/srv/irclogs.ubuntu.com/2015/06/11/#ubuntu-server.txt

=== markthomas is now known as markthomas|away
Zarathuztra|2anyone around that can help out?04:14
sarnoldwith what?04:44
lordievaderGood morning.08:09
=== Lcawte|Away is now known as Lcawte
friendlyguygood morning ;)09:04
diyttohi, i have my server set to only accept pubkey ssh connections, but my server seems to not be accpeting those connections for my user09:08
diyttoi haven't changed anything with ssh configs, and i can still login as another user09:08
diyttohowever, this other user does not have sudo rights09:09
diyttoany suggestions?09:09
diyttoi am still open on an sftp connection with the server on the account i am lockedout of09:09
friendlyguydiytto: did you add your pubkey to authorized_keys?09:10
=== markthomas|away is now known as markthomas
diyttoyeah, i have had it in there since the beginning09:10
diyttoi have always been able to log in with it09:10
diyttoi haven't changed it in any way, yet am unable to log in09:11
friendlyguykk, and you were able to connect with ssh via pubkey before? Or did you enter a password upon login?09:11
diyttoi used pubkey previously09:11
diyttoi have password disabled09:11
friendlyguyk09:11
friendlyguydid you change anything at all?09:11
diyttono09:11
diyttoonly thing i have done is copy the authorized keys to another user on the server09:12
friendlyguyhave you tried to login to another host with this keypair? maybe something is broken09:12
OpenTokixdiytto: what does ssh -vvvvv say?09:12
diyttoi don't know how that would make a difference09:12
diyttosame key works on another user09:12
diyttoOpenTokix: i am getting nothing with that09:13
diyttoit just tells me correct usage of ssh09:14
friendlyguyi think he ment to add verboooooose output to your connection09:14
diyttothe exact same authorized keys works on a seperate account09:14
diyttoah okay hold on09:14
friendlyguymaybe you could also check your file permissions in ~/.ssh... should be 700 over the place09:16
diyttois there a paste tool you would prefer i use?09:16
friendlyguyi don't care, but maybe there are some "rules" in here for which pastebin to use09:17
friendlyguy...f you want to show large texts, such as errors, use the pastebin and post the URL to the paste instead.... http://paste.ubuntu.com/09:17
friendlyguyfrom: https://wiki.ubuntu.com/IRC/Guidelines?action=show&redirect=IrcGuidelines09:17
diyttohttp://paste.ubuntu.com/11695170/09:17
friendlyguydid you checkt the permissions?09:18
diyttohow do i check specific permissions09:19
friendlyguyls -la ~/.ssh09:19
OpenTokix.ssh should be 700 and files in .ssh 60009:19
OpenTokixbtw.09:19
OpenTokixand owned by your user and your personal group09:19
diyttoeverything looks fine09:20
diyttoon my end09:20
friendlyguythis last "Permission denied (publickey)."...09:21
diyttoserver is fine with permissions too09:22
diyttoi am able to edit my authorized_hosts09:23
diyttoi have an sftp connection that was open previously before this issue09:23
diyttono cli access09:24
friendlyguycould you try to use the -i (together with -vvv) option of ssh, to point directly to the right keyfile?09:28
davegarathdiytto: the file name for the public keys is authorized_keys, not authorized_hosts09:28
diyttodavegarath: i am using the authorized_keys file, i am tired atm09:30
diyttofriendlyguy: let me try09:30
diyttohttp://paste.ubuntu.com/11695216/09:32
friendlyguyr u using selinux?09:36
diyttono09:36
friendlyguymaybe you messed that up09:36
diyttoi am on OS X, server is ubuntu09:36
OpenTokixdiytto: debug1: Offering RSA public key: /Users/diytto/.ssh/diyttoaws.pem09:36
OpenTokixI am guessing that is the problem09:36
OpenTokixdiytto: for the -i you have to provide the full path to the key, it will not select that name of key from your .ssh dir09:37
diyttoOpenTokix: even if i am in the .ssh dir?09:37
OpenTokixI think so09:37
friendlyguyi just found one mac user with "slightly" the same problem:09:37
friendlyguy...on my Mac, the file /etc/ssh_config had the line  PubkeyAuthentication = no   I commented out that one line, and now everything works fine....09:37
OpenTokixfriendlyguy: that is not standard behaviour on the mac.09:38
friendlyguykk09:38
friendlyguyI've got very little clue about macs09:38
OpenTokixdiytto: but you might also want to check out your /etc/ssh_config09:39
diyttoI've never had a problem with logging in before09:39
OpenTokixdebug3: Could not load "id_rsa.pub" as a RSA1 public key09:39
diyttoOpenTokix: i get the same thing with the full path09:39
OpenTokixdiytto: ok, post the debug-output09:39
friendlyguyi though: "debug2: key: id_rsa.pub (0x7ff35b700140), explicit" is indicating the use of the keyfile09:40
friendlyguymaybe you could also show us some log output from the server09:40
diyttohttp://paste.ubuntu.com/11695243/09:41
diyttoi can possibly09:41
diyttowhere is log info located09:41
OpenTokixdebug3: Could not load "/Users/diytto/.ssh/id_rsa.pub" as a RSA1 public key09:41
OpenTokixThere is your problem09:41
OpenTokixdo a ls -l /Users/diytto/.ssh/id_rsa.pub09:41
OpenTokixoh09:42
OpenTokixhaha09:42
OpenTokixnow I get it09:42
OpenTokix=)09:42
diytto-rw-------+ 1 diytto  staff  402 Jul 18  2014 /Users/diytto/.ssh/id_rsa.pub09:42
OpenTokixYou are trying to login with your public key09:42
OpenTokixssh -i ~/.ssh/id_rsa diytto@de.diytto.com09:42
OpenTokixthis will work09:42
friendlyguyouch09:42
OpenTokixhaha, - so easy to miss09:43
diyttostill denied09:43
OpenTokixok, now with -vvvv and see the output09:43
diyttohttp://paste.ubuntu.com/11695253/09:44
OpenTokixdebug3: Could not load "/Users/diytto/.ssh/id_rsa" as a RSA1 public key09:45
OpenTokixfile /Users/diytto/.ssh/id_rsa09:45
OpenTokixwhat does that command output?09:45
OpenTokixdo _NOT_ paste your private key09:45
diytto     /Users/diytto/.ssh/id_rsa: ASCII text09:45
OpenTokixok09:45
OpenTokixif you look into that file09:45
diyttoalso, this fails with a separate pubkey on my phone09:46
OpenTokixdoes it start with ----BEGIN RSA PRIVATE KEY----09:46
diyttoif that's helpful09:46
friendlyguywhats still bugging me, he tols us he is able to login with this same key to another user09:46
OpenTokixand proc-type 4,encrypted - etc.09:46
OpenTokixfriendlyguy: I am guessing the other user is with the aws-pem-file09:46
diyttoOpenTokix: it does09:46
OpenTokixls -l /Users/diytto/.ssh/id_rsa09:47
OpenTokixWhat does that output?09:47
diytto-rw-------+ 1 diytto  staff  1679 Jul 18  2014 /Users/diytto/.ssh/id_rsa09:48
OpenTokixlooks correct09:48
diyttothe aws one is for an amazon server09:49
diyttofyi09:49
friendlyguyguessed that ;)09:49
diyttoit's not used here09:49
OpenTokixyes, I guessed that to09:49
OpenTokixand if you do the exact same command, just switchout user@09:49
OpenTokixit works?09:49
diyttomy phone has it's own pubkey and is also unable to log in09:49
diyttoyeah09:49
OpenTokixie. ssh -i /Users/diytto/.ssh/id_rsa otheruser@sameserver ?09:49
diyttoto sb1@de....09:49
skylitecan I enable an apache module only for one vhost?09:50
OpenTokixskylite: no09:50
skylitenever? :(09:50
OpenTokixskylite: but you can do the handler only for one vhost09:50
OpenTokixskylite: so it will be effectivly "hidden" for others09:50
diyttoOpenTokix: that works fine09:50
skyliteso I enable a module and hide it in all the other vhosts but one?09:51
OpenTokixskylite: no, you enable module and add the handler for that module only to the vhost that should have it09:51
friendlyguyhm... you could verify if your keypair is "cool"09:51
OpenTokixdiytto: hmmm09:51
friendlyguyssh-keygen -y -e -f <private key>09:51
friendlyguyand compare this to your pubkey09:51
diyttosuccessful connection http://paste.ubuntu.com/11695290/09:52
OpenTokixdiytto: im guessing there is something wrong on the serverside in the authorized_keys file, or its rights09:52
OpenTokixlunch now, *gone*09:52
skyliteOpenTokix this is a quite simple module Is that gonna work the way you suggest? https://github.com/danghvu/mod_dumpost09:52
diyttofriendlyguy: they appear to be identical09:53
friendlyguyweird weird09:54
diyttookay, i have shell access through my znc09:56
diyttoso i can send commands09:56
diyttofriendlyguy: only the last user i added to the server i am able to log in to10:00
diyttoi am afraid i must go to sleep. it's 4am here. i will try to figure this out more in the morning10:03
diyttothank's for the help you've provided10:03
friendlyguyyoure welcome10:03
friendlyguygn810:03
friendlyguyist sdc denn wirklich "sdc"10:05
friendlyguyoh, sry... wrong window10:05
friendlyguyhmmm :) maybe one can help me to debug my server a little further... there is a "issue" which is driving me crazy. when i first start my server i can see the post until grub is supposed to start. -> thats when my monitor goes blank. IF i restart it (using ctrl-alt-del) i can watch the POST and grub appears10:07
friendlyguyAND, if i need to reboot again: i'll get a blank screen opposed to grub. hit ctrl-alt-del again, wait for the post stuff... and grub is there again10:08
friendlyguyprecisely every 2nd "attempt"10:08
OpenTokixskylite: mod_audit already does that for you10:33
skyliteOpenTokix thx I'll try that one ... already trying with mod_dumpio10:34
OpenTokixskylite: http://dev.prositen.com/wp/log-post-data-with-apache/ <--- there you have how mod_security does it.10:35
skylitethx a lot10:35
OpenTokixskylite: and then you add the Secrules in your vhosts10:35
OpenTokixskylite: my collegues site =)10:36
skyliteOpenTokix great writing thx it works :)10:50
OpenTokixskylite: I forwarded your thanks to my collegue10:52
rbasakdannf: thanks for the memory corruption fix for MySQL. Any opinions on me pushing this to Debian too? I'm working on Debian mysql-5.6 right now.11:14
* rbasak goes for a walk/lunch while stuff builds11:15
=== DenBeiren is now known as zz_DenBeiren
=== wickedpuppy2 is now known as wickedpuppy
=== strikov is now known as strikov-lunch
dannfrbasak: yeah, i'd definitely +1 applying it to debian14:12
rbasakdannf: OK, thanks!14:12
dannfrbasak: also, i'd like to get it sru'd back to trusty - should i just go ahead and upload backports?14:13
rbasakdannf: that's fine - go for it.14:14
=== athairus_oops is now known as athairus
=== strikov-lunch is now known as strikov
friendlyguyanybody got some experience with zfs dedup? i'd like to turn on dedup for a relative small pool ~ 2t where I'm going to store vm backups. i read that dedup takes 1-2 gb ram per tb in pool, so here max 4gb. I've got 16gb ram sitting in this machine, so looks good to me. BUT, I read on the german ubuntu wiki to "NEVER" turn on dedup.15:01
=== cps0_ is now known as cps0
ogra_kickinz1, my ownclöoud snappy install constantly pops up an upgrade warning, are you working on a 8.0.3 snap ? (or is anyone)15:09
=== ideopathic_ is now known as ideopathic
kickinz1ogra_, no15:28
=== BrianBlaze420 is now known as help
=== help is now known as LLcoolBERRY
=== LLcoolBERRY is now known as BrianBlaze420
ogra_kickinz1, well, it would be nice to have that upgraded somehow ...15:40
kickinz1ogra_, yes planned around next week.16:10
ogra_kickinz1, awesome, thanks :)16:10
ogra_if you need a tester, just ping me :)16:10
kickinz1ogra_, Ok, I'll do!16:11
squisherrbasak, another look at bcache-tools please... someone already spotted a bug :)16:27
squisherit's again rather trivial changes16:27
rbasaksquisher: that looks fine. Is that two separate fixes in one commit or are they related to the same issue?16:30
rbasaksquisher: and does piuparts pass now?16:30
squisherrbasak, hm, yeah, they should probably be separate16:31
squisherI'll check piuparts, but I tested it in pbuilder16:31
rbasaksquisher: "Fix dracut" isn't really helping me. Maybe describe what you're fixing and why?16:31
rbasak(well, clearly you're fixing "dracut", but I mean the actual problem you're fixing)16:32
squisherrbasak, hmm, I wonder how I can fix that now with the gbp workflow16:32
rbasaksquisher: don't bother rebasing, it's not worth it. So just add extra commits fixing up the changelog for this time I guess.16:33
squisherrbasak, yeah, I agree. I should be more careful with my descriptions (basically dracut wasn't working at all before, I was just being lazy)16:33
=== braderhart_ is now known as braderhart
Gregor3000why is the check disk failing and reports corrupted files? i tried 3 different USB image burners - 1. Unetbooting in windows, LinuxliveUSB in windows and startup disk creator in linux. every time checking of disk reported error. despite the fact that md5sum matches, i've tested also USB it has no errors in readin & writing.16:58
squisherrbasak, I'll have to fix that later. I don't really like the gbp changelog handling, but on the other hand I would like to automatically generate the changelog :-\16:59
Gregor3000i also can not proceed with installer - it stops at 33% when formating /. i have preexisting software RAID1 that holds /swap and /var/log /data16:59
squisherGregor3000, the md5sum of the downloaded image I assume?17:00
squisherI'd run memtest over night17:00
Gregor3000correct - miniiso or server - it's not memorry as i cretaed and booted the image on different PC's17:02
Gregor3000in the end it said it can't even detect the image (eventhough it was botoing from it and running other programs on it)17:06
Gregor3000hwo do i report bug with installer? also when reporting it do i add pictures? or what?17:13
Gregor3000sorry how17:13
diyttoHi, I was here last night with my issue if anyone saw it. Basically my server has locked me out from ssh. It is refusing my pubkey auth on my account, even though I have used previously. I can access a different account on the same server with the exact same authorized_keys, but not my personal account. Any ideas?18:15
diyttoMy account has sudo access, while the account i am able to access does not18:16
sarnolddiytto: check permissions on your ~/.ssh and ~/.ssh/* files18:20
sarnolddiytto: the sshd is very picky about e.g. too-wide group write support or files owned by the wrong user18:20
diyttopermissions are fine, we went over them last night18:20
diyttothat was the first thing we went over last night :(18:21
sarnoldhehe nice :)18:21
sarnoldis there anything in the logs?18:22
diyttowhere can i find the logs on the server18:23
lordievaderdiytto: /var/log/ (from there you want auth.log and the syslog)18:24
diyttoalright let me take a look18:24
diyttowell this is a problem18:25
diyttoi can't read the logs18:25
sarnoldcan you su, sudo, or login, to the account that can read the logs?18:26
diyttono18:27
diyttounless there is a way to login without sudo18:27
lordievaderdiytto: He means to your user account with sudo powers.18:27
diyttono, that is the account i am locked out of18:27
lordievaderdiytto: Your ssh is locked, not local login, right?18:28
squisherafaik ubuntu doesn't use wheel for su, right? So you should be able to su into your sudo-able account if you know your local password18:28
diyttojust ssh is locked18:29
squisherdiytto, that's probably what lordievader is talking about too :)18:29
squisherthen you shouldn't have a problem :)18:29
lordievaderYes, su'ing into the 'locked' account.18:29
diyttoah okay18:29
diyttoi wasn't aware i could do that18:30
diyttookay i am in18:30
lordievaderdiytto: Then read the logs.18:30
diyttoit looks like permissions for my home directory are wrong?18:34
squisherI guess if your home dir is 777 then other people could change the perms of your ~/.ssh dir18:34
diyttoi am the only one on the server18:36
lordievaderStill, sshd doesn't like that.18:36
squisherhm, I may be wrong on that, but anyway, what lordievader said18:37
lordievaderAs sarnold said, sshd is very picky.18:37
diyttoi never changed that though, and I've never had an issue logging in previously18:37
diyttohome dir perms drwxr-xr-x  8 sb1  sb1   4096 Jun 11 01:55 diytto18:38
squisherdiytto, that's not 777 - you should paste the error from the logs18:38
diyttodrwx------  2 diytto diytto    4096 Jun 11 04:04 .ssh18:38
sarnoldsb1 vs diytto??18:39
diyttooh wow i missed that18:39
diyttothat fixed it18:40
diyttowow18:40
diyttoi have no idea how that happened18:40
squisher`history | grep sb1` ;-)18:41
diyttothanks so much guys18:42
diyttoi never would have found that issue18:42
sarnoldall sorted?18:42
diyttoyep, thanks18:43
sarnoldsweet :)18:44
shirgallHrm, the openssl update seems to have no changlog other than the Debian one.18:49
sarnoldshirgall: what are you looking at? it should be quite extensive: https://launchpad.net/ubuntu/+source/openssl/+changelog18:50
shirgallThis -> /usr/share/doc/openssl/changelog.gz has a link to ../libssl1.0.0/changelog.gz which is missing18:51
shirgallBut, the main thing is that it looks like logjam vulnerability, fixed in 1.0.1n, is not yet integrated, that's what I was trying to determine.18:53
sarnoldOH!18:54
sarnoldI see,  you're actuyally talking about the changelog.gz file. feel free to ignore that. what you want is the changelog.Debian.gz file18:54
shirgallYeah, it just surprised me that there was a dead link in openssl18:54
shirgallAt any rate, i was looking for CVE-2015-4000 and didn't find it18:56
friendlyguyhmmm. quick question: i've installed htop, but i don't get any percentage numbers of core / ram usage18:56
=== NomadJim_ is now known as NomadJim
mdeslaurshirgall: the CVE-2015-4000 is actually about the TLS flaw, I didn't use it in the openssl updates. WIth the last openssl update, the export ciphers were disabled, and today's update rejects shorter than 768 dh params.18:58
mdeslaurshirgall: do if you install today's openssl update, you're all set with the logjam mitigations18:58
shirgallmdeslaur: yeah, i poked in gnutls, but while I was looking around, I noticed the dead line18:58
shirgalllink18:58
shirgallmdeslaur: ok, cool, thanks18:59
friendlyguyis there a way to install mate-core with gdm or lightdm on a ubuntu server? (without actually installing stuff like evolution-server and crap)19:50
sarnoldfriendlyguy: apt-get install the specific leaf packages you want, they ought to drag in whatever they need19:52
=== Lcawte is now known as Lcawte|Away
=== pgraner is now known as pgraner-afk
=== Lcawte|Away is now known as Lcawte
mitfreeI have been using apt to update my 14.04 VPS and now my /boot is full. I've been unable to update. What is the right way to keep my /boot nice and clean?20:57
hexchmitfree: clean up boot21:05
hexchremove unused kernel.21:05
RoyKnext time, use a larger /boot21:05
RoyKusing 200 megs or so for /boot is nonsense21:05
RoyKand as hexch said, clean up old stuff21:06
mitfreehttps://img.bi/#/mOFiH0x!YtDlPwylaNEQyiyvgAwkhpoAUTBOpAGqgQlgXood21:06
sarnoldRoyK: didn't you have a nice short command last time this came up, something that looked way simpler than my usual method?21:06
RoyKsometimes you can't remove old kernels easily because of a full filesystem - if so - "> whateverfileyouwanttotruncate" and start over21:06
mitfreeThe image is from cloud at cost, so I didn't choose the size. I'm also having trouble with /tmp21:07
RoyKsarnold: if you remove the file, apt will get angry - if you just truncate the file, it'll remove it easily21:07
=== markthomas is now known as markthomas|away
RoyKsarnold: truncate the file with something like "> /boot/thatfile" and do apt-get purge "thatpackage"21:08
mitfreeI posted the results of df -h21:09
RoyKmitfree: tune2fs -m 0 /dev/sda121:09
RoyKmitfree: but remove the old kernels21:09
sarnoldRoyK: I hadn't heard that about the truncation! that'll save a ton of effort :)21:09
RoyKsarnold: we all learn along :)21:10
mitfreewhat do you mean by truncate exactly? is that just changing the file name or actualy editing the file by deleting parts of it.21:11
RoyKmitfree: just removing its contents21:11
RoyKmitfree: setting filesize to zero21:11
mitfreeintersting idea, I honestly hadn't thought of that.21:12
RoyKmitfree: just don't truncate the live kernel21:12
_piggy_Just did a new install of server 14.04. apt-get update says that kernel for utopic (not trusty) is being held back.  Any ideas?21:12
_piggy_uname -a shows 10.0421:13
_piggy_bah  14.0421:13
_piggy_Just tested on another 14.04 and it does not show utopic21:14
RoyKnever had   that issue21:15
_piggy_Ya. Me neither.  Starnge21:16
_piggy_Strange that is.  One of those days...21:16
tarpman_piggy_: run apt-get update and check again. yesterday I had some kernels held back because the metapackages showed up in the archive before the actual kernels did, but all has been ok today21:17
_piggy_tarpman, will do   thanks.  BRB21:17
tarpman_piggy_: regarding utopic vs trusty, servers installed from 14.04 or 14.04.1 media will have the trusty (3.13) kernel, servers installed from 14.04.2 media will have the utopic (3.16) kernel21:18
_piggy_tarpman: That's the instll media I used.  Any idea for change?  Repositories show trusty too.21:20
_piggy_tarpman: I assume it will be ok to proceed then?21:20
tarpman_piggy_: I don't understand "Any idea for change?", sorry21:21
tarpman_piggy_: there's no need to downgrade unless something is broken, if that's what you mean21:21
_piggy_tarpman: Thanks.  You have been a good help. I will see if I can figure out why the kernel change happened.  Thanks!21:22
=== markthomas|away is now known as markthomas
shirgall_piggy_: you can learn more about the kernel changes here: https://wiki.ubuntu.com/Kernel/LTSEnablementStack21:57
=== zz_DenBeiren is now known as DenBeiren
_piggy_shirgall:  Thanks.  Saw that not long ago.  Thanks for posting.22:34
=== utlemming is now known as utlemming_away
=== CiPi is now known as cipi

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!