[00:01] GammalSokk: Well, in that case I'd say you'd also have to modify your new /etc/init.d/samba to call smbd and nmbd using the -s flag. That's probably just one of many defaults you now have to be explicit about. [00:02] ye, guess I'm gonna try getting it done tomorrow tho, getting late now, and I can't find any usefull about it when I search the forum or on google... [00:03] oh and nmbd doesn't restart properly when I issue '/etc/init.d/samba restart' it seems, heh, I blame me being tired [00:03] GammalSokk: That's a normal problem :) [00:03] ah, ok [00:04] GammalSokk: That is, things going wrong due to the system administrator being tired :) [00:08] I guess I can just blame my boss for demanding this to be done in a too small time frame :P Buuut then again he's paying my overtime so... [00:23] GammalSokk: Well, if nothing else the smb.conf man page is really good. [00:23] gives me something to do at work tomorrow I guess :) [00:23] ty for help so far, gotta try and sleep 4 hours before going back to work :P [00:24] yeah, sleep is probably something I should look into myself :) [00:27] How do I setup SSL? [00:27] (Error code: sec_error_untrusted_issuer) <--- I am getting this error when trying to access a https website on my server [00:28] don't have proper certs setup? [00:28] check the server guide [00:28] billybigrigger, good idea [00:28] =) [00:29] https://help.ubuntu.com/9.10/serverguide/C/certificates-and-security.html [00:30] okat, the issue seems to be that the cert is self signed [00:30] Okay* [00:30] So... wtf? I am not going to pay to have it authorized. [00:30] This is for a development server in my basement. [00:32] oh, i'm an idiot [00:32] never mind, I missed the "make an exception" part =) [00:33] :P [00:41] anyone here familiar with ssh tunneling? [00:41] i'm trying to setup a tunnel between my friends computer, and my server... [00:41] so that we can both use my usenet account at the same time [00:41] from the same IP address [00:42] i've created an account on my server, and i can ssh into my box, from his...with this command ssh -p 2222 68.146.139.247 -L 2222:news.astraweb.com:119 [00:42] that connects fine, and then after i launch pan on his pc, via vnc, i try to connect to localhost:2222 [00:43] this should redirect him to news.astraweb.com:119 correct? [00:43] or am i missing something here? [00:43] 2222 is the port i have sshd running on my server [00:43] or do i need to specify a different port to tunnel through? ie...... [00:44] ssh -p 2222 68.146.139.247 -L 3333:news.astraweb.com:119 [00:44] and have him connect through pan via localhost:3333 [00:45] ? [00:45] hmm [00:45] i guess we're both downloading now at the same time...everything seems to be ok i guess [00:49] this tunnel is pretty effin slow i might add haha, maybe this isn't the best way to go about this [00:49] i guess this tunnel would be capped at my upstream wouldn't it? [00:49] billybigrigger: Yes. [00:49] since i'm technically sending it to him [00:50] hmmm [00:50] Might be better to have him use X forwarding, so he sshes into your server and then runs pan on that server, with its display forwarded over ssh back to his local workstation> That assumes he has X on his local workstation... [00:51] either way that data he downloads with still be capped via my upstream [00:51] s/with/will [00:52] billybigrigger: No, using X forwarding the data between your server and him is just video and keystrokes/mouse movement. The news stays on your server machine. [00:52] my server is a VM :) [00:52] my upstream is 120kb/s max :P [00:52] maybe i should look into renting a host for this :) [00:52] Then why are you offering to share it with friends?? :) [00:53] yeah, having my upstream being the bottleneck totally slipped my mind [00:54] 120kb/sec is slow... you have a connection using 2 56k dialup modems bonded together?? [00:54] no thats my cable modem [00:55] 2.5MB/s down 120KB/s up :) [00:55] Ah, OK. [00:55] he has the same ISP [00:55] I'm spoiled here -- Verizon FIOS, so 10Mbps down / 2Mbps up :) [00:55] even using my server as a proxy would not help us out in this situation would it [00:56] ya canadian ISP's suck for upstream, they all suck [00:56] billybigrigger: Not that much -- I'm not sure whether remote X over 120kbps would be better or worse than the news feed going over that 120kbps link... [00:57] in either option, the ssh tunnel, or setting up the proxy server, he will still be capped at my upstream [00:57] so either tell him to buy his own usenet account or split the cost of a co-located server.... [00:57] $11/month for the usenet account seems to be the best option :) haha mind you i wouldn't mind having a server setup with a decent connection [00:58] $20/mo for a small slice on Linode might work -- $10each if you share it... ? [00:58] linode, never heard of it [00:59] http://www.linode.com -- well reputed place for getting Linux virtual servers [00:59] checking it out now [01:03] doesn't say what kind of link the servers are on though...unless im missing something [01:05] how can I get the output of dmesg with timestamps so I know when these things happened [01:05] Several Mbits/sec per VM, I'm sure -- they are at huge data centers buying bandwidth in bulk... you can ask them if you want a clear answer [01:06] zroysch1: The number in [] on the left of dmesg output is the number of seconds since server startup... doesn't that tell you when things happened? [01:07] jmarsden: yea i'm not trying to sit here and calculate for every event. [01:08] zroysch1: You could write a trivial script to accept a time (the server boot time) as a parameter and dmesg output as input and display the times any way you want... probably a two or 3 line Perl script would do it. [01:09] yea i wouldnt know where to start [01:10] You are a server admin and have no scripting skills? Time to learn, maybe ? [01:11] server admin, what is that? [01:12] uh yea i have a computer sitting next to me running ubuntu server [01:12] i guess that makes me a server admin === MianoSM1 is now known as MianoSM [01:15] If you prefer, get the dmesg output into a spreadsheet and set that up to do the time conversions, maybe? Use whatever tools you *do* know. [01:32] jmarsden: dmesg -h would be ideal. [01:33] jmarsden, can i still use ssl through an ssh tunnel? [01:33] zroysch1: There is no -h option to dmesg. You mean like du -h, where "h" means "human-reladable format"? Sure. [01:33] billybigrigger: Yes. [01:33] correct. [01:33] linode is by far the best VPS option i can find === crohakon is now known as crohakon|afk [01:42] zroysch1: Try this Perl oneliner: while () { /^\[([0-9]+)(.*)$/ ; print "[" . localtime($ARGV[0] + $1) . $2 . "\n"; } [01:43] jmarsden: thanks, but how would i implement that === jtisme is now known as jtholmes [01:44] and why is my /var/log/messages filled with only -- MARK -- [01:44] sorry i cannot google that [01:44] Stick it into a file that starts with #!/usr/bin/perl on one line and the perl I gave you on another line. Let's say the file is called display-time.pl Then do dmesg |perl display-time.pl 1234567890 [01:45] ok thanks will try [01:45] Where 1234567890 is the time offset when you booted your serer [01:45] /var/log/messages is filled with only -- MARK -- if you have a server that is doing nothing at all and has the syslog mark option enabled. [01:47] zroysch1: Actually you can do the date conversions on the command line if you prefer, just type [01:47] dmesg |perl -e 'while () { /^\[([0-9]+)(.*)$/ ; print "[" . localtime($ARGV[0] + $1) . $2 . "\n"; }' 1234567890 [01:48] And adjust the 1234567890 to the correct value for your machine :) [01:49] appreciate it [01:50] it seems that an ssh connection from the internet is finally stable. [02:01] jmarsden, do you have a linode account? [02:02] billybigrigger: No, I've just heard good things from several Ubuntu people who do. [02:02] ahh ok [02:02] just wondering what the setup time is [02:02] Minutes, they advertise. [02:03] fair enough [02:05] The signup page says "Accounts are activated instantly when possible. " :) === lamont` is now known as lamont [03:04] jmarsden, hmmm linode network link doesn't seem that great [03:04] i've tunneled both me and my buddy to my linode server and we're both getting only 200kb/sec [03:05] billybigrigger: If you create a user for me on your server I can ssh in from here and test bandwidth to/from both my home and from other servers which have plenty of bandwidth,,, [03:08] 1% [ ] 77,941,856 2.52M/s eta 27m 50s [03:09] thats from wget [03:09] just don't have a decent place to scp a file to test this upstream [03:09] 2.52M/s == 2.52 Megabytes per second, so that's 20 mbits/sec which seems reasonably quick to me... [03:10] not no 100mbit i thought i would have though :) [03:10] that's the same downlink as my home connection [03:10] just that my home connection has a crap uplink [03:10] and by the looks of it, so does linode [03:11] get me an ssh login and I'll test both ways from a server at a major datacenter to and from your server... [03:11] check pm [03:11] Got it... here we go... [03:15] jmarsden, i don't see you logged in [03:15] 1.7Mbytes/sec from me to you, 1.4Mbytes/sec from you to me, over ssh. Pretty decent for a small slice [03:15] I scped rather than sshing in for each connection, use last to see the two brief scp sessions [03:16] hmm some claim in the linode irc chan 50mbps [03:16] for uplink [03:17] Do they have a larger slice? it may be allocating bandwidth based on the size of your slice?? [03:17] i asked for my 360 account [03:17] 50mbps, upgradeable for free if you have legitimate/acceptable reason to be so. [03:18] Hmm. Well, at the moment you're not seeing that, at least not to where I tested. And I don't *think* the server I used would be the limiting factor... [03:18] did you test from a datacenter? [03:18] or just your home link [03:19] Yes, from a Verio datacenter where I admin a work server [03:20] what's 50mbps, like 6Mbytes/sec roughly? [03:21] Yes. But does it matter to you -- if you get anywhere close to 2Mbits/sec your cable will become the limiting factor anyway :) [03:22] of course [03:22] my connection SHOULD be the bottleneck [03:22] but it's not by the looks of things [03:23] not even seeing close to the 1.7/1.4 mbytes you saw though [03:23] 200k/sec here and 250k/sec for him [03:23] So if you do scp -pv -P 2222 bigfile user@ipaddress: what do you see? Then scp -pv -P 2222 usedr@ipaddress:bigfile bigfile2 to try it from the server to you. [03:24] ssh -p 2222 74.207.252.123 -L 2222:news.astraweb.com:119 [03:24] does that look like a correct ssh tunnel? [03:24] Yes, looks fine to me. [03:24] thought so [03:25] News may not be a good bandwidth test... lots of small articles... [03:25] whats a quick way to spit out a 10MB test file on this server? [03:26] use dd [03:26] dd if=/dev/random of=testfile bs=1024 count=10240 [03:26] 100%[======================================>] 10,485,760 23.6M/s in 0.4s [03:27] nevermind, found one on the net [03:27] that was quick [03:28] There is also one in ~jmarsden on your server (from my tests) :) [03:28] ahh :) [03:29] could it be the limitation of openssh or the tunnel? [03:29] You'd have to have a very slow CPU for the ssh crypto to slow down that far. [03:30] On a 486, sure, it might be a limitation :) [03:32] If you are really testing newsfeed speed, can you download news fast on the server itself using a shell-based newsreader? [03:35] well i'm just going to have to setup apache and host this 10mb.bin somewhere [03:35] this is odd [03:39] http://74.207.252.123/10mb.bin [03:40] What's odd? 1.14Mbytes/sec download to here ~= 10Mbit/sec which is my download speed... seems fine to me :) [03:42] 1.6Mbit/sec to "my" server in a datacenter, but I think the file is too small to really be a good test at those speeds, it was still speeding up when the download ended. [03:43] *1.6Mbyte/sec [03:44] a little slow to get going at first (mind you, i'm coming at it from approx. 3000 miles away), but 3.11MB/sec -> 24.88Mb/sec, trending faster. with a larger file, it'd fly [03:44] 22:39:55 (3.11 MB/s) - `/dev/null' saved [10485760/10485760] [03:44] 3.11MB/s is nowhere near my 231K/s :) [03:44] from my house, 2009-11-22 22:41:45 (1.68 MB/s) - `/dev/null' saved [10485760/10485760] [03:45] he's 3000 miles from my server, i'm only 1500 miles [03:45] i'd be happy to see 1MB/s [03:48] Is WUBI the same thing as goodbye-windows.com? === crohakon|afk is now known as crohakon [03:56] I somehow botched my postfix configuration, I set home_mailbox to Maildir/ but I still see mail going to /var/mail/user .. ideas? [03:57] did you restart postfix? [03:57] yes [03:58] billybigrigger: yes I was following Ubuntu server guide on postfix, so I also have dovecot up.. I'm not great setting up email daemons [03:59] my ultimate goal here is to setup procmail [03:59] use google apps [03:59] mail SUCKS [03:59] but you already know that. [03:59] but it seems like procmail needs the mail in the /home/user/Maildir format [03:59] twb: No, WUBI installs Linux within files inside the WIndows filesystem, or used to... goodbye-windows.com looks like a way to boot a Debian installer from Windows, but you need to repartition etc etc as normal. [04:02] kshah: No, procmail will work on normal mailbox files too, or it did a few years ago for me... [04:02] jmarsden: OK. I was confused on that point, since goodbye-windows also appears to run as a Windows .exe [04:02] jmarsden: awesome, and I'll go that route if I can't figure this out, but I do also want to know why my setting isn't taking effect [04:02] jmarsden, would a proxy server help out my speeds here at all? [04:03] cat /etc/postfix/main.cf | grep home_mailbox # => home_mailbox = Maildir/ [04:03] billybigrigger: Well, for browsing static web pages it might, but that's not what you are trying to speed up... [04:03] so pretty much, my connection to my server sucks, but it's great for everyone else :) [04:04] billybigrigger, a proxy server only increases speeds on files you have already downloaded before [04:04] billybigrigger: Looks like it :) Which is pretty odd... [04:04] so it helps in multi user environments [04:04] but that's about it [04:04] jmarsden, i should have looked into a canadian vps [04:04] billybigrigger: a proxy for what? HTTP? [04:05] billybigrigger: Well, you have 7 days to test it for free, if you find something better you can drop Linode within that time and get your money back. [04:05] At least, they used to offer that, I think they still do. [04:06] Probably takes a week to get a VPS fully configured anyway [04:06] billybigrigger, what type of internet connection are you using? [04:06] (Just like any other server.) [04:06] 1MB/s is more than a lot of home connections can do [04:06] 25mbps advertised [04:07] i can get around 2.0 - 2.5/MB/s downloads, with a 120K/s upload [04:07] ah [04:07] Incidentally, an HTTP proxy like polipo uses some tricks to reduce latency even for URLs that aren't cached, such as upgrading the connection to HTTP 1.1 and using multiplexing. [04:07] billybigrigger: that'll just be because you're a ways from the exchange, or have a lot of line noise [04:08] Obviously another way to make browsing faster is to disable flash, images, js, css, etc. [04:08] not trying to speed up browsing [04:08] twb: or use lynx :) [04:08] I use w3m, actually. [04:09] me and a buddy are sharing a usenet account, and we're both tunneling over ssh into this VPS i bought, so we can both use the news server at the same time [04:09] but we're only seeing like 200k/sec each [04:09] 200K/sec sorry [04:09] http://74.207.252.123/10mb.bin [04:09] billybigrigger: you could set up leafnode (an NNTP proxy) [04:09] what do you guys get for download speeds from this server? [04:09] twb, is it going to be any faster than this ssh tunnel? [04:10] billybigrigger: latency is not the same as speed [04:10] even when i ssh into this server it seems lagged to hell [04:10] billybigrigger: if leafnode has already downloaded news to your local machine overnight, then you don't need to wait for it to come down while you're reading it -- so latency is reduced even though you're probably downloading more overall [04:11] typing takes forever... [04:11] billybigrigger: you should also investigate QoS [04:11] billybigrigger: also, you should check the load on the remote host -- it might be that someone is running e.g. emacs or firefox there [04:11] 15:09 http://74.207.252.123/10mb.bin [04:11] 100 10.0M 100 10.0M 0 0 127k 0 0:01:20 0:01:20 --:--:-- 129k [04:11] That's 129kB/s, I think. [04:11] hmm [04:13] twb: He'd need a fair amount of disk space and bandwidth to maintain a leaf node, though -- how big is a full Usenet feed these days? [04:13] jmarsden: leafnode can proxy selective groups [04:13] billybigrigger: ssh to your VPS has no discernible lag from here in Southern California... [04:13] jmarsden: actually its default behaviour is only to pre-fetch groups you have tried to read in the last N days [04:14] twb: OK, that sounds workable. [04:14] So if you read all articles in a group, leafnode shouldn't be significantly more intensive than not using leafnode [04:16] hmmm....i use nzb's mostly, i don't even subscribe to any groups [04:16] nzb's? [04:16] Is that a newsreader? [04:17] no [04:17] pan i use for the newsreader [04:17] nzb is just for downloading binaries [04:18] Oh, you are an alt.sex.binaries weenie [04:18] bahaha [04:18] not quite [04:19] alt.sex.furries.binaries? [04:19] * jmarsden thinks alt.sex.* preferences are probably off topic in #ubuntu-server :) [04:20] So, has anybody tried ext3's transparent compression functionality? Is it reliable? [04:20] I'm wondering if I can/should turn it on for stuff like ~/Mail and ~/News, which are guaranteed to be lots of small text files. [04:28] I've never tried it, but have wondered about it... is it still "an unofficial patch" ? I'm not sure how much I trust an unofficially patched filesystem... [04:30] you doing anything important on that vps jmarsden? :) [04:30] Nope :) I just left myself logged in after testing for keyboard lagginess that you reported :) [04:31] do you see it? [04:31] No, it's lag-free for me. [04:31] billybigrigger: ssh to your VPS has no discernible lag from here in Southern California... [04:31] that vps is in cali, i'd sure hope not :) [04:34] Looks like I'm ten hops and about 25ms away from it. [04:37] o.o [04:39] billybigrigger: 1 100MByte test file makes the bandwidth of your VPS look better: 4.2Mbytes/sec scp transfer. [04:41] k i moved it to /var/www [04:42] 4% [> ] 4,233,872 178K/s eta 5m 37s [04:42] wget http://74.207.252.123/100MB.testing [04:42] i think i just need to get a VPS host here in canada or something [04:43] Could be. [04:43] everyone else seems to be able to pull over a MB/s from it, and i can barely break 300KB/sec [04:43] Are binaries from Usenet really worth all this effort? :) [04:44] no i actually have a host, thefrozencanuck.ca that i have www/mail and a bunch of junk on here on a VM on my home connection [04:44] i wouldn't mind having it hosted somewhere else [04:44] OK. [04:45] but on a host that has a better connection than my home connection :) [04:51] New bug: #486950 in php5 (main) "php5-cgi should be compiled with the --enable-pcntl option." [Undecided,New] https://launchpad.net/bugs/486950 [05:56] whats a good webmail server for ubuntu 9.10 that lets users create their own accounts? [05:57] generally users shouldnt be creating their own accounts [05:59] well, yes , i mean that lets them change their passwords from within the webmail page [06:00] check out roundcube [06:00] i tried squirrelmail it didnt have it [06:00] dunno if you can change user/pass though, as it just reads your systems users [06:00] ah [06:00] usually password management is not a function of the mail client [06:00] i think you can setup roundcube to read users from a db though [06:00] Sam-I-Am, yeah exactly [06:00] what i've done in the past is made a web page for password changes [06:01] billybigrigger, you drive semi trucks? [06:01] nope [06:01] work on oil rigs :) [06:01] alright, thanks [06:01] * smackdaddy installs roundcube [06:01] billybigrigger, damn... ever been to an asteroid? =) [06:01] ever been to an asteroid? [06:02] i don't understand your question [06:02] billybigrigger, do you often sing "Leavin on a jet plane"? [06:02] ahh...haha not in awhile [06:02] =) [06:02] billybigrigger: they have internet connections on those? [06:02] Sam-I-Am, of course they do. [06:02] yeah they do [06:03] Sam-I-Am, they have to send and receive data all the time. Most likely satellite? [06:03] yeah usually the operator's office usually wants to watch the rig data, and usually some bigshot's with all the $$$ in houston like to watch what your doing aswell :) [06:04] billybigrigger, one last off topic question... Are you in the gulf? [06:04] nope [06:04] i live/work in canada [06:04] eh [06:04] oh, nice [06:12] (Error code: ssl_error_rx_record_too_long) [06:12] pwnguin, ssl with zen-cart? =) [06:12] just followed the wiki [06:12] https://help.ubuntu.com/8.04/serverguide/C/certificates-and-security.html [06:13] crohakon: any idea? [06:13] hi [06:13] pwnguin, was I right? Zen Cart? [06:13] no [06:13] pwnguin, oh... nope, I can't help. I am getting the same issue with zencart and ssl [06:14] i have no idea what zencart is [06:14] im guessing a php app for ecommerce [06:14] pwnguin, shopping cart e commerce stuff [06:15] crohakon: im pretty sure the problem is unrelated to your cart, except for the part where ecommerce requires SSL [06:16] crohakon: check your virtualdirectory apache config [06:16] pwnguin, figured as much as well... I just reinstalled it without ssl as I am just playing around with it. [06:16] seeing if I like it [06:17] *shrugs* [06:17] yea, i had [06:17] SSL dont like that [06:18] well you can run one ssl vhost... then the other ones wont work without other IPs heh [06:27] well, i just have the one domain [06:28] time for zzz here... [06:30] i have put my id_dsa.key in the .ssh/authorized_keys of a server, but still when i try to ssh to the server, it returns: Permission denied (publickey). why? [06:34] because you did it backwards [06:35] you need to put the .pub in the authorized keys file [06:35] that way the server doesn't have your private key [06:36] the id_dsa.key is stored wherever you wish to ssh FROM, and the id_dsa.pub is needed wherever you wish to ssh INTO [06:40] maxagaz: there's a program that will actually deploy keys for you [06:40] ssh-copy-id [06:42] how do i configure roundcube [06:44] judging by my server logs, poorly [06:45] seems like im always getting roundcube attack attempts =/ [06:47] it sucks? [06:47] i cant even get it installed [06:47] or working.. [06:47] its installed [06:53] pwnguin, i don't have password access to the server, so ssh-copy-id won't work [06:54] well, then you get to do it the hard way [07:02] pwnguin, what is the hard way ? I already put the content of my user's id_dsa.key at the end of the authorized_keys of the distant user on the remote server [07:02] pwnguin, is there something else to do ? [07:08] maxagaz: yes. delete that, becuase it's the wrong thing [07:08] maxagaz: do you know how public key encryption works? [07:08] pwnguin, partly [07:08] you want the user's public key on the server [07:09] however, you put the private key on the server [07:09] pwnguin, no, i did put the public key [07:09] pwnguin, id_dsa.pub [07:09] (pwnguin, sorry for saying id_dsa.key) [07:10] then you have a long night ahead of you [07:11] perhaps blow away the auth_keys file [07:11] and maybe make sure the keys are matched [07:16] pwnguin, actually i can access the server via another address and port, with password, so I've add the pub key from it using ssh-copy-id, now i can access the server from this way without password, but if i try to access the server from its other address and other port, it returns: Permission denied (publickey). Why? [07:21] not sure. im not quite the expert at configuring servers yet [07:30] so, when I try to connect to my ftp server from outside my lan I get Response: 227 Entering Passive Mode (192,168,1,2,209,60) and Status: Server sent passive reply with unroutable address. Using server address instead. [07:30] How do I fix this? [07:31] crohakon: Tell your FTP server what your external address is and that it needs to use it in port commands. [07:32] I use vsftpd... where do I start? [07:32] crohakon: the man page for vsftpd, I would think... :) Let me look... [07:33] jmarsden, nothing in the man page [07:34] Did you also read the man page it points to, man vsftpd.conf ? I think not. [07:35] =( [07:35] Hint: search for pasv_address [07:38] okay, what if I have a dynamic IP? [07:40] I think you are somewhat stuck; you can use pasv_addr_resolve to resolve your dyndns hostname at vsftpd startup time, but if it changes underneath the vsftpd instance it will break until you restart vsftpd. [07:41] Does your ISP really sanction file servers on dynamic IP addresses, by the way? [07:41] So I can used the pasv_addr_resolve=YES with pasv_address=whatever.dynhost.com [07:41] ? [07:41] Right. [07:41] And that should work? [07:41] Great. [07:41] Thanks man. [07:42] It will "work" until your dynamic address changes, I think. [07:44] Well, it now resolves, but still fails to connect. [07:44] i keep getting connection refused with vsftpd [07:44] FTP is a nightmare, suggest SFTP instead [07:44] whats the command to open ftp [07:45] crohakon: do you have the relevant range of ports open for incoming PASV FTP connections? [07:46] do they use something different then the normal port? I currently have the server listening on port 93 [07:46] and I have the router set to forward all connections on port 93 to the server [07:46] crohakon, you need both the FTP listening port and a range of high ports [07:47] How do I get that range? [07:47] assigned to the FTP server, all forwarded [07:47] crohakon: Yes. Very much so. To run an FTP server that supports PASV mode FTP you need a range of ports too. ... read the vsftpd.conf man page again... :) [07:47] this is why I hate FTP, and suggest SFTP instead [07:47] on top of only needing one port, the default is not filtered by your ISP [07:47] * crohakon sighs [07:48] and you won't have any dyndns issues [07:48] crohakon: pasv_min_port and pasv_max_port are your friends . As you are discovering, FTP was not designed to have FTP servers run behind home NAT/firewall boxes. [07:48] It can be made to work, as long as you understand it. [07:50] those are not in the man page, but I guess I get how they work. pasv_min_port=5000 pasv_max_port=5100 and it will then use 5000 through 5100? [07:50] yes [07:50] okay [07:50] and you need one port per connection [07:50]