[06:06] yo [07:34] I'm getting a 500 error while going to iplayer [07:34] ah, it's gone now [07:34] phew [07:34] I thought the world was ending [07:35] oh no, it really is struggling this morning [07:45] anyone know of cheap powerline adapters that don't die after one year? === Lcawte|Away is now known as Lcawte [08:59] iplayer's been down for 2 days here [09:05] http://www.bbc.co.uk/news/uk-28388585 === Lcawte is now known as Lcawte|Away [09:29] morning boys and girls. [10:55] is test -x /usr/sbin/anacron supposed to show/echo a value? [12:02] anyone know why i am getting too many authentication failures using password ssh in 14.04 server? [12:02] some weird default> [12:02] ? [12:07] oh, told my client not to do pubkey [12:07] weird [12:08] but.. pubkey > password security [12:08] as long as you're not insane and keep a passphrase on the key [12:09] this is first time connection [12:09] so keys will come later [12:40] Maybe someone cracked the account already, or is brute forcing it [12:41] Is this machine visible from teh Internets? [12:41] My router fields many, many attempts to crack it on a daily basis (even though it no longer accepts password auth) [12:43] * penguin42 hopes his doesn't have to take any auth from the outside world [15:42] morning [15:43] * penguin42 yaaawwwwnnns [16:31] * SuperEngineer smiles - found a cheap portable USB cassette player to put some prize cassettes into mp3 [16:32] it had better be cheap if it was easier than plugging in an old casette recorder to the audio in [16:34] penguin42: it was 9.99 - & old cassette player is slightly u/s [unless you can find me a new drive band for it!] [16:35] £10 will do me fine [16:35] yeh ok for that much [16:38] I am honoured that you approve ;) [16:39] u/s? [16:39] unserviceable [16:39] aah, I thought it was "uniquely scrumptious" [16:41] a.k.a.. f.. [no SuperEngineer, slap your wrist... you mustn't say that on a family friendly channel] [16:45] * SuperEngineer also celebrates having found cause of several weird & wonderful system errors & x crashes! [16:46] last update... linux headers downloaded... no linux image... fired up synaptic... [16:47] voila! linux-headers-generic ticked [installed] but linux-image-generic mysteriously unchecked! [16:48] dpownload the corresponding image, install linux-image-geric package again... all fixed! :) [16:51] ...& btw, I *hate* working weekends [although some are made easier by silly calls and finding bargain cassetrte usb cassette players [16:52] cassetrte usb cassette players? - y'all know that don't make sense! [16:52] yeh, it really doesn't [16:53] ;) [16:54] [it first converts a cassetrte into a cassette then it transfers output to pooter - clever huh] [17:11] Tech question... the only thing not working since failed restore and forced re-install [previous home partition restored]... [17:11] ...is those darn web apps [17:12] where should I look? could there be dirty keys held in seahorse [keyring]? [17:17] hi, what TTY has the GUI? [17:17] 7 [17:17] hmmm, something's wrong then :) [17:17] or to rephrase that - the keys for "Ubuntu Web Account: id 1-1" [& 1-3, 3-1, 3-1]... do these need to be removed? [17:17] I was running dist-upgrade moving from 13.10 to 14.04 [17:18] and it's showing a black screen and the last message on it is "stopping virtual printing daemon: done", not updating. [17:20] alt+ctrl+del to the rescue. fingers crossed the box machine still works [17:22] :'( [17:23] :( [17:25] the box boots and is reachable on the network, but TTY7 is just a blank screen [17:29] hm [17:29] wfresh install? [17:29] yea, just need to scp my data off. [17:29] blank screen when sshing in is this? [17:30] no, ssh is fine. the monitor shows a blank unless i go to a tty other than 7 [17:30] i can ping google from the device too so the networking is working and i guess everything else [17:30] i tried restarting lightdm to no avail [17:31] probably already checked but checked logfiles for anyclues [17:33] where would lightdm log if it failed to start? [17:35] var/log/lightdm/lightdm.log: [17:41] easier to just copy my /home [17:41] and install 1404 directly. [17:41] got gigabit and a NAS so it's not a big deal. [17:41] or reinstall the desktop with apt [17:43] it said unmet dependencies, then suggested i run: apt-get -f install, which seems to be updating loads of packages, presumably it's resuming the upgrade which failed [17:43] let it run then [17:43] :D [17:45] gah, some complaints about gnome-settings-daemon-schemas [17:45] i'll just go clean install route [18:43] My dad just got a Nexus 4 and stuck a giffgaff sim into it, paid for the £12 goodybag, but whatever he does he only seems to get a "G" connection (not 2g or 3g) and can't get any internet access out of it. Any suggestions? [18:46] and he's enabled 3g and selected the network off the list? [18:48] penguin42: settings > more > mobile networks > data enabled is enabled [18:48] what do you mean network off the list? [18:50] Azelphur, G is 2G [18:50] GPRS [18:50] H is 3G [18:50] E is 2.5 [18:50] awilkins: usually it says 2g, on my Nexus iirc it does [18:50] but yea, either way he has no internet access [18:50] Azelphur, I have an N4 and it uses the more confusing and annoying acronym names [18:51] fun [18:51] The thing about GiffGaff is they sell reserve capacity of o2s network [18:51] Azelphur: APN or being stuck on 2G [18:51] Azelphur: on my phone I can chose the network [18:51] daftykins: I set all the APN details [18:51] * penguin42 boots his phone [18:51] actually I just had a thought, he's in wales...does that break shit? [18:52] yep if he's down in a valley [18:52] Wales has lots of mountains and stuff [18:52] nah he's got signal [18:52] Azelphur: wth did you have to screw around with apn settings? [18:52] likely won't get more than 2G in a valley though mate [18:52] and my mum on a different network has 5 bars of HSDPA, so he's in a reasonably populated area [18:52] penguin42: we followed a youtube video from giffgaff detailing the APN settings [18:52] If he has signal the local router might just be borked if he has no network access [18:52] daftykins: he doesn't have any connection at all though, despite it saying 2g, he has no internet access [18:52] Azelphur: weird, I've not had to do that in the last 10 years [18:53] penguin42, have most of your phones been provider ones? [18:53] oh i see [18:53] factory reset? [18:53] https://www.dropbox.com/sh/fz006ibpbygcj3y/AACw5Fqaal0DQqRW66-yis8-a [18:53] i was in a valley today and got stuck on EDGE [18:53] daftykins: it's a fairly new phone already mostly default [18:53] Azelphur, The OS has the APN settings for GiffGaff in it AFAIK [18:53] but just look at those prawn sarnies and pint of ale 8D [18:53] Azelphur: wireless settings-mobile network settings-network operators ? [18:53] awilkins: yea, by default it was set to O2 [18:53] dafty! [18:54] maps o/ [18:54] awilkins: Well I'm on Cyanogen so I don't think that's relevant [18:54] :D [18:54] 10pm swan fun? [18:54] or whenever youre free [18:54] and O2 are behind the scenes for giffgaff [18:54] :D [18:54] lol [18:54] Azelphur, I don't recall having to do anything scary with it apart from configuring which network it was on... there's also a thing where you can get them to send you a text with the APN settings in that magically sets them for you [18:54] yeah hopefully in a bit mate, just relaxing atm [18:54] cool:D [18:54] i've asked in their channel [18:55] someone replied at mid-day today after that situ last night XD [18:55] awilkins: yea I thought there was that, I wonder where that is [18:55] Azelphur, But network access on GiffGaff has sometimes been a bit patchy for me so if you only just got it set up I might be inclined to see if there were any outages [18:55] perhaps the youtube video was outdated [18:55] awilkins: has been a couple days with issues [18:55] Azelphur, That's not atypical. Sometimes they go through a day or so of sending the same SMS message to me 2-5 times [18:55] fun [18:55] Although that was cleared with a "manual roam" [18:56] Which does sound fun :-) [18:56] In general I'm happy with them for a service [18:56] I get a 1GB package with tethering for £10 a month which I can't complain about [18:57] wee-hee - busy copying cassettes to pooter with newly purchased £10 usb cassette player [18:57] And I can only recall one occasion when the network service failed and left me in a tight spot (couldn't pay for my parking with the phone app) [18:57] Compared to Vodafone they are the Super Happy Fun Band [18:58] awilkins: found the number for giffgaff, supposedly SETTINGS to 2020, so checking that out [18:58] SuperEngineer: cassette O_O what treasures lie on those? :) [18:58] [as to "Windows conversion software supplied" well - errrmmm! [18:58] daftykins: Twin Peaks, HHGTTG et al [18:58] (Vodafone outright lied to me and sold me a plan with no data after I spent 10 minutes explaining to them that I barely made calls or sent texts but I did need data... and then charged me £1 a day every day I used the network. Scummers) [18:59] ...it is supplied with acopy of windows program - something called Audacity :D [18:59] It was worth the £70 residual on my contract just to get the filthy stink of Vodafone's SIM card out of my phone. [18:59] SuperEngineer: :D ooooh VHS? [19:00] daftykins: not VHS [tho I still have a few vid tapes around awaiting - these are audio [19:01] ah right, i'd have found it easier to source elsewhere in superior quality :D [19:01] Twin Peaks soundtrack \o/ [19:01] Twin Peaks = ultimate brain warp = /me [19:01] ;) [19:02] time to try this yorkshire tea i bought [19:04] eeeh lad [19:05] by guum - be a good brew me lad === jpds_ is now known as jpds [19:05] [though my slightly cooled bottle of beer is better] :D === jpds is now known as Guest68453 [19:09] looks my cassettes are soon to heard in my ears again :D total cost £9.99 === Guest68453 is now known as jpds_ [19:11] oi jpds_ ... make ya mind upo pretty please ;) [19:12] [& hi] [19:12] SuperEngineer: Oi, it says my nick is unavailable. [19:12] hehe [19:12] jpds_: do you have some time for some strongswan fun at all? me and maps were working on it last night [19:13] jpds_: idea... change your nick to nick - get your revenge [19:13] daftykins: Yep. [19:13] jpds_: excellent :D here's what the client log showed - http://paste.ubuntu.com/7822608/ [19:14] daftykins: You'd have to check what the server says. [19:15] jpds_: pretty much identical, it's almost as though we need to specify key type or tell it in the client config to send the certificate? [19:15] daftykins: Also, why are you shoving your certs and keys directly in /etc/. [19:15] jpds_: basically i put them in /etc/ipsec.d/ to start and kept seeing apparmor messages about DENIED, so wasn't sure if it was being grumpy [19:16] i shuffled them about and it made no odds [19:16] Well, apparmor says it's sitting in /etc/. [19:16] daftykins: Can I see your config? [19:17] sure 2 mins [19:18] daftykins: The server shoudl say something else in it's logs. [19:18] maps|wrk: ^ [19:19] jpds_: http://paste.ubuntu.com/7826510/ [19:20] jah [19:20] ]do i need to show any logs or config [19:20] maps|wrk: yeah can you paste some of /var/log/syslog that shows up when i try to connect? [19:21] lemme make an attempt so you get fresh logs [19:21] in fact on boot mine probably did already [19:21] oke 2sec [19:22] there we go, 20:21:46 attempt [19:22] gots it [19:22] :D [19:22] :) [19:22] more gifts for jpds_ http://paste.ubuntu.com/7826523/ [19:23] Erm, what does the server's config look like? [19:23] line 8 looks like the ticket [19:23] sec [19:24] jpds_: http://paste.ubuntu.com/7826528/ [19:24] followed the pdf exactly i thought [19:25] OK, and you're using a common CA? [19:26] I would move the certs and keys to /etc/ipsec.d/{certs,private}/ [19:27] Just to keep apparmor happy. [19:27] will do, certainly made no odds last time [19:28] so is my end ok jpds_ ? [19:29] maps|wrk: Did you give daftykins a key and cert that were signed by your CA? [19:29] yip ^ [19:29] i obtained them from maps and popped them into my folders [19:29] yep [19:30] firewall/router [19:30] i'm certainly behind NAT, but maps has his box DMZ'd [19:30] daftykins: In your ipsec.conf, can you edit rightsourceip so it has a ',' instead of a ';' ? [19:31] wilco [19:31] oh, you're both running that same config? [19:31] i'm the client, he's the server [19:31] jpds_: hang on i don't have that field at all - is that for the server side? [19:32] rightsourceip should have my IP dafty thought we had that? [19:32] oh no maybe not [19:32] maps|wrk: it's yours that needs the semi colon changed then mate [19:32] maps|wrk: Ah, that's for you. [19:33] aha [19:33] :D [19:33] so what do i change [19:33] after 24? [19:33] maps|wrk: line 18. [19:33] ...of http://paste.ubuntu.com/7826528/ [19:33] done [19:33] 24,fe3 [19:34] restarted strongswan [19:35] ok check your logs, i saw a retransmit this time [19:35] ok moment [19:36] http://paste.ubuntu.com/7826569/ [19:36] same :< [19:37] maps|wrk: change left= to your 192 address rather than the hostname which I assume is resolving to a public address [19:37] ok and i had differences - http://paste.ubuntu.com/7826580/ [19:38] so [19:38] left=192.16.0.2 [19:38] I belive you're missing an 8 [19:38] ah yea [19:38] :D [19:38] but done with the 8 [19:38] :P [19:38] reloaded and ready for retry? [19:38] and restarted again [19:38] yep [19:39] oh hello, lots more this time [19:39] http://paste.ubuntu.com/7826598/ [19:39] http://paste.ubuntu.com/7826599/ [19:39] haha sequential! \o/ [19:39] 10[IKE] IKE_SA deleted [19:39] Jul 20 20:38:57 frogs charon: 10[CFG] lease 10.0.1.1 by 'C=UK, O=Example Ltd., CN=client' went offline Jul 20 20:38:59 frogs radvd[2523]: attempting to reread config file Jul 20 20:38:59 frogs radvd[2523]: resuming normal operation [19:40] client went offline hm [19:40] hahaha yea [19:40] Jul 20 20:38:57 vaiotz charon: 09[IKE] no trusted ECDSA public key found for 'C=UK, O=Example Ltd., CN=frogs.zapto.org' could that be why [19:40] maps|wrk: Think daftykins needs a copy of the ca cert. [19:40] ah i thought that could be what it is [19:40] ooh a third file [19:40] ok [19:40] i wasnt sure [19:41] gwCert.der ? [19:41] no [19:41] Yep. [19:41] caCert.der ? [19:41] make sure the key isn't in it [19:41] which file :| [19:41] gw [19:41] caCert.der [19:42] maps|wrk: That one. [19:42] oh. heh [19:42] will i want this one in /etc/ipsec.d/cacerts/ ? [19:42] silly question i know :> [19:42] yes [19:42] ok [19:42] its there now [19:42] got the url still daftykins ? [19:43] errrr [19:43] https://frogs.zapto.org/~mark/swan/ [19:43] :D [19:43] yeah i can make it up from memory [19:43] or click that \o/ [19:43] heh [19:44] if i dont respond say my nick so it flashes my browser :D [19:44] have to do a bit of work now and again ya know [19:44] :) [19:44] i am connected \o/ [19:44] yay [19:44] :D [19:45] ok let me fiddle with the networking [19:45] see what's working [19:45] jpds_: can i use this config for a windows7 machine? i read win7 doesnt support ecdsa [19:45] ah yea check it all works fine good idea [19:46] i'm a bit confused as to how this malarkey works now then, i don't get an interface, i don't get any network routes... [19:46] hmm [19:46] "ipsec statusall" tells me i'm 10.0.1.1 [19:46] should you have? [19:46] i know that with openvpn you get a new interface [19:46] i don't have a clue how this setup works :) [19:47] is everything going through my vpn now or nothing lol [19:47] No interfaces with ipsec. [19:47] jpds_: what about my windows7 question please:D [19:47] maps|wrk: Never used Windows with this before.. [19:47] thanks [19:47] and iOS?:) [19:47] or also never [19:47] There's: https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config [19:47] but where would we put the cert/key and cacert:| [19:48] have to make them into a .p12 ? [19:48] daftykins: sudo ip xfrm policy [19:49] maps|wrk: https://wiki.strongswan.org/projects/strongswan/wiki/IOS_%28Apple%29 [19:49] ive read all those lots of times :D [19:49] but where would we put the cert/key and cacert?? am i right about this p12 ..sure i read that [19:50] looks like my traffic has definitely changed, as pinging google is dead :D [19:50] maps|wrk: Probably, I used this for my android phone: http://danielpocock.com/strongswan-debian-rhel-fedora-with-android-client [19:50] daftykins: It's all going via maps|wrk's box. [19:51] http://paste.ubuntu.com/7826657/ [19:51] maps|wrk: Did you put the masquerade rule in/ [19:51] should i be able to ping an IP at his end? i'm not even sure what that'd be [19:52] looks like a no, or maybe the IP forwarding isn't up [19:52] hmm jpds_ nope didnt do any ipforward or iptables..i thought we wouldnt need to as the box is setup as the DMZ? [19:52] as i can't ping 8.8.8.8 [19:52] aha [19:52] so i need ipforwarding [19:52] maps|wrk: cat /proc/sys/net/ipv4/ip_forward [19:52] 0 or 1? [19:53] 1 [19:53] mark@frogs:/etc/ipsec.d/cacerts$ cat /proc/sys/net/ipv4/ip_forward 1 mark@frogs:/etc/ipsec.d/cacerts$ [19:53] cool, just need those iptables masquerade rules then [19:53] maps|wrk: you also need the nat masquerade rules in the slides. [19:53] oh [19:53] ok 2sec [19:53] i didnt realise oops [19:56] that's a bad maps! [19:56] i thought we got to that with the convo last night :> [19:56] wlan0 then for me not eth0 yea? [19:56] if that's your home machines active interface ja [19:57] done! [19:57] holy moly i can ping google now [19:57] by IP [19:57] and by host [19:57] :D [19:57] plus i have pings consistent with going over via your connection [19:58] vewy gewd [19:58] how cna you tell because the ms is longer? [19:58] jpds_: thanks for your assistance :> [19:58] yep [19:58] so whatismyip.com shows my ip? [19:58] 60-110 it came up with [19:58] hmm. plugged in 2 disks in slots 3 & 4 on my microserver but they appear as sda and sdb. thought they would be sdc and sdd [19:58] daftykins: No worries. [19:58] thanks jpds_ [19:59] jpds_: would it make more sense for security to use other forms vs ECDSA? [19:59] as in would others be better? [19:59] daftykins: can you fireup ffox and see [19:59] foobarry: ah the ol' pesky order switcharoo [19:59] just wondering if its all going via the vpn [19:59] i assume so as its not a split tunnel [20:00] daftykins: bit nervous about adding disks later [20:00] foobarry: you just mount via UUIDs instead of device names though eh [20:00] daftykins: That's a question for a crypto expert. [20:00] maps|wrk: yeah i'm on the sofa with my laptop SSH'd to the laptop i'm VPN'd via though XD [20:00] :D [20:01] should everything be going via my vpn now jpds_ ? [20:01] i tried to be lazy by installing lynx, but for some reason it gave me a 403 on whatismyip.com 0o [20:01] haha [20:01] maps|wrk: Yep. [20:01] next step is get it working on ios [20:02] openvpn worked fine except for the issue ive mentioned so many times [20:02] :< [20:02] maps|wrk: Because you have 0.0.0.0/0 as the subnet. [20:02] and i can use it to watch bbc iplayer when on holiday :DDD [20:02] hahaha [20:03] well i suppose i'll just have to get up and use a browser [20:03] lol [20:04] yep IP is yours [20:04] :DDDD [20:04] what incriminating activities can i... er i mean hi :D [20:04] lol [20:05] another question [20:06] is it possible jpds_ or anyone to make the vpn users use a specific http proxy say i run a squid proxy on the same vpn machine could i make them use tyhat [20:06] just so i coukd control what can be visited through acls [20:06] couldnt with openvpn [20:06] probably cant [20:06] maps|wrk: Yeah, you'd have to tweak the iptables rules so it REJECTs normal HTTP traffic. [20:06] maps|wrk: But it allows traffic to the proxy port. [20:07] but that would rely on the user manually setting their browser to use the proxy if im understand right? [20:07] *understanding [20:07] maps|wrk: Yep. [20:07] maps|wrk: Or. [20:08] maps|wrk: You set a masquerade rule so that all port 80 traffic is forced to the proxy port transparently. [20:08] ah [20:08] thanks very much jpds_ [20:08] No worries. [20:10] successful day:D [20:11] guess i better remove that software / work out how to reconfigure it without autostart 8D [20:11] :D [20:12] isnt it a vmu made just for this] [20:12] or was it a diff machine i forget [20:12] nah i switched to a laptop in the end [20:12] ah ya [20:13] daftykins: Change your auto= config to add. [20:13] "auto=add" hmm, ok that doesn't make any sense to me XD [20:14] i'd have expected "auto=off" or something :D [20:14] =] [20:14] adds it but isnt acive [20:15] i remember being in a job where some guy was going to spend thousands on some hardware VPN equipment, i was going to suggest just two old boxes at either end running VPN software [20:15] other end being in Monaco [20:16] daftykins: And now we have strongswan and two Ubuntu VMs. [20:17] :D [20:17] >:D [20:17]