nice. [05:14] Hello... anyone have any suggestions on getting an Ubuntu Server (running gnome) to find a USB memory stick when there is already disk drives sda1, sdb1, and sdc1 as part of a raid array? [05:14] XiXaQ: it's very cool, just remember to leave unallocated space, you can always expand partition anytime with lvm [05:15] jtaji, what does that mean? [05:16] I've deleted all partitions on both disks. [05:16] XiXaQ: with lvm you'll create a physical volume for lvm (most likely your whole disk), then create logical volumes in that (/, /home, etc...) [05:17] XiXaQ: when you create your logical volumes, don't use all the space in the physical volume, you can expand partitions easily later, and also the empty space is needed for snapshotting [05:18] at minimum, just for snapshots, you'd need enough space to account for all the disk changes that go on while your snapshot alive and you do your backup [05:23] Hello... anyone have any suggestions on getting an Ubuntu Server (running gnome) to find a USB memory stick when there is already disk drives sda1, sdb1, and sdc1 as part of a raid array? [05:26] jtaji, that's unallocated space on each disk I use? [05:29] XiXaQ: oh right..... I wasn't entirely accurate [05:29] each disk will be a physical volume, multiple physical volumes are combined to one volume group [05:30] it's the volume group in which you create logical volumes and leave some unallocated space [05:32] ah, I see. [05:37] jtaji, I'm following the server guide from help.ubuntu.com. It seems to suggest I should keep / and such outside lvm? [05:42] I don't understand this. I used 100% of the first disk for LVM, but now I'm only able to give 100% of that to the / partition. [05:43] XiXaQ: ah yes, another good point :p [05:43] XiXaQ: I just keep /boot outside [05:43] and only ~200 MB [05:43] is it necessary? [05:43] yeah [05:44] so I'd make the /boot on the first disk, then the rest of that disk for LVM physical volume [05:44] and /boot is primary and the rest is logical? [05:45] doesn't matter, but since you only have one or two partitions on each disk, I just use primary [05:46] how do I undo the kvm setup? [05:46] without lvm, I use all logical typically [05:46] kvm? [05:46] lvm [05:47] I now have 100% of the disk set to lvm and 100% of that set to /. I can't see any way to remove / and when I try to remove the lvm stuff, I get an error saying it's in use by lvm. [05:48] remove the / logical volume, then remove the volume group, then delete the physical volume [05:48] how do I remove it? [05:49] "delete all data on this partition"? [05:50] oh, this is going to take a long time. :( [05:51] in the installer? can't remember, should be pretty obvious [05:51] on the command line you'd use lvm lvremove, lvm vgremove, lvm pvremove...... [05:52] I'll take a few hours to delete the / partition? [05:52] should take seconds [05:53] it's been running for ten minutes and it's at 2% [05:54] I can't think of why that would be [05:54] oh, I found it. [05:57] ok, so I first make a /boot partition, of a few hundred megs. The rest I'll use for lvm and then I'll be able to easily resize / and /home, for instance? [05:58] yes [05:59] I'm not allowed to do that. I must provide a / filesystem. [06:02] dunno, I've done it several times... but I'm afraid now I must go to sleep [06:02] good luck ;) [06:02] thanks. [06:52] i have to backup some directories, and only root has access to them, i have chosen duplicity as a tool for backup, however ssh for root is disabled, so i need another uid 0 account just for the backup's purposes. or should i create a new user with group as root? [06:57] use sudo? [06:58] oh, sorry. I didn't read properly :) [06:59] adding your user to the root group seems best. [07:02] error404notfound: all of those techniques are sucky. [07:03] error404notfound: I suggest allowing ssh access to root, but only via a single key, and locking that key down to run only a single command. [07:03] twb, so what can i do... i have to make backups, directories are such as etc, var (yes, without lock, spool and run), and some other mounted media [07:04] twb, what if using xinetd or may be denyhosts i disable root ssh from any ip except local, wont that achieve the same goal? [07:04] error404notfound: I'm assuming you already use AllowedUsers to restrict ssh access as root [07:04] http://linuxmafia.com/faq/Security/ssh-publickey-process.html [07:04] twb, i have used AllowedGroups with canssh [07:05] error404notfound: AllowedUsers root@192.168.1.*, for example [07:05] I would not bother pissing about with xinetd. [07:05] twb, yes, that i can do in my sshd_conf like root@localhost [07:05] twb, hmm [07:06] twb, AllowedUsers take preferences over group? if yes, may be root should be in canssh group as well [07:06] error404notfound: I don't know. [07:06] My impression is that it takes a set union (∩) [07:07] My impression is that it takes a set union (∪), rather [07:08] twb, okay, thanks, i am gonna try it.. [07:19] i addedthe AllowUsers line in sshd, restarted sshd, and now when i try to ssh into the server, i get: http://pastie.org/582321 [07:44] "Too many authentication failures" sounds like you are using something like fail2ban [07:45] The ssh client should not report that much information about why a connection was rejected. === mdz_ is now known as mdz [09:27] anyone here uses duplicity? [09:27] i am getting http://pastebin.com/m730f508a [09:28] twb, any ideas form your side? [09:30] http://pastebin.com/m7aafbbe2 [09:35] error404notfound: sorry, I'm busy [09:35] twb, no problem :D [09:40] twb, i fixed it :P there was one extra --include [09:40] hi, i'm trying to create a mail server with a LDAP server as a auth backend. [09:41] the thing is: how could I store the mail if there are no user directories in the mail server (they're in the ldap server)? [09:41] <_ruben> acalvo: virtual users [09:41] acalvo: with a network filesystem [09:41] mmm [09:41] network filesystem? [09:42] acalvo: such as NFS, CIFS or AFS [09:42] yes [09:42] but i don't want to have the mail in the same filesystem as the user data [09:42] _ruben: virtual users? what do you mean? [09:42] acalvo: then you just make sure pam_ldap is in pam.d/dovecot instead of pam.d/common-*, I guess [09:42] <_ruben> acalvo: most MTAs support both local users (system accounts) and virtual users [09:43] twb: why? pam only takes care of authentification, it won't redirect to new storage tree [09:44] I don't see what the problem is [09:44] If the only thing that needs to know about these users is the MTA, then you only make the MTA see them. [09:44] _ruben: yes, but this is done using LDAP (right?), my point is how to instruct dovecot/postfix to store the user mail in some directory that is only owned by the LDAP user [09:44] twb: and how to control where to store mail? [09:45] it won't be a /home/$user$ [09:45] <_ruben> acalvo: http://www.postfix.org/VIRTUAL_README.html#virtual_mailbox [09:45] acalvo: nsswitch.conf handles that. [09:45] So I suppose the accounts would exist on the mail server, but wouldn't allow logins [09:45] Doing it the way I propose, that is. I daresay _ruben has a better approach [09:46] <_ruben> acalvo: if you use postfix+dovecot .. have postfix check against ldap for valid users .. and have dovecot auth against ldap as well for imap/pop3 and use a static map (or ldap field) for the mailbox location [09:46] twb: thanks, you're approach also seems right -- but I don't really understand how nsswitch can control storage systems [09:46] _ruben: I think I've get your point! [09:47] thank you both! [09:47] acalvo: "getent passwd fred" will tell the system fred's home dir [09:47] twb: acalvo:x:1004:512:System User:/home/acalvo:/bin/bash [09:47] it's true [09:47] but there is no "/home/acalvo" in the mail server [09:47] So what? [09:48] so, default config redirect to /home/user/Maildir [09:48] if there is no /home/user, it will fail [09:48] I suppose [09:49] You tell the mail system to make directories that don't exist [09:49] seems fair [09:49] I'll try to mix up both suggestions [09:49] <_ruben> dovecot creates mailboxes automatically on first mail/login [09:50] that's what I've guessed [09:50] I'll try what you said, using postfix+dovecot against LDAP [10:35] has anyone here used an IBM LCM? [10:36] The candy bars? [10:50] Hi, I am experimenting with ubuntu server, I want to setup a a simple server for clients. Basically I want to run samba for file sharing, and run a mail server which will pull mail from the isp, and then also be able to route mail localy. Most of the how to guides I have been reading talk about ISP server with multiple domains. [11:00] Richie: have you read the Ubuntu admin guide? [11:10] twb: I read some of the ubuntu server guide, busy having another look at the mail section. I tried one of the tutorials on how to forge, which was in my opionion to much, I am not going to be hosting multiple domains. Maybe what I should do is start working through the admin guide, then when I get to sections I am not sure about I will ask the relevent questions here. [11:19] the one thing that does confuse me is the mail server host name in the basic postfix configuration. the server is not going to have a fixed ip, I want to retrive mail with fetch mail and route localy and outgoing mail will be relayed to the isps smtp server, would I call it mail.mydomain.com, or would it be better to call it mail.mydomain.local. [11:36] If your MTA does not have a fixed IP, it will not work very well [11:37] Lots of other MTAs will refuse to talk to you because the hostname you supply doesn't resolve to an IP that resolves back to the hostname you supply. [11:37] If you're a SOHO, I suggest you just relay all outbound mail through your ISP's smarthost. [11:40] the plan is to relay the mail to the ISP's smarthost, and the mail will get pulled from the isps mail server. I want to do something similar to the pop3 connector in sbs 2003 [11:41] currently if people mail each other it goes to the isp, then the next person downloads from the isp when its for internal mail [11:50] having an issue setting up postfix [11:51] cant get it to sign my emails [11:51] http://pastebin.com/mffe2322 [11:51] tried just about everything to fix the problem cant put my finger on it [11:51] any help would be greatly appreciated [12:30] Hi guys [12:30] how can I debug something like this: [12:30] Aug 13 00:04:01 www kernel: [515697.941360] php[20786]: segfault at 7f9420f75f30 ip 00007f9420f75f30 sp 00007f941f2820f8 error 14 [12:31] I mean, I have no idea which specific php script caused that error so I don't know how to reproduce in order to debug [12:31] how can I get more info? [12:36] _ruben: still here? [12:40] psteyn: that means something crashed at that time, and there is no way to debug it unless you have turned on core dumps for that specific app [12:44] <_ruben> acalvo: somewhat [12:44] <_ruben> $dayjob keeping me busy [12:44] yeah, and I don't know which specific app it is. it's a live site with thousands of php files [12:44] sigh [12:45] <_ruben> psteyn: if the script runs long enough and crashes often enough, you could monitor the process table :) [12:45] _ruben: ok, quick question, as you suggested, I've configured posfix and dovecot, so now both work with LDAP. the problem is that the folders aren't being created. I think this is MTA's job right? but in postfix I'm using dovecot as a sender (in fact, using this guide https://help.ubuntu.com/community/Postfix/DovecotLDAP) [12:45] <_ruben> are adding a wrapper script .. which writes sript name and pid to a file, which can then be matched against the crash details [12:46] yeah, but that would be too easy ofcourse...sigh. it's random, and hours apart, and I don't know which specific code it is [12:46] <_ruben> acalvo: by default dovecot creates mailboxes either on first mail or on first imap/pop3 login [12:46] I'm having this error [12:46] what is weird is that I'm using stock standard ubuntu server 9.10 migrated from centos 5.3 and I didn't have those errors on that server. [12:46] <_ruben> psteyn: a systemwide wrapper would catch it [12:46] Aug 13 13:42:38 jupiter dovecot: imap-login: Login: user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured [12:46] Aug 13 13:42:38 jupiter dovecot: IMAP(acalvo): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home/acalvo [12:46] Aug 13 13:42:38 jupiter dovecot: Fatal: IMAP(acalvo): Namespace initialization failed [12:47] <_ruben> acalvo: set mail_location? :) [12:47] _ruben: but, where? [12:47] <_ruben> dovecot config [12:48] ok... touché, but it is getting home/acalvo as a mail_location, right? [12:48] <_ruben> this what i use on one system: mail_location = maildir:/var/spool/dovecot/%1d/%d/%1n/%n/Maildir [12:49] <_ruben> it stores mail for user@domain in /var/spool/dovecot/d/domain/u/user/Maildir/ [12:49] _ruben: you were right, gracias! [13:06] nijaba: I have introduced translations and a stand alone shell script.. just throwing it in the PPA now. [13:06] Got someone else to do de translations, just writing a call for help blog post now. [13:07] Daviey: great. let me know when the ppa is up to date :) [13:11] nijaba: now :) [13:12] nijaba: There is a script bundled called ubuntu-server-tip for retrieving the correct language, that presumably update-motd can use [13:24] i am making backups over a webdav using duplicity, which is better option? 1. mounting webdav, then using file:/// in destination OR 2. using webdav:/// in destination? [13:29] bum! [13:29] bump* [13:50] Need some server tips - http://blog.daviey.com/ thanks :) [13:51] Is anyone running Informix IDS 11.5 on Ubuntu Server LTS ? [14:04] Daviey: for some reason, the translated string have an empty newline appended and accentuated character are not displayed properly :( [14:04] hmm [14:05] i noticed the accentuated issue, but assumed that was a UTF-8 issue on my box. [14:05] Daviey: looks like it is NOT using the utf8 version... [14:05] empty new line.. hmm.. wonder what has introduced that. [14:06] nijaba: ah! I hope fortune supports accentuated chars. [14:07] Daviey: it does... example: Personnellement, je suis toujours prêt a apprendre, bien que je n'aime [14:07] pas toujours que l'on me donne des leçons. [14:07] -+- Winston Churchill -+- [14:08] hmm [14:09] Daviey: in german it is even worse... they use a lot of special chars [14:12] ipp für Ubuntu server: Mit 'etckeeper' können Sie Änderungen in /etc/ in [14:12] einem Bazaar-Repository aufzeichnen. Nützlich, um Änderungen zu verfolgen [14:12] und rückgängig zu machen. http://tinyurl.com/etckeeper [14:12] German looks ok to me :/ [14:14] weird [14:14] ahhh.. working it out. [14:14] nijaba: does "$ fortune fr/ubuntu-server-tips" work as you would expect? [14:15] except the blank line [14:15] Daviey: nope [14:15] hmm [14:15] i'm using a locally create package, not the one from the PPA [14:15] Daviey: nor does: fortune fr/philosophie [14:15] * Daviey upgrades [14:16] Daviey: must be a pb on my system! [14:17] nijaba: well oddly i'm seeing the same issue if i "$ LANG="fr" ubuntu-server-tip" [14:35] hello guys [14:35] my question today is, i have a dhcp server, so do i disable the dhcp server settings on my wireless router [14:38] cuz since setting up my ubuntu box as a dhcp server i notice that sometimes when i restart i'm able to connect to office computers at random [14:39] CopyWriter: typically a subnet has a single dhcp server serving it [14:39] why is bzr 1.3.1 the default in Ubuntu Server 8.04 LTS ? ...is there a more recent supported bzr package [14:40] thanks pmatulis [14:40] i'm going to try assigning static ip addresses to the clients [14:41] corporate_cookie: why? b/c that's what 8.04 shipped with [14:44] who was it that was looking for help setting up a jabber server? [14:45] article in Linux Journal this month about Openfire (http://www.igniterealtime.org/projects/openfire/index.jsp) [14:45] looked pretty easy to setup [14:54] CopyWriter: One dhcp is enough. but is it not easier to make friends with your tech? [15:10] nijaba: 21 suggestions raised so far! :) [15:10] Daviey: yeah!! [15:10] ontop of the current ones. [15:11] Daviey: as bugs? I do not see any? [15:13] Daviey: uh... now I do... [15:16] nijaba: Had a brief look at some of them.. mostly look good.. will need to make some of them more concise i think. [15:17] Daviey: agreed [15:31] # Appears as MAYNARD [15:32] (#G010E110M1T\sh) ÖÐ¹úÈË¶àÃ´ [15:33] (#GI8:E=88RM1Tkees) hi [15:44] huh. anyone know why 9.04 wants to install to LVM by default? anywhere I can read the discussion behind the decision? mostly curious, LVM is cool and all, just seems like a slightly odd decision for the default. [15:45] perhaps it's due to the fact that harddrives are bigger and cheaper than ever [15:45] so people are buying more and bigger drives than before [15:46] lots of big drives means a potential need for large volume management [15:46] but I'm just guessing [15:46] Solaris uses zfs my default these days, iirc, so it could be a response to that [15:46] s/my/by/ [15:49] morning everyone! [15:51] sgsax: yea, that sounds like a good guess. [15:52] suppose it can't hurt, this is just a vm I'm setting up because all my LTS ones are too old for what I'm doing (python 2.6) [15:52] all my servers are 8.04 [15:53] sgsax: zfs rocks [15:54] sgsax: yea, same here. I just need to test out a python 2.6 quirk and afaict that's not available even in hardy-backports, so I'm virtualizing 9.04 for a bit [15:54] RoyK: so I hear, I'm not a big sol guy, so I haven't played with it at all [15:54] bitprophet: makes sense, you could also roll your own package [15:55] sgsax: I'm a linux guy, really, but not really _only_ linux [15:55] i've just worked with solaris a few months, and it rocks [15:55] sgsax: this is true. I actually used to do that back when I was on debian proper and 2.3 was the default (and outdated) python [15:55] I kinda wanted to see what 9.04 was like anyway. [15:55] I don't use sol enough to be fluent with it, only have one box that runs my sunray thin clients [15:55] bitprophet: sure, I love it on the desktop [15:56] and I'm sure it's fine on servers, I just get a more warm, fuzzy, enterprisey feeling running LTS [15:56] haha, ditto. [15:57] plus I can't really justify upgrading for each release, but every ~2 years is acceptable [15:57] we have a few boxes with 9.04 here, mostly doing number crunching with some antique fortran stuff :) [15:57] oh my. [15:57] RoyK: you must be doing clustering [15:57] the researchers - at least some - still use fortran [15:57] does fortran even run on anything manufactured after 1985? [15:57] * bitprophet kids [15:58] our big cluster (1024 nodes) runs on gentoo and has any number of bizarre modeling libs [15:58] last language update of fortran was in 2003 :) [15:58] some barely-usable [15:58] but - gotta go... [15:58] fortran continues to be used and updated [15:59] mostly because scientists/researchers are *not* programmers [15:59] Heh [16:00] sgsax: and also because it doesn't have some of the performance issues that C has.. [16:00] So, tell me, Ubuntu's init scripts for postgresql, they just try to run postgresql and don't try to constantly poll it to make sure it's running after-the-fact, does it? [16:01] I don't think *any* init scripts monitor daemons after bringing them up [16:01] Psi-Jack_: I would guess that very few initscripts will do that [16:01] sgsax: anyway, my warm and fuzzy feeling went away after getting some new hardware, and now I'm hacking on karmic to get it to work. :) [16:01] sgsax, Why would you guess that? heh [16:01] maswan: yay for new toys :) [16:01] unless you're using Upstart, which (at least as of 8.04) was only for a small number of things by default [16:01] iirc [16:01] Psi-Jack_: but, that's your answer, use Upstart or something similar like daemontools/runit [16:02] cfengine can also monitor services [16:02] Ahhh. Upstart? Hmmm. [16:03] Psi-Jack_: it's an Ubuntu specific initiative, I think upstart.ubuntu.com? google should find it easy [16:03] I was only curious because it was one annoyance I had argued with for hours before about gentoo's init scripts, checking and polling waiting, and when you're doing a PITR walls recovery on the database, you just don't want it sitting there waiting endlessly. [16:03] Ahhhhhh [16:03] I remember hearing some about upstart, event-based init system. [16:04] upstart /sounds/ like it could be a good idea. [16:05] Though current init methods, gentoo has rc-config, which lets you start and stop services by 'rc-config start/stop/restart/etc service' Does Ubuntu have something similar? [16:05] depends. in my experience most daemons are quite stable and don't need watchdogging [16:05] Besides just /etc/init.d/service [16:06] however my rails using co-workers have some awesome daemons that crash when anyone so much as sneezes near them, so they need constant hand holding. so I've been using runit for that (as they run them on centos boxes in production, so no upstart) [16:06] bitprophet, When you're dealing with highly needed daemons, you want to be 100% certain. [16:06] Psi-Jack_: update-rc.d I think [16:06] yes, it definitely depends on your needs. [16:06] bitprophet: update-rc.d creates links in rc?.d to init.d [16:06] and that's why upstart/runit exist [16:06] it doesn't start/stop services itself [16:06] Hmmm, what a horrible name, update-rc.d? [16:06] oh, sorry, I misread what he said [16:06] heh [16:07] No idea, I always just do sudo /etc/init.d/ [16:07] there are several update-* scripts from debian [16:07] all for managing various things [16:07] update-rc.d manages stuff in the rc.d dirs [16:07] Yeah, I usually avoid using sudo direct-commands. [16:07] so it makes sense, but agreeably, it's a bit unweildy [16:07] I usually sudo su - first, then run them then exit [16:08] you can also use sudo -i [16:09] -i works too, long as it's the full login, so env gets proper. [16:09] Psi-Jack_: you can try the chkconfig package (not sure it works very well) [16:10] rcconf works for a ncurses-based thing, but. what I was looking for was just a simple wrapper to call /etc/init.d/service [16:10] I'll just make an alias if one doesn't exist. [16:10] -i starts a new "initial login", -s just spawns a new shell [16:11] Psi-Jack_: use the 'service' command then [16:11] Aha! [16:11] pmatulis: I always thought that was a rh-specific thing [16:11] sgsax: yeah, i guess you can call it a port from red hat [16:11] Heh [16:12] not that there's anything wrong with that... [16:12] Too funny. --status-all shows question marks by.... A lot of stuff I know is running, like, ufw [16:13] Oy, fricken pain in the arse.. One of my systems at home, won't fscking boot up without a keyboard hooked up to it, it stops to say it couldn't find a keyboard. [16:13] And it's an old Compaq 733, the CMOS doesn't have an option for disabling that error, [16:15] Anwyay.. [16:16] So, ufw. So far, I'm not liking it, but I'm giving it a fair looksie. [16:17] Psi-Jack_: re 'service --status-all', though I haven't looked at it, it is likely because service isn't smart enough to handle lsb output [16:17] So far, with ufw enabled, it blocks everything by default, so I had to ufw allow 22 to enable it, but that enabled it for BOTH internal and external network interfaces. What if I just wanted it enabled on a specific interface? [16:17] Psi-Jack_: you can either specify the destination ip of the interface you want to listen on, or in karmic specify the interface directly [16:18] Psi-Jack_: see 'man ufw' for details [16:18] karmic? [16:18] Psi-Jack_: Ubuntu 9.10 (as yet to be released) [16:18] Oh [16:18] heh [16:19] * Psi-Jack_ hates named versions. [16:19] yea that's one thing that gets me about ubuntu [16:19] And Debian. :p [16:19] yea [16:20] at least debian has fewer names. [16:20] Especially when people refer to those versions, by name, not by version. I understand numbers. [16:20] I used to constantly get hardy and gutsy mixed up for some reason [16:20] I apologize for the jargon [16:20] Oh, no problem, really. [16:20] Psi-Jack_: the "trick" is that they go alphabetically (at least nowadays) but I guess I'm mentally challenged because that never helps me [16:20] heh [16:21] I just know, so far, I'm not totally enthusiastic about ufw. [16:21] Good concept, but it's virtually impossible to make an uncomplicated firewall, sorry. ;) [16:21] All you do is complicate it [16:22] ufw doesn't run as a service, does it? [16:22] Not technically, no. [16:22] Psi-Jack_: ufw currently targets single-homed bastion hosts. it's cli interface is quite helpful with that [16:22] it just configures netfilter, right? [16:23] Psi-Jack_: a multi-homed host with routing is by definition complicated [16:23] yeah. [16:23] Which is why I'm not liking it. It's complicating. :p [16:23] Psi-Jack_: ufw can help quite a bit there too [16:23] Especially when people are saying to use ufw just to enable ipmasq, like everywhere. [16:23] ufw allow to oprt 22 proto tcp [16:24] That'll work in 9.04? [16:24] Psi-Jack_: yes [16:24] sans typos [16:24] sudo ufw allow to port 22 proto tcp [16:25] or with application integration [16:25] sudo ufw allow to app OpenSSH [16:27] Psi-Jack_: ufw provides a framework the provides all the power and flexibility of iptables, but does a lot of the loegwork for you by default. so with two lines, you can enable the firewall and open ssh. IMO that is much easier than writing your own iptables script. but if you're more comfortable with iptables, feel free to use it [16:28] Psi-Jack_: you might also be interested in https://help.ubuntu.com/9.04/serverguide/C/firewall.html, which discusses masquerading (among other things) [16:28] nijaba: I think i have resolved the language issue. [16:29] Daviey: yes? that would be great! [16:29] jdstrand, Yeah, tha's the ufw-based guide I followed to get it working,.. Or similar. [16:29] re ufw and 'service --status-all': ufw exits with the proper code. it is likely a bug in the 'service' script not being able to handle LSB initscripts [16:30] trying to move my / partition; I cp -a 'd everything to a new partition, updated /boot/grub/menu.1st with the new UUID and updated /etc/fstab with the new UUID. I ran update-grub and copied the new menu.1st to the newroot/grub/boot. what am I missing? [16:30] but I haven't looked at the issue with 'service'-- it is speculation [16:30] nijaba: try, "$ fortune -u fr/ubuntu-server-tips" I haven't commited it yet, but seems to solve it here. [16:31] I'm sure it's something obvious, but I'm administering the box remotely, and now I'll have to walk someone through plugging a monitor in and fixing whatever I forgot. it must have been something small, or maybe a typo [16:31] jdstrand, The only problem is, it seems like ufw isn't really well documented much. Not even that website you referred me to, tells how to handle forwarding ports. [16:31] Daviey: yes it does [16:31] \o/ [16:31] Psi-Jack_: ufw doesn't 'do' handling port forwarding per se. it allows you to do it if you already know iptables [16:32] Daviey: "-u Don't translate UTF-8 fortunes to the locale when searching or translating" what the heck! [16:32] Aha.. [16:32] Psi-Jack_: ufw focuses on 'host-based' firewalling [16:32] nijaba: odd eh? [16:32] Yeaah, So I'm noticing. [16:32] Daviey: very [16:32] Psi-Jack_: so there is nothing in it to particularly help with port forwarding [16:32] jdstrand, Is there one you would better recommend for a server? single to multiple ip handling? [16:33] Psi-Jack_: I'm not the right person to ask, tbh. I like ufw. [16:33] Yeah, well, this is #ubuntu-server. ;) [16:34] And sadly, THIS is the channel I was told, ufw is the "recommended" way to handle firewalls in Ubuntu. [16:34] Psi-Jack_: ufw can do port forwarding just fine [16:35] Psi-Jack_: you just add the appropriate rules to /etc/ufw/before.rules [16:35] Yeah, iptables-save-style rules. [16:35] * jdstrand nods [16:35] Which writing those kind of rules by hand is painful enough. [16:35] Psi-Jack_: any iptables guide on port forwarding will work [16:35] heh, jdstrand likes ufw [16:36] ;) [16:36] Psi-Jack_: there are tools listed at the end of https://help.ubuntu.com/9.04/serverguide/C/firewall.html if you want to try something different [16:36]