/srv/irclogs.ubuntu.com/2014/04/14/#ubuntu-server.txt

=== RaptorJesus_ is now known as RaptorJesus
mwhudsonhm03:50
mwhudsoncan i use uvt-kvm to create a vm backed onto a lvm lv?03:51
=== sz0` is now known as sz0
=== sz0 is now known as sz0`
MiploHi, do I need to permit root login on an Ubuntu server using SSH? Wouldn't the actual admin user be enough? (using sudo)04:00
=== sz0` is now known as sz0
rahuldroyHey Guys, I have a quick question. I am planning to make a closed-source website using MySQL as a database. Will I be legally allowed to do that?05:26
sheptardare you planning on redistributing mysql?05:32
sheptardor just using mysql to drive the website05:32
rahuldroyjust use mysql to drive the website05:32
sheptardthen why would they care05:33
rahuldroyI don't want to do anything illegal05:33
sheptardalso, IANAL05:33
rahuldroyhaha neither05:33
rahuldroyjust tyring to make sense of open source licences05:33
rahuldroyBSD and MIT Seems to have no restriction on commercial use05:34
sheptardthose licenses usually only matter if you plan to use the actual code in another product, or redistribute said product05:34
rahuldroyGPL seems to though05:34
rahuldroylets say I get an GPL Software and customize the code to my needs05:35
rahuldroyDo I need to make the modifications freely available??05:35
sheptardonly if you want to05:36
sheptardassuming you aren't selling the software05:36
rahuldroythats what I though as well. Does this include saas software??05:37
sheptarddon't think so05:39
sheptardagain, IANAL05:39
rahuldroyI think it would be be best if I avoid GPL code on my project completely just to be safe but I will keep using MySQL though05:41
=== maddiecn is now known as maddiez
EpicCyndaquilI tried asking in #ubuntu but no one there answered, and you all are probably better with bash anyway: can anyone help me understand why this bash script doesn't work? https://3d3.ca/yLLXL.bash#VT23LM5SHgTzkCLU05:59
vonsyd0wEpicCyndaquil, what about the #bash channel?06:01
EpicCyndaquilah, good idea :)06:01
EpicCyndaquilshellcheck.net was enough to help me figure it out, so thanks for bringing up #bash, vonsyd0w06:03
vonsyd0wno prob, my bash skills arent that great... yet06:04
Alina-malinathis cronjob is it recommended to use in high load mode? for example i have multiple users they add posts and the crontab removes those after 5 hours, will that be problem if there are 5000+ users?06:11
lordievaderGood morning.06:19
prgCoderhey guys - I have a weird problem and my head already hurts...06:20
prgCoderhad a problems where a suse server all of a sudden started to poll the internet and started to use up a lot of bandwidth06:21
prgCoderlocal it admin said it was only out going.....06:21
prgCoderso I grapped another box, formatted the drive and install ubuntu 12 server and transaferred programs and data to it06:22
prgCodera day later the same thing started to happen - the suse server is off and the new ubuntu server is up and the local IT admin says this server is plling the internet, over and over again06:23
prgCoderany ideas on what to look for and where this is coming from - I havetried wireshark and a few others but I have no clue what to look for06:24
lordievaderprgCoder: Investigate what is using it ;) iftop -P might come in handy there.06:24
prgCoderI will give that a go when the local admin either turns it back on or can some how retard the server from using up most of the bandwidth so i can get in remotely06:25
prgCoderwhat should i look for?06:26
lordievaderprgCoder: Something that uses a lot of bandwith. It will show the src ip+port and dst ip+port. From there you can make up which service/application is responsible.06:29
prgCoderloadievader: thanks06:29
prgCoderlordievader: thanks06:31
lordievader:)06:33
lordievaderprgCoder: Good luck06:34
prgCoderthanks06:34
=== Nolar2_ is now known as Nolar2
dv81whats the easiest tool to backup/restore an entire server's disk?09:10
dv81to an offsite location09:11
jpdsI doubt you'll find something "easy".09:12
dv81"easiest"09:12
jpdsdv81: Well, I can only give suggestions like bacula, rsync, obnam, ....09:17
dv81*googles*09:17
lordievaderI find dirvish quite easy (I've come to understand that dirvish is an rsync wrapper).09:18
alesalesexist also a tool named relax and recover :)09:20
alesaleshttp://relax-and-recover.org/09:20
alesalesis like aix mksysb or OS/400 SAVSYS :)09:20
dv81thanks guys09:21
dv81looking for something that will image a disk, grub and all rather than just certain parts of the fs09:22
dv81alesales: Rear, looks good thanks09:22
alesalesI never tried...I just heard about that09:23
alesalesI'm not working with Linux on x86 :)09:23
=== sz0 is now known as sz0`
=== sz0` is now known as sz0
=== sz0 is now known as sz0`
ashdsetting up ldap and samba - ubuntu 14.04 following the ubuntu docs and walkthrough. “id user” shows uid,gid and groups.. but only main group… ldapid shows all the groups… is this the correct behavoir, or have i done something wrong somewhere.10:45
Proshotafternoon when i login into ubuntu server via ssh i get this welcome http://pastebin.com/46THn4se i was wondering where the config is that displays this message11:02
jamespagesmoser, roaksoax, zul, hallyn: I've added some content to https://wiki.ubuntu.com/TrustyTahr/ReleaseNotes for server this morning11:06
jamespageI've left some placeholders for MAAS and libvirt right now - if you want to draft something appreciated :-)11:06
jamespagegaughen, ^^11:06
Proshotanybody any idea where i get the config files which displays that message11:23
gt8ost4lanyone know how i can somehow change the mysql default name11:59
=== psivaa is now known as psivaa-lunch
bekksgt8ost4l: default name?12:00
gt8ost4lyeah the name you give the mysql server the first installation12:01
bekksgt8ost4l: you dont set any names for mysql servers at all during installation.12:01
gt8ost4lso its just a password and thats all12:02
bekksgt8ost4l: you have to enter a password for the mysql root user during installation.12:03
gt8ost4lso root is just the default12:03
bekksgt8ost4l: thats the default mysql username of the mysql root user, yes.12:07
gt8ost4lso theres no way to change that username12:08
bekksgt8ost4l: Create a new user, done.12:08
gt8ost4lhow do i do that12:09
bekksgt8ost4l: https://dev.mysql.com/doc/refman/5.1/en/create-user.html12:09
rbasakgt8ost4l: don't change the name of the root user. The maintainer scripts need root access for upgrades, etc, and so if you change the username you'll break upgrades.12:15
rbasakgt8ost4l: creating another user for what you want is fine.12:15
zuljamespage:  https://code.launchpad.net/~zulcss/heat/heat-mir/+merge/21549412:47
Havenstance2good morning, is there a work around for the gpg not found error in 13.10?13:04
rbasakWhat gpg not found error?13:05
Havenstance2I keep getting a gpg not found error when I try to pull in a key. not sure why it just says gpg package not found13:06
Havenstance2wget -q http://keys.zentyal.org/zentyal-3.4-archive.asc -O- | sudo apt-key add -13:06
Havenstance2I enter that then it returns, gpg not found13:06
Havenstance2the machine sitting right next to it takes the command and returns OK13:07
Havenstance2only difference is one is server 13.10 amd64 the other is server 13.10 i38613:08
Havenstance2and its the amd64 throwing the error13:08
rbasakHow did you install the broken machine?13:09
rbasakThe apt package depends on the gnupg package.13:09
rbasakYou might be able to install gnupg to fix the problem, but it sounds like you have a bigger issue there.13:09
rbasak(or something wrong with your PATH or something)13:10
=== psivaa-lunch is now known as psivaa
=== Havenstance2 is now known as Haven|Work
Haven|Workrbasak, I just did a fresh install so we will find out when it finishes. I had a network failure on Friday about the time I set this machine up so its possible that it didn't pull a package it needed13:24
jamespagezul, one typo but other than that +113:24
zuljamespage:  saw...thanks13:26
jamespagehallyn, could you take a look at bug 1305280 - might be related to bug 130416713:26
uvirtbotLaunchpad bug 1305280 in apparmor "juju command get_cgroup fails when creating new machines, local provider arm32 " [Undecided,New] https://launchpad.net/bugs/130528013:26
uvirtbotLaunchpad bug 1304167 in apparmor "syntax error, trusty beta-2 cloud image" [Undecided,Confirmed] https://launchpad.net/bugs/130416713:26
zuljamespage:  im just catching up precise-icehouse this morning13:42
jamespagezul, libvirt and xen?13:43
zuljamespage:  yep13:43
jamespagezul, I'm just sorting out the publishing issue - ceph built twice for armhf on the last version13:44
jamespagehashsum mismatches all round13:44
zuljamespage:  uh ok :)13:44
smbzul, Still the build in P problem? Most admit I have not yet checked how well the current 4.4 does as I tried to make arm64 more real13:44
zulsmb:  still the P problem i have a work around for it though13:45
smbzul, ok sounds good13:45
jamespagezul, your patch for heat is still worng13:50
zuljamespage:  arrgh13:50
zuljamespage:  gimme a sec13:50
jamespagezul, you might want to change the name of the patch as well13:51
jamespagesuder ->sudoers13:51
smoserroaksoax, where are we on maas ?13:58
zuljamespage:  https://bugs.launchpad.net/bugs/130751813:59
uvirtbotLaunchpad bug 1307518 in glance "ERROR "CRITICAL glance [-] AttributeError: 'NoneType' object has no attribute 'drivername'" in /var/log/glance/api.log" [Undecided,New]13:59
smoser:-(13:59
hallynhm.  stgraber: ^ wonder if bug 1304167 could be due to the new pivot_mount rule (i haven't dug yet)14:00
uvirtbotLaunchpad bug 1304167 in apparmor "syntax error, trusty beta-2 cloud image" [Undecided,Confirmed] https://launchpad.net/bugs/130416714:00
jamespagezul, eh14:03
jamespagezul, I'll try to reproduce14:04
zuljamespage:  ditto14:04
stgraberhallyn: that sounds more like a problem with the new apparmor statements14:07
hallynoh god.  is this in cloud archives again?14:07
hallynpeople really need to mentin that14:07
jamespagezul, I see that we are missing "schema-image.json"14:09
jamespagehmm14:09
zuljamespage:  arrgh so we are14:11
jamespagezul, and that the perms on /var/lib/glance/images and /var/lib/glance/image-cache are wrong14:11
stgraberhallyn: no, it's just the LXC upload done by the apparmor folks being wrong14:11
jamespagethey are not writable by the glance user14:11
stgraberhallyn: LXC doesn't version depend on apparmor so it'll happily install with the wrong apparmor version14:11
hallynstgraber: feh.  (i'm still waiting for an upgrade so i can get to testing)14:11
stgraberhallyn: I have a debdiff here, uploading in a minute14:11
jamespagezul, ah crap - that's a regression from fixing bug 121494714:11
uvirtbotLaunchpad bug 1214947 in glance "chown in postinst fails on netapp storage" [Low,Fix released] https://launchpad.net/bugs/121494714:11
hallynstgraber: thanks14:12
jdstrandstgraber: what upload? the one I did added the sed rules and was acked by stgraber14:12
jdstranderr, by you14:12
jamespagehmm14:12
* jdstrand uploaded 1.0.2-0ubuntu214:13
stgraberjdstrand: right, and we missed the fact that you need a versioned dependency on apparmor too.14:13
stgraberjdstrand: so that precise -> trusty doesn't break14:13
jdstrandwouldn't that have broken with the dbus rule too?14:14
stgraberit probably did in some cases but since people don't care much about non-LTS releases we never heard about it14:14
stgraberjdstrand: http://paste.ubuntu.com/7249946/14:14
jamespagezul, this highlights a gap in testing I think14:15
zuljamespage:  we seem to be missing property-protections-policies.conf.sample property-protections-roles.conf.sample as well14:15
zuljamespage:  agreed14:15
jamespagezul, hmm - those are just samples14:15
jamespageless worried about those14:15
roaksoaxsmoser: check the bug :)14:16
jdstrandstgraber: hrmm, apparmor itself has: Breaks: ..., lxc (<< 1.0.2-0ubuntu2~), ...14:16
smoserroaksoax, i thought we agreed to upload without that feature14:17
smoserwith the 2 bug fixes14:17
stgraberjdstrand: right, so apparmor won't upgrade with an old LXC, but LXC will happily upgrade with an old apparmor14:17
stgraberjdstrand: bug 130416714:17
uvirtbotLaunchpad bug 1304167 in apparmor "syntax error, trusty beta-2 cloud image" [Undecided,Confirmed] https://launchpad.net/bugs/130416714:17
hallynhm, that's not gonna help ppl upstream14:17
stgraberjdstrand: that's someone getting a cloud instance of beta2, doing apt-get update && apt-get install lxc without doing a dist-upgrade14:17
stgraberjdstrand: they get the new LXC but not the new apparmor and things break14:17
hallynideally there'd be versioning built into the policy language :)14:17
jdstrandwhy doesn't beta2 have the new apparmor?14:18
jdstrandhallyn: we are getting there14:19
stgraberno idea, though the problem should also happen when doing 12.04 to 14.04. apt may very happily resolve the upgrade path as lxc in a first batch and apparmor in a second one. Which will cause the exact same failure.14:19
stgraberOn smaller upgrades, you get a single batch so the apparmor breaks is enough to sort out the configure ordering but if they are each in their own batch, then things will break.14:20
stgraberjdstrand: anyway, I think my fix should be enough for that, I'd just suggest you make sure any other affected package gets something similar or I'd expect quite a few confusing upgrade bugs to show up soon enough...14:21
jdstrandI don't know how apt will sort these things, but slangasek said the Breaks was enough to dtrt for upgrades. I didn't do 12.04 to 14.04, but I did do upgrade test of lxc under that version and it all worked14:21
jdstrandif apt isn't breaking isn't honoring that, that seems like a bug in apt14:22
jdstrand(otherwise why even have the Breaks mechanism at all)14:22
jdstrandnow, I get that a cloud image with the old apparmor will happily install a new lxc14:23
stgraberno, what apt is doing is perfectly correct. Your debian/control only prevents me from upgrading apparmor before lxc itself has been upgraded.14:23
stgraberbut I can upgrade lxc itself independently of apparmor and nothing will force me to get the right parser14:23
roaksoaxsmoser: well... there is some discussion as to how to14:24
roaksoaxsmoser: well... there is some discussion as to how to publish that the setting is enabled14:24
hallynjodh: ok i'll go ahead and push 'stop on [06]' for cgmanager;  if/when someone has a problem due to it, we can revisit.  ideally there would be a signal emitted right before final umounts (/var and /)14:25
smoserroaksoax, 2 bugs need fixing14:25
smoserindependent (i thought) of feature being added14:25
zuljamespage:  https://code.launchpad.net/~zulcss/glance/lp1307518/+merge/21567914:25
smoserand i had hoped we'd upload with 2 bugs fixed14:25
jodhhallyn: right, although upstart isn't doing the unmounting.14:25
roaksoaxsmoser: i know14:26
roaksoaxsmoser: feel free if you want to go ahead and upload those14:26
hallynjodh: what is?  doens't seem to be mountall...14:26
roaksoaxsmoser: cheery pick and patch the ubuntu package14:26
jdstrandstgraber: I understand that the cloud image having an old apparmor, apt-get update, apt-get install lxc doesn't work. I'm saying that a do-release-upgrade or apt-get dist-upgrade where apt breaks this into chunks that don't correctly honor the Breaks would be a bug14:27
jodhhallyn: /etc/init.d/umount*sh14:27
jdstrandwhen was the beta2 image generated?14:27
=== tyhicks` is now known as tyhicks
roaksoaxsmoser: i rather make I upload than make 2 though14:28
stgraberjdstrand: having apt do the upgrade in two chunks, first upgrading 200 packages including LXC, then upgrading another 300 packages including apparmor, would honor the Breaks and would make the upgrade fail.14:28
roaksoaxsmoser: that's why I'm saying, follow the bug as the latest developments are happen there and for the looks of it, it is just deciding how to notify the user about the setting being enabled by default14:28
jdstrandstgraber: who is breaking that up into chunks? the user or the upgrader?14:29
stgraberjdstrand: because it'd technically never have the new apparmor installed before the new lxc, so the Breaks would be satisfied14:29
stgraberjdstrand: apt does it when there are massive set of packages with complex dependencies (most pre-depends and the like). A lts-to-lts upgrade usually qualifies...14:30
stgraberjdstrand: you'll often see apt do multiple configure runs during a dist-upgrade, that's the easiest sign to see it do the chunking14:30
hallynjodh: ok so we may just have to provide guidance that any upstart jobs using cgm in post-stop should do '|| true'14:30
stgraberso download of everything => unpack => configure => unpack second chunk => configure second chunk => ...14:30
jdstrandstgraber: ok, so I'm saying that if in its chunk calculation it allows what you are saying, its calculation is wrong. it should always put them in the same chunk14:31
stgraberjdstrand: why?14:32
stgraberit'll always ensure that apparmor isn't installed before the new lxc because that's what you said in your Breaks14:32
jdstrandbecause it would break on upgrades when the Breaks is explicitly there to prevent that14:32
stgraberbut that's as much as it'll do for you14:32
stgraberas that's as much as you asked it to do14:32
stgraberit won't at all prevent lxc from going in a first chunk on its own and then apparmor in a second chunk14:33
stgraberbecause that'd perfectly respect your Breaks14:33
jdstrand"When one binary package declares that it breaks another, dpkg will refuse to allow the package which declares Breaks to be unpacked unless the broken package is deconfigured first, and it will refuse to allow the broken package to be reconfigured."14:34
stgraberso? apt will respect that and things will still break14:35
jdstrandthe broken package is lxc14:35
stgraberthere's no break against installing the new lxc with the old apparmor14:35
jdstrandyet, it is being configured before apparmor14:35
stgrabersure because the old installed apparmor doesn't break on the new lxc14:35
jdstrand(in your scenario)14:35
stgraberit's just the new apparmor which breaks on the old lxc, but they can be installed 6 months appart for all apt cares14:36
jdstrandI get that-- but the calculation is wrong. the intent of a massive upgrade is for everything to be upgraded14:36
hallynjdstrand: does 'we are getting there' for versoined policy language mean that we might get them during 14.10, or that we might get them during 16.04 timeframe?14:36
jdstrandif apt breaks it up into a bunch of little things that get you a different upgrade, that is wrong14:37
stgraberjdstrand: well, usually the point of doing things in chunk is to make the whole upgrade possible to resolve... and unless lxc has a version dependency on the new apparmor or a break against the old apparmor, apt won't necessarily put them both in the same batch14:38
jdstrandhallyn: you'd have to ask jjohansen. it is recognized as a real problem. I would guess 15.04 though. we are trying to get abstract sockets and lxc finished up first14:38
hallynjdstrand: thanks14:38
jdstrandthey are both quite close actually, but trying to be realistic14:38
jdstrandsmoser: hey, who generated the beta2 cloud images?14:39
smoserjdstrand, they're built in automation14:40
smoserutlemming would have marked it as 'beta-2'14:40
jdstrandsmoser: so, looking at bug #1304167, I'm quite surprised the old apparmor is still there14:40
uvirtbotLaunchpad bug 1304167 in lxc "syntax error, trusty beta-2 cloud image" [High,Triaged] https://launchpad.net/bugs/130416714:40
jdstrandsmoser: is there an easy way to see a package list with versions of that? is there a beta 3 already?14:41
=== rbanffy_ is now known as rbanffy
jdstrandstgraber: I maintain that is a bug in apt if it operates differently with small and massive upgrades14:42
jdstrandI don't know that it actually does. I've not seen any upgrade bugs yet.14:43
jdstrandI guess I can try an upgrade, but if what you say is correct, then upgrades are non-deterministic and just cause my upgrade succeeds doesn't mean yours would14:44
stgraberjdstrand: well, I don't feel like arguing for hours, it's not an apt bug neither is it something new, I had to fix around 50 of those with the last lts to lts upgrade for 12.04.1. apt does respect your dependencies, however assuming that everything is processed in a single run is wrong and will lead to problems on massive upgrades.14:45
stgraberjdstrand: feel free to file a bug against apt though, I'm sure mvo will be happy to discuss it though I still expect the outcome to be that packages need to clearly define what they need, which in this case wasn't the case.14:46
* jdstrand doesn't want to argue anymore either14:46
jdstrandI find it curious that 13.04 to 13.10 didn't have the same issue with dbus policy though14:47
stgraberjdstrand: well, you need to be pretty unlucky and the larger the set of package and the further they are appart the more likely it becomes. I'd expect 13.04 to 13.10 to be just a few hundred packages, that don't have a massive amount of transitions going on with complex pre-depends/breaks and such. So the upgrade may have happened in a single chunk (if it was resolvable that way) or maybe two, in which case we basically had a 50% chance of14:52
hallynsmb: for bug 1218959, did you look to see what patches fedora is currently using? :)14:52
uvirtbotLaunchpad bug 1218959 in libvirt "KVM virbr# no longer forwards multicast traffic by default (U12.04)" [High,Confirmed] https://launchpad.net/bugs/121895914:52
hallynanyway if that route isn't simple i'll do the darned udev rules.  i'm not sure if we should have later releases remove them then, but they should be safe14:53
stgraberlts to lts tends to be more like 5-6 runs, especially if we get things like massive debhelper, upstart, libc, ... changes with strict dependencies, it's therefore much more likely to show up in lts to lts than in any other upgrade case14:53
stgraber(lts to lts are also pretty much the only case where we may get to the point where apt just plain fails to resolve an update, no matter who many chunks it makes)14:54
smbhallyn, No, if its not mentioned in the bug report (and I have not yet read it carefully) its always a bit hard to find. I wanted to check on the two I think may be the ones. But have not yet got there either14:54
hallynsmb: ok lemme check one more time, ithought someone said the udev workaround did not work for them.  if nooe said that, we'll do the workaround14:55
zuljamespage:  ok updated14:56
smbhallyn, Ok, if they do work it maybe is the simpler route for older kernels. What we will do if that does not work we'll figure out when it does not work. That always works...14:59
jamespagezul, +115:01
zuljamespage:  thanks15:01
jamespagezul: nope -thankyou!15:01
hallynsmb: ok yeah let's go with the udev rules.  ttyl15:02
jamespagecoreycb, your grizzly->icehouse upgrade; can you check the keystone.conf post upgrade please15:04
lordievaderGood afternoon.15:16
coreycbjamespage, sure15:18
coreycbjamespage, I had compared it vs the havana->icehouse and they were the same post upgrade15:18
jamespagecoreycb, ack15:19
* jamespage thinks again15:19
jamespagecoreycb, the only thing I can think is that something did not happen in the db migrations15:19
coreycbjamespage, http://paste.ubuntu.com/7250219/15:19
jamespagecoreycb, that looks aok15:20
coreycbjamespage, ok yeah I was thinking the same.  I can test vs rc2 branches if you think anything's changed.15:20
jamespagecoreycb, I don't think so15:27
jamespagezul, we might want to considering doing that late-restart thing with debhelper dh_installinit in the packaging15:31
jamespageright now if you get a kernel update, nova-compute and stuff stays down for a long time15:31
=== chuck_ is now known as zul
TazaChonchahello there15:54
ZalHello all. I'm having trouble running an 'apt-get upgrade' on an Ubuntu 12.04LTS EC2 instance. The process stuck at grub-pc. After aborting, the process sticks at lvm2. Now "apt-get upgrade" tells me to run "sudo dpkg --configure -a", which itself sticks again at lvm2. Any tips on getting fixing this installation?15:56
ZalAll I see in dpkg log is a message telling me lvm2 is half configured, when the process freezes15:57
hallynwe're missing a zul16:05
hallynsmb: i just uploaded a new libvirt-bin.  are you done with xen-releated libvirt uploads?16:06
ZalI manually killed the dpkg and frontend processes, blacklisted lvm2 and grub-pc, after which dpkg --configure -a ran successfully. I'm still concerned about the state of my instance though, any pointers are appreciated.16:06
hallynZal: might ask in #ubuntu-devel.  lvm upgrade error would scare me too...16:06
smbhallyn, If you did a ubuntu13 for T that is fine by me. The 12 was the one I had16:06
hallynsmb: yeah 13 (phew)16:07
hallynZal: take a look at /var/log/apt/term.log for details on teh lvm failure.16:07
smbhallyn, Ok, so we are good (hopefully) :)16:07
Zalhallyn, thanks, I'll look there again, didn't see anything previously16:07
Zalyeah, no errors there16:08
hallynZal: my *guess* is that there is a hung udev rule which is holding a lock16:16
zuljamespage:  just about to seed heat16:17
axisyshow to encrypt a folder in my dir? I am sharing this precise 64bit server with multiple system admins16:20
axisysI like it auto decrypt when I login and only try to access the folder16:21
axisysand when I get out of the folder/dir, it will go back to encrypt.. is it possible?16:22
axisysI dont mind to do it manually ..16:22
axisysso decrypt; access the folder; exit the folder; encrypt16:23
axisyshttps://help.ubuntu.com/community/FolderEncryption looks interesting16:23
zuljamespage/coreycb: glance rc2  has been accepted16:25
jamespagezul, w00t - I think that means only swift and neutron are still in the queue right?16:33
kosmoHi I got problem with my apache server. All was right but after week serevr just crashed and I cant start it.16:47
jpdsPlease explain what you mean by "crash".16:48
kosmoI cant accces it from my local network16:48
bekksThen investigate the logs.16:48
jpdsAny debug?16:48
jpds"Crash" could mean anything from meteor strikes, cosmic rays, annexation by Russia, etc.16:49
kosmoand apache status command resutlts apache server is not running lolz16:49
bekkskosmo: Then check the logs.16:49
sarnoldoh that crazy putin, here he goes again16:49
jpdssarnold: He's putin'g himself in your servers.16:49
bekksNow he crashes server. Does he even pay that "peer" who always terminates connections?16:49
sarnoldjpds: lol16:50
bekksjpds: :D16:50
sarnoldbekks: hahaha16:50
jpdskosmo: So you can *access* the server from SSH, but not on HTTP?16:50
kosmoweell the thing is error.log file is empty16:50
kosmojpds yes smbd also works gr816:51
bekkskosmo: Which ubuntu release is it?16:51
kosmo12.04 LTS16:51
patdk-wkdid you check dmesg?16:52
kosmoyou mean the msg after service apache2 start?16:54
RoyKkosmo: just type 'dmesg'17:00
jamespagejdstrand, around? I just got asked to look at the seed changes for bug 1266066 but need some guidance from the security team17:05
uvirtbotLaunchpad bug 1266066 in unbound "[MIR] strongSwan" [Undecided,Fix committed] https://launchpad.net/bugs/126606617:05
jamespagejpds, technically mterry needs to ack unbound still as well17:06
jpdsjamespage: All tests run as of https://launchpad.net/ubuntu/+source/unbound/1.4.22-1ubuntu417:08
jdstrandjamespage: what do you need?17:08
jamespagejdstrand, just a bit confused as to what actions need to be taken - the bug report references removal of ipsec-tools - but I see racoon that still depends on that17:09
jamespagejdstrand, I was just going to push strongswan into the supported-misc-servers seed17:09
jdstrandracoon is superceded by strongswan, no?17:09
jdstrandjpds: ^17:09
jdstrandjamespage: I wonder if supported would be better (eg network-manager-strongswan)17:11
sarnoldracoon is built from ipsec-tools, right?17:11
kosmoI got dmesg output but its big and I didnt find anythnig interesting17:12
jdstrandsarnold: yes17:12
jamespagesarnold, yes17:12
jdstrandso yes, please unseed that :)17:13
jamespagejdstrand, jpds: OK - so I'll replace racoon with strongswan in the supported-misc-servers seed17:13
jdstrandjamespage: in case I wasn't clear, I was saying 'supported' instead of 'supported-misc-servers'17:13
jdstrandjamespage: I'm ok with supported-misc-servers, but supported seems ok too17:14
jdstrandjamespage: you're call17:14
jdstrandmeh17:14
jdstrandyour*17:14
jamespagejdstrand, just going on where racoon is currently :-)17:14
jdstrandthat's fine17:14
jdstrandjamespage: you are taking the list from comment 13?17:14
jdstrandjamespage: strongswan-pt-tls-client and network-manager-strongswan were also mentioned as desired17:15
jamespagejdstrand, looking now - but if I just seed strongswan it will pull source+binaries into main right?17:16
jdstrandjamespage: you want to seed the binaries you want. there are a lot, jpds enumerated those we want17:17
jamespagejdstrand, ack17:17
jdstrandhrmm17:18
jdstrandopenvswitch-ipsec depends on racoon17:18
jamespagejdstrand, indeed17:22
jamespagejdstrand, I'm assuming the outcome of having ipsec-tools and strongswan in main is not desirable?17:23
jdstrandit is undesirable17:23
jdstrandit looks like debian/ovs-monitor-ipsec is the only thing that uses racoon17:23
jdstrandis there an ovs-monitor-strongswan we can drop in its place?17:24
jdstrandit looks like Nicira wrote debian/ovs-monitor-ipsec17:24
jdstrandwell, it is the only thing other than the testsuite that uses ipsec-tools17:24
jdstrand(and the testsuite uses it to test ovs-monitor-ipsec)17:25
jamespagejdstrand, indeed17:25
* jamespage continues to dig17:25
jdstrandfeel free to commit the change to promote strongswan. the demotion of ipsec-tools can happen separately (but before release)17:26
jpdsjdstrand: openvswitch-ipsec is in universe now.17:27
jamespagejdstrand, not yet - it looks like upstream ovs have been discussing switch to strongswan but there is no support yet17:27
jamespagejdstrand, is it?17:27
jamespagejpds, erm - is it17:27
jpdsjamespage: Yep, cjwatson said he'd move it today.17:27
jdstrandah17:27
jdstrandI was just going to suggest doing that17:27
jamespageI have to admit to being uncomfortable making this change so late in  cycle17:28
jdstrandwhich change?17:28
jamespagethis puts any users of the ipsec feature of openvswitch in a different support position after moving to 14.4017:28
jamespage14.04 even17:28
jdstrandoh, just moving it to universe?17:28
jpdsWell, debian/ovs-monitor-ipsec looks like some nasty hack.17:29
jdstrandI also mentioned in January that we would want to demote ipsec-tools17:29
jdstrandipsec-tools is stagnant17:30
jdstrandjamespage: note, it does not change the support position over 12.04. openvswitch itself was in universe17:31
jamespagejdstrand, I know17:31
jpdsjamespage: Ah, yes. The list in my email + strongswan-pt-tls-client (we can ignore n-m for now).17:32
jamespagejdstrand, yes - but ipsec-tools and racoon where in main17:33
jamespagejdstrand, I guess I'm uncomfortable as I was not aware of this plan until 10 days ago17:33
jdstrandjamespage: I'm confused about the support position you are referring to. are you referring to openvswitch or ipsec-tools to strongswan migration?17:34
zzxcHey guys. I have a question. I had a script I want to run on startup for a machine that does a mount -bind. How would I get it to run on start up?17:34
jpdsjamespage: Anyone using them, is going to probably see their quality of life improve with something a little more... modern. ;-)17:34
* zzxc wonders if his conf has gone screwie or if jdstrand, jpds, and jamespage are talking using /me comments17:35
jdstrandjamespage: moving to strongswan is no different than moving to another supported technology in any other software in the stack. we release note that ipsec-tools no longer receives support and users should migrate to strongswan, which works better (more featureful, active upstream, etc)17:35
jdstrandjamespage: people who need ipsec-tools can use it on 12.04 for 3 more years. upgrade timelines are at their discretion17:36
jdstrandjamespage: honestly, I bet people are simply installing strongswan from universe anyway-- ipsec-tools hasn't gotten a new release in 3 years17:39
jamespagejdstrand, just uncomforable doing this right now - I've not had three months to thing about it17:39
jdstrandjpds: perhaps you can step in here-- you are the one driving this17:40
sarnoldzzxc: must be your configuration, they look like normal /msg #ubuntu-server to me17:40
sarnoldzzxc: /etc/rc.local may be the easiest way to get your script to run; you could create an upstart job just for your script if you wanted to be fancy: http://upstart.ubuntu.com/cookbook/17:41
bekkszzxc: fstab ;)17:41
jpdsjamespage: Well, I've been using the tool since August last year pretty much.17:42
zzxcbekks: Hahaha thanks for that bekks.17:42
sarnoldbekks: does that work out alright for bind mounts? cool :)17:44
bekkssarnold: Sure.17:44
zzxcsarnold: Actually I never understood upstart jobs. Isn't it just basically just like sticking it in the init.d folder and running update-rc.d?17:44
jpdsjamespage: All the IPsec stuff's in the kernel; there are essentially keyring daemons with feature sets.17:44
zzxcbekks: Yeah still kind of nervious about that. Espically if something happens to the prod server.17:45
bekkszzxc: Then test the fstab entries before rebooting. Whats the problem with that?17:45
sarnoldzzxc: I found upstart's 'native' interface easier to use than the sysv compatibility things, or the old sysv-init17:46
jdstrandjpds: perhaps describing more why it is desirable over ipsec-tools (perhaps with why you are pursuing it to beging with)17:47
zzxcbekks: Honestly. If I leave the company I'm working for I wouldn't trust the other people to remeber to do a check on the prod machine before restarting it when they need to update it.17:47
zzxcsarnold: Hmmm alright. Isn't upstart going away in the next couple of version though?17:48
jpdsjdstrand: That's all in the bug.17:48
jamespagejdstrand, jpds: tbh I don't think this is up to me to decide - this counts as a feature for me - I've pushed it to the release team17:48
sarnoldzzxc: yeah, eventually. fwiw I prefer bekks's advice after hearing it :) hehe17:49
jdstrandjamespage: from my perspective, the fact that strongswan has an active community upstream, within Debian and Ubuntu, has a modern feature set and is well-written are all compelling. Holding on to something that has gotten upstream attention in 3 years for a security sensitive piece of software is not desirable17:49
jdstrandhasn't*17:50
zzxc*sigh* alright. I've gone through enough holding my breath during the heartbleed fixes. Guess I'm going to have another everytime we update it.17:50
jpdsjamespage: Yeah, they pushed me towards you.17:50
sarnoldzzxc?17:53
bekkszzxc: sudo apt-get update; sudo apt-get dist-upgrade; <- that how to install the heartbleed fixes.17:54
zzxcWhats up sarnold?17:55
zzxcbekks: Yeah I know. We took a slightly different route and used unattended_upgrade17:55
zzxcBoss was terrified of compadibiltiy breaking.17:56
sarnoldzzxc: I'm just curious what you mean by "guess i'm going to have to hold my breath every time we update it" ..17:57
bekkszzxc: He should have read the changelog then.17:57
zzxcbekks: ? Which change log?17:57
bekkszzxc: the changelogs for the bugfixes? http://www.ubuntu.com/usn/usn-2165-1/17:59
zzxcbekks, Yeah of course right. No I read through that. It was more along the lines of only doing a security update rather than updating jaxb, or 3cpo, or hibernate.18:02
bekkszzxc: Those applications do not need to be updated to fix the heartbleed issue.18:02
zzxcRight. no I get that we could have just recompiled openssl as well with the noheartbeat flag and it would have worked as well. But I wanted to do all of the security updates. He didn't want to update anything that wasn't a secuirty fix so using unattended_upgrade was the medium for only updating the security patches, and not other updates that would have been covered in a dis-upgrade.18:04
bekksyou can easily cover security-only updated in dist-upgrade, too.18:05
sarnoldzzxc: thanks for not compiling your own, that's a path of pain and suffering. we do updates so our users don't have to do them themselves :) hehe18:06
sarnoldzzxc: see https://wiki.ubuntu.com/SecurityTeam/FAQ#Repositories  for a quick description of what bekks is describing18:07
zzxcbekks: How so?18:07
zzxcsarnold: Thanks18:07
bekkszzxc: Disable all repos but the security ones, run sudo apt-get update; sudo apt-dist-upgrade; and re-enable all formerly disabled repos again.18:08
bekks1zThat takes about 5 minutes overall.18:08
zzxcMmmmm yeah, I thought of that as well. You can also change the ranking of secuirty updates to 500 and downgrade the none security updates to 50.18:09
bekksWhich doesnt help at that point.18:10
zzxcBasically all i had to do was do sudo apt-get update && unattended-upgrade -d. which did the same thing.18:10
bekksbecause regardingless of the ranking, non-security updated would have been pulled in.18:10
zzxcbekks: No currently installed applications have a ranking of 100 (I beleive) so unless you need pull in a new version for a dependency its less desirable than an application that has already been installed.18:13
bekkszzxc: That doesnt affect what I just said. :)18:13
zzxcSo why would the non-security be updated?18:13
bekksBecause of the enabled repos.18:14
bekksNot because of their ranking whatsoever.18:14
sarnoldif all your updates are through unattended-upgrades it probably does the right thing; but when you go to run apt-get -u dist-upgrade yourself, it'll pull in all -updates and -security packages together..18:14
bekksdist-upgrade literally means "get them all". No matter which ranking the updates have.18:14
zzxchttp://askubuntu.com/questions/194/how-can-i-install-just-security-updates-from-the-command-line the second entry was was I was talking about.18:15
zzxcwas what*18:16
zzxcsarnold: Actually that was what I was wondering about. If I do a dis-upgrade -security does it only pull in security updates?18:16
bekksThere is no such parameter.18:17
zzxcbekks, Ok I didn't think there was. Is there a way to tell dis-upgrade to only install the secuirty updates?18:19
bekkszzxc: Disable all other repos.18:19
zzxcbekks, Ok right, so short of disabling the other repos there is no way to do that?18:21
zzxcsarnold: And right. But the lead developer didn't want to do a full update because he was convinced it would break something and at midnight I didn't really feel like arguing with him about it.18:22
sarnoldzzxc: yeah, that part makes a lot of sense :) hehe18:23
dv81zzxc: it will break imo18:23
zzxcDoing an unattended_upgrade to update only the secuirty patches? It wouldn't shock me honestly, but it is a feature that sets it self up like a cron job to do updates on prod machines ever so often. And honestly the system is pretty stable still and I just need it to work for about 2 or 3 more months then I can upgrade the system to the new LTS.18:25
zulhallyn:  i already uploaded a fix for the libvirt cloud-archive bug18:27
zzxcOr more actually build a new system and move over to that. I'm also hoping I can move the data volumes over to ext4 or s3.18:27
bekkszzxc: You are on ext3 currently?18:28
zzxcFor the data volumes yes. A lot of the infrastructure has been here well before I got here.18:30
hallynzul: which one is that?18:30
bekkszzxc: Then mount the as ext4, done.18:30
zzxcbekks, wait really? I know ext3 and ext4 are pretty simalar but won't I still not have the journaling functionality of a ext4 drive?18:31
bekksGuest88173: [~chatzilla@c-69-244-43-156.hsd1.az.comcast.net]  that should be enough to know you're not anonymous ;)18:32
bekkszzxc: ext3 is a journalling fs, too.18:32
bekkszzxc: And you can upgrade to ext4 by just mounting ext3 as ext4.18:32
lordievaderbekks: Really, no need for any conversion tools?18:33
bekkslordievader: No need for tools whatsoever.18:33
zulhallyn:  the libvirt apparmor change on precise18:33
lordievaderNice :)18:33
hallynzul: ok, so you took the one i uploaded to trusty?18:33
zulhallyn:  when did that happen?18:34
hallynearlier today18:34
zulhallyn:  no but i will18:34
hallyncool, thx18:34
zzxcbekks: Cool good to know. Thank you.18:48
jamespagejpds, still around? whats the closest thing to ipsec-utils in strongwan?19:08
jpdsjamespage: That packages doesn't exist?19:09
jamespagejpds, I have to replace ipsec-utils on the iso with something equivalent19:10
jpds$ apt-cache show ipsec-utils19:10
jpdsN: Unable to locate package ipsec-utils19:10
patdk-wkipsec-tools you mean?19:10
jamespageI do19:11
jamespagejpds, ipsec-tools19:11
jpdsjamespage: All of that should be in strongswan-starter.19:11
jamespagejpds, ok19:13
jamespagejpds, just testing the seed changes now19:13
jamespagejdstrand, I'll make the seed change in the ISO to demote ipsec-tools in favour of strongswan-starter19:16
jdstrandjamespage: ok. I looked at openvswitch more and it shouldn't need a packaging change19:17
jdstrandI thought it did, but it doesn't install raccoon or ipsec-tools during the build19:18
jdstrandI'm kinda curious what the testsuite is actually testing now, but not enough to look at it :P19:18
jamespagejpds, which was the additional package you wanted in the seed?19:20
jpdsjamespage: https://bugs.launchpad.net/ubuntu/+source/strongswan/+bug/1266066/comments/1319:21
uvirtbotLaunchpad bug 1266066 in unbound "[MIR] strongSwan" [Undecided,Fix committed]19:21
jpdsjamespage: +strongswan-pt-tls-client.19:21
jdstrandjamespage: ok, so I should not touch serv-ship. got it19:22
jamespagejpds, ok19:22
jdstrandserver-ship19:22
jamespagejpds, how does this look> http://paste.ubuntu.com/7251357/19:22
jpdsjamespage: +1.19:24
jamespagejpds, is strongswan-nm - that appear to pull network-manager into the misc-server seed?19:25
jpdsjamespage: Oh, drop that one.19:25
jpdsThat would be for network-manager-strongswan, which I'm not too fussed about.19:25
jamespagejpds, ack19:25
jamespagejdstrand, jpds: seed changes pushed19:31
jdstrandthanks!19:32
jamespagejdstrand, np19:32
jpdsjamespage: Thank you!19:32
jdstrandipsec-tools demoted (openvswitch-ipsec already was)19:32
jamespagejpds, thanks for your work on this this cycle19:32
jdstrandcrafting a release note now19:32
jpdsjamespage: Always a pleasure. :)19:38
jamespagejdstrand, thanks for doing the release note btw19:41
jdstrandnp19:42
=== FreezingAlt is now known as FreezingCold
jdstrandjamespage: did you commit all your changes? I only see the strongswan-starter change19:44
jamespagejdstrand, in server-ship yes19:44
jamespagejdstrand, the others are in supported-misc-servers in the platform.trusty seeds19:45
jdstrandah, platform.trusty19:45
jdstrandright. thanks!19:46
jdstrandjamespage: I'm going to get ahead of component-mismatches and promote these now19:46
smoserzul, is there a way to easily tell which cloud-archive packages have delta ?19:58
bekkshave delta compared to what?19:58
smosercompared to their source release.19:59
smoserie, the majority are straight (changelog change only) backports of trusty packages for icehouse19:59
smoserbut some require changes.19:59
smosermy best guess is package presense at https://code.launchpad.net/~ubuntu-cloud-archive/20:01
zulsmoser: not really...its just libvirt/xen/mongodb/subunit that have deltas20:04
smoseri'm fairly sure thats not true.20:06
smoseri know mongodb oes20:06
=== marrusl is now known as marrusl_afk
=== chuck_ is now known as zul
=== sz0 is now known as sz0`
=== marrusl_afk is now known as marrusl
RunemoroHi, could anyone help me fix some problems I'm having with bind9?23:56
RunemoroWhenever I do "dig @rebornlegend.no-ip.org rebornlegend.tk", I get the correct response, but if I remove the "@rebornlegend.no-ip.org" part, it doesn't work anymore. I've checked with whois that my nameserver is set to rebornlegend.no-ip.org23:58
sarnoldhah, why is the "dot tk" registry in the netherlands? o_O23:59

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!