[01:19] so I've got install issues with ubuntu server. My keyboard works fine in the grub menu and the system boots into the console-based installer... but from then on in the keyboard doesn't work (looks like it's off, as the numlock light goes out immediately as it starts to boot). Does anyone have any ideas on this? The exact same system works fine with a desktop ubuntu install. Keyboard is a standard wired usb. [01:19] ubuntu 13.10, for reference [01:20] any thoughts on how I can get around this? I've found a lot of threads online with similar issue but no joy in terms of a workaround [01:26] ricepuddin: bug #? [01:26] no launchpad bug that I found... just some forums threads all around the same theme [01:28] ricepuddin: https://bugs.launchpad.net/ubuntu/+source/debian-installer/+filebug [01:44] pmatulis: https://bugs.launchpad.net/ubuntu/+source/debian-installer/+bug/1250280 [01:48] ricepuddin: nicely done [01:48] and now I wait? :/ [01:49] ricepuddin: check yo 'box [01:51] I see :P [01:51] will try 13.04... === TDog_ is now known as TDog === TDog_ is now known as TDog === gfrog is now known as gfrog_working [03:51] HI all , I'm Using Ubuntu 12.04 Server and now there is many updates installed , and there is many kernel updates too , how can i find the Currently using kernel and , how can i safely remove the old kernels ? [03:53] babinlonston: 'uname -r' gives what's running now. not necessarily the latest installed kernel (you need to reboot to use it) [03:56] babinlonston: dpkg -l | grep linux-image-3 | grep '^ii' should give you all kernels installed on precise. you can remove some of the earlier ones but always keep the latest few around [03:58] babinlonston: an apt-get autoremove should show you what it thinks is removable === gfrog_working is now known as gfrog [03:58] babinlonston: but check to make sure you're running the latest before doing that, and its not going to remove what you're running [03:59] k === freeflying is now known as freeflying_away [04:09] wow there are , 5 4 kernels and 3 removed and 2 not including Generic ... Successfully Working after a restart ... === freeflying_away is now known as freeflying [04:39] so i'm running ubuntu 12.04 and just noticed that between kernel versions linux-image-3.2.0-24-generic-pae and linux-image-3.2.0-31-generic-pae the system reverted to 32 bit mode instead of using a 64 bit kernel. i can't find anything about this, can anyone confirm? [04:43] http://pastebin.com/HgXX7cbj [04:43] Cool Created a Document too for removing the kernel.. thanks mates [05:08] http://www.linuxmental.com/ [06:17] I am having lots of trouble getting the tftpd-hpa to work ... it installed find ... but it doesn't seem to start... netstat shows nothing, and there is nothing in syslog as to why... can anyone help? [08:56] im having issues with samba. I removed apparmor as I had a feeling it was causing issues and now I cannot even connect to the samba share at all is apparmor a must ? [08:57] eagles0513875: no. how did you remove it? [08:59] sudo apt-get purge apparmor === tjaalton_ is now known as tjaalton [09:00] jjohansen: should i rreinstall it? [09:00] eagles0513875: okay what is the out put of [09:00] cat /sys/module/apparmor/parameters/enabled [09:00] cat /sys/kernel/security/apparmor/profiles [09:00] output of first is Y [09:00] and the 2nd the security folder doesnt exist [09:00] so basically it seems like i only got rid of the profiles [09:01] eagles0513875: well I would recommend it for the added security but it is not required, and at this point adding it back in might make debugging the problem harder [09:01] ok reason being is i had some users which are added on the system and with username and password i setup for them they still were not able to connect it wasnt accepting the password [09:01] eagles0513875: what is the output of [09:01] mount | grep securityfs [09:02] none on /sys/kernel/security type securityfs (rw) [09:02] eagles0513875: and did you reboot after removing apparmor [09:02] yes and this is up after a cold boot this morning as I didnt leave it online as its not accessible [09:03] what is the output of [09:03] ls /sys/kernel/security/ [09:03] apparmor evm [09:03] apparmor is a directory [09:04] eagles0513875: and the output of [09:04] sudo cat /sys/kernels/security/apparmor/profiles [09:05] http://paste.ubuntu.com/6404235/ jjohansen [09:05] eagles0513875: uh, apparmor is enabled and enforcing some policy [09:06] eagles0513875: what is the output of [09:06] sudo aa-status [09:06] i did notice a page in the official docs about needing to load a profile [09:06] jjohansen: aa-status command not found [09:07] jjohansen: therre is a section here on apparmor https://help.ubuntu.com/12.04/serverguide/samba-fileprint-security.html [09:08] jjohansen: i was actually going to use standard ACL's [09:08] eagles0513875: what is the output of [09:08] dpkg -l '*apparmor*' [09:09] http://paste.ubuntu.com/6404254/ [09:09] if i do apt-cache policy apparmor its showing not installed [09:09] i can reinstall it no problem [09:09] i guess the question is what did you change in samba to break apparmor? [09:10] mardraum: nothing i just got rid of apparmor [09:10] jjohansen: http://paste.ubuntu.com/6404262/ [09:10] eagles0513875: so, removing apparmor packages doesn't actually remove it from the system, but it can stop it from enforcing policy. If the apparmor package is missing and you did a clean reboot I don't see how it loaded policy. [09:10] i dunno either im an apparmor noob [09:10] i can reinstall it no problem [09:11] should i do that? [09:11] eagles0513875: hah got it, the apparmor_parser is in a separate package [09:11] ya fragmentation is nice but in some aspects its annoying [09:11] eagles0513875: hrmm no it isn't never mind [09:12] should i just go ahead and reinstall apparmor [09:12] if apparmor isn't the problem, I would use it [09:12] thing is i think its a bit overkill for this file server for an office of 3 [09:12] eagles0513875: does the file /sbin/apparmor_parser exist? [09:13] jjohansen: nope nothing app armor in that directory [09:14] im going to reinstall it [09:14] this is causing more problems then its worth [09:14] eagles0513875: I'll let you decided whether you want it. apparmor in Ubuntu is enforcing a targeted policy, that is it only confines applications with profiles defined for them. If you don't want the samba profile you can simply disable that profile by [09:14] removing the profile file from /etc/apparmor.d/ [09:14] or [09:14] placing a symlink from /etc/apparmor.d/disable/ to the profile in /etc/apparmor.d/ [09:15] the second option is more package manager friendly [09:15] jjohansen: it seems like its rather easy to get samba working with apparmor but i have one question though about it [09:16] to completely disable apparmor, you can remove its packages (I can't explain why policy is loaded), unless are you doing this in a lxc container? [09:16] no on physical hardware [09:16] bare metal nothing virtual no containers [09:17] eagles0513875: or you can add [09:17] apparmor=0 [09:17] to the kernel boot parameters list in /etc/default/grub, and then run update-grub [09:17] eagles0513875: okay, I can't explain why you are seeing policy, it should not have loaded [09:18] eagles0513875: the apparmor module will still be loaded and functioning even when you remove the packages. So /sys/module/apparmor/parameters/enabled will still report Y. But everything is in an unconfined mode which is just stard unix DAC capabilities [09:18] ok [09:18] eagles0513875: what is your question about it? [09:19] https://help.ubuntu.com/12.04/serverguide/samba-fileprint-security.html the section on app armor the 2nd step where do i have to put the path to the share? [09:22] eagles0513875: okay, so apparmor policy syntax is declarative. The share line can be placed anywhere within the profile. The profile will a pattern like [09:22] /usr/bin/samba { [09:22] # rules ... [09:22] } [09:23] eagles0513875: you can add new lines any where in there [09:23] jjohansen: what rules would i need to place in there as the documentation doesnt explain much [09:23] do you have any reference or site that i could take a look at [09:24] eagles0513875: if you added a share at [09:24] /srv/samba/share/ [09:24] you would add the lines [09:24] /srv/samba/share/ r, [09:24] /srv/samba/share/** rwkix, [09:24] Hello. I want to create a zone that fetches all .dev TLD and forward it "IN A 127.0.0.1". is that possible? [09:24] can i add that in the smbd profile [09:25] as it says to edit that particular file [09:27] jjohansen: ^ [09:27] ah yes the instructions aren't very good. [09:27] edit the file [09:27] /etc/apparmor.d/usr.sbin.smbd [09:27] add the new policy lines somewhere in the profile block for [09:27] /usr/sbin/smbd { [09:27] } [09:27] ok i did that and just at the end like you did above add rwx [09:27] and does it need a , after the permissions [09:28] so you need [09:28] /your/share/location/ r, [09:28] /your/share/location/** rwkix, [09:29] 'a' is not needed when 'w' is specified as a permission [09:30] what does the 2nd line do? [09:32] jjohansen: ^ [09:32] the first line gives read access to the directory, the second line gives broad permission for data under the directory [09:32] ** is a recursive glob meaning all files and directories under here [09:32] r - read permission [09:32] w - write permission [09:32] k - lock permission [09:32] ix - allow execution from here but, anything run inherits the smbd profile [09:32] unless you are planning on executing things from the dir, you should be able to leave ix off [09:34] jjohansen: how would that work then if i want to execute a file on my pc do i need to leave ix off? [09:34] eagles0513875: ah no. Let me explain a little more [09:36] The profile only applies to the smbd daemon, the ix is being applied to it. So if the daemon tries to execute something from the share that program will run with the same confinement the daemon has. [09:36] However since a targeted policy is being used, the user (you) is running unconfined, and applications run from the share by you will also be unconfined [09:37] ahh ok i got it [09:37] ok what about other users on the system [09:37] as i have it setup in terms of usernames and passwords to use system users [09:38] eagles0513875: unless you have done something special to setup policy for them, they run unconfined as well [09:38] ok one other odd issue im seeing is i cannot connect to the work group but i need to specify the ip address [09:38] im guessing that would be the router or something blocking samba [09:39] probably [09:39] eagles0513875: grep DENIED /var/log/syslog [09:39] will show up any apparmor based denials [09:40] nothing [09:40] eg. [09:40] Nov 11 14:21:17 ortho2 kernel: [84584.313258] type=1400 audit(1384208477.153:123450): apparmor="DENIED" operation="capable" parent=1 profile="/usr/sbin/libvirtd" pid=1322 comm="libvirtd" pid=1322 comm="libvirtd" capability=29 capname="audit_write" [09:40] the odd thing is it doesnt seem to resolve by name which the shares fall under workgroup [09:40] if i use the ip address it works just fine [09:41] eagles0513875: hrmm its failing the dns lookup for some reason [09:41] probably router is blocking [09:41] what port does samba use? [09:42] the way the setup is is an adsl modem router then that i connected to a switch as I needed more ports [09:43] hrmm I don't know [09:43] I've never setup a samba share :) [09:44] ok now i need to figure out why when i use another user besides me it doesnt accept the users credentials [09:45] SMB uses quite a few ports [09:45] eagles0513875: what is your smb.conf file name resolve order? [09:45] jjohansen: mardraum http://paste.ubuntu.com/6404393/ [09:46] hrmmm that looks right, so that knocks that bug out of the running [09:47] jjohansen: would i need to use apparmor in conjunction with the ACL [09:47] standard access control list? [09:47] https://help.ubuntu.com/community/FilePermissionsACLs jjohansen [09:48] eagles0513875: need no, you can yes. apparmor is hardening the server in case it has a vulnerability and gets attacked, its not setup from what I can see to control the permission of what is being handed to users, that is entirely regular access control list [09:49] ok :) [09:49] cuz i even added them to the sambashare group thinking that would solve the problem [09:49] so basically [09:49] if i add the sambashare group with rwx permissions that would be enough [09:49] yes it should be [09:51] ok :) [09:51] damn dolphin i wish it woudl ask me on this laptop every time for the username and password [09:54] btw jjohansen and mardraum ty for your help [09:58] jjohansen: im still getting access denied for these other users and they are part of the sambashare group [09:59] bah === silo_ is now known as Shogoot [10:04] hey pleia2 [10:08] jdstrand, hey - I've subscribed you to a number of blueprints for UDS next week where I think we need some security enagagement [10:08] please feel free to delegate that out to whoever is most appropriate from your team [10:11] hi jamespage [10:11] hey eagles0513875 [10:12] jamespage: have you done any samba share setups? [10:12] eagles0513875, not for an extremely long time [10:12] ok nm then ill head back to google [10:15] hi [10:15] !hi | sacarde [10:18] I nedd to reconfigure upgrades mode [10:18] http://digilander.libero.it/sacarde/np/tasksel-ubu.jpg [10:18] how can I reconfigure this? [10:19] dpkg-reconfigure ??? [10:24] any samba experts here :( [10:31] hey guys im having an issue with name resolution for the samba server [10:32] and for some reason it is not resolving the name workgroup [10:32] any ideas === freeflying is now known as freeflying_away [11:08] jjohansen: figured out why users couldnt login [11:39] zul, hmm - rtslib switch to apache-2.0 [11:39] guess we can enable that cinder stuff now === freeflying_away is now known as freeflying === gary_poster|away is now known as gary_poster === freeflying is now known as freeflying_away === guampa_ is now known as guampa === freeflying_away is now known as freeflying [14:34] does anyone know how to figure out why the RX dropped packets counter keeps incrementing like 1 or 2 per second on Ubuntu 12.04.3? [14:35] this is with the interface being in the KB/s range [14:42] Teduardo: bad cable? switch duplex? [14:43] that should actually show up in errors/collisions i would think, not the queue in the nic [15:00] jamespage, you mentioned setting the mtu to 1546 on the interfaces in an openstack deployment, that would just be for the neutron gateway and compute nodes wouldn't it ? [15:00] gnuoy, yup [15:00] thanks [15:02] gnuoy, read this - explains why - http://techbackground.blogspot.co.uk/2013/06/path-mtu-discovery-and-gre.html [15:02] jamespage, thanks === gfrog_ is now known as gfrog [15:26] oh.. 3.0 > increments rx_dropped everytime it sees a network protocol it doesnt understand. yay [16:58] jamespage, on https://wiki.ubuntu.com/BlueprintSpec [16:58] jamespage, what do you think on updating "Goal" to "Deliverable" [16:59] jamespage, or should we just make the description of what a goal is a something than can be delivered, and measurable? === racedo` is now known as racedo [17:24] is anyone here familair with virtualization and VM's on ubuntu server? === thesheff17_ is now known as thesheff17 [17:39] yep [17:55] hi [18:00] zul: http://people.canonical.com/~serge/libvirt-t/ has the additions i need, but i've not yet set up the new round of tests [18:00] (lunch first) [18:01] i have Ubuntu 12.04 server running Apache2 , PHP and MYsql. On a monthly basic, the server crashes 3 times (kernel panic on exhausted memory). Linode is not so helpful in debugging the issue. Where should i start debugging the kernel panic issue ? [18:20] nguyendh: you've got to collect some information just before the badness hits; ps -aux output can be really nice to have, if you can get dmesg output or serial-console dmesg output, or perhaps /proc/slabinfo and /proc/meminfo you might be able to spot a trend that leads to trouble [18:27] nguyendh: a few things. ① grep your syslogs for 'OOM' ② install sysstat and learn how to use it ③ install sosreport (info-gathering tool; precise-backports) and invoke it immediately after problem occurs === hitsujiTMO_ is now known as hitsujiTMO [18:34] pmatulis: cool, I've not seen sosreport, looks useful :) [18:35] sarnold: it's cross-platform. originally from suse i believe. now championed by canonical support [19:00] HI I am using ubuntu 12.04 server, how could I enable serial console? thx [19:04] rostam: In which type of context would you like to use the serial console? To communicate with an external device directly connected like UPS/switch/modem/etc? Or to access from another computer with perhaps a nullmodem cable, etc? [19:09] genii: I like to use it as console such that I can see output of the boot process, and be able to debug some of the issuees [19:13] rostam: So in this instance, you are connecting it to another machine which will then view the output? === psivaa is now known as psivaa-afk [19:17] genii, Yes that is what I need to do. [19:21] rostam: https://help.ubuntu.com/community/SerialConsoleHowto ... older but still relevant. The pertinent parts are where it shows to config for Karmic and editing the /etc/default/grub file (grub2) instead of the menu.lst file (grub1) [19:21] zul: one bug i'm hitting [19:22] https://bugzilla.redhat.com/show_bug.cgi?id=1015636 [19:23] gah [19:23] hallyn: qemu 1.6.1 ? [19:24] 1.6.0 [19:27] hallyn_: got an idea? [19:28] well i guess we can just explicitly allow that state until upstream patches. for now i see no fix in libvirt git [19:28] neither do i [19:28] thanks for all suggestions. === zz_Gurkenmaster is now known as Gurkenmaster [19:39] zul: but let me know if you object to any of the changes I posted [19:40] going to build a test fix for the migration setup bug [19:40] hallyn_: url? [19:41] http://people.canonical.com/~serge/libvirt-t/libvirt_1.1.4-0ubuntu1.dsc [19:44] hallyn_: im gonig to add esx support in there as well [19:45] k [19:46] genii, thanks [19:49] Hello all. What could be reasons for apache2 going back to /var/www If i have made a vhost to another folder in that folder and have used a2ensite with that domain? [19:50] other vhosts work on this server [19:51] and this is my file that i made for apache http://pastebin.com/HmHM6hFT [19:54] rostam: You're welcome. Did you manage to get it working yet? [19:58] Ok I now found that disabling default will make apache go to the correct folder [19:58] but I dont want to disable default [20:00] Ok I now discovered that having a domain name point to your hostname is not a great idea [20:00] :) [20:06] i have an ubuntu 10.04 server which usually uses nsswitch.conf ldap for users to login ("compat ldap"). the server is has currently no network connection at all. i am not able to log in locally using the root account or another account i created. i am able to log into the recovery console and i tried a bunch of different pam.d, ldap.conf, nsswitch.conf, security/access.conf things but to no avail. i just can't log in locally. any ideas? i [20:11] zul: great, now virsh-uriprecedence testcase is unhappy with me [20:11] hallyn_: its because of the 9002 patch i bet [20:13] funny_ha_ha: a lot of things can be wrong [20:13] nudge me into a direction i didn't mention :) [20:16] zul: yes... just trying to figure out the best way to fix the test, and trying to make sure the 9002 patch is doing it right... [20:17] hallyn_: i think thats why i asked we needed it in the first place [20:17] funny_ha_ha: client nsswitch.conf, client PAM, client NSS, client ldap config, server ldap config [20:18] funny_ha_ha: if just one of those is bad, the whole thing collapses [20:18] zul: but here we go, it looks like /etc/libvirt/libvirt.conf is obsolete in favor of $XDG_CONFIG_DIR/libvirt/libvirt.conf - i.e. per-user config file [20:19] hallyn_: ack [20:19] zul: cause setting uri_default in /etc/libvirt/libvirt.con does nto work - too bad as that would let us drop 9002 patch [20:21] pmatulis: well as i said, the ldap server is not available at the moment. and that's fine. i just want to be able to login when the server is not there. all the client confs you mentioned, i already went over at least 4 times :/ i must be missing something [20:23] funny_ha_ha: it can get fairly complicated. and, yes, you can set it up to log in if the server is not around (either have some kind of credential caching or have local accounts, at least for some important users) [20:29] zul: so those tests have never passed for us (don't in saucy either). "VIRSH_DEFAULT_CONNECT_URI=test:///default virsh uri" works, while "LIBVIRT_DEFAULT_URI=test:///default virsh uri" does not [20:29] hallyn_: skip it then [20:29] zul: do you still have an install of your original 1.1.4? [20:29] hallyn_: i dont [20:29] i'd be curious to see what you get there for LIBVIRT_DEFAULT_URI=test:///default virsh uri [20:29] ok [20:30] i mean, you must get test:///default, or else your build wouldve failed... [20:31] allr ight then ,proceeding. [20:39] guys is there a good primer on running a ubutnu virtualization server? [20:48] joossee: try the ubuntu server guide [20:52] am i understanding this correctly? I can bridge 3 wireless netwrk connections into one superfast connection? [21:25] guys can I mount a bootable USB stick as an image or use with libvirt? [21:50] Hey, quick Q. I've got a VM I updated to 13.10, and after the upgrade it's got a new new grey, purple and orange prompt which looks like this: unit3@ds9:~⟫ [21:50] however, other systems I've upgraded or freshly installed don't have that prompt. [21:50] anyone know what package it came from how I can enable it elsewhere? [21:53] sounds kind of like byobu? [21:53] Hm, maybe not. [21:57] oh, it could be byobu. [21:57] I do use it on a bunch of my boxes. just weird that my desktop, which was upgraded, doesn't show the same prompt when I launch byobu. [21:58] but I do see byobu code for setting what looks like a similar prompt. [21:58] unit3: yes, that's byobu [21:58] unit3: it only installs that by default, if byobu can determine if you haven't modified some things in your environment [21:58] Yeah. it must think I've modified things on the other hosts where it's not showing up. time to dig through the code [21:59] unit3: that said, you can easily enable it by ensuring that you have Byobu >= 5.60 installed, and run byobu-enable-prompt [21:59] oh, handy! [21:59] unit3: yep ;-) [21:59] yep, that worked! Thanks! :) [21:59] Now to steal the prompt code for my non-byobu systems. ;) [22:00] ^_^ === Gurkenmaster is now known as zz_Gurkenmaster === gary_poster is now known as gary_poster|away [22:12] zul: so http://people.canonical.com/~serge/fix-uri-precedence-test needs to be added to debian/patches in the package i posted before. i'll keep working tomorrow, but if you wanted to push it as is i think that'd be sensible [22:17] zul: (updated http://people.canonical.com/~serge/libvirt-t [22:17] * hallyn_ out [22:21] what is best way to spin up a VPN, install stuff, nuke it, do it again; etc like self hosted EC2? [22:21] is there a tutorial for open stack for that? [23:00] hallyn_: will do === freeflying is now known as freeflying_away [23:16] HaltingState: yes, look into openstack === freeflying_away is now known as freeflying