| halvors | Hi! Anyone know how to setup and enable nagiosgrapher? I've installed it and enabled "process_performance_data=1" and "service_perfdata_file_processing_command=process-service-perfdata" in the nagios.conf :) But no hosts is showing up :( | 00:05 |
|---|---|---|
| === PixelCrumbs is now known as [PixelCrumbs] | ||
| === [PixelCrumbs] is now known as ASDF___ | ||
| === ASDF___ is now known as PixelCrumbs | ||
| === PixelCrumbs is now known as _- | ||
| === _- is now known as PixelCrumbs | ||
| === PixelCrumbs is now known as Pixel_Breaky | ||
| === Pixel_Breaky is now known as PixelCrumbs | ||
| ruben231 | hi gusy how do i find huge file size on my ubunt server | 01:08 |
| ruben231 | i ahve storage of 98 pecent but cant see whihc file are having this huge file size any idea..? | 01:08 |
| RoyK | find / -size +something | 01:09 |
| RoyK | man find | 01:09 |
| RoyK | best place to start is /var/log | 01:09 |
| RoyK | or start with | 01:12 |
| RoyK | du -sch /var /home | 01:12 |
| ruben231 | 82G /var | 01:16 |
| ruben231 | 58G /home | 01:16 |
| ruben231 | 140G total | 01:16 |
| RoyK | so how large is the filesystem? | 01:17 |
| RoyK | I need to sleep - talk tomorrow | 01:17 |
| ruben231 | http://pastebin.com/XKvuhyaE | 01:18 |
| ruben231 | please | 01:18 |
| ruben231 | wait | 01:18 |
| bobbyz | ruben231: You could always 'find / -type f -printf "%s %p\n" | sort -n | 01:56 |
| bobbyz | ruben231: keep in mind sort uses space in /tmp though | 01:58 |
| lamont | 05:18 | |
| === PixelCrumbs is now known as Sarcasm | ||
| === Sarcasm is now known as PixelCrumbs | ||
| vedic | Which virtualization software do you recommend? I have an 8 core Intel server with 8gb RAM and 300GB HDD. Need to create a virtual machine which can run 24x7 without any need for maintainace or reboot. | 07:10 |
| vedic | Locally I have been using Virtualbox. But not sure if that is suitable for long running as a server | 07:10 |
| geofft | I wouldn't use Virtualbox on a server; that's not its intended use case, really. | 07:11 |
| geofft | kvm (possibly via virt-manager) and Xen are both quite fine | 07:11 |
| vedic | geofft: I was thinking XEN but need second opinion. Is it easy to setup? | 07:12 |
| geofft | I haven't used it on recent Ubuntu versions, but in my experience, yes | 07:14 |
| vedic | geofft: Which guest type is preferred ? PV or HVM ? My needs include mathematical application and a lot of number crunching. That may include clock timing requirements for random numbers etc. | 07:21 |
| snowdrop | Greetings from Sweden all. Just installed ubuntu-server on a virtual server, and all works, but I haven't understood one basic thing: Which user is "logged" when the virtual server reboots? For example, which users crontab will be in effect after a reboot? | 07:24 |
| geofft | vedic: PV. Xen's HVM support is primarily for OSes that can't be run as PV | 07:42 |
| === PixelCrumbs is now known as OresomeBot_ | ||
| === OresomeBot_ is now known as PixelCrumbs | ||
| === PixelCrumbs is now known as Pixel_Zzzzz | ||
| yousaf | how I do list the current list of php processes? | 12:04 |
| loostro | hi | 12:41 |
| loostro | i'm haveing a problem setting up a apache2 server on ubuntu, is this the right channel to ask? | 12:42 |
| loostro | (and i suspect this is not apache2 issue, but something wrong with my router/connection settings/port forwardning) | 12:43 |
| === loostro_ is now known as loostro | ||
| duckstep | i just created a new raid5 volume with mdadm, got it configured and rebooted to confirm all settings were correct | 13:07 |
| duckstep | volume wouldn't mount properly | 13:07 |
| duckstep | i try to mount it manually and find the device in /dev has changed from /dev/md0 to /dev/md127, but all of my data is still there | 13:08 |
| duckstep | any thoughts on what i might have done wrong? | 13:08 |
| duckstep | here is what i have in /etc/fstab | 13:08 |
| duckstep | UUID=f70b9a0f-cf0aa0a2-9e5cf3fd-c44046b8 /media/storage ext4 defaults 0 0 | 13:08 |
| Quest | how can I restrict users to only use one command ("passwd") to just be able to change their password. and cannot do anything else in console? how is it possible? | 13:09 |
| hallyn | geofft: yeah, that ppa is years old, and yeah i saw tpm related patches flying by the list recently... sorry i don't kno wof anyone working on tpm+qemu right now. | 13:09 |
| Quest | Pici, geofft you there? | 13:33 |
| Quest | how can I restrict users to only use one command ("passwd") to just be able to change their password. and cannot do anything else in console? its for just giving them sftp acces. how is it possible? cant do it with rssh | 13:40 |
| Quest | may be RoyK would know | 13:43 |
| RoyK | if you use rssh, users can't login | 13:48 |
| RoyK | how many users? | 13:48 |
| RoyK | and why so paranoid? | 13:49 |
| === rocket is now known as Guest38867 | ||
| patdk-lap | only sftp? without scp? | 13:58 |
| * patdk-lap goes paranoid though | 13:59 | |
| patdk-lap | users can change their password in webmail | 13:59 |
| patdk-lap | and on the sftp box, I unset all sticky user/group settings from all programs | 13:59 |
| yousaf | To start my application I need to run "start socialapi", but I can't find "start" anywhere | 14:15 |
| Quest | RoyK, 50-100 | 14:20 |
| Quest | RoyK, chroot might be better option? | 14:23 |
| Quest | what does %h means in http://www.fpaste.org/DQdA/ | 14:23 |
| Quest | and should the ForceCommand internal-sftp be ForceCommand /usr/lib/openssh/sftp-server | 14:23 |
| RoyK | Quest: chroot means you'll need to link in libs an other binaries | 14:31 |
| RoyK | Quest: if the system is secure, like most are, allowing logins shouldn't be a problem | 14:32 |
| RoyK | Quest: at work, we use a homegrown webinterface for users to change their passwords across several systems. I guess there should be some around for just changing unix passwords | 14:35 |
| RoyK | Quest: as usual - please google first | 14:36 |
| Quest | how do you give web interfaces for changin password? | 14:36 |
| Quest | RoyK, ^ | 14:36 |
| Quest | RoyK, i just dont want even anyone the use ifconfig eth0 | 14:37 |
| RoyK | why not? | 14:37 |
| RoyK | it'll just show the ip address and mac address and so on | 14:37 |
| Quest | no one should do anything that their dont need to | 14:37 |
| Quest | first rule | 14:38 |
| RoyK | no, the first rule is "noone should be able to administer the system" | 14:38 |
| Quest | no one should do anything that they* dont need to | 14:38 |
| RoyK | so what if they can run ifconfig? | 14:39 |
| Quest | RoyK, thats not a rule. thats implicit | 14:39 |
| Quest | RoyK, nothing... but why give info for a hacker that . look heres my ip config for all ehos. ipconfig is just one example | 14:39 |
| RoyK | oh | 14:40 |
| RoyK | ipconfig doesn't exist, btw | 14:40 |
| wickedpuppy | ... | 14:40 |
| RoyK | the problem with newbies, is that they are afraid of users | 14:40 |
| Quest | sory ifconfig | 14:40 |
| Quest | thats a good problem then | 14:41 |
| Quest | how do you give web interfaces for changin password? | 14:41 |
| RoyK | Quest: have you even tried googling that? | 14:42 |
| Quest | ok | 14:42 |
| * RoyK ignores Quest | 14:42 | |
| Quest | what does %h means in http://www.fpaste.org/DQdA/ | 14:42 |
| Quest | and should the ForceCommand internal-sftp be ForceCommand /usr/lib/openssh/sftp-server | 14:42 |
| Quest | RoyK, dont answer / chat with me if you do ignore on me one more time | 14:42 |
| Quest | and use /ignore not /me ignores Quest | 14:43 |
| Quest | for good | 14:43 |
| Quest | google that for its use | 14:43 |
| RoyK | Quest: I've helped you with a lot of things, but I ask you, kindly, again, to please bloody google things before spamming this channel | 14:43 |
| Quest | for that i am really thank full | 14:43 |
| Quest | really appriciate it | 14:43 |
| Quest | :) | 14:43 |
| Quest | but saying ignoring is not friendly | 14:44 |
| Quest | its like you are giving a peny to a begger and spiting on his hand as well. i dont need such penies | 14:44 |
| RoyK | Quest: well, ignoring my repetitive requests for you to try to google things before you ask here, and then, when you get an answer, repeat the question, is not very friendly either. it makes people like me who likes to help newbies want to ignore them all the way | 14:45 |
| RoyK | so please, jfgfi | 14:45 |
| === security is now known as fire | ||
| Quest | why theres a need to adduser to a group of its own name? why not add most users to one group only? | 15:10 |
| shauno | that's an option, just not the default | 15:13 |
| Quest | shauno, adduser userName adds the userName to the groupd called userName by default (and makes /home/userName even -m is not supplied) | 15:14 |
| maxb | Quest: The practice of making a user's primary group one dedicated to that user is indeed a bit obscure | 15:23 |
| maxb | It has to do with the concept of 'umask' | 15:23 |
| maxb | umask determines what the access privileges assigned to newly created files are | 15:23 |
| Quest | maxb, so adding users to their own group name is neccesry? | 15:24 |
| maxb | It's not necessary, but it is the de facto standard way to implement the ability to share write access to files using groups | 15:24 |
| Quest | maxb, ok. whats the command to add a user and while adding, add the user to its own group (named as the user name) and to 2 more groups? | 15:25 |
| maxb | The idea goes as follows: If you set up users with their own group, then you can set the default umask to one which allows the group write access bit for new files to be on, without actually giving access to other people | 15:25 |
| Quest | hm | 15:26 |
| maxb | Then, when you want a directory tree where write access *is* shared between a group of users, you can chgrp that tree and set the directory setgid bit so that new files are also group-owned by that group | 15:26 |
| maxb | It is a fairly obscure use case | 15:26 |
| Quest | i see | 15:26 |
| Quest | ok | 15:26 |
| Quest | whats the command to add a user and while adding, add the user to its own group (named as the user name) and to 2 more groups? | 15:26 |
| maxb | But it is the only concrete reason I've ever come across for the pattern of defaulting to creating these 'usergroups' as they are typically known | 15:27 |
| maxb | Are you using 'adduser' the Debian/Ubuntu friendly helper, or 'useradd' the lower level tool? | 15:27 |
| Quest | yes | 15:27 |
| Quest | adduser | 15:28 |
| maxb | That was an either/or question, yes is not a valid answer :-) | 15:28 |
| Quest | i stated adduser | 15:28 |
| maxb | It looks like you need to create the user and then add the additional group memberships in a second command | 15:29 |
| Quest | ok | 15:29 |
| Quest | whats the commands? | 15:29 |
| maxb | 1) adduser [options] username | 15:30 |
| maxb | 2) adduser username groupname | 15:30 |
| maxb | adduser does different things depending on whether you give it one or two names | 15:30 |
| maxb | Which is a little obscure at first | 15:30 |
| Quest | my /etc/groups stats testing:x:1005: but groups testing says groups: testing: No such user | 15:34 |
| Quest | whats wrong | 15:35 |
| maxb | Huh, weird. Somehow I've managed to go a decade plus of using Linux without coming across the groups command :-) | 15:37 |
| maxb | But 'man groups' tells me that groups takes a username, and you appear to be misunderstanding it as taking a groupname | 15:38 |
| Quest | k | 15:40 |
| Quest | i just $ sudo service ssh restart . it did restarted and iam on that shell (i didnt disconnected) but now i cannot ssh to that computer by any account. it says connection refused. whats wrong? | 15:46 |
| Quest | I just installed fail2ban with no config editing. i restarted sshd with sudo service ssh restart. now i cant login by ssh by any ip. nmap says port 22 is closed. what can by wrong? | 16:09 |
| geofft | hallyn: OK, thanks. (Was looking for something easy to learn with, since my laptop doesn't have a TPM) | 16:13 |
| geofft | hallyn: may I ITP libtpms in Debian based on your packaging? (I'll also check with the Debian qemu team) | 16:14 |
| maxb | Quest: Sounds like sshd failed to start to me. | 16:15 |
| Quest | hm | 16:15 |
| Quest | maxb, but why ssh 22 is closed and so are other ports? | 16:15 |
| maxb | closed just means nothing has it open... | 16:16 |
| Quest | ok | 16:16 |
| Quest | maxb, this config http://pastebin.ca/2352079 in the /etc/ssh/sshd_config is not letting the openssh server to startup. whats wrong in it? | 16:54 |
| Quest | anyone? | 16:56 |
| Quest | this config http://pastebin.ca/2352079 in the /etc/ssh/sshd_config is not letting the openssh server to startup. whats wrong in it? i commented the out to make it work. now ssh server is runing. the only logs i get is ssh status stop/waiting and Invalid user plant from 116.212.190.6 | 17:09 |
| Quest | more elaboration : this config http://pastebin.ca/2352079 in the /etc/ssh/sshd_config is not letting the openssh server to startup. whats wrong in it? i commented the out to make it work. now ssh server is runing. the only logs i get is ssh status stop/waiting and Invalid user plant from 116.212.190.6 . if i follow this http://www.serverubuntu.it/SFTP-chroot it says this http://pastebin.ca/2352109 | 17:39 |
| Quest | Pici, ? | 17:40 |
| maxb | My guess would be that the way sshd is being managed by upstart is unhelpfully causing the interesting error messages to be lost. | 17:42 |
| maxb | Therefore I would try starting a second sshd running on an alternate port manually in a terminal, so I could observe whatever it's complaining about | 17:43 |
| Quest | maxb, now iam on local host | 17:46 |
| Quest | same problem | 17:46 |
| Shogoot | Hi good people. I jsut made my ubuntu server to have static ip. I dont know if it is a consecuense of this that i cannot ping any ip that is not 8.8.8.8 - 8.8.8.4.4. Anyone that can help me find out whats wrong? | 18:29 |
| Shogoot | I did the two ip are the two that i added as dns-nameservers in my etc/network/interfaces | 18:31 |
| patdk-lap | no idea | 18:31 |
| === RoyK^ is now known as RoyK | ||
| vedic | I have created upstart script to start/stop a python script (its a tcp/ip server). There are two servers that I need to start (order is not a matter). When I start the first server using upstart script, it is starting well and works fine. But while first is running, if I start second server which is using prefork to spawn about 10 processes, it is not able to start. | 18:45 |
| === rocket is now known as Guest1797 | ||
| Shogoot | Hi good people. I jsut made my ubuntu server to have static ip. I dont know if it is a consecuense of this that i cannot ping any ip that is not 8.8.8.8 - 8.8.8.4.4. These two ip are the two only ips i added as dns-nameservers in my etc/network/interfaces. Can anyone help me find out why i cannot ping other ip's? | 18:57 |
| Quest | i just deleted /var/log/auth.log and i dont see it recreated. i recrated it with sudo. blank file but even after a reboot. its no being populated. stil blank | 19:02 |
| guntbert | Shogoot: dns-nameservers have nothing to do with the ability to ping a host by IP-address, thats more a problem of routing-tables | 19:16 |
| Shogoot | can you help me find ouot what i need to do? | 19:17 |
| Shogoot | ig ot a netgear WNDR3700 router | 19:18 |
| patdk-lap | did you define a gateway? | 19:24 |
| Shogoot | patdk-lap, this is my interface file http://pastebin.com/ZKeq0n6j | 19:27 |
| Shogoot | quick snser: yes | 19:27 |
| Shogoot | quick answer: yes* | 19:27 |
| Shogoot | im looing into if it is my router... | 19:29 |
| Shogoot | it does have a static routers config thing.... | 19:29 |
| Shogoot | iamge: http://imageshack.us/photo/my-images/708/staticipk.jpg/ | 19:31 |
| maxb | You really shouldn't be defining static routes on a home wifi router unless you're REALLY sure you need to do so | 19:32 |
| maxb | In this case it looks a lot like you've told the router it needs to route to your network via itself | 19:33 |
| Shogoot | i want to access it from outside | 19:33 |
| maxb | Which could well be breaking stuff | 19:33 |
| Shogoot | hmmm | 19:33 |
| maxb | Static routes have very little to do with external access | 19:34 |
| Shogoot | what i thought to... but im going nowwhere with this | 19:34 |
| maxb | Delete all static routes on the router and see if your routing problem is fixed | 19:39 |
| Shogoot | i had no static routes to begin whit. so that not the issue | 19:40 |
| shauno | you had no static routes when you could ping the outside world. you now have them and can't. so it makes sense to backtrack to a working config before you go forward | 19:42 |
| Shogoot | yupp | 19:43 |
| Shogoot | and i found the problem | 19:43 |
| Shogoot | in interfaces i use 3 dns-servernames, and only 2 are allowed... | 19:43 |
| Shogoot | i got rid of the last and now i got it up and running :) | 19:44 |
| Shogoot | maxb, thanks for your time | 19:44 |
| Quest | i have seen rssh docs, used chroot with sftp and openssh server . i want to accomplish is. give users sftp access, make a jail and they cant go outside their home, but can login to console and only use those commands that i have allowed. . how can it be done? | 19:45 |
| patdk-lap | heh? you can't | 19:49 |
| patdk-lap | chroot breaks all of that stuff | 19:49 |
| Quest | I encrypted /homes while installing ubuntu. how come i can browse other peoples /homes. ? | 20:26 |
| RoyK | if those are encrypted, you can't | 20:30 |
| IdleOne | probably because you are switching to that user account | 20:30 |
| Quest | no iam not | 20:31 |
| IdleOne | More detail will be needed to diagnose | 20:32 |
| Quest | there is .ecryptfs | 20:32 |
| Quest | in /home | 20:32 |
| Quest | but i can cd to others /home | 20:32 |
| IdleOne | as root or as a user | 20:35 |
| IdleOne | How many times do we need to tell you not to cross post your questions in multiple Ubuntu channels, it is rude, and it divides the support. | 20:36 |
| shauno | Do you actually see anything in their homes? | 20:36 |
| Quest | IdleOne, user | 20:38 |
| Quest | I encrypted /homes while installing ubuntu. how come i can browse other peoples /homes. ? so if had user1 setup at install time and choosed encrypt /home folder . who can go into other user accounts and who cannot? | 20:40 |
| ashley_w | i used vmbuilder and now have a qemu qcow image. how can i boot this using libvirt? | 20:42 |
| shauno | who can chdir to that folder is permissions, not encryption. as you were were trying to put users all in the same group earlier, rather than having a group created per-user, you're probably not seeing the default behaviour there anymore | 20:42 |
| shauno | what you find inside those homedirs should be the result of encryption/lack of | 20:42 |
| Quest | coplete info . I encrypted /homes while installing ubuntu. how come i can browse other peoples /homes. ? so if had user1 setup at install time and choosed encrypt /home folder . who can go into other user accounts and who cannot? | 21:14 |
| Fieldy | it's based on permissions of that users home directory. 700 means only they can see it. 750 will let users in the same group in to read (but not write), 770 also write. 755 those in the same group, and everyone else, read. 777, everyone read/write (bad idea) | 21:28 |
| Quest | if a theif gets the HD , boots from live cd, replaces /etc/shodow file with his own. boots up. logs as sudoer, changes all users password , can he get into the encryped /homes of users? | 21:29 |
| Fieldy | Quest: no, because /home (i'm assuming) is encrypted as a partition. they would need the password and/or key of the encrypted partition | 21:30 |
| geofft | I'm pretty sure the context is that directories in /home are encrypted with eCryptFS. | 21:30 |
| Fieldy | i'm not sure what that is, all i know of is luks | 21:31 |
| Fieldy | and i'm assuming /home was encrypted in such a way | 21:31 |
| patdk-lap | encryptfs is far away from luks | 21:31 |
| Fieldy | okay, well whatever it is, if it's /home that is its own partition, and encrypted, the concept still applies | 21:31 |
| geofft | Fieldy: Quest has said before that ecryptfs is what's being used. | 21:31 |
| geofft | Fieldy: It's not partition-level encryption. | 21:32 |
| Fieldy | right. but i don't know what that is. so i'm reverting to conceptual stuff | 21:32 |
| patdk-lap | fieldy, the concept does not | 21:32 |
| Fieldy | okay, i am ill-informed on this subject then, sorry | 21:32 |
| patdk-lap | if you don't know what it is, you don't know the concept, please to confuse people | 21:32 |
| Fieldy | short answer from me: with luks, an attacker won't get the user data as described. with this other thing, I have no idea. | 21:32 |
| geofft | I'm really worried about what Quest is doing, since they're clearly doing something security-sensitive | 21:33 |
| geofft | and are asking random folks on an IRC channel for advice | 21:33 |
| geofft | and that's a great way to get yourself totally misconfigured by mistake and screwed over. | 21:33 |
| geofft | If I say "no, you're fine, there's no security risk", why should you possibly trust me? | 21:34 |
| geofft | Even if I'm competent, I may have misunderstood you. | 21:34 |
| geofft | Or you may have failed to describe something else about the system that's relevant. | 21:34 |
| geofft | So I strongly, strongly advise folks here to point Quest at thorough documentation instead of guessing at particular questions. | 21:35 |
| Quest | hm | 21:35 |
| geofft | Or at consulting resources. I hear you can pay Canonical to run this for you. | 21:35 |
| geofft | Here's some ecryptfs documentation: | 21:35 |
| geofft | http://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/files/head:/doc/ | 21:35 |
| geofft | I think this all gets installed somewhere in /usr/share/doc | 21:35 |
| geofft | I'm usually happy to answer questions, but the amount that these questions are security-sensitive | 21:37 |
| geofft | and the way that they're being asked | 21:37 |
| geofft | worries me a _lot_ | 21:37 |
| geofft | If you're doing this for fun, for learning, for personal use, great. It gets hacked, whatever. | 21:37 |
| geofft | but it sounds like you have a deadline, which means someone is paying you to get this right | 21:37 |
| geofft | so you should be appropriately conscientious about getting this right. | 21:38 |
| Quest | Fieldy, geofft user3@server1:/home$ sudo ls user1/ | 21:41 |
| Quest | Desktop Documents Downloads Music nxclient_3.5.0-7_amd64.deb Pictures Public Templates Videos wget-log | 21:41 |
| * Fieldy is confused | 21:41 | |
| Quest | user1 home is supposed to be encrypted | 21:41 |
| Fieldy | you're running the command as root. you will be able to see any file anywhere | 21:42 |
| Fieldy | i don't really understand the encryption you're using though, i only understand luks. so i can't say if an attacker would be able to see that information or not | 21:42 |
| patdk-lap | heh? | 21:42 |
| patdk-lap | this is how *it works* | 21:42 |
| patdk-lap | fieldy, please read the docs before commenting about | 21:43 |
| geofft | Fieldy: This isn't LUKS, please stop talking about LUKS. | 21:43 |
| patdk-lap | but I don't see the private folder | 21:43 |
| patdk-lap | so that use likely was not created using encrypted home | 21:43 |
| patdk-lap | user | 21:43 |
| geofft | Quest: Yes, the encrypted directory is mounted by eCryptfs because that user has unlocked and mounted it. | 21:43 |
| geofft | patdk-lap: I _think_ this is what you get if you encrypt your whole homedir and not just Private | 21:44 |
| geofft | but I might be wrong there | 21:44 |
| geofft | Quest: You should figure out how mounts work and what PAM is and how pam_ecryptfs fits in here. | 21:44 |
| patdk-lap | maybe, I don't use encryptfs personally, just messed with it some | 21:44 |
| geofft | Quest: I can't give you a proper explanation of all that in an IRC channel. I've given 2-hour lectures on that stuff before. | 21:45 |
| patdk-lap | but I do what fieldy doesn, luks on all my drives | 21:45 |
| Quest | geofft, so if one user logs in, he has decrypted all the users /homes? | 21:45 |
| geofft | Quest: That's not what I said. | 21:45 |
| geofft | Quest: You should figure out how mounts work and what PAM is and how pam_ecryptfs fits in here. | 21:45 |
| patdk-lap | if a user logs in, that users home is decrypted for all to see, assuming permissions | 21:46 |
| Quest | you mean. if the system is runing, its mounted. ofcourse, so decrypted | 21:46 |
| patdk-lap | we are talking to a wall | 21:46 |
| Quest | patdk-lap, in my case, the user1 was not logged in but user 3 saw his home | 21:46 |
| patdk-lap | default permissions set on home folders don't allow that, encrypted or not | 21:48 |
| Quest | convinced | 21:49 |
| Quest | drwx------ 19 user1 user1 4096 Apr 7 22:15 user1 | 21:49 |
| Quest | the install was by user1 and choosed to encrypt home | 21:50 |
| Quest | ser3@server1:/home$ sudo ls user1/ | 21:50 |
| Quest | Desktop Documents Downloads Music nxclient_3.5.0-7_amd64.deb Pictures Public Templates Videos wget-log | 21:50 |
| Quest | patdk-lap, geofft any commentd ^ | 21:50 |
| patdk-lap | comment about what? | 21:53 |
| patdk-lap | you just ran ls as root, what did you expect? | 21:53 |
| Quest | i thought even roots cant go in ecrypted homes | 21:53 |
| patdk-lap | if they aren't mounted | 21:53 |
| Quest | hm | 21:54 |
| Quest | i see. so if they are mounted. roots can go in those? | 21:54 |
| patdk-lap | anyone can | 21:54 |
| patdk-lap | as I said above | 21:54 |
| Quest | now i understand what geofft said | 21:54 |
| Quest | patdk-lap, thanks | 21:54 |
| patdk-lap | for a server, it's generally pointless, as I see it for encrypted homes | 21:55 |
| patdk-lap | unless you want to use it for some semi-private storage space, that does not need tobe used by normal server operations | 21:55 |
| patdk-lap | cause anything in it, won't be accessable to normal server stuff, unless the user is logged in | 21:56 |
| patdk-lap | or you auto-mount it | 21:56 |
| Quest | Fieldy, you said no. well if shaddow is replaced. so are password. so they have the password and can bot system. | 21:59 |
| Quest | if a theif gets the HD , boots from live cd, replaces /etc/shodow file with his own. boots up. logs as sudoer, changes all users password , can he get into the encryped /homes of users? | 21:59 |
| Quest | patdk-lap, ok | 22:01 |
| geofft | Quest: Why not try it? | 22:01 |
| geofft | Backup /etc/shadow, make a new one, see what happens. | 22:01 |
| Quest | geofft, are you saying it because you are unsure? | 22:02 |
| geofft | No, I know the answer. I just want you to figure it out. :) | 22:03 |
| geofft | I know the answer because I know _how_ /etc/shadow interacts with ecryptfs. | 22:03 |
| Quest | please tell it | 22:03 |
| geofft | And so I can figure out the answer from that base knowledge. | 22:03 |
| geofft | No, dude, you're not paying me. | 22:03 |
| Quest | ok. tell me yes/no. ill find out how | 22:04 |
| geofft | I'm here to help you figure out how to answer questions on your own. | 22:04 |
| geofft | If you're going to be demanding of volunteers, I'm not helping you. | 22:04 |
| geofft | This is a development channel, not a paid contractor. If you want a paid contractor find one. | 22:05 |
| geofft | Doing experiments like this is exactly how I learned the answer to every question you have asked fso far in the past two days. | 22:06 |
| geofft | I am happy to help you learn, but I'm not doing your homework for you. | 22:06 |
| Quest | .. | 22:06 |
| geofft | And honestly, if I told you "no", why should you possibly believe me? | 22:07 |
| geofft | Are you willing to risk your job on the chance that some guy you've never met before understands ecryptfs? | 22:07 |
| Quest | i trust people here. thats why | 22:07 |
| Quest | like you, Pici and RoyK | 22:07 |
| geofft | I don't even trust _myself_ to answer that question. | 22:07 |
| Quest | k | 22:08 |
| geofft | I have my guess, but if I had to do so on a reaal production system I'd do the experiment before guaranteeing the answer. | 22:08 |
| geofft | So why don't you do that experiment and cut the middleman? | 22:08 |
| Quest | i did and couldnt get into. maybe i did it wronge | 22:09 |
| Quest | thats why asking | 22:09 |
| geofft | Why did it fail? Did you get any error message? | 22:09 |
| Quest | and i couldnt find on google. on how . | 22:09 |
| Quest | nop. | 22:09 |
| Quest | no error message | 22:09 |
| Quest | geofft, slienced? | 22:12 |
| geofft | Dude, I'm doing three other things behind a bad internet connection | 22:12 |
| geofft | What happens if you try to ecryptfs-mount the homedir? | 22:13 |
| Quest | iam away from that system now. and i attached the HD again. re repleced shadow | 22:15 |
| Quest | geofft, can you tell me what might be wronge? | 22:15 |
| === LargePrime is now known as Guest43684 | ||
| ^Mike | How can I list which repositories have a given package available? | 22:51 |
| geofft | ^Mike: apt-cache policy $package, or packages.ubuntu.com/$package | 22:52 |
| uvirtbot | geofft: Error: "Mike:" is not a valid command. | 22:52 |
| geofft | ... | 22:53 |
| geofft | I'm just going to call you "Carrot Mike" from now on. | 22:53 |
| ^Mike | cool, thanks | 22:55 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!
