[00:10] hi [00:11] someone got a minute to help a poor noob with network troubles ? [00:11] tunabread: we can try, just ask the question [00:11] its ... complicated [00:12] tunabread: first off did you try google [00:12] i have a 10.04 LTS server installation on a vserver [00:12] yes, i tried google [00:12] ok [00:12] i cant get any network connection in or out from the machine [00:12] i have VNC access, so i can access the shell [00:13] does host have net access? [00:13] the only thing i did, was change the sshd_config file, and flush iptables [00:13] well my ISP management console says, yes. [00:13] tunabread: what did you change wihtin the sshd [00:14] i enabled protocol 1 [00:14] so i changed the line "protocol 2" to "protcol 2,1" [00:14] have you tried removing that? [00:14] i already changed it back [00:14] yes, had no effect [00:14] tunabread: what iptables did you flush? [00:14] i reloaded the SSH, too [00:14] well i used "iptables -F" [00:14] so it should flush all rules ? [00:15] i used that before on another machine, do disable iptables, for testing [00:15] then reloaded the rules, worked. [00:16] can you give me a hint what i should check ? [00:16] i tried ping, textmode browser, nothing works [00:16] well what rules did you remove [00:16] i might mention, it worked before :) [00:17] iptabels -F just flushes the rules, not technically "disabling" them [00:17] tunabread: what do you get when you ping say google? [00:18] unknown host [00:18] if i try to ping DNS servers, network is unreachable [00:19] tunabread: what is the ipaddress? [00:19] 176.31.159.85 [00:20] i guess the problem might be in iptables [00:20] i'm not that experienced with iptables, a friend of mine set it up and defined the rules [00:21] if you know what file you need to see, just tell me [00:21] if he did it right than he should have saved them in a .rules [00:21] hopefull in /etc [00:21] look for something like /etc/iptables.rules [00:21] yes, there is a file [00:22] can you paste them here: paste.ubuntu.com [00:23] the rules [00:24] i only have VNC, so i can only take a screenshot or type them down manually [00:24] http://web219.server-drome.info/web/iptables.png [00:24] just say if i shall type them for you [00:26] tunabread: well i couldnt see that screen so do you want to re-enable those rules? [00:27] first, i would like to gain network access again [00:27] like, at all [00:29] tunabread: did you have access when you had the rules up? [00:29] yes. [00:30] i changed the sshd config, and reloaded sshd [00:30] well then we should probably put them back. have you tried that yet, re-enabling rules? [00:30] no [00:30] tunabread: what is the name of that .rules file? [00:31] iptables.rules [00:31] iptables-restore << /etc/iptables.rules [00:33] tunabread: it work? [00:34] the VNC is using a very strange keyboard layout, i'm struggeling to find the << [00:39] tunabread: if you can find the keys you can just re-enter the rules manually [00:40] i found a way, ALT+60 on keypad [00:40] kk, check the rules with iptables -L [00:42] iptables seems to hang up when i enter your command [00:43] take away one of the < [00:43] iptables-restore < /etc/iptables.rules [00:45] iptables-restore v1.4.4: no command specified [00:45] Error occured at line: 16 [00:46] Try 'iptables-restore -h' or 'iptables-restore --help' for more information. [00:47] did you enter entire command? [00:47] as it should show: [00:47] yes. [00:47] well you entered something wrong [00:47] tunabread: what is the location of that iptables.rules file? [00:47] /etc/ [00:49] when i cd into /etc/ and enter "cat iptables.rules" i get the right output [00:49] i entered: sudo iptables-restore < /etc/iptables.rules [00:50] well since your already in the /etc directory just do: iptables-restore < iptables.rules [00:50] i tried, same output [00:50] what does error line 16 mean ? doesnt it try to parse the file already ? [00:51] i would need to see the content of the file [00:51] yes [00:51] there is an error at line 16 of the rules [00:51] i just finished typing [00:51] http://pastebin.com/9tYX1qkV [00:52] the -ü in line 10 is a typo, it does not exist in the real file. sorry [00:54] http://pastebin.com/rcJxUV0q [00:54] two typos corrected [00:55] i am pretty sure that these rules were used before [00:55] since he noted that in the install-log [00:55] we have a log were we both write down everything we change [00:56] tunabread: remove that space underneath the last rules listing in the file [00:56] he also noted the name and location of the file (iptables.rules) [00:57] tunabread: also the naming is wrong [00:57] or else you typed it wrong when you typed cat iptabls.rules on the paste [00:57] tunabread: but remove that space under line [00:57] yes, i typed it wrong. sorry [00:57] what space under line ? [00:58] line 17 ? [00:58] no [00:58] you are counting wrong, line 16 is the space, 15 is the rule, according to your paste [00:59] there is a blank line, and i shall delete that ? [00:59] the line after -A INPUT -j DROP ? [01:00] yes [01:01] ok [01:02] it worked, no error, and iptables -L shows all the rules [01:02] check net [01:03] network is unreachable [01:03] do the rules make sense to you ? [01:03] honestly i didn't really look, just looked at the error line [01:04] do you know an acceptable picture hosting service ? [01:04] so youve changed the ssh back and readded the rules [01:04] yes [01:04] still no net [01:04] yes [01:04] what would you check ? [01:05] tunabread: what does ifconfig show [01:06] http://imageshack.us/photo/my-images/259/ifconfig.png/ [01:06] i hope thats acceptable [01:06] http://imageshack.us/photo/my-images/208/iptables.png/ [01:07] your not pulling an ipaddress [01:07] oh [01:08] it is possible that my ISP screwed something up. at least, i would not be suprised by that. [01:08] just mentioning [01:08] how does the vserver work? [01:08] host? [01:08] they say KVM [01:09] what details do you need ? [01:10] so you have a host server providing a kvm virtual machine which you are trying now? [01:10] they call it "full kvm", it behaves like a root [01:10] i can insert any iso to boot from, and install [01:10] i can even install windows, os/2, whatever [01:10] its not a shared kernel [01:10] right [01:10] ok [01:10] it behaves like a dedicated root [01:11] but the hardware is emulated, i think by QEMU [01:11] if you can read german, you can look it up here [01:11] https://www.filemedia.de/vserver/lightbox [01:11] doesnt give that much details, tho [01:12] anyone here ask about kvm? [01:12] tunabread: one sec [01:12] :D [01:12] sandyd: hey [01:13] sandyd: so here is quick brief: [01:13] op: tunabread , is using a kvm vm but lost net access [01:13] sandyd: he deleted his iptables and changed sshd_config protocol setting [01:13] sandyd: after readding iptables i helped with and changing the sshd back he still does not have access [01:14] sandyd: ifconfig does not show an ip but i could be wrong there [01:14] sandyd: ifconfig output: http://imageshack.us/photo/my-images/259/ifconfig.png/ [01:14] If you are using KVM, ifconfig must show an ip [01:14] I suspect that the ip is not binding correctly [01:14] cat /etc/network/interfaces [01:15] THATS what i was thinking of lol [01:15] dang it [01:15] ^^run that and get output [01:15] flipping interfaces, wanting to see if bridge or anything [01:15] tunabread: take all commands from sandyd from here out [01:15] * stlsaint fades into fog..... [01:16] http://imageshack.us/photo/my-images/826/catinterfaces.png/ [01:17] all i got left is crappy VNC, cant copy&paste text since output is pixels .. [01:17] alright, tunabread, this is the part I am not sure about [01:17] thank you for your help stlsaint :) [01:17] that VM is supposed to have a static ip right? [01:17] yes [01:17] the ip was static for ages [01:17] well, you have configured the address as dhcp [01:17] i can set one in the manager i got. [01:18] it will not work like that. [01:18] i didnt touch that config, and it worked for months [01:18] ok [01:18] if you have a static ip, it should say something like [01:18] iface eth0 inet static [01:19] IP Address 176.31.159.85 [01:19] Gateway 176.31.159.81 [01:19] Netmask 255.255.255.240 [01:19] Nameserver 213.186.33.99 [01:19] Nameserver 134.91.66.55 [01:19] thats what my manager says [01:19] so, why dont we just configure it correctly ? [01:19] pastebining it right now [01:20] there are tabs that can't be created in irc :| [01:20] ok [01:20] you know that i have to type it in manually anyway ? [01:21] point [01:21] let see... [01:21] type this in. AFter the second line, there is a tab for everything [01:21] iface eth0 inet static [01:21] address 176.31.159.85 [01:21] netmask 255.255.255.240 [01:22] got that [01:22] dns-nameservers 213.186.33.99 134.91.66.55 [01:23] I think that is it, becuase you don't have any broadcast/network [01:23] its nameserver1 and nameserver2, right ? [01:23] sudo /etc/init.d/networking restart [01:23] yes [01:23] you might lose connection with the last command [01:23] so you replace everything under auto eth0 with the stuff I typed above [01:24] they do the VNC with some other machine, one level above [01:24] add the pre-up iptables-restore [01:24] you can even enter the virtual BIOS over the VNC thingy [01:24] so, no issue there [01:24] at the last line [01:24] done [01:25] try restarting the network using the command [01:25] i did [01:25] check ifconfig [01:25] the ip should be there [01:25] it says *reconfiguring network interfaces ... [01:25] don't seem to be have all the variables for eth0/inet. [01:25] failed to bring up eth0 [01:26] lemme check. might have made a typo [01:26] can you post a screenshot of the new network/interfaces? [01:26] if you have a VNC client, you could connect to the VNC server and look over my shoulder live ? [01:26] but i can do that, too [01:26] oops [01:26] I forgot the gateway [01:27] yes. [01:27] gateway 76.31.159.8 [01:27] place that before the pre-up iptables-restore [01:27] its configured differently in fedora lol [01:28] try restarting and see if the interface comes back up [01:28] same output for network restart [01:28] same error [01:29] post the output of cat /etc/network/interfaces [01:29] http://imageshack.us/photo/my-images/694/newinterfaces.png/ [01:30] you mispelled address [01:30] there is an extra d [01:30] or maybe i did [01:31] nah. just add the d in, remove the 1 from the nameserver [01:31] in fact, remove both lines [01:31] my fault [01:31] it should just be [01:31] dns-nameservers 213.186.33.99 134.91.66.55 [01:31] oh. ok [01:32] SIOCADDRT: No such process [01:32] Failed to bring up eth0. [01:32] (help) :C [01:33] add a 1 in front of the gateway [01:33] i mean in front of the 7 where it says gateway [01:33] so that its 176 [01:33] .*** [01:33] and restart [01:33] http://imageshack.us/photo/my-images/96/siocaddrt.png/ [01:34] same output. [01:34] ha ! [01:34] i found it [01:35] the gateway's last byte is 81 [01:35] not 8 [01:35] reconfig says OK [01:35] lol. more of my typos. [01:35] typical me [01:35] hehe [01:35] i'm incredible tired. [01:35] working now? [01:35] check the ping, tracert, .etc .etc [01:35] was too busy celebrating [01:36] yay ! [01:36] stlsaint, these are typos that usually lead people astray in the UF [01:36] ping to google DNS works [01:36] excelent :) [01:36] good to see that it works [01:36] i thank you very, very much [01:36] I advise you to back the file up [01:37] yes [01:37] your welcome :) [01:37] any idea how it got lost in the first place ? [01:37] sandyd: thank [01:37] thank you too, stlsaint :) [01:37] tunabread: stop changing stuff ;) [01:37] but :C [01:37] nope. There is nothing much that will change something from static to dhcp mysteriously [01:37] lol [01:38] i didnt touch network config [01:38] maybe someone else touched it? [01:38] no [01:38] most servers (if configured properly) have security logs [01:38] there are only two people with root access, me and a very, very good friend. who is on vacation in the wildness of norway without even cellphone. [01:38] i checked the logs [01:39] or rather, mine does. If you edit the interfaces, the warnings immediatlye sound [01:39] there is very, very few software running on this server [01:39] not sure what could cause that. ive never seen that before [01:40] we got another server, and my friend set up the logging so that the log is written to that server, too [01:40] and there is munin monitoring installed, and it showed nothing special [01:40] i restarted the server ? [01:40] and my ISP tends to do random changes to everything for no reason [01:40] maybe it was on dhcp first, but worked magically ? [01:41] tunabread: naw, i think something reverted it back to dhcp from static [01:41] well the reason i started changeing stuff in the first place: i need someone to connect to the server via SSH with an encryption of less than 128 bit [01:42] he lives in france, and encryption above 128bit is illegal there [01:42] so i thought, i give him a restricted user account and allow ssh protocol 1 for his account [01:42] not sure if thats a good idea [01:42] tunabread: simple temp password probably would not have sufficed? [01:43] tunabread, for all that is holy. WHO CARES. if he really wants to obey the law just email his password to the government [01:43] gen a ssh key at 64bit [01:43] send it over, and let him have fun [01:43] its still illegal, he isnt even allowed to download an SSH client capable of protocol 2 as far as i understood [01:43] how do i do that ? [01:43] tunabread, telnet? [01:44] hum [01:44] tunabread, i would not reduce security for all your other users just because the french are morons [01:44] he does not need root, he does only need access to his home dir [01:44] is there any _save_ way to do that ? [01:45] http://www.guyrutenberg.com/2007/10/05/ssh-keygen-tutorial-generating-rsa-and-dsa-keys/ [01:45] use DSA keys [01:45] ok [01:45] well it CAN be 128bit [01:45] just not above [01:45] then use dsa at 128bit [01:45] or use openvpn at 128bit [01:46] see, i'm not really experienced [01:46] so i try to keep the stuff on the server limited [01:46] i now know how to configure SSH and i know the bascis because i read thru them, and i think i did it safe [01:47] if its not installed, it cant cause problems [01:47] so use the ssh tutorial above [01:47] yes [01:47] thank you, i will try that [01:47] replace RSA with DSA, and you can generate under 1024 [01:47] would that encryption still need serious time to crack ? [01:47] not as secure. mind you, but it would be fine [01:47] tunabread, the problem is that even if your key is 128bit your stream cipher would probably be illegal [01:48] hum [01:48] i guess the proper way would be, not grant him access at all [01:49] i think i know what you mean, escott [01:50] does anyone have experience how it is handled in france ? not in theory, practically ? [01:51] you want the direct papers? [01:51] ? [01:56] i dont get that [01:58] ssh working again [01:58] actually, everything working again [01:58] tunabread, if your client already has the 256bit encryption libraries i would think he is already in breach of the law, and i dont see how you could get in trouble for letting his programs do the default thing [01:58] assuming you are not in france [01:59] i'm in germany [01:59] i have no troubles, but my friend in france has [01:59] i think its no big issue, too, but [02:00] tunabread, so check out the louve and the eiffel tower now, just in case you arent allowed to enter the country, but i really doubt they care. its not like they seize laptops at the border? [02:00] haha [02:00] well, he LIVES in france [02:00] tunabread, which means that every tourist visiting paris is violating the law every time they check facebook [02:01] isnt SSL 128 bit ? [02:01] i thought about that, too [02:01] many programs use encryption [02:01] without people even noticeing [02:01] *sigh* [02:02] tunabread, i cant imagine they have any ability to enforce this. its probably just something they throw at people who have already been arrested for some other computer crime [02:02] yeah i dont think they scan the french internet for encrypted data streams [02:04] tunabread, most ssl uses 128bit RC4 for the stream, but the key is going to be at least a 1024 bit public key [02:07] :@ i'm among crypto experts [02:07] you are all from NSA, arent you [02:08] tunabread, im just looking at what the web browser tells me [02:13] tunabread, this seems to be accurate http://rechten.uvt.nl/koops/cryptolaw/cls2.htm#fr [02:14] tunabread, which would suggest that as long as you keep your server out of france you should be in the clear [02:15] oh, nice [02:15] thank you very much [04:38] im trying to set up irc on empathy but cant join the group. do you use the hash infront of ubuntu? [04:39] To join the channel, yes so it would be #ubuntu (or whatever else you'd want, say a local groupd as well) [04:42] ok thanks === yofel_ is now known as yofel === SkippersBoss_ is now known as skippersboss [22:20] hi, just set up 12.04, while installing jedit editor in software center I saw download size is 40 Mb compared to 4 Mb .deb file on the home page, same with many other programs, why are they so large on ubuntu? Even when i install jedit fresh on windows its never 40 Mb