[00:01] hazmat: i actually pitched removal of a number of packages recently :) [00:01] jrwren, i'm primarily looking at lxc instances (including in cloud-instances), and minimizing seconds on container boot time, its easy to avoid via some container customizerization [00:01] jrwren, fair enough [00:01] its easy to do externally [00:02] hazmat: do you then git clone something to teh new instance? [00:03] jrwren, git is used internally by juju when deploying charms, but fair enough i'm snapshotting against a base image for the containers, easy enough to add there, out of curiosity what packages were you pitching to remove? [00:03] oh, a juju thing. [00:03] would make sense to have a jujuimg separate from cloudimg IMO [00:04] jrwren, basically i'm creating a base juju image from each series/release cloud image, i can add the extra package there just as easily [00:05] although it would be nice if lxc-attach would work with precise and hwe kernels.. ssh normalizes nicely across the containers. [00:09] by base juju image i mean container with btrfs snapshot for lxc-clone. the default cloud images have nothing in specific support of juju btw. === freeflying is now known as freeflying_away [00:19] right. i know the cloudimg pretty well. [00:20] everything else you just said, i've no idea what you are talking about :) === robbyf_ is now known as RobbyF [00:58] is this the right channel for discussing CloudInit, i.e. https://help.ubuntu.com/community/CloudInit ? [01:00] it's a fine channel [01:00] for that and many other things [01:00] oh good [01:01] is it possible to get cloud-init to run on my mac? [01:02] i want to be able to use write-mime-multipart [01:27] figured it out. bzr branch lp:cloud-init === liam_ is now known as Guest46102 [03:38] jamespage: uh oh, what happened? [04:23] Hi I have just unstalled ubuntu server 12.04 and I have changed ip address to static (been pinging it from my laptop and I know its connected to my network). Then I installed nginx running the command aptitude install nginx. The version of nginx is 1.5.6. When I then, on my laptop, type in my servers ip address in my webbrowser I get nothing. [04:23] Im following the manual http://arstechnica.com/gadgets/2012/11/how-to-set-up-a-safe-and-secure-web-server/2/ [05:11] i need to re-do my certs ... i just ran through the steps i used the first time but it failed to change the cert as evidenced by the old data being present and not the new data. i used a different email address to make them stand out. [05:30] hello.. [05:30] dont tell me !ask, i know. just being kind. [05:30] ok guys.. so this is what i want to do. I dont really understand lvms and the like, but i know what i want.. [05:31] my old machine was a simple 1 disk setup, and while installing ubuntu i chose the guided partitoning and chose luks + lvm [05:31] i want to do the same again, except this time, with two disks. and i want the "2nd disk" to be in teh LVM so i only have to type the key once. [05:32] but not raid? [05:32] lvm though seems to create one giant partion, like dynamic disks. i dont want that. i want one "partition" on the 1st disk, and the "other/storage" on the other [05:32] correct. but no raid. [05:32] they're separate PVs then [05:32] no way around that [05:33] um [05:33] is there a way the "storage" disk can mount into the first group? [05:33] you can mount things wherever you want [05:34] (im at the guided screen if you wanna teamviewer and push the buttons, but i have a feeling you know what i want to do..) [05:34] i dont mind how the "mounting process" happens, as long as.. see the reason why i want them seperate is so that i could possibly transport the second disk and mount it on another computer someplace. [05:35] anepanaliptos, why do that at all? [05:35] why *type the key* multible times? [05:35] i dont want to. [05:35] then don't [05:35] so how would i set it up so i dont have to? [05:36] there are many ways [05:36] I personally use a script to fetch the key [05:37] the script asks for the password to decrypt [05:37] it then uses that password to get the key [05:37] I store the keys in a gpg archive [05:37] woah too complicated [05:37] :) [05:37] you could go lazy [05:37] just save the key onto your first disk [05:37] ok what's that route look like? [05:37] aa ok. [05:37] and reference that file to unlock the second [05:38] if first is locked, can't unlock the second [05:38] ok. can that be done "near boot time" ? [05:38] near boot time? [05:38] what does that mean? [05:38] that sounds better. [05:38] before for example, apache2 starts up [05:38] no idea [05:38] it happens when disks mount [05:38] that is upto upstart [05:38] perfect. [05:39] issues is, anyone that roots your server, has access to the decrypt key [05:39] so using a script, while much harder, is safer, by alittle bit [05:39] hmm. [05:39] hmmm. [05:40] i think ill just type it twice. [05:40] what exactly are you protecting against? [05:40] how do i setup luks without the volgroup stuff then? [05:40] im trying to protect againt physical theft [05:41] then it doesn't matter [05:41] so when you yank the power, you're done and you need the key again. [05:41] well, those are totally different [05:41] anepanaliptos: oh, so if people are serious about stealing kit they won't yank the power [05:41] lifeless: lol. [05:41] the best way to steal it, is to root it and copy the data while it's up [05:42] and nobody even knows [05:42] the system is much less protected when it's running [05:42] anepanaliptos: there are stock products that replace the power supply hot [05:42] yeah im just talking about like a dumb theif stealing equipment. [05:42] look, its my mailserver [05:42] then saving your key for the other disks in /etc, is safe enough [05:43] im trying to "protect" against some "not nice people" accessing.. my mail. if it were to get siezed. [05:43] cause it's unlikely they logged in, and rooted your server to get those keys first [05:43] that kind of thing. [05:43] siezed? [05:43] but im happy with this solution too [05:43] 23:42 < patdk-lap> then saving your key for the other disks in /etc, is safe enough [05:43] that implies people know what they are doing [05:43] not really. local authoraties arent that smart. [05:44] thermite trap [05:44] problem solved [05:44] jkitchen, what triggers it? [05:44] not solved :) [05:44] again, too technical. [05:45] how do you guys protect your mail servers? [05:45] patdk-lap: "oh shit" button [05:45] :) [05:45] tie it to your iphone "siri, nuke the drives please" [05:45] when i had the first one, with only a physical raid, i felt "safe" with luks [05:45] personally, I have to insert a special usb stick [05:45] and type in a password [05:46] ok. any things i can "rtfm" to help me setup something similar? [05:46] but, for email [05:46] it is much much more likely they tapped your internet connection [05:47] eeh. still pointless. ssl. [05:47] what ssl? [05:47] smtp doesn't use ssl [05:47] i use webmail. [05:47] so your email is safe until you send/receive [05:47] yeah. i understand those rules. [05:48] till everyone starts doing dane/tlsa, I don't really get the whole encrypted email thing [05:49] if you secured your email, like with s/mime, or pgp [05:49] there would be no need for encryption [05:49] the only thing your somewhat protecting is your email history, from *before* they tapped your connection [05:49] ohkay. [05:50] so single disk it is that mounts the others via key. [05:50] well, the simple way is, use your password to unlock your root disk [05:50] then save the keys on your root disk, maybe like /etc/disk.keys/.... [05:50] and use those files to unlock the other disks [05:51] someone would have to copy those files first, to unlock the other disks [05:51] or have the password to unlock the first disk [05:51] that is the simple way [05:51] any other way, gets into messing with initramfs, and that isn't much fun [05:52] yeah. i think that way is best. [05:53] s/best/acceptable/ [05:53] and as far as the whole email thing, there is MX tls [05:53] 23:53 < patdk-lap> s/best/acceptable/ [05:53] ^^ agreed. [05:53] smtp mx tls is mitm [05:54] it is full of selfsigned, unsigned, broken, expired, certs [05:54] correct. but for "the people who care" that i exange email with, we have exchanged keys. [05:54] so you can't enable hard verification [05:54] * patdk-lap just has lots of ipsec tunnels [05:56] yeah i dont know if i trust creating an ipsec tunnel with someone. === Ursinha is now known as Ursinha-afk [06:18] <_root_> for IP Aliasing: both Ip should have the same MAC address? [06:20] you don't need to specify the mac [06:20] unless you're talking about something different than I'm thinking of :) === NomadJim_ is now known as NomadJim === freeflying_away is now known as freeflying [08:35] <_root_> I have to add my first IP to my VPS this way http://paste.ubuntu.com/6497998/ and because of that I cant get the eth0:0 to IP alias. could you give me a clue as to what should I do to get eth0:0 working [09:27] samba seem to be tricky to manage get installed there are some issues several places [09:31] are there samba install scripts that are up to date ? [10:08] How can I get /etc/crontab to run a script as if it is in the same working directory as the script? [10:08] nf7: cd /path/to/dir && /path/to/dir/script [10:08] ohhhhh [10:09] jkitchen: is this a messy way to do it? [10:09] that's the way to do it [10:10] jkitchen: awesome, thanks a lot [10:10] yup [10:10] nf7: Alt have the script start off by entering the desired working directory, assuming that applies equally well. [10:11] andol: it's a Python script, is it possible to do that? === wickedpuppy3 is now known as wickedpuppy [10:11] http://docs.python.org/2/library/os.html#os.chdir [10:12] thank you! [10:18] jkitchen: Is it possible to have os.chdir point to the scripts path (so it will work no matter where I put the script), or do I need to always manually enter the path? [10:28] nf7: http://docs.python.org/2/library/sys.html#sys.argv http://docs.python.org/2/library/os.path.html#os.path.basename [10:30] jkitchen: Thanks a lot. It's really hard for me to read and find my own information using the documentation. Is there some sort of guide on how to utilize the documentation properly? Or do I just need to learn more. [10:30] I am permalinking you directly to the functions you want [10:31] jkitchen: Right, I'm just asking for future reference. [10:31] oh [10:31] I just google for the function name [10:31] or thereabouts [10:31] Cause I need to stop bothering people so much about little things. [10:31] hah, it's fine [10:31] Ah ok, how long have you been programming with Python? [10:31] I don't [10:32] I've been a professional google user for about 13 years now though [10:32] hahah [10:32] that's always a good skill [10:32] do you program with anything though? or just use Ubuntu server? [10:33] I am a recovering perl user turned rubyist [10:33] dabbled briefly in python [10:33] cool, there's a lot of perl in linux isn't there? [10:33] I was fixing a problem with a wifi card's hardware a while back and I ran into a lot of perl scripts [10:33] there's a lot of a lot of stuff in linux [10:34] right [10:34] used to be perl was really popular for a lot of stuff though [10:35] still is, truth be told [10:35] Perl and Python are very similar aren't they? [10:35] lots of folks like me who can whip up all kinds of shit in perl in no time [10:35] but trying to keep up with the new hotness [10:35] That's what someone told me anyway. [10:35] perl python and ruby are like the romance languages [10:36] What kind of stuff do you use Ruby for? [10:36] my company is a rails shop [10:36] so... basically everything [10:36] Right, I've dabbled very little with Ruby, seemed almost identical to Python up to what I learned. [10:36] hah [10:36] not even remotely :) [10:36] Cool, so web development? [10:36] yeah of course, past a point [10:36] no, I'm ops [10:37] I just run the servers [10:37] interesting [10:37] but I use puppet for managing my servers, and foreman for managing the metal [10:37] so there's some ruby there [10:37] I've been programming for about 3 months right now. Just writing some Reddit bots, having them run on a Ubuntu server on an old netbook that I'm SSH'ing into. It's fun. [10:38] now that this migration is almost finished (working on it right now, in fact, should be done shortly) I'll be able to get into the code side of things a bit more and start making things suck less [10:38] cool [10:38] Well I didn't understand much of that but it sounds interesting. [10:38] What OS do you use for programming/personal use? [10:39] OSX is my daily driver [10:39] but really it's just a pretty terminal [10:39] chrome, iterm, adium, and a music player [10:40] my primary operating environment is an ubuntu server with about 2 dozen tmux sessions [10:40] Yeah I was using OSX as well but I recently switched back to Windows, I like 8.1 a lot. [10:40] I can't work on windows [10:40] like literally am incapable [10:40] Just don't like it or missing some particular program? [10:40] there are no terminals for windows [10:40] putty doesn't qualify. [10:41] putty is great for what it is, but it's not what I need. [10:41] plus I really enjoy having a proper unix command line on my daily driver [10:42] Whoops, lost the Wifi there for a moment, back though. [10:42] What did I miss? [10:42] dunno [10:43] I have one windows machine, and it's been turned off for the last 8 months. [10:43] Well the main reason I switched back to Windows is that I really like 8.1, they've figured out their hotkeys, took some pointers from OSX as well with the spotlight style search and a few other things. [10:43] Plus I really like Thinkpads [10:43] if I were going to use a thinkpad it would have linux on it. [10:43] Can get around 12 hours of battery with two packs and the docking base is amazing [10:44] but there is no finer laptop than the 13" retina macbook pro [10:44] I love coming home and simply snapping it on and having it connect to the speakers, mouse, screen, keyboard, external hd instantly, it's great [10:44] Yeah that's actually what I had as well, great machine [10:44] "docking base" [10:44] some proprietary thing [10:44] yes it's lenovo proprietary [10:45] I have a thunderbolt display [10:45] very similar [10:45] the apple one? [10:45] yes [10:45] that's one of the nicest screens, crazy expensive though [10:45] was free [10:45] I think if I ever bought an OSX machine again I'd get a 13 inch Macbook pro [10:45] the battery on those things is crazy [10:45] macbook air* [10:45] everything on this thing is crazy. [10:46] oh, not the air [10:46] I am spoiled by retina [10:46] yeah the retina is great [10:46] I love how you can scale the resolutions [10:46] you know what I'm talking about? [10:47] I only use it at the 1680x1050 effective resolution [10:47] I like it at whatever the default it [10:47] is* [10:48] dunno, I love linux on the desktop, but I also love not having to fuck with my laptop to have it work [10:48] there is no need for tha language jkitchen [10:48] sorry [10:48] no problem, thank you [10:49] (didn't realize mac was a dirty word, amirite?) [10:49] haha [10:49] I kid. [10:50] I came close to buying a thinkpad or samsung series 9 this time around, but then the mavericks preview came out where they were talking about the battery optimizations they were doing at the OS and hardware levels and stuff [10:50] mind blown [10:50] sorry but there's just no way linux can compete with that :( [10:51] OSX has crazy good power utilization. [10:51] that's the kind of stuff you can do when you are fully vertical [10:51] Windows must be the worst. [10:51] Even so, I get really good battery life on my ThinkPad [10:51] for sure [10:51] I've actually removed all Lenovo drivers [10:52] there were a bunch of power management ones, but I notice no difference whatsoever with them off. [10:52] but there's always that time when you're sitting there and boom, 90% -> 10% in what feels like minutes because something is chewing up power [10:52] Yeah true [10:52] happened on my android phone all the time [10:52] happened on my thinkpads in the past [10:52] I do miss linux on the desktop though. [10:52] I can't stand all the tools and utilities Lenovo puts on their machines (even if they aren't bloatware technically), first thing I did was a fresh install from a Microsoft CD [10:53] is this really anything to do with ubuntu server ? [10:53] perhaps take it to one of the offtopic channel please ? [10:53] heh [10:53] I was just heading out anyway, thanks for the help. [10:54] np, good luck [10:54] Hi I have a system without a graphics card and I want to set up ubuntu server on it, what would the best way to do this be? [10:54] a serial connection [10:54] Gilligan94: network console [10:54] so I'll beable to install it over SSH? [10:54] it really doesn't even have like an onboard vga? weird. [10:54] Gilligan94: yup [10:55] yea no VGA this is an AMD system [10:55] doesn't mean it doesn't have a vga port on board [10:55] in fact with newer AMDs it seems like it's hardecr to get one WITHOUT an apu than with... [10:55] in this case it doesn't have any VGA [10:55] crazy [10:56] I believe this mobo and CPU was aimed at gaming so they just assumed you would use a dedicated GPU [10:57] what is the motherboard model [10:57] not sure, I dont have it on hand currently [10:59] not even hdmi?! [10:59] * jkitchen is baffled [10:59] nope nada [11:00] kinda cool IMO keeps the cost down [11:00] eh [11:00] by about $2 [11:00] anywho OFF TOPIC [11:00] try the network installer. [11:00] every little bit counts >.> [11:00] alright thanks [11:01] or serial console [11:01] but I doubt it has a serial port [11:01] yea I dont think it does [11:01] if it's not got any form of vga for "cost saving" they won't have put a serial port on [11:01] right [11:02] any advantage to using 13.10 over 12.04? [11:02] plenty [11:02] Gilligan94: it really depends on your needs [11:02] go with 13.10 unless you need LTS [11:03] alright [11:51] does there exist scripts up to date for install of samba ? [12:01] blueking: the package manager will manage updates [12:05] Hi there. I need a little assitance with mx records. I successfully set multuiple A records for server's IP. So when I go to mydomain1.com it goes there without a problem. It's the same with mydomain2.com Now I'd like to set up MX records for mail server for mydomain1.com. Under free DNS hosting section of my host provider, I set up: Name: mydomain1.com, Type: MX, Value: IP [12:06] WHen I do dig -t mx mydomain1.com I can't see mydqomain1.com under mx... [12:06] Am I doing this correctly? [12:07] I also tried for google mails and it's rather different then I did: Name: atl1.aspmx.i.google.com, Type: MX, Value: mydomain1.com [12:07] dns changes will take time to go live [12:07] So: do I have to first set A recrod for mail.mydomain1.com and then use this? [12:07] mx records need to be a vali dhost name too [12:08] ikonia: I've set up yesterday and still not seen. [12:08] is the fqdn of the mx host able to be resolved [12:08] ikonia: so in theory, if I set first A record: mail.mydomain1.com for server's ip and then use for mx like this: mail.mydomain1.com Type: MX value: mydomain1.com will it work? [12:08] MX has to be a fqdn, not an ip [12:09] aha [12:09] we found a problem [12:09] let me try [12:11] It says changes will be visible in max 4 hours [12:12] Nevertheless I noticed a few problems with postfix [12:14] postfix/cleanup[1128]: warning: mysql:/etc/postfix/mysql-virtual-alias-maps.cf lookup error for "root@mydomain1.com" this warning each second, which is worring me [12:14] log is already 18MB big [12:14] ioptop is running like crazy :) [12:15] In that *.maps.cf I have user, password, hosts, dbname and query [12:17] Also in that file, user is not root === julian is now known as alamar === Ursinha-afk is now known as Ursinha [12:43] ikonia: not that kind I was thinking.. but script to get everything installed [12:44] the package manager will install everything [13:57] i used ubuntu-s for five years guys [13:57] please like https://www.facebook.com/DwayneJohnson [13:57] the rock [15:07] Ok. I have setup a MX record for mydomain1.com as mail.mydomain1.com and is also seen if I do dig -t mx mydomain1.com [15:07] What does that error mean for postfix? Nevertheless I noticed a few problems with postfix [15:07] postfix/cleanup[1128]: warning: mysql:/etc/postfix/mysql-virtual-alias-maps.cf lookup error [15:55] Hey all, anyone know if there is a netatalk channel? [15:56] or anyone able to help bme with some netatalk issues [15:56] s/bme/me/ === mjohnson15_2 is now known as mjohnson15 [16:45] I've tried adding a second hard drive to my ubuntu server machine but now it won't boot up. It gets stuck at verifying dmi pool. Any ideas? === mibofra- is now known as mibofra [18:47] Hey guys any one here who can help out with a VPN problem ? [18:50] ?ask [18:50] ??ask [18:51] don't ask to ask, just ask. if someone can help and is willing, they might just do that [18:53] yes. but i dont know what your problem is. [18:56] sorry got called away from the machine as i typed enter [18:56] I'm having some problems understanding generating the certificates [18:56] bitbyte: what sort of vpn are you creating, openvpn? [18:56] I am following the setup outlined here : http://serverfault.com/questions/212382/how-to-set-up-strongswan-or-openswan-for-pure-ipsec-with-iphone-client [18:57] but the openssl command I am having trouble finding any details for. Any ideas on some documents to read up more on it [18:57] there's always 'man openssl' [18:57] I am setting up StrongSwan on ubuntu server, I think I have the config right. But when i generate the certs they don't seem to work right [18:58] but basically that guy is setting up a CA and such [18:58] for my vpn (openvpn) I use the easy-rsa stuff that ships with openvpn [18:58] to manage my ca [18:59] If I'm just setting up a home VPN would i need to setup the Certificate Authority ? [18:59] yes [18:59] I was looking on ss64 for the openssl command but had no luck [18:59] if you follow those directions on the page exactly, it should work fine [18:59] what step did you have trouble with? [19:00] Ok I will give it another shot, The issues began when i copied the certs over to my osx test laptop and it did not recognize the certs even when fully important to keychain [19:01] The setup I have at the moment is : http://pastebin.com/g2yhYYC0 [19:02] If I understand this correct the leftsubnet 10.10.10.x/24 will be the network the VPN clients are on and 0.0.0.0/24 will accept any inbound IP's [19:02] I can't speak to that part, sorry [19:02] and having the interfaces=%default route it should pass it through to the em1 ethernet interface and connect it to my internal 10.10.5.x/24 network [19:04] There was one other item i was wondering about which was that when i run the openssl to generate the certs it asks for a password, Can this be taken off ? [19:05] Because if I understand it correctly, it will require the password to be entered every time its requested to be used. [19:16] yes you can leave it blank and push enter [19:17] When i pushed enter it seems to exit the creation of the cert [20:29] hello [20:31] I have a question about reboot/init 6 I have an issue with it tried google for it but found no answer to it, maybe someone here knows ? the issue about reboot/init 6 is that it shuts down computer and doesn't restart are there ways to force pc/linux restart ? I am running ubuntu server 13.10 [20:56] Hi guys, I'm trying to find out why my Ubuntu 12.04 server with Postfix/Dovecot suddenly stopped receiving emails. Sending works fine. Could someone give me a hand? [21:01] Please? [21:12] Anyone? [21:23] I have a question about reboot/init 6 I have an issue with it tried google for it but found no answer to it, maybe someone here knows ? the issue about reboot/init 6 is that it shuts down computer and doesn't restart are there ways to force pc/linux restart ? I am running ubuntu server 13.10 [21:53] How do I decrypt a pgp message? [21:54] you need the private key [21:54] then you just gpg --decrypt [22:03] jkitchen, do you have a compleate example? [22:04] sander^home: huh? [22:04] gpg --decrypt filename [22:05] jkitchen, ah, ok. And what argument do I spesify the private key, and where do I spesify the message? [22:05] sander^home: you need the private key in your keyring [22:05] and you can either pipe the message in or specify a filename [22:06] gpg will figure out which private key to use to decrypt the file if you have multiple private keys in your keyring [22:07] jkitchen, how do I import the private key into my keyring? [22:09] sander^home: gpg --import keyfilename [22:09] or you can pipe the key into --import [22:16] jkitchen, seems like I got an public key..and a message [22:17] sander^home: if you don't have the private key you can't decrypt the message [22:17] that's kinda the point [22:24] jkitchen, ok. Thanks alot:) [22:27] Hi guys, I'm trying to find out why my Ubuntu 12.04 server with Postfix/Dovecot suddenly stopped receiving emails. Sending works fine. Could someone give me a hand? [22:30] noone had problem with shutdown -r, reboot, init 6 ? [22:30] zkvvoob: what's in your maillog? [22:30] also, what's the domain? [22:31] jkitchen: http://paste.ubuntu.com/6501474/ [22:33] Dec 1 00:20:02 server sm-mta[7723]: NOQUEUE: SYSERR(root): hash map "access": missing map file /etc/mail/access.db: No such file or directory [22:33] that's not postfix, for one [22:34] sm-mta I'm gonna guess is sendmail [22:34]