[00:00] lifeless: actually, I got that from Spads, when I asked for the squid config Canonical IS uses at UDS [00:00] oh man [00:00] chinese whispers. [00:00] lifeless: we'd love your input/review on this [00:01] lifeless: this is the squid.conf we're using in the Orchestra server [00:01] kirkland: if you need 1/2 GB of hot objects, you should be doing, I dunno, 100MB sustained traffic ? [00:01] maybe more [00:01] thats per-sec of course [00:01] lifeless: this is the ubuntu network installation server [00:02] lifeless: i'd expect we'd be installing maybe 100+ ubuntu servers simultaneously [00:02] that is unrelated :) [00:02] is ubuntu server slower if I run it with the desktop gui? [00:02] ok [00:02] let me break out the aspects for you [00:02] lifeless: so i figured there'd be a good 500MB of packages required to install each [00:02] on a miss squid: [00:03] - writes the response to disk (without blocking) [00:03] - forwards it to the client [00:03] - if its small enough keeps a copy in memory (it has to do a little, but it can choose to keep a window in memory, or the whole thing) [00:03] the knob to control window-or-whole thing is [00:03] maximum_object_size_in_memory [00:03] with (last I checked) this default: [00:03] # maximum_object_size_in_memory 512 KB [00:04] (because something like 90% of objects on the net are < 512KB) [00:04] on a hit squid: [00:04] lifeless: ah [00:04] - either reads from memory (if it can ,possibly joining onto an existing download that is happening) [00:04] lifeless: okay, that part makes sense [00:04] - or reads from disk *and does NOT* copy it into the in memory buffer [00:05] the second part is considering a minor bug: you cannot seed a hot object by getting cache hits. [00:05] it plays merry hell with really high volume reverse proxies [00:06] ones up in the many-thousand-hits-per-second category. [00:06] so, that 512MB seting you have, by default, will only cache the smallest of debs [00:06] lifeless: heh, okay, thanks for that [00:06] RoAkSoAx: wanna commit that fix too? [00:07] deltree_: it will use up some RAM that could better be used caching data. [00:07] kirkland: yup [00:07] RoAkSoAx: change that back to 512KB? [00:07] and, given we basically depend on the OS cache for most hits anyway, is unlikely to have a significant impact for you. [00:07] kirkland: whoa [00:07] kirkland: you're confused - two related settings [00:07] SpamapS: ok, just making sure [00:07] the cache_mem setting defaults to 256MB. [00:07] kirkland: RoAkSoAx: just delete the setting. [00:07] lifeless: okay, thanks [00:07] kirkland: the *policy* knob for what things can go into that memory cache defaults to 512KB [00:08] lifeless: as for a disk cache, what's your recommendation? [00:08] kirkland: aufs. [00:08] lifeless: size wize [00:08] kirkland: if you want this thing to be snappy, make it 2/3rds your physical RAM [00:08] lifeless: so I remove the cache_mem line and s/ufs/aufs [00:09] kirkland: that will allow space for metadata lots etc and guarantee nothing needs disk UI [00:09] *IO* [00:09] RoAkSoAx: yes please [00:09] kirkland: wouldn't you want the cache size to be "big enough to keep all desired releases on disk" ? [00:09] kirkland: if you want to optimise to avoid network downloads, set it to big enough to .. [00:09] SpamapS: that's what I was thinking [00:09] what SpamapS just said. [00:09] okay, good [00:09] note that you need 14 MB of memory per 1 GB on disk for 64-bit Squid [00:09] http://wiki.squid-cache.org/SquidFaq/SquidMemory [00:10] yeah the goal here is to minimize impact on the wan [00:10] that comes from the OS [00:10] kirkland: i guess we will need to do some debconf stuff to set add the "lan" we will be using automatically as well [00:11] kirkland: the goal would also be to be able to handle 1000 servers installing at one time.. :) [00:11] so, you have what 40GB at the moment? that should be fine. [00:12] SpamapS: thats primarily achieve by a) using aufs and b) having a tonne of memory on the machine. [00:12] SpamapS: enough for socket buffers + os page cache for all the debs being downloaded. [00:13] lifeless: right, we'll recommend that the orchestra server be a fairly beefy machine, and note that the lack thereof will impact provisioning results [00:13] okay, i gotta take a break; been a 12+ hour day [00:13] i'm off for a bit to hang out with the wife [00:13] lifeless: indeed, there's an affect that happens also where they all tend to get to the same spot in the install/download process if you can't fit the whole cache in memory.. [00:13] lifeless: you're awesome, man, thanks so much!!!!! [00:13] lifeless: I had this w/ system imager.. they'd all start a few minutes apart, but end at the same point, because only one window of data would fit in the OS cache. [00:14] kirkland: anytime [00:14] RoAkSoAx: yes, or edit the local_network acl [00:14] SpamapS: yah, memory memory memory :) [00:14] If some got behind, they'd slow the others down.. and eventually they'd all be downloading the same data. [00:14] SpamapS: Back in the bad old days I was workin (shudder) yum [00:14] lifeless: cool! thanks for taking the time to take a look at it ! really appreciate it [00:15] and it was crystal clear whenever something was missing from the cache, all the machines would grind to a goslo [00:15] RoAkSoAx: no worries; feel free to ask anytime [00:15] lifeless: will do, thanks === Brumle__ is now known as Brumle [01:01] New bug: #832447 in amavisd-new (main) "package amavisd-new-postfix 1:2.6.5-0ubuntu2 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1 happens on every update" [Undecided,New] https://launchpad.net/bugs/832447 [01:02] New bug: #362579 in open-vm-tools (multiverse) "Compilation of vmhgfs module fails on amd64" [Undecided,Won't fix] https://launchpad.net/bugs/362579 [01:10] so with a LAMP server, I'm thrilled how it basically works right out of the box. [01:10] I'm confused though, is there a way to allow Ruby Apps to be run, but not the whole server in Ruby (my PHP is not MVC, but my Ruby is) [01:13] soren, i did not really look much, so just didn't see it. that probably is "the right way" to do that. [01:15] i sent it upstream, we'll see what they say there. [01:31] in an attempt to set up rails as an app environment, rather than the whole server, I've been following the instructions here: http://russbrooks.com/2009/5/25/install-ubuntu-9-04-server-edition-rails-php-passenger-postgresql-and-mysql It explains to setup a passenger.load file for apache and aparently I did that wrong based on the errors I'm getting anyone know about this? I tried following... [01:31] ...the instructions on passenger to try to use it as a standalone, but I get the error that the passenger command doesn't exist [02:11] trying to set up rails to run on my ubuntu LAMP server as an app environment, leaving php in tact etc. So far my research has told me to use passenger as a standalone with virtual hosts, but when I install the passenger gem, and try to do as instructed: http://www.modrails.com/documentation/Users%20guide%20Standalone.html I get an error that the passenger command doesn't exist. When I try... [02:11] ...to follow the instructions of someone who's managed to do this before: http://russbrooks.com/2009/5/25/install-ubuntu-9-04-server-edition-rails-php-passenger-postgresql-and-mysql I get other oddities, including the lack of a mod_passenger.so file === ScottK2 is now known as ScottK [03:31] deltree_: did you try asking in a rails channel? They might have better info for you. [03:32] I have [03:32] only one person I've seen so far claims to have set it up, and in their words i had to do major surgery on my gems [03:32] then they left [03:32] ew [03:33] When you wrote your code, what did you use to develop it? [03:36] I haven't built a rails app yet [03:37] Oh, just playing? [03:37] I write mostly in php & asp.net mvc (yes) [03:37] what version of Ubuntu ? [03:37] 10.04 [03:37] I'm doing it all on virtual machines, so when I mess something up, I just start over [03:38] so don't get scared if I do something stupid, I can back it up and try again [03:38] thats a great way to learn [03:38] but please, a little guidance would go a long way [03:38] I'm pretty new to linux too [03:38] I figured out how to give my server a gui [03:38] and that has made things easier for figuring out what I'm doing [03:38] a gui? [03:39] ubuntu desktop [03:39] gnome [03:39] Thats ultimately going to hinder your learning more than you might think. [03:39] Learn to use SSH, learn to *love* SSH [03:39] You can even setup an SSH filesystem between your host OS and your VM so you don't have to log directly into the VM to edit files [03:40] I plan to, but my VM has been awkward with ssh, so I've been using the network and sharing to drop files onto the box [03:40] just while I figure out setup [03:41] Ok. Just a suggestion.. ditch the GUI [03:41] will do [03:41] it wasn't helping anyway [03:41] I spent most of my time in the terminal [03:41] So if you're doing ASP and PHP.. why ruby? [03:41] the reason I liked the gui was 'cause I could just run firefox to see if localhost was working [03:41] like, you're taking on a whole new OS, and a new language, at one time? [03:42] just set the IP of your VM to the same thing all the time.. you don't have to make it dynamic. ;) [03:42] SpamapS: it's a language I don't know, and I really like the language, the "truly OOP" is beautiful in my eyes. It's language #17 for me, so it's really not hard to learn, I just need a place to learn it, and windows doesn't like that idea much [03:43] in addition, I came across an app in Perl, which meant more IIS troubles [03:43] hah [03:43] Ok well Ruby is kind of borked in 10.04 [03:43] 11.10 will have a MUCH better Ruby [03:43] so I decided to take a look at Ubuntu again, after all, I've got 3 linux rigs in the house, but linux is more of a "set it and forget it" os in my eyes [03:44] with a non broken rubygems [03:44] 10.04 is LTS, and since I'm considering moving my server to it, I need the LTS version [03:44] Are you sure? [03:44] no [03:44] actually [03:44] 18 months is a long time for an experimental box [03:45] I have to agree, this is one of the few cases where non-LTS makes more sense [03:45] Which is how long after this coming October 11.10 will receive updates. [03:45] if you were running it in production at a company I'd say yes, but just to develop on, go with the newer one [03:45] plus you'll be one upgrade away from the next LTS, 12.04 (unless we lose our minds and decide not to make it an LTS.. which is about a 1 in 1000000 shot) [03:45] come to think of it, LTS isn't exactly my style anyway [03:46] always new [03:46] anyway, wife is waiting for me.. time to head out [03:46] I'm more likely to automate os upgrades than to use old software [03:47] deltree_: If you're brave.. try out 11.10 beta1, which should arrive next week. [03:47] (I'm not)in any case, is 11.04 going to mean a heck of a lot of difference in Ruby [03:47] deltree_: we will be *forever* indebted to you for any bug reports you might have. :) [03:47] 11.04 is a *little* better [03:47] I would, but I'm clueless with linux anyway [03:47] And you can always update to 11.10 after October and once you feel comfortable. [03:48] I can open up a web browser and gksudo nautilus, that's my latest "whoohooo" [03:48] lol.. scary [03:48] well glad to see you're on the right path. :) [03:48] lol [03:48] good luck w/ rails and ruby.. gone... [03:48] * SpamapS disappears [03:48] so no one has gotten passenger to work in standalone on 10.04? [03:53] if someone can say they have in 11.04 then I have a reason to jump forward now, otherwise, I'll continue experimenting on this one until 11.10 [03:54] weird... one of my users has /usr/sbin not in path. Is that normal for members not in sudo or wheel group? [03:54] /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games === otubo is now known as otubo[AFK] === bkerensa_ is now known as bkerensa|laptop === bkerensa is now known as register === register is now known as bkerensa === bkerensa|laptop is now known as bkerensa_ === SWAT__ is now known as SWAT === smb` is now known as smb === rickspencer3_ is now known as rickspencer3 [08:47] Beta freeze is tomorrow... oh joy. [08:48] DanaG: that happens to me all the goddamn time (lucid) [08:49] DanaG: I assume PATH setting was moved from /etc/profile into PAM, and PAM doesn't trigger when I log in via SSH or something. [08:49] I haven't been annoyed enough to actually track it down. It's probably when you ssh root@foo -t sh or something [09:54] Daviey: the beta freeze will only block new packages from landing the archive right? [09:59] lynxman: No, the beta freeze means the archive is on manual approve. [09:59] so all uploads get wedged [09:59] https://wiki.ubuntu.com/BetaFreeze [09:59] So Now would not be the greatest time to get into packaging? :-P [10:00] Daviey: heh, better get those bugs smashed then [10:05] Hi, I followed the instructions in the InstallCDCustomization wiki page and I got a working installation but I can't log in if I add my custom packages. I know there are issues with casper autologin but this time it's not a livecd. [10:11] ersi: packaging NEW stuff.. no, bad time :)... although NEW packages for Debian still makes sense, that we'll sync in next cycle :) [10:11] ersi: fixing packaging issues, yes still a good time :) [10:25] ;) === himcesjf1 is now known as himcesjf [11:05] #ubuntu-cloud [11:16] * RoyK hands koolhead11 a /j [11:20] RoyK, :) === otubo[AFK] is now known as otubo [11:23] how to install packages from CDrom after installation ? [11:25] some said https://help.ubuntu.com/8.04/add-applications/C/offline.html but how about on the server ?? [11:26] in etc/apt/sources.list , I edited with # on deb http://........ and left only two cdrom lines on top. but still not ok yet [11:27] <_ruben> that oughta work i'd say [11:27] <_ruben> did you run sudo apt-get update after editing sources.list? [11:28] <_ruben> and you did uncomment (iirc it's commented by default) the cdrom lines i guess :) [11:28] http://www.grimrock.net/ [11:28] sry. wrong window [11:29] _ruben: no. I just left only cdrom lines. and rebooted [11:29] ubunteo: Look at apt-cdrom. [11:29] ubunteo: It does what you need. [11:31] soren: do I have to install aptoncd package? [11:31] <_ruben> ubunteo: a reboot wouldn't change a thing ;) [11:31] soren: As I have no internet with my server, how can I do ? [11:32] <_ruben> ubunteo: what happens when you run sudo apt-get update ? [11:32] _ruben: so running sudo apt-get update could help ? [11:32] If you are relying on a CD, you are probably doing it wrong. [11:32] <_ruben> yes, tho it been ages since i used offline media :) [11:32] _ruben: to tell you the truth, I have not run that command as I thought it would only work with internet [11:32] <_ruben> ubunteo: it uses the contents of the sources.list ;) [11:33] Daviey: I don't wish to rely on CDs only but having internet at home is really damn expensive here in my country [11:33] <_ruben> not everything is available on the standard -server install cd tho... [11:34] _ruben: yes. I see. I know I can install mail server and Postgre sql server role from installer CD [11:34] _ruben: we are actively trying to remove stuff from the iso :) [11:34] _ruben: because I left those things during initial installation. but I dont know how to install them after installation . even though I tried tasksel, it didn't read from CD [11:35] <_ruben> ubunteo: after editing the sources.list and running apt-get update, it shoudl [11:35] <_ruben> Daviey: i dont care about that, personally ;) [11:35] _ruben: I want to install mail server using installer server CD. how can I ? that should be done using CD alone without internet [11:35] <_ruben> Daviey: i netinstall my box anyways :) [11:35] ubunteo: No, you use apt-cdrom. [11:36] In a terminal, type: apt-cdrom [11:36] soren: do you mean, apt-get update won't fix ? [11:36] No. [11:36] soren: apt-cdrom is default package like nano installed by default during installation ? [11:36] Just try it. [11:37] It's free. [11:37] soren: I see. but my server is without internet [11:37] Yes? [11:37] Look, it's not that hard. [11:37] Type "apt-cdrom" and hit return. [11:38] It'll take only a fraction of the time we've wasted on this discussion. [11:39] _ruben: good stuff. [11:40] soren: How can I accomplish ? [11:40] First, you open a terminal. [11:40] soren: what do I do next without internet on myserver to install apt-cdrom ? [11:40] Then you hit the key on your keyboard marked with an "A". [11:40] Then you hit the key on your keyboard marked with an "P". [11:40] Need I really go on?= [11:41] It's already installed. [11:41] You would have known this if you'd just bothered to try. It's not that hard. Just type on the keyboard. [11:49] soren: I am on server. no need to open terminal bro. [11:52] soren: I am just confused. one said apt-get update will fix. you said to use apt-cdrom . what do I do ? [11:52] ubunteo: You stop asking questions and try both and see which one works. [11:53] soren: I wish I could but my server is at home. and I am now at work with windows XP. easier said than done [11:53] See, you could have mentioned that. [11:53] soren: according to office policy, only windows XP is allowed at work [11:54] Then you take a piece of paper and write "'apt-get update' or 'apt-cdrom'". Take it home with you. Give them a go and see what happens. [11:54] ubunteo: What are you trying to install anyway? [11:57] _ruben is probably just sensible enough to have evicted the usually completely useless knowledge about how to add a cdrom source after the fact. I, sadly, have not. I'm stuck with this in my brain, taking up valuable space. [11:58] "apt-get update" deals with dynamic sources. cdrom's are not in that category. apt-cdrom fills the gap. [11:58] soren: dear bro, is there any official documenation for apt-doc ? [11:58] apt-doc? [11:59] soren: sorry. apt-cdrom [11:59] There's a man page. [12:00] It's also online. http://manpages.ubuntu.com/manpages/oneiric/man8/apt-cdrom.8.html [12:01] Searching for "apt-cdrom" on your favourite search engine would probably also be helpful. [12:01] If office policy permits. [12:02] soren: thanks. I found. http://manpages.ubuntu.com/manpages.gz/oneiric/man8/apt-cdrom.8.gz file. I think I can download and take it home and install manually with tar - ??? option [12:02] I think my quota for how much time I want to spend on this is up now. [12:02] Read the last 4-5 things I said. [12:03] If that doesn't answer all your questions, there's nothing else I can do. [12:06] soren: I don't bother you , bro. you can ignore my post. there are so many who wants to volunteer in the world. [12:08] I'd tell you to read the lst 8 things I said, but I'm afraid of the goto-loops involved. So I won't. But you should anyway. [12:10] soren: I wish we all wish part of the solution. not part of the arguments or problem that will insult others. so thanks anyway. The reason why newbies come here to seek for help is IRC is quicker than launchpad to get interactive answer. [12:11] soren:The reason why newbies come here to seek for help on IRC is that is quicker than launchpad to get interactive answer. [12:12] soren: have a nice day ! thanks anyway. [12:12] I've told you exactly what to do. Numerous times. I'd count them, but I really can't be bothered. If you won't listen, that's beyond me. [12:13] soren: it is good for you to take it easy to ignore my newbie questions. [12:14] lynxman: What is the status of bug #822142 , the merge proposal you quoted seems dead? [12:14] Launchpad bug 822142 in openvswitch "package openvswitch-controller 1.1.0~pre2.g2.ea763e0e-1ubuntu2 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1" [Medium,In progress] https://launchpad.net/bugs/822142 [12:14] ubunteo: Let me part this conversion with a single word: apt-cdrom [12:14] Have a magnificent day. [12:14] soren: If I were now infront of my ubuntu server, I would just type in quickly rather than asking to make sure not to wait for one more day. [12:14] Daviey: yeah I removed the merge, you told me to integrate from upstream, I'll do that as soon as I'm finished with some Ensemble + Openstack tests I'm doing :) [12:15] Daviey: will be dealt with today [12:16] ubunteo: The real issues was that you asked a question, but didn't make it clear that you were not able to run commands right now. soren was really rather helpful, but frustrated that it seemed you were not /trying/ his suggestions. [12:16] lynxman: rocking! [12:18] ubunteo: You keep doing the same, ignoring people answers and asking new questions, the same happened to me when I tried to help you :) [12:19] Aw. [12:19] ubunteo: even if you think (you're of course entitled to) that our answers might be not useful it's common courtesy to try it anyway, it's better to try and be wrong than just be right on a hunch ;) [12:22] I think something was "lost in translation" in that session unfortunally. [12:23] ersi: Oh, wow. I think he's been here before under a different name. [12:23] * soren tries to remember [12:24] soren: He has been as ubunteo before as well [12:26] lynxman: This was like 4 years ago. [12:26] https://lists.ubuntu.com/archives/ubuntu-server/2007-October/000881.html [12:26] From Myanmar as well. [12:27] rimriaz, I think was his irc nick. [12:27] * soren searches for that. [12:27] soren: wow, classy email :D [12:29] heh, some people we are better without [12:30] <_ruben> wow, nice! [12:32] patdk-wk: I would like everyone to use Ubuntu of course, constructive criticism is always welcome (and I'm the first one to give it), but cursing on a public mailing list is not smooth :) [12:33] I would disagree with that to a point [12:33] everyone has their own tastes, there is no way everyone would be happy using ubuntu [12:33] patdk-wk: yeah it's a wishful thinking isn't it :) [12:33] morning [12:34] Daviey: Thanks for the preseeing tip a while back. [12:34] I just rolled that into production :) [12:34] I went with slackware for a long time, cause I didn't care about security patchs, at home [12:34] but in the workplace, used rhel, and hated everytime I updated it, it wiped my configs, or configs came back I had removed [12:34] haven't had any issues with ubuntu's updates, so I'm happy :) [12:38] patdk-wk: I've used a bit of everything, Slackware back in the time, RHEL, Debian, Ubuntu [12:38] patdk-wk: I'd just like people to find Ubuntu useful of course, and consider it a choice :) [13:01] i have set a static ip in /etc/network/interfaces (i have double checked the file to make sure everything is typed correctly) When i restart networking ifconfig shows that i have the correct static ip that i just set, but after a couple minutes it gives me an ip address from dhcp. any ideas? [13:02] dschuett: Yes. [13:02] die gtk-window-list die! [13:02] dschuett: You've not rebooted. [13:02] hi soren [13:03] dschuett: "ifdown eth0" doesn't remember anything. It looks in /e/n/interfaces to find out how eth0 was configured. [13:03] dschuett: ...so you had it configured via dhcp, changed the config, ifdown'ed and ifup'ed. The ifdown didn't know that it had been configured by dhcp, so it didn't kill the dhcp client. [13:04] soren: I have rebooted twice [13:04] dschuett: ifup just set the ip, and once your dhcp lease expired, the dhcp client (which hasn't been killed yet) clobbered the config. [13:04] dschuett: WEll, the dhcp client didn't start itself, that's for sure. [13:05] dschuett: Pastebin your /etc/network/interfaces. [13:34] nigelb: ahh, yes.. was wondering what you were talking about :) [13:34] Daviey: hehe :) [13:34] I have to bite the bullent and learn puppet for the long run though. === [1]MarcelT3 is now known as MarcelT3 [13:52] <_ruben> aww .. collectd's cpu plugin only does jiffies and doesn't attempt to turn it into percentages or anything :/ [14:01] Hello people [14:01] !hi | openeye [14:02] ehh ubottu fail [14:02] anyways, greetings [14:02] Hallo Theevilone! Can someone help me out for a second, i need to find smtpd_recipient_restrictions in the postfix master.cf? [14:03] it is not there [14:05] openeye: it should be in main.cf not master.cf as far as I can recall [14:06] indeed [14:06] indeed [14:06] that is the place where i am now [14:07] if it is not there, i can just add it? [14:07] New bug: #828424 in samba (main) "package samba 2:3.5.8~dfsg-1ubuntu2.3 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1" [Undecided,New] https://launchpad.net/bugs/828424 [14:08] openeye: hm, unless you know why and what you're doing I wouldn't, master.cf is normally just reserved for defining new subprocesses from the postfix parent process [14:08] i need to add spf [14:08] check_policy_service unix:private/policy-spf [14:08] openeye: that should go in main.cf I reckon [14:09] that is where i am [14:09] openeye: then add it there :o) [14:09] well depends [14:10] you add it to master.cf if your doing something like, overriding the defaults for the submission service [14:10] but spf would be on the main port, not an override, so main.cf [14:10] ok perfect thank you! [14:10] patdk-wk: that's why I was suggesting main.cf as well [14:11] but why, is also important, or they will just ask again :) [14:11] Thank you all [14:12] patdk-wk: indeed [14:15] zul, could you take a quick look at https://code.launchpad.net/~ephess/ubuntu/lucid/php5/fix-for-651049/+merge/71112 [14:15] php whats that? ;) [14:17] It's those funny guys who likes to get the same salt for every hash [14:17] smoser: commented as well [14:18] morning guys, trying to set up daemontools but somehow I do not see an init script for svscan and when I do ps -aux | grep supervise I see the following error: http://pastebin.com/Tc5Ns4GY [14:18] could / would you consider sponsering that ? [14:18] if I do svstat /etc/service/dstpd I see it up and running [14:18] can anyone shed some light? [14:18] smoser: yeah once the changelog is fixed [14:18] hi [14:19] Hi again [14:19] hi all , we have ISP that offer us to use proxy address to use web [14:20] how can we configure that ISP connection on squid to share this connection to all clients ? [14:24] how to install deb file package on server ? === zyga is now known as zyga-afk === giovani_ is now known as giovani [14:29] hi [14:30] anyone know how to drop all outgoing ssh traffic regardless of port using iptables? meaning the default 22 or some other random high port? [14:31] moonpup: that would require deep packet inspection [14:31] lynxman: that's what i thought... [14:31] moonpup: Don't think iptables can do it unless you can specify using the type module [14:32] moonpup: but that just cover some pretty basic scenarios [14:32] lynxman: what about tcpwrappers? [14:32] * lynxman has a look.. [14:33] moonpup: tcp wrappers will just affect how your sshd daemon accepts connections [14:33] moonpup: was having a look to see if there's some magical iptables modules :) [14:34] lynxman: hmmm... thanks for checking. I'll keep digging [14:34] ooh look at his [14:34] moonpup: http://l7-filter.sourceforge.net/ [14:34] there was a magical module :D [14:34] well can't you use a combination of conntrack and OUTPUT filters? [14:35] TheEvilPhoenix: if it uses non standard ports nope [14:35] TheEvilPhoenix: that'd solve it for port 22 [14:35] lynxman: i've heard of that before... need to read up on it again... thanks [14:35] -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT [14:35] TheEvilPhoenix: but if they use port 10022 that's another issue [14:35] -p tcp --dport -j DROP [14:35] lynxman: two rules [14:35] oine to allow established and its related in any port, the other to block all other traffic on said port [14:35] or in this case it might be --sport [14:35] TheEvilPhoenix: that's way too broad [14:35] or w/e it is [14:36] havent dug into iptables output yet :P [14:36] s/yet/much/ [14:36] TheEvilPhoenix: I wouldn't feel comfortable using such a rule myself, you'd block a hell of peripheral traffic :) [14:36] TheEvilPhoenix: iptables is fun :) [14:36] lynxman: yes, true [14:36] heh [14:36] iptables is fun, but sometimes its a PITA [14:36] like one time i fubar'd the INPUT filters on a VPS [14:36] ended up blocking all external traffic [14:37] TheEvilPhoenix: that too, but not more than ipf, although sometimes I miss rule numbering which is not quite implicit in iptables [14:37] before i had put in a -m state rule to allow my traffic :P [14:37] heh [14:37] TheEvilPhoenix: tehee :) [14:37] lynxman: l7 may be the ticket, thanks [14:38] moonpup: perfect :) [14:39] adam_g: ping [14:40] lynxman: not sure the l7 project is currently active, info is years old.. :( [14:40] moonpup: eek [14:41] * moonpup still reading website [14:41] oop time to get ready for class *disappears* [14:41] I think ipp2p is uptodate [14:41] moonpup: looks like people are still using it, found an article in linux.com explaining how to do it in CentOS 5 [14:42] patdk-wk: ooh cool [14:42] or well, has been renamed, to opendpi now [14:42] what's opendpi? [14:42] http://www.opendpi.org [14:42] open-deep-packet-inspection, new version of ipp2p [14:43] it was meant as a l7 replacement [14:43] thanks guys... great find [14:43] be very careful will that though [14:43] cause all packets hitting that rule, will be very cpu heavy [14:43] RoAkSoAx: I'm getting quite confused what needs to be seeded for powernap [14:44] Howdy. I was having some weird trouble with my Jaunty 2.6.28-11-server kernel where it would misbehave a few times a day when sleep()ing. The details of this are sort of a different story. So I compiled a new kernel as per the Ubuntu community wiki article. Now I have a kernel that seems to have solved the sleep issue but has other problems. [14:44] RoAkSoAx: powernap-server seemed to include the whole shebang, but added a new Dep. [14:44] Ack. What is the command to change my name? [14:44] patdk-wk: will do, thanks [14:44] RoAkSoAx: python-scapy, via powerwake-common [14:47] Daviey: yes [14:48] bahh it is in universe :S [14:48] Anyhow. The first problem with the new kernel was that building it gave me a headers and image .deb which I installed. But the headers .deb failed since it depends on "linux-headers-2.6.32-34". Which is weird because it's name is "linux-headers-2.6.32-34-server_2.6.32-34.74_amd64.deb". It seems like I probably missed a step in the install wherein it realized they are the same package? [14:49] RoAkSoAx: but it's NEVER been in main afaiks.. so how has this happend? [14:49] Or maybe they actually are different packages and I don't have the base one because I'm using Jaunty which uses 2.6.28? But if I were on Lucid, I'd already have the appropriate base headers? [14:49] hi guys, does ubuntu use init or upstart [14:49]