| === zz_denbeiren is now known as denbeiren | ||
| cluelessperson | hey guys, I want to make sure my server is really secure | 02:11 |
|---|---|---|
| cluelessperson | how can I go about doing this? | 02:11 |
| teward | cluelessperson: disconnect it from the internet and put it in a Faraday cage | 02:11 |
| teward | inside a lead-lined bunker | 02:11 |
| teward | cluelessperson: 'really secure' is a vague, ambiguous phrase | 02:12 |
| teward | because 'really secure' is based off use case and acceptable risk levels | 02:12 |
| cluelessperson | teward, I run owncloud+deluge+apache my personal server with TLS 1.2. I want to make sure it's impossible for an unknown to penetrate it. | 02:13 |
| teward | basics: SSH key auth only, 2FactorAuth where possible, only open ports you need opened, and only open them for 'sources' that you trust | 02:13 |
| teward | cluelessperson: you can't guarantee that | 02:13 |
| teward | there is no such thing as a "100% secure" system | 02:13 |
| teward | unless it's non-networked and put in a bunker with no wifi capabilities | 02:13 |
| cluelessperson | teward, only certain ports are open, connections are by default blocked. I'm using... I forget what it's called to shut down ports on repeated connection attempts. | 02:14 |
| teward | fail2ban? | 02:14 |
| cluelessperson | teward, yes. and I need to switch SSH back to key | 02:14 |
| teward | fail2ban helps a little. SSH Key Auth Only helps too. | 02:14 |
| teward | putting 2FA on is also helpful | 02:14 |
| cluelessperson | sentences for passwords, I might just go with a client certificate requirement to connect to certain applications. | 02:14 |
| teward | (all my offsite servers have 2FA with Duo Security) | 02:15 |
| teward | cluelessperson: that can help too | 02:15 |
| cluelessperson | teward, Also, my GPG+owncloud data is stored on another backend server | 02:15 |
| teward | cluelessperson: security is also a 24/7 thing | 02:15 |
| teward | putting a IDS/IPS (like Snort in front of things) can help a little more | 02:15 |
| teward | but... | 02:15 |
| cluelessperson | teward, the web facing server has credentials for an owncloud sftp account only, and mysql for various applications. | 02:16 |
| cluelessperson | teward, Do you know how I might hide internally credentials? | 02:16 |
| cluelessperson | teward, I'm also wondering if there's a way to setup traps, when access to shut off the secure server's access. | 02:17 |
| cluelessperson | Anyone know anything about creating client certificates? | 02:21 |
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === WaddupYo is now known as Waddup | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === markthomas is now known as markthomas|away | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| cluelessperson | Hey guys I'm trying to run this command | 07:03 |
| cluelessperson | openssl ca -in cpwr.csr -cert cpwr-ca.crt -keyfile cpwr-ca.key -out cpwr.crt | 07:03 |
| cluelessperson | but it errors Using configuration from /usr/lib/ssl/openssl.cnf | 07:03 |
| cluelessperson | I am unable to access the ./demoCA/newcerts directory | 07:03 |
| cluelessperson | wtf | 07:03 |
| ikonia | you're going to need to provide more info than that if you want help | 07:11 |
| cluelessperson | ikonia, like? | 07:14 |
| lordievader | Waddup: Does fsck detect errors? | 07:52 |
| lordievader | Good morning, by the by. | 07:53 |
| === Guest54024 is now known as IdleOne | ||
| === jelly-home is now known as jelly | ||
| === medz is now known as samsn | ||
| nils13_ | Hi, | 11:16 |
| RoyK | ho | 11:16 |
| lordievader | ha | 11:17 |
| phre4k | I have 2 NICs in my samba server and when I ping the domain from a client, it always uses the wrong one. How do I fix this? | 11:34 |
| lordievader | phre4k: How are the two nics set up? | 11:37 |
| phre4k | lordievader, forgot to say it's an LXC container | 11:38 |
| phre4k | one is bridged with the host system and the other is bridged with the internal LXC network | 11:40 |
| phre4k | they show up as eth0 and eth1 inside the container | 11:41 |
| lordievader | What is the default gatway for the container? | 11:43 |
| phre4k | the bridged connection | 11:45 |
| phre4k | or rather, the local DNS | 11:47 |
| phre4k | *router, sry | 11:47 |
| lordievader | Is the th nic you want it to use when you ping it? | 11:51 |
| phre4k | I set the local IP as DNS in a client and then I ping the AD Domain (ad.company.org), which gives me back the virtual IP of the server instead of the local IP | 11:53 |
| lordievader | The virtual ip? The lxc internal? | 11:54 |
| phre4k | yes, that one | 11:57 |
| phre4k | I am 192.168.20.149, my DNS is 192.168.20.11, I ping ad.company.org and should get 192.168.20.11, but get 10.3.1.2 | 11:58 |
| lordievader | Do you get the correct address when you resolv ad.c.o on the lxc box? | 12:12 |
| === utlemming is now known as utlemming_away | ||
| === utlemming_away is now known as utlemming | ||
| phre4k | w8 | 12:14 |
| phre4k | I get "unknown host", wtf | 12:15 |
| lordievader | Do you get the correct ip when you resolve ad.c.o on 20.149 (don't forget to expend the c.o part ;) ) | 12:16 |
| phre4k | yeah, of course, I understood what you mean ;) | 12:16 |
| phre4k | 20.149 is the client I have problems on | 12:17 |
| phre4k | my own laptop is a different IP, but I try it now | 12:17 |
| phre4k | unknown host | 12:17 |
| === utlemming is now known as utlemming_away | ||
| lordievader | How do you ping it when you cannot resolve it? | 12:20 |
| phre4k | I entered ad.c.o in the hosts file and can now ping from the samba server, I'll try the clients | 12:20 |
| lordievader | That is a bad way of resolving ips. | 12:22 |
| === utlemming_away is now known as utlemming | ||
| phre4k | of course, but if the samba way doesn't work... ;) | 12:26 |
| phre4k | the client doesn't get it though, but it was worth the try | 12:26 |
| lordievader | Of course not, /etc/hosts is host only, That is why is a bad method. | 12:27 |
| yossarianuk | Hi - is it possible to use unattended updates - e.g ->> https://help.ubuntu.com/lts/serverguide/automatic-updates.html, but only updating specified packages ? | 14:43 |
| yossarianuk | I know you can prevent certain packages being installed... Just wondering if you can make it so only specified packages are automatically updated. | 14:43 |
| yossarianuk | i.e I can see how to blacklist packages from updating from https://help.ubuntu.com/lts/serverguide/automatic-updates.html but I want to blacklist all but one package.? | 14:48 |
| lordievader | Make a script that just installs those packages? If there are updates it will install those if not nothing happends. | 15:32 |
| yossarianuk | lordievader: sure that was the alternative way I was thinking, just wondering if unattended upgrades could also do it... | 15:34 |
| yossarianuk | cheer | 15:34 |
| yossarianuk | *cheers* | 15:34 |
| === markthomas|away is now known as markthomas | ||
| === markthomas is now known as markthomas|away | ||
| === markthomas|away is now known as markthomas | ||
| PatBateman | hi | 16:54 |
| PatBateman | i have a 14.04.02 server with raid 1 ssds, and after an update and reboot, the machine stopped at grub cli | 16:55 |
| PatBateman | what should i do? | 16:55 |
| PatBateman | i found some info starting the system manually, but what about my raid array ? | 16:55 |
| RoyK | PatBateman: the array is hopefully ok | 17:03 |
| PatBateman | yes I can list it | 17:03 |
| RoyK | PatBateman: boot on a usb live thing and check /proc/mdstat | 17:03 |
| PatBateman | the folder structure | 17:03 |
| PatBateman | RoyK: I can do it only tomorrow, can you tell me what to do in steps in short? | 17:04 |
| RoyK | then - if things work - try to mount the root fs on /mnt, mount proc on /mnt/proc and sys on /mnt/sys and boot on /mnt/boot - chroot /mnt and reinstall grub (update-grub) | 17:05 |
| PatBateman | RoyK: thanks | 17:06 |
| RoyK | perhaps grub-install /dev/sda ; grub-install /dev/sdb | 17:06 |
| PatBateman | what do you think about boot-repair, could it repair out of the box? | 17:06 |
| RoyK | but update-grub should do | 17:06 |
| RoyK | boot-repair should work - it just does the same without you knowing | 17:07 |
| PatBateman | i see | 17:07 |
| RoyK | I'm just used to the old way :) | 17:08 |
| RoyK | linux mdraid is very robust, so having a whole RAID die on you isn't something that happens often | 17:08 |
| RoyK | BUT! Keep a backup anyway - bad things DO happen! | 17:08 |
| RoyK | RAID != backup | 17:08 |
| PatBateman | yeah currently i am copying raw data to a hdd (which have my old ubuntu on hdd) | 17:09 |
| RoyK | I use a cloud service | 17:09 |
| PatBateman | even from here i see the raid array and all folders which gives hope | 17:10 |
| RoyK | crashplan works ok, although it's very slow on big data (VERY slow, because of the dedup things in there designed by a one-armed monkey) | 17:10 |
| RoyK | I use a Norwegian reseller of crashplan - they've turned all those dedup things off, so it works well (albeit more expensive). You can turn those dedup things off yourself, but my experience with crashplan.com is still that it's very slow | 17:11 |
| PatBateman | hm | 17:12 |
| RoyK | doesn't help much with 'unlimited' backup if it takes a year to restore from a crash | 17:12 |
| PatBateman | haha yes | 17:12 |
| PatBateman | so, have to go, thanks for the help! | 17:12 |
| RoyK | np | 17:12 |
| sarnold | don't they offer to ship you your data on a hard drive when you need it back? | 17:13 |
| AndChat59136 | I have an issue with two ip's on one machine, with one nic. The second ip is seemingly coming out of nowhere. I know this isn't right, but I don't know where to look apparently. I have set a static ip via the interfaces file. I have removed the second ip using the ip del command, but it comes back eventually. I am running server version 14 and a dd-wrt firmware router. Any ideas? Wrong irc channel to ask? | 17:13 |
| RoyK | AndChat59136: IPv4? | 17:15 |
| AndChat59136 | Yes | 17:15 |
| RoyK | what's this other IP that comes out of nowhere? | 17:16 |
| AndChat59136 | 192.168.1.100 is the static, .134 is the one that keeps appearing | 17:18 |
| sarnold | AndChat59136: ps auxw | grep dhc -- I wonder if you've got a dhcp client of some sort goofing around | 17:18 |
| sarnold | there's lots of ways that it could be added, of course, bootp, dhcp, a script, some other program.. | 17:19 |
| RoyK | AndChat59136: pastebin /etc/network/interfaces | 17:22 |
| RoyK | AndChat59136: or as sarnold said | 17:23 |
| AndChat59136 | grep: I: No such file or directory | 17:23 |
| RoyK | AndChat59136: 'ps auxw | grep dhc' | 17:23 |
| AndChat59136 | Haha, duh | 17:25 |
| AndChat59136 | paste.ubuntu.com/11994498/ | 17:25 |
| RoyK | and ps output? | 17:26 |
| AndChat59136 | paste.ubuntu.com/11994514 | 17:26 |
| RoyK | dhclient eth0 | 17:27 |
| RoyK | kill that - have you restarted lately? | 17:27 |
| RoyK | also - which ubuntu version is this? | 17:27 |
| AndChat59136 | 14.04, I should be able to remove dhclient correct? | 17:29 |
| RoyK | not sure what depends on it - but again - with that interfaces file it shouldn't be started | 17:30 |
| RoyK | 19:27 < RoyK > kill that - have you restarted lately? | 17:30 |
| AndChat59136 | I will kill it, and yes, had a restart just today | 17:33 |
| RoyK | and dhclient started again after restart? | 17:33 |
| AndChat59136 | Yes | 17:34 |
| AndChat59136 | I dont have dhclient in my kill list | 17:34 |
| AndChat59136 | So maybe not | 17:35 |
| AndChat59136 | I know that I don't start it | 17:35 |
| RoyK | hm... http://ubuntuforums.org/showthread.php?t=1391829&page=2 | 17:35 |
| RoyK | looks like dhclient may start if the /var/lib/dhcp3/dhclient.leases file exists | 17:36 |
| RoyK | seems like a dumb bug | 17:36 |
| AndChat59136 | I googled a bunch and never found anything like that. Must be the 'override' keyword. I will rename the file and see if that helps. I will report back. | 17:43 |
| RoyK | AndChat59136: the secret about googling is always "use as few and as exact words as possible" - it was on my first search ;) | 17:47 |
| AndChat59136 | I kept using some variation of two ip's on one nic, that just kept bringing up how to set it up. | 17:48 |
| AndChat59136 | Sometimes that's the hardest part of using google | 17:50 |
| AndChat59136 | No luck so far. Thanks for your help anyway. | 17:58 |
| RoyK | AndChat59136: chmod -x /sbin/dhclient # should do it, albeit a bit rednecky | 18:02 |
| sarnold | AndChat59136: you aren't using networkmanager on this system by chance, ar eyou? | 18:07 |
| AndChat59136 | Not to networkmanager | 18:11 |
| RoyK | AndChat59136: is networkmanager installed? | 18:11 |
| AndChat59136 | Let me check | 18:12 |
| RoyK | dpkg -l | grep -i networkma | 18:13 |
| RoyK | or perhaps dpkg -l | grep network-man | 18:14 |
| AndChat59136 | Apparently it is paste.ubuntu.com/11994845/ | 18:20 |
| RoyK | remove it | 18:21 |
| AndChat59136 | 10-4 | 18:22 |
| RoyK | 14-4 :D | 18:22 |
| sarnold | hehe | 18:22 |
| AndChat59136 | I see what you did there | 18:23 |
| AndChat59136 | Shows what I know. I thought I removed that a while ago. When reading about static ips they say to remove it. | 18:25 |
| RoyK | AndChat59136: did it help? | 18:26 |
| AndChat59136 | Does not appear to have. I renamed the dchp leases file and my .134 ip has changed to .140 | 18:38 |
| AndChat59136 | That was before removing network manager. After removing network manager I can't tell any difference. | 18:38 |
| AndChat59136 | Still have the .140 ip | 18:39 |
| sarnold | did you kill the processes, too? | 18:41 |
| AndChat59136 | I removed network manager and restarted | 18:43 |
| AndChat59136 | networking service restart never seems to work, so I reboot the machine | 18:43 |
| sarnold | ah yes, ifup and ifdown are the intended interfaces there | 18:45 |
| AndChat59136 | Ok, bear with me. If i wanted two ips it would look like eth0 and eth0:1. As far as what to bring up and down. I only have eth0, with the two ips. If I am ssh in, make changes and ifdown eth0 i will loses my connection and have to reboot anyway, correct? | 18:51 |
| teward | run `ifdown eth0; ifup eth0` | 18:51 |
| teward | it first down's eth0, then brings it back up | 18:51 |
| teward | the semicolon will make it run those in sequence | 18:51 |
| teward | (it's how I take down and instantly bring back up an interface on my servers when I mess with its settings xD) | 18:52 |
| AndChat59136 | Ok, thanks for that bit of info. I really do appreciate everyones input | 18:57 |
| a1fa | is it just me, or did 14.04.02 installer fail to provision partitions | 18:59 |
| a1fa | 300GB RAID1; use entire disk + lvm turned into a cluster mess | 18:59 |
| a1fa | so root got 23GB | 18:59 |
| a1fa | and /dev got.. wait for it | 18:59 |
| a1fa | udev 126G 4.0K 126G 1% /dev | 19:00 |
| a1fa | ^ i lolled ; twice | 19:00 |
| a1fa | did i miss a README that said don't use lvm with hardware raid? | 19:00 |
| sarnold | a1fa: isn't /dev a devtmpfs, which defaults to half your ram or something similar? | 19:00 |
| a1fa | i guess.. but still does not explain where my 300GB drive went to | 19:01 |
| sarnold | indeed, no :) | 19:03 |
| a1fa | 23G 875M 21G 4% / | 19:03 |
| a1fa | i am going to try resizing it | 19:04 |
| sarnold | any chance there's a /home or /opt or something similar that's just not currently mounted/ | 19:04 |
| a1fa | no just checked with cfdisk | 19:05 |
| a1fa | sda5 NC Logical LVM2_member 299709.77 * | 19:05 |
| a1fa | 299.9GB LVM2 | 19:05 |
| a1fa | there is this thing | 19:06 |
| a1fa | none 126G 0 126G 0% /run/shm | 19:06 |
| a1fa | i wonder if swap took all of it ;) | 19:07 |
| a1fa | Size: 274840158208 bytes, 274.8 GB | 19:07 |
| a1fa | punk | 19:07 |
| a1fa | there it is | 19:07 |
| ReScO | ugh | 19:10 |
| ReScO | Sky2 driver is making my network a living hell | 19:10 |
| ReScO | DNS requests failing etc... | 19:10 |
| sarnold | a1fa: 274 gigs of swap? makes sense, you want to suspend your 256 gigabyte RAM machine, right? right? :) | 19:11 |
| a1fa | heh | 19:20 |
| a1fa | i twont let me remove it | 19:20 |
| a1fa | it thinks its busy | 19:20 |
| a1fa | swapoff -a; lvremove .. | 19:21 |
| === denbeiren is now known as zz_denbeiren | ||
| RoyK | a1fa: 128 gigs of memory? | 19:29 |
| a1fa | 275G 895M 263G 1% / | 19:30 |
| a1fa | back in business, sarnold | 19:30 |
| a1fa | RoyK: 256 | 19:30 |
| a1fa | all is well now | 19:31 |
| a1fa | for some reason it would not disable swap with swapoff -a | 19:31 |
| === zz_denbeiren is now known as denbeiren | ||
| a1fa | so reboot fixed it, and i was able to extend my partition to 100% | 19:31 |
| a1fa | thanks | 19:31 |
| === zz_denbeiren is now known as denbeiren | ||
| cluelessperson | https://letsencrypt.org/ | 19:49 |
| cluelessperson | thoughts? | 19:49 |
| ReScO | here's my dmesg output: http://pastie.org/private/l2tia3nuotd8zvxier1zw | 20:08 |
| === denbeiren is now known as zz_denbeiren | ||
| ReScO | sky2 is crashing for my ethernet adapter: http://pastie.org/private/l2tia3nuotd8zvxier1zw | 20:17 |
| patdk-wk | !poll | 20:24 |
| === zz_denbeiren is now known as denbeiren | ||
| sarnold | a1fa: great! :) if you've got the time/inclination to try to repeat it, I think it'd be worth a bug report | 20:36 |
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === crazybluek is now known as Blueking | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| === zz_denbeiren is now known as denbeiren | ||
| === denbeiren is now known as zz_denbeiren | ||
| AndChat59136 | RoyK: thanks for all your help earlier. The chmod command seems to have worked. | 23:57 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!