[00:12] ah, got it all working [00:12] turns out the main problem I was having was a typo in my root qdisc [00:12] had handle 1: instead of handle 1:0 [00:12] mucked everything up === erichammond1 is now known as erichammond [00:17] hi guys. I have 2 servers and a shared sas storage. I'd like to create a cluster between both servers to have some VMs and put its disk in the sas storage using a clustered FS. Should I use ubuntu+Xen+ ... ? Does UEC apply to my case? (I'm new to cluster stuff, sorry if I'm doing conceptual mistakes). [00:44] Does UEC work? [00:46] I've had horrible luck trying to install a private cloud. Currently stuck on step 4 of 7 on the UEC CDInstall instructions. It fails trying to discover nodes with some pythonic error that yields very little on google. Does anyone know what to do for this error: Failed to resolve service 'x07' of type '_eucalyptus._tcp' in domain 'local': Timeout reached ?? [00:48] smcquay, I guess UEC is not for my case. just 2 xen dom0 in a cluster would solve my case, I guess [00:49] glauber: that sounds reasonable [01:12] smcquay I was trying debian, but I could not get ocfs to work.. [01:15] I put dir,syncdir in my / mount options in /etc/fstab ... is this enough to turn off Write Caching on the root partition? [01:16] I still get "Assuming Drive Write Cache" when 8.04.3 boots. === freeflyi1g is now known as freeflying [01:53] hi [01:53] how to change the home folder path ? [01:53] for a given user [01:56] vi /etc/passwd [01:57] ok, it has to be done manually [01:58] some people think ftp should die, but what can replace it ? [02:07] ssh [02:35] maxagaz: SFTP (for rw) and HTTP (for ro) [02:54] owh, ssh looks too dangerous [02:55] maxagaz: Too dangerous for what? [02:55] owh, to dangerous to give someone rw access to one directory only [02:56] owh, but i probably don't understand it enough [02:56] owh, is possible to restrain the access to one directory ? [02:56] and its subdirs [02:57] maxagaz: ssh receives far more security scrutiny than a typical FTP daemon [02:57] maxagaz: That statement makes no sense. ssh is a mechanism to transport information across the Internet in an encrypted fashion. SFTP uses ssh to transport FTP commands across the net. You don't need to give shell access to a user. [02:57] maxagaz: locking it down is very well understood, because openssh is widely used [02:57] And as owh says, you can hand out SFTP access without giving full shell access. [02:58] twb, interesting, i didn't know that... [03:04] hello to all. i am having trouble installing the newest postfixadmin from sourceforge. [03:04] get downloaded it with [03:04] sudo wget http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin_2.3_all.deb?use_mirror=garr [03:04] and wanted to install it with [03:04] dpkg -i postfixadmin_2.3_all.deb [03:04] bit it stop with the error message [03:04] dpkg: Error .... [03:05] anybody know how to install the newest postfixadmin ? [03:05] xperia2: Is this package specific to your version of Ubuntu? [03:07] it is not a specific version for ubuntu. i am following this wiki help article here [03:07] https://help.ubuntu.com/community/PostfixCompleteVirtualMailSystemHowto#Enhanced%20Mail%20Services [03:07] that advice me to do this [03:07] normally it should work as written in the wiki page [03:11] too pitiy that this package is not in the ubuntu repositorys. it would be great to have this in the reps for upgrading later the system full [03:11] Have you lodged a packaging request for it? [03:12] xperia2: installing third-party packages is very strongly discouraged. [03:13] never heared about this how to do it ! do you have a link or similar ? [03:13] Because they are not subject to the same quality control as official Ubuntu packages. [03:14] twb: i understand but from my side of view this package should be in the repositority as it is very helpfull [03:15] the only possibility at the moment to use it is installing it as external package [03:15] xperia2: the alternative would be to learn how to manage postfix directly. [03:16] But as owh says, you can also file a Request for Package bug. [03:17] xperia2, that tutorial refers to a version that is considerably out of date [03:17] xperia2: You could download the source and compile it from source, but since you didn't tell us what the actual error is, there is little we can do from here. As twb says, it's strongly discouraged to install external software - to the point where we probably won't give you actual support. [03:17] did you check universe/multiverse to see if it's been packaged? [03:18] http://hpaste.org/fastcgi/hpaste.fcgi/view?id=12449#a12449 [03:18] Not nearly as bad as webmin's third-party .deb, but it's still clear that they don't really know what they're doing. === MarwolTuk_ is now known as MarwolTuk [03:19] qman__: I did; it hasn't. It's a PHP/MySQL web app for managing postfix/main.cf, so it's hardly surprising that nobody wants to package it. [03:19] ah [03:30] well postfix looks really very helpfull especially when it comes to mysql backed postfix solution. [03:30] http://postfixadmin.sourceforge.net/ [03:30] have installed now the older version as i need it. [03:30] will look to create a package request for this application if nobody till yet has created [03:31] first however i need to update the wiki page as the version is heavy outdated [03:38] I have hosts with heterogeneous disk sizes. [03:39] I wish to lvextend /dev/mapper/foo-bar on all these hosts, to use up all remaining PFree [03:39] Can I specify --size in terms of pfree? [03:41] Ah, --extents 100%FREE [03:47] twb, how to make restriction with ssh so that a user can only browse its folder ? [03:48] maxagaz: talk to #openssh [03:48] twb, ok [03:48] maxagaz: it should mostly be covered by the sshd_config manpage [04:07] okay gug is now allso filled up at launchpad ! [04:07] https://bugs.launchpad.net/ubuntu/+bug/485645 [04:07] Launchpad bug 485645 in ubuntu "[needs-packaging] postfixadmin" [Undecided,New] [04:10] :-) [05:04] OK, I have two user account I would like them to control the directory that are connect to their domain, how would I do this? [05:50] I can't get my traffic shaping to work right--upload throttling is working, but download throttling isn't. Here's my script: http://pastebin.com/m42db8842 [05:51] output of tc show commands indicate no packets are being sent to the 1:10 class [06:19] how to allow a user to browse only his folder ? [06:26] maxagaz: in what? [06:28] twb, in his home folder [06:28] maxagaz: I mean, in what service? [06:28] twb, i'm still on my ssh problem, but it seems it's not a ssh problem [06:29] maxagaz: in SFTP, then? Or full ssh? [06:29] maxagaz: did you ask the #openssh people about it? [06:29] twb, i just want to allow this user to scp or ssh to his folder but I don't want him to see anything else [06:30] So you *do* want to allow full SSH, not just SFTP [06:38] twb, i don't really understand sftp [06:38] twb, do i have to install something else than openssh-server to do sftp ? [06:39] openssh-server includes sftp [06:40] twb, actually i need someone to send some files on my server regularly, that's all [06:40] so, sftp looks the good solution if it allows this only [06:40] maxagaz: do you need normal ssh to work, too? [06:41] no [06:41] That is, does any user (including yourself) need to ssh into the box? [06:41] not those users [06:41] i need to ssh into the box [06:41] OK [06:42] but some users (all belonging to the same group) can only send files to the server [06:42] I tackled that situation by creating a jail for those users with jailkit [06:42] You need to write a Match block in your sshd_config, which has ForceCommand internal-sftp and ChrootDirectory /srv/pub or /home/fred or similar [06:43] I put them in: /opt/my_special_users/ [06:43] qman__: openssh-server handles the jailing internally -- and best of all, requires no libraries or anything inside the chroot [06:43] i mean their home folder [06:43] nice [06:43] qman__: apparently this is a relatively recent development in openssh-server [06:43] yeah, it certainly didn't exist when I was addressing it [06:44] hence the somewhat complex jailkit setup [06:46] ah [06:46] it was added circa april 2008 [06:46] last time I did it was in 2007 [06:46] twb, i'm in the sshd_config file, can you please teach me how to do this for the group ? i'm not sure to understand... [06:46] maxagaz: you want (at the bottom of the file) something like (untested): Match User fred \n ForceCommand internal-sftp \n ChrootDirectory /srv/pub [06:47] qman__: if your sshd_config mentions internal-sftp, you should have it. [06:55] twb, what if I want to do it with two users ? Just add another block ? Nothing tells ssh when the block ends ? [06:55] As sshd_config says, the match block ends at the end of the file, or at the start of a new Match block [06:56] It looks like you can say "Match User alice, bob" or something, but I haven't checked. [06:57] Obviously you will test this before placing it in production... [06:58] hi [06:58] i get Nov 19 22:55:22 host0104 kernel: [19938.001554] program smartctl is using a deprecated SCSI ioctl, please convert it to SG_IO [06:58] Nov 19 22:55:22 host0104 kernel: [19938.002814] 3w-9xxx: scsi0: ERROR: (0x03:0x0101): Invalid command opcode:opcode=0x80. [06:58] on ubuntu hardy server [06:59] Any clue ? [06:59] kaushal: safe to ignore, I think [07:00] kaushal, if you're not experiencing any problems, the errors are safe to ignore [07:00] make sure that smartctl is doing what you want [07:00] ok [07:01] but the system is unstable [07:01] qman__: how do i use smartctl to fix the above issue ? [07:02] the first error is regarding smartctl; if smartctl is working properly, it can be safely ignored [07:02] the second is likely an error with the configuration or drivers of your 3-ware RAID controller, or the hardware is failing [07:03] the thing about the second error is, if everything works, it can be ignored [07:03] but if there's a problem, it might point you in the right direction [07:03] Oh sorry, I only looked at the first message [07:04] smartctl -a -d ata /dev/sda [07:04] Smartctl: Device Read Identity Failed (not an ATA/ATAPI device) [07:05] that one's pretty self explanatory, /dev/sda is not an ata device, you need a different -d option [07:06] usually omitting the -d option will let it autodetect the correct one [07:06] but it doesn't always work, check the manual for the other options [07:07] -d ata is for SATA drives [07:07] But since you're using 3-ware, you probably need something vendor-specific like -d 3ware [07:11] 03:03.0 RAID bus controller: 3ware Inc 9xxx-series SATA-RAID [07:12] kaushal: the error means smartd CAN'T talk SATA to the drives in your hardware raid [07:19] bit confused here [07:20] twb, thanks a lot [07:20] what needs to be done exactly to sort out this issue ? [07:21] kaushal: read the smartd manpage? [07:21] yeah [07:22] Find out which -d you need [07:22] 18:07 But since you're using 3-ware, you probably need something vendor-specific like -d 3ware [07:22] Device: AMCC 9500S-4LP DISK Version: 2.08 [07:22] please try adding '-d 3ware,N' [07:22] you may also need to change device to /dev/twaN or /dev/tweN [07:22] when i run smartctl -a -d scsi /dev/sda [07:23] kaushal: and did you try that? [07:23] smartctl -a -d 3ware,0 /dev/sda [07:24] WARNING - NO DEVICE FOUND ON 3WARE CONTROLLER (disk 0) [07:24] I'm not familiar with 3ware, so the only other thing I can suggest is you contact your hardware vendor and ask them. [07:26] twb: so i have to use smartctl to fix the issue? am i understanding you correctly ? [07:26] kaushal, you haven't said what the issue is [07:27] the issue is the machine gets freezed and becomes unstable [07:27] kaushal: well, nothing you do in smartctl will fix that [07:27] yeah [07:27] smartctl/smartd just reports hardware errors in your disks [07:28] understood [07:28] Thanks [07:28] since you have another error regarding your 3ware controller, that's one thing that could be causing the problem [07:29] so i have to run the smartctl to look for hardware errors on my disk [07:29] check for driver conflicts, misconfiguration, or hardware failure [07:31] Hi all i've got a question/problem using ecryptfs with dovect maildir on my home (encrypted filesuystem) [07:31] I hate hardware raid for that reason [07:31] specifically, everything works correctly when i am logged via ssh into the server [07:32] but i log-off maildrop doesn't uses may ~/Maildir but the /var/mail maildir [07:33] i think the problem comes from the home encrypted filesystem that is not mounted when i logoff from the server [07:33] that's correct [07:33] any hint? [07:33] it can't access ~/Maildir when it's encrypted and not mounted [07:34] however, I don't know what you need to do to work around that [07:34] probably set it up to store your mail in a temporary folder while logged off, then move it when you log on [07:34] ok, but how can i keep it mounted when i'm logging off [07:34] or something like that [07:35] already works this way, but it's a pain in a multi-user environment.... [07:36] I'd like to keep the home filesystem always mounted [07:37] that's outside my knowledge and a quick google isn't helping, sorry [07:37] thanks anyway :) [07:43] twb, where is the doc you were referring about for the Match block ? [07:45] maxagaz: man sshd_config [07:46] twb, thanks [07:51] qman__: shall i pastebin the observation ? [07:53] how do i lock the account of a user on an nfs server? i'm using openldap to authenticate them. [07:53] twb: shall i pastebin the observation ? [07:57] twb, it seems i can't do it on hardy => http://www.debian-administration.org/articles/590 [07:58] twb, how should i update openssh-server on a production machine ? [08:03] maxagaz: unless it's in hardy-backports, you shoudln't [08:04] Unbuntu-Package search looks to be down... [08:09] twb, unfortunately, it's not... 1:4.7p1-8ubuntu1 [08:11] Since 4.7 doesn't have this feature, you'll have to make a chroot environment and run a second ssh daemon in there -- super sucky [08:12] So it might be reasonable to add intrepid entries to your sources.list and write some pins into apt.conf, though that's a bit of a hassle [08:49] Ubuntu 8.04 hans after saying Activating Swap [OK], No messages in log and not telling what it is doing. Any idea whats going on here? [08:51] I'd say it's hanging immediately after activating swap. [08:58] twb: it seems that activating swap is the last action of S35mountall.sh i doubt it hangs there [09:00] a_ok: so what is the next script after that? [09:04] how to sort by size with ls ? [09:06] <\sh> maxagaz, man ls ; ls -S [09:13] S36mountall-bootclean.sh [09:13] twb: I think this might be the problem script [09:15] a_ok: so put set -x at the top of it and try again [09:15] a_ok: be sure to boot without usplash, if you have that installed [09:19] twb: well its a production server so not reboting it anytime soon what does set -x do btw? [09:20] It turns on tracing [09:21] twb: are there servers using usplash? [09:21] a_ok: stupid ones, yes [09:21] There are lots of stupid people in this channel, so I have to check [09:22] Even my boss makes me put gnome on servers, "because customers are used to Microsoft TS and SBS, which has a local display" [09:30] twb: wtf you should fire your boss [09:31] unless your run it for thinclient stuff [09:31] Why would it matter if the server serves thinclients? [09:32] does it not need to run X with gnome libs etc? [09:32] Oh, right. It needs it installed, but not running on the server. [09:32] Morning, quick question [09:33] I restarted fail2ban [09:33] but it failed because the .sock was still present [09:33] so I removed the /var/run/fail2ban directory and now getting " [09:33] start-stop-daemon: Unable to set gid to 0 (Operation not permitted)" when I try to restart [09:34] Gorlist: you're not running it as root [09:34] just launch under sudo? [09:34] right its running, thanks [09:34] http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_with_iptables/ [09:35] -m recent is more elegant than that userspace fail2ban crap [09:35] right, will read through it [09:35] thanks [09:35] Better, of course, is to remove password-based authentication from ssh [09:36] That article isn't really up with best practices, but it's the least worst I could find on short notice. Check up with #netfilter if you decide to go with iptables [09:36] its not ssh [09:36] im having problems with ftp and mail [09:37] It should work for other services, too [09:38] will take a look, use to use denyhosts but decided to try fail2ban this time around [09:38] Of course, FTP is a stupid protocol and requires an extra bit of magic -- but SFTP (rw) or HTTP (ro) is a better idea anyway [09:46] Who should I bother about the -virtual kernel config? [09:55] Is there an #ubuntu-kernel? [09:56] Jeeves_: plan B is launchpad [09:57] twb: I'm trying #ubuntu-virt now, but they all seem to be asleep :) [10:16] hi, any suggestion on how turn-off encrypted home directory, on 9.10? [10:17] this feature is giving me a lot of problem with nfs and dovecot [10:20] * twb boggles [10:20] It's on by default? [10:20] i've installed it on 9.04 and after upgrade to 9.10 stilll there [10:20] yes in on by default [10:20] Good grief [10:21] I'm glad I stick to LTS [10:21] (And Debian, for my own stuff ;-) [10:21] It's not on by default, afaik? [10:22] I got asked a question about it, I don't remember which was the default choice though.. [10:22] maswan: ah, so it probably isn't the default [10:46] 9.10 server with sshd..is like 5 to 7 seconds from grub to login [10:55] found! here the link: http://ubuntu-ky.ubuntuforums.org/showthread.php?t=1134121 [11:02] <\sh> maswan, the default is "no"... [11:02] <\sh> maswan, btw...didn't you had some strange syslog entries like diskio.c: don't know how to handle 9 request somehow? [11:02] <\sh> (HP + SmartArrray) [11:03] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/413070 [11:03] Launchpad bug 413070 in linux "karmic cciss: error messages on working device" [Undecided,New] [11:05] <\sh> hmmm...since jaunty I have now the message I pasted above...I wonder what that is [11:05] <\sh> and karmic does it still [11:06] Ah, seems to be a different one then. I haven't seen that. [11:07] i am building some http cache servers using varnish, I am debating about not creating any swap [11:08] there used to be a performance hit if you built a system with no cache [11:08] err swap [11:40] incorrect: well I ran my linux box for years without swap and no performance issues at all, do note that when you run out of memory linux locks up instandly (way faster that is) compared to when you have a swap file [11:41] there used to be issues with not having swap [11:41] a box locking up is ok [11:41] no its not lol [11:41] incorrect: was it ubuntu speciffic? [11:42] maybe kernel 2.2 days [11:43] ow thats way back. linux memorymanagement is quite different now [11:47] i just wanted to ask [11:52] hi, question: after update my console is not 80x25 anymore. how do i get this back? [11:56] dvrcoder: frame buffer? [11:56] a_ok: i set vga=normal in menu.lst [11:56] (and i'm still using the old grub) [11:58] ah, i obviously did it wrong :D [11:58] dvrcoder: check the table here http://crunchbang.org/archives/2007/10/10/changing-bootup-and-console-screen-resolutions/ [11:59] epinky: thx [11:59] dvrcoder: nothing to do with grup furtunately kernel params [11:59] no VGA line should make it 80x25, 640x480 makes it 80x30 [12:00] I prefer 80x30, more lines, just as readable [12:01] I prefere higher resolutions logfiles tend to have longer lines [12:01] well, I do too, but for my one box I actually have the console up with, I prefer the low res so I can read it without my glasses [12:02] qman__: yeah it does depend on what monitor you have lol [12:02] all the other ones I just ssh from this desktop [12:02] well right now it's at about 60 lines. i don't know, i just like good old 80x25 on the console (since i have the same over ssh) [12:02] dvrcoder, well, you can set the vga mode in the kopt= line, then run 'sudo update-grub' to apply it [12:03] that's for grub 1, no idea about grub 2 [12:03] I also generally remove the 'quiet splash' from it too [12:03] that way when something goes wrong you can actually see what it is [12:03] but that's just personal preference [12:05] a_ok, it's a 17" CRT, plenty big enough, I just have very poor vision without my glasses ;) [12:10] qman__: didn't know you had to do an update-grub when you adjust menu.lst [12:10] dvrcoder: try with "vga=ask" ? [12:11] vga=normal is 80x25 [12:12] For grub2, you want to edit /etc/default/grub, particularly on x86-like systems to disable as fb there as it tells you to [12:12] a_ok, you don't if you just modify the actual boot lines, but in ubuntu, the proper way is to modify the kopt= line in the top section, then run update-grub [12:12] that also makes it stick for kernel updates and such [12:16] hmm good to know, I'm more of a manual man myself that is probalby why I still have gentoo at home. Since ubuntu failed me once with an upgrade I never trusted it [12:18] Personally, I prefer video=vesafb:1600x1200-32 [12:18] (Or uvesafb for widescreens, but that's a huge pain in the arse.) [12:21] re [12:22] btw, can i just unselect the pae kernel in aptitude if i don't need it? [12:23] I don't see why not [12:23] Hello. Can you please help me install ebox ? [12:25] Adrian1: ebox server? [12:25] Ebox..... https://help.ubuntu.com/9.04/serverguide/C/ebox.html [12:26] That how to doesn't work. [12:26] New bug: #485766 in lm-sensors (main) "lack of support for Fintek F71889F" [Undecided,New] https://launchpad.net/bugs/485766 [12:29] Adrian1: I don't use ebox, but what Ubuntu version are you using? [12:30] 8.01 [12:30] Or smth like that. [12:32] 8.10 [12:33] invoke-rc.d: initscript ebox, action "apache" failed. [12:33] if it's 8.10 then bad news [12:34] Adrian: https://bugs.launchpad.net/ubuntu/+source/ebox/+bug/255368 [12:34] Launchpad bug 255368 in ebox "ebox: Depends: libapache-authcookie-perl but it is not installable " [Undecided,Fix released] [12:35] Well... I installed it, let's see if it works. [12:35] Aaaa noap. [12:36] wasn't ebox totally broken in 8.04 and/or 8.10? [12:36] I remember someone saying that in here, though obviously I stay the hell away from web UIs [12:37] twb: you're right, it tells that here https://help.ubuntu.com/community/eBox [13:18] <\sh> twb, /me is always saying that === david is now known as Guest21743 [13:31] is there an irc channel with openldap support? [13:32] dvr: #openldap ? [13:33] epinky: oh cool, there really is :D [14:11] New bug: #485807 in qemu-kvm (main) "XP guest installs but gives BSoD on reboot unless in safe mode" [Undecided,New] https://launchpad.net/bugs/485807 [14:31] New bug: #485820 in mysql-dfsg-5.0 (main) "deca" [Undecided,New] https://launchpad.net/bugs/485820 === chuck_ is now known as zul [14:45] what is the goal of /etc/init.d/bootclean [14:45] ? [14:46] I thought that tmp could just be emptied instead of dicected and cleaned [15:46] New bug: #485873 in logwatch (universe) "logwatch should report apparmor events" [Undecided,New] https://launchpad.net/bugs/485873 [15:56] is it possible to force a pxe install to always prompt for manual network config [16:11] New bug: #485799 in postfix (main) "package postfix (not installed) failed to install/upgrade: sub-processo novo script pre-installation retornou estado de sa?da de erro 1" [Undecided,New] https://launchpad.net/bugs/485799 [16:13] Should I rely more on BIOS fan control or should I set up fancontrol daemon on Ubuntu? [17:42] Key [17:42] I am wondering if there is a patch and config management tool for multiple ubuntu servers? [17:43] hi [17:43] I have 100 that need to be managed and I can't seem tot find anything by searching the net [17:43] so, when configuring a server to authenticate to LDAP, I disabled all other methods of authentication. I was able to auth as an LDAP user. after reboot, it's not authenticating, and not accepting system users. is there another way to log into this machine, other than chroot? [17:43] anyone closing following my issue on ubuntu-server mailing list ? [17:44] cos I'm 2000 miles away, and I don't want to lead a monkey through a chroot. especially because I' [17:44] 'm not sure what partition it is, etc. [17:45] about 3w-9xxx: scsi0: ERROR [17:51] nevermind. I forgot single user mode was an option. [18:08] checking in again for my query ? [18:15] kaushal, running memtest86 for a couple of hours should tell you whether your memory is good for that server. [18:17] cyphermox, so its sure shot a memory issue ? [18:17] I mean sympton [18:17] kaushal, it's a common cause of lockups. [18:17] ok [18:17] can memtest86 run on 64bit architecture [18:18] ? [18:18] kaushal, you should check whether there are other errors in syslog, and perhaps post them up on in the mailing list thread, for the benefit of everyone in the thread [18:18] i think so, yes [18:18] cyphermox, i have done it already [18:19] nothing other than the errors for 3w-9xxx? [18:20] yeah [18:21] kaushal, or even including an excerpt of your syslog from say, that error message, up until the time you get a freeze, that could help. [18:22] ok === MarwolTuk_ is now known as MarwolTuk [18:38] why is my mail server rejecting all the emails telling them "Relaying denied [RCPT_TO]" im using sendmail and courier-imap [18:40] kaushal: yes :) [18:59] can i add mdadm to an existing single drive ubuntu-8041-server? === hggdh_ is now known as hggdh === MarwolTuk_ is now known as MarwolTuk [20:24] Hi guys.. I downloaded the ubuntu server iso ages ago, burned it on a cd.. now it's corrupt.. but it still boots.. just some files are missing.. anyway to do a netinstall from that same disc? [20:44] ok, so i just installed, and the only package i choose on install was the openbsd ssh server [20:44] on boot at the console the server starts [20:44] then it restarts [20:44] what's the deal? [20:45] aberhow, the server is restarting by itself? [20:45] yup, on boot it is [20:45] or it seems that way [20:47] Anything mentioned in the log files? [20:50] not other than the server is listening [20:50] then a few seconds later after the restart it says the server is listening again [20:50] on 22 [20:50] Is it not listening on :22 the first time? If not, it sounds like it might be restarting to rebind to a new network interface. [20:51] that could be it, the computer is set to dhcp [20:52] i would thit it would have its ip by then though [20:57] dhclient should show up in your logs, too. Should be easy enough to check. === MarwolTuk_ is now known as MarwolTuk === MarwolTuk__ is now known as MarwolTuk === luis__lopez is now known as luis_lopez [21:19] OK, I think I have OpenLDAP all setup and working, as well as basic FreeRADIUS. Now the part I don't exactly understand: How are client certificates associated with a user account - or are they even? [21:40] ziesemer: i might say lots of nonsense cause i haven't slept for quite a while [21:40] I know the feeling. :-) [21:40] So basically, I'm sure I could get FreeRADIUS to allow authentication using the same user/pass combinations as for local access, etc. [21:41] Client -> user/pass -> FreeRADIUS -> OpenLDAP [21:41] ok [21:41] I'd like to use certificates instead. Client -> X509 cert -> FreeRADIUS -> OpenLDAP [21:41] never played with that :/ [21:42] Under Microsoft AD, for example, the public keys for any issued certs are stored with the user's entry in AD (LDAP). If it doesn't exist there or if the user isn't active, login denied. [21:42] Seems that FreeRADIUS will work the same. If the public key isn't in the CA or is revoked, access denied. [21:43] I was just wondering if it still ties into user authentication when moving from user/pass to certificates. [21:43] All I can seem to find online is a reference to the "named client" in the WPA_HOWTO at http://wiki.freeradius.org/WPA_HOWTO . [21:44] So I guess I'll just have to test, but an hoping / assuming that the cn (common name) passed in the certificate is still used to check against the username. (Is account still enabled, etc.?) [21:44] http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on-centos5 [21:46] something like that...? [21:48] this is for sure something to test and explore [21:48] i never tried it [21:48] I'll experiment and post back. [21:48] a write up would be great [21:48] Will probably end up becoming a blog entry at blogger.ziesemer.com . [21:48] great [21:49] Thanks! Get some sleep!! [21:49]