[00:16] i cant get my ethernet working :( [00:16] says " eth0: link is not ready" [00:16] then either the cable isn't plugged in on one side, the cable is bad, the switch/hub is bad, or the network card is bad [00:17] none of the above? [00:17] how do you know? [00:19] cause ive checked em all [00:19] how did you check if the network card is bad? [00:20] i'm thinking it's a cross over cable and switch tried to auto negotiate it and roll it but was made of fail [00:21] KillMeNow: out of the dozens of possible causes, why that one? [00:23] giovani, because its fine [00:23] cheeseboy: that doesn't sound like a [00:23] *test* [00:25] its fine [00:25] ok, so you're lying -- you haven't tested it [00:25] feel free to get help from someone else [00:26] "it obviously doesnt work cause I say so" === qiyong_ is now known as qiyong [02:34] Ugh. Wish users wouldn't put '*' in filenames [02:35] it makes my head hurt [02:37] or name them -rf [02:37] or.. put carriage returns in them [02:38] I get a lot of &s and 's...a few *s [02:38] I'm going to have to install something like mc [02:38] * ball sighs [02:38] what are you trying to do? [02:44] Ah, it's alright. The *s weren't part of the filenames, they were ls -F showing me that some files were marked executable [02:44] chmod ftw [02:45] ah [02:50] Still have files with ' and & in the names though [03:16] New bug: #418396 in mysql-dfsg-5.1 (main) "need to port 38_scripts__mysqld_safe.sh__signals.dpatch from mysql server 5.0" [Undecided,New] https://launchpad.net/bugs/418396 [03:19] hi guys, i am setting up rssh to allow chrooted sftp access to users and was wondering why /bin/bash needs to be accessable in the chroot. I was under the impression the purpose of rssh was to replace the shell [03:22] mase_work: who said bash needed to be in the chroot? [03:22] giovani: well it fails if it is not in the chroot. [03:22] did you set the user's shell to rssh? [03:23] yes [03:23] where is the failure error message? [03:23] i.e. how did you come to know it failed? [03:23] it is in /var/log/user and it immediately disconncts the sftp sessions [03:23] let's see the error then [03:24] ok 10 secs [03:29] giovani: ignore me. it seems i have one set up here without /bin/bash which is working .there is obviously something else going on as well. [03:29] anyone know a way to limit ssh login attempts to 3 per hour? [03:30] mushroomtwo: do you mean per source ip? === mushroomtwo is now known as mushroomblue [03:31] that would work too. [03:31] there's no built-in mechanism for that -- you'd have to use a script that watches for logins (failed, presumably) and then actively bans that IP -- which is essentially an IPS (Intrusion Prevention System) [03:31] well why not describe what your goal is ... [03:31] someone has compromised me over wifi [03:31] your initial description was an output ... not really a motivation [03:31] and I'm pretty sure there's been a man-in-the-middle attack going on via the router. [03:32] hello all. im wondering how i can have a user start up a program at boot....id like for it start a screen session. i tried adding this to the crontab "@reboot /usr/bin/screen &" ...but it does not work. [03:32] so all my machines are more than likely compromised. [03:32] Wicked: you should add it to the proper runlevels [03:32] mushroomblue: how is this related to wifi? [03:32] giovani, well i just want to start screen for a certain user at boot...i really dont want to add a init script or somehting like that. [03:32] I've narrowed down the ways the attacker has accessed the system, and it appears it happened over wifi [03:33] there has to be a way to have a user be able to start something at or after the machine boots [03:33] which means, I have a douche of a neighbor [03:33] Wicked: ok ... "at boot" and "for a user" are entirely different, and not compatable methods [03:33] how about...id like a program to start under a certain user after the machine is fully booted. [03:34] the proper way to do anything like that is with an init script [03:34] it's just that simple [03:35] hmm ok [03:35] but I really don't think that you should be doing it -- I think you should be looking for a better method to achieve the output you want [03:35] mushroomblue: fail2ban, denyhosts, etc -- a bunch of scripts to monitor failed logins [03:36] I'm not sure how limiting logins to 3 per hour has anything to do with preventing an attacker who already has a password [03:36] it wouldn't. but it would discourage bruteforce [03:36] but if they already have hacked your system [03:36] there won't be any bruteforcing [03:36] so you need to define your parameters here [03:37] i run irssi and a few other things inside a screen session. i have screen setup to start the programs when screen is started. after the machine is rebooted i would like screen to be started so then my programs will always be running...then i can connect via ssh and reconnect to the screen session [03:37] Wicked: why would the system be shut down? [03:37] i thought setting a crontab to do that at boot would work...but it fails to start screen [03:37] giovani, lots of reasons. mostly...power outages [03:37] or new kernels [03:38] giovani: make no mistake, I'm in the process of reinstalling all my servers atm, and flashing the router. I'm just trying to come up with ideas so that there isn't a next time. [03:38] or someone trips over the power cord... [03:38] I can't afford another full system rebuild. [03:38] s/system/network/ [03:38] but thanks for the tips. [03:38] mushroomblue: ok -- but without understanding the attack you're trying to prevent, you're not goign to get anywhere [03:42] Wicked: alright, well if you want to use the crontab -- there's no need to add the '&' at the end -- the process isn't going to ever be in the foreground anyway [03:42] Wicked: Why not setup .bash_profile to launch screen for the user upon login? [03:42] I presume you added that to your user's crontab? [03:42] grim76: because he doesn't want a new screen session on every login, obviously [03:42] yea [03:43] Wicked: and you tested this with a -reboot- and not a clean startup? I'm not sure if it's specific to the former [03:43] and i just want screen to start at boot so all my programs in screen witll be running as soon as the computer boots. [03:43] http://rpatterson.net/blog/screen-sessions-at-boot [03:43] im trying that now [03:43] giovani, ive tried both [03:43] both what? [03:44] ok well that url is using an rc script [03:44] like I recommended [03:44] did you remove the '&' from the end and try a reboot? [03:46] yes [03:46] i added the & because without it it did nothing. [03:46] that seems unlikely, but alright [03:48] it's possible that @reboot isn't supported in your version of cron [03:48] I don't see it in my manpages [03:49] yea. [03:49] thats what i was thinking...that its a newer feature thats not in 8.04 [03:50] or a custom-compiled one in a major distro, who knows [03:50] but I don't see it documented outside of casual mentions in google [03:50] i don't see manpages containing it [03:52] yea me neither. i actually 1st saw the @reboot mentioned on a debian page [03:52] cant remember which one. [03:52] yeah, looks like ubuntu contains cron 3.0 [03:53] and the only manpage I can find mentioning @reboot is for 4.1 [03:53] Is that Gnu Cron? [03:53] no ... isc/vixie [03:53] the standard one :) [03:53] ah [03:54] Thanks [03:55] gnu cron doesn't even seem to exist [03:55] except in intention [03:55] http://www.gnu.org/software/gcron/main.html [03:56] nice that did just what i wanted [03:56] "This project has been decommissioned and is no longer developed." [03:56] http://directory.fsf.org/project/gcron/ [04:12] Ummm man 5 crontab |less +/@reboot shows @reboot in the Ubuntu 8.04 crontab(5) manpage, for me at least... [04:20] jmarsden: I stand corrected -- you're right, somehow I missed that [04:21] Debian, at least, defaults to Vixie cron [04:22] yeah, as does ubuntu === jtimberm1n is now known as jtimberman === pace_t_zulu_ is now known as pace_t_zulu [04:33] i think theres a vixie cron on aix even [05:06] I am having trouble with Webdav. I get the Error: You cannot connect to this server because it cannot be found on the network. Try again later or try a different URL. [05:06] Here is my Virtual Host configuration: http://paste.ubuntu.com/259068/ [05:06] Any help is appreciated. [05:07] Please [05:12] I have a private lan with a domain name gandalf.lan. I'm trying to configure /etc/exports with the following line /sharing *.tolkien.lan(blablabla). But it doesn't work Can someone telling me what I'm doing wrong ? [05:12] If I write /sharing *(blabalbla) everything is ok [05:13] probably a name resolution problem [05:13] How can I check? [05:14] can either host ping each other on tokien.lan and galdalf.lan? [05:14] I'm able to ping the gandalf.tolkien.lan from the cleint [05:14] whats the clients name? [05:14] hal9000 [05:15] can the server resolve that to hal9000.tolkien.lan ? [05:15] I am using: http://www.howtoforge.com/how-to-set-up-webdav-with-apache2-on-ubuntu-8.10 [05:15] No ! [05:16] To set up Apache for Webdav [05:16] yeah, so name resolution needs to work both wats [05:16] ways [05:16] otherwise use IPs [05:16] How can I do that both way ? [05:17] if you dont have a dns server, make sure they're all defined in /etc/hosts [05:17] I've already installed DNS. [05:17] Seems to work ok [05:18] Any ideas about my Webdav? [05:18] apparently its not if things arent resolving... [05:18] 'Cause I can ping gandalf.tolkien.lan www.tolkien.lan and tolkien.lan from the cleint [05:18] of course, all your hosts need to point to the same dns server [05:18] I see no difference but the paths in my file from the tutorial's pages [05:18] but the server.. [05:18] Alex_21: i havent messed with webdav in a long time [05:19] Can someone check to see if my config file is correct? [05:19] Where do I start to configure the server to recognize clients [05:20] slap: make sure it can resolve your hostnames [05:20] It is a mission critical webdav share [05:20] like... either consider it to point to your dns server in /etc/resolv.conf or edit /etc/hosts ... probably the same way you configured the client [05:21] Totally forgot to edit resolv! ( I remember reading something about that) Thanks a lot [05:24] are you trying to get to the webdav server using the URL as configured? [05:25] its going to be some.domain/base [05:32] Ok, now I can ping it both way. But I still have an access denied when I triy to mount the sharing ? Any clues ? [05:32] look in the logs [05:36] It says that there is a mount request for a unknown host ?? [05:37] I figured it out. [05:37] found it [05:38] I shouldn't have been so chicken about looking in Apache's logs [05:38] add the client's name on /etc/hosts [05:38] Thanks Sam-I-Am [05:39] Now, I can enjoy this webda share [05:40] logs are good [05:41] Yes. [05:41] Not plesant when you use a screen reader, but good all the same [05:46] Sam-I-Am I'm learning networking on linux. I have one thing I would like to know. If I want a sharing on a medium network with a DHCP service, how can I configure bind and nfs if I have dynamic address. Do I have to use something else ? [05:47] Is it possible ? [05:47] you can either make sure hosts keep the same name independent of IP... using dynamic DNS... or you statically assign IPs to hosts [05:48] no, I would ike to try with dynamic IPs for hosts. So I have to take a look at dynamic DNS, right ? [05:48] yup [05:49] or just allow entire ranges of IPs for nfs [05:49] or domains [05:49] Do I have to use bind9 with a different configuration, or there's another deamon [05:49] isc dhcp talks to bind9 [05:51] No. How can I do that ? [05:53] theres documentation out there [05:59] time for bed... [06:09] Thanks for all your help [06:09] Good night. [07:00] New bug: #416093 in samba (main) "karmic hangs during booting" [Undecided,New] https://launchpad.net/bugs/416093 [07:54] Hi there, I just recover my samba server but i cannot access to all of my shared folder even if i have permisions, and still i got error such as cli_lsa_lookup_sids_noalloc(): out of memory [07:55] New bug: #418276 in samba (main) "package samba-common 2:3.4.0-3ubuntu1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1" [Undecided,Invalid] https://launchpad.net/bugs/418276 [08:20] short question, what time is it (in UTC)? [08:36] johe|work: date -u [08:36] too easy :-) [08:39] i have a problem here with the ldap client auth, user logging works now, but he does not get the groups === mdz_ is now known as mdz [10:23] is there a decent guide that someone can point me to regarding 9.04 and hardware raid? [11:01] Hi, anyone know anything about RAID. See im not sure what config im best using [11:02] I see RAID 1 is all drives are the same and if one goes down you just replace it. But that means that if I have 6 72gb drives in, im only gonna get about 68gb of space? [11:02] which is ok for my LTSP server, but [11:02] i need to setup an asterisk server and store lots of calls. Am i best using RAID 5 for that? [11:08] <\sh> garymc: if you want raid1 over 6 drives, you use RAID10 [11:08] <\sh> garymc: which is a mix between raid0 and raid1 [11:08] thanks, but thats my issue i dont really understand raid [11:08] so dont know which one is best to use [11:09] <\sh> garymc: http://www.cuddletech.com/veritas/raidtheory/x31.html [11:09] im just looking to update the controller array 5i firmware [11:10] <\sh> garymc: it depends on your work setup ... raid5 + databases could be a problem in some cases...then you have raid6 which is similar to raid5 but has two drives which could fail at the same time [11:10] <\sh> garymc: HP? [11:10] yes [11:10] HP [11:11] * \sh is mostly using raid10 for more diskspace with mirroring...and having at least one more redundancy via drbd or directly using HP MSA 60/70 or iscsi solutions for lots of diskspace... [11:12] hmm lol, i better read up more on it all [11:14] im looking to download the firmware for my server, but theres that many differnt packages on the HP site not sure which one to get. [11:14] What do you think of this one? [11:14] Systems ROMPaq Firmware Upgrade Diskette for HP ProLiant DL380 G3 (P29) Servers [11:14] would that be the correct stuff to download and boot my server with? [11:15] <\sh> garymc: there is normally bios firmware updates and smart array updates packages...and there is at least one CD ISO where the latest stuff is on..depending on your configuration... [11:15] <\sh> smart array 5i is old afaik [11:15] so do i have to download the 5i firmwarE? [11:16] or can i upgrade my firmware to someting else [11:17] <\sh> garymc: for your smart array 5i http://h20000.www2.hp.com/bizsupport/TechSupport/DriverDownload.jsp?lang=en&cc=us&prodNameId=266599&taskId=135&prodTypeId=329290&prodSeriesId=374803&lang=en&cc=us this is the right page [11:17] <\sh> for your dl380 there is some other page....search hp... [11:17] thanks [11:17] :) [11:18] trying to load that link now [11:18] <\sh> garymc: for your ROM update...you need http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=us&prodNameId=266599&prodTypeId=329290&prodSeriesId=374803&swLang=8&taskId=135&swEnvOID=1085 this page === mrchrisadams_ is now known as mrchrisadams [11:18] whats a rom update? [11:18] <\sh> garymc: the smart array bios firmware stuff...it's the bios of your smart array controller [11:18] that first link you gave me lists operating systems [11:19] im using ubuntu 9.04? [11:19] or Centos [11:19] <\sh> garymc: yes and there is a smartstart maintaince - ROM update...that's what you need [11:19] do i just burn them to CD rom? [11:19] and boot the serveR? with it in? [11:20] <\sh> garymc: dunno...I'll have a debian OOB installation for this to update..cause I'm not really convienced that HP is supporting my ubuntu 64bit setup ;) [11:21] ahh ko [11:21] ok [11:21] well im running 32bit as 64 bit wouldnt work? [11:21] or wouldnt go on [11:22] <\sh> garymc: ah no...hp is supporting debian 32 + 64bit ... but as there are some kernel modules which I didn't test against ubuntu 32 or 64bit I can't say if it works...problem is that my HP supporter always tells me "You know more about this crap then I do" and I don't have the time to test it [11:22] ok lol [11:23] <\sh> garymc: next target of my work is to implement HP SIM for our server infrastructure and then I have the time to test HP drivers on Ubuntu [11:23] cool, busy busy :) [11:36] h [12:04] Daviey: ... [12:37] hi [12:37] i have a question, how can I install and configure truetype fonts for php? [12:44] sergevn: I'm kinda confused what you want to achieve.. php will produce valid output, but the fonts really need to be client side.. [12:45] Unless you are trying to create images or similar sergevn ? [12:45] Daviey: yeah images :) [12:46] ah [12:47] i am trying to use imagettfbbox() but getting error it cant fint the font. [12:48] sergevn: unless i'm mistaken, it uses a full path [12:48] you can't just say $font = "somefont.ttf"; [12:50] so you could just drop the somefont.ttf to the same location as the .php script [12:52] yeah im doing that. [12:52] still error [12:53] that's the weird part [12:53] and on "another" webhoster it does work [12:56] sergevn: http://uk.php.net/manual/en/function.imagettftext.php#90580 [12:57] sergevn: you might get more specifc help in a #php channel. [13:00] Daviey: you saved my day [13:00] it works :) [13:00] heh [13:05] is there a decent guide to making 9.04 work with hardware raid? [13:06] everything seems to want to send a person to software raid [13:07] Hello all, I want to build an ubuntu based lab, with fat-client config. Login+home mount should be authenticated using LDAP. Can any1 guide me to the needed howto documents? [13:08] soloslinger: to get hardware raid *working* is often irrelevant to the OS. [13:08] soloslinger: that's b/c with hardware raid the OS does not know anything about the raid configuration. it will see one drive when there are actually two (RAID1) [13:08] (for instance) [13:08] soloslinger: hardware raid just presents the raid disk as a standard block device. [13:09] pmatulis: I have configured hardware raids for use with other operating systems, but I can't seem to get ubuntu's server installer to want to recognize it. [13:09] Can any1 support me, please ? [13:09] soloslinger: k, that's different === cjwatson_ is now known as cjwatson [13:09] tarekeldeeb: however, monitoring the raid device is normally the responsability of the OS. [13:10] soloslinger: What make/model raid contoller are we taling about here? [13:10] soloslinger: maybe ubuntu just doesn't support that particular controller [13:11] pmatulis: that is my sneaking suspicion(sp?) unfortunately... Daviey: I'd hafta reboot the box and look, it's in a fairly new 1 u server, an hp dl160 g5 [13:11] soloslinger: ahh, is it hp raid? [13:12] The spelling of suspicion is correct [13:13] Daviey: yeah. [13:13] soloslinger: Then it is probably cciss, and i dislike it :) [13:13] pmatulis: ty =) [13:14] soloslinger: What version of Ubuntu are you trying to use? [13:14] Daviey: most likely it is. Am I SoL tryin to get the ubuntu installer to see it? 9.04 [13:14] no.. it should work. [13:15] kk [13:15] I'll hafta play with it when I have the opportunity to bring the server down for longer. Is there some docs somewhere that you (or someone else) could point me to? [13:16] Did some googling for that, but everything comes back with software raid tips [13:16] soloslinger: The "disk" should show under /dev/cciss [13:16] yeah [13:17] But as the installer moves along, even if I want to do partitioning manually, I don't see it prompt me to specify a device to use as a disk [13:17] ie, $ ls /dev/cciss/ [13:17] c0d0 c0d0p1 c0d0p2 [13:17] soloslinger: Can you confirm you are using the Ubuntu Server disk, or the Ubuntu Desktop? [13:19] Daviey: I am fairly certain I am, nobody here runs Ubuntu for a desktop, so there shouldn't be a cd of it laying around. If I install to one drive it doesn't try to get me to put a WM on like the desktop installs I did once upon a time. [13:19] ok, great. [13:19] Daviey: I would say I am fairly certain I am using a Server disk. [13:19] soloslinger: is it graphical or ncurses (blue)? [13:20] pmatulis: blue [13:20] soloslinger: When you get to the disk management area, what do you see? [13:22] Daviey: It first prompts me for something to the effect of "Do you want to enable Serial ATA RAID" with a yes, no and cancel. Regardless of if I select yes or no, the next screen where normally the partitions are built is blank. In other words, there isn't a "disk" there to divide up the partitions. [13:22] One trick could be to switch to a shell prompt (alt+f2) and type lspci to find out what storage controller it actually is [13:23] I'm not sure that the dl160 has a real cciss [13:23] i'll bet it's the P400. [13:23] Daviey: You'll hafta forgive me too, i needed something up by the time I left today so I am going from memory an hour or so ago. [13:23] soloslinger: no worries, can you try what maswan said? [13:23] sorry for duplicating, but i need support [13:24] Hello all, I want to build an ubuntu based lab, with fat-client config. Login+home mount should be authenticated using LDAP. Can any1 guide me to the needed howto documents? [13:24] If I switch to a shell prompt and build the partitions via Fdisk, could I switch back into the installer and carry on like normal? I am comfortable using Fdisk. [13:24] :( [13:24] soloslinger: I'm not sure offhand if fdisk is included in the environment, parted and probably sfdisk is [13:25] tarekeldeeb: Hm. Don't really know. We use kerberos auth. [13:25] Daviey: I will try the next time I can bring the server down for any time. I am fortunate that it's in a cluster of a couple other servers, so losing a disk will suck, but it could be worse. [13:25] tarekeldeeb: There are a bunch of ways, perhaps if you hit the ubuntu-server mailing list, you'll get a better response. [13:26] soloslinger: ok.. what OS is it at the moment? [13:26] ubuntu 9.04, I just have it running on one disk atm === freeflyi2g is now known as freeflying [13:26] Daviey: you want the output from a lspci ? [13:26] ahh, you can just ssh in and run some commands :) [13:26] kerboros, is it better than LDAP? Or you seek windows clients interoperability ? [13:27] soloslinger: please. [13:27] soloslinger: Also, fdisk -l would be handy [13:28] Daviey: thanks .. [13:28] Daviey: lspci = http://pastebin.com/d6e9ca9a4 [13:29] 631xESB hmm [13:29] Daviey: fdisk -l = http://pastebin.com/dd2f5c3c [13:30] i was wrong :) [13:30] soloslinger: for a two disk setup, is there a reason you dont want to use software raid? [13:31] Daviey: haven't really weighed the pros and cons out yet. Figured it had the hardware for a hardware raid, might as well use it. [13:33] soloslinger: I can see your point, but for 2 disks - there is no real extra overhead for a mirror / RAID-1 [13:33] and actually, you get some bonus.. you can pull the disk out and put it in any server, not locked to the RAID controller card [13:33] it's easy to monitor. [13:34] Daviey: I suppose so. What are you seeing that put the nail in the coffin to the hardware raid idea for my future reference? [13:35] soloslinger: I haven't used hardware raid with 631xESB.. but it was the fdisk -l, that showed 2 disks made me mention it. [13:35] Daviey: ah. Gotcha [13:36] soloslinger: mdad really is your new best friend :). [13:37] Daviey, maswan, pmatulis: I appreciate your time and help. I get to get outta here and get some sleep! [13:37] Daviey: Yuup. Sounds like I got some reading to do. [13:38] nn soloslinger, let us kow how you get on. [13:38] will do [13:38] yo, im installing new firmware for my HP server and its stopped at 82% :( [13:38] should i just wait? [13:39] firmware? for what device? [13:39] Array controller 5i [13:39] RAID [13:39] ok [13:39] all seemed to be going well then it stops, just sitting there :( [13:40] :) [13:40] now its done lol [13:40] ok [13:44] anyone tell me if I can have 4 X 146gb drives in my Server [13:44] 3 of them setup as a logical drive as RAID 1 and one of them spare [13:44] and the fourth 146 as Logical drive on its own as RAID 0 [13:44] ? [13:45] <_ruben> both raid0 and single drives arent raid [13:45] so would the RAID 0 drive be its own drive for extra storage? [13:45] so I could remove it when backing up? [13:46] Or should I set the 4 DRives up as RAID 1+0 and have two of them as Spares? [13:46] decisions decisions [13:46] its for a UBUNTU LTSP server [13:46] <_ruben> you cant do raid10 with 2 spares with just 4 disks [13:46] <_ruben> raid10 has a 4disk minimum without spares [13:47] <_ruben> (except for the software raid10 in linux, which can do fancy raid10 setups with odd number of drives for instance) [13:47] jdstrand, so yesterday you mentioned to me that passing sensitive data to a application via environment was not secure ? why is that? i'm not aware of a way in which a non-root user can view environment of another users' processes. [13:47] <_ruben> it pretty much comes down to how much performance and how much storage you need [13:48] well my RAID config is letting me setup RAID 1+0 with 2 drives and two spares? [13:48] New bug: #418342 in mysql-dfsg-5.1 (main) "akonadi-server prevents install of mysql-server-5.0" [Undecided,New] https://launchpad.net/bugs/418342 [13:48] what linux software can i get that does that _ruben [13:49] is it in the GUI or command prompt? [13:49] im better with gui [13:49] :) [13:50] <_ruben> garymc: mdadm .. not sure if there's a gui for it [13:50] ok [13:51] is RAID 0 just pure disk space? [13:53] and performance [13:53] <_ruben> raid0 isnt raid (as the r in raid stands for redundant, and raid0 doesnt offer redundancy) .. it basically 'glues' 2 or more drives together .. same as with using multiple pv's in lvm [13:54] ok well ive setup two logical drives in the array controller [13:54] one RAID 0 146gb drive [13:54] and 3 Raid 1+0 (2 plus a spare) [13:54] <_ruben> performance is one of the most common reasons for raid0 .. its nice for video editing for instance [13:54] Will this work? [13:54] I want to use the single 146 as a data backup [13:54] <_ruben> like i said, a single drive isnt raid, not even raid0 [13:54] will it show up as a seperate drive in ubuntu? [13:55] <_ruben> and im not sure how your raid controller does it, but in my book, raid10 over 2 disks isnt possible [13:55] hmm posible its RAID 1? [13:55] <_ruben> could be [13:55] thats over 3 [13:55] one as spare [13:55] just trying to work out the best setup of this stuff [13:55] <_ruben> raid1 with 2+1 disks is fairly common [13:57] cool but i got a RAID 0 on there too [13:57] in the fourth slot [13:57] will this work? [13:58] smoser: it is an unnecessary risk imo. subprocesses will inherit it, which might not be what you want. the same user can get to it (of course), root can get to it (of course). There might be other ways I'm not thinking of. IMO it will be difficult to get right, and if you do get it right, you may not have covered everything for another platform [13:59] smoser: I also googled it to see if I was missing anything and came across: http://dev.mysql.com/doc/refman/5.0/en/password-security-user.html [14:00] <_ruben> garymc: it probably would [14:00] on linux the "extremely insecure" would seem a bit incorrect [14:01] as "If you set MYSQL_PWD, your password is exposed to any other user who runs ps." is as far as i can tell explicitly wrong [14:02] so anyway... i agree that without care, environment is longer lived than data written to a pipe. but loads better than other ways. [14:03] and actually, i *think* that mysql was where i first saw this... if you do run '-pMYPASSWORD' as a command line argument, it reads that, and then writes over its argv space, so that the 'ps' only shows 'XXXXXXX' [14:05] smoser: yes, but it is in ps output for a split second in that case [14:05] yeah [14:05] s/second/milli secong/ but yeah [14:05] :) [14:06] smoser: it's not particularly hard to win those kind of races [14:07] fair. [14:07] jdstrand, do you know, is it actually the case that environment is intended to be "secure" on linux ? [14:07] ie, as a general goal rather than just happenstance that the /proc//environ has secure perms [14:08] smoser: I think it is hoped to be, based on /proc//environ [14:08] (i realize not pure happenstance, but wonder if it would be considered a bug if it would be treated as a security issue if that were leaked elsewhere) [14:08] jdstrand, thanks. [14:09] smoser: of course, I've seen kernel bugs where the permissinos end up wrong in /proc/ [14:11] smoser: based on /proc//environ, you *probably* are ok to use it, but still are dealing with subprocesses and root. I don't know exactly what you are trying to do, but if it is ec2, protecting against root where feasible would be a good defensive stance [14:11] smoser: I don't claim to know every means of getting at the environment, but it doesn't feel right [14:12] smoser: kees and mdeslaur may want to weigh in as well [14:13] jdstrand, it was just a general question, really, but came up in context of ec2-ami-tools (from amazon) which expose "secret-key" on cmdline and provide no other way to pass it (that i'm aware of) [14:13] how much hope does one actually have for protecting against root ? is that a reasonable goal? [14:14] jdstrand, i would say that if you were a program reading sensitive data from environment you should take care to un-set that data after reading [14:14] smoser: a real fix would be to use a config file, as mysql does. You should file a bug with amazon to get that implemented. [14:15] (I recommended that initially) [14:15] so how is a permanently stored plaintext password in a config file more secure than just about anything... definitely not safe from root. [14:16] oh...good luck protecting from root [14:16] smoser: those are two different points [14:16] * mdeslaur has not followed the whole thread [14:16] you should always protect your stuff from root [14:16] because root is the evil man [14:16] it would seem to me that plain text password in a text file is not really more secure than environment on linux [14:16]