=== erichammond1 is now known as erichammond [00:20] How do I sett up a cron command, to run chmod -R 777 /path/ [00:30] eriksson25: why do you need to do that continually? [00:32] have a folder that that my admin user creates folders in, and need to have 777 permissons on those folders to be able to change them with a other user over samba. [00:34] in the crontab, shuld the actual comand be, or shuld it link to a other .cron that contains the comand? [01:06] Hey guys, can anyone help me with a problem? [01:06] If theres anybody paying attention [01:07] Wow, the ubuntu channel is sprawling with people and yet nobody says a word on here [01:13] cygnus, as per the rules of irc, only solve questions, not questions about questions [01:13] but he is gone anyways [01:16] New bug: #689472 in quagga (main) "package quagga 0.99.15-1ubuntu0.1 failed to install/upgrade: subprocess new pre-removal script returned error exit status 1" [Undecided,New] https://launchpad.net/bugs/689472 [01:58] Patrickdk, they never seem to stick around long [02:08] wtf [02:09] ya, 2min is defently not long enough on irc [02:09] I installed the ntp package and setup so my local network can sync off my ntp daemon but its not working [02:09] exactly how did you setup? [02:09] trying to telnet on port 123 gives connection refused [02:09] ntp doesn't use tcp, won't work :) [02:09] oops [02:09] yeah, forgot udp [02:10] ntp.conf needs many changes also [02:10] i used this parameter in ntp.conf [02:10] restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap [02:10] that should work fine [02:10] and broadcast 192.168.1.255 [02:10] use ntpdate on another machine to check it [02:10] forgot broadcast nothing really uses it at all [02:10] windows machines? [02:10] i try and it says no suitable server found [02:10] 12 Dec 21:06:35 ntpdate[8788]: no server suitable for synchronization found [02:11] well, ntp has too be running for awhile, (5-15min atleast) before it stabilizes, and will serve time [02:11] otherwise it will reject requests [02:11] oh [02:11] wow [02:11] I didn't know that, thanks. [02:11] unless it knows it has good time, it won't give out time :) [02:11] patdk-lap: just when you said that, it worked [02:11] hehe [02:12] patdk-lap: can I have ntpd serve time to people outside my lan too? [02:12] or is that a bad idea [02:12] yep [02:12] I do it [02:12] what do I need to change for that [02:12] ntp.patrickdk.com I think [02:12] I chane the defaults to: [02:12] restrict -4 default notrap nomodify nopeer [02:12] restrict -6 default notrap nomodify nopeer [02:13] Not NN.pool.ntp.org [02:13] ? [02:13] twb, it's in pool also [02:13] but using my own domain, I have my own servers setup to use it, besides just the pool [02:13] my ntp servers are in the pool, but the clusters of servers behind and with them, just use mine [02:13] My DHCP server tells DHCP clients to use my local NTP server, but AFAICT Ubuntu ignores them (except d-i). [02:13] patdk-lap: can you test if getting time from stiv2k.info works [02:14] server 72.188.7.219, stratum 2, offset 0.039795, delay 0.06297 [02:14] 12 Dec 21:14:22 ntpdate[6344]: adjust time server 72.188.7.219 offset 0.039795 sec [02:14] hmm so it already works then [02:15] you have a firewall on that machine? [02:15] yes [02:15] i already had the port forwarded [02:15] from before [02:15] if you put it in the ntp pool. be careful [02:15] it will easily overflow conntrack [02:15] why [02:15] oh [02:15] i'll get thousands of requests? [02:15] yep [02:15] even with a large pool? [02:16] if you use some of the slower connection speeds, you won't *often* get a flood [02:16] but I normally only use the highest speed setting [02:17] actually, since that guy started redirecting all turkey dns traffic to a dummy server, it's been a lot better [02:17] what do you mean speed setting [02:17] on the ntp pool website [02:24] another issue i'm having is that my cups keeps pausing the printer with a backend error after every print job [02:25] http://paste.neoturbine.net/98229 [02:25] that is the cups error log [02:28] any ideas? [02:58] how to fix the following security vulnerablity [02:59] http://marc.info/?l=full-disclosure&m=129175358621826&w=2 [02:59] about econet issue? [03:03] <_Techie_> is there any way to install windows inside a ext partition? === Psi-Jack_ is now known as Psi-Jack [03:05] _Techie_: ##windows [03:05] There is a way, but only under virtualization where Windows itself thinks it's a primary partition, or rather, a full raw hard drive, but I'm sure that's not what you were thinking. [03:06] <_Techie_> if it just emulated the HDD then im happy [03:06] <_Techie_> i just dont want it to emulate the CPU and everything else [03:06] AFAIK neither Windows' bootloader nor kernel contains drivers for ext, thus AT BEST you will only be able to store data (i.e. D:) on ext. [03:07] I'm not aware of any virtualization technology that can present a virtual HDD *to Windows* without emulating an entire system. [03:08] Obviously LXC/OpenVZ can approximate that for Linux clients, but that's because both host and guest share a kernel. [03:08] <_Techie_> okay, is there any way to safely resize the ubuntu-server partition and install windows side by side without screwing up everything [03:08] _Techie_: I don't know; I haven't used Windows for about ten years. [03:09] _Techie_: normal procedure is to install Windows *first*, because Ubuntu understands Windows partitions, but not vice-versa. [03:09] <_Techie_> yeah [03:10] <_Techie_> i would have done that, but only recently has the idea of doing windows stuff on this machine arised [03:10] I suspect you can simply shrink your ext partition, install windows, then boot a live medium and reinstall the bootloader. [03:10] <_Techie_> i can do that, but i dont trust gparrted that much === squishy is now known as SquishyNotHere === Belgrano_29_H is now known as mterron [04:36] HELP~ one of my linux servers has been overcome with about 50 processes running a command called dtmss! [04:37] they are connecting from various random ip addresses, I can killall the processes, but I don't know where they came from! [04:39] they are running under the www-data user [04:43] ok, stop killing them all [04:43] the www-data user, what does it look like in /etc/passwd? [04:43] cat /etc/passwd | grep -i www-data [04:43] and lsof | grep dtmss [04:43] don't paste a huge thing from lsof in here, find a pastebot [04:44] fluvvell: all of this is pointed at you [04:49] The_Tick, Hi, ok just looking up www-data now [04:50] The_Tick, just one entry www-data:x:33:33:www-data:/var/www:/bin/sh [04:50] Wait, why should www-data have a shell? [04:50] set that to not have a shell [04:50] starting off [04:50] you're getting hacked [04:51] you need to figure out where that dtmss lives on the box [04:51] or [04:51] it's a torrenting app [04:51] a find command ? [04:51] fluvvell: sounds like you're running a PHP app [04:51] find / -name 'dtmss' [04:51] twb: sounds like torrents to me [04:52] The_Tick: yes, but the reason he got owned was he ran a PHP ap [04:52] twb, my web server has php [04:52] I have a locally written content manager in php [04:53] twb: hehe [04:53] fluvvell: you have a poorly written one most likely [04:53] The_Tick, twb, I have found the dtmss in /tmp [04:53] yeah, [04:53] fluvvell: don't rm it yet [04:53] investigate that fil [04:53] * fluvvell flogging my programmer [04:53] file [04:53] see who owns it [04:54] www-data [04:54] its binary [04:54] well there you go [04:54] ya, heh [04:54] anything else in /tmp? [04:54] see if www-data has a history of commands [04:54] barbut [04:55] if it were me [04:55] I'd reimage the box [04:55] uh, but they don't have a home directory? [04:55] and restore from backup [04:55] I think re-imaging might be a good idea [04:55] and then harden the box [04:56] then put it back on the net [04:56] in other words [04:56] Owch, re-writing the website under a new content manager?? [04:56] Reimaging the box won't help if he doesn't also fix the shitty code [04:56] twb, lol [04:56] fix your shitty code [04:56] why do you have a custom built local thing when there's 30 oss packages which are maintained normally? [04:57] but you're right. Its written by shitty@code.com. I'll just send him an email. [04:57] rewrite it in python ;) [04:57] The_Tick: because the 30 oss packages are also full of security holes :P [04:58] The_Tick, I might have to get an off the shelf cms, got any recommendations? [04:58] twb: hehe [04:58] cough wordpress cough phpbb [04:58] doh, asked the stupid question. [04:58] fluvvell: depends on what you need [04:58] Isn't w**dpress written in php twb ??? LOL [04:58] fluvvell: yes, which is a contributing factor in its poor security history [04:59] twb, from what I've read, they've made a bit of progress in that area [04:59] IME CMSs are designed for stupid people, by stupid people. I don't think I've seen one that I'd recommend, except maybe to an enemy. [04:59] fluvvell: what exactly do you need to do? [04:59] do either of you want a copy of the hackers code to look at? [04:59] don't say "cms" [04:59] nope [04:59] he he [05:00] http://en.wikipedia.org/wiki/Functional_requirements [05:00] Just a clients website, it wasn't too complicated. I think I could implement it in wordpress. [05:00] no no [05:00] what does the website need? [05:01] before I answer, should I kill off the shells that my hacker still has open? [05:01] umm yes [05:01] rm the binary [05:01] then kill them all [05:02] change the shell [05:02] check for anything in /etc/rc* [05:02] for restarting their shittiness [05:02] fluvvell: http://www.porcupine.org/forensics/ [05:03] have heard about the coroners toolkit before [05:03] I was mainly pointing to the textbook (first link) [05:04] Interesting [05:06] Well I've shut down the web server, but of course that puts their website offline :( So being 3 days from my summer holiday of 3 weeks, anybody got a quick suggestion that will keep my mental health intact? [05:06] reimage, restore from backup, lock down [05:06] * fluvvell kicks self, hunts for instant magic solution, fully aware it does not exist [05:06] yes, reimage [05:06] Reinstall the machine, but leave the website turned off [05:07] only a nights work I guess [05:07] figure out how they got in [05:07] then force the user to fix it [05:07] before it goes online [05:07] use virtual machines [05:07] The_Tick: since it was owned by www-data, it's a safe assumption is was something within the www-data group that was exposed [05:08] Using a VM won't stop the abitrary-execution-with-user-privileges hole in his CMS [05:08] Users are all samba users, plus my programmer who has left to run kids camps, and only programs part time now. [05:08] twb: agreed [05:08] Yes, I'd say most definately it was a php vulnerability [05:08] twb: it'll make it easier to revert the vm since I have a feeling he'll run into this again [05:08] The_Tick: true [05:12] I'd probably best get someone to convert the4 website to wordpress [05:12] fluvvell: again [05:12] what does the user actually need [05:12] you may not need a cms [05:13] The_Tick, okay, I see your point. They havn't done a lot of content update themselves. [05:19] The_Tick, checking it out, they have changed details here and there, contact names etc, added some text to their product line descriptions. It used to be about 5 pages with links etc, not much changed there. [05:31] nope, all the /etc/rc* directories look standard, and rc.local is untouched from standard [05:32] so twb, you'd be more keen on Django ? Being a python based content manager? [05:36] Look, the bottom line is that anyone can write an insecure web app [05:37] twb, its true [05:37] PHP targets newbies, and newbies make more mistakes [05:37] So as a rule of thumb, I'd prefer python over php -- but that doesn't mean it won't be full of holes [05:37] And hey, python is targeted at newbies, too [05:38] twb, yes [05:39] twb, The_Tick, many thanks for the help. I've got to go collecting for the food bank, but I'll schedule in a reimage on the server for tomorrow night. warm regards to you both. [05:39] Whatever [05:40] shut the box down now [05:40] until you can work on it [05:45] Hear hear [08:01] Hey, for years I was a Windows-Admin now switching to Linux. I used Exchange behind a VPN. User can`t use IMAP and SMTP without VPN connection. Is it reasonable to do the same with my Ubuntu-Postfix-Cyrus installation? [08:03] I have OpenVPN. If it is reasonable how do I configure Cyrus and Postfix to accept connections only from local networks. [08:11] Frenk: don't run them on the bastion? [08:13] twb, sorry but i dont know what you mean =/ my english isnt as good [08:13] Frenk: the "bastion" is the host that sits between your network and other networks, and routes traffic between them [08:14] If cyrus runs on any other host, and the bastion firewalls it, then it will inherently be inaccessible from other networks [08:14] oh ok i got it [08:15] http://de.wikipedia.org/wiki/Bastion_Host [08:16] thx for german version hehe [08:19] is my idea right? = i set up a bastion host for vpn, the cyrus is on another host and is blocking all connections except from the bastions ip [08:19] because both hosts are servers pointed directly to the internet (root hosting) [08:20] If both hosts are directly on the internet, you do not HAVE a network [08:22] If it's just a VPS on the internet somewhere, you would put everything on one box, and configure the firewall to only allow connections to postfix/cyrus from the VPN's subnet. [08:22] oh ok [08:23] You could ALSO tell postfix and cyrus to only bind to that interface, but that requires you to use static IPs, and to bring up the network before starting postfix/cyrus. [08:23] If the VPN is only there to control access to IMAP and SMTP, I would instead just use SSL. [08:23] I'd also use dovecot instead of cyrus. [08:24] I use imapS only. but i thought that double authentification (vpn + cyrus) is good [08:24] I don't see why [08:25] Because people will need keys to access the network and then their passwords to access the mailbox [08:25] To prevent hacking of the mailboxes [08:25] or is it useless? [08:26] So you want it for multi-factor authentication? [08:26] i.e. so you need both a key and a password? [08:26] yes [08:26] right [08:26] I *think* you can do that with SSL, by configuring two-way SSL handshaking [08:26] ok ill google it [08:26] and why dovecot over cyrus? [08:26] i.e. each client machine also has an SSL keypair and an SSL cert [08:27] its all in all for 15 people so i think individual ssl key isnt a problem [08:28] Mainly because dovecot seems to be more active, and (I think) it's Ubuntu's preferred implementation [08:29] Yeah, cyrus is in universe, dovecot is in main. [08:30] https://help.ubuntu.com/10.04/serverguide/C/dovecot-server.html [08:30] Since i am new to *nix i use artica (postfix-cyrus-webinterface-amavid and many more features) for email with snort with snorby as ids [08:30] Do not trust just any article you find [08:31] In particular, check when it was written, and for which version of Ubuntu [08:31] ok [08:31] One of my coworkers keeps using really old articles and I have to hit him with a stick... :-/ [08:31] hehe [08:32] aand artica is using cyrus as default - thats why im using cyrus =D [08:32] okay ill search for ssl handshake, thx a lot! === doko_ is now known as doko === Psi-Jack_ is now known as Psi-Jack [10:08] hi guys [10:09] i have i question, how do i create such system if server is down, i give user a static styled html msg with temp down info [10:10] i know its possible i just dont know how [10:11] <_ruben> udens: you'll need to put a reverse proxy in front of that server which would give you that functionality [10:12] so this reverse proxy would chek if site is down and then display static html? [10:12] <_ruben> basically,l yes [10:12] is it possible to show different html for different domain? [10:12] <_ruben> most reverse proxies offer that as a feature, yes [10:12] thanks _ruben [10:12] Of course, then your reverse proxy would be a SPOF [10:13] thanks guys im just new to this :) [10:13] google didnt help this time [10:13] <_ruben> twb: that probably isn't an issue, as without it, it already is an spof on its own ;) [10:14] <_ruben> just add one more spof ;) [10:14] two spofs is worse than one [10:15] <_ruben> twb: true, but if one wouldn't matter, why would two ? ;) [10:15] Bah [10:15] Enough of your "logic" [10:15] <_ruben> if one cares about spofs, the "backend" would be HA as well ;) [10:17] <_ruben> heh === Fookin_Prawn is now known as fookin === fookin is now known as Fookin_Prawn === hackeron_ is now known as hackeron === Psi-Jack_ is now known as Psi-Jack [13:38] hey guys i need some help with smtp. i have it setup to use startttls on my smtp server yet now its having problems sending out going emails :( [13:38] any one able to help me [13:43] <_ruben> eagles0513875: you'll need to be much more specific & elaborate .. good starting point would be to pastebin the config and relevant logs [13:44] _ruben: what port does starttls use [13:46] !postfix | eagles0513875 [13:46] eagles0513875, please see my private message [13:48] basically _ruben starttls isnt able to establish a connection to my server :( [13:51] _ruben: this is the error message im getting as im trying to send this email [13:51] Sending of message failed. [13:51] An error occurred sending mail: Unable to establish a secure link with SMTP server eagleeyet.net using STARTTLS since it doesn't advertise that feature. Switch off STARTTLS for that server or contact your service provider. [13:54] starttls isn't a what or an it [13:54] thats odd [13:54] O_o [13:54] Hi, I can use some advice as i'm setting up my first dedicated server and i'm not sure as to do i need to install a mail server like Postfix for PHP scripts to be able to send email using the mail() function or is there a better and more efficient method? [13:54] patdk-wk: i think i have isolated this issue to thunder bird [13:55] so you selected the, require encryption option, and didn't turn on encryption support on your server? [13:55] its been working up until this afternoon patdk-wk [13:55] what doesnt make sense [13:56] is that i can send an outgoign email from squirrelmail but not thunderbird mail client [13:56] well, when it installs, it installs a dummy certificate, did that dummy cert expire? [13:57] fixed it [13:57] hmm, dummy cert made for 10years here [14:01] patdk-wk: O_o it might have but i think its a port issue [14:01] patdk-wk: what file do i need to look at for the port smtp is using [14:03] master.cf [14:04] and maybe /etc/services [14:07] patdk-wk: where exactly would it tell me what port im using === ubax is now known as uba [14:08] netstat -atnp [14:09] tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN <-- that good like that [14:09] instead of that smiley its supposed to be :* [14:09] : * [14:09] heh? what smiley? [14:09] you need a proper irc client [14:10] im using kvirc [14:10] does that look right to u though [14:11] it's ok, but you shouldn't be using that for thunderbird or stuff [14:11] im not [14:11] im accessing my mail server with it as my client [14:12] heh [14:12] you should never talk to a mail server using port 25 :) [14:12] it's unreliable [14:13] O_o [14:13] what other port can i use starttls with [14:13] 587? [14:13] firefox is defaulting to 587 should i use that instead [14:14] thunderbird i mean [14:14] patdk-wk: when it searches for the settings automatically it keeps setting the port to 587 for out going [14:14] for some reason [14:16] patdk-wk: i really need to get this back up :( [14:24] Hi, any ubuntu server dev here? [14:29] :( [14:39] :( [14:42] patdk-wk: what i find odd is i can use squirrelmail to send emails just fine [14:42] Is squirrelmail running on mail server? [14:42] 15:12 < patdk-wk> you should never talk to a mail server using port 25 :) [14:42] Uh? :) [14:43] jeeves, way too many isp's, hotels, wifi hotspots, ... blocking or redirecting it [14:44] port 587 was always made for user access [14:44] Jeeves_: I think what patdk-wk is trying to say is that if you can, you should provide yourself with port other than 25 where you can connect to your smtp server, as port 25 is often blocked by ISP's. [14:44] It was simply rather poorly phrased. [14:44] I love how the iphone uses port 25 by default, and at&t blocks it in most places [14:45] You're supposed to use AT&T's SMTP server, aren't you? [14:45] soren: Indeed, you are. [14:46] interesting how can i reconfigure postfix to use 587 instead patdk-wk [14:46] patdk-wk: 587 never made it for normal use [14:46] oh ya, like at&t's smtp server is safe for sfp or dkim [14:46] eagles0513875, postfix uses port 587 by default :) [14:46] Did I say it was? [14:46] as if spf or dkim help :) [14:46] * soren scrolls up [14:46] Nope. [14:46] O_O patdk-lap then what is port 25 used for [14:46] server to server [14:46] patdk-wk: Stop talking nonsense [14:47] You're talking RFC's, not use. [14:47] port 25 is used for delivering email from server to server, as well as from client to server. [14:47] heh? it's been that way on my servers for >10years [14:47] no user can use port 25 [14:47] Jeeves_: well im having an issue though [14:47] patdk-wk: Than you're quite special :) [14:47] I don't allow use logins to port 25 and reject relay [14:47] its probably a thunderbird bug [14:47] user [14:48] thing is with squirrelmail things work fine with port 25 [14:48] That's just silly. [14:49] squirrelmail is on the postfix box though isn't it? and thunderbird isn't? [14:49] patdk-wk: ya thats right [14:49] thign is im on the same network as the postfix box [14:49] ya, so completely unrelated [14:49] eagles0513875: If i see the message above, thunderbird is not going to use tls because the server isn't saying it supports is [14:49] same subnet and everything [14:49] Jeeves_: ? [14:49] Jeeves_: whats funny is it was working just fine earlier this afternoon [14:49] let me try again on my mac [14:49] 14:51 < eagles0513875> An error occurred sending mail: Unable to establish a secure link with SMTP server eagleeyet.net using STARTTLS since it doesn't advertise that feature. Switch off STARTTLS for that server or contact your service provider. [14:50] That's where you client is connecting to port 25 (or 587 for that matter) and checking if postfix responds to EHLO with STARTTLS [14:50] It seems like postfix isn't doing that [14:51] so try and pastebin this: [14:51] Jeeves_: mac laptop is working fine :( [14:51] open a terminal [14:51] bah i swear this desktop is starting to frustrate me [14:51] let me test one other thing [14:51] type 'telnet 25' [14:51] type EHLO . [14:51] type quit [14:52] and pastebin the output [14:52] Jeeves_: i have isolated the problem to this pc [14:52] eagles0513875: Ok, nevermind than. Have fun [14:53] Jeeves_: ha thats what i get for trying to run windows lol [14:53] i thought it was a problem with the email server at first [14:54] anti-virus doing a smtp redirect? killing ssl support :) [14:54] patdk-wk: nope [14:54] Hi everyone, I'd like to report a problem with either ubuntu-server 10.04 installer or documentation regarding option "Minimal virtual system". [14:55] someone from the dev team is around? [14:58] mterron: just post your problem and someone will answer if they know the answer [14:59] I know eagles051387, I've already fixed it, but i'd like to report it to someone on the dev team [15:02] mterron: report any bugs on http://launchpad.net [15:02] ok, thanks a lot eagles0513875 [15:03] no problemo m8 :) === SquishyNotHere is now known as squishy [15:21] soren: looking at lp:vmbuilder - do i understand right that you just take the bzr tree, drop in the debian/ dir, and call that the package? Or is there some other process to it? [15:23] hallyn_: Honestly, I don't remember. There may be a packaging branch somewhere. [15:23] hallyn_: Let me look real quick. [15:25] soren: I do see lp:ubuntu/natty/vm-builder as well [15:28] hallyn_: That happens automatically. [15:28] hallyn_: All packages have that. [15:28] i see [15:28] Except the few that fail to get imported, but generally they are there for all packages. [15:28] hallyn_: mvo has been working a bit on vmbuilder recently. [15:28] hallyn_: He also did an upload. You could ask him? [15:29] soren: will do, thanks [15:29] Sure. [15:33] Hello all [15:34] What happens when u create a new key if one is already in place? Will it replace the current key? [15:37] Anyone? Lol... [15:47] New bug: #689715 in dhcp3 (universe) "package dhcp3-server 3.1.3-2ubuntu3 failed to install/upgrade:" [Undecided,New] https://launchpad.net/bugs/689715 [15:48] :( [15:57] Goooood morning all [16:04] Daviey: ping === Mr_mist is now known as mrmist [16:22] SpamapS: ping lemme know when you are around === Mr_mist is now known as mrmist [16:26] zul: pingalingadingdong [16:26]