[00:05] upstart, by design, fires everything up simultaneously as soon as it can, unless configured dependencies preclude it [00:05] so if you depend on something having already been done, you need to configure that in your script [00:07] samuelkadolph: startup is emitted at the very very very beginning of pid 1's existence [00:07] samuelkadolph: you need to 'start on filesystem' .. not startup [00:11] That fixed it, thanks qman__ and SpamapS. I am curious about why trying to redirect the io breaks it but not launching the server itself. [00:17] hello everyone, my box has many domains and subdomains on it, I have jenkins running on port 8081. I want jenkins to be accessible only using jenkins.domain.com so that I can set up authentication on this subdomain. I am using apache proxy module for this. now I want to disable accessing it using any other domain by using 8081 port. how can I do this? [00:19] If you are using ProxyPass then just block 8081 with your firewall or bind jenkins to 127.0.0.1 so only apache can access it [00:20] how can I do any of these? I tried many things but still failing [00:21] Stop unblocking the port with your firewall and if you don't have a firewall, get one. [00:24] I prefer the second solution [00:24] when I bound jenkins to 127.0.0.1, it became not-accessible even from apache [00:25] Then you are using the wrong url [00:25] If it's http://localhost:8081/ change it to http://127.0.0.1:8081/ [00:26] this isn't what I want to do. I want it to be accessible only by using subdomain.domain1.com and not by anything else like domain2.com:8081 [00:28] Then you have to block external access to 8081 and ProxyPass to localhost:8081 from that domain only [00:31] in my virtual host file of subdomain.domain1.com, I have PassProxy / http://127.0.0.1:8081, and jenkins is bound to 127.0.0.1. now, I see a blank page when requesting subdomain.domain1.com [00:31] the good news is domain2.com:8081 is giving nothing [00:31] Having a trailing slash with ProxyPass is very important [00:33] I have it on file, sorry for forgetting it here [00:36] What does the error_log say? === medberry is now known as med_out === kentb is now known as kentb-out === Refael is now known as FernandoTertiary === RudyValencia- is now known as RudyValencia [03:59] Is it possible to have mlocate scan the local filesystems daily, but only scan remote (i.e. NFS) filesystems on a Sunday, when the bandwidth spike won't be noticed? === cerber0s is now known as cerberos [05:57] i was unable to configure my dchp during the install as i was offline. how can i do that now that i am connected? [06:14] hi === cerber0s is now known as cerberos === smb` is now known as smb [08:20] hi guys . i have a dual nic system .. one nic is connected to a network with multiple vlans, and other nic is the internet connection .. when the request comes without vlan then it gets to intenret fine, but requests from vlan are not working on most sites.. [08:21] i believe most sites are not responding to requests with vlan id .. so we need to strip it for requests going out to internet .. how do i do that ? [08:25] where do i set vlan=no for internet connection ? [08:55] c [09:16] New bug: #816313 in openssh (main) ""ssh -b x.x.x.x" or "ssh -o BindAddress=x.x.x.x" does not work." [Undecided,New] https://launchpad.net/bugs/816313 [09:30] * twb bets triangle routing [09:30] Oh, or he's just not untagging correctly.. [10:49] hi, just wondering if anybody has used iRedMail? have any opinions on it ? [10:53] as i am struggling to setup mailserver a little, i mean its running fine but i want virtual users etc [11:12] anyone around that can help with taking a server snapshot ? [11:39] tixo5: what do you mean by that? [11:40] like some shared hosting providers, allow a server snapshot, like a full image of the server [11:40] im setting up a VPS for first time, and would like to do something similar [11:40] possible to take a full image via shell ? [11:46] I am going to install a minimal x server with fluxbox on my server - is there any way i can prevent apt-get from pulling all the xorg-drivers except the one i really need (intel)? Is that even benefitial in order to keep thinks as light as possible or should i just do the old sudo apt-get install xserver-xorg xserver-xorg-core fluxbox [11:50] zul, Whenever you get online, could you ping me? [11:51] smb: ping i saw the depwait for ipxe i just added it to the seeds [11:52] zul, Ah ok, then that get sorted already. The other thing I wanted to chat about is your thoughts on the grub config idea [11:52] smb: sure [11:53] smb: what was the idea again [11:53] whats the best packaged backup solution for ubuntu ? [11:53] Well basically to have two distinct sets of command line arguments for dom0 kernels and "normal" kernels [11:54] an not the same being used for both as currently [11:54] ok.. [11:54] At least I (not sure that is common though) have the problem of using two different console definitions for both [11:55] When I start a normal kernels console=ttyS1 and for xen dom0 its console=hvc0 [11:55] oh this is the serial console stuff? [11:55] right [11:56] right [11:56] yeah im all for it, if you can give me a debdiff for it :) [11:56] zul, That should be possible. :-P [11:57] Have not prepared one yet. But basically running it in locally modified environment [11:58] smb: sweet....go for it then [12:16] best backup solution for ubuntu server? [12:17] rsnapshot? [12:18] http://duplicity.nongnu.org/ [12:23] ok thanks ill take a look [12:24] beta software? [12:25] ideally i would like to take the backup via SSH to my local machine [12:25] they have a stable release [12:26] and it supports ssh, ftp, DAV, etc [12:26] ok [12:26] tixo5: you want a snapshot of the vps? [12:26] you can also use it with duply http://duply.net/ which is a console frontend [12:26] yes basically [12:27] you could just use lvm snapshots or depending on the vps technology you use vzdump/vzsnapshot for example if it is openvz [12:27] before i wipe it and start again, incase i mess up etc [12:27] yes its openvz [12:27] doesnt my provider need to support that ? [12:27] my router says Primary DNS Server 119.159.255.37 Secondary DNS Server 203.99.163.240 , how can i know which public dns the ip refers, whats the name of that dns 2. how can i make my own dns and get the list of all the websites of the world? [12:27] tixo5: .. I thought you were the provider [12:27] jane-: #dns [12:28] jane-: A list of all the websites in the world? [12:28] no alamar i have a VPS container, i have setup everything else myself [12:28] but being the first time i am worried i have done a few things a little messy, so want to start from scratch [12:29] i am unable to take a snapshot or use the snapshot without my provider supporting that right ? [12:32] jpds yes. webs and ips, thats what dns do. [12:32] jane-: Why would you want that? [12:32] JanC: [12:32] ermm [12:32] i want to make my own dns [12:32] jane, you need BIND DNS running [12:32] with a master zone [12:32] jane-: whois 119.159.255.37 for ex. ? [12:33] then add A records and such [12:33] jane-: But you want your own DNS records for every website in the world? [12:34] jpds yes. [12:34] what are you on about [12:34] lol [12:36] that's "you're crazy" territory. usually for sites you don't handle, your dns server would query upstream & cache. trying to take a snapshot of every site in existance would be exceptionally difficult (even if you're google) [12:37] WinstonSmith: that duplicity is meant to backup local systems to another server? [12:37] how public dns work then. they have a list. dont they? [12:38] not sure if im right, but all zones are hosted by many servers all over the work [12:38] so com will be hosted [12:38] jane-: No, they query other DNS servers. [12:38] tixo5: not the whole system ( well not partitions) only files. and it can backup locally or remotely (ssh, ftp, dav, etc) [12:38] then the (.) [12:39] WinstonSmith: i sort of want to take a snapshot, is this impossible without support from the VPS provider? [12:39] tixo5: can't help you there, never used VPS. [12:39] jane-: They don't have their own copies for every DNS record in existance. [12:40] jpds then who does [12:40] jane-: Noone. [12:40] Daviey: ack a sync for me? (https://bugs.launchpad.net/ubuntu/+source/tomcat7/+bug/816393) [12:40] Launchpad bug 816393 in tomcat7 "Sync tomcat7 7.0.19-1 (universe) from Debian unstable (main)" [Wishlist,New] [12:41] if my router states pri dns and sec dns. that means it goes to that ip and fetchs ips of websites according to their names.... doesnt it ? [12:41] jane-: Yes. [12:41] Hi [12:41] jane-: And those DNS servers, will forward requests they don't know the answers to, to other DNS servers. [12:42] ya [12:42] each zone jane- is hosted by another server [12:42] (www)(.)(domain)(.)(com) [12:42] not always but u get the idea [12:42] jpds ok. and those others dns servers can be any in world.. ? isnt there a main one dns serveR that has all ? [12:43] jane-: No, they send DNS requests down the chain. [12:43] jpds how many are there any way. any gues? [12:43] jane-: . nameservers, go to .com nameservers, which go down to ubuntu.com nameservers, etc. [12:43] Hi, I have a server which is shared between me and others, (my server), I allow them http://mydomain/theirsite, but how can I stop the users from looking at eachothers files, uploading a php directory listings allows access to others files /site1/ /site2/ etc. [12:44] jane-: What exactly are you trying to accomplish? [12:44] GreenDance: are you using virtualhosts? [12:44] tixo5 yes [12:45] each user is a unix system user? [12:45] or all the same user [12:45] as thats probably your issue [12:45] jpds just studing, and may be ill make my own dns [12:45] small one [12:45] tixo5, same users [12:46] are they all legitimate dns servers, and what if i want to make my own, bind dns resolver ? ill need a list of ip names and corresponding names , how can i get it ? [12:46] tixo5, same user* [12:46] jpds ^ [12:46] apache:apache [12:46] i think [12:47] tixo5: if I create a unique linux user for each person, would that work? [12:47] well if you want different permissions i would use different users per/site [12:47] yes, there is probaably other ways [12:47] you could create virtual users using a mysql backend [12:47] really? [12:47] :o [12:47] :D [12:48] well my mailserver's users are stored in a database [12:48] so i dont see why not [12:48] jane-: Install bind9 on a machine somewhere? [12:49] jpds that was my original reply [12:49] jane-: https://help.ubuntu.com/10.04/serverguide/C/dns.html [12:49] jane-: #dns will me more help [12:50] hm [12:51] jane-, i am running BIND on my server [12:51] i host my own DNS records [12:51] somebody else hosts the (.) and (com) [12:52] you may need your domain registrar to add a 'glue record' to the (.) [12:52] Hey guys! Maybe somebody in here can help me with this: When logging in to my ubuntu server, the appearing statistics summary page shows the /home directory instead of the root directory... unfortunately I have no clue how to change that... does anyone know where I can do that? [12:53] tixo5 is it possible to make a new domain , e.g not .com but .moc ? [12:54] no [12:54] as far as i am aware [12:54] there are 'bodies' that govern things like that [12:54] the internet would become a crazy place is that was possible [12:55] ICANN has allowed generic TLDs to be registered, but it costs a prohibitive amount of money to do so. [12:55] money is the solution to most things, in this context ill stick with it not being possible [12:55] tixo5 if i make a list of .moc and supose some people make my server as their pri dns. then they can see a different google.moc ? [12:56] again jane, for 5th time your better off asking in #dns [12:56] k [12:56] nobody knows where to change the information on the login summary page? [13:06] lynxman, around ? [13:15] guys, how to add a system user on command line? [13:15] Kurisutian, you want to change th motd that displays on login? [13:17] adac: man adduser [13:17] adac: Correction: man useradd [13:18] both should work [13:36] New bug: #816414 in nut (main) "[MIR] nut (nut-doc, nut-client, nut-server)" [Undecided,New] https://launchpad.net/bugs/816414 [13:43] smoser: here [13:43] rsync'ing / root is a bad idea? [13:45] lynxman, i put one question in the merge proposal, but then i had some others. [13:45] smoser: shoot [13:45] tixo5: it normally is [13:46] tixo5, rsyncing it to another system, or carefully to another drive will work, though capturing the state of a live filesystem is less than ideal. [13:46] lynxman, i had intended that "include_once" would be really just "download_once" [13:46] i was trying to backup to my local machine over ssh but obviously cant use root as ive disabled login, so need to setup the daemon [13:46] but you implemented as "include_once". [13:46] is there any other better backup solutions to images the partition of my VPS [13:46] guess that impossible [13:47] smoser: it is download once as far as I see it [13:47] smoser: yeah, wasn't that what we agreed the naming convention would be? :) [13:47] tixo5, rsync is probably reasonable. you *can* still use rsync as root. [13:47] smoser: wait what.. you are advocating using rsync as root? [13:48] can from the system [13:48] but not remotely [13:48] in order to read files that are root-protected that is generally required. [13:48] i was looking more for a VPS snapshot [13:48] this cant be done from within the system right ? [13:49] tixo5, you can do it, you just have to have rsync client tell the server to use a different "rsync client" [13:49] see man page [13:49] --rsync-path=/home/smoser/my-rsync [13:49] rsync is totally different to snapshot though [13:49] where my-rsync has something like: exec sudo rsync "$@" [13:49] i want an image of my VPS ideally [13:49] smoser: i think we need a rsync-rootwrap. [13:49] we do indeed. [13:50] we need more setuid executables i think [13:50] lynxman, hold on [13:50] smoser: holding on :) [13:50] smoser: if i rsync'ed /, installed fresh OS and restored [13:50] everything wouldnt work right ? [13:51] tixo5, well, probably would. or very close. [13:51] but i would be surprised if there werent some issues. [13:52] so, i am looking for a solution like VPS snapshot [13:52] or at least would not be surprised if there were some issues [13:52] is that impossible without admining the dedicated server my VPS is on ? [13:52] tixo5, you'd run into the same sets of issues (at least some of them) with block level [13:52] some would be different [13:53] you need to sync the filesystem to the block device (fs_freeze) before you snapshot [13:53] most VPS providers alllow snapshot images to be created, and restored [13:53] but then, you still get a "live" filesystem. [13:53] hmm [13:53] when you start form that live filesystem, at very least that volume will be dirty and need fsck (maybe fs_freeze woudl handle that... id don't know) [13:53] its the same as if you lost power [13:53] which *normally* is fine [13:54] so your basically saying theres not much different between using rsync, and a VPs providers snapshot of the system [13:55] wish my provider allowed for offsite images to be taken [13:55] dont see why that would be so difficult [13:55] lynxman, if os.path.isfile(includeonce_filename): continue [13:55] thanks for help anyway [13:56] block level snapshots are more complete than filesytem level [13:56] more complete == safer [13:56] and its impossible for me to do that from my VPS? [13:56] for instance, some things that rsync would not pick up are your filesystem UUID or LABEL [13:56] which may exist in /boot/grub/grub.cfg [13:56] if not restored, your system might not reboot. [13:57] leaving it pretty painful to backup/restore [13:58] smoser: that's what I do, I just name it a bit differently [13:58] block level is going to be safer. filesystem level is going to be smaller. [13:58] neither are perfect. [13:58] perfect is shutdown, snapshot, start [13:58] i can do block level? [13:58] (imo) [13:58] well, you can... [13:59] shutdown, snapshot is what i want to do [13:59] dd if=/dev/sda of=- | ssh system 'dd > disk.img' [13:59] but i have not got those features in my client panel so i cant do it right? [13:59] i'm really not very familiar witih vps's, but it sounds reasonable that they do not hvae block level snapshots exposed to you. [14:00] most do, but mine is cheap :) [14:02] lynxman, ^ [14:07] smoser: replied to you in the middle of the rsync thread :D [14:08] lynxman, right. you 'continue' [14:08] so you never process that include again [14:09] smoser: hence include-once [14:09] right. [14:09] i would have preferred "download-once" [14:09] to suffice for the one time url [14:09] i dont see a real-need for process-once [14:09] as most things are 'per-instance' anyway [14:09] (ie, your mcollective stuff is per-instance) [14:09] smoser: for certs for example makes sense, that's what I had in mind [14:10] why does it make sense? [14:10] you have other controls over whether or not to act on the data more than once. [14:10] i think the data should be present to cloud-init so it *could* act on it [14:10] if it was a module or soemthing that should be acted on every time [14:10] smoser: hm okay let me paint you an scenario [14:11] smoser: you get temporary certs, which mcollective uses to connect to a provisioning collective, then it gets fed new certs for the "global" collective once its authenticated and properly provisioned [14:11] smoser: that is actually the scenario I had in mind, in this scenario I just need these certificates once, and that data should not be acted upon ever again, if so it'll reset the machine status [14:15] lynxman, thats fine [14:15] that situation works fine [14:15] you can process that hunk multiple times [14:15] because mcollective module only runs per_instance [14:15] which means once (the first boot) [14:15] no side effects will occur the second time [14:17] zul: ping...I got 10 pandaboards...how many you need for OpenStack on ARM testing :P [14:17] robbiew: one would be good [14:19] * RoAkSoAx would like one if there's one to spare :) [14:19] zul [14:19] cool [14:19] RoAkSoAx: yeah...I think I can swing that [14:19] lynxman, i have this suggested change: http://paste.ubuntu.com/652442/ [14:19] robbiew: cool thanks ;) [14:20] zul: so is it possible to have OpenStack installed across multiple pandaboards...with only LXC [14:20] i.e. multiple compute nodes [14:20] robbiew: it should be able...maybe two then [14:20] zul: ;) [14:21] smoser: well if you wish that feature instead of mine, sounds good :) [14:21] robbiew: can I have one? I promise to feed it nicely [14:21] i think its generally a superset of function [14:21] robbiew: :D [14:21] smoser: fair enough :) [14:21] the other question i had, lynxman [14:22] the private key should be 0600 right? [14:22] smoser: hm I think so, wasn't sure so I didn't implement it yet [14:22] smoser: wanted to test it first once merged and then make the change if needed [14:22] smoser: but it makes sense [14:23] lynxman, you know, you are allowed to test things *before* i merge them [14:24] its even generally smiled apon [14:24] smoser: lol ;) I normally do [14:24] smoser: this one is highly experimental though [14:25] lynxman, [14:25] well, can yo udo 2 things for me [14:25] i will push a brnach with some changes to your code [14:25] can you build it and test it? [14:26] lynxman, lp:~smoser/cloud-init/include_once_and_mc_cert [14:26] smoser: will give it a shoot [14:27] RoAkSoAx: hey...interested in getting cobbler to work with ARM images? [14:29] robbiew: though that zul already had that working.. [14:29] zul: ^^ [14:29] RoAkSoAx: nope [14:30] robbiew: yeah why not [14:30] RoAkSoAx: the ground work is there already just needs to be followed through [14:30] zul: cool ;) [14:31] * smoser re-reads above, and for the 4.23e8'th time he realizes he may have sounded rude. [14:31] sorry, lynxman [14:31] smoser: no worries, really [14:32] RoAkSoAx: cool, thx...then will send you 2 boards ;) [14:32] robbiew: hehe ok ;) [14:33] zul / RoAkSoAx: they need to work with u-boot PXE loader, and be as ready as possible to work with native PXE booting. [14:33] Daviey: agreed [14:33] (might need to use NCommander for support on that) [14:42] oh, NCommander has been package for Ubuntu? [14:42] :-) [14:42] RoAkSoAx: send me an email with your mailing address and phone, and I'll handle the rest [14:42] smoser: interested in a panda board? [14:42] * NCommander apt-get instakk's himself [14:43] heh. BTW, NCommander, thank you for rooting my android, works perfectly :-) [14:43] robbiew: will do [14:44] RoAkSoAx, i'm not un-interested. [14:44] i would plug one in and give it a try. [14:44] smoser: cool [14:45] smoser: can you shoot me an email with your address and phone...I can take care of the rest [14:45] * robbiew notes he should have this...but won't "go there" [15:07] The heartbeat + pacemaker in ubuntu-server 10.04.. is this a long-term cluster plan for ubuntu or are they moving elsewhere? [15:09] utlemming, https://gist.github.com/1100458 [15:10] smoser: nice :) [15:18] kirkland, hey ... i have an external usb drive on a server that i'd like to be a luks encrypted volume, got any experience of monting those during boot ? and i'd like to have it === med_out is now known as medberry [15:24] apw: I don't, but kees does [15:24] apw: kees uses a usb drive just like that [15:37] Kind attention please , im getting shell booters and host booters hitting my server , how can i trace whos doing it and how can i stop them [15:38] and is their some kind of special support for such problems , that im willing to be greatful in paying the sum of hes help knowledge === andreas__ is now known as ahasenack [15:44] lsheeba: what are shell and host booters? [15:44] It consists of some php flooding shells and a gui. [15:44] the gui pings the shells and gives them a command to flood a certain IP [15:44] since the shells can be on servers with high bandwidth connections, it can be a powerful flooding method. [15:45] it hurts my servers badly , all of my local network cant ping the server then [15:45] er...turn it off then? [15:45] so block their ips and try to get upstream to nullroute them [15:45] their offline [15:45] im on my personal pc running ubuntu 11.04 desktop [15:45] Howdy folks, Ubuntu cloud days (day-2) starting in #ubuntu-classroom on the hour .. see you there [15:45] ive blocked all oversea's ip's and allowed local ip's only and still how do they get access ? [15:45] (and in addition contact the hoster's abuse department of the infected servers) [15:46] im running a small GSP [15:46] with a static ip that i have purchased [15:47] booters [15:47] arent meant not to be tracked [15:47] they use shells hosted on other servers that have been hacked [15:47] * tixo5 shows his blackhat side :( [15:47] cyber crime department didnt help much , well didnt help at all [15:48] i gave you your answer [15:48] any solution? [15:48] tixo5, [15:48] a WAF? [15:48] or ddos module for apache [15:48] Hello, is anyone here familiar with mdadm raid arrays? I just got the mdadm alert email saying a drive was removed from the array. It is now marked as faulty. I was curious if there is any way to see a log of when/where/how this happened? [15:49] do u know of any specialized guru who will accept a payment to perform our security liabilities for this GSP , personal-aid not an organizational request because then we couldve gone for expensive firewall hardwares [15:50] Further, I am curious if anyone can help with replacing the failed drive with a new drive. The new drive will be a new model and likely new make. Which specs are necessary to be consistent among hard drives across mdadm raid arrays? [15:50] i do penetration testing, securing servers it not my area, although i know a decent amount [15:50] i have work shortly but i will add you incase i can help [15:50] Thanks a bunch [15:50] thisismygame: one thing at a time. Review the system logs at the time of the alert [15:51] lsheeba: Rate-limit network traffic on a per-IP basis? [15:51] i theory the problem of other gsp's here attacking me because of my price range in cost per slot [15:52] jpds, ive tried that , and it puts pressure in hogging the router's cpu " 100% " [15:53] StevenR: I just looked at dmesg and /var/log/messages. dmesg has nothing related, and /var/log/messages, is, from what I can tell, empty. :o [15:53] thisismygame: /var/log/syslog [16:00] tixo5: what do you use? openvas? [16:00] for pentests? [16:00] yep [16:00] many many many tools [16:01] i specialise in web app security [16:01] ok [16:01] trying to go for a niche :) [16:01] any tool in particular? [16:01] not being a large company i cant afford the larger tools like webinspect [16:01] * RoyK has a scan running with openvas against his office computers [16:02] openvas and such are only good for finding outdated packages rly, [16:02] thats all it really does [16:02] compares versions [16:02] I know [16:02] that's why I wondered about other tools, specifically for probing webapps [16:03] webapps, opensource like w3af [16:03] not a bad framework, quite buggy atm though [16:03] k [16:03] Daviey: ping [16:03] there is a distro called 'Samurai' that has some really nice tools, just waiting on their 11.04 ubuntu update, as jaunty is pain for me [16:03] Daviey: /win 22 [16:03] argh [16:04] how can i merge 2 folders in ubuntu? [16:05] tiphares: rsync? [16:05] or what do you mean 'merge'? [16:05] RoAkSoAx: o/ [16:05] unison perhaps [16:05] Daviey: i'll ping you again after the meeting ;) [16:06] i have 2 folders, 1 contains a,b,d, folder 2 contains b,c,d, and i want to marge them into ONE folder, containing a,b,c,d [16:06] RoAkSoAx: cool [16:07] tiphares: rsync -avP folder1/ folder2/ newfolder [16:07] iirc [16:07] tiphares: that won't help you with collisions, though, the data from folder2 will overwrite whatever came from folder1 (or was it the other way around?) [16:08] doesn't matter which ones overwrite the other [16:08] StevenR: oh, they moved it. yea this has some relevant info. Buffer I/O error, dev sda, sector 0 [16:08] as they both contain some of the identical files [16:08] why cant you just copy [16:08]