/srv/irclogs.ubuntu.com/2011/11/10/#ubuntu-server.txt

uvirtbotNew bug: #888266 in cobbler (universe) "'cobbler sync' fails when run in a bash script after 'service cobbler restart'" [Undecided,New] https://launchpad.net/bugs/88826600:05
=== Guest79151 is now known as med_out
jorenAnyone have any suggestions on why an 11.10 server might not boot after installation?00:52
jorenI've re-installed grub already, and I'm able to mount the root raid device from the ubuntu cd00:52
donspauldingAnyone out there know what the "State of the Art" is when it comes to creating LXC containers on ubuntu server?01:10
donspauldingShould I be looking at libvirt solutions or rolling my own creation scripts?  It seems like everyone has a slightly different take on how to create containers, and I'm looking for some tried-and-true utilities.01:11
SpamapSdonspaulding: lxc-create ? ;)01:26
tohuwIs there a way to have writable webdav shares besides giving the Apache user access?01:28
donspauldingSpamapS: Your palindromic username tells me all I need to know.01:28
donspaulding:-P01:28
donspauldingI'm following along on this article, and it all seems so…thrown together.  http://www.activestate.com/blog/2011/10/virtualization-ec2-cloud-using-lxc01:29
donspauldingand all the articles I've read on lxc are like that.01:29
donspauldingI was just hoping there was something more than a bunch of half-hearted wrappers around lxc-ubuntu01:30
SpamapStohuw: unfortunately not really. the daemon has to have write access... unless you write an suexec capable CGI / PHP webdav implementation.. but that seems unlikely to be worth the time ;)01:30
SpamapSdonspaulding: I find lxc-create pretty good. :)01:30
SpamapSdonspaulding: you can try the juju local provider..01:30
SpamapSdonspaulding: https://lists.ubuntu.com/archives/juju/2011-October/000844.html01:31
tohuwSpamapS: The idea of re-implmenting webdav into a CGI or PHP environment just to use an existing suexec tool makes me consider the benefits of seppaku.01:31
tohuwThanks for the assitance... I'll just have to find another way to make this work..01:31
twbdonspaulding: libvirt contains its own LXC code that is separate from that in the "lxc" package.01:35
twbdonspaulding: last time I looked they worked very differently and the libvirt one was far more primitive01:36
twbtohuw: run a separate webdav httpd on a high port?01:36
twbI guess the owner of that proc would still need write access, tho01:37
tohuwtwb: yes, that was just suggested to me in #httpd. Create another httpd daemon with minimal modules and tight security, and have it serve webdav shares.01:37
donspauldingtwb: ah, thanks for the tip.01:38
twbI wonder if there's a decent DAV implementation that basically just static HTTP+DAV and no fancy crap like php or cgi01:38
tohuwtwb: I could disable cgi and php in another httpd instance if I had it use its own configuration directory, no?01:41
twbYes01:41
twbI just don't like that it's even in there, because it means the devs care more about features than security01:42
T3CHKOMMIEhey guys, anyone know where i could get some help getting my compiled kernel installed on a hard drive or getting a live cd set up for it01:53
kyconquersI am trying to decide whether to use postfix or exim for an outbound SMTP relay. Where would i find a good comparison or documentation on this?02:06
virusuyT3CHKOMMIE: maybe  #ubuntu-kernel02:06
T3CHKOMMIEsweet thank you!02:06
virusuykyconquers: i always use postfix, but take a look at : http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCcQFjAA&url=http%3A%2F%2Fshearer.org%2FMTA_Comparison&ei=szG7ToSqOIGSgQeC2625CA&usg=AFQjCNH8C6vnjm8DhWbyZtba7ukBMmcIoA&sig2=TWrpFB66pbbj5hGFAUN-3g02:07
virusuyis a nice review between exim qmail, sendmail and postfix02:09
virusuywith pros and cons02:09
virusuyand also talks about administration, releases, comunity ,etc02:10
kyconquersvirusuy, thank you, I'm definitely using postfix as a MTA and MDA but am unsure about it's performance as an outbound smtp with ldap auth, do you know of anything more geared towards that area?02:12
virusuyno, i've never used postfix with ldap auth.. so i cannot help you with that.02:13
virusuybut, i guess if you do a little search on google could be plenty of how-to02:13
kyconquersI found a way to do it running through Cyrus.02:14
virusuyoh, nice02:14
kyconquersi'm just trying to see if letting postfix handle the inbound and something else for the outbound would be better or worse?02:15
virusuywell, posftix handle outbound in fact02:16
virusuyor am i wrong ?02:16
RoyKkyconquers: postfix is an mta, it just delivers, cyrus, on the other hand, handles the mailbox02:17
kyconquersit works. it just is a workaround a workaround and seams unstable.02:17
RoyKkyconquers: cyrus can't deliver a single thing02:17
virusuyRoyK: or dovecot02:17
RoyKyeah, or zimbra or courier or ...02:17
virusuyRoyK: there's a lot of differents MDA02:17
virusuyall of them with some pros and cons02:18
RoyKyeah, I know...02:18
* RoyK ended up on zimbra because it was nice02:18
virusuyin my own experiencie always postfix + dovecot was the best solution02:18
virusuyRoyK: i used zimbra too it's awesome, but then i met roundcube (webmail)02:18
kyconquersCyrus is being used to do the authorization  Dovecot is my MUA and i'm using postfix for MTA MDA and the body(everything except authorization) for my outbound02:18
virusuyso postfix + dovecot +roundcube = WIN :-D02:19
RoyKit's thin and works well, but it doesn't have the admin-friendlyness of zimbra02:19
RoyKroundcube I don't know (never heard of it before now)02:19
virusuyRoyK: yeah.. and zimbra is a suite .. IM , Calendar, Mail02:19
virusuythats a pro on Zimbra, though02:19
RoyKyeah, and that's rather nice...02:20
RoyKmost is in the open version02:20
virusuyyes.02:20
RoyKa bit more tricky for backups02:20
virusuyreally ?02:21
RoyKwell, the commercial version has online backup, fixing the issues with mysql and possibly other services that must be stopped02:22
RoyKbut then, I have a private server, so it doesn't matter much for it to be down for 15 minutes in the middle of the night...02:22
virusuynice then02:22
RoyKalso, there are scripts around to fix online backup, but I just haven't bothered02:23
kyconquersso looking at outbound only is there a reason to go with postfix over exim?02:23
virusuynot really02:24
RoyKkyconquers: I can't answer that question, but I've standardised on postfix since gods know when, and I've had less issues (close to zero) with postfix than with exim, but then, I don't know exim too well, so that may be the cause02:25
virusuySame as RoyK , in my experience with postfix has been excelent02:26
virusuyhave*02:27
kyconquersok thank you both02:27
virusuyhas* gosh, i cannot even write :P02:28
virusuytoday i configured logrotate on our squid server at work02:32
virusuyreally easy, logrotate's man page is awesome02:32
virusuyvery clear and straightforward02:32
=== james is now known as Guest26243
thermionixis there a PPA for deb's for testing server kernels?03:10
twbthermionix: what do you mean03:11
thermionixcurrent 3.0.0 kernel crashes when suspending devices03:21
thermionix3.0.6 fixes the issue03:21
thermionixwondering if I can find a 3.0.6 ubuntu-server without compiling etc03:22
twbDunno, sorry03:31
RoyKthermionix: doubt it03:31
RoyKthermionix: but please file a bug03:31
twbA simple google for "kernel ppa" turns up some matches03:31
twbthermionix: also 3.1 is in precise.03:31
=== nande is now known as nandemonai
jdobrienanyone here familiar with installing setting up lxc on oneiric?04:03
twb!anyone04:07
ubottuA high percentage of the first questions asked in this channel start with "Does anyone/anybody..." Why not ask your next question (the real one) and find out? See also !details, !gq, and !poll.04:07
jdobrientwb, if I knew what to ask, i would04:11
jdobrienI need help diagnosing why I get this when starting an LXC lxc-start: failed to attach 'vethAG4ovV' to the bridge 'virbr0' : No such device04:12
twbAnd that third line is the one you should've started with04:12
twbIt's trying to attach to a bridge that doesn't exist.04:13
jdobrientwb, right04:13
twbDid you set up a bridge?  Pastebin /etc/network/interfaces, and the output of "ip a"04:13
jdobrientwb, why the heck didn't lxc-create set it up04:13
twbBecause lxc-create creates a CONTAINER04:14
twbIt's not its job to fuck up your networking04:14
jdobrienhaha04:14
twbIt's not vmware_config.pl04:14
twblxc-create should complain taht virbr0 doesn't exist tho, IMO04:15
jdobrientwb, hmm...libvirt-bin not installed...there's a clue04:16
twbYou are either using lxc or libvirt-bin; they're separate04:16
jdobrientwb, they don't work together?04:16
twb12:35 <twb> donspaulding: libvirt contains its own LXC code that is separate from that in the "lxc" package.04:16
twb12:36 <twb> donspaulding: last time I looked they worked very differently and the libvirt one was far more primitive04:17
jdobrienor play together04:17
jdobrientwb, so should i not use libvirt?04:18
twbIMO don't bother with libvirt unless you need to give non-root users access to VM management (as opposed to just access to the VMs)04:18
twbThat is predicated on you knowing what the hell you're doing wrt. lxc or kvm, tho04:19
jdobrientwb, I'm using it a semi-isolated development envo04:19
jdobrientwb, i got along find using schroots04:20
jdobriens/find/fine04:20
jdobrientwb, these are the instructions i am using https://dev.launchpad.net/Running/LXC04:20
jdobrieninstalling libvirt-bin did resolve the issue04:22
twbBecause libvirt fucks with your network setup04:23
twb(Hm, actually as at lucid I don't remember it doing so...)04:24
jdobrientwb, the network/interfaces is untouched04:26
twbDunno why it works then04:26
{bosco}ok so i am running 11.10x64 is it possible to make it so only root can login to the server once logged in a user on the server ?04:51
{bosco}via ssh sorry?04:51
{bosco}ti know the sshd_config file i can set that to NO on allow root login but will that do the trick04:55
smw{bosco}, that will do the trick04:57
smw{bosco}, assuming you have no other methods to login remotely...04:57
smw{bosco}, hopefully you have the same setting on your ftp server or whatever else you have.04:58
{bosco}smw: yes lol04:58
{bosco}smw: just curious what is your recomendation on "BASTILLE"04:58
smwConsidering I have no idea what it is... I hate it04:58
smwwell, no idea on its relation to computers :-P04:59
{bosco}it is a server package that configures your server to some security via apt-get05:00
smwinteresting05:00
{bosco}just curious if you have used it or not no biggie thanks later05:00
smwI am going to look into it then :-P05:00
{bosco}:-P05:00
tashcan anyone tell me if this is or isn't a good way to permanently mount a windows share? adding this to /etc/fstab: //MyPC/Users        /mnt/data       cifs    credentials=/etc/.smbcredentials,dmask=777,fmask=777    0       005:02
tashseems that it mounts, and is readable, but not writeable05:02
{bosco}smw: hey i am getting a permission denied when i try and login to root via ssh from my user account?05:02
{bosco}now05:02
tashpermissions and ownership on everything mounted is dr----x--t 1 root root05:03
tashbosco: root ssh is probably disabled05:03
smw{bosco}, wait, this is #ubuntu-server. What are you talking about root?!05:03
smwlol05:03
{bosco}tash: i want it disabled from an outside computer via ssh but from my own server i want it enabed?05:03
{bosco}lol sorry05:04
tashwhy don't you just ssh as your user, then sudo?05:04
smw{bosco}, I thought I was on ##linux or something05:04
smwwhy is root even enabled?05:04
{bosco}smw: is it possible i know root should not be enabled and i have added bosco to the sudo list just asking05:05
smwon ubuntu you can't login as root from anywhere without having root privileges unless you make changes..05:05
smw{bosco}, huh?05:05
tashsmw: mounted windows shares before?05:06
smwtash, yes I have05:06
smwtash, why?05:07
thermionixregarding the drive suspend issue in 3.0.0 and its being fixed in 3.0.6 - theres a few bugs - but nothing the mentions ubuntu-server > do I need to create a new bug relating to ubuntu-server?05:07
tashsmw: I added this to fstab and it mounted, but things are not writeable. Trying to determine if I have something wrong in the fstab line, or if it's a windows permissions thing:05:08
tash//MyPC/Users        /mnt/data       cifs    credentials=/etc/.smbcredentials,dmask=777,fmask=777    0       005:08
thermionixalternatively I'll just update to the newer desktop kernel05:08
smwtash, add defaults to the settings05:09
tashsmw: not sure what you mean :\05:10
smwtash, before credentials add "defaults,"05:11
smwtash, no space05:11
smwtash, that will add rw as well as a few other options05:11
smwtash, if you don't want too many other options, just add rw05:12
tashk, added defaults and rebooted.  dr----x--t 1 root root 4096 2011-10-23 10:31 data05:14
tashpermissions looks off still05:14
tashor is that normal?05:14
tashI cannot cp something from /home/myuser to /mnt/data/ ... seems like perms are whacky still05:14
tashI'll try rw05:15
tashwell, I think the problem was actually on my windows share05:18
tashhowever, I did end up setting rw05:18
{bosco}ok so i have disabled root acess to my server via ssh but my other user now has acess to root what now?05:58
{bosco}all i have done basicy is changed my root to bosco right.05:58
{bosco}ok so i have disabled root acess to my server via ssh but my other user now has acess to root what now?05:59
SpamapS{bosco}: except that now its logged whenever bosco becomes root05:59
{bosco}SpamapS: what are the benifets of this comared to root just having root acess is it still a security issue and if so how to fix this?06:00
{bosco}SpamapS: you there06:02
ZanzacarHi I have been tryingn throughout the day and have been unsuccessful at using vsftpd to chroot someone into their home directory.06:23
Zanzacarcan anyone help me out with this?06:24
twbZanzacar: why not use SSH's built-in chrooting SFTP server.06:27
Zanzacarhttp://paste.pocoo.org/show/505655/ thats my configuration files06:28
Zanzacarbecause I am completely and utterly unaware of such functionality06:28
twbhttp://paste.debian.net/144386/06:29
twbYou'd probably want sftponly in the AllowGroups as well :-)06:30
twbBut anyway, I recommend doing it with SFTP instead of FTP, since they look about the same to users, but SFTP is a much better designed protocol and more secure to boot.06:30
Zanzacarright I was doing it sFTP using vsftpd06:31
twbvsftpd is not an SFTP server.06:31
twbIt might be an FTP/SSL server.06:31
Zanzacaro... I didnt know that06:32
twbSFTP is a module of SSH, so no SSH -> no SFTP06:32
Zanzacaroic, see ssh has always been on all my servers so therefore I could always sftp but I always thought that was because I needed to install vsftpd06:32
Zanzacarwow06:32
twbThat goes in my quote file06:34
ZanzacarI have only really been using linux for maybe 3 months now so ya06:34
Error404NotFoundWhat would be a good DNS that also supports MySQL? Bind with 3rd party mysql driver, mydns, powerdns...?06:35
Zanzacarso the script you wrote there, it setsup the ssh_config file correctly to chroot users.06:35
twbZanzacar: you should read the sshd_config manpage and understand the lines in it06:36
SpamapSError404NotFound: have heard of big sites using powerdns06:36
twbZanzacar: you probably won't want one as locked down as I have06:37
Error404NotFoundSpamapS: hmm, ok, powerdns it is.06:37
twbSpamapS: "big sites" = root servers?06:37
twbError404NotFound: why do you want mysql?  Mysql's shit.06:37
Zanzacartwb: working through the information i found on it. thanks for the information it sure does explain why things where not working haha.06:38
Error404NotFoundtwb: correct, what else? pgsql? don't have that much hands on for that06:38
SpamapStwb: no, I'm not familiar with what they use. But the two sites I knew of using it were large hosting providers. (Not sure if they still exist)06:38
SpamapSOH please06:38
SpamapSscale pgsql without wanting to throw yourself off a cliff and I'll gladly give you a hang glider for free.06:39
twbError404NotFound: well, I dunno about you, but I am using nsd, which compiles normal bind-format zonefiles into a binary database in some magical way I haven't cared enough to grok06:39
Error404NotFoundtwb: :) wil google that06:39
SpamapSI really liked tinydns when I used it06:39
SpamapSso simple06:40
twbAnd nsd *does* run on l. and k.root-servers.net06:40
Error404NotFoundSpamapS: is it really that hard for pgsql? never did it.06:40
twbAnd half of h.root-servers.net06:40
twbI also found nsd really simple to work with compared to bind06:40
SpamapSError404NotFound: its possible. But.. well.. ask the launchpad guys about how much they love Slony. ;)06:40
SpamapStwb: still have to write bind zone files tho, right?06:41
Error404NotFoundSpamapS: ya, i know 'Slony' along with some curse words D:06:41
twbSpamapS: well, what else are you going to do?06:41
twbIf you want to store the master format for RRs in an RDBMS instead, IMO you need your head examined06:41
twbUnless you're doing some stupid cpanel-type web UI for idiot end users06:42
twbThen *maybe*06:42
twbSpamapS: I bet you could make pg scale really well by just turning off all the integrity checking features that mysql has off by default ;-P06:42
SpamapSthats a lie06:43
SpamapSread the manual on 5.506:43
SpamapSInnoDB is the default06:43
SpamapSsafe transactions are on by default06:43
twbI'm not a DBA, but the DBAs I know tell me it's still not good enough06:43
SpamapSpg people still spreading lies from 3.x days06:43
twbDon't forget we don't all run latest non-LTS either06:44
SpamapS4.1 introduced InnoDB06:44
SpamapS*4.1*06:44
twbShrug.06:44
Error404NotFoundI am at a dilemma, working on a setup that updates DNS zones on the fly using a custom web interface. Now if i don't use a mysql backend supported DNS the updates would have to be done via a cron that pulls data from database and writes config files. NSD seems amazingly fast, wondering what would be better.06:44
SpamapSThat MyISAM was still the default until just over a year ago when 5.5 was released has only fed this FUD. :-/06:44
twbAnother stupid that pissed me off was when I cleaned out old records from squid2mysql the other day, I couldn't find a way to reduce the disk consumption without dumping and rebuilding the db06:45
SpamapSError404NotFound: you could just as easily build config files on the fly, you don't have to do it via cron.06:45
twbSpamapS: IIRC they changed the default on Windows a few years before they changed it on linux, too06:45
SpamapStwb: OPTIMIZE TABLE xxx06:45
twbIt was a host running etch06:46
SpamapStwb: but that will only regain space if you have innodb_file_per_table on (which you should if you want to have any kind of long term server managability :)06:46
Error404NotFoundSpamapS: hmm, care to give a hint? Say if data for a zone is inside a table called abc.com, won't i need a cron that would pull data from db and write nsd configs?06:46
lifelessSpamapS: is that webscale?06:46
SpamapSlifeless: it uses /dev/null!06:46
twbI handballed the problem to a dba, but probably he didn't have a new enough mysql for that06:46
lifelessSpamapS: with map reduce?06:46
twbSpamapS: and is one table per file the default yet? ;-P06:46
SpamapSError404NotFound: nah, just write to the table and then kick off a message to a worker that updates the zone file from the DB06:46
SpamapSlifeless: and JSON ftw06:47
twbError404NotFound: IXFRs go into the db by default, and a cron pushes them to the slave .zones06:47
SpamapStwb: not sure if innodb_file_per_table is default yet06:47
lifelessSpamapS: did you hear about the yaml thing ?06:47
twbError404NotFound: master zones go from the files to the .db when you nsdc rebuild && nsdc reload06:47
Error404NotFoundtwb: hmmm, need to read more about nsd, if i can bind it with mysql, somehow without adding say more than a minute delay of pushing changes from db to nsd's binary format, it would be cool.06:48
lifelessSpamapS: arbitrary code execution via pyython's yaml.load06:48
lifelessSpamapS: which is why we don't roll our own formats, mmkay!06:49
SpamapSlifeless: *@#$%*06:49
lifelesshttp://pyyaml.org/wiki/PyYAMLDocumentation#LoadingYAML06:49
twbError404NotFound: when I say db I mean nsd's database, not mysql06:49
lifeless>>> yaml.load("""06:49
lifeless... !!python/object:__main__.Hero06:49
lifeless... name: Welthyr Syxgon06:49
twbError404NotFound: nsd has no mysql06:49
Error404NotFoundtwb: ya06:49
SpamapSlifeless: tho I think I use safe_load most of the time06:49
lifelessSpamapS: and know you know why06:49
lifelessSpamapS: really it should be called 'exploit_me_load' and 'load'.06:49
Error404NotFoundtwb: thats why i might skip nsd even though its cool as: cron pulls config data from db, writes bind style config for nsd, rebuilds and reloads nsd would always have some delay, running a cron every minute might not be a good idea.06:50
twbError404NotFound: you could just have the web UI read and write the zonefile directly, I guess06:50
twbI guess instead you could write a replacement for zonec which reads from an RDBMS, but I don't like it06:51
twbHaha, or ASN1 format :P06:51
SpamapSone nice thing about tinydns.. the line-per-record format was ridiculously hard to script around06:52
SpamapSerr06:52
SpamapSs/hard/easy/06:52
twbI guess the root servers don't have to worry about bullshit web UIs because everything is pushed to them... via DNS06:53
Error404NotFoundtwb: hmmm, going for powerdns for now, will do nsd where i don't have some crazy boss to answer :P ;)06:53
SpamapSforget web UI, just being able to attach DNS records to things like customer records is valuable06:53
twbError404NotFound: sure, whatever.  You know how I feel, I can't force you to do things my way :P06:54
twbSpamapS: M-1 M-! dig AXFR example.net RET when sending the RT email06:54
Error404NotFoundOne more question, and please bear with me as this might sound stupid for a while, may be longer :D06:54
twbSpamapS: oh, you mean records as in an RDBMS06:54
twbThought you meant records as in "record keeping" i.e. the issue tracker06:55
lifelesstwb: meh rdbms. perl hashes are where it is at.06:55
twblifeless: bleh06:55
lifelesstwb: imagine a root server running out of an in-memory hash :)06:55
twblifeless: at least it isn't a goddamn CSV-backed database on a SCO4 server06:55
twblifeless: the vendor is all "yes must can haz RAID6 6-way 1500 SAS for db"06:56
twbIt's bloody CSV FFS, they have like 80MB and 40 users06:56
Error404NotFoundI have client web servers running behind a varnish+nginx proxy where all clients point their DNS there. Its been working great till last morning when my boss asked me to add support for FTP. We have limited IPs and i was looking some kind of FTP proxy solution that i could configure against say either usernames or incoming domain names(if possible) to route port 21 to backend server. Or is there another alternate? I don't06:56
Error404NotFound want to give public ips to web servers in DMZ.06:56
twbOh and it was running on a Pentium III last week06:56
lifelesstwb: must have terrible scaling overheads.06:56
lifelessError404NotFound: frox perhaps06:57
twblifeless: no, the db vendor is just an idiot06:57
Error404NotFoundlifeless: checked, seems like its restricted to only one host in transparent proxy mode, checking non-transparent one, though then i might need to assign dns names for hosts in DMZ in Frox server's /etc/hosts or local dns.07:14
{bosco}ok so how do i take a user on my server and only allow him to see /home/user and anything there after?07:35
{bosco}no browsing around?07:36
SpamapS{bosco}: I've used scponly for that kind of thing before07:38
* SpamapS passes out and goes to sleep07:38
{bosco}ok what about non inherit trivial in file permissions07:40
{bosco}SpamapS: but this person still has to have simple root acess to update upgrade and install07:41
{bosco}nothing else07:41
{bosco}will that conflict07:41
Guest51768hello everyone, i have a more philosophical question then a technical one. Encryption. Since my /home dir is completly empty how can I use encrpytion on ubuntu server? could i encrpyt /var /etc07:44
Guest51768and so on...07:44
Guest51768?07:45
{bosco}leave guest07:49
{bosco}lol jk07:49
=== Guest51768 is now known as noob889
* ball is confused07:52
greppy{bosco}: you want them to only have access to ${HOME} but also have root?07:54
{bosco}greppy partial root acess only to update upgrade and install packages not to remove or see anything else other than there homefolder07:55
{bosco}i know how to do the first part it isthe secound that i ham having trouble with07:56
{bosco}chmod A+user:bosco:read_data/write_data:file_inherit:allow /home/bosco07:57
{bosco}that is the closest i have come but doesnt work in 11.10x6e07:57
{bosco}407:57
greppy{bosco}: you would basically need a jail environment for that to work for a shell, but that will make using sudo & apt commands just about impossible.07:58
Error404NotFoundlifeless: jftpgw seems more flexible thank frox.08:01
lifelesscool, I had not heard of that08:01
{bosco}greppy: so it is not possible to have both>08:05
{bosco}chmod A+user:bosco:read_data/write_data:file_inherit:allow /home/bosco then what is this for08:06
lynxmanmorning o/08:08
greppythey will need access to the binaries & libraries to use a shell as well as apt-get using sudo.08:09
{bosco}oh ok08:09
greppyyou can't really restrict access to just thier home directory and expect them to be able to do other things on the system.08:09
{bosco}right makes since just though it might work08:10
greppy{bosco}: why do you trust them to install and upgrade but not have access to the rest of the system?08:10
greppyif they install a conflicting package, ie lighthttpd instead of apache for example...08:10
greppythey don't have to uninstall to be able to make something no longer work.08:11
{bosco}becuase this is me and i am the only one on the system trying to make the perfect user with security isues08:11
{bosco}i have disabled root ffrom ssh08:12
{bosco}so i wsa just trying to be secure with my user and also just give him the 3 commandsthat i imight use on a day to day basses08:13
{bosco}no biggie08:13
noob889{bosco} how about you give your user its own virtualmachine? :)08:16
{bosco}well ok noob889 what is the best way to go about that and why have vm on a vps lol isnt that kind of redundent i just want it for security reasons in case someone acesss my server08:17
kaushalHi08:18
kaushalis there a bash script which checks for tomcat service being up and running ?08:18
{bosco}hi08:18
kaushaland what would be the ideal scenario to check for catalina.out file08:18
kaushalI suppose monitoring tomcat listening port is not a recommended method08:18
kaushalI mean any specific string08:18
kaushal{bosco}: hi08:18
{bosco}kaushal: :P08:19
kaushal{bosco}: Any clue ?08:19
{bosco}kaushal: not that i now of one sec though?08:19
{bosco}http://www.unix.com/shell-programming-scripting/118495-how-check-start-tomcat-using-script.html08:21
{bosco}check there see if that helps08:21
{bosco}kaushal:08:21
{bosco}here is how to start them at boot so you know they are running http://raibledesigns.com/tomcat/boot-howto.html08:22
{bosco}kaushal:08:22
kaushal{bosco}: basically i need to restart tomcat gracefully using bash script08:23
kaushali mean graceful shutdown and graceful start08:23
{bosco}kaushal: i know lol08:23
{bosco}other than those links i wouldnt know how you may ask in #ubuntu as well since no one is on here lol?08:24
=== jason is now known as jasef
tyskahi guys, to configure a server with authenticated proxy it does not just type export http_proxy=http://user:pass@ip:port ?12:24
tyskahello?12:25
eagles051387hey ikonia12:26
tyskacan anyone help me with proxy configuration?12:28
xranbytyska: are you using apache?12:29
tyskaxranby: no, im not trying to configure a proxy server12:29
tyskaxranby: i need to configure a client12:29
tyskaxranby: im trying to do export http_proxy=http://user:pass@ip:port , but it does not working12:30
xranbythat only work for some applications12:30
xranbyfor example if you want to use firefox you ahve to set the proxy option inside the firefox configuration gui12:31
tyskabut i cant do a simple ping to 8.8.8.812:31
xranbyping are not using http12:31
xranbythe proxy only work for applications that uses http12:31
tyskabut even with elinks i cant connect12:32
xranbycan you run apt-get update ?12:32
xranbytyska: elinks are looking for HTTP_PROXY12:34
xranbywith all CAPS12:34
tyskaow12:34
tyskabut even with ALL CAPS it does not work12:35
xranbytyska: if apt-get update work   then your proxy work12:36
xranbytyska: you have to check each application that uses http and double check that it gets correct configuration12:37
tyskaxranby: configuration of apt is on /etc/apt/apt.conf.d/02proxy12:37
tyskaxranby: this is already configurated and working12:38
tyskaxranby: my problem is with this export thing12:38
xranbyunfortunally elinks documentation do not mention in what format it want the HTTP_PROXY string http://elinks.or.cz/documentation/manpages/elinks.1.html12:38
=== cerber0s is now known as cerberos
xranbytyska: you can create an elinks.conf http://elinks.or.cz/documentation/manpages/elinks.conf.5.html12:40
xranbyyou need to set12:40
xranbyprotocol.http.proxy.host  protocol.http.proxy.user  and protocol.http.proxy.passwd12:41
xranbyin this config file12:41
xranbyaparently it can only use  host:port format for HTTP_PROXY and protocol.http.proxy.host12:41
ruben23hi there guys i get this error when i restart my network --------------> http://pastebin.com/esXNzpXc13:01
ruben23(9:00:46 PM) Azelphur [~Azelphur@azelphur.com] entered the room.13:01
pmatuliswho is azelphur?13:02
ruben23sorry i wrongly paste it13:03
pmatulisruben23: what release?13:06
ruben2310.04 LTSUbuntu 11.1013:07
ruben23Ubuntu 11.1013:07
pmatulisruben23: maybe pastebin your interfaces file13:13
ruben23http://pastebin.com/hzZ6AhbR13:14
pmatulisruben23: is the open-iscsi package installed?13:24
ruben23 pmatulis: how to install13:28
pmatulisruben23: i asked *if* it's installed13:29
pmatulisruben23: 'dpkg -l open-iscsi'13:29
ruben23No packages found matching open-iscsi.13:30
pmatulisruben23: ok, just checking13:30
pmatulisruben23: you may want to use strace on the command 'sudo strace -o output.txt /etc/init.d/networking restart' and pastebin output.txt13:31
ruben23http://pastebin.com/4gTXhGg713:35
pmatulisruben23: go up 2 messages13:40
zulDaviey: ping you said you had a python script that talked to the cobbler api?13:54
Davieyzul: well, something basic - yes13:55
uvirtbotNew bug: #888552 in cyrus-sasl2 (main) "cyrus-sasl2 denies authentication if host name unresolvable" [Undecided,New] https://launchpad.net/bugs/88855213:56
Davieyzul: what usesage?13:56
zulDaviey: care to share?13:56
zulDaviey: ill do the squid3 thing today13:57
Davieyzul: Yes, but  have a few snippets - what do you want to achieve14:00
zulDaviey: i just want to an example that logins to the api and sends something like a mac address14:00
Davieyzul: http://pb.daviey.com/oocT/ , you'll have to change the profile value.14:02
Davieyzul: I am interested what this is for tho.14:03
zulDaviey: the hardware detection stuff14:03
Davieyzul: Hang on, we have this stage of things done.14:04
pmatulisbonus question: how do you restart networking on oneiric?14:04
zulpmatulis: sudo /etc/init.d/networking restart14:04
Davieyzul: it needs to be done in shell or C really.. unless we bring back the pre-boot enviroment idea14:04
zuli think we bring back the pre-boot enviornment idea14:05
Davieyzul: That aspect needs to be addressed before adding the tool.14:05
zulbut really i wanted the snippet to test to see if i add like cpu info to the cobbler api that it can be tested14:05
DavieyHow is the image created?  Maintained?  How is data injected or pulled securely?14:06
zulDaviey: sure i have a vague idea in my head14:06
zul:)14:06
zuli need some caffine first14:06
Davieyzul: That needs documenting! :)14:06
pmatuliszul: bzzzt!  "Running /etc/init.d/networking restart is deprecated because it may not enable again some interfaces"14:06
Davieyi'm not digging into your head :p14:06
zulDaviey: well guess whats on my todo list today ;)14:06
Davieyzul: Depending how exotic we plan to get, adding CPU, KVM supported, Memory/RAM / Disk sizes etc, is probably going to be easier to add in C than handling a binary image.14:07
zulDaviey: right...but you have to be smart on how you get your information we are just not dealing with intel only14:08
Davieyzul: no, totally.14:09
zulDaviey: ill write my vague idea up today14:09
Davieyzul: ok, great!14:12
zulsend it off to ubuntu-server?14:13
=== chuck__ is now known as zul
zulfreaking freenode14:21
zulDaviey:  for arm we cant use something like dmidecode and /proc/cpuinfo is different as well14:22
Davieyzul: Yeah, that is what hdt seems to depend on, no?14:25
zulDaviey: no it uses syslinux14:25
Davieyerm, are you sure that is how it detects the CPU?14:27
zulyeah im looking at the code now14:28
Davieyand it doesn't use dmi?14:28
zulhttp://lxr-test.linpro.no/#syslinux+syslinux-4.01/com32/sysdump/14:30
Davieyhttp://lxr-test.linpro.no/syslinux+syslinux-4.01/com32/sysdump/dmi.c , isn't concerning?14:31
zulfor arm yes :(14:31
zulDaviey:  just poke holes into my dreams ;)14:32
Davieyhah14:33
Davieyit might still work.. :/14:33
zulogra_: ping14:33
zullets ask the experts14:33
ogra_pong14:36
ogra_you wont be able to use syslinux on arm, you will need to use whatever bootloader the board supports14:37
ogra_and zul is right, no dmi (BIOS) on arm14:37
Davieyogra_: uboot can chain into syslinux / pxelinux, no?14:37
zulogra_:  fudge...14:37
ogra_i doubt that, but u-boot can to PXE nowadays14:38
Davieyogra_: Gah! I said no dmi aswell.. :)14:38
ogra_s/to/do/14:38
ogra_what do you need from syslinux here ?14:38
ogra_i would assume that functionality is in u-boot as well already14:38
zulogra_:  syslinux provides a tool called hdt which dumps hw info about the machine you are booting14:38
ogra_the bad thing is that each board has its special setup, so you will need a lot of special casing per-board14:39
zulogra_: i wanted to use hdt to suck that info out of it and feed it back into cobbler14:39
Davieyogra_: I thik probing the kernel is safer. :)14:39
ogra_hmm14:39
ogra_well, that sounds like you do it before a kernel is booted14:40
ogra_if you have kernel and userspace archdetect is your friend14:40
ogra_and lsusb ...14:40
Davieyogra_: Well we have 3 possible solutions..14:40
zularchdetect?14:40
ogra_well, it should return the arch and subarch14:41
ogra_i.e. armel/omap414:41
Davieyogra_: can give me the output of /sys/devices/system/cpu/present on arm please? :)14:41
ogra_beyond that .... cat /proc/cpuinfo |grep ^Hard14:42
ogra_ogra@horus:~$ cat /sys/devices/system/cpu/present14:42
ogra_0-114:42
Davieyogra_: is that a 2 core box?14:42
urthmoverwhen installing 11.04 on apple xserve I do not see an option to  install EFI boot when partitioning my disks.  How do I resolve this?14:42
ogra_(thats on tegra, bvut i doubt it will be different on other SMP boards)14:42
ogra_Daviey, exactly14:43
Davieythanks14:43
ogra_ogra@printsrv:~$  cat /sys/devices/system/cpu/present14:43
ogra_014:43
ogra_beagleboard ^^^14:43
urthmoverI did notice that 11.04 server iso only has bootx86.efi  and not bootia32.efi in the /efi/boot folder as well.  Will someone speakup that hcan leand a hand?14:43
zulogra_: lovely ;)14:44
ogra_:)14:44
urthmoverif anyone in here does not have experience with ubuntu on this platform (apple xserve) but knows of someone on this channel that does please point that nick out to me as well  thanks14:45
zulurthmover: i doubt alot of people have an apple xserve google is your friend in this case14:45
Davieylamont: I assumed you might have some experience with apple xservers running ubuntu?14:46
urthmoverzul: agreed I have been slopping around in this for all of this past week.  I've compiled my own grub  but unable to grub-mkimage ...  I have a booting usb key but it only boots into grub 1.96  and won't loop iso images from the usb key   thanks for the suggestion though zul14:46
zulurthmover: you might want took at refit as well14:47
urthmoveragreed zul  refit does appear to be a valid solution but unfortunately when I have that installed on this box  it does not recognize any mountable install media (cdrom, usb drive)  been quite frusterating.....maybe I'll install refit  again  and see if anyone in the refit irc channel can lend a hand as to why that aspect of this install wasn't successful14:49
Davieyzul: it seems to me that hdt gives us the worst of both worlds TBH15:04
zulDaviey: hmm...maybe we dont need dmi info15:04
zulDaviey: how so?15:04
Davieywe don't get the flexibility to extend it, which we'd have with a bloated image - and we aren't using the linux kernel, which provides an abstraction layer we can probe15:05
Daviey(linux kernel being the current implementation)15:05
zulk15:05
DavieyIt's still C, meaning rapid development equals the current implementation15:06
zulso right now you have to pop in the cd to send the mac address back to the cobbler server?15:06
DavieyOne of the main benefits of a bloated image is that it is easier to throw in adhoc modules i feel.15:07
Davieyzul: no!15:07
Davieyzul: That was low hanging fruit to add.. the primary interface is a default preseed from cobbler to netboot and register it automagically.15:07
zulok gotcha15:08
Davieywe are (ab)using d-i as a cheap execution enviroment, which we can pass data to, which is supported by cobbler.15:08
zulok im just trying to understand now15:09
Davieyi'd actually not be upset if it went away from the CD menu TBH, so it just works under the covers.15:09
DavieyReplace it with a 'Deploy something on this machine', which chains into ipxe.15:10
stgraberhallyn: uploaded a new LXC to Precise. This fixes some auto-generated changes that got bundled in the previous upload and applies the remaining changes to lxc-ubuntu15:20
stgraberhallyn: so the new lxc-ubuntu is identical to what's upstream at the moment (includes the lxc.cap.drop, tap devices and mknod changes)15:21
hallyndid i cause those auto-generated changes?15:24
hallynok, i'm trying to get a prototype of the lxc bridge working.  The /etc/init.d/lxc is getting kind of ugly though :)15:24
stgrabernot sure, might well have been me. It's one of these cases where we need to unapply and re-apply all the quilt changes15:24
stgraberare you planning on converting it to an upstart script?15:24
hallynI might have to just bite the bullet and switch to upstart.  except i don't want to diverge from debian15:24
hallyni dunno, what's your thought?15:25
hallynhe's obviously developing the bas version,15:25
hallynso i guess it depends on whether dba is willing to take my changes (in some form or other)15:25
hallynif not, then yes, no sense maintaining our own version of the bash script15:25
stgraberyeah, if the changes go in Debian, we probably should stick to the sysvinit script15:25
stgraberif not, then upstart would likely be a bit cleaner15:26
stgraberbut we'd loose some of the custom actions in the process (not that I think they should have been there in the first place)15:26
hallynwhat would we lose?15:28
stgraberfreeze, unfreeze and status15:28
lamontDaviey: it's possible15:33
lamontthe buildds are xserves, but I thought those were ibm, not apple15:34
Davieyah, ok15:34
urthmoverlamont: apple calls their rackmountable enterprise server hardware xserve (as confusing as that is for everyone except apple)15:39
urthmoverlamont: Apple has discontinued these boxes a year or so ago.  Still supporting them  but I'm sure that OS updates will soon stop in a few years   so it is time to take advantage of the great hardware and put an OS that I can grow with15:40
uvirtbotNew bug: #888603 in openldap (main) "package slapd 2.4.23-6ubuntu6 failed to install/upgrade: le sous-processus script post-installation installé a retourné une erreur de sortie d'état 1" [Undecided,New] https://launchpad.net/bugs/88860315:56
ppetrakihallyn, iscsi-target16:03
hallynppetraki, lvm16:06
ppetrakihallyn, I'm confused, I thought you were interested in which iscsi target server we were using?16:06
ppetrakihallyn, what about LVM?16:06
hallynppetraki, nothing about lvm  :)16:07
ppetrakihallyn, oh good :)16:07
hallynppetraki, that's true in 12.04 too?16:07
ppetrakihallyn, hrm... that knowledge is definitely based on 10.04 LTS16:09
ppetrakihallyn, I don't have a good answer for you there16:09
hallynppetraki, ok, thanks16:11
ppetrakihallyn, appears that fedora is using tgtd, which would be the tgt package for us, for what its worth16:12
kirklandSpamapS: yo16:12
SpamapSkirkland: sup?16:15
roaksoaxjandrusk: ping16:15
roaksoaxups16:15
dorkhello16:15
roaksoaxsorry16:15
roaksoaxjamespage: ping16:15
jamespageroaksoax: pong16:15
roaksoaxjamespage: any recommendations for USB sticks for the pandaboards?16:16
jamespageroaksoax: hmm - so I'm using laptop SATA drive in a USB caddy - works OK16:16
jamespagestill boot from the sd card buts runs from the drive - so better performance16:17
roaksoaxjamespage: right16:17
roaksoaxjamespage: what's the preseed file again? and after installation did you have to modify anything?16:17
roaksoaxjamespage: and kernel parameters added if any?16:17
jamespageroaksoax: preseed - https://gist.github.com/120583216:18
jamespagecobbler stuff inc kernel params - https://gist.github.com/120582516:19
jamespageand some fu to re-image the SD card to netboot when you want to re-install16:19
jamespagehttps://gist.github.com/120575116:19
jamespageI did have a pad - but I can't find it ATM16:20
roaksoaxjamespage: ok, but after installation everything was working as expected then16:20
jamespageyep - I use that configuration pretty frequently towards the end of last cycle16:21
roaksoaxjamespage: i mean, it was booting of sd card but running from sda16:21
jamespageyep16:21
roaksoaxjamespage: ok cool16:21
roaksoaxjamespage: cool, thanks16:22
jamespagenp16:22
roaksoaxjamespage: now, did you get any case for your pandaboard?16:22
roaksoaxlol16:22
jamespagenope16:22
hallynstgraber, hey, do you ever see containers that wont' shut down because ureadahead was still running (or hung) ?16:22
hallynI've reported it as a bug for natty, but got it with an oneiric container on precise too16:23
hallyni don't know what the problem is16:23
jamespageits nicely accumumating a layer of dust - just waiting for it to catch fire when I run some java on it!16:23
roaksoaxjamespage: sounds like fireworks to me.. wait for the hollidays :)16:23
BrixSathello16:32
BrixSatim trying to compile a driver and i get the next error16:32
BrixSatMakefile:93: /lib/modules/2.6.32-28-generic/build/.config: No such file or directory16:32
hggdhDaviey: the server's team to bug-control expired. Is this what you want?16:40
hggdhah, server team's membership, to be precise16:40
uvirtbotNew bug: #888618 in ec2-ami-tools (multiverse) "ec2-ami-tools has hard coded location list" [Undecided,New] https://launchpad.net/bugs/88861816:45
Davieyhggdh: Ah no, i hoped to grab you about that last week.16:50
DavieyCan it be re-added?16:50
Davieyzul: for squid3, are you adding a transisitional package?16:50
zulyep16:51
Davieyzul: Are the conf's compatiable?16:55
zulDaviey: yeah16:55
Davieyrocking!16:56
roaksoaxzul: why is a squid3 transitional package needed?16:56
zulroaksoax: because squid is going away in favor of squid316:57
roaksoaxzul: ahh just realized that we have both, squid, and squid316:57
* Daviey notes roaksoax is behind on his bug mail.16:57
roaksoaxDaviey: heh... or in the spam bin16:58
roaksoaxDaviey: is there any email I should have been aware of?16:59
Davieyroaksoax: nah, jdstrand opened a bug asking us to replace squid with squid3 for it to be possible to support it for 5 years17:00
roaksoaxDaviey: ahh.. I didn't get any17:00
* jdstrand hugs server team17:00
Davieyjdstrand: when do hugs turn into beers?17:01
roaksoaxDaviey: how was skydiving btw?17:01
jdstrandperhaps when I receive one that is owed to me :P17:01
lynxmanjdstrand: so it's a very good transaction, the server team gives you one... you have to pay one for each guy of the server team? ;)17:03
Davieyjdstrand: heh, fair point :)17:03
Davieylynxman: Rick Clark promised to buy every member of the Ubuntu Server Team a beer at UDS.. ~ubuntu-server being an open team at the time doubled it's membership overnight.17:04
lynxmanDaviey: and then half of them dutifully resigned the next day? ;)17:05
jdstrandhehe17:05
SpamapSlynxman: so *thats* how we got Chuck!17:11
* SpamapS hugs zul17:11
zuleh?17:12
zulokies squid3 should be ready for the MIR report now17:27
zuljdstrand: it already had ufw support btw17:28
ServerNoObwho has plenty of time to help me? Afraid I may be doomed17:29
jdstrandnice17:30
uvirtbotNew bug: #888637 in clamav (main) "unneeded group write permissions for freshclam network files" [Undecided,New] https://launchpad.net/bugs/88863717:30
ServerNoObAnyone good with dns?17:31
ahs3ServerNoOb: yes, somewhat.  what's the question?17:32
ServerNoObis it possible to do this.17:32
ServerNoObISP----router------wifpc----out to another router -----to ubuntu 10.04 server17:33
ServerNoObI have the first router port forwarding to the wireless pc17:34
ServerNoObthe wireless pc is giving ip to the second router17:35
ServerNoObports forwarded from second router to the ubuntu dns server17:36
ahs3tcp or udp ports or both?  dns wants to use udp, typically17:37
ServerNoObdns work on that lan but i think it is broken at the wireless pc... dont think it is passing it off to the second router17:37
ServerNoObwill try that17:37
ServerNoObdns is set to udp17:38
ServerNoObon both routers17:38
ahs3i think what you'll have to do is debug each step with something like dig17:40
ServerNoObwhen I try to go  to the domain it says taking too long to respond17:41
ahs3i.e., go to the ubuntu server, make sure you can dig there, then go to the next link17:42
ServerNoObdoes the wireless pc have to have a dns server too or is there a way to passit through17:42
ahs3if you want the pc to resolve names, yes it needs a dns server -- or at least a hosts file17:43
patdk-wkyou don't need a dns server on ANY of those machines or routers17:43
patdk-wkit would be helpful if the isp router had a dns server, but not needed17:43
patdk-wkahs3, are you confusing dns server with resolv.conf?17:44
ahs3ah, i interpreted the question as "does it need access to a dns server", not "does it need to _run_ a dns server"17:44
patdk-wksounds like he has a dns server running on the ubuntu box17:45
patdk-wkso many possible things could be going on17:45
patdk-wkbut normally dual homing things, expecially laptops, normally don't work well17:46
ahs3right, unless done very carefully17:46
patdk-wkall my networks use 192.168.1.x :)17:47
ahs3heh17:47
ServerNoObahh does it need to run one17:48
ahs3patdk-wk: yeah, that's why this sounds like a debugging exercise to find the link where the dns packets get dropped17:48
ahs3ServerNoOb: it doesn't need to run a server, but it must be able to resolve (hence, /etc/resolv.conf)17:49
ServerNoObfrom the server dig got info17:49
ServerNoObnext step up is linksys router17:49
ahs3right -- see if you can dig from the other side of the router, and so on...17:50
ServerNoObfrom the wireless pc it digs too17:51
ServerNoObI think my connection may just be too darn slow17:52
ahs3it would have to be *really* bad for dns to fail -- it does a lot of retries17:54
ahs3and dig will report the response times17:54
ServerNoObspeedtest.net says 0.35Mbps dn and 0.08Mbps up17:55
ServerNoObI would like to get my server wifi working to cut out a few steps17:56
ServerNoObwith the desktop version wifi card worked out of the box, but not on server17:56
ahs3that should be plenty of bandwidth17:57
patdk-wkspeed doesn't matter, just latency17:57
patdk-wkif you have 30seconds of latency :(17:57
patdk-wkServerNoOb, you know, there is no difference between desktop and server17:57
patdk-wkexcept all the desktop stuff isn't installed17:57
patdk-wkso you just need to install the wifi drivers into your server install17:58
ServerNoObdig show Query time: 332mms17:58
ahs3long, but not at all unreasonable17:58
ServerNoObssh is not even making it past first router18:01
ServerNoObconnection timed out18:01
ahs3that's tcp on a different port, but that sure seems like a clue :)18:02
ServerNoObcan you ping it?18:03
ahs3what's the ip address?18:03
=== smb` is now known as smb
ServerNoOb206.41.235.15218:04
ahs3it's not configured to ignore pings, is it?18:05
ahs3apparently not...18:05
ahs3PING 206.41.235.152 (206.41.235.152) 56(84) bytes of data.18:05
ahs364 bytes from 206.41.235.152: icmp_req=1 ttl=242 time=395 ms18:05
ServerNoObnslookup shows it pointed to that IP18:07
ServerNoObnow I have pulled everything from nat on router except http and ssh18:10
ServerNoObalso removing firestarter18:11
ServerNoObam I still here?18:13
ServerNoObok I am18:14
ServerNoObhow strange18:19
ServerNoObahs3: now it makes it past first router but pulls the wireless pc's webpage18:29
patdk-wkyou don't have your wireless router setup as a hotspot capture do you?18:30
ServerNoObno18:30
ServerNoObwish I could18:30
ahs3well, and if http is port forwarded to the wireless pc, isn't that correct?18:31
* ahs3 is a little puzzled by the question...18:31
ServerNoObthis pc I am on pulls wifi from my first router then uses eth0 to share net with second router18:31
patdk-wkoh well, so basically you have 3 routers18:32
ServerNoObthe server with dns and website I want to reach is coonnected to second router18:32
ServerNoObif you conut this pc as a router18:32
patdk-wkit routes doesn't it? :)18:33
ServerNoObthe it would be second18:33
patdk-wkhow is the second router setup?18:33
patdk-wkI assume you connected it's wan port to your eth0?18:33
ServerNoObyes18:33
patdk-wkya, then talking to stuff on that lan isn't possible18:33
ServerNoObso it pulls an ip18:33
patdk-wkunless you setup port forwarding, then you can only talk to one device18:34
patdk-wkthat is so bad, 3 level deep nat :(18:34
ServerNoObI figured that18:34
ServerNoObwas worth a try18:34
patdk-wkoh it's possible18:34
patdk-wkbut many limitations18:34
ServerNoObso I need to make this pc my main server18:35
ahs3yeah, very messy.  i wonder if you could subnet the lan on eth0 and have the pc route to it...18:35
patdk-wkno idea, I don't thing we even know your goal18:35
uvirtbotNew bug: #888662 in xxxterm (universe) "Web browsers should share the cache" [Undecided,New] https://launchpad.net/bugs/88866218:35
ServerNoObI will make a graphic and show you ...will you be around for a few18:36
* ahs3 has to head off to lunch...bbiab18:37
uvirtbotNew bug: #888671 in facter (main) "Please merge facter 1.6.2 (main) from Debian testing (main)" [Undecided,New] https://launchpad.net/bugs/88867118:46
ServerNoObpatdk: still here18:46
zulDaviey: you are right the api is silly19:38
Davieyzul: oh?19:46
Davieyzul: you mean the lack of exposed debug?19:46
zulsilly-easy19:46
Davieyoh19:46
Davieyyeah xmlrpc via python is really rather nice.19:47
Davieyzul: Have you managed to add extra data?19:47
zulDaviey: working on that now19:47
sorenIs this for cobbler?19:47
zulsoren: yes19:48
sorenok19:48
sorenThere's actually a change under review against Nova that adds bare-metal provisioning.19:55
sorenIf you guys want to do a cobbler driver, you may want to look at it.19:55
sorenIt's targeted at some odd ball embedded platform they have, so it's not the same use case, but it would be great if they would be in the same sort of style.19:56
zulsoren: yeah i saw i need to review it19:57
roaksoaxzul: you working on cobbler-enlist?20:13
roaksoaxor similar?20:13
zulroaksoax: kind of20:14
roaksoaxzul: so how are we gonna register new systems then?20:14
zulroaksoax: right now sudo cobbler system --cpu_cores=99 and that info gets exposed from the api20:15
DavieyI really think cobbler-enlist is the approach we should be extending20:16
roaksoaxzul: so we are extending cobbler then and not using ocsinventory or are we doing both20:17
zulroaksoax: extending cobbler20:17
DavieyThe bloated image approacg which 'sudo cobbler system add' depends on has significant more work involved, for a similar end experience.20:17
zulI should have a patch soon as an example20:17
DavieyI feel that ocsinventory is a Medium priority thing.20:18
roaksoaxDaviey: well in my mind relies the approach that a system should 1. turn on. 2. obtain a pxe image from cobbler 3. register into cobbler (with all info) 4. it turns off 5. ready to be deployed20:18
Davieyroaksoax: that is what we were striving for already, but the image is based on something we get for free.20:19
roaksoaxDaviey: that's what I mean with20:20
roaksoaxDaviey: that's what I mean with "in my mind relies the approach"20:20
DavieyIf we go for the bloated image, we need to worry about creating, maintaining and passing credentials to it.  Which is an issue we currently do not have20:20
zulthats something we all agree on20:20
Davieysmoser, doesn't agree20:20
smoseri never do20:20
DavieyI agree that a bloated image might well be nicer, but the added work has little benefit IMO.20:20
smoseri just think that you're going to have to bite the bullet at one point or another.20:21
smoserthat sooner or later (read, sooner) you're going to realize that getting enough stuff to run in that little environment of the installer is a regular PITA20:22
Davieysmoser: You could well be right, but in order to make a decent plan on this - we need to document reasons that would cause that.20:22
smoserand you'll re-invent lots of things (like facter) that you would get for free if you bit said bullet20:22
Davieysmoser: so every dep we need in the d-i env, we need to introduce a udeb - is a PITA, agreed20:22
Davieysmoser: even in the minimal image, i'm not sure we'd want ruby, would we?20:23
smoserthings you need, that will result in reinvention or PITA:20:23
smoser * facter20:23
smoser * ssl support20:23
Davieyssl support we are getting regrdless.20:23
smoserreally? that is somehow free?20:23
zulfree as in magic..20:23
smoseri thought installer did not have it, and thus you couldnt use it.20:23
Davieysmoser: I *do* agree that a bloated image is 'better', but not neccessarily the right choice.20:23
* zul does his doug henning impression20:23
smoseri dont think its necissariliy better.20:24
smoseri just think you're going to do a ton of work now fighting to stay in that installer20:24
Davieysmoser: well not free, but Colin is adding ssl support to d-i already.20:24
smoserand then throw that away in the future20:24
smoseri can most definitely grab a *lot* of data through /sys and /proc about a system with nothing more than busybox20:25
* Daviey loves how the tables have turned. :)20:25
* Daviey was smoser last cycle, and smoser was Daviey20:25
smoserDaviey, we'll, i could agree with you20:25
smoserbut then we'd both be wrong20:25
roaksoaxisn't it better to have a live image pxe booted, that runs and grabs the info, and then pushes it to cobbler?20:25
smoserwhat does "live image" mean20:26
Davieyroaksoax: yes, but we need to worry about creating, maintaining and passing secure data to it.20:26
Davieysmoser: pxe booting a read only minimal image.  aka, bloated image20:26
roaksoaxyeah20:27
smoserdoesnt have to be read-only20:27
roaksoaxDaviey: by secure data you mean cobbler's user/password in order to be able to push that back into cobbler?20:27
DavieyI certainly will not block the bloated image approach, as i do think it is cleaner and more extendible.. However, it really needs a solid plan, with clear benefits.20:28
Davieyroaksoax: yah20:28
roaksoaxDaviey: and can't we preseed that or use cloud-init?20:28
Davieyroaksoax: well if we go for the bloated image, preseed isn't an option is it?20:28
Davieywith the d-i image we can preseed.20:29
Davieycloud-init.. Yes!  That is a good idea.20:29
Davieywe'd need to extend the orchestra metadata service tho20:29
Daviey(suddenly it's sounding like a significant undertaking, with little end user benefit)20:29
roaksoaxDaviey: uhmmm not really, we could just obtain a blob of data base64 encoded20:30
roaksoaxand then decoded on the image20:30
roaksoaxsimilarly to what we do with the juju/cloud-init stuff20:30
Davieywell sure, but we still need to make and maintain a data service, right?20:30
smoserDaviey, not entirely20:31
smosermaybe we could just take over the kickstart for this path20:31
smosercloud-inti would hvae bot be extended for a datasource type20:31
Daviey"have to be"?20:32
smoserthen it would just read forom the kernel command line that uesr-data comes from this url (which is its kikstart url)20:32
smoserand it consumes it20:32
smoserhave to be20:32
Davieysmoser: How long would that take?20:32
smoserbut i dont know if cloud-init is necessary or overkill for that little thing.20:32
smoserit wouldn't be too bad.20:32
smoserits another data source type20:32
Davieyutlemming: How long would it take you to fork the livebuild magic to produce a <100MB bootable image?20:35
roaksoaxbut anyways, i think we need to be concerned on extending cobbler to store hw information20:41
roaksoaxof a system20:41
zulDaviey roaksoax smoser: Thats how you expose new things through cobbler:people.canonical.com/~chucks/cobbler/cobbler-cpu-cores.patch20:41
smoseri think 100M is unfortunately overly optimistic20:42
smoser$ du -hs /lib/modules/$(uname -r)20:43
smoser140M/lib/modules/3.1.0-2-generic20:43
roaksoaxzul: Instead of patche item_profile.py you should be patching item_system.py since the system'20:44
roaksoaxzul: Instead of patche item_profile.py you should be patching item_system.py since the systems, since they are the ones that hold the information of each system20:44
zulcrap i thought i did that :P20:44
roaksoax:)20:45
zulroaksoax: but you get the ide20:45
zulidea even20:45
roaksoaxzul: but anyways, if we end up having ocsinventory as a backend, I think we could add a new feature to cobbler to say "system backend is ocs inventory". so it grabs all the hw info from there20:45
roaksoaxzul: yeah I do, sweeeet20:46
roaksoaxzul: so I gues you will be working on extending cobbler to store hw info then?20:49
zulroaksoax: probably20:49
Davieyroaksoax: so one of the *huge* reasons we went with cobbler when we reviewed the options was because we thought it would be easy to extend to make it the heart of orchestra.20:52
roaksoaxDaviey: which it is20:52
Davieyzul: looks like a good patch, and easy to extend, nice work.20:53
Davieyzul: I wonder how much work it would be for extensions to be a runtime plugin, rather than patching core.20:53
smoserwhat patch is this ?20:54
smoserhttp://people.canonical.com/~chucks/cobbler/cobbler-cpu-cores.patch20:54
zulit would be nice to know what hardware info we need21:08
uvirtbotNew bug: #888752 in dovecot (main) "dovecot 2 on 11.10 - mysql db access is sortof missing" [Undecided,New] https://launchpad.net/bugs/88875221:11
the-mgtif I'm on LTS and run 'do-release-upgrade -d' it's trying to upgrade me to precise21:55
the-mgtis there a way to specify a release?21:55
the-mgtahh nm, Prompt=normal21:56
hallynall right, super-friends, tomorrow is a holiday, so i'll see ya'll on monday!22:30
lynxmanhallyn: enjoy :)23:08
utlemmingDaviey: sorry I missed your chat...forking livebuild is pretty trivial, but like smoser said, <100MB is going to next to impossiable unless we use a compressed FS or strip out unneeded modules.23:18
Davieyutlemming: thanks23:20
utlemmingDaviey: what are you using the bootable image for23:23
virusuyhi23:24
utlemmingDaviey: I've build a initramfs based boot that used ~100M compressed initramfs before (not Ubuntu though) that booted over PXE. As long as you have sufficient memory, then you could run the root file system out of memory.23:25
Davieyutlemming: yeah, did that include python?23:26
utlemmingDaviey: ah, yeah it did23:27
utlemmingIt was really, really stripped down, and I think it was like 75MB with xz encryption.23:28
utlemmingDaviey: It was also using a custom compiled kernel, so that helped with the space requirements.23:28
Davieyutlemming: that might be worth considering, but i'm concerned about cleanly reproducing and maintaining.23:28
utlemmingDaviey: actually, I take that back, it was 140M23:28
DavieyThe concern is also support for unknown hardware, which means we need a rich kernel.23:29
Davieysmoser, zul, roaksoax ^^23:29
utlemmingTrue...but I would assume that it is things like disk arrays, raid hardware, ethernet, etc. If you drop out the video for linux, 3d acceleration cards, etc., you can save some serious space23:30
kyconquerswhat would be the pros/cons of using exim with cyrus auth vs exim doing auth itself?23:33
zulDaviey: im all for it if it can be done easily enough23:44
TakyojiDoubt anyone would know, but: know how to disable the 'switch user' option via manually changing it in gconf or a text file?23:46
utlemmingDaviey, zul: the big problem that I ran into with a large initramfs was that download errors. We saw some problems with TFTP, so we used a patched version of gPXE that had some retry logic.23:49
zulyucky23:50
Davieyutlemming: In other news, are you able to tackle the keystone MIR - bug 881464 you signed up for? :)23:50
uvirtbotLaunchpad bug 881464 in keystone "[MIR] keystone" [Undecided,Incomplete] https://launchpad.net/bugs/88146423:50
utlemmingDaviey: I thought you were going to ask about that...yeah, I'll put that on my high priority list. I got side tracked by UDS and Amazon's new region that just launched.23:51
Davieyroaksoax: SpamapS is doing a mysql merge, can you work with him to get it included - or hand off - bug 880339? Thanks23:51
uvirtbotLaunchpad bug 880339 in mysql-5.1 "AppArmor profile needs update" [Medium,Incomplete] https://launchpad.net/bugs/88033923:51
Davieyutlemming: excuses, excuses :P23:51
Davieyzul: How is bug 885283 looking?23:52
uvirtbotLaunchpad bug 885283 in squid3 "please demote squid and promote squid3" [High,New] https://launchpad.net/bugs/88528323:52
zulDaviey: need to do the MIR23:52
Davieyzul: and bug 879853?23:52
uvirtbotLaunchpad bug 879853 in munin "Munin upload 1.4.6-1ubuntu1 drops fixes / sponsor debdiff instead" [High,Triaged] https://launchpad.net/bugs/87985323:52
zulDaviey: will do the munin tonight after i get back from meeting liams teacher23:53
Davieyzul: Great, i think it will be trivial - considering a security member of the MIR team requested it. :P23:53
Davieyzul: Ooo, have fun23:53
Davieyzul: bug 871278 has landed in upstream trunk now, right?23:54
uvirtbotLaunchpad bug 871278 in nova "Cannot attach volumes to instances if tgt is used" [High,In progress] https://launchpad.net/bugs/87127823:54
zulYeh23:54
zuli think so23:54
zulill upload the nova milestone tomorrow as well23:54
Davieyzul: Yeah, it was blocked on Authors file if i saw correctly, now resolved23:54
Davieyzul: Great!  It might be good if one of the components, you talk through someone else how to do the process. :)23:56
Davieyadam_g: Hey, have you been able to touch cobbler-enlist this week?23:56
Davieyzul: In other news, did you see - bug 883988?23:57
uvirtbotLaunchpad bug 883988 in glance "package glance 2011.3-0ubuntu4 failed to install/upgrade: ErrorMessage: subprocess installed post-installation script returned error exit status 1" [High,New] https://launchpad.net/bugs/88398823:57
zulsqlalchemy.exc.OperationalError: (OperationalError) table images already exists u'\nCREATE TABLE images (\n\tid INTEGER NOT NULL, \n\tname VARCHAR(255), \n\ttype VARCHAR(30), \n\tsiz23:59
zulthat tells me it was a re-install23:59
adam_gDaviey: theres a pending MP for bug #86849223:59
uvirtbotLaunchpad bug 868492 in cobbler-enlist "cobbler-enlist needs to register all interfaces on system, as advertised" [High,In progress] https://launchpad.net/bugs/86849223:59

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!