[00:02] so i've mounted a nfs share at /tmp, but not i can't umount it. says device is busy - probably because it's /tmp... i can't even umount it with -f, what else can i do? [00:06] kill any programs using /tmp :) [00:07] patdk-lap, none should be at present... [00:08] verify with lsof? [00:08] i just did...and there are some .nfs files open [00:08] from .python.b [00:09] how do i know what process to kill tho? [00:13] patdk-lap, i can't kill all of the .python.bin processes... [00:23] reboot? :) [00:24] hahaha [00:24] yea i guess so [00:24] this is a 'production' server so i was hoping to avoid that... [00:25] heh [02:16] New bug: #611769 in eucalyptus "Can't create volume from snapshot with different size" [Undecided,Fix committed] https://launchpad.net/bugs/611769 [02:47] Standard Cloud Add-On - 1 Year: $350.01 [02:55] Anyone have an issue with pptpd GRE+ppp checksum errors? [03:06] trying to setup vsftpd. can anyone help? [03:14] help with server [03:18] mewsic: sure we are in here to help, but you need to provide us with specific problems that your having === lifeless_ is now known as lifeless === dendrobates is now known as dendro-afk === rmk_ is now known as rmk [05:02] hi, [05:02] everyone. I got a UEC issue. [05:02] I can't register my node. [05:02] !ask [05:02] Please don't ask to ask a question, simply ask the question (all on ONE line and in the channel, so that others can read and follow it easily). If anyone knows the answer they will most likely reply. :-) [05:02] and I found people have same problem with me. [05:02] there is bug:https://bugs.launchpad.net/ubuntu/+source/eucalyptus/+bug/598186 [05:02] Launchpad bug 598186 in eucalyptus "Unable to register nodes in eucalyptus" [Medium,Incomplete] [05:03] is there other people got this issue too? [05:03] thanks === EvilTrek is now known as EvilPhoenix [07:13] what is file /proc/user_beancounters? and where are the current values of that things? [07:16] alex88: it's OpenVZ's exposure of resource limitations stats [07:18] twb: thank you, but there are the limits..where i can see the current values? i have some fails in tcprcvbuf and tcpsndbuf [07:21] The limits are configured in /etc/vz/conf/N.conf [07:25] is anything i can do with those buffers? i just download from my home when i get those errors [07:29] alex88: ask #openvz. I don't really feel like dealing with openvz stuff. [07:31] oh...sorry :) thank you [07:51] New bug: #617237 in mysql-dfsg-5.1 (main) "package mysql-server-5.1 5.1.41-3ubuntu12.3 failed to install/upgrade: Package is in a very bad inconsistent state - you should reinstall it before attempting a removal." [Undecided,New] https://launchpad.net/bugs/617237 [07:59] for some reason apache is not saving the log files... [08:00] <\sh> WalterN: hmm? elaborate? :) [08:00] using the same configuration as with 9.10 [08:00] with virtual hosts [08:00] moin [08:00] <\sh> hey binBASH [08:00] hmm.. lemme pastebin the config file [08:00] Hi \sh ;) [08:01] paste somewhere :) [08:01] hi all)) how I can determin frequency of my graphic card on my 10.04 without X server? [08:02] demon1981: look at manifacturer specs :) [08:03] alex88: I dont know what video card I use:) [08:03] lspci? [08:04] http://pastebin.com/gq8THFcV [08:04] where pool is a RAID5 [08:05] it worked fine is 9.10 and on a single disk (didnt have RAID st up at the time) [08:05] WalterN: tried /var/log/apache2/error.log? [08:05] it shows startup errors [08:06] checking [08:07] I have that in dmesg [08:07] [ 4.702355] [drm] nouveau 0000:02:00.0: Detected an NV50 generation card (0x0a5000a2) [08:07] may be its nvidia [08:07] how I can determ model of card? [08:08] demon1981: i told lspci not dmesg [08:08] ups [08:08] alex88: oh, it says it cant open /media/pool/website/error_jewelcreekkennels.com.log. Unable to open logs [08:09] WalterN: look why..can you access with root? [08:09] like touch /media/pool/website/error_jewelcreekkennels.com.log [08:09] look also at fstab permissions for the drive [08:11] I chowned the drive I thought [08:11] maybe I should have -R ? [08:11] sure [08:17] heh, that did it [08:17] my card is GeForce 02:00.0 VGA compatible controller: nVidia Corporation GT216 [GeForce GT 220] (rev a2) very likely driver nouveau is used. How I can determine the frequency of output signal? [08:17] strange though, why would I need to own the directory that its saving the log to? [08:18] not sure who the owner was before, but could save anything I wanted before [08:20] hmm, since I'm talking about it, what is a good website log viewer/analyzer thingy program? [08:21] <\sh> webalizer / awstats / analog /modlogan it depends on your needs [08:22] hobby server [08:22] <\sh> webalizer [08:22] as in, I dont know what I need :P [08:23] demon1981: you main monitor refresh? [08:23] WalterN: no, that not important...btw try to set log to debug in apache.conf, or ask in #httpd :) [08:23] gtg now [08:27] hi, I'm having a problem setting up a router [08:27] can anyone help? [08:28] soloslinger: what kind of router, and for what? [08:29] i'm setting up my computer to serve as a linux router [08:29] i have ubuntu 10.04 installed [08:30] oh, donno XD [08:30] I could help with dd-wrt though :) [08:30] which is not what you are using or want to use, so nevermind [08:31] I'm using openwrt on my wireless routers... [08:31] which I don't have a problem with [08:36] hey guys [08:36] my question is this. [08:36] soulstar: what you want to have?gateway? [08:37] i have my modem connected to a router and the router is getting dos'd is it possible to black list the ips on my server so they cant flood the server again? [08:37] eagles|work: you have firewall? how are you'r linux skills? [08:37] eagles|work, yes, but it's even easier/better to use iptables recent [08:38] it'll dynamically block addresses that are spamming [08:38] qman__: and alex88 i have iptables setup [08:38] would you like a pastebin of the iptables -L output [08:38] i use csf, and is awesome for ddos, bruteforces etc [08:38] try it [08:39] http://www.ducea.com/2006/06/28/using-iptables-to-block-brute-force-attacks/ [08:39] i have in the past but had mixed feelings about it [08:39] that example is for ssh, but can be used for any type of traffic [08:40] it'll significantly reduce the impact of the DoS while not cutting off service entirely [08:40] eagles|work: i've always been fine with that.. [08:41] qman__: someone pointed out somethign valid though even though the server is secured the router and my incoming connection will still be getting flodded [08:42] eagles|work, the way this works is, the server will simply drop packets being spammed in [08:42] so the DoS would have to have so many resources that only the single incoming SYN packets can max your line [08:42] and if that's the case, there's nothing you can do about it [08:42] ya im in the process of setting up another server as a dedicated firewall [08:43] qman__: would snort help mitigate those kinds of attacks or not really [08:43] no [08:43] snort is an IDS, it has no effect on this sort of thing [08:43] it will simply tell you what is happening [08:43] ok [08:44] if the attacker can flood your line with SYN packets, there's nothing you can do on your end [08:44] contact your ISP [08:44] see if they can help [08:45] but, if they're only succeeding with the full handshake, a proper firewall will reduce the impact [08:45] I should set up email sometime soon [08:46] qman__: im getting flooded with udp packets [08:47] eagles|work, is your server dropping them, or rejecting? [08:47] dropping is what you should be doing [08:47] reject will just generate more traffic [08:47] and if you are, that's all you can do [08:47] qman__: i have a router in between the outside and server [08:47] irrelevant [08:48] if the router can handle all the packets [08:48] and the router is just stopping the floods [08:48] well, it doesn't really matter where the packets are getting dropped, as long as they're getting dropped, and not rejected [08:48] that's all that can be done from your end [08:48] ya [08:49] thats not exactly true, if you can get someone else upstream to drop them for you :) [08:49] hehe [08:49] exactly my point, nothing else can be done on his end of the line [08:49] well i am in the process of setting up a dedicated firewall machien with 2 nic's [08:49] call the ISP, get them to help [08:49] yeh [08:49] or get the ip address, fly to their location and punch em in the face [08:49] ya i am waiting to get an email back with contact number [08:50] meh [08:51] just launch ICBM with IP seeker firmware installed [08:51] make sure its not pointing to lo ;) [08:52] only two approaches there, get the ISP to drop the packets, or give you a fatter pipe [08:52] IP address doesn't incidate elevation, which is critical for a targeted ICBM strike [08:52] *indicate [08:52] qman__: i get hundreds of emails a day offering me a fatter pipe... =) [08:52] twb: a contact fuse would work, though yeah.. elivation would make it more ideal :P [08:53] elevation* [08:53] qman__: whats funnier if you look at the internal ip which is assigned by router dhcp [08:53] the ip they are attacking is the ip of my laptop [08:54] So, fun fact that I learned today [08:54] If localhost doesn't resolve, hardy won't enable NFSv3 [08:55] It'll silently fall back to NFSv2 [08:55] i have another question related to this if im setting up a firewall machine that will take the incoming connection on one nic route it to the 2nd nic and the internal network [08:56] do i need to put the proxy on the server hosting the website or on the firewall server? [08:56] "routing" isn't done by a firewall [08:57] twb: i know but one of the nic cards in this other machine will be directly connected to the external connection [08:57] the other to the internal network [08:57] my question is more on which machine should the proxy be [08:57] the one that has the firewall [08:57] or the server on the internal network [08:57] proxy for what? [08:58] web proxy [08:58] like squid [08:58] as well as i want to provide some content filtering [08:59] If you're masquerading and not using -j TPROXY or -j DNAT, you'll need a proxy on the masquerading device. [08:59] !masquerading | eagles|work [08:59] Er, that is, for exposing a local service to the internet. [08:59] gotcha [09:00] If you're just talking about providing a conventional caching HTTP proxy to browsers on the local network, squid can be deployed anywhere [09:00] twb: this is going to need to be on the masquerading device as its also access by people on the outsdie [09:00] would content filtering go on the masquerading device too [09:01] Filtering of what content, from whom? === maxb_ is now known as maxb [09:01] twb: like porno graphic content etc [09:02] from the internal network [09:02] im at a clinic and im working on providing wifi to the whole place [09:02] wifi with content filtering [09:02] btw qman__ if your interested this is the router security log http://pastebin.com/Yhzg3wWx [09:03] Unless you're operating a "default deny" policy, you won't block pornography. [09:03] not even if i use dansguardian [09:04] Let me rephrase: you won't block ALL pornography. [09:04] its better most then nothing [09:05] Well, I can't comment on "most", but if that's your position then by all means adopt a "defalt allow" and a blacklist. [09:05] arent there some web based content filter where you tell the filter certain keywords are blocked etc [09:06] yes, but they're quite terrible and only marginally effective [09:06] nothing wrong with the software itself, the idea is flawed [09:06] ok [09:07] whitelisting is the only truly effective way [09:07] ok but using what something like dansguardian [09:08] AFAIK dansguardian is just a blacklist and a squid hook. [09:11] twb: ok [09:11] and i officially hate my isp [09:11] they giving me the whole rubbish of they cant ddo anything [09:11] and only thing i can do is on my end with a firewall [09:11] and if they continue to contact the police [09:13] qman__: the other one that screwed me at a prison was that they whitelisted google --- which happens to include all google's "cached page" pagse [09:13] yeah...you need to be a lot more specific than that [09:14] Really the problem is the prison staff can be... not too bright [09:49] morning [09:55] hey guys is it possible for a multicast to flood a connection? === Barre_ is now known as Barre [10:06] dual nic. eth0 and eth1. eth0 connects to public internet. eth1 connects to GSM router. GSM router has Port Forwarding to eth1. eth0 has a gw defined, eth1 does not. ip_forwarding is enabled. If I ping eth1 from the GSM network I get answer,.if I ping eth1 from the GSM network I get no answer. Anyone good with routing that can help? [10:06] <_ruben> woah .. rereads it a couple of times [10:06] lol [10:07] <_ruben> how about a nice diagram? ;) [10:07] froud: you have a router involved in ur setup [10:07] and u want one nic directly on the internet right [10:07] eagles|work: yes eth0 is on the internet [10:08] eth1 connected to a BR970 GSM router [10:08] <_ruben> weit .. your message is wrong: you're saying that pinging eth1 from GSM network does both work and not work [10:08] well u could connect eth0 to the router [10:08] <_ruben> s/weit/wait/ [10:08] but then put eth0 on the dmz of the router directly exposing it to the net that way [10:08] <_ruben> and also quite importantly: what are trying to achieve? [10:09] okay here goes slowly [10:09] eth0 <-> eth1 <-> GSM [10:09] eth0 is public and available [10:09] I can ping it [10:10] froud: you want to route traffic from 0 to 1 [10:10] eth1 is connected to a switch port on the GSM router [10:10] froud: man route btw might help [10:10] GSM router SIM gets IP 10.0.0.1 [10:10] Eth1 got 192.168.1.2 [10:11] you are on entierly different subnets for one [10:11] On GSM host at 10.0.0.3 I can ping 10.0.0.1 [10:11] but I cannot reach 192.168.1.2 [10:11] eth1 needs lets say 10.0.0.0.4 for example [10:11] froud: the ip is on a differrent network segment all together [10:11] brb from laptop [10:11] eagles|work: yes but the subnets are joined by router GSM [10:12] eth1[192.168.1.2] - GSM ROUTER - 10.0.0.1 [10:13] back [10:13] * eagles0513875 shakes head froudeth1 has to be a 10.0.0. ip though [10:14] eagles0513875: why the B970 does routing [10:15] If I route add default gw 192.168.1.2 to the server I can ping eth1 [10:15] from 10.0.0.3 [10:15] <_ruben> does the gsm router have a router for 192.168.1. network and does your machine have a route for the 10.0.0. network ? [10:15] but then I will lose the eth0 [10:15] humm [10:15] <_ruben> have a route meant [10:15] <_ruben> i meant [10:16] <_ruben> geesh, must be friday [10:16] _ruben: default admin interface of router is 192.168.1.1 [10:17] I think what I need to do is add some route that will send traffic detined for 10.0.0.0 via eth1 and not eth0 [10:17] but I am not sure how [10:17] my route knowledge is not that good :-) [10:17] <_ruben> ip route add 10.0.0.0/24 via 192.168.1.1 dev eth1 [10:19] invalid argument [10:23] * froud goes to pastebin [10:29] oh..is there a ip command? i've always use route directly.. === oCean__ is now known as oCean_ [10:30] ip is from 'iproute2', you could even add additional routing tables/rules [10:30] oCean_: i've seen the help..is a more complete command including also route [10:31] if i've seen right [10:31] _ruben: http://pastebin.com/gdX2tUXn [10:31] eagles0513875: http://pastebin.com/gdX2tUXn [10:31] * froud needs to step away for 5 mins, nature, brb [10:40] morning [10:40] when setting up a chroot for SSH, it all seems very, very mesy. I mean - what happens when updates come in for the files you've had to copy across into your chroot? [10:41] I can't think of any sane way for a sysadmin to monitor which files and copy the new ones over. Surely there has to be a simpiler way, such as with SSH using SFTP - you can simply use the internal-sftp and chroot users, done. [10:42] * eagles0513875 loves sftp so easy to setup compared to ftp [10:42] * froud is back [10:43] indeed, FTP shouldn't be used really - such a crap protocol. However, that's a different discussion :P [10:44] ya sry [10:44] never worked with a chroot much AlexC_tbh so i dunno what to tell ya [10:44] dealing with my own issues atm here at work [10:44] it's quite shocking really that such thing is so ... complicated to do, really [10:45] <\sh> AlexC_: why copy? hardlinking is a good way to go [10:45] <\sh> or softlinks if that works... [10:46] \sh: hum, all guides/references that I've seen said to copy. I didn't think it was possible to link them due to the path changes [10:47] to a person not in a chroot, the links will work. But how would it work for a user in the chroot if they can't access above their chroot, which is where the real files would be [10:48] is ther a known problem with logrotate in ubuntu 8.04 or am I mistaking in my configuration? [10:48] a_ok: how do we know you're making a mistake, when you tell us no problem? [10:49] the files seem to be created with different rights (at random) and it does not seem to rotate daily properly [10:50] AlexC_: http://pastebin.com/BXVQx3Hi [10:51] AlexC_: as you can see /var/log/mail.log.6.gz modified date is wrong (checkt the content and it has entries of 1-8) [10:52] a_ok: not sure, only thing I can think of - is there another logrotate script using the same file? [10:53] checked the configuration [10:53] no duplicates [10:56] AlexC_: there is only one logrotate installed. is there some other package that does rotating (perhaps sysklogd???) [10:57] and why is there an uncompressed file called /var/log/mail.log.0 ? [10:58] a_ok: that's normal, it'll become .1.gz upon next rotate [10:58] a_ok: however, one thing - why do you want your log files writable? [10:58] 440 would do me [10:59] but today its the 13th, and last change on mail.log.0 is the 8th... [10:59] ah, simple [11:00] your server has become aware it is 'Friday' and also the '13th'. Therefor, let it run wild and see what happens tomorrow [11:00] lol [11:01] AlexC_: don't need it writable actually in this case as syslog writes to it but its the default setting for all my logfiles [11:01] be right back [11:12] <\sh> AlexC_: regarding http://ulf.zeitform.de/de/dokumente/sshchroot.html you can use hardlinking without any problems (sorry is in german but I think google will help to translate ;)) [11:15] \sh: interesting, thanks :) [11:36] New bug: #617127 in eucalyptus "CacheConcurrencyStrategy should be READ_WRITE and not TRANSACTIONAL" [Undecided,Fix committed] https://launchpad.net/bugs/617127 [11:49] Hi! Where I can look for kernel boot param line in grub2? [11:49] AlexC_: there are some default settings in logrotate.conf (the toplevel config file instead of stuff in logrotate.d) like a weekly rotate and keeping it for 4 weeks [11:50] could that be the problem [11:50] demon1981: /boot/grub/grub.cfg [11:50] AlexC_: I noticed that the day's that are off are all sunday's [11:50] its like it does not rotate those files [11:51] a_ok: grub.cfg seems as script file. how I can compile from it result params string? is it possible? [11:53] demon1981: erm its just a config file. if you scroll down a bit you should see the kernel line [11:53] no compilation [12:01] a_ok: I dont see here video params Where I can take those params? I want to decrease framebuffer frequency linux /boot/vmlinuz-2.6.32-21-generic-pae root=UUID=c8b6c463-c05f-4f76-9a17-3d6d5b282d95 ro quiet initrd /boot/initrd.img-2.6.32-21-generic-pae [12:01] a_ok: this is line from /etc/grub/grub.cfg [12:03] those are two lines i think [12:04] you can edit the line starting with: linux /boot/vmlinuz-2.6.32-21-* [12:31] a_ok:yes. it's 2 lines. if in kernel options we dont see video options then those options takes from other place. From what conf are they takes? (I use nouveau framebuffer) [12:31] [12:46] hggdh: GOOD MORNING! [12:46] hggdh: Thanks for your email last night. [12:51] Daviey: Good morning [12:53] hggdh: How are you this fine day? [12:56] Daviey: so far I am fine... and I hope I will be able to find out what gives on the test rig [12:57] hggdh: I have a PPA package enroute, but also expecting a new code drop to resolve a potential registration issue [12:59] Daviey: right now I will try anything ;-) [13:11] hey guys package dovecot-postfix contains full mailserver ready to run ? some kind of easy pack to install? am i right? [13:28] morning === RoAkSoAx_ is now known as RoAkSoAx [14:01] New bug: #617053 in eucalyptus "on upgrade from 1.6.2, euca_upgrade should preserve DISABLE_ISCSI="Y"" [Medium,In progress] https://launchpad.net/bugs/617053 [14:15] hey Daviey, what was the URL for the wget on wrappers.conf? [14:16] cannot find the email :-( [14:16] New bug: #617380 in munin (main) "Add apt_ubuntu plugin" [Undecided,New] https://launchpad.net/bugs/617380 === dendro-afk is now known as dendrobates [14:25] hggdh, Ah, you are back - i just mailed you the wget line [14:26] Daviey: sorry, weechat had a moment here [14:27] hggdh, heh [14:39] Does anyone know how I can implement watchdog on Linux / Ubuntu Server and also find a list of which watchdog hardware is supported === jetole_ is now known as jetole [14:48] in order of request: [14:50] hallyn, Daviey, soren: I uploaded libvirt 0.8.3-1ubuntu1 yesterday. this morning I uploaded 0.8.3-1ubuntu2 to fix a ftbfs on armel, but I'm not planning other uploads (excepting an emergency), so have at it [14:50] jdstrand, Super, i just wanted to test it - soren wanted to add a patch [14:50] Thanks jdstrand ! [14:50] sure :) [14:51] jdstrand, Have you documented the merge? It seemed pretty intense? [14:51] Daviey: in the changelog (as per standard practice) [14:51] Good Point Well Made. [14:52] Daviey: most of those patches have comments at the top. I didn't write most of those, but tried to make them DEP-3 when I could find the history [14:52] jdstrand, Ok.. thanks.. i'll read the changelog [14:52] Daviey: I also try to put in the changelog when I expect something to be able to be dropped, to help with future merges [14:53] jdstrand, We'll keep you! :) [14:53] heh [15:00] guys, I have a newly installed 10.04 machine and am trying to follow this guide: https://help.ubuntu.com/community/LDAPClientAuthentication however there are looooots of inconsistencies, for example it asks to restart nscd but I have no /etc/init.d/nscd, also my /etc/libnss-ldap.conf is missing and I can't seem to find it anywhere else (updatedb && locate), I've found a libnss-ldap.conffiles in doc, but that just mentions /etc/init.d/libnss-ldap. Is [15:01] I know it's not a server-related issue, but someone in #ubuntu recommended I ask here since you guys might be more up to date on this matter [15:16] v00lcano: there's a libnss-ldapd package. Might be something you want. There's also a libnss-ldap package ... a bit confusing. The fisrt appears to be a fork of the second. [15:26] Daviey: shouldn't eucalyptus-*-publication be stopped when you 'sudo stop eucalyptus'? [15:27] Daviey: and shouldn't they be started when you (later on) 'sudo start eucalyptus'? [15:30] hggdh, technically yes - i haven't tried that [15:30] Daviey: before I open a bug there -- can you try it? [15:30] hggdh, Hmm [15:30] yes i can :) [15:31] hggdh, I am prepairing an upload now btw [15:31] Daviey: also, what images did you use on your tests yesterday night (rather, today very early)? Current Maverick UEC ISO? [15:31] Daviey: cool! [15:31] * hggdh awaits happily [15:31] hggdh, netboot, from archive.ubuntu.com [15:32] so whatever was in the archive at that time [15:32] Daviey: no, for the VM images [15:32] oh.. [15:32] i used what was on uec-images.ubuntu.com [15:33] Can anyone help me out with how I configure watchdog on ubuntu server? [15:33] Daviey: the dailies, then, correct? [15:33] hggdh, you expect, avahi-publish -s Walrus _eucalyptus._tcp 8773 txtvers=1 protovers=1.5.0 type=walrus ipaddr=10.0.0.100 <-- to be killed? [15:33] Daviey: yes indeed [15:34] wy publish something that is currently dead? [15:34] jetole: I never used whatdogs, sorry [15:34] any experts on load balancing here today [15:34] hggdh, CLC avahi went - still waiting on Walrus [15:34] ssureshot: depends. Whats your question? [15:35] hggdh, confirmed, walrus didn't go - this was on a CLC + Walrus box [15:35] CLC did die [15:36] jetole: I have 2 servers setup and functioning with heartbeat / ldirectord all services set up that I need... My question is this.. When I turn on the backup load balancer first it doesn't transfer the server to the primary once it is turned on.. Is this normal? [15:37] ssureshot: what is the backup load balancer? [15:37] but if I turn the primary on first have the talking unplug primary services transfer accordingly and they transfer right back when I plug it back in [15:37] jetole: ubuntu 9.10 server [15:38] hggdh, Hmm.. raise a bug - and i'll confirm it on a fresh box [15:38] hggdh, Feel free to assign it to me,. and i would say Medium priority.. agree? [15:38] ssureshot: how are you load balancing though? Are you using ipvs, haproxy or something else? [15:38] oh ipvs [15:38] hallyn, around ? [15:39] ssureshot: I don't know. I have been meaning to switch to IPVS for a few months, I currently use HAproxy however I would ask this question in... what was that room? One sec [15:39] #linux-cluster [15:39] Daviey: hum. Low should be fine [15:40] #linux-ha [15:40] jetole: awesome thank you sir [15:40] those two rooms are really good when it comes to IPVS [15:40] ssureshot: no prob [15:40] hggdh, agreed [15:42] im planning on setting up a server to play with. what is the recommended intrusion detection software? snort? munit and mungin? [15:43] resno: I use sshguard i think [15:43] resno: suricata [15:43] i can't find truecrypt in lucid althought there are gui tools for truecrypt available. any idea why truecrypt isn't available in lucid? [15:44] zash: heh you think ;) [15:44] resno, used to be snort but afaik snort is... how do I put this? I guess snort isn't really being developed as actively anymore [15:44] snort 3 seems to have been on the back burner for far too long [15:45] jetole: ah, darn out of date information :( [15:45] resno: suricata is a fork of snort created by The Open Information Security Foundation [15:45] resno: http://www.openinfosecfoundation.org/index.php/download-suricata [15:46] resno: actually, not a lot of people really follow snort closely enough to care so some people, in fact most people will still recommend snort [15:46] i see. im curious to see how much of my playing will register on it, etc [15:47] the current snort release is 2.8.6.1 and, if I remember correctly, almost two years ago 2.8 was still being used and if I remember correctly, almost 2 years ago snort 3 was announced as the upcoming snort [15:47] heh nice [15:48] resno: Well with both snort and suricata, you can always create custom rules plus some of the best rules don't come from snort. I think bleeding edge rules is the big one [15:48] I would use oinkmaster to download the snort rules and the bleeding edge rules and write a rule for anything you can find that doesn't register [15:48] jetole: this mainly will detect attacks not block them right? [15:48] resno: I thougt that was what it was called, and it was [15:49] resno: well that depends on you [15:49] both snort and suricata can be compiled as an IDS or IPS / detect or block [15:49] the blocking is done via NFQUEUE via netfilter and iptables [15:49] resno: but I would strongly recommend against blocking [15:50] IPS can be very dangerous [15:50] a false positive can block legitimate users [15:50] it's better to do IDS and analyze the results [15:50] jetole: yes, ive read [15:52] Also, with either snort or suricata, I would recommend the unified2 format and the barnyard 2 utility [15:52] for front ends, you can look at BASE, Aanval or prelude prewikka [15:53] jetole: thats quite a bit of information to get me started :) [15:54] what is wrong with IPS blocking legitimate users? [15:55] kelt: It's too much work when you can just turn the server off to block legitimate users [15:55] lets just suppose i blocked myself, how would you get back in? [15:55] I find the poweroff command is quicker and easier then bothering with rules if I don't want people to access a service I am running. Plus you have the wasted time of developing and running a service that you don't want anyone to access [15:57] resno: afaik, the system works on a per match basis for example if you block fragmented packets and you send a fragmented packet then that packet is blocked however if you don't send a fragmented packet then it will go through [15:57] thats in theoreom, clearly you will have more rules then that [15:57] oh ok [15:57] kirkland: o/ [15:57]