=== InfoTest1 is now known as InfoTest === InfoTest1 is now known as InfoTest === Lcawte is now known as Lcawte|Away [02:58] hello friends [02:59] I'm repurposing an old laptop to use as a server. When I close the lid, it does nothing, which sounds great (no suspend) but the screen stays lit. How can I control the timeout so the screen goes entirely black? [03:15] not_roasted: sounds like the backlight is staying on. DPMS is usually the way to control that, but it may require working with the platform ACPI driver too [03:15] TJ- ! thanks [03:17] I know there used to be a CLI command to directly control DPMS but can't find it now [03:17] some problems but solved... 1) i am ejecuted crontab with sudo... :) === markthomas|away is now known as markthomas === markthomas is now known as markthomas|away [09:28] Good morning. === Lcawte|Away is now known as Lcawte === chmurifree is now known as chmuri [12:31] what is a good partiton schema for ubuntu14.04 server edition on a 1TB HDD? [12:32] gulzar: tiny boot and the rest an lvm pv. Create a small-ish volume (50GB) for the root filesystem and separate volumes for each application you put on it and its data [12:32] ^ that [12:32] most importantly, don't allocate all diskspace right away. It's easy to grow an LV, and rather difficult to shrink one. [12:33] Seveas: it will have only one app for testing , whcih willl be reinstalled every week [12:33] gulzar: all the more reason to go for this. Deleting the app is as simple as dropping and recreating the LV :) [12:33] you can even minimize downtime by doing the reinstall in a different lv and swapping it in place :) [12:34] win 4 [12:34] Seveas: the only fear I have is, the users here are pure MS people and they all use root account , and many times someone do execute 'rm /' and chmod which destroy the system [12:34] don't give them root access them [12:34] then* [12:34] just enough sudo access to do their job. [12:34] create non-privileged user accounts, or auth against AD [12:35] Seveas: can't help , the idiots made the app to work on root account. I will change this but will need few months [12:35] Hi! I use Ubuntu Server 14.04. with Kernel 3.13.0 and ubuntu-zfs on a nfs server. [12:36] Seveas: so regular snapshots/backups of system other than the current system storage is necessary [12:36] gulzar: That is simply bad design... [12:36] Seveas: interesting in your wording around 1 lv per app [12:36] do you actually mean "per app" or per app file system ? [12:36] lordievader: yes, and since those MS people think that admin on windows and root on linux is same, my power is low [12:37] gulzar: Ouch [12:37] lordievader: :( [12:37] lordievader: so backups on other server of / is a must [12:37] maybe you should do moral choise and make them know that they can't decide about what they don't know about [12:37] ikonia: I mean /srv/www on a different lv than /var/lib/mysql [12:37] dunno if that is good idea, if they are too emotional about it [12:38] and if you add redis, stick its datadir on an lv [12:38] Seveas: ok, what I'd expect then [12:38] gulzar: You could also use snapshots of the root lv [12:38] Seveas: thought you where suggesting some new "docker style" approach [12:38] gulzar: lvm also lets you make snapshots, yet another reason to go for this scheme [12:38] omen: they are like main developers and all think in same way. I handle linux and tools part [12:38] ikonia: no, I don't do such madness :) [12:38] Seveas: ok, any doc for this snapshot thing? [12:38] Seveas: didn't think so, hence the interest [12:39] gulzar: man lvcreate :) [12:39] gulzar: https://wiki.gentoo.org/wiki/LVM [12:39] Seveas: :P [12:39] lordievader: ok [12:39] so finally what size for these lvm ? [12:39] gulzar: if you really want to mess with them, add an aufs overlay on top of /, then anything can be rolled back by rebooting :) [12:39] hjjg: after 370 days of solid and stress free uptime, we installed updates and rebooted the machine. Now we are experiencing serious problems. [12:39] and /boot [12:39] Seveas: that aufs went above the head [12:40] gulzar: /boot 250mb, / 50GB, /data/yourapp whatever you need [12:40] gulzar: it was more of a joke than an actual suggestion, so don't worry [12:40] gulzar: if the app is light, maybe you should try virtualization [12:40] Seveas: that /data needs to be /home [12:40] gulzar: /home/yourapp then, not all of /home [12:40] every 2 to 4 days the server needs to be rebooted. the ZFS datasets are inaccessible (ls on /pool/dataset hangs) and the nfsd-kernel processes are consuming 100% cpu time (sys) [12:40] omen: no, its bad , super memory hog app, I think even 128GB ram wil be less [12:41] is it possible to downgrade the kernel and zfs/spl to a specific version? [12:41] Seveas: how its possible to have tow /homes ? [12:41] hjjg: if you have access to the repos that hold the older packages sure, other things may depend on the later version [12:41] as I recall the zfs kernel repo is 3rd party maintained [12:42] is there someone else who has problems with ZoL and NFS? [12:42] gulzar: same way as you can have / and /home on a different volume, any subdir can be on a different volume [12:42] Seveas: one for /home/app and other for /home/user ? [12:42] Seveas: oh [12:42] or one for /home and one for /home/app [12:42] Seveas: ok, got it [12:42] hjjg: select the older kernel from your grub menu, see if the problem remains [12:43] ikonia: I am well aware of the fact that this is a third-party repository. I also bug-reported this issue on github. [12:43] other than that you're going to have to interact with the kernel maintainer team for the ZFS packages [12:43] ikonia: the problem is that spl-dkms and zfs-dkms are rebuilding all of the installed kernel modules. [12:43] hjjg: the older kernel should still maintain it's tree [12:47] Seveas: I just got good news, that /home/app can be anywhere not just inside /home , it just needs max free space and that space is on external drive. No need to use internal HDD === balloons is now known as Guest4533 [12:47] Seveas: that external is mounted in /media [12:47] Seveas: so the only problem is protection of permision and 'rm /' === Guest4533 is now known as ballons_ [12:48] ikonia: dkms does odd things. 3.13.0-36, 3.13.0-57, 3.13.0-65 and 3.13.0-66 are installed but the zfs module has only been built for -65 and -66 [12:48] yes, the corresponding linux-headers package is installed. [12:48] Seveas: there? === ballons_ is now known as balloons_ [12:54] !ping [12:54] pong! [12:54] Seveas: Thank You === Lcawte is now known as Lcawte|Away === balloons_ is now known as balloons === a0rora_ is now known as a0rora === cz2 is now known as pulseaudio === pulseaudio is now known as cz2 [16:03] jgrimm: ping [16:03] jose, pong [16:03] jgrimm: hey! just wondering why the python2 to python3 session was declined === markthomas|away is now known as markthomas [16:04] jose, decision was to wrap that into the python3 session already scheduled. [16:04] jgrimm: gotcha. thanks! :) [16:05] jose, http://summit.ubuntu.com/uos-1511/meeting/22568/python3-only-on-the-images/ [16:05] jose, no problem! [16:06] rbasak: ping, if you're around, just need an opinion on something [16:06] no rush if you're busy === CiPi is now known as cipi === cipi is now known as CiPi [17:21] Hi I want to change all the file permissions in /var/www to 644. Does this work? find /var/www/ -type f -exec chmod 644 {} \; [17:23] fuzzywuzzy: chmod -R /var/www og+r,u+rw [17:23] yes, that changes permissions on dirs to, but only to things you need anyway :) [17:24] fuzzywuzzy: should work fine [17:25] sarnold: it'll be slow as hell though, and it's missing quotes [17:25] I'm trying to chmod the FILES to 644 [17:25] Seveas: yeah, xargs or the + thingy would go faster. what quotes is it missing? [17:25] Accidently set to 755 [17:28] Am I doing this wrong? [17:28] So says - http://wiki.apache.org/httpd/FileSystemPermissions [17:29] no, you're doing it right [17:30] trying to match permissions on default Wordpress install on Ubuntu server [17:34] gracias amigos! [17:34] =) [17:37] Can anyone recommend an up to date book on Ubuntu server security? [17:44] fuzzywuzzy: this guide seemed sane https://www.gov.uk/government/publications/end-user-devices-security-guidance-ubuntu-1404-lts [17:59] sarnold: interesting the UK government is publishing guides like that (even if some of what they write is nitpickable :) ) [17:59] If I make a pptp vpn server, can multiple clients connect to it at the same time? I tried with Windows (the built in thing it has) and it only allowed one client at a time. [18:00] JanC: yeah, I was impressed. It's not perfect but so many of those guides are ridiculous. [18:01] there is indeed a lot of good stuff in it, it seems [18:02] JanC: The US DoD does the same. We call them STIGs. [18:06] hotmedal: yes, but pptp is an insecure protocol, don't use it [18:07] hotmedal: PLEASE don't use PPTP. When we say insecure, we mean "@#$%ing broken." [18:09] ^ that [18:09] hotmedal: Better go with ipsec. Works really well :) [18:10] Or openvpn if you're going through NAT. [18:10] Ipsec can go through NAT (ESP at least) [18:10] lordievader: but even then it's a pain. [18:10] openvpn is a lot LESS of a pain. :P [18:11] That is NAT's fault :P [18:11] True, but until we can get rid of IPv4, NAT's kind of a thing. [18:11] lordievader: IPSec can go through nat, but OpenVPN behaves better on it, I think [18:11] granted, my firewall appliance handles my network's VPN, but meh [18:11] :P [18:15] strongswan handles IPsec just fine on Ubuntu and has Windows support [18:16] It's only painful when one doesn't know how it works [18:16] Indeed and the documentation for Strongswan is nice. [18:16] <3 strongswan docs :) [18:28] i basically need to create a vpn on a windows machine and with its built-in pptp I succeeded but for only one client at a time [18:29] can I do something about that? [18:29] Windows supports ipsec out of the box too. [18:29] (I know openVPN is good but my clients would rather use the built in vpn connection) [18:29] lordievader: how [18:29] lordievader: Win8+ yes [18:30] (win7 it likes to complain, from what I've done in testing) [18:30] yes I have 8.1 [18:30] hotmedal: https://wiki.strongswan.org/projects/strongswan/wiki/Windows7 [18:30] teward: I use it on my Win7. Bit tricky to get the cert just right but after that, click and go. [18:31] lordievader: link please :) [18:31] teward: See above. [18:31] or a guide. 'cause it doesn't work on my Win7 [18:31] thanks [18:31] (works GREAT in Win10 though xD) [18:31] teward: Windows 7 is very picky about it's certs it needs a couple of flags set else it will give Nat related errors or some wierd stuff like that. [18:32] mmm [18:32] I don't want to generate certificates and get the clints to use them [18:32] just username and password [18:33] I have no experience with psk. [18:34] lordievader: psk is difficult in windows i think in win7 - psk not supported perhaps. [18:34] but that's offtopic :) [18:36] From the page I linked to "or Username/Password using EAP-MSCHAP v2 (case C)." seems psk is supported. [18:36] * teward shrugs [18:36] But I have no idea if that is actually using the ipsec psk. === markthomas is now known as markthomas|away === ddstreet_away is now known as ddstreet [20:28] hello, I have an issue setting up a service, it does work when I do sudo service xxx start|restart|stop but it wont start up with the system. [20:28] may anybody help me set it up? [20:28] it is pm2 I hope some of you is working with it. [20:29] upstart conf? sysv-init script? systemd service? === markthomas|away is now known as markthomas [21:28] zul_, coreycb, jamespage: which repo should I use to setup liberty ? trusty/proposed/liberty or trusty/updates/liberty ? [21:31] EmilienM, you'll want to run with updates unless you need to test something that's in proposed [21:32] coreycb: what is supposed to be stable? [21:32] EmilienM, -updates is stable [21:32] EmilienM, so this is stable: add-apt-repository cloud-archive:liberty [21:32] cool [23:16] anyone know why ip route add 10.248.5.0/24 dev bond0.250 src 10.248.5.154 table vlan_250 would give "RTNETLINK answers: Operation not permitted" what do i need compiled in the kernel for that? [23:16] what is funny is that the command ip route add default via 10.248.5.1 dev bond0.250 table vlan_250 wroks fine [23:20] ponyofdeath: is 10.248.5.154 assigned to bond0.250 ? [23:42] TJ-: yup [23:42] this was working until i compiled kernel 4.3 [23:42] so i think i might be missing a kernel option [23:42] ponyofdeath: Ahhhh! [23:43] anything in dmesg/kern.log gives a better clue? [23:43] nothing [23:43] that i fixed [23:43] sorry [23:43] that i can tell [23:44] i have everything under policy routing comiled in [23:46] might be worth enabling some dynamic_debug tracing [23:48] gonna roll back kernel to see if that was it as i also upgrade with the latest packages for 14.04 [23:49] is ipv6 needed for iproute [23:50] no, I used iproute2 utilities well before ipv6 was around..