=== blackjack is now known as sumpit === sumpit is now known as woles [01:16] Hey gents, is there a way to change the outward facing IP address on my server? [01:16] i have bout 25 IP's configed and its using 1 as the outward and i need it to use another [01:17] seems to be using the last one on my list, as apposed to the first one that it should be using [01:18] Eitan: rfc1918 addresses? [01:19] nat? [01:19] So i have eth0 - eth17 [01:19] and its using eth 17 as the external instead of eth0, i could just rename eth 0 to eth18 [01:19] what addresses? [01:19] nat [01:20] vim /etc/udev/rules.d/70-persistent-net.rules perhaps? [01:20] same subnet? [01:20] yes [01:20] why so many NICs? [01:21] its a dedicated server... thats how the host set it up [01:21] you shouldn't assign addresses in the same subnet to more than one physical adapter [01:21] i needed a lot of ip's [01:21] Eitan: you don't need a truckload of IP addresses [01:22] i agree, [01:22] but right now i cant get rid of all of them [01:22] i just need to change my outward facing ip [01:22] there is no such thing; you're misinterpreting something else [01:22] so i can get through someones firewall, instead of asking them to change hte IP in their ACLs [01:22] I assume you mean the IP your system is sending new connections out from [01:22] yes sir [01:22] my external iP [01:23] who people think i am [01:23] all of your IPs are external [01:23] ok, [01:23] you are right [01:23] mispoke [01:23] the ip that my system is sending out connections from [01:23] its currently using the last eth instead of the first [01:24] it's most likely using whichever one was most recently configured [01:24] qman: you are correct [01:24] it is using eth0:13 instead of eth0:1 [01:24] it is using eth0:13 instead of eth0:0 [01:25] ok; those are virtual interfaces, not physical, and are different in both configuration and function [01:25] ok, that makes sense they are all running on eth0 [01:25] and its using the last configured [01:26] so im just going to change it here /etc/network/interfaces [01:26] do you have more than one default gateway specified? [01:26] no [01:26] same default gateway [01:26] what I mean is, is it specified more than once? [01:26] yes sir [01:26] that's incorrect [01:26] specified for every IP [01:27] it should only be specified once [01:27] on the first interface [01:27] pretty much everything is duplicated for every network int [01:27] only thing different is address itself [01:27] that's wrong; the additional addresses should only be specified as address and netmask [01:28] ok, ill make that change [01:28] how should i go about making this stop using my last configured int as outgoing? [01:28] switch them in the config? [01:28] no [01:29] this will probably fix that [01:29] oh cool [01:29] if not, you'll have to change some advanced routing settings [01:29] got it [01:29] ill give it a shot [01:29] thanks for the info [01:29] after removing all those you will have to make that configuration apply, done easiest by rebooting [01:30] or you could probably manually delete all the extra gateways [01:30] ok, ill just run a quick reboot [01:32] could also use ssh -b address to use a speciifc Ip [01:32] woops === LargePrime is now known as Guest16628 [02:02] hello friends [02:03] I have a server with a spinning drive for the OS. I got to thinking about taking it an dputting it on an SSD. If I would do that, should I exclude swap from the SSD? [02:18] are you using swap a lot? [02:34] hachre: I don't believe so... truth be told I haven't checked in quite a while. [02:34] how much ram do you have? [02:34] it's a home server... 4gb of ram. [02:34] does it run anything? [02:34] quite a bit, but all for personal use [02:34] except samba [02:34] subsonic, owncloud, apache, samba, motion video surveillance, mdadm raid [02:35] dnot know that motion video thing [02:35] apart from that [02:35] they arent huge ram hogs [02:35] anyway.. if you dont use it much i wouldnt care [02:35] motion isn't a huge ram hog, but it taxes the cpu a little bit [02:35] if you really trash it you could put it on the disks to spare the ssd [02:35] i personally use linux as a desktop on my laptop with a ssd [02:35] sounds good [02:35] i dont have any problems [02:36] laptop has been going for three years [02:36] I just wasn't sure how swap + SSD would work [02:36] swap on the ssd and i go way beyond the 4 gb sometimes [02:36] like if that was a bad idea or anything [02:36] nah [02:36] I run swapless [02:36] more RAM would have been cheaper [02:36] just for the wear and tear [02:36] do you guys know of a way to suck up the contents of my entire server OS and drop iton an SSD? [02:36] 500GB HDD right now... want to go to 64GB SSD... [02:37] I'd use rsync [02:37] rsync for the OS? [02:37] yep, rsync [02:37] for everything [02:37] wow [02:37] I didn't think rsync would work [02:37] rsync the files, then install grub to the SSD [02:37] well you gotta reinstall grub and you have to do the partitioning on the ssd and mkfs [02:37] thats it [02:37] rest is rsync [02:37] specifically [02:37] I had the drive prepped already [02:38] just hooked it up to a sata connector on my laptop and GParted it [02:38] I just haven't swapped it out yet [02:38] renovating the basement, so... been pre-occupied [02:38] rsync -avh --exclude=/dev --exclude=/proc --exclude=/sys --exclude=/mnt/ssd / /mnt/ssd [02:38] yup [02:38] :) [02:38] qman__: the server will be offline when I rsync. Would the excludes be needed then? [02:38] assuming you mount the ssd to /mnt/ssd [02:39] nope [02:39] I can just do rsync -avh /media/hdd /media/ssd ?? [02:39] just mount both disks and rsync one to the other [02:39] yes [02:39] well dang [02:39] that's freakin nice [02:39] :) [02:40] taking that down in my notes quick... [02:42] k, done deal [02:42] thanks again fellas [02:42] np [02:49] Is there a way to secure Tomcat using AppArmor on 12.04? [02:49] or more generally, applications that run on the JVM [02:52] yes, just like any other [02:52] you need to configure a profile that allows it the access needed [02:53] but 'it' is the java binary. which could be used to run other JVM apps - which should have different profiles. [02:53] yet they all look like the same binary [02:53] I saw something about ChangeHat, but i cant find much. [02:54] it was in the SuSE docs [02:55] looks like there used to be an apparmor_tomcat but it's been left to rot [02:55] yeah, i saw that :( [02:58] it would seem like i'd have to install a JVM per app and secure them that way, or combine the profiles into one (which kindof defeats the purpose) [02:58] yeah, I don't really see a way around that; you could make linked copies of the JVM by different names [02:58] still messy though [02:59] AppArmor doesn't follow links to the underlying binary? I guess that would be another way it could work. [02:59] given the nature of tomcat and applications that run on it, there probably aren't many people that have this specific need [02:59] I don't have the specific need just yet - its more of an academic excercise. [03:00] but i can see it being useful in general [03:00] what people probably do in the real world is spin up a VM per tomcat application [03:00] offers greater separation and security between them [03:00] probably for the best then. [03:02] but I can see if tomcat were to host more than one application, it would make sense to isolate at the servlet level too (like tomcat_apparmor provided) [03:03] I wonder if it was abandoned due to lack of interest, contributions, or both. [03:03] since nothing has replaced it [03:03] that's likely [03:04] there are other considerations when running applications that need to be separate, which are more easily achieved by separating servers [03:04] yeah. In a prod environment i'd be more inclined to have a single webapp per tomcat install [03:04] plus the way things are headed these days is toward preconfigured instances that you fire up on the fly with your application preloaded [03:05] "I need six more foos and three bars", click it in your openstack [03:07] thx for the help qman__ [03:20] what are the downsides of root not being the owner of a file in www-data [03:24] i think it may be because chgrp can be used to give it away. and if root owns it, then only root can chgrp [03:25] may be other reasons, could also just be convention [04:12] Falados: but what is the harm in it being given away [04:30] LargePrime: it depends on what it was changed to and who has access to that new group. It's unexpected behavoir, and should be avoided. [04:31] LargePrime: but there may be other things that are not coming to mind. Its probably not a large attack vector - but its simple enough to enforce this convention anyway. [04:31] do you have time to discuss more? [04:32] Falados: [04:33] i have several sites i host. like mydomain.com and yourdomain.com and thierdomain.org [04:34] I want you to have rights to yourdomain.com them to have rights to thierdomain, and my web guy to have access to all of them [04:34] www-data need to have access to server the files, and some of the files cannot be made public [04:35] depends on your particular constriants, but the owner/user permissions are not very granular like that. [04:35] my plan is to create a group for each domain and add web authors to each group as needed [04:35] and set the group as owner [04:35] there is an ACL implementation i think, but that might be overkill. I'd probably end up giving the web-guy sudo permissions [04:36] sudo is going to be a pita over FTP? [04:36] oh, these files are managed via ftp? [04:36] yes [04:37] did i miss something obvious? [04:37] other than ftp should never be used :) [04:37] sftp then [04:38] you can get more granularity with ACLs: https://help.ubuntu.com/community/FilePermissionsACLs [04:38] but thats usually not what I see. [04:38] YMMV [04:39] ok so what is wrong with setting a group as the owner and adding peopel to that group [04:39] or you can do what Hiroku does, and use git w/ hooks. [04:39] that way no one owns the deployment files [04:39] what is git with hooks? [04:40] also, note the total noob [04:40] ya, I have a website that just does git pulls every minute [04:40] git is source control management [04:40] i know [04:40] like mecurial, or bazaar [04:41] and a post-receive hook is just a bash script that you can create that will deploy the files [04:42] I think that is gonna be kinda tuff for my web guys [04:42] actually, not just bash, could by py, perl, ruby [04:42] Well, if dont want to change your workflow, then maybe you'll have to set up ACLs. [04:42] they did that at my University for web hosting with FTP. [04:42] because granting ownership to a group is an issue? [04:43] yeah, it is not granular enough. You can't give multiple groups access to the same files [04:43] i cant make one group owner and another the group? [04:44] does a user have to be owner? [04:45] the http server needs to have read (and in some cases write) access to the files and folders it needs. It can get this only though those 3 ways: [04:45] user , group, other [04:45] other is too broad [04:46] gives every accoutn access - so thats a cop-out [04:46] its user [04:46] if its user is web-guy, then they have one set of permissions, and if group is www-data then www-data has another set of permissions, but you cant introduce a third into this without ACLs. [04:48] and user cant be a group? [04:48] correct [04:48] a user is always a user. [04:48] bah [04:48] with ACLS you can give permissions to arbitrary users and groups [04:49] but i have to take down teh server to implement acls [04:49] yeah, you have to re-mount [04:51] you can get by with playing with users and groups, but you'll find that its really too course and you'll end up giving too much permissions to people [04:51] the only solution that doesnt need a remount would be a change in deployment process. [04:52] using FTP as a staging area, and a script run as www-data to deploy from staging [04:52] could be a simple as rsync or as sophisticated as triggering a job in a CI server like jenkins [04:54] how can www-data deploy files it might not have read or write access too? [04:54] well, you could also run the script as root too [04:54] no one should be running that script besides cron anyway [04:55] but your refresh-rate won't be immediate with cront. it will take about a minute [04:55] there must be tonnes of websites that have virtual hosts. How do tehy handel these things [04:56] probably using jails/chroot [04:56] and make webguy the owner? [04:56] and the web-guy has total access to the server either via SSH, or cpanel, or something [04:57] although I havn't set up a shared hosting server, so i dont have a specific implementation I can reference. [04:58] perhaps solutions like CPanel hide all of these details for you. [04:58] s/for/from [05:09] there are probably open-source cpanel-like applications that can help in this regard. Just a quick google search brings up a wikipedia page on it: [05:09] en.wikipedia.org/wiki/Comparison_of_web_hosting_control_panels [05:11] im out. hope this helps some [05:37] Falados: while there probably won't be anyone there right now, you might bring up apparmor and tomcat in #apparmor on OFTC [05:38] you can get a definitive answer on how it (used to) work, where it is now, etc [06:41] Anyone up and active? [06:42] I'm new to Ubuntu Server but I'm trying to setup a dhcp server. Can anyone point me to a tut/guide. Or take the time to help me out. Thanks. [06:43] azKennett: http://askubuntu.com/questions/140126/how-do-i-configure-a-dhcp-server [06:43] Thanks billy_ran_away [06:51] billy_ran_away, I followed the guide and I get error, "stop: Unknown instance: start: Job failed to start" any ideas? [06:52] azKennett: Yea check /var/log/syslog and look for "dhcpd: Open a socket for LPF: Permission denied" [06:53] azKennett: If you have that then refer to this bug: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/1107686 [06:53] Launchpad bug 1107686 in isc-dhcp "dhcpd: Open a socket for LPF: Permission denied" [Undecided,Fix released] [06:53] billy_ran_away,I'll look [06:57] billy_ran_away: Didn't see it. [07:16] hi, I get an error when doing `sudo apt-get update` it stalls at "Reading package lists... 99%" then prints out "Reading package lists... Error!" [07:17] I am using amazon ec2 [07:35] ak5: "Error!" usually has a message with it. [07:35] SpamapS: this time it doesn't. I have the same error as this guy http://askubuntu.com/questions/259114/reading-package-lists-in-update-apt-get-ubuntu-12-04-vps [07:36] ak5: weird [07:36] SpamapS: indeed [07:38] SpamapS: any ideas? [07:42] ak5: none I'm afraid. :-/ [07:48] SpamapS: I am going to change mirrors [07:53] ls [08:07] xnox, great - I thought that was the case; I revised that patch to be backwards compat as well - its for 2.4.3 which I'm currently working on the merge for [08:18] has anyone tested ZFS with Ubuntu Server 13.04? [08:24] Hi all. I'm setting up ubuntu server for the first time and have a few general questions. Anyone around to help? [08:28] I have no experience setting up a server with ubuntu, only with debian [08:28] I'm hoping to use the server as a LAMP server, a printer server for home, and its main use will be as a minecraft server. What sort of security precautions should I take? [08:29] Hi sies34. These are only general questions though, so perhaps you'd be able to help anyway. [08:29] at what level? [08:30] go ahead [08:31] First question is above. What do you mean "at what level"? I know network/server security is an expansive subject, but I'm just looking for a simple "best practice" to ensure my home network isn't compromised. [08:34] best first line of defense is a firewall [08:34] So for example, a firewall is a given. [08:34] Haha. Great minds... [08:34] do you have a router? [08:35] AfroMark: or you can use iptables [08:35] Yes - the server will have a wired connection to a wireless modem/router will serves the house [08:35] first thing you should do is disable root login via password, use ssh keys or disable it all together [08:39] you can choose between iptablet (on your linux server) or your built-in firewall of the router [08:40] I read something about disabling root password login. Does that only account for remote access? I don't want it to be a pain every time i try to "sudo" something [08:40] usually to configure the firewall of the router better/easier [08:41] yes [08:41] afer you login with ssh you can 'su' [08:44] it also helps if you forward port 22 to another port in your router [08:44] for instance 45893 [08:44] AfroMark: sudo is different, and yes in the ssh config for remote access [08:45] I feel that changing ssh port is cargo culting nowadays: http://bsdly.blogspot.co.uk/2013/02/theres-no-protection-in-high-ports.html [08:45] there are many port scans on port 22 [08:46] I lock down ssh users with AllowUsers in /etc/ssh/sshd_config. Then you don't have to worry about accidentally having a weak password on some other account. [08:46] On the whole, how accurate is the information here? http://www.andrewault.net/2010/05/17/securing-an-ubuntu-server/ [08:47] Then make sure you either have very strong passwords on the AllowUsers accounts, or disable password auth in sshd_config and use keys only. [08:47] I'd make sure that the minecraft daemon is running as its own special user, and constrain it with AppArmor. [08:50] indeed better to use a ssh-key [08:50] LAMP servers are particularly vulnerable. I'd put that in a separate VM, or at least very carefully constrain it with AppArmor. [08:52] Thanks all for the advice [08:52] Obviously there are quite a few things i need to look into! [08:54] One last question - I have a NAS attached to my router. Would I be able to run an ftp server allowing access to the network storage? Or is that opening up even more security concerns? [08:57] I wouldn't double dip like that if I had other options. Minecraft server/print server/FTP server is a lot to keep in mind when starting out. [08:57] use NFS [08:57] Set up two VMs. One for services to the outside world, and one for services to your LAN. [08:58] when you nas supported NFS [09:00] rbasak is thinking in the right direction. Separate out your tasks. [09:01] or use smbmount on your server [09:08] Will 2 VMs be a drain on resources? It may be that I'm trying to accomplish too much too soon. [09:09] The computer I'm planning to use is fairly old. 2.4Ghz CPU and 2gig RAM. [09:10] I apologise in advance if I'm being a massive newbie. [09:10] Don't even worry about it. [09:11] I wish I'd known there was an ubuntu-server channel when I started. [09:11] 2 VMs will probably be a bit much for that build... [09:13] You can just test and develop on that machine if you hold off forwarding any ports on your router til you have your ideal configuration. [09:24] I'd better be off now. Thanks to everyone for the advice! It's given me plenty to think about. [09:25] It's likely I'll be back soon though! [09:54] hi guys, I have an ubuntu instance that gets an error at `sudo apt-get update` - anyone else have this? It outputs: Reading package lists... Error! And nothing else [10:42] Is there a recommended way for conditionally setting envionment variable. To elaborate, files ending in .sh on /etc/profile.d are sourced by all users. What if I want to source some env vars in an init script. [10:43] I don't want to set those vars directly, because several scripts may use them. [10:47] lotia, /etc/default/ [11:03] jamespage, rbasak, any other english folk - happy may day. Will you be doing a may pole dance later? [11:03] I already have bells on my shoes, all set. [11:03] Daviey, already have me bells on [11:03] just about to go get my big stick [11:05] heh. [11:11] jamespage: thank you [11:11] workers of the world unite! === stan_ is now known as Guest98943 [12:13] how often /var/tmp is cleared in Ubuntu? === Guest98943 is now known as stan_0001 [12:14] Is /vat/tmp cleared automatically in Ubuntu? [12:17] stan_0001: /tmp is a ramdisk, it exists in ram only. It's not that it's cleared on shutdown, it's that it doesn't survive shutdowns at all. [12:18] jacobw, i see thanks. [12:18] stan_0001: /var/tmp isn't a ramdisk, it's just a directory in the filesystem on the disks, it's just like any other directory [12:21] stan_0001: Consider symlinking to /tmp or mounting /var/tmp as a ramdisk === Jikan is now known as Jikai === Jikai is now known as Jikan [13:31] im seeing a strange screen artifact using byobo + tmux that doesnt occur when using straight screen. [13:31] i dont use tmux outside of byobu, [13:31] not sure if this would be a good channel to discuss this since byobu is an ubuntu creation [13:33] sometimes when i resume a disconnected session, I have a {window|pane|whoknows} off to teh side that seems to be filled with period characters. I dont think i can switch to it, and I cannto make it occur on demand, but it does occure pretty frequwently. [13:33] It might be related to resuming a session with a terminal with a different windo size thatn the one detached [13:34] anyone seen that on their installs? I am using the current putty to connect to ubuntu 12.04.2 [13:35] i'll get a screenshot next time [13:36] kirkland: ping, have you seen this happen? [13:36] slestak: hi [13:36] good mornig man. [13:37] thsi is not a big issue, just somethign im tryng to figure out. if you think it is def a tmux thing i'll go talk to them [13:37] slestak: it's just like you say -- when you see the "periods", you're connecting from a terminal larger than some other terminal that's also connected [13:37] slestak: it is a feature/function of tmux [13:37] slestak: you can force disconnect the other client [13:38] slestak: let me find the command/key for that [13:38] im trying to see where the feature part of that comes in. for instance, doesnt gnu screen handle that a little more gracefully? [13:38] i can look at the docs, thanks for the pointer [13:39] slestak: I prefer tmux's handling of it, actually [13:40] cool, i'll check it out. [13:40] slestak: but that's probably just preference [13:40] slestak: okay, you can do this... [13:40] just wasnt understanding the implemetation [13:40] slestak: if your escape key is ctrl-a, then try pressing ctrl-a-D [13:40] slestak: note that's a capital D [13:40] slestak: that will show you a list of attached clients [13:40] slestak: and the geometry of their screens [13:40] slestak: pick the one you want to kill (probably the smallest geometry) [13:41] slestak: and you'll detach that client's connection [13:42] slestak: I think there's a byobu feature request to add a hotkey to "detach all clients not myself" [13:42] cool [13:42] thanks for byobu [13:42] slestak: you bet! thanks for using it! [13:51] Can anyone explain why my pvscan isn't showing the correct volumes and it says something about "Incorrect metadata area header checksum" http://pastie.org/7746710 === wedgwood_away is now known as wedgwood === bladernr` is now known as bladernr [14:33] billy_ran_away: prolly b/c lvmscan is looking at non-LVM partitions [14:33] pmatulis: Yea I was hoping that was it, but it's not. [14:34] pmatulis: I'm closer to solving I think, thanks for the suggestion though. [14:34] billy_ran_away: ok, report back when you find out more [14:35] pmatulis: Okay thanks === Jikan is now known as Jikai === dosaboy_ is now known as dosaboy === Jikai is now known as Jikan === Ursinha is now known as Ursinha-afk === Ursinha-afk is now known as Ursinha [15:50] anyone here that can explain where and how md arrays are assembled? seems lucid assembles nested arrays fine, but precise and later does not. it assembles the base arrays, but not the ones on top (as in raid-5+0 etc). See bug 1171945 for details. [15:50] Launchpad bug 1171945 in mdadm "Nested RAID levels aren't started after reboot" [Undecided,Confirmed] https://launchpad.net/bugs/1171945 [16:09] Anyone know how I can manage user's home directories across a series of machines? [16:27] parallel21: Salt, ldap, puppet, chef, cfengine, spine, rsync, and NFS mounting, just to name a few. [16:31] My votes with rsync. [16:33] Oh god that's horrible. [16:33] genii-around: I use git / vcsh. [16:34] I've heard of using git for this sort of thing but never tried it myself. [16:43] I'm not so concerned about dotfiles, but stuff like text files and managing user profiles and passwords across machines. I'd like to be able to add an ssh user across a set of a machines [16:45] parallel21: Yes, welcome to the world of either LDAP, or configuration management. Your pick. [16:46] parallel21: And really, ssh keys make more sense in this decade. [16:46] parallel21: How many servers are we talking? [16:49] Corey: Under 10… I'd really like to use something like puppet. But I'd like something I could deploy more quickly, as I know little about puppet. LDAP would be OpenLDAP? Ssh-keys wouldn't just fix it would it? They'd need a home folder and the like? [16:49] parallel21: saltstack.org is probably your best bet. [16:51] Corey: This looks awesome [16:52] parallel21: Thank you. #salt is also a good resource here. [17:04] parallel21: look at ansible [17:04] #ansible also [17:05] its all ssh based command, but can build up if needed [17:05] I'm trying to set up postfix with SMTP AUTH on 12.04 but the guide on help.ubuntu.com seems to be out of date with regard to dovecot configuration. Does anyone know of another resource? [17:11] GeminiDomino: I've been doing the same [17:11] Any luck? [17:11] GeminiDomino: Where are you having a problem? [17:12] Going in works… smtp auth out does not [17:12] I'm not getting the "250-AUTH xxx" lines in the ehlo response [17:12] Hrmmm.. [17:21] Yep. Just did it from scratch again... I get the STARTTLS announce, but no auth... [17:37] I never thought I'd miss Sendmail. <_< [17:38] postfix? [17:39] That's what's making me miss sendmail. :) [17:40] Yeah, I was thinking about sendmail as well. What's the diff? [17:41] * RoyK mumbles something about PEBKAC [17:41] pbkac? [17:43] parallel21: Sendmails configuration files make perl look readable. :) [17:52] hallyn: hello :) [17:53] 'sudo kvm -hda test.img -monitor stdio' returns 'Could not initialize SDL(No available video device) - exiting' on our precise servers [17:54] psivaa: what happens when yo type 'xterm' ? [17:54] psivaa: shorter answer: add '-vnc :1' [18:02] hallyn: ok thanks, adding '-vnc:1' makes it work, xterm is not installed though === Ursinha-afk is now known as Ursinha === gary_poster is now known as gary_poster|away === gary_poster|away is now known as gary_poster === gary_poster is now known as gary_poster|away === gary_poster|away is now known as gary_poster === Ursinha is now known as Ursinha-afk === Ursinha-afk is now known as Ursinha === smb` is now known as smb [20:56] Can I unbond two network interfaces that were bounded at boot using network/interfaces without risking the stability of the production server or the second bonded interface without rebooting the server? [21:03] I tried ifenslave -d bond1 eth2 eth3 [21:06] ok it worked, it just took a few seconds [21:06] there was probably a machine whose arp tables didn't update or something [21:06] thanks === mikal__ is now known as mikal [21:55]