=== Guest83192 is now known as nandemonai === erichammond1 is now known as erichammond === erichammond1 is now known as erichammond [01:00] cab somebody give me some idea why Ubuntu uses ufw rather than iptables? [01:07] johna: It uses both, ufw is a simpler front end for iptables. [01:09] jmarden: simpler? [01:09] that shuld have been jmarsden, sorry [01:10] where does ubuntu hid the iptables config and input? [01:11] /etc/ufw is one place where you will see some of it. [01:12] If you don't want to use ufw, no one forces you to do so. You can use naked iptables on Ubuntu just fine. [01:13] You'll lose some of the integration of packages that automatically configure ufw, etc. but it can be done. [01:15] jmarsden: I am switching from Centos. I cannot see an advantage to ufw as it seems to make simple things very complicated. what would I be losing if I dropped It? [01:15] How complicated is ufw allow 22/tcp ? [01:15] Seems pretty simple to me :) [01:16] Some packages can automatically configure ufw to allw access to tehir daemons etc... [01:16] You will lose that if you manually set up iptables. [01:16] It is usually better to learn the new way when you enter a new world... but it is your choice. [01:17] i took a look at the ufw config files and there seem to be chains all over the place, I would think that would make debuggiing more time consuming? [01:17] johna: For normal use, debug at the ufw level. Why are you trying to dive in so deep? What weird tricky things that ufw cannot do are you needing to accomplish? [01:21] jmasden: dovecot has all 4 ports open, I restrict to imaps. Plus I like to know whats going on on the systems I administer [01:33] Does anyone in here use Ubuntu Server? [01:33] Ha. I meant, "Does anyone in here use CloudInit?" [01:34] I am trying to generate multi-part MIME for it's user data, but it's not working. [01:42] johna: I suggest you read 'man ufw' and 'man ufw-framework' [01:43] johna: if you choose not to use it either leave it disabled or uninstall it [01:57] Ubnutu 10.04 - Dovecot/Postfix SMTPd Issue - Auth - Getthing this error message when someone tries to auth to the smtp server to send a email SASL CRAM-MD5 authentication failed: Invalid authentication mechanism [01:58] well, fix it :) [01:58] you oviously didn't store your passwords in plaintext [01:59] no, my dovecot passwd is all in cram-md5 [01:59] and imap logins work [01:59] hmm? [01:59] here is my dovecot.conf : http://pastebin.com/wWbhXaM2 postfix master.cf http://pastebin.com/kvm7Jx2m [01:59] I don't exactly know how you can store a password as cram-md5, cause it's not possible [02:00] i did a dovecotpw to make them [02:00] well, what format did it make? [02:01] and why do you have two auth sections? [02:01] no wonder [02:01] the config is just total foobar [02:02] the second part of for the SASL for the SMTP server [02:02] ya, and it has no users or passwords in it [02:02] so no wonder nothing can auth [02:02] it wont [02:02] the first section covers that (i think) [02:02] it won't auth cause there is nothing in there to auth against [02:02] no, that is a different section [02:02] sections have nothing to do with each other [02:03] I have seen some complex setups, but never seen more than one auth section before [02:03] as you can have as many user storage methods as you want in one section [02:05] this should work http://pastebin.com/4c9HM9X3 [02:06] you might want to allow the login method [02:06] as that is the only method outlook will use [02:06] >_> [02:07] man this project was harder then it should of been, I dont even have anti-spam in it yet [02:07] hmm? [02:08] normally takes about 4 hours for me to setup an email server [02:08] wow... my normal time for a LAMP stack is 20mins [02:09] just never done it before... bout time i learned [02:09] heh? to install a lamp stack you just click lamp in the installer, done [02:09] email is the most annoying thing ever to setup [02:09] for incoming not too hard [02:09] i have a bash script to add users and remove users from dovecot [02:09] for outgoing, extreemly hard, cause no one else will trust you [02:09] SPF helps [02:09] DKIM also help [02:10] spf and dkim only helps if you make it to the junk folder [02:10] first is using a good ip [02:10] second is setting up dns and rdns correctly [02:10] 3rd is having your mail server id itself correctly [02:11] mine doesnt... atlest i dont think it does [02:11] the rdns is a linode [02:11] and the smtp server says its that host [02:12] so it will probably work on 90% of email servers [02:12] the other 10% needs the rdns to match [02:14] dir === ng_ is now known as zz_ng_ [05:40] hi - situation = Lucid-10.04.3amd64 install .. i have a raid1 ( md0 ) and wish to know if Grub will run from within LVM or do i need a physical /boot partition ? [05:41] * LVM on top of raid1 [05:44] is there a command to update the server's clock using internet time servers? [05:44] mine's off couple of days [05:45] ntpdate ip of time serv [05:45] watchout if your remote as it can screw your sudo timestamp [05:46] oh ok. thanks. what could be the worst that can happen? having to re-authenticate? [05:48] the worst ? dunno - it will require a re-auth tho ... do you have physical access to the machine ? [05:48] yes [05:48] no prob then ... [05:52] worked flawlessly, thanks. [05:53] didn't know there were that many NTP servers. [05:54] did you use your -country.pool.ntp.org ? [05:54] *your-country [05:57] yes [05:59] I have no idea though why my server would think it's Thursday in the first place. [06:01] gotta get back to this install... === photon is now known as Guest83739 [09:55] installing a VMhost do i enable auto security updates ? [10:46] whats the command for the network-config curses gui ? [10:49] or isn't there one ? === zz_ng_ is now known as ng_ === ng_ is now known as zz_ng_ === zz_ng_ is now known as ng_ === ng_ is now known as zz_ng_ === zz_ng_ is now known as ng_ === ng_ is now known as zz_ng_ [13:47] New bug: #815071 in apache2 (main) "package apache2.2-common 2.2.17-1ubuntu1 failed to install/upgrade: installed post-installation script alfolyamat 1 hibakóddal kilépett" [Undecided,New] https://launchpad.net/bugs/815071 === medberry is now known as med_out === zz_ng_ is now known as ng_ === ng_ is now known as zz_ng_ [15:46] <[[suarez]]> buenas === zz_ng_ is now known as ng_ [17:55] Has anyone got sound over hdmi to work in ubuntu server using boxee? === ng_ is now known as zz_ng_ [18:18] Has anyone got sound over hdmi to work in ubuntu server using boxee? [18:34] anyone out there? [18:37] * Datz nods as he can here you [18:37] but no, I haven't done that [18:42] thanks, just seems very quiet here... was starting to wonder if i was on my own [18:43] everyone's at the lunch party, I was full [18:43] :) === zz_ng_ is now known as ng_ === ng_ is now known as zz_ng_ === zz_ng_ is now known as ng_ [20:32] hi all [20:32] i have a little dns related question that maybe someone can help me with [20:32] i have a bind server running on our net that does dns-caching as well as master for local dns [20:33] now i would like to override an external domain to point to a server in our local net [20:33] what would be the smartest way to handle this? [21:22] when i upload files via web interface it is uploading them as user www-data instead of the user name [21:25] what are all you jackasses doing in this channel any way [21:25] few hundred bots? [21:27] goddard: www-data is the user of the apache process, so there is nothing wrong with it [21:28] frogger if your running a multi user enviornment and fastcgi it is suppose to assign to the user [21:28] mod_suexec [21:30] frogger not to menton if you use sftp then try and make any changes you cant [21:31] its idiotic actually to leave it as www-data [21:34] any other idiots wasting space on freenode? [22:10] lots :) [22:11] fyrfaktry you got that right === ng_ is now known as zz_ng_ [22:19] where does ubuntu server keep things like dkim keys, apache ssl keys? [22:20] where-ever? [22:20] normally ssl stuff is in /etc/ssl [22:20] personally I just make /etc/ssl/dkim for well, the ovious [22:21] But it's a function of the where the config file is set to look for them. [22:21] It depends a bit on what implementation you are dealing with. [22:21] patdk-lap: so there is no recommended location for crypto keys? [22:22] heh? didn't I just say /etc/ssl? [22:23] Scottk: it must be configurable for each app? [22:23] It is. [22:23] I'm not saying it must be. [22:23] DKIM is a protocol, not an application. [22:24] patdk-lap: yep, so the "recommended loc is /etc/ssl/..." [22:25] johna: For example, my /etc/opendkim.conf says: KeyFile /etc/dkim/keys/... [22:25] You could put it anywhere. [22:26] ScottK: I just like to keep things neat, and if there were a "prefered" loc use it. [22:27] There isn't. Just in /etc somewhere that makes sense to you. [22:27] when i upload files via web interface it is uploading them as user www-data instead of the user name [22:31] goddard, that is pretty ovious [22:31] the webbrowser runs as www-data [22:31] it shouldn't be allowed to be run as your user [22:31] or to even do that, root [22:31] that would be some serious security issues [22:31] this part makes sense sure [22:32] what if you in a multi-user enviornment [22:32] one that doesn't have the permissions to change www-data [22:32] with a web interface, said environment is handled by said web interface [22:36] as in, the web interface controls user access and file permission separately from the filesystem [22:36] with, say, an SQL database full of users and password hashes [22:36] some systems let you upload components via the web infact it is much easier this way [22:37] if they upload pictures even [22:37] yes, and they work the way I described [22:37] that is not what is in question [22:38] the files on the filesystem are still owned by www-data (or whatever group their system happens to run the web server as) [22:38] because the web server, rightly, does not have the ability to change the owners of files to any given user [22:38] that would be an enormous security risk [22:39] unless the process is apart of a virtual enviornment [22:39] virtual environments don't change this fundamental process [22:40] haha ok i can see we are going to go now where with this so thanks for sharing with me your point of view [22:41] an owned virtual server is no different from an owned bare metal server [22:41] thanks for the information [22:45] just for your own future reference qman__ check this out http://httpd.apache.org/docs/current/mod/mod_suexec.html#suexecusergroup [22:46] in conjunction with fastcgi it all becomes possible [22:46] I never said it was impossible [22:46] just that it was a huge security risk [22:46] which it is [22:46] oh ok ... :D haha [22:47] Care to explain how this setup is a security risk? [22:47] running a given CGI process as a dedicated user separate from the web server user isn't a big risk [22:48] running a given CGI process as many different users, probably specified by the web site code, is an enormous risk [22:49] ok if this is true how? [22:50] because if the web site can run code as any given user, with input generated by the web site, that site has the potential to be exploited to privilege escalation [22:51] i.e. one bad page in your site means root access [22:51] i think you have the process confused a little bit because it is only defined when the apache virtual enviornment is defined [22:52] and it is defined as the user you create [22:52] that user has specific privalges [22:52] yes, but that user must be determined at some point [22:52] i guess they could sudo su [22:52] and if that user is not hard coded in the system, it must be provided by the user [22:52] and any time you process user input you are taking in a risk [22:52] that isn't the way mod_su works [22:52] read the link [22:53] if a virtual user was attemping to hack into root you could find out pretty quickly [22:53] 3 fail attempts and he gets blocked [22:53] no more access [22:54] that's great, until the web site code is exploited, and only one attempt is needed [22:54] id be interested to hear this method but im not seeing what your saying [22:54] I assume that your web site is PHP [22:55] I also assume that your web site was written by a human [22:55] therefore, I can conclude that said website has flaws [22:55] right using fastcgi [22:56] all systems have flaws [22:56] and when you allow such a high risk thing as filesystem access as an arbitrary user with an interface that has a high risk of potential exploits, you are playing a dangerous game [22:56] this is with jailkit? [22:57] jails are great too, but I'm guessing you wouldn't want to lose any of your users' data either [22:58] and that user data must exist inside the jail, otherwise it couldn't be uploaded in the first place [23:00] this is all just to vague