=== sander__ is now known as Sander^home [01:16] smoser, around? === RaptorJesus_ is now known as RaptorJesus === beisner- is now known as beisner === markthomas_ is now known as markthomas === sz0 is now known as sz0` === medberry is now known as Guest53340 === sz0` is now known as sz0 === sz0 is now known as sz0` === justizin_ is now known as justizin === Ursinha is now known as Ursinha-afk === Ursinha-afk is now known as Ursinha === Ursinha is now known as Ursinha-afk === Ursinha-afk is now known as Ursinha === Adri2000_ is now known as Adri2000 [06:49] hallyn: hrm.. both sarnold and I are now pinned on the saucy version [06:49] but I'd be happy to try a new version === Azelphur_ is now known as Azelphur [07:06] Good morning. [07:08] jdstrand: did you notice mdes laur posted qemu updates to the security proposed ppa? I wondered if we were tripping over something that might have been fixed in the giant block level auditing... [07:17] sarnold: I say the call for testing. I did not do it yet. I hadn't considered that it would fix our issues because I figured the fixes were likely in 2.0, but if mdes laur patched trusty too, probably worth trying [07:17] s/say/saw/ [07:19] jdstrand: aww. I hadn't considered that they might not have affected trusty. now I'm dissapointed. [08:17] gnuoy, https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1322498 [08:17] Launchpad bug 1322498 in ceph "Unable to set swift container ACL's on existing containers" [High,Triaged] [08:17] building here - https://launchpad.net/~ceph-ubuntu/+archive/edgers/+build/6034662 [08:17] jamespage, thanks === sz0` is now known as sz0 [09:26] when you using ProxyCommand to jump through hoops, you have to have authendication to those hoops machine on your local machine (public key wise), otherwise you can't get on to next one. Is there anyway to allow the machine connect to it authendicate this rather then the local machine initialised the connection? [09:34] hello [09:36] o/ [09:44] could anyone here help me with my ubuntu server? i ended up somehow installing a bunch of kernel images and headers and now i'm stuck booting into this one particular kernel. I just want to revert back to my old one but its a remote server so I can't actuallly see grub when it comes up [09:52] morph-: you have a remote server without any management out-of-band that can't boot? [09:52] i can go into rescue mode or something [09:53] but I can't KVM or anything to actually mess with it while ist booting [09:53] how are you able to get it into "rescue" mode [09:53] go into OVH manager [09:53] select rescue [09:53] hi all, anyone has a workaround for trusty's network device reanming bug? (https://bugs.launchpad.net/ubuntu/+source/biosdevname/+bug/1284043) [09:54] from netboot [09:54] Launchpad bug 1284043 in biosdevname "udev renaming the same hardware network i/f to different name, breaks networking and firewall" [High,Confirmed] [09:54] then reboot the server [09:54] its a server from ovh.ie [09:54] i am aware of udev's "predictable device naming" feature, but it's not predictable at all. [09:54] do they offer documentation about what that rescue mode does? [09:54] yea [09:54] 1 sec [09:54] I don't want a link, I want to know if you have read it :p [09:55] mardraum http://help.ovh.com/RescueMode [09:55] ive used it plenty of times [09:55] i dunno how to fix this [09:55] trust me i didnt coem in here and ask first [09:56] if you can get access to the shell of your machine, can you remove the problem kernel packages? [09:56] yeah im ssh'd in my server right now [09:56] it works [09:56] its just this kernel keeps lagging me out [09:56] but i dunno how to undo all of this [09:57] i have already put 80-net-name-slot.rules and 80-net-setup-link.rules and deleted, had it auto-recreated, and also edited 70-net-persistence-rules but it still unpredictable. sometimes my devs renamed to "rename5" [09:57] remove the kernel packages [09:57] leave the ones that WORKED [09:57] mardraum http://pastebin.com/w9yNncTr [09:57] thats from grub-mkconfig [09:57] ok? [09:58] Ubuntu, with Linux 3.8.0-41-generic [09:58] is the one i want [09:58] do i just like [09:58] remove the others [09:58] go into /boot [09:58] and remove all this stuff? [09:58] well, I would use apt-get [09:58] you have used it before right? [09:59] how did you install these kernels.... [10:00] some with apt-get [10:00] some with dpkg [10:00] that's ok then [10:01] i have no idea what the file names were though [10:02] they're not like /boot/initrd.img-3.13.5-vanilla [10:02] linux-image-3.13.5-vanilla? [10:02] is taht the format maybe? [10:02] dpkg --list [10:03] yay [10:03] okay one more thing [10:03] i know when it gets down to it i wont be able to remove this kernel im booted into [10:04] it'll throw an error telling me i can corrupt everything blah blah [10:04] how do i get past that? [10:04] I've not seen that sorry [10:08] mardraum http://puu.sh/8XEQu/6920cfaa56.png [10:17] marcoceppi [10:17] mardraum [10:17] I got it :) === swebb is now known as zz_swebb [10:21] thanks a ton mardraum === sonne_ is now known as sonne [10:44] zul, https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1322568 [10:44] Launchpad bug 1322568 in libvirt "nova interface-attach fails" [Undecided,New] [10:44] :-) [10:44] zul, not quite sure why I did not see that pre-release [10:44] I'm pretty sure tempest does lots of those [10:47] gnuoy: just following up to your answser in #juju as it pertains to the nova-cloud-controller charm [10:48] caribou, hi, I'm in an upgrade-charm debug session for nova-cloud-controller as I type [10:51] gnuoy: in the compute_changed() function I just printed the migration_auth that comes from "relation_get('migration_auth_type') [10:51] gnuoy: when running "juju upgrade-charm", it prints None as the value; I must be missing something [10:51] caribou, you need to give it the relid and unit id [10:52] hang on, I'll paste bin [10:52] gnuoy: that's what I thought; I got misled by the fact that compute_changed doesn't ask for one; I can change that [10:53] kk [10:54] gnuoy: you can still paste what you have, it'll help me [10:56] sure, one sec [11:02] caribou, sorry, I lost connectivity for a bit there. http://paste.ubuntu.com/7505148/ [11:03] gnuoy: np [11:10] caribou, Iwhen I run that I'm only getting the private address of the compute host so I guess the compute host is not setting anything when the relation is joined [11:10] * gnuoy checks [11:13] caribou, do you have enable-live-migration enabled ? [11:13] 'migration_auth_type' is not set by the compute node if enable-live-migration is not True [11:14] gnuoy: well, my config file does set it [11:14] gnuoy: maybe I should explain what I try to achieve instead [11:14] sure [11:16] gnuoy: I've fixed nova-cloud-controller & nova-compute to transfer authorized_keys/known_hosts files in multi-lines [11:17] gnuoy: I'll get you the Merge Reqs: [11:18] gnuoy: https://bugs.launchpad.net/+branch/~louis-bouchard/charms/precise/nova-cloud-controller/lp1313602-multiline-known-hosts [11:20] jamespage: suggested to rerun the hooks for relations in order to get that multi-line setup to be applied when we upgrade the charm [11:20] gnuoy: my mistake is to suppose that all relations were available in 'upgrade-charm'. [11:21] caribou, they are all available, what makes you think they aren't ? [11:22] gnuoy: well, I suppose they are if I explicitely call them by rid, in relation hooks there's no need for that apparently [11:22] if I understand it correctly [11:23] gnuoy: I mean I do not need to supply the relation-id in a relation hook when doing 'relation-get' [11:23] caribou, you don't need to explicitly set relation id when you're in the context of that relation. But in upgrade charm your not in the context of any relation so it needs to be set explicitly === Lcawte|Away is now known as Lcawte [11:24] gnuoy: sorry for all those nOOBs assumptions, I'm just getting into those charms mechanisms [11:24] caribou, don't apologise, no problem at all [11:25] how can I make my mirror smaller ? it's 200GB! [11:38] anyone ? [11:41] YamakasY, have asked in #ubuntu-mirrors and looked https://wiki.ubuntu.com/Mirrors for expected mirror sizes ? [11:42] " The Ubuntu archive, as of 2013-04-04, uses about: 642GB of disk space for the Ubuntu package archive. " === marlinc_ is now known as marlinc [11:49] gnuoy: not loked there yet [11:51] gnuoy: maybe I misunderstood what jamespage asked for [11:52] caribou, nope- the conversation above looks on the right track :-) [11:52] jamespage: thanks for the confirmation [11:53] jamespage: there is also a dependancy on the order of the upgrade : nova-cloud-controller must be upgraded first to make the new relations available to nova-compute [11:54] caribou, actually I don't think that will matter [11:54] jamespage: well, if nova-compute runs & no indexed relation is there, it will do nothing [11:54] caribou, if you do it the other way around, nova-cc will set the data and the nova-compute nodes will just pickup the new relation format [11:54] caribou, yes [11:55] hence nova-cc needs to be to the latest version first [11:55] jamespage: I mean it will not break anything, but just not use the multi-line format [11:56] so someone not knowing about the specific ordering requirement will not get a functional live-migration ssh key setup after the upgrade [11:56] if nova-compute is upgraded first [12:29] * zul shakes his fist at tempest [12:38] anyone has a workaround for trusty's network device reanming bug? (https://bugs.launchpad.net/ubuntu/+source/biosdevname/+bug/1284043) [12:38] Launchpad bug 1284043 in biosdevname "udev renaming the same hardware network i/f to different name, breaks networking and firewall" [High,Confirmed] [12:54] jamespage: gnuoy: running compute_changed() in a non relation hook context is rather difficult : [12:54] caribou, there should be lots of examples of how todo that already in the nova-cloud-controller charm [12:54] many of the function used make the assumption that all relations are available [12:55] caribou, note that those which need to be called outside of a relation context allow the rid to be passed in [12:56] def compute_joined(rid=None, remote_restart=False): [12:56] gnuoy: I fixed many of them, but the call to shh_compute_add fails because it calls helpers that expect some environment variable to be there [12:56] gnuoy: yeah, i've done all of this, the whole relation get/set is fixed accordingly [12:58] gnuoy: here is an example : http://paste.ubuntu.com/7505499/ [13:00] caribou, just to be pedantic "all relations are available" in all hook contexts. And there is no hook context where they're all available without having to set a rid for ones outside of the current context. [13:00] gnuoy: agreed, that why I added rid & uid to the call so I have them, that works [13:00] kk [13:02] gnuoy: it's the call to ssh_directory_for_unit which calls remote_unit that expects $JUJU_REMOTE_UNIT to be set; maybe I should change that to use a unit passed as argument [13:02] gnuoy: since I know it already [13:02] sounds good to me [13:03] gnuoy: just that the fix becomes more intrusive that I expected ( or rather that I'm used to) [13:03] yeah, I think you've been unlucky [13:03] gnuoy: from the look of it, the current compute_joined was written to be called in a relation hook only [13:04] gnuoy: I must change it to be called in any context [13:04] gnuoy: I'm fine with it [13:04] caribou, no, it is called in other relation contexts already, hence the ability to pass in the rid [13:05] shared-db-relation-changed calls it for one [13:07] gnuoy: it calls compute_joined, not compute_changed [13:07] compute_changed is argumentless atm [13:07] caribou, ah, you said compute_joined in your previous comment "the current compute_joined was written to be called in a relation hook only" [13:07] gnuoy: oops, sorry :-/ [13:08] np :) [13:08] ok, now that I got blessing for people who know, let's get that working :-) === Ursinha is now known as Ursinha-afk === Ursinha-afk is now known as Ursinha === melmoth_ is now known as melmoth === sz0 is now known as sz0` [13:51] Hi, How do I make sure whenever a service e.g. apache stops to make sure it be restarted again.....apart from using cron to check on a timely basis. === sz0` is now known as sz0 [13:55] Werkena: upstart can restart processes that crash [13:57] rberg: Can you take such an instances where the sysadmin wants to ....e.g. just unpluging a wifi usb AP and replugging it would make hostapd to freez/stop....so I have to restart it manually....or if some how the usb wifi is pluged after the hospad service already started, it wouldn't restart itself.....so I wanted it in such like scenario.... [14:00] for hardware events I would look at writing udev a rule === sz0 is now known as sz0` [14:14] rberg: I think I understand you now, Should I only include the word "respawn" in the init.d of the script (for hostapd) like found in this post.....https://forums.plex.tv/index.php/topic/109449-respawn-on-crash/ === `ph8 is now known as ph8 [14:32] hey guys. whats the easiest way to port your deployed apps to apache 2.4 from apache 2.2 ? [14:33] this blog mentions automated deployments but i really don't know what he's talking about: http://www.justgohome.co.uk/blog/2014/04/new-in-14-04-apache.html [14:33] does anyone know what he's referring to? [14:41] klander: vrtualised instances using deployment and configuration management tools; Chef, Puppet, Salt, Ansible, etc, etc, === sz0` is now known as sz0 === zz_swebb is now known as swebb === swebb is now known as zz_swebb === stoned is now known as stoned- === sz0 is now known as sz0` === sz0` is now known as sz0 [16:17] gnuoy: jamespage: FYI, looks like I got the compute_changed() to work in non-relation hooks (i.e. upgrade-charms) [16:17] I'll give it more tests next monday & fix the unit-tests [16:17] caribou, excellent [16:17] gnuoy: jamespage: your help was very valuable, thanks for it [16:17] np [16:18] caribou, yw [16:20] kirkland, bummer: https://bugs.launchpad.net/cloud-init/+bug/1322692 [16:20] Launchpad bug 1322692 in cloud-init "seed_random runs too early if local datasource used" [Medium,Confirmed] === stoned- is now known as stoned === sz0 is now known as sz0` [16:53] smoser, eeek https://bugs.launchpad.net/cloud-init/+bug/1316475 [16:53] Launchpad bug 1316475 in tripleo "trusty hang on first boot post deploy" [Critical,Triaged] [16:55] adam_g, bah. [16:56] good debugging. [16:57] adam_g, you can just disable that datasource [16:57] thats the easiest thing to do . [16:58] smoser, yeah.. [17:03] smoser, how do i disable it? [17:04] dpkg-reconfigure cloud-init will allow you to select [17:05] or you can just pars/edit /etc/cloud/cloud.cfg.d/90_dpkg* [17:11] adam_g, that just plain sucks [17:24] smoser, yeah. its still not clear to me why its happening on a small percentage of our servers and not others. im happy to test whatever you come up with. [17:29] adam_g, well, it would not hang if either: [17:29] a.) there was no ttyS1 [17:29] b.) there was data to read on the ttyS1 [17:29] c.) the read failed. === sz0` is now known as sz0 === Lcawte is now known as Lcawte|Away === medberry is now known as Guest39402 === Ursinha is now known as Ursinha-afk === Ursinha-afk is now known as Ursinha [19:04] smoser: okay...suggestions? [19:06] no good suggestions at the moment [19:22] Hello! I'm trying to get my dhcp server to dynamically update my dns server with hostnames, but dhcpd keeps spitting out these errors: dhcpd: Unable to add forward map from $HOSTNAME. to $IP: connection refused - Anyone familiar with it? [19:24] vonsyd0w: 'connection refused' could be generated by a firewall on the dhcp machine, a firewall on the dns machine, or the dns server not being configured to accept connections on that IP/port [19:29] firewall on the dhcp! wow forgot [19:30] let me check now... === a1berto_ is now known as a1berto [19:53] how do you guys control your raid? [19:55] telekinetics [19:55] O:-) [19:55] with mdadm.. how else? [19:55] so no hardware? [19:55] im looking at a 4 disk ssd raid [19:55] maybe 5 [19:56] I have used some hardware.. I find megacli obtuse [19:57] what do you think of this? http://www.amazon.com/gp/product/B004JPHAF0/ref=s9_wish_co_d0_g147_i4?ie=UTF8&colid=12KKAP4FH9RM4&coliid=I3TX9VQI5ZJ53U&pf_rd_m=ATVPDKIKX0DER&pf_rd_s=typ-top-left-1&pf_rd_r=1ZG25XSSJ2F44974WDGZ&pf_rd_t=3201&pf_rd_p=1780082482&pf_rd_i=typ01 [19:59] personally I would stick to software raid for 4 or 5 disks [19:59] i think i have a bottle neck some where with this 4 disk raid 0 [19:59] using mdadm [20:00] sarnold, that was it! A firewall issue. I forgot my dhcp server (my edgemax router) had explicit deny rules set. I had to create an allow rule for port 53, its working now [20:02] vonsyd0w: oh! nice :D [20:02] vonsyd0w: thanks for reporting back, I love learning what fixes things :) [20:02] has anyone used this before? http://sourceforge.net/projects/automysqlbackup/?source=dlp [20:02] I'd like to set up a cron job to back up my mysql DB's, and that looks to fit the bill, but it hasn't been updated in over a year. [20:05] fridaynext: a collegue of mine implemented this, works well, dumps when requested- [20:06] remix_tj: recently? [20:06] last july [20:07] remix_tj: meh, close enough. it's not like commands to back up a db have changed in 6 months. [20:07] mysqldump -u me -pblah, etc. [20:07] oh, yeah [20:07] I'd write the scripts myself, but I'm too lazy. [20:07] <[[lutchy]]> What's wrong with just a routine mysql dump? [20:07] fridaynext, Percona XtraBackup is another option: http://www.percona.com/doc/percona-xtrabackup/2.1/ [20:08] I haven't used it, but it seems well maintained [20:08] and good docs [20:08] automysqlbackup also sends report, helps with a lot things for lazy sysadmins [20:08] <[[lutchy]]> hmmmm... [20:08] and you know, you're not a senior sysadmin until you're lazy [20:08] remix_tj: have i been upgraded to senior??? nice! [20:09] <[[lutchy]]> No offense, but it's like another software to keep up2date. [20:09] really all I want to do is back up the db, zip it, and move it into the user's owncloud folder (daily). === Guest39402 is now known as medberry [20:09] [[lutchy]]: your code has to be tested and updated by yourself, drilling down problems when issue appears [20:09] dammmit, i'm just going to write the cron job for it. [20:09] no reason to install something else. [20:10] when the code is written by others for many people, it's well tested (hope) and problems are eventually drilled down by more people than yourself [20:10] <[[lutchy]]> Now if I make it simple... [20:10] <[[lutchy]]> s/now/not/ [20:11] yeah [20:11] simple means 2 lines of code [20:11] <[[lutchy]]> I like simplicity when it comes to sysadmin... [20:11] more than two is already on the road for "complex" :-P [20:11] <[[lutchy]]> remix_tj, Yeah, only time it breaks, is bash or something else changed :-p [20:12] yup :-) [20:13] <[[lutchy]]> In my experience, I've seen some folks come with complicated solutions to solve a simple solution (not sure if they are trying to impress someone or not) [20:13] <[[lutchy]]> s/simple solution/simple issue/ [20:15] Hello [20:18] <[[lutchy]]> Hi [20:24] Would it be possible to use wubi.exe to install ubuntu server alongside winXP? Using ubuntu12.04 server [20:25] <[[lutchy]]> That's 'ubuntu12.04' part confused me a bit... [20:27] [[lutchy]]: 12.04 is the version of ubuntu server that I have. [20:28] <[[lutchy]]> Joe_knock, If I understood correctly, you want to install Ubuntu Server under ubuntu 12.04 along side winxp ? [20:29] <[[lutchy]]> I have about 4 Ubuntu Server VMs, but I would assume that the installer, which I can test in a VM, will automatically recognize WinXP :/ [20:30] <[[lutchy]]> wubi.exe to install ubuntu, using ubuntu12.04? webi.exe is a Win program.. [20:32] Joe_knock: Wubi hurts performace, not really what you want on a server. [20:33] lordievader: I just need it for home-testing and playing around with it. It isn't a production server. [20:34] [[lutchy]]: That is my point. I want to use wubi.exe to install ubuntu server alongside WinXP [20:34] Still, wubi is ugly and should die. But that is just my personal opinion. [20:35] lordievader: I respect your opinion, but I am just clarifying whether it is possible or not. I am restrained in that I cannot make the system run ubuntu on its own. [20:36] <[[lutchy]]> From what I understood, wubi was just a more easier way to install Ubuntu under Windows XP ? [20:36] <[[lutchy]]> Not Windows XP, but under any Windows version that is supported [20:36] Hmm, haven't done a wubi install in years. But I suppose that if it is possible to install the desktop the server part shouldn't be a problem. [20:37] [[lutchy]], [20:37] [[lutchy]]: Yes that is correct. It installs "within" windows. so ubuntu kind of lives on top of windows [20:37] lordievader: Thanks [20:38] Joe_knock: just why don't you use virtual machines? [20:38] <[[lutchy]]> hehehe [20:39] <[[lutchy]]> I have Windows Server 2012 R2, with the latest patches to Hyper V [20:40] <[[lutchy]]> I have CentOS, and 2 Ubuntu VM Server [20:40] <[[lutchy]]> My http://projects.lhprojects.net/ and http://scm.lhprojects.net/. both running from the same server and from VMs [20:40] guntbert: The tower I intend using only has 512MB of memory [20:41] <[[lutchy]]> Ok... [20:41] <[[lutchy]]> Well, IIRC, 14.04 only support 64bit ? [20:42] Hey folks. I just checked munin on a largely inactive server, and I am seeing a lot of postfix activity http://i.imgur.com/x49HlKk.png [20:42] should I be worried? [20:42] <[[lutchy]]> Joe_knock, Let me guess, no USB, no CD-ROM ? [20:42] Joe_knock: thats really low, indeed [20:42] !munin [20:42] Hmm, thought there was something with munin. [20:43] [[lutchy]]: It has USB and a CD-ROM drive, but I will install using a virtual drive. [20:43] well anyways, this server has never ever been used (intentionally) as a mail server. [20:43] So is this sign of someone using it agains tmy will? [20:43] guntbert: Which is why I need full resources to try installing a couple of tools I want to test [20:43] WACOMalt: if that is the case, why is postfix installed on it? [20:44] I would venture to guess it came with it [20:44] <[[lutchy]]> Postfix by default, is pretty secure [20:44] Joe_knock: I understand but cannto contribute anything to your wubi-question - I never used it, not even in a VM [20:44] *cannot* [20:44] how can I check if anyone has been using it? [20:44] <[[lutchy]]> All my Ubuntu installations were basic with just openSSH [20:45] WACOMalt: It looks like only 6 mails have been deferred. Unless I am misinterpreting the graph. so it isnt a lot, compared to previous activity [20:45] can I check what user initiated those? [20:45] guntbert: I will test it out in a couple of minutes time. [20:46] Joe_knock: Good luck! [20:46] WACOMalt: yes, you should be able to see activity of sent/received emails. Do you have access to the server? [20:46] I do, but have no experience with postfix to know where to look [20:47] WACOMalt: Are you comfortable with the commandline? [20:47] guntbert: Thanks [20:47] <[[lutchy]]> The Mail log, will not tell you who initiated in terms of a *user*... It will tell you the host [20:47] yes, provided I can get some help as to what to type :P [20:47] <[[lutchy]]> Who asked the Mail to be relayed [20:47] that works [[lutchy]] [20:47] <[[lutchy]]> Unless you have SASL auth [20:47] <[[lutchy]]> Then you will get a *user* [20:48] -\(°_o)/¯ [20:48] I never set that up, so I guess I wont get a user [20:48] so how do I check? [20:48] <[[lutchy]]> How do you want the E-Mail server to be setup ? [20:48] [[lutchy]]: Wouldn't all that is needed to identify the person is the email address that tried to send the email? Based on the graph, it seems somebody or 6 people or 1-6 people tried to send a total of 6 emails that were "deferred" [20:49] <[[lutchy]]> Postfix is very documented and features typically work as expected [20:49] [[lutchy]], not at all preferably [20:49] WACOMalt: Have you by any change installed logwatch? [20:49] nope [20:49] <[[lutchy]]> Joe_knock, no, I can telnet to your server and enter whatever mail from person I like [20:50] [[lutchy]]: true, but it may be possible that some end-user is trying to send an email. [20:50] so, how do I check? [20:50] <[[lutchy]]> logwatch is really good [20:51] WACOMalt: Do you want us to check what commands to type in for you? lol [20:51] <[[lutchy]]> It's very useful ... I thinking of another program to aggregate results from different servers.. I found logstash [20:52] WACOMalt: Perhaps this might help -- http://www.postfix.org/postqueue.1.html [20:52] <[[lutchy]]> Joe_knock, It's not about if user will or will not send mail... it's based on the policy of the mail server to reject it [20:53] WACOMalt: I see that the -p part is where you may be looking. [20:53] <[[lutchy]]> I have two postfix servers relaying mail.. [20:53] <[[lutchy]]> I don't know why you would suggest postqueue [20:53] <[[lutchy]]> When postqueue is about whatever mail that's currently in the 'queue' [20:54] [[lutchy]]: I am trying to help him as best I can. Feel free to make a better recommendation [20:56] <[[lutchy]]> Yeah, it's about helping one another ... [20:56] <[[lutchy]]> I had asked earlier how he wanted his E-Mail server to be setup [20:56] <[[lutchy]]> I doubt, when you 'apt-get install postfix', it leaves you as open RELAY [20:57] [[lutchy]], I answered that question with "not at all" [20:57] <[[lutchy]]> Postfix, being complex, has a very simple and well documented [20:57] <[[lutchy]]> configuration [20:57] it looks like one of my users has set up an email address, and they have google set to recieve that for them in their gmail [20:58] thats all the acticity I can see in postqueue [20:58] so I guess things are fine? [20:59] <[[lutchy]]> Read what postqueue is far ... [20:59] <[[lutchy]]> postqueue does not produce logs [21:00] <[[lutchy]]> Postfix is simple a MTA, if it's allowed to TRANSFER email, then it's likely a faulty in security [21:01] ok, then I'm just uninstalling it [21:01] <[[lutchy]]> If you don't need a MTA, then yeah, but keep in mind... programs that need a sendmail program will fail [21:02] <[[lutchy]]> Bottom line, who accessing your Computer ? [21:02] honestly, at this point I dont even know. I have 3 authorized users. And I'm about as unfit of a server admin as has ever existed [21:02] :) [21:02] [[lutchy]]: the emails weren't delivered, which means they're sitting in the queue, which is why postqueue can tell what emails are there. [21:02] <[[lutchy]]> Ok [21:03] WACOMalt: Do you recognise the email address? [21:03] <[[lutchy]]> WACOMalt, There are few things you can to secure it up [21:03] yes, and no [21:03] there is www-data@myserver.com [21:03] and then a few that are actually users [21:03] but all are trying to send to gmail servers [21:04] WACOMalt: Identify with the company bureaucracy whether you are allowed to access email accounts, if yes, then maybe you can access the content of the email to see what it says. [21:04] "the company beaurocracy" = me [21:04] its just a guy (me) with a box [21:04] <[[lutchy]]> What piss you off the most [21:04] WACOMalt: I think what is happening is that they're using mail-forwarding, and those 6 emails weren't forwarded for some reason. [21:05] <[[lutchy]]> The fact, 3 authorized people send Mail [21:05] <[[lutchy]]> Or the targets of the E-Mail, by one person, is wrong [21:05] <[[lutchy]]> That information can help [21:05] yeah I'm gonna talk to those 3 people [21:05] they dont use the emails any more, but I know they had them set up at once point. Gonna askt hemt o remove them from gmail [21:06] <[[lutchy]]> BTW, when it's local mail [21:06] <[[lutchy]]> It's logged by user [21:06] <[[lutchy]]> So, if they send a mail from 'sendmail' program from the server, it will be logged by who [21:06] WACOMalt: Are they just forwarding from myemail@domain.com to myemail@gmail.com or are you using gmail as your email provider? [21:07] <[[lutchy]]> Postfix behaves differently when it comes to local sent mail [21:07] Joe, the former example [21:07] <[[lutchy]]> There is a different daemon that handles local mail [21:07] <[[lutchy]]> That should be log, what Ubuntu server do you have ? [21:07] At current I see nothing to hint at someone misusing the server. So I'm not worried and will jsut ask the users to disconnect google if they arent using the address any more [21:08] 10.04 :/ [21:08] WACOMalt: Based on what you say, it is actually the automated email forwarder that has placed the emails in the queue (my assumption based on info). [21:08] hmm possibly [21:09] WACOMalt: Disconnecting google won't fix it. You need to stop mail-forwarding from: myemail@mydomain.com . What email client do you have access to? [21:09] you mean on the server? [21:09] or on my local desktop [21:10] locally I think I have windows live mail which could connect to those addresses [21:10] Yes, you need to configure mail-forwarding to be stopped. Find out how the 3 other users setup mail-forwarding previously and tell them to reverse that process. [21:10] righto. I'll have to look into that tonight though [21:10] I have to leave for the time being. [21:11] WACOMalt: Perhaps a webmail client like squirrel or something else might help. Good luck [21:11] Thank you both for the help. At least my mail wasnt being used for nefarious purposes [21:11] WACOMalt: If you don't need postfix, best to remove it then. [21:12] yeah I'll check if anyone else is actually using it, but it certainly looks like they arent [21:13] ok, I'm off. thanks again! [21:15] what permissions does a mysql user need to be able to dumb a DB? [21:15] <[[lutchy]]> root [21:15] i have all my users set at SELECT, UPDATE, INSERT, DELETE [21:15] <[[lutchy]]> Depends, the entire DB directory ? [21:15] oh, so only root can dump a db? [21:15] no just individual DB's [21:15] I want to dump DB's daily for my clients running WP sites on my server [21:16] fridaynext: usage and select (on all object) may be enough if you do a mysqldump. but it really depends on the kind of backup you want to do [21:16] serverhorror: just basic. [21:16] <[[lutchy]]> thanks serverhorror [21:16] mysqldump -u someone -pblah summatDB > summatDB_today.sql [21:16] <[[lutchy]]> I was thinking only 'select' [21:17] i think just about any right implies usage, but granting it makes it explicit in listing the rights also [21:18] this is what i'm getting when i try to use a user's un/pw for a dump http://pastebin.com/TrcETmff [21:19] fridaynext: actually any user can create a backup like this. if you “grant usage,select on myschema.public_table to ‘restricted_backupuser’@‘backuphost.invalid’” you’ll still get a backup just not of all the tables in the database ;) [21:19] s/database/schema [21:21] 0.25 0.00 2.61 26.12 0.00 71.02 [21:21] i am getting 26.12 in iostat for iowait :/ [21:21] <[[lutchy]]> iostat? [21:21] serverhorror: what if I grant lock tables - will that fix the error in the pastebin? [21:22] top too [21:22] but i wanted to see where it was.. .can't quite put my finger on where i'm getting the pause [21:22] <[[lutchy]]> You know fridaynext, give users all access to the DB they OWN [21:23] it should, but it will also …. LOCK your tables (no other client can write while the backup is running) [21:23] [[lutchy]]: i'm running wordpress sites, and wordpress codex suggests only granting select, insert, update, delete to mysql users. [21:23] <[[lutchy]]> No.. === a1berto_ is now known as a1berto [21:23] <[[lutchy]]> You can grant access per db, even per table [21:24] http://codex.wordpress.org/Hardening_WordPress#Database_Security [21:24] I know I can do that, but this is just what the WordPress codex suggests. [21:24] I want to keep it as secure as possible. [21:24] fridaynext: don’t use wordpress :) [21:24] <[[lutchy]]> Macer, Install 'iotop', it can show you IO in terms of IO in regards of DISK usage [21:24] serverhorror: if i had a nickel. [21:25] hehe [21:25] <[[lutchy]]> Let me get this right... [21:25] but until I can teach myself a new language and implement a secure e-commerce platform for the 12 sites i'm currently running - i'm stuck with WP. [21:25] <[[lutchy]]> You know you can do that but you followed instructions blindly ? [21:25] [[lutchy]]: not blindly. [21:26] ah ok. let me take a look at it [21:26] fridaynext: truly the permissions depend on the backup. my default solution is to run a backup only slave and go from there (either xtrabackup, mysqldump, …) that at least won’t lock the clients out during backups [21:27] fridaynext: e.g. I’m pretty sure mysqldump —opt … and mysqldump —single-transaction … will need different sets of permissions [21:27] if I run mysqldump as root, and put that in a .sh file in the root directory, to be run with the root user's crontab - is that basically secure? [21:27] <[[lutchy]]> Yes, but from he is telling me, he already knew beforehand, then apply permission per DB [21:27] <[[lutchy]]> NEVER fridaynext [21:27] fridaynext: just don’t [21:27] which part - the root user's cron job? [21:27] or running mysqldump as root? [21:28] or both? [21:28] <[[lutchy]]> This is how I do it, as opposed to serverhorror [21:28] 0.25 0.00 2.61 26.12 0.00 71.02 [21:28] oops [21:28] 12015 be/4 root 48.19 K/s 0.00 B/s 0.00 % 98.63 % dpkg -i ./packages/zimbra-store_8.0.7.GA.6021.UBUNTU12.64_amd64.deb [21:28] <[[lutchy]]> I use phpmyadmin, to select what permissions per user has [21:28] wow... wth? [21:29] is that because of some awkward lxc kernel translation or something? heh [21:29] <[[lutchy]]> I just give full permission to that user to the db [21:29] iotop has dpkg @ 99% io? [21:29] <[[lutchy]]> It avoids any permission issues moving forward [21:29] fridaynext: make it secure: use ssl all over the place (expect about 30% of the original performance). never use root but dedicated role accounts. get rid of the [debian|ubuntu] mysql user [21:30] serverhorror: i've been converting all sites to 100% ssl over the past week, so that much is being taken care of. [21:30] fridaynext: practically I’m having dedicated schema owners and use those for maintenance like backups… [21:30] fridaynext: on the webserver part or the mysql part [21:30] webserver [21:30] fridaynext: i’m talking about mysql [21:30] i didn't know using ssl was possible within the same machine [21:30] for mysql [21:30] since it's all on localhost, that is. [21:31] <[[lutchy]]> Macer, snippets... do not work.. I can't see headers, you expect people understand what you pasting [21:31] fridaynext: it is. mysql just has the habit of being overly friendly and actually uses the unix socket instead of the tcp socket if you specify localhost but you can tell the (at least) the mysql client to use the tcp socket [21:31] <[[lutchy]]> MySQL and SSL serverhorror .. it's frustrating [21:32] <[[lutchy]]> Not all clients support SSL with MySQL [21:32] <[[lutchy]]> I have stunnel setup .. :) [21:32] hm. zfs seems to be giving me some pretty bad speeds [21:32] [[lutchy]]: as i said: 30% of the original performance (not 30% drop) 30% left of what you had [21:32] serverhorror: wow that's a huge drop [21:32] (rough estimates of course) [21:33] <[[lutchy]]> serverhorror, You didn't say from what I am reading just in case [21:33] [[lutchy]]: sorry.. it's not zfs. the i/o to the zfs isn't bad. i don't know what is holding it up [21:33] dpkg in a container seems to be getting held up somewhere [21:34] [[lutchy]]: I was referring to the frustration. I’d drop mysql without a blink if I had the chance too [21:34] TID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND [21:34] 12015 be/4 root 0.00 B/s 0.00 B/s 0.00 % 99.84 % dpkg -i ./packages/zimbra-store_8.0.7.GA.6021.UBUNTU12.64_amd64.deb [21:34] <[[lutchy]]> The socket issue is a problem [21:34] it's not the disk.. :/ [21:35] so how do i avoid doing a mysqldump with locktables? (is that even possible?( [21:35] <[[lutchy]]> Especially when I am using stunnel, but just specifying the IP of the localhost should resolve that [21:35] <[[lutchy]]> fridaynext, read the error carefully [21:35] [[lutchy]]: it looks like it is definitely going to lock the tables while performing the db backup. [21:36] <[[lutchy]]> I would have to defer to serverhorror .... [21:36] oh it's that percent sign, isn't it. [21:36] <[[lutchy]]> How big is the DB ? Why can't you schedule a time ? [21:36] It's probably 30MB [21:37] I can schedule a time, but I'm testing the mysqldump command as the owner of the db before setting up a cronjob that won't work when it's fired [21:37] <[[lutchy]]> Regardless, I still have to defer to serverhorror... [21:37] [[lutchy]]: I don't get it - defer b/c I'm too daft to understand, or you don't know what to tell me next? [21:37] <[[lutchy]]> My question to serverhorror, if you know, does mysqldump 'lock'? [21:37] 30M should be done in well under a minute with almost any hardware today. depends on your requirements wether that can still be locked or not [21:37] [[lutchy]]: oh. [21:39] <[[lutchy]]> Yeah, I agree with serverhorror [21:39] <[[lutchy]]> But, are you doing back per user ? [21:39] <[[lutchy]]> s/back/backup/ [21:40] <[[lutchy]]> That's inefficient [21:40] [[lutchy]], fridaynext: look for “—add-locks” there’s also a “—no-add-locks” (or any other —no…. options for that matter) so it doesn’t necesarily lock. but then it doesn’t guarantee consistency (read: you could get a broken backup, missing posts, etc. but 30MB doesn’t sound like a high traffic blog) — [21:40] http://manpages.debian.org/cgi-bin/man.cgi?query=mysqldump&apropos=0&sektion=0&manpath=Debian+7.0+wheezy&format=html&locale=en [21:40] <[[lutchy]]> Thank serverhorror :) [21:40] <[[lutchy]]> Thank you* serverhorror [21:41] personally i do mysqldump —single-transaction —opt —triggers —add-drop-triggers …. [21:41] serverhorror: it's a super high trafficked site, but I just granted lock tables to the user, and it performed the dump in about 0.3 seconds. [21:41] but as I said: I always have a backup only slave so I have no problems with locks [21:42] fridaynext: high traffic in that case means: it’s creating multiple posts per second as the lock would keep you from saving them but not from reading them [21:42] is that a separate mysql user with permissions on all DB's? [21:42] <[[lutchy]]> I think the issue is, since fridaynext mentioned user, I still don't get why you don't give the use full privs? [21:42] fridaynext: no it’s separate hardware that acts as a repliation slave [21:42] [[lutchy]]: I've had client's come to me whose sites have been hacked, and I want to keep my sites as secure as possible. [21:43] <[[lutchy]]> Do you trust MySQL ? [21:43]