=== gunner_genii is now known as genii === Eu is now known as Guest95210 [00:39] Hi! [00:39] I have a setup with BIND9 and DHCPD and i'm trying to update reverse dns records from dhcp. [00:39] But i get the following error on the DNS server: client 192.168.0.118#48065/key rndc-key: updating zone '10.IN-ADDR.ARPA/IN': update failed: not authoritative for update zone (NOTAUTH) [00:40] And on the dhcp server: Unable to add reverse map from 135.40.0.10.in-addr.arpa to halvors02.crew.infected.no.: not found [00:40] I have no idea why this doesn't work. [00:40] why is a client on 192.168.x.x updating a record for 10.x.x.x? [00:43] 192.168.0.118 is the DHCP server and 192.168.0.116 is the DNS server. They just have communication via another network. [00:43] And 10.x.x.x because dhcp relay :) [00:44] okay, so something expected :) [00:44] But i don't fully understand the NOAUTH. [00:44] your bind9 server isn't set as authoritative for that zone [00:45] Does it mean my rndc-key is bad? I've checked and it is excactly the same configuration as the forward zone. [00:45] teward: How do i set it authorative? [00:46] halvors1: this guide makes me think you can make it authoritative by adding "recursion no; [00:46] " [00:46] https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-an-authoritative-only-dns-server-on-ubuntu-14-04 [00:50] sarnold: I don't get the: client 192.168.0.118#48065/key rndc-key: updating zone '10.IN-ADDR.ARPA/IN': update failed: not authoritative for update zone (NOTAUTH) [00:51] Anymore, but i still get the: Unable to add reverse map from 135.40.0.10.in-addr.arpa to halvors02.crew.infected.no.: not found [00:51] error [00:52] What confuses me the most is the not found message reported by the dhcp server. [00:52] halvors1: ooh, this looks useful: http://community.spiceworks.com/topic/174078-isc-dhcp-and-bind-doing-ddns [00:53] halvors1: looks like you need to add another zone nnn.nnn.nnn.nn.in-addr.arpa { } block to your dhcpd config [00:55] I have that zone in dhcpd already. [00:56] do you need to reload the server to know about it? (sorry, but I've gotta ask :) [00:56] huh? Of course i reloaded both bind and isc-dhcp-server [00:56] :) [00:56] Here is a dump of my dhcpd.conf file: http://pastebin.com/G6RKKNNr [00:59] halvors1: hmm, looks rndc-key is still in the paste [01:01] yep :P [01:02] But it's just a lan dns server ;) [01:02] hmm. [01:02] halvors1: sorry, I'm not spotting it :( [01:03] Basiclly it seems like the issue is that somehow bind is complaining about that zone doesn't exist... [01:03] But cannot figure out why... [01:03] halvors1: but the error is coming from dhcpd, right? [01:03] yes [01:03] halvors1: you could ltrace the thing, you might get lucky.. [01:03] I've tried manually with nsupdate [01:03] http://pastebin.com/7M70ybeh [01:04] ltrace? [01:04] ltrace is like strace, but shows (some, but not all) function calls [01:05] Here is my zone from bind btw: http://pastebin.com/6YSyQwv0 [01:05] Seems ok, right? [01:05] halvors1: is that leading "0." alright? === markthomas is now known as markthomas|away [01:06] Is it just zone "40.0.10.in-addr.arpa" { you mean? [01:06] Keep in mind that this is bind configuration not dhcpd. [01:07] halvors1: yea, I just don't know bind all so well :) [01:07] hmm. [01:08] The zero seems to be correct. [01:08] okay [01:17] sarnold: hmm. I'm gonna need to continue looking at this tomorrow :) Thanks for help so far ;) [01:17] halvors1: good luck :) I'd be curious to hear what it is when you find it [01:17] :) [01:18] the last time I used bind and dynamic updates like like 10years ago [01:18] the zero is not correct :) [01:19] the 0 would be a dns record (ptr) within the zone [01:19] not the whole zone [01:19] hmm. [01:19] Are you sure? [01:19] well, I haven't used bind since like 2005 [01:20] but I have been serving up zone entries since 1998 [01:20] this looks like no zero .. http://www.zytrax.com/books/dns/ch3/ [01:20] http://www.philchen.com/2007/04/04/configuring-reverse-dns [01:21] Patrickdk: hrm, that includes the 0 :) [01:21] no it doesn't [01:21] zone "0.168.192.in-addr.arpa" IN { [01:21] oh [01:21] 3 places [01:21] sigh [01:21] not 4 :) [01:21] me fail reading [01:21] that's unpossible! [01:21] :) [01:21] wait till you start learning about sub/24 ptr forwarding :) [01:22] like when an isp needs to give you reverse for a smaller than /24 block :) [01:22] or for that matter, anything not on a Class A/B/C boundry [01:22] :) [01:23] It is /24 subnets i'm gonna provide reverse dns for :) [01:23] no, the end person, doesn't matter :) [01:23] it can be *too* large, without sideeffects [01:23] it's when you have to correctly forward that info, it gets interesting [01:24] enough they wrote rfc's for it :) [01:25] Ah, excellent. [01:25] Now got it actually working over here :D [01:26] Thank you very much all of you :) [01:26] The problem was the 0. [01:26] Patrickdk: nice :) [01:26] My zone in bind now looks like: http://pastebin.com/yrvB0sRW [01:27] agh, have to remember that for future installations :) [01:28] hmm, I wonder if I can ban more ips now :) [01:29] http://www.inmotionhosting.com/support/news/general/wp-login-brute-force-attack [01:29] been having that *issue* [01:29] not enough to really even be noticable [01:29] but well, bruteforcing shouldn't be allowed [01:30] YEah :) [01:33] Patrickdk: heh, crazy, they don't include firewalling :/ [01:33] wouldn't that block the ability for people to use wordpress then? :) [01:33] heh, makes me really happy though that I'm on debian/ubuntu [01:34] apparmor is so much useable than selinux to lock down this crap [01:35] Patrickdk: dropping packets from login-bruteforcers is unlikely to upset too many legitimate users :) [01:35] sarnold, tell that to my users :) [01:35] I had it dropping packets after 10 logins per minute [01:35] Patrickdk: oh they try to log in as admin a few hundred times without the right passwords? :) hehe [01:35] I dunno why users where hitting up the login page so often :) [01:35] haha [01:36] the other part that annoys me :) [01:36] is the wordpress ajax script [01:36] *NORMAL* users hit that up like 3 times a second [01:36] that totally triggers all my anti-dos protection [01:36] wow.. [01:37] where anti-dos is set for, same url, same ip, loads same thing, >100 times in 5min [01:37] sounds reasonable? :) [01:39] yup :) === maxb_ is now known as maxb === daker_ is now known as daker === the_ktosiek is now known as ktosiek === Lcawte|Away is now known as Lcawte [13:11] how to install ssl on ubuntu? === a1berto_ is now known as a1berto [16:40] ListenAddress 192.168.1.2, 192.168.1.3 is it true in sshd_config ? === markthomas|away is now known as markthomas === markthomas is now known as markthomas|away === markthomas|away is now known as markthomas === Ursinha is now known as Ursinha-afk [18:07] hi folks [18:07] who used those? [18:07] http://www.soyoustart.com/us/essential-servers/ [18:21] ?? [18:22] only you [18:22] ??////??/ [18:22] oki [18:22] Patrickdk: which one do u use? [18:23] my own? [18:23] how? [18:23] its cost alot to colo [18:23] place order, receive server, install software, buy datacenter, install into datacenter [18:24] eeee [18:24] buy datacentre? [18:24] u mean colo space? [18:24] sure :) [18:24] well, if your small [18:24] but I just want 1 server :P [18:24] hehe [18:24] it's cheaper to own the datacenter [18:24] how come? [18:24] it cost millions [18:24] and how much would it cost to *rent* a datacenter? [18:24] atleast 4x that price [18:25] why does everyone want to get *bigger*? [18:25] cause you can save more money, when your larger [18:25] till you become management heavy [18:25] I want to rent 1 to 2 boxes [18:25] :) [18:25] surely cheaper to rent? [18:26] datashag got some cheap enough [18:26] those are a strange collection of *desktop* machines [18:26] that is why those are cheap [18:27] it's just a normal desktop [18:27] most of them don't even have ecc [18:27] but it all depends on your requirements [18:28] i want it cheap [18:28] and big [18:28] ::) [18:29] what is *big*? [18:29] 32 MB ram === Guest95210 is now known as knoxy [18:33] so you start also offers anti ddos [18:33] :D [18:33] for free [18:33] there is no such thing as anti-ddos [18:34] they claim they offer it [18:34] what they claim, and what it's called, are going be two totally different things [18:34] means site will stay online [18:34] how come? [18:34] how can it stay online? [18:34] they absord extra BD [18:35] extra bandwidth? [18:35] what about your cpu? what about your server? [18:35] and what about all those ligit clients attempting to access you? [18:35] absorbing bandwidth costs != site is still usable [18:35] just means you won't get a huge bill [18:35] not that things will work [18:36] what about All OVH servers will benefit from automatic anti-DDoS mitigation by default in the event of an attack (reactive mitigation). [18:36] Anti-DDoS PRO Subscribing to professional use for your server enables access to permanent mitigation (the permanent settings) and configuration of the Firewall Network. [18:36] but how do they perma mitigate it? [18:37] dunno :) [18:37] how do they know a ddos from just normal usage? [18:37] the first time your site goes vial, it will be considered a ddos [18:37] at the moment you DONT want it to go down [18:38] I think thei offer tilera [18:38] instant scale of cpus cores [18:38] http://www.tilera.com/ [18:40] i dont know how they do it but it works [18:40] my mate host site that is often ddosed with them [18:40] fine [18:40] herzner simply nulls IP [18:43] see, I do it the other way [18:43] I just have enough servers to not be ddos [18:43] and will block on a needed bases to stop abuse [18:44] but I don't want stuff to be blocked incase of a spike [18:44] well say u got 1 box [18:44] then its tricky [18:44] :D [18:44] do u also offer hosting? [18:44] :D [18:45] not for a private server [18:46] for what then? === apb_ is now known as apb1963 === Ursinha-afk is now known as Ursinha [20:50] hello after i uninstalled nginx from my server i can't use the port 80, i stopped the service and rebooted, what am i missing? [20:50] hmm [20:50] apt-get purge [20:50] also u missing apache [20:50] or some webserver [20:50] to serve http on port 80 [20:50] :D [20:51] or run ls [20:51] ls [20:51] or lsof -l [20:51] something like that [20:51] to see ports [20:51] funman___, i'm using a node.js app, if i change port it works . [20:51] something is blocking the port 80 [20:52] and other than nginx i can't thing other things [20:52] run some command to list all ips and ports [20:52] then u know for sure [20:52] i did, nothing is runnign on 80 [20:53] heh? that seems hard to figure out [20:53] why not just use, netstat -antp [20:53] netstat -lnptu [20:53] :D [20:56] https://gist.github.com/blackdev1l/1ce488497280fca4d0da funman___ Patrickdk [20:56] :( [20:56] you are running it as *root* right? [20:56] y [20:57] * Patrickdk has no idea what a single letter means, you can talk right? [20:57] w [20:57] ....it's not like you can't think what y mean while you type it on terminal uh? [20:57] w u s? [20:58] :D [20:58] yes btw [20:59] y? sounds like why? but could be short for yes? but then I don't even know what your thinking so who knows [20:59] and I shouldn't have to FORCE myself to deciver your encryption [21:00] that is taking free support, too far [21:00] or maybe you can be just a little less pedantic and expect more a yes to a "yes/no" question [21:00] but, whatever, thank you for the support [21:00] I expect answers, not letters [21:00] this is not a scantron test [21:01] someone has an idea about my prior question ? [21:03] netstat -lnptu pastebin [21:05] i did funman___ [21:05] https://gist.github.com/blackdev1l/1ce488497280fca4d0da funman___ [21:05] i know that something is blocking the 80 port because if i change to default one it just works [21:06] ok try reboot [21:06] :D [21:06] that can fix it [21:07] i already did :( i'm so lost with this problem [21:07] heh, there are only 3 possible things it could be :) [21:07] and reboot is never an answer [21:08] it is [21:08] hehe [21:09] if reboot is the answer, then it was a program running, and that program *failed* to restart [21:09] so really, you ahve two more issues, ontop of your issue :) [21:10] blackdev1l: rebot and see [21:10] :D [21:11] doesn't works [21:15] oki [21:15] top [21:15] and kill all proccesses u dont know [21:15] what they for [21:15] :D [21:15] ahah [21:16] i think i'll give up and use apache [21:16] and do some proxypassReverse [21:19] funman, won't help [21:19] that isn't the problem, already confirmed using netstat [21:19] using apache, likely will work around the issue [21:19] yeah [21:19] :\ kinda bad though [21:20] bad? [21:20] that you don't know what to fix? [21:20] guess so [23:03] little question [23:31] hey guys Im trying to copy files from my local computer to a remote server but I need to copy them to a root owned directory via my user. Is there a way to request sudo on transfer? [23:32] I have scp www_example_com.csr ubuntu@165.000.000.200:"/etc/nginx/ssl" [23:52] zeroNones: is this a one-off thing? [23:54] zeroNones: if so, you can scp to a directory the ubuntu user can write to, ssh to the server, and use sudo to copy that file under /etc/nginx/ssl. if not, the make the /etc/nginx/ssl directory writeable by user 'ubuntu', or his group