[00:00] sarnold: no, there's a separate, unmanaged network for the iscsi host and clients. [00:01] all the normal addresses are 10.1.x.x, and the iscsi ones are 10.0.x.x [00:01] keithzg: ah :) good, that should be far easier to do. [00:01] .. to the point of making me wonder why it doesn't just do that already? [00:02] ...yeah that's what's confusing me. Suddenly when I want to ping any host, for example, it's trying to ping from the unmanaged iscsi network. === cpg|away is now known as cpg [00:05] keithzg: 'ip route list' will show you the routing table, perhaps all you need to do is move the 'default' route to a different gateway? [00:06] sarnold: yeah, that makes sense, right now it's showing "default via 10.0.0.1 dev br1 metric 100" and should be 10.1.etc dev br0 [00:06] * keithzg can't seem to find in the documentation for "ip route" how to change that [00:07] I've been reading a bunch of security tutorials, but what is the best way to shield my LAN ubuntu server from internet traffic / etc. [00:07] keithzg: that's the anoying thing; back in the day when you wrote all your own ifconfig and route commands fixin these things was easy. now you've got to find the right incantation in /etc/network/interfaces to get done what you want. [00:07] do I have to like go to a library with a laptop & nmap my server's IP address? [00:08] lvmer: step 1: netstat -anp will show you what is open and which programs have those sockets open [00:08] lvmer: step 2: install ufw, it'll make configuring firewall really easy [00:09] sarnold: I have shorewall. Should I use ufw too? [00:09] lvmer: step 3: configure applications to only listen on interfaces you want them to -- sometimes you only want them to listen on 10.x or 192.168.x and sometimes you want them on * [00:09] lvmer: nah, one firewall thingy is enough. [00:09] ufw is just easy enough that people'll use it. :) [00:10] lvmer: I also like to make sure tha every program that listens on a network socket is confined by apparmor; the apparmor-utils package tool 'aa-unconfined' makes it easy to see which programs are listening but not confined. [00:10] keithzg: that almost sounds like incorrect network masks .. [00:11] sarnold: aaaah all I've done with apparmor is $ sudo apt-get install apparmor-profiles lol [00:12] sarnold: could be, I'm fairly dumb in regards to those specifics; I have both interfaces set for netmask 255.255.0.0 [00:13] keithzg: hrm. that sounds like it fits what you wanted in the first place. :/ [00:14] sarnold: so I got it right? I guess this is one of those perverse debugging moments where finding out one *hasn't* made a mistake is disappointing! [00:16] keithzg: well, obviously osmething is slightly wrong somwhere :) you've got the wrong results. I'm surprised though that it sounds to me like you should be fine. [00:20] sarnold: yeah, it's quite the conundrum [00:21] keithzg: can you pastebin the whole interfaces file? It might be overkill to the right person, but I'm not sure what specificxally to ask for. :) [00:22] sarnold: http://pastebin.com/dagKBUEw [00:23] there's probably some weird interactions with whatever systems the historical sysadmin of this infrastructure has set up over the years [00:24] keithzg: okay, I know nothing of the bridge stuff :) SO, with that caveat out of the way, the 'broadcast' addresses look incorrect; they should probably be 10.1.255.255 and .... hrm. [00:24] keithzg: is the 10.1.* a hole punched out of the middle of the 10.* range? [00:24] .. or are there two ranges, 10.1.* and 10.0.* ? [00:25] sarnold: in *theory* it should be two ranges, 10.1.* and 10.0.* [00:25] I'm tempted to just change the iSCSI addresses all to an entirely different range, though, see what that accomplishes [00:26] keithzg: okay; then the 10.255.255.255 ought to change to 10.2.255.255, the 10.255.255.255 ought to change to 10.0.255.255, and I think you need to remove the 'gateway 10.0.0.1' line completely; two gateways configured in one file is probably just asking for trouble. [00:27] sarnold: yeah I actually commented out the second gateway line recently, but it didn't seem to make a change so I figured I'd just paste the file as it had been for longer. [00:27] hehe [00:28] good debugging instinct. :) [00:28] hi everyone. does anyone know what the maximum amount of IPv6 addresses I can allocate on one system are? is it limited by memory? [00:30] shti: as far as I know, limited by memory; thousands ought to be doable on nearly anything; I'm not too sure about millions, but one hopes you could find out overnight :) [00:31] i figured as much, thank you [01:00] sarnold: thanks! that, along with a few other pieces of fiddling with other things that were wrong or conflictingly configured, seems to have solved nearly everything. Now I just need to tackle the actual iSCSI part . . . gulp. [01:01] keithzg: woot! :) [01:01] good luck there. that thing seems _huge_... === fenris is now known as Guest34244 === Gallomimia_ is now known as Gallomimia === fenris is now known as Guest9079 === micahg_ is now known as micahg [03:25] sarnold: I don't think apparmor even runs on startup. But I didn't find anything 'unconfined.' I only found 'enforce' and 'complain.' [03:26] lvmer: aa-status will give you details on what's running.. [03:26] sarnold: ops. I made a mistake. sshd & apache2 are 'not confined' [03:26] yeah, confining sshd requires administrator decisions [03:27] sarnold: hum. [03:27] and apache2 is so wide open that it is nearly impossible to provide a pre-written profile for it. [03:27] sarnold: hum. [03:27] sarnold: I installed both my servers the same way, but I'm thinking now... I only want samba on (1) of them. & I'll keep the other with everything to just fool around [03:28] sarnold: should I just remove apache2? and php5? [03:28] lvmer: I would; I try to keep what's running on my systems to just the minimum === n0ts_off is now known as n0ts [03:28] hey [03:29] for dpkg -l how can I output it to a file? lol [03:29] lvmer: dpkg -l > filename [03:31] sarnold: omg the paste doc is 500 long [03:32] yes, there are a lot of packages on a standard system. :) [03:32] sarnold: I have no idea what to remove & what not do lol :/ [03:32] sarnold: oooohhhh the horror: http://paste.kde.org/611126/ [03:33] am I allowed to remove vim? as I really just stick to nano. [03:34] $ apt-get remove vim vim-common vim-runetime vim-tiny ? xD [03:34] heh, funny, removing nano is the first thing I normally do. :) [03:35] sarnold: I kind of always understood programing, and setting up this server was frustrating, but it only took about a week. And now.... seeing this list of 500 things long.... I litterally have no idea what they are. I feel like a teenage girl looking at the task manager processor list. [03:36] the names will grow on you -- before long they'll be old friends. :) [03:38] lol [03:38] the 'deborphan' tool can help you clean up packages you're not using any more [03:39] though it probably makes less sense on a brand-new install than one that's been running for a few years [03:39] sarnold: so install to uninstall? I like it. :) [03:39] bind9 bind9-host bind9utils ?? [03:39] lvmer: yes, that does seem strange :) "apt-get install deborphan ; deborphan" --> _fewer_ packages installed... [03:40] at least bind9-host is nice to have, you can run 'host foo' and get IPs, reverse lookups, MX entries, etc. awesome little tool. [03:40] I just don't want to mess up my samba on this bad boy [03:40] aaahh ok. good to know. I shall keep it then. [03:41] ftp? [03:41] sure, it's just the client program [03:42] and sometimes wget or curl are annoying compared to an interactive ftp client. [03:42] so many libs [03:43] wait so uninstall ftp? or keep? [03:43] keep ftp [03:43] I do have 2 servers & this one is pretty much only samba [03:43] ok [03:43] you may never use it :) but it's nice to have when you do need it [03:44] mysql ? xd? [03:44] easy way to type all those bad names? [03:44] mysql-client .... client-core common server... etc. lol [03:45] just apt-get remove mysql-common will probably get all the rest of them -- they'll need the -common package to satisfy dependencies. [03:46] oh... so that happens automatically? [03:46] it'll prompt :) [03:50] if I remove bind9 ... it says dnsutils & ubuntu-standard also remove [03:50] bad? [03:52] sarnold: look how much progress I've made: http://paste.kde.org/611150/ [03:52] sarnold: lol xD [03:53] lvmer: 'nsupdate' from 'dnsutils' might be very nice to hold on to.. I don't know if it is used by default, but it -might- be... [03:53] yah I held on to them [03:54] sarnold: I can't seem to remove apache2.2-common is the file special? it shows up as 'rc' [03:54] lvmer: woo. :) that's pretty good. run deborphan and see if there are any libraries you don't need any more... that's probably enough, though. my development workstation has 1807 packages installed. :) [03:54] lvmer: 'rc' means 'remove configured' -- the configuratoin files are still there, in case you re-install, but the package isn't currently installed [03:54] lvmer: you can use dpkg --purge or apt-get purge to _also_ remove the configuration files [03:55] oh how do I get rid of those? [03:55] ah [03:59] could I type sudo apt-get remove vim-* ?? [04:00] try it with 'vim-*' -- with the quotes [04:01] if there is something in your current working directory that matches vim-, the shell will expand the * and not give the right results to apt-get [04:01] double or single? [04:01] either [04:02] (that tip goes for way more than just apt-get -- if you want to find all files ending with .orig, you should also use quotes here: find . -name '*.orig' ) [04:02] sarnold: :) k [04:03] installed deborphan [04:03] ah. -a [04:04] http://paste.kde.org/611180/ [04:05] anything weird? [04:05] maybe mysql-client-core-5.5 [04:06] if you don't care about mysql or mysql clients on this machine, you can remove that [04:06] sarnold: my computer is a dell 4500 from 2001... it is impossible for it to use wireless should I uninstall wireless stuff? [04:06] I did remove most mysql [04:06] lvmer: you could remove the wireless stuff if you want, but that might threaten to remove things you want to keep [04:07] ah [04:07] how much memory is in this system? if four gigabytes of RAM or less, you can probably also ditch the linux-generic-pae kernel [04:07] 1gb lol... [04:07] if that [04:07] sarnold: For recent releases it's all PAE [04:07] I'll check [04:07] ScottK: oh?? [04:08] lvmer: don't touch linux-generic-pae :) [04:08] ScottK: thanks :D [04:08] amd64 has been all PAE for awhile and i386 as of 12.10. [04:08] sarnold: I actually surprisingly have 2gb.... wow. [04:08] ooh [04:08] speed demon from 2001 :) [04:09] Now that I think about it... I think I threw away the 2 computers from 2000 & 2001... this bad boy might be an 03 xD [04:09] makes sense to drop plain old x86 kernels. they're definitely the minority these days and the pae kernels probably boot pre-pae machines just fine. [04:10] what is whoopsie and getty? [04:10] gam_server? winbindd? [04:10] lvmer: whoopsie handles the "this program has crashed, send a report?" crash reporting service; getty provides the login: prompt on your consoles. [04:11] sarnold: um.... I have a lot of 'getty -8 38400 tty' [04:11] sarnold: in 'htop' [04:11] lvmer: probably seven? :) [04:11] .. or six? [04:11] sarnold: .... lol [04:12] sarnold: ok you win [04:12] one for each virtual console, alt+f1, alt+f2, alt+f3, .. , alt+f6 [04:12] X runs on alt+f7 [04:12] sarnold: o [04:12] sarnold: never used alt+ any f [04:12] you probably have to use control+alt+f1 to swap to the virtual consoles from within x [04:13] sarnold: I'm on putty too btw. [04:13] landscape-common ? [04:13] landscape.ubuntu.com -- a management framework [04:17] The following packages will be REMOVED: [04:17] crda* linux-generic-pae* linux-image-3.2.0-29-generic-pae* linux-image-3.2.0-33-generic-pae* [04:17] linux-image-generic-pae* wireless-regdb* wireless-tools* [04:17] good or bad? lol [04:18] bad :) [04:20] * ScottK has a computer from 2001 running precise. [04:20] scottk: lol how you do that? [04:20] ScottK: you haven't replaced it with a pandaboard? :) [04:20] sarnold: oooo bad? dang. lol [04:20] * ScottK doesn't usually replace working hardware. [04:20] Also it's my test server. [04:20] ........ lol [04:21] I must know how to *** [04:21] lol [04:21] * test [04:21] lol [04:21] * ScottK also has one from 1999/2000 running Hardy (it missed the ACPI cutoff date in the BIOS, so that's the latest it can run) doing file storage. [04:22] * lvmer test [04:22] lmao [04:22] ScottK: yeah, I can definitely understand that urge. but man, a few watts, no heat, no fan... granted, storage speed on panda is s s l l o o w w [04:23] test [04:23] lvmer: /me test [04:23] oh I see you already found it [04:23] sarnold I know I did it up there xD [04:23] sarnold: what is umode? [04:23] They help keep the basement warm. [04:23] lvmer: time to learn a new tool :) "apt-cache show umode" [04:23] ? lol [04:24] ScottK: hehe [04:24] unknown command [04:24] ohhh, umode, that must be from your irc client -- user modes [04:25] lvmer: still, it's time ot learn a new command :) try "apt-cache show ureadahead" [04:25] no way [04:26] I'm not cache'ing anything [04:26] lol [04:26] what does it do? [04:26] * lvmer lvmer is not so gullible [04:27] lvmer: apt-cache will show you data from the packages visible to apt-get [04:27] oh lol [04:27] apt-cache search and apt-cache show are two immensely useful little commands on debian / ubuntu systems [04:28] * lvmer has just realized [04:28] ok I'm going to stop that before I get banned. lol. I appriciate it. I'm checking it out. btw: I couldn't find 'umode' lolz :p === kInOzAwA is now known as Guest45163 [04:30] lvmer: about umodes: http://freenode.net/using_the_network.shtml [04:31] sarnold: yup. :) thanks again. :) [04:33] 'night lvmer :) [04:33] sarnold: good night [04:48] I have no swap space.... is this bad? I'm running lvm2. & I just noticed in htop: swp 0/0MB [05:22] lvmer: how much RAM do you have? [05:35] greppy: 2GB.... I sware I thought I had swap when I installed. I don't see it anymore though... in df -h or fstab or htop. [05:49] Depends on what you're doing with the box. [05:51] it's only bad if you require more memory to perform the tasks you're attempting === Gallomimia_ is now known as Gallomimia [07:19] Hi all, is there an official channel for Ubuntu Cloud? [07:19] have some doubt related to Ubuntu Cloud Live CD [07:49] ranjan: here is fine to ask [07:54] can you help me with roundcube? #roundcube is kind of dead [07:58] lifeless, how can i use nova-volume in ubuntu cloud live? [08:01] Kartagis: what kind of help? [08:02] blkperl: I'm getting "Make sure that the configured database exists and that the user has write privileges DSN: " but the database is there [08:03] ScottK: what do you think of https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/1027061/comments/14 ? [08:03] Launchpad bug 1027061 in postfix "Postfix upgrade to 2.9.3-2~12.04.1 changes configuration files" [Wishlist,Invalid] [08:08] Kartagis: what do the database logs say? do they show failed connection attempts [08:09] blkperl: nothing in roundcube logs. do you mean imap server logs? [08:12] Kartagis: what database are you using? mysql, postgres? [08:12] sqlite? [08:12] mysql [08:12] go look at those logs [08:12] also check that the user has write privs in mysql [08:14] create database db;grant all on db.* to user@localhost identified by 'pass'; <--- this was my line [08:16] can you connect to the database from the roundcube server? [08:17] yes [08:19] I've also imported the databasr schema. that must mean I have at least INSERT access, no? [08:20] hi [08:20] how can i see which program on my server is causing 2.79 load average.... but cpu usage is low [08:21] htop [08:21] why htop [08:21] over regular top [08:21] it is more detailed [08:21] oh [08:27] well [08:27] transmission daemon is using like 10% cpu and 11% mem [08:28] its the most active process i have... yet my load average is very high === ranjan is now known as Guest90825 === n0ts is now known as n0ts_off === acidflash_ is now known as acidflash [10:12] Hi, I'm using automatic updates on some servers. Now it mails me that a reboot is required, but only the make package has been updated. I'm not used to linux requiring reboots for anything but kernel (services are usually just restarted when updated). This however is neither a service nor a kernel and make isn't actively used either :/ [10:26] check are you running the latest kernel [10:27] uname -a and compare to files in /boot [10:40] vezq: heh thx, my spamfilter ate that e-mail :/ [10:43] it was consistent tho', it ate all of the auto update messages from that day. Must not like some package === n0ts_off is now known as n0ts === Akendo_ is now known as Akendo === Akendo_ is now known as Akendo === kInOzAwA is now known as Guest33607 [12:13] Does anyone know how to change metric settings on my l2tp vpn settings like that checkbox on Windows, because i'm connected and it works but all pages are blocked right know === mdeslaur_ is now known as mdeslaur === mcclurmc_ is now known as mcclurmc [13:06] When one rsync a directory to another, does it just send the changed bytes or the whole file is transfered for each modification ? [13:11] changes only [13:11] well, there's some caveats to that [13:13] but yes, it only transfers changed bytes by default [13:18] cool thank you [13:18] Does anyone know how to change metric settings on my l2tp vpn settings like that checkbox on Windows, because i'm connected and it works but all pages are blocked right know [13:20] Regarding inotify, if i lookup a folder by registering to its events, does it watch automatically every child folders in it ? [13:21] qman__: how about if there are some deleted files from source? [13:23] nopz: from the manual: Inotify monitoring of directories is not recursive: to monitor subdirectories under a directory, additional watches must be created. [13:24] Ho thank you RoyK, do you have a link pointing to that? [13:25] Ok it's at the bottom of the man page [13:31] rbasak: I think the package is designed to use debconf and since they didn't, they are on their own. That said, I think it would be a useful improvement. [13:33] ScottK: I think puppet is probably doing DEBIAN_FRONTEND=noninteractive apt-get install postfix, and then the postinst is clobbering main.cf [13:33] ScottK: is that your understanding when you say they're on their own? [13:34] (I haven't verified this though) [13:40] ScottK: need to go offline but I'll check the logs to see if you've responded. === cpg is now known as cpg|away [13:50] ScottK: I decided to add a comment there. (1027061) [13:50] lamont: Thanks. === rnbrady_ is now known as rnbrady [14:11] quick question : what is the best way to upgrade the kernel in an Openstack/canonistack instance ? [14:11] without using a different cloud image, just need to test a new kernel [14:25] hi [14:26] Hey jamespage, My Cinder + Ceph is working. But without authentication [14:27] Akendo, libvirt uuid still proving problematic? [14:27] Just a question out of my mind, can it be that you have to create a extra client instead of using client.admin for this? [14:27] Yes [14:27] I'll solve it late, I just wanted to ensure that the connection is working. [14:28] Akendo, I do that yes; client.admin is like 'root' whereas cinder only needs access to pools/rbd's [14:29] But shouldn't it be possible to use this "root" for everthing in the beginning? This is justa proof of concept for me, it shound't have to much complexbility [14:31] Akendo, what rbd_user did you specify? [14:32] For now admin [14:32] But late I think it will be one use per tenant [14:32] So that this tenant have it's own access credentails [14:32] Akendo, I think thats right [14:33] First I have to get a feeling for Ceph with OpenStack ;-) [14:34] One Question, that keeps going torugh my mind is: How does the single pool per tenant will behavior with this placement groups? It's a "hard" limit for my Pool? [14:49] hallyn: hey. looks like bug #1057024 is still not done. i just posted [14:49] Launchpad bug 1057024 in qemu-kvm "kvm kernel module always loaded, without setting /dev/kvm permissions" [High,In progress] https://launchpad.net/bugs/1057024 [14:51] jamespage: ping [14:51] zul, pong [14:51] jamespage: fyi the quantum proxy ip stuff got merged into the stable/folsom tree [14:52] zul, yeah - I've been watching gerrit mp's [14:52] w00t! [14:52] jamespage: ok cool [14:52] zul, thanks for pushing on that btw [14:52] Akendo, not sure single pool per tenant makes sense? [14:52] jamespage: no worries all a part of the days work.. [14:53] Why not? [14:53] Akendo, well the pool in ceph is completely abstracted from the users of Openstack [14:54] Sure [14:54] Akendo, and you can only configure it once in cinder, and not on a per tenant basis [14:55] Ah [14:55] Really? [14:55] hm... [14:55] That indeed a problem then I didn't think of yet [14:57] pmatulis: the p11-kit thing is separate and was supposed to be fixed long ago. but yes, there is also the new bug 1080912 i'm trying to reproduce right now [14:57] Launchpad bug 1080912 in qemu-kvm "package qemu-kvm 1.0+noroms-0ubuntu14.4 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1" [High,New] https://launchpad.net/bugs/1080912 [14:57] slangasek had wanted me to change the fix for that bug, and the new way doesn't seem to be as robust as doing it by hand [14:57] pmatulis: do you still have access to that box? [14:58] well lemme see how my box does after a 11.10->12.04 upgrade [15:00] hallyn: indeed i do [15:02] pmatulis: great - what does /dev/kvm look like? (ls -l and getfacl) [15:03] hallyn: not good at all i'm afraid [15:03] sudo ls -l /dev/kvm [15:03] ls: cannot access /dev/kvm: No such file or directory [15:06] pmatulis, modprobe kvm is working? [15:08] Akendo: yes it does, that looks like the beginning of a workaround [15:08] What is lsmod |grep kvm displaying? [15:09] Akendo, hallyn: indeed, after loading the module i can start my guests [15:09] pmatulis: do you ahve the ugprade logs? did 'start qemu-kvm' fail? [15:09] ;-) [15:09] bc that should have loaded the module [15:09] hallyn: let me take a look for the logs [15:10] hallyn: note that i rebooted twice. once after the upgrade, and once again after upgrading qemu-kvm [15:10] (-proposed) [15:10] hm. [15:11] so it wasn't loaded at all after reboot. that's bad. and weird [15:11] hallyn: agreed [15:11] hallyn: i'll update the bug [15:11] pmatulis: to be sure, did all work well under oneiric on that box? [15:13] anyone running a 12.04 based OpenStack with Quantum + Open vSwitch? [15:13] That can happend from time to time, then you should add kvm to the /etc/modules.conf [15:14] Can you past me via pastbin the dmesg output? [15:14] hallyn: yes, all worked very well on 11.10 [15:14] ah === matsubara is now known as matsubara-lunch [15:14] btw: /etc/modules for Ubuntu [15:17] can someone help me translate this EDAC info into a which DIMM is actually reporting errors? EDAC MC1: CE row 1, channel 0, label "CPU#1Channel#0_DIMM#1": Corrected error (Socket=1 channel=0 dimm=1) ... my manual/board labels the DIMMs P1_DIMM{1,2,3}{A,B,C} & P0_DIMM{1,2,3}{A,B,C} [15:19] pmatulis: odd, my test box had /dev/kvm just fine :( [15:19] pmatulis: i suspect yours deserves a new bug [15:19] wonderful [15:24] jamespage, Do you know of any bug in glance that can't list the uploaded image to ceph? [15:27] I see there are what look like tokens in the Ubuntu Openstack supplied configuration files. Things like %SERVER_USER%. Most of the tutorials call for you to replace these but is there a better Canonical way for configuring the services? [15:30] Hey ninjix [15:30] Checkout the nimbis-keystone-init on github [15:30] Akendo: hi [15:31] Maybe not whay you mean, but it can help you to setup all important stuff for you [15:31] Then your using a tenant called service [15:32] I hope this can you help [15:33] thanks. I've been holding off with the helper scripts while I familiarize with the Folsom release [15:33] Great ;-) [15:34] then wants I understand how to better use Quantum and Open vSwitch, I'm going to look into a MaaS+Juju rollout [15:35] wants ?? -> once :) [15:37] Akendo: are you running Openstack? [15:38] Akendo, not that I know of - I have not seen that issue [15:40] Akendo, just out of interest can you see it with nova image-list ? [15:42] Akendo: sorry, better question is are you running it in production? === matsubara-lunch is now known as matsubara === rnbrady_ is now known as rnbrady === paskal is now known as tarzxvf [16:31] I'm getting millions of lines like this in my syslog: "Nov 20 10:30:14 ntop ntop[1180]: **WARNING** Packet # 37334012 too long (len = 2546)!" What's that mean? [16:55] I've got a LAN server with just samba on it. Is there a good way to maximize the computer solely for samba? aka: like dedicate lots of ram to caching files that are typically requested, etc. === n0ts is now known as n0ts_off [17:00] That'll happen automatically for you [17:01] rbasak: really? [17:01] The kernel uses available memory to cache what it can [17:01] in [global] I setup: socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536 [17:01] I was thinking about doubling it to 131k or so [17:02] rbasak cause right now my server is only using 62mb of ram.... lolzzzzzzz === yofel_ is now known as yofel [17:03] ops I thought I was in the samba channel. -_- [17:10] sshd is 'not confined' by apparmor, how shall I change this? [17:14] gah [17:14] bad changelog [17:14] lvmer: that is acually a particularly challenging application to confine because it is designed to spawn shells [17:14] lvmer: I recommend looking at http://wiki.apparmor.net/index.php/Pam_apparmor_example [17:15] lvmer: you might also want to join #apparmor on OFTC and discuss it there [17:15] jdstrand: ah. :/ yes I did #apparmor. I was guessing it would be easy with only 1 sshd allowable computer / ip. [17:16] jdstrand: ty for the starting place. I am looking through it now. [17:16] lvmer: the experts in #apparmor usually don't come online until around now [17:16] lvmer: it's little point adding IPTOS... and the SO_ stuff - the default values are ok === Akendo is now known as Akendo_ [17:17] lvmer: that is, unless you're on a 10Gbps network and really want full throughput, all the default values should be ok. It'll be either your network or the I/O on the server being the bottleneck [17:18] royk: yup you seem right on that. noticed no difference. [17:18] royk: definitely server I/O [17:18] royk: 12 year old computer ftw... lolz. [17:18] lvmer: what sort of disksystem? [17:18] single IDE drive? ;) [17:18] royk: IDE lol [17:18] royk: 3 stripe raid [17:18] raid-5? [17:19] royk: but the dell motherboard is attrocious [17:19] royk: raid 0 [17:19] royk: lol trust me, it doesn't help much with the bus speed of this Dell. [17:19] raid-0 is a bit like BASE jumping with an umbrella... [17:20] royk: all information has 2 other separate backups & is non-essential. I know the risks. [17:20] * RoyK uses RAID-6 for most stuff these days [17:20] royk: I'm actually hoping these hd's fail so I can buy a $300 computer this christmas [17:20] well, obviously, if you handle the downtime and restore, no problem [17:20] royk: lol that will def. be the hard part. [17:20] * RoyK wants uptime... http://xkcd.com/705/ [17:21] royK: but the server is only 1 week old.... & I've re-installed 2x already from stupid mistakes. so I don't think it'll take more than 1 day. [17:21] royk: trying to configure rsync for configs, but right now I just copy/paste them to NAS [17:21] if you can do with the space on two drives, use raid-5 and change later or add more drives later [17:22] that is, if you have a NAS, why do you want a fileserver? [17:22] royk: ide drives? no freaking way [17:22] royk: cause it's a windows temp. nas lol [17:22] royk: and it sucks [17:23] royk: also this was mostly just supposed to be a fun project to get my feet wet.... into linux which is clearly much faster. [17:23] you can get a mobo + cpu + memory for almost nothing, probably $150 will go a long way [17:23] royk: ok last question.... here I'm done explaining my logic lol. idc if it is flawed. [17:23] or at least $200 [17:23] royk: yes... that is why I est. $300.... [17:23] royk: 3TB HD... xD [17:24] royk: which will be sata [17:24] lvmer: install sysstat and start it, and it'll collect performance data for you [17:24] or perhaps munin [17:24] royk: why? [17:24] you'll see quickly where the bottleneck is [17:24] royk: k [17:24] sysstat / sar is basically terminal stuff, munin makes nice graphs [17:25] royk: ok how do I use this? never used sysstat [17:26] nvm I got a tut [17:26] apt-get install sysstat - vi /etc/default/sysstat - enable it - /etc/init.d/sysstat start [17:26] run 'sar' [17:27] !uupdate [17:28] royk: ? [17:28] just tried to ask the bot about uupdate [17:28] o [17:28] !uupdate [17:28]