[00:00] isn't it like ntpd and ntpdate? [00:01] how can I configure TLS with my postfix config if I have virtual users who's data is held in MySQL? [00:02] jeeves_Moss: TLS shouldn't really matter at that point, unless you're trying to store their client-certificate in mysql somehow. [00:02] SpamapS, naaa, I've just been trying to set up TLS so I can send e-mail when I'm external to the local network [00:04] so, a "submission" service on port 587 ? [00:04] ?? [00:04] JanC, was that directed @ me? [00:05] jeeves_Moss: yes ☺ [00:05] oh, sorry. [00:05] JanC, basically, when I'm internal the the network (where the postfix server is), I can send all day long, but as soon as I'm external, I get "mail relay" issues [00:06] the server can be reached from the outside network I assume? [00:07] yes [00:07] jeeves_Moss: Ah, so you have no auth setup w/ Postfix.. you just want to create A) TLS, and B) SMTP Auth? [00:07] I can do it all (httpd, ftpd, IMAP, etc) [00:08] SpamapS, yep, that's all I want. I want to be able to send e-mail from the outside (no real point of having a smart phone if I can't reply to e-mails on my own friggin' domain!) [00:11] jeeves_Moss: yeah I did the same thing [00:12] jeeves_Moss: I forget which howto I followed.. its actually quite simple [00:12] SpamapS, oh? what phone do you have? [00:12] (and if you get a chance, can you see if you can find the "howto"? [00:12] jeeves_Moss: do you have SASL authentication setup? [00:13] I'm thinking I do, but I should remove it and start fresh if you know of a good howto [00:14] you probably need something like the following in master.cf: http://paste.ubuntu.com/436972/ [00:14] JanC, Thanks. [00:14] jeeves_Moss: Android 1.6 w/ K-9 email client [00:14] I'll have a look in a sec [00:15] submission == port 587 (which is the default for such a service, as many ISPs block outgoing port 25 connections) [00:15] SpamapS, nice. I personally love my WM5 phone [00:15] to each his own [00:15] * f1yback bites THEREisONLYzulNUCK [00:15] CANUCK [00:15] JanC, wiat a sec.... You say it's using TLS on port 587? [00:16] JanC: why would you put that in master.cf? I don't think I had to do anything in there.. just added stuff to main.cf [00:16] I take that back I did add stuff [00:18] SpamapS: because I want port 25 (incoming mail from other servers etc.) & port 587 (submission of mail by me) handled differently [00:18] http://paste.ubuntu.com/436985/ [00:18] JanC: yeah me too, which is why mine is similar. ;) [00:19] anyone have any tips for configuring permissions for wordpress on ubuntu? seems like something doesn't have what it needs out-of-the-box. i don't want to just chmod 777 all of /usr/share/wordpress [00:19] * SpamapS is embarassed that his production cert file is named 'test.pem' ... [00:20] celeborn999: by default it shouldn't need any write perms unless you want to use the admin interface to do things. [00:20] SpamapS: yeah that's what i'm trying to do, install a theme through the wordpress admin [00:22] celeborn999: doesn't the wordpress documentation have something about that? [00:23] JanC: i was just looking at that, what kinda sucks is the official docs are written for people who (i guess) are having their filesystems managed by their webhost. for example the doc says: "However, if you utilize mod_rewrite Permalinks or other .htaccess features you should make sure that WordPress can also write to your /.htaccess file." i don't know who "WordPress" is. www-data, maybe? [00:24] celeborn999: in that case, chgrp -R www-data wp-content/themes && chmod -R g+w wp-content/themes [00:24] JanC: or this blurb: "All WordPress files should remain owned by your user account" -- the wordpress files are all owns by root:root or root:www-data [00:24] Yeah the wordpress docs take the stance that if you are hosting your own wordpress, you know enough to figure this out. [00:24] SpamapS: or which IRC channel to spam, at least [00:25] SpamapS: even then, they should explain which directories need write access and which not IMNSHO ☺ [00:26] JanC: its not so much need.. its a choice. ;) [00:26] SpamapS: it looks like www-data is already the group for the directories you mentioned and has group write permissions [00:27] celeborn999: then should work fine [00:27] SpamapS: that's a bummer [00:27] celeborn999: its not just the dirs though.. the files must be writable [00:27] I guess it's the usual PHP app stupidness? :-( [00:29] SpamapS: i checked every directory and file, they are all owned by root:www-data and have group write permissions. i wonder if there is some kind of "landing spot" where incoming downloads are stored before they are installed, and the landing spot needs permissions [00:30] does wordpress write stuff as www-data? [00:30] or is there some third account it likes to use sometimes? [00:30] celeborn999: taht depends on your www-server config ;) [00:30] celeborn999: should if apache is running as www-data [00:31] i use apache and it uses www-data [00:31] celeborn999: I have to agree with JanC .. the WP docs and forums should help with this [00:31] i agree with both of you, they really should [00:32] personally I think the docs should be enough, this sounds liek basic stuff every sysadmin installing WP should know [00:32] like with everything else i've installed recently, i'm sure once i figure it out, it will all make perfect sense [00:34] i found the Debian-specific notes for Wordpress (/usr/share/doc stuff) to be unusually unhelpful at previous steps in this process, relative to other software i've installed [00:45] celeborn999: in general the Debian-specific notes only document changes from upstream [00:46] if upstream is weird and undocumented, good luck... :-/ [00:46] JanC: Debian pretty heavily customizes Wordpress, they have a special mysql install script and a totally different way of handing wp-config.php [00:47] JanC: to give two examples [00:47] in that case, that should be documented in Debian-specific docs of course [01:03] smoser: Did you just publish a new copy of ec2-api-tools or was I dreaming? https://launchpad.net/~ubuntu-on-ec2/+archive/ec2-tools?field.series_filter=karmic [01:07] ami tools [01:07] erichammond, [01:07] but only in lucid [01:07] is there a new api tools ? [01:08] er... i only put it in maverick at the moment. [01:08] https://bugs.launchpad.net/ubuntu/+source/ec2-ami-tools/+bug/582387 [01:08] Launchpad bug 582387 in ec2-ami-tools "update to 1.3-49953 to support ap-southeast-1" [Undecided,Fix released] [01:18] smoser: I see, thanks. I was only partly dreaming. [01:19] and mostly just confused. [01:19] well, there is a ec2-api-tools [01:19] now that i go looking [01:37] so for the record, for my wordpress problem, here is the answer: http://www.chrisabernethy.com/why-wordpress-asks-connection-info/ ....... wordpress has a silly method of checking for filesystem permissions, it writes a test file and checks to see if the owner of the test file matches the owner of the script being run. of course with ubuntu the file owner is root but the test file is written as www-data (for apache) [01:38] so i can workaround the problem by chowning some files to www-data but this will get blown away during an apt-get upgrade (for example). sucks. [01:57] how can i tell ubuntu/apt-get not to try to upgrade a particular package in the future? i want to disable updates for wordpress only and just do the upgrading through the wp admin console [01:58] Uninstall wordpress and download it from the website? [01:58] there's got to be a generic way to do it [01:58] Yes. [01:58] Install wordpress from wordpress.org :P [01:59] i mean generic for all packages [01:59] i.e. i like the current version of FOO, please never try to upgrade it [02:01] answer: use aptitude, find package, press "=" to "hold package" [02:01] at least that's what i think will work, we'll see down the road i suppose [02:10] celeborn999: basically you want "apt pinning" [02:11] but that also means you'll soon be using a wordpress instance full of security bugs I assume... [02:11] honestly if an app has to be chown/chmodded to work.. [02:11] it sux [02:12] (well, full of known security bugs, they'd have been there before already) [02:12] I use wordpress.. [02:12] and I hate that part [02:12] based on the manpages it looks like pinning means you want apt to try to get the software from a different source or a different (past) version. instead the intention is ask apt to not do the update, and instead use the wordpress console's upgrade utility to do it instead. this should avoid the permissions problems [02:12] i think the hold package idea from aptitude is what i'm looking for [02:43] if celeborn comes back tell him that idea is stupid -- debian packaging of wordpress is worse than no packaging, and pinning an old version of wordpress is bound to be an attack vector [03:40] pwnguin: I agree, this is why we have nightly build ppa's.. :) [03:42] I kind of wish we had a 'volatile software' ppa where someone could just ask for the latest upstream to always be built and installed. Something tells me this already exists, I just can't find it in the amazon-rain-forest-sized documentation on debian packages. :-P [03:47] No, the general point of having a release is to have stuff stop changing. [03:48] sadly, there are things like wordpress that are more stable when they change. [03:48] It stems from the ability to produce software faster than users can break it. Yes I'm saying PHP makes it too easy to program. :) [03:49] visual basic was the same. ;) [03:49] Certainly, there are exceptions. [03:50] PHP is one of those things that I understand is almost everywhere, but I prefer not to get any on me. [03:50] Also it does take some effort to make sure the new stuff is packaged properly and works. [03:50] I think there's a certain class of things that shouldn't be packaged for release.. wordpress is probably the best example of it. [03:50] * ScottK is doing that right now for clamav. [03:50] yeah clamav changes *fast* and *must* [03:53] I guess the real lesson to learn is that there may not be a single unifying theory of packaging.. [03:54] clamav we treat as a special case and try to keep it current for all releases. [03:54] It's a lot of work though. [03:56] Yeah, IIRC it will start squawking loudly in the logs if the engine falls behind the definitions [03:57] seems like at that point the engine becomes data as much as software [03:57] Unfortunately it's production critical, security sensitive software.... [04:47] tutorial ldap offline file configuration anyone knows? please === shade_ is now known as {shade} [06:13] is there a way I can connect to a wifi router with ubuntu server? [06:17] Brando753: of course. Go find a cable long enough and plug into the LAN port of the router. ;-) [06:19] Brando753: yes. [06:20] as good an option that is can i do it without the large cable [06:20] Brando753: yes. [06:20] You will, obviously, need a wifi NIC. [06:20] Network Interface Card? [06:21] Brando753: yes. [06:21] got it. [08:21] are modeline in vim somehow disabled in *buntu ? [08:43] Weasel[DK]: set modeline >> vimrc [08:46] screen-x: Perfekt... Tak! [08:47] screen-x: oops wrong language.... perfect.. Thanks ! ;) [09:46] New bug: #583698 in apache2 (main) "hardy-proposed (2.2.8-1ubuntu0.16) uninstallable" [Undecided,New] https://launchpad.net/bugs/583698 [09:56] I am connected via ppp0. I want to share the internet to the network via eth0. How can i set up the network-manager to share the internet? [09:56] Either bridge or masquerade [09:56] Oh, you're using network-manager. I don't support that, sorry. [10:02] one of my 8.10 servers hosting a website has been by [10:03] one of my 8.10 servers hosting a website has been compromised by Storm7Shell [10:03] hosting oscommerce v2.2 rc2a [10:25] Hey guys. I am looking for some sudo help if anyone minds. I am in the admin group and prompted for a password proper. That is unchanged from ther server install however I created a group alias in the sudo file and a application alias in the sudo file and said this group alias can execute this app alias without a password as root which has worked fine for non admin users however I am still being prompted for a password. [10:26] Does anyone know how I can execute the application alias without a password even though I want everything else I sudo to, to be password protected? [10:26] my line looks like: DNS_ADMINS ALL=(root) NOPASSWD: DNS_COMMANDS [10:27] I am in the DNS_ADMINS alias and other people not in the admin group are not prompted for a password who are in the DNS_ADMINS alias [10:33] : I am connected via ppp0, using a script. I want to share the internet to the network. Typing /etc/network/interfaes shows "iface ppp0 inet ppp", but ppp0 does not appear in the network connections. How can i set up the network-manager to share the internet? [10:33] the ifconfig command should show ppp0 [10:33] doesn't it? [10:36] c13: that question was to you [10:36] i've just fdisk'd my drives however without mknod i don't see a /dev/sdxy appearing, i used to reload udev to see them appear, but 10.04 that doesn't happen [10:37] yes it does === screen-x is now known as hugh === hugh is now known as screen-x [10:38] c13: then ppp0 is active. I don't know where you are looking where you say it doesn't appear but it is there regardless so now all you need to do is enable ip forwarding in the kernel (man sysctl) and setup nat via netfilter/iptables [10:39] incorrect: not to sure about the udev in 10.04. I'm using it, haven't looked into it but do you see the disk in /dev i,e, not the partitions but do you see /dev/sda but not /dev/sda1 ? [10:39] *not too [10:40] i am just missing the new ones i created [10:40] fdisk -l shows them [10:40] incorrect: you didn't answer my question [10:40] i did, i am just missing the new partitions i created [10:40] the block device is there [10:40] <_ruben> jetole: perhaps the order in the sudoers file is relevant? [10:40] do you see the whole disk in /dev [10:41] _ruben: yeah I have noticed that in the man page. Still not sure. I am still reading [10:41] disk = block device [10:41] incorrect: do you see, for example /dev/sda if sda is the disk [10:42] I know what a block device is [10:42] thx [11:11] aha! its partprobe i need [11:16] Oh I could have helped you a while ago if you didn't ignore my questions and then me but I guess it always feels good to find the answer yourself [11:21] well i answered but you didn't seem to understand [11:50] Hi all, trying to install sun-jave-jre on ec2... Which repo do I need to point at or do i install direct. [11:55] the partner repo [12:04] will the partner repo track release from java.sun ? [12:41] New bug: #583753 in mysql-dfsg-5.1 (main) "package mysql-server 5.1.41-3ubuntu12.1 failed to install/upgrade: problemas de dependencias - se deja sin configurar error2002 to upgrade mysql server erro de pos instalacion dio erro 1" [Undecided,New] https://launchpad.net/bugs/583753 [12:51] o/ riktking [12:52] jussi, i think im just gunna remove the lamp stack and start again [12:52] fair enough [12:52] its not a mission critical website lol [12:57] fixed it! [13:00] hi all [13:00] i am using latest ubuntu 9.10 server [13:00] my ssh server is very slow [13:00] how do i fix this problem? [13:01] slow with login [13:01] slow when typing [13:02] Japje: login and typing both [13:02] lifeless, Thanks, sorry for the delay.. :) [13:02] login could be that resolving is slow [13:03] if both are slow.. perhaps high load, or much traffic on your side, or the server side [13:04] Japje: any other ssh server package to try? [13:05] DelphiWorld: thats probably not the right idea behind the problem [13:05] its not the ssh server itself [13:05] its something thats affecting it to be slow [13:11] How do you clear the arp cache? === niekie_ is now known as niekie [13:15] can somebody tell me how to install usb modem in ubuntu9.10?? [13:15] its is not been detected [13:20] Amarendra_: does it have drivers available? Some don't. [13:20] ya it was first detected as cd drive [13:21] i installed the driver [13:21] now it is not detecting [13:21] if you run 'dmesg' do you see anything about it when you plug it in/remove it ? [13:24] i am not able to connect in ubuntu so i switched to windows and downloaded x-chat to connect this chat room.. Now i am in windows . So i cannot run any command [13:25] ah [13:25] EtienneG: eaten all your chocolate yet? [13:25] any more ideas??? [13:26] Japje: fixed just by restarting it [13:26] Japje: and this is my majore problem in Deb based systems;) [13:26] Amarendra_: you might want to try making sure acm is loaded.. (modprobe acm) [13:27] acm?? [13:27] Though hotplug, or whatever it is we have that has replaced that, should do it. [13:27] http://www.linux-usb.org/USB-guide/x332.html [13:27] Amarendra_: that explains what acm is [13:27] ok [13:28] SpamapS, no, my kids are on it [13:28] there was a *lot* :) [13:28] Spamaps: Is there anyway to uninstall the driver and start again?? [13:30] Amarendra_: what driver did you install? [13:30] cm200 driver [13:31] shall i mail to u?? [13:34] Amarendra_: isn't that a webcam driver? [13:35] no [13:35] my usb modem is CM200 [13:35] Provider= tata photon whiz [13:36] should i send u the drivers?? [13:36] Amarendra_: no thats ok [13:37] ok [13:37] smoser: apparently lucid is still not available in the imagestore... I thought Gustavo had it covered ? [13:37] Amarendra_: I've had very bad luck with those things on anything but Windows.. :-P [13:37] its .deb packages [13:37] for ubuntu [13:40] Amarendra_: well then thats weird that it doesn't work. ;) [13:41] SpamapS: re: "how a blueprint gets released", you mean, the lifecycle of a blueprint ? [13:42] i got some information from internet now i shall restart .. Thanx for yr cooperation [13:42] SpamapS: gets accepted, scheduled against a development subcycle ("maverick-alpha-2"), then work items are burnt... spec goes to beta available, then Implemented. [13:43] hi everyone! after doing a fresh install of ubuntu server 10.04 (over 9.10) one of our php apps went dead and while access.log shows 500 response nothing is logged into error.log; any ideas how to revive this functionality? [13:46] ttx: ok that all makes sense. [13:47] ttx: and who does the accepting? [13:48] SpamapS: the approver. Usually that will be Jos. [13:53] Hi, I have an urgent problem. No idea how difficult to solve. I upgraded a server from Karmic to Lucid. The server runs 3 virtual machines. Now, 1 of them doesn't want to start anymore. $ virsh start | error: Failed to start domain | error: monitor socket did not show up.: connection refused. (The server is on support, so I contacted Canonical, but I'm not sure if they will call back today. [13:53] It's probably nighttime at the location of the helpdesk. Hence, I'm looking for tips here) [14:07] ok, got it. (Little bit of panic aside) I created a new virtual machine with the same properties, and compared the xml. There were a lot of differences. I guess the new xml is better. Now, it works fine. (There were differences in cdrom (type='raw' instead of ''), in , and video) [14:08] ttx: so the portion of cloud databases where Cassandra wants hadoop overlaps with the hadoop-pig spec, which you are listed as drafter on.. [14:08] yes. [14:08] alvin: good to hear it works out [14:09] having issues with apache2 cant seem to get website to apear under http://hotsname/username/ [14:10] ttx: ok, so should I make this one dependent on that one? [14:11] SpamapS: not really. hadoop/hbase should already be in a shape that you can use for building cassandra [14:12] SpamapS: they are already packaged and should be in ubuntu anytime now [14:12] so just add a note that you are dependent, but do not mark the spec as fully dependent [14:14] ttx: should I requestsync for hadoop? has someone already done that? [14:14] SpamapS: it should get autoimported [14:14] ttx, this is correct, it is not. [14:15] i have acl to do it now, but its painful. [14:15] i had not made huge interest in it because i was wanting to get a refreshed image [14:15] with the incrased dleep [14:15] increased sleep even [14:16] smoser: ok, you might want to reply to the thread on c-cloud to avoid getting hurt by backslash === jbernard_ is now known as jbernard [14:23] riktking: sudo a2enmod userdir , and use http://domain/~USERNAME === RoyK800 is now known as RoyK [14:49] morning [14:50] I have 'AllowGroups adm' in my /etc/ssh/sshd_config file, however I also want to allow the user 'foobar' (who is not in 'adm' group) access to SSH. I added the line 'AllowUsers foobar' however this user can still not login [15:08] jbernard: neat trick :-) [15:11] just tried enabling apparmor on apache in Lucid and setting complain mode, but i get nothing in kern.log, I'm I looking the right place? [15:12] kirkland: thanks man! turned out to be much easier than I thought [15:12] jbernard: yeah, really, really clean [15:14] tlb: if you have auditd installed, then it will log to /var/log/audit/audit.log instead of kern.log [15:16] jdstrand, i don't have that installed, but is that the recomended way? [15:18] tlb: it will log to kern.log without it. while developing profiles without auditd you will probably want to use 'sudo sysctl -w kernel.printk_ratelimit=0' to cut down on kernel rate limiting [15:19] tlb: note that sysctl will not survice a reboot [15:19] survive [15:20] jdstrand, installed auditd and still nothing, when i set aa-enforce /usr/lib/apache2/mpm-prefork/apache2 apache fails to start because i enabled mod_fcgi and i get nothing when in the log when i set aa-complain [15:21] tlb: the failure to start would seem to be unrelated to appamor if it isn't logging anything [15:21] New bug: #583821 in dovecot (main) "hostname -f prevents dovecot installation" [Undecided,New] https://launchpad.net/bugs/583821 [15:21] jdstrand, apache works fine when i set the profile to complain, but i get nothing i the log [15:22] jdstrand, in the apache log i can see it's problem with creating shared memory when apparmor is set to enforce, but i would really like apparmor to give me some debug information in complain mode [15:23] tlb: it could be that the environment is being scrubbed because you are using Ux or Px... [15:25] apparmor won't (can't?) log in that situation cause the confined application isn't handling the lack of environment due to the scrubbing [15:26] jdstrand, it's the default apache profile that comes with Lucid and a clean install, so far I havent touched a config file [15:26] you could try to use 'px' or 'ux' in enforce mode and see if that works [15:26] well, that apache profile in lucid is only for phpsysinfo [15:27] if phpsysinfo is not working with that profile, that is a bug [15:27] (in which case please file it, with exact steps on how to reproduce) [15:27] jdstrand, I'm sorry but i'm kind of new to apparmor, and I don't think I understand what scrubbing or ux and px mode does? [15:28] jdstrand, it's only because i'm trying to run it in fastcgi mode [15:28] tlb: are you trying to use the phpsysinfo profile? [15:28] hmm... my ubuntu server virtual machine just started up with 64 MB of ram [15:29] tlb: or you just happened to enable the profile, and things broke cause you are using fastcgi? [15:29] jdstrand, yes but so far apache is not even starting if you enable mod_fcgi [15:30] tlb: sounds like a bug. can you one against apparmor along with how you enabled fastcgi? [15:30] jdstrand, I'm trying to make a profile for mod_fcgi + suExec, but to start simple I just wanted to get the phpsysinfo profile working with fastcgi [15:31] let's see if it works with 32. :) [15:31] jdstrand, if you give me some more hint, I'm sure I can come up with a patch and a bug report :) [15:31] tlb: sure. I did not develop that profile. it sounds like more needs to be done with it, and filing a bug is one way to make that happen :) [15:32] tlb: well, the hint was Ux/Px vs ux/px [15:32] I don't know that is the case [15:32] when you give a binary Ux, you are saying to transition to unconfined mode, but scrub the envoronment for things like LD_LIBRARY_PATH [15:33] the same for Px, except rather than going unconfined, you transition to another profile [15:33] ux/px means do the transition, but don't scrub the environment [15:33] in general, that is a bad idea, but it would be worthwhile to know if that was the cause [15:34] that may not have been as clear as it could be... [15:34] the rule: [15:34] /usr/bin/foo Ux, [15:34] means that if the application tries to exec /usr/bin/foo, go unconfined and scrub the env [15:35] and by 'go unconfined' I mean, /usr/bin/foo executes unconfined, not the application that is executing it [15:36] * jdstrand sorta wishes he could have worded all that more clearly from the start [15:37] jdstrand, ok, so when mod_fcgi fails to make shared memory it might be because the fcgi daemon is running in a unconfined but scrubbed environment where it's missing some options [15:37] hi [15:38] Does anyone know if one can use the slapd.conf in Ubuntu 10.04? I read that it's not possible... [15:38] tlb: that is the hypothesis, yes. cause apparmor won't log anything if the app craps out due to env scrubbing, so it sorta seems to fit [15:39] jdstrand, is there a way to dump the complete profile with all includes included? [15:39] tlb: not currently [15:39] it used to be there, but went away [15:39] it will be back in maverick [15:40] jdstrand, so my job is looking at all the includes and see if this somehow triggers a Ux or Px [15:40] SpamapS: you should follow strictly https://wiki.ubuntu.com/WorkItemsHowto for your work items [15:40] tlb: in the profile or the includes, yes [15:41] jdstrand, is there some good documentation that describes what the permission mean in a apparmor profile? [15:41] SpamapS: also move the discussion notes from the whiteboard to the "BoF discussion" section on the wikispec [15:42] tlb: yes. in apparmor-docs there is the techdoc.pdf (though it is a little outdated). also [15:42] https://apparmor.wiki.kernel.org/index.php/Main_Page [15:42] that is more up to date, but less organized (we are in the process of fixing that) [15:44] jdstrand, ok thanks i will try to da a little debugging [15:44] tlb: thanks :) [16:01] ttx: oops I forgot the :'s didn't I? ;) [16:02] New bug: #583865 in dbconfig-common (main) "package dbconfig-common 1.8.41 failed to install/upgrade: package dbconfig-common is already installed and configured" [Undecided,New] https://launchpad.net/bugs/583865 [16:02] jdstrand, there is no Ux or Px anywhere in the profile and i guess this /** mrwlkix shold give access to do pretty much anything? [16:03] SpamapS: yep [16:12] tlb: well, I'm not sure what the problem would be [16:13] tlb: /** mrwlkix will do a transition, but with 'i', which 'i'nherits the current profile. aiui, it will inherit the current env as well. [16:13] jjohansen: is that accurate? ^ [16:14] jdstrand: yeah, at least from an AA persepective [16:14] when ix is done apparmor does not request the environment be scrubbed [16:15] cool, yeah [16:15] however, other things like the loader may decide to scrub the environment anyways [16:16] tlb: so I'm not sure why apparmor is preventing apache from working with fastcgi and not logging it [16:17] jjohansen: he enabled the fastcgi module, and enabled the phpsysinfo profile for apache, but apache won't start (something with not being able to allocate shared memory) [16:17] jjohansen: if he disables the profile, it works. there is no logging in enforce (or complain) mode [16:17] tlb: is there any apparmor message in the log? [16:18] tlb: can you open a bug and attach the profile so we can look at it? [16:18] so, the only thing I could think of off-hand was scrubbing [16:19] jjohansen, this but only first time: type=APPARMOR_DENIED msg=audit(1274455154.369:125): operation="capable" pid=15801 parent=1 profile="/usr/lib/apache2/mpm-prefork/apache2" name="dac_override" [16:19] tlb: as root can you do echo 1 > /sys/module/apparmor/parameters/debug [16:20] * jdstrand always forgets about that one... [16:21] jjohansen, did not give more information in the log [16:21] tlb: what happens if you add capability dac_override, to the profile [16:21] tlb: did you restart apache after doing that? [16:21] jjohansen, after adding debug yes [16:22] tlb: okay, that rules out AA scrubbing the environment [16:22] what's the easies way to load my new profile, right now i'm doing apparmor_parser -R, apparmor_parser -r and then aa_enforce [16:23] tlb: apparmor_parser -r will replace without needing to do the remove [16:23] tlb: just apparmor_parser -r is enough [16:24] add capability dac_override, [16:24] makes it work? [16:27] jjohansen, dac_override is'nt that a tad much to give in capability, DAC_OVERRIDE allows the reading or writing of any file on the system regardless of the ownership or permissions [16:29] tlb: well, yes it normally does but AA file rules clamp it down to what is listed in the profile [16:29] jjohansen, aah so even if dac_override is given, aa still has final say? [16:30] tlb: yes [16:30] in this case DAC is being applied first, and asking for capability dac_override, [16:31] AA has the option of denying that or allowing it, if you allow it it gets to apply further mediation after [16:35] jjohansen, dac_override seems to do the trick, do you want that in a bug report? [16:37] tlb: you were getting the log message for that right? If so its really more of an apache behavior, than an AA bug [16:37] jjohansen, but I was only getting after the first time? [16:38] tlb: okay file the bug and we will try to replicate [16:38] jjohansen, if I want the error i need to reload the profile [16:38] strange [16:38] that is a bug then, make sure you attach the profile you are using [16:39] file the bug against apparmor so me and jdstrand will see it [16:44] alguem aqui utiliza samba4 como PDC ? [16:48] morning === unreal_ is now known as unreal [16:49] !br | Kbca [16:49] Kbca: Por favor, use #ubuntu-br para ajuda em português. Obrigado. [16:55] jjohansen, https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/583896 [16:55] Launchpad bug 583896 in apparmor "libapache2-mod-apparmor profile fails when mod-fcgid is enabled and gives little error information" [Undecided,New] [16:55] tlb: thanks [16:55] :9 [16:55] :) [16:55] jjohansen, thanks for the help both of you [16:56] np, any time [17:18] Greetings! I can't seem to get ssh working using key authentication without asking for a password. Can someone help? [17:19] bkingx: what did you do already? [17:20] guntbert: Created the keys without using a passphrase, copied the keys to the remote server and cat'd it into .ssh/authorized_keys. [17:21] guntbert: set permissions on authorized_keys to 600 [17:21] bkingx: when you try to connect it still asks for a password? what does /var/log/auth..... tell? [17:23] guntbert: Correct. And I don't get anything in /var/log/auth.log until I actually enter the password. [17:23] bkingx: let me look some things up [17:24] bkingx, it may be easier to use ssh-copy-id (it will copy the key to the remote server and take care of everything) [17:24] guntbert: When I do log in, I get one line: May 21 12:21:03 sftp sshd[2850]: pam_unix(sshd:session): session opened for user 20383 by (uid=0) [17:24] Hmm...this user is set up as scp-only, so it makes it difficult to run that command. [17:24] bkingx, just make sure to manually check that it only put the one key you wanted on the other server (just in case) [17:24] bkingx, oh, ok... [17:26] bkingx, have you tried the -v flag to get more info from ssh/scp ? [17:26] deslector: Yes, I even went as far as -vvv I'll post that to pastebin. [17:26] bkingx, ok [17:27] deslector: http://pastebin.com/za4qyYKN [17:27] bkingx: I didn't find anything special in /etc/ssh/sshd_config -- sorry [17:27] guntbert: yeah, this has me baffled. [17:28] I've tried both rsa and dsa keys [17:29] bkingx: is id_dsa the key you want to use? [17:30] and told the server to expect? [17:30] either one is fine, id_dsa or id_rsa [17:32] bkingx: after "we sent a public key, waiting..." you should get "debug1: Server accepts key: pkalg ssh-rsa blen 277" or so [17:33] guntbert: can you think of a reason why I can't get that? [17:34] bkingx: yes but it will be of no help : the server is still not ready to accept pubKey auth : did you restart the sshd ? [17:34] hello everyone. I'm setting up Postfix and having some trouble with local recipient verification. The verification probes (to Cyrus' LMTP port) are successful, but Postfix still rejects the client with "Recipient address rejected: User unknown in local recipient table" [17:35]