| sarnold | ubuntu_: that sounds a bit like LTSP | 00:00 |
|---|---|---|
| ubuntu_ | whats LTSP | 00:00 |
| sarnold | linux terminal server project http://www.ltsp.org/ | 00:01 |
| ubuntu_ | O is that going to support vnc or rdp or both | 00:01 |
| ubuntu_ | because thats kind of cool | 00:02 |
| sarnold | a quick skim of http://wiki.ltsp.org/wiki/Concepts gives me the impression that it's native X11 | 00:03 |
| cncr04s | Is there any comprenehsive guide on using kvm/qemu/libvirt on ubuntu. I specifically use virsh to start stop and edit all my virtual machines, I suppose that is all that is really needed but just wondering if there are any additional commands that do other usefull stuff, like adding a new disk while the vm is running, etc. | 00:08 |
| ubuntu_ | Also curious for GPT partitioning what is the prefered file system for a linux partition is it ext4 or is it like LVM or some virtual level file system that one can cuse | 00:16 |
| ubuntu_ | I guess what i am getting at is the best filesystem for large data centers with expandable racks or Loading more HDD drives / expansions | 00:17 |
| sarnold | I'm a fan of ext4 for OS storage and openzfs for your data | 00:18 |
| ubuntu_ | GPT covers pretty much infinity size partitions but for a file system on that partition kind of wondering what linux file system | 00:18 |
| sarnold | some people do like to pu their ext4 filesystems on top of lvm but i'm too lazy to figure that out | 00:18 |
| ubuntu_ | zfs and ufs is more for *bsd file systems | 00:18 |
| ubuntu_ | but ya i guess you could uses the zfs for linux | 00:19 |
| cncr04s | i just format them as ext4 | 00:19 |
| cncr04s | and mount them | 00:19 |
| ubuntu_ | I am wondering what linux file system is good for expansion of data like a server in the data center that one can add HDD | 00:19 |
| sarnold | zfs | 00:19 |
| ubuntu_ | zfs on top of ext4 or just zfs on the bare partition | 00:20 |
| sarnold | zfs on bare drives | 00:20 |
| sarnold | don't partition the drives, the zpool tool takes care of everything | 00:20 |
| ubuntu_ | gotcha for windows ntfs supports zfs type expansion? | 00:20 |
| ubuntu_ | or is windows using a different file system | 00:21 |
| sarnold | I haven't used ntfs in 16 years, I suspect it's changed a bit :) | 00:21 |
| cncr04s | you can extend a partition across drives in windows | 00:21 |
| cncr04s | otherwise, raid | 00:21 |
| ubuntu_ | for data centers i know ntfs is enough for any small business or most HDD drive but more interesting in the data center | 00:21 |
| cncr04s | in my datacenter, I put in a drive, format it as ext4, mount it in whatever folder I want | 00:22 |
| cncr04s | depends on what your doing | 00:22 |
| ubuntu_ | Yes but can you extend the file system accrosss drives or do you have to reformat the ntfs after you expand the drive | 00:22 |
| ubuntu_ | when your spreading it over more then one drive | 00:23 |
| cncr04s | in windows: just initilze the drive, and extend the partition onto it | 00:23 |
| ubuntu_ | It would have to have some LVM virtual software on top of the bare file system i would imagine | 00:23 |
| cncr04s | windows has its own stuff, not compatible with linux | 00:23 |
| cncr04s | otherthan just a ntfs partition | 00:24 |
| ubuntu_ | O ok ya never tried it only expanded and shrink HDD partitions on the same HDD drive | 00:24 |
| ubuntu_ | curious is there any drive that can go do both zfs and ntfs | 00:24 |
| cncr04s | zfs is a filesystem | 00:25 |
| sarnold | drives just hold bits, you can put whatever filesystem you want on them | 00:25 |
| ubuntu_ | I guess would be nice to know that a driver is out there for windows and mac to support zfs | 00:25 |
| sarnold | I understand the OS X openzfs port has been revived. I haven't heard of anyone working on a windows openzfs port. | 00:25 |
| cncr04s | I don't know and I doubt it. so count windows out. if the drive goes into a linux server is stays in a linux server | 00:25 |
| ubuntu_ | Because how else if you uses zfs and now not have linux anymore are you going to beable to get the data off the zfs you would have to have a means to install a zfs driver .sys .dll onto the windows machine | 00:26 |
| cncr04s | boot into a linux live cd | 00:26 |
| sarnold | you can also run one of the illumos-derived distributions, such as smartos or omnios | 00:27 |
| ubuntu_ | though linux has ntfs don't you think windows should have zfs driver made? | 00:27 |
| sarnold | dunno. I worry about linux and let microsoft worry about windows. | 00:28 |
| sarnold | if they think their users would like zfs they're free to try to port it | 00:28 |
| ubuntu_ | But you think since file on a file system is really what people life for when it comes to computers you think you want portablity between major filesystems | 00:29 |
| ubuntu_ | without storage or files/filesystem you just got computer memory which is nice but then you don't have persistant storage or any kind of information systems other then at an instance in memory | 00:30 |
| JanC | seems like there used to be a read-only ZFS for Windows, but it can't even read recent versions | 00:37 |
| sarnold | there was a fuse-based zfs a while ago but I think it's .. quite stale | 00:38 |
| sarnold | I certainly wouldn't trust any data I cared about to fuse | 00:39 |
| JanC | dokan-based | 00:39 |
| sarnold | so the idea of zfs-fuse strikes me as funny :) | 00:39 |
| JanC | the one I saw | 00:39 |
| JanC | fuse is useful to rescue data off a disk if there is no other driver though | 00:40 |
| sarnold | yeah | 00:40 |
| sarnold | or a convience vs sftp or scp all the time :) | 00:40 |
| sarnold | convenience | 00:40 |
| JanC | I rescued data from disks that came out of a ReadyNAS NV+ with it some time ago (apparently they use or used a patched ext3 in some of their NAS systems, which can be read with one of the fuse-based implementations of ext2/3/4) | 00:43 |
| sarnold | that's ... odd :) | 00:44 |
| sarnold | hooray for the patched versions being available though | 00:44 |
| sarnold | that'd be a frustrating way to lose data if it were stuck in their silo | 00:44 |
| CodeMouse92 | How do I find my LDAP URL and port (preferably via phpLDAPadmin?) | 00:48 |
| JanC | sarnold: you can mount those filesystems in Ubuntu with the implementation in 'fuseext2' (there is info about how to do it on the internet) | 00:49 |
| sarnold | JanC: neat | 00:50 |
| CodeMouse92 | Nevermind, I think I have it figured out. | 00:51 |
| CodeMouse92 | How do I configure phpldapadmin to ONLY be available over localhost> | 01:20 |
| CodeMouse92 | (Solved that too. Sorry!) | 01:24 |
| Alpha | Hi | 01:55 |
| MASM | There are some expert in firewall(ufw) ubuntu?? | 03:06 |
| MASM | how i create a note? to share here¿? | 03:06 |
| sarnold | MASM: the pastebinit package has a pastebinit tool that makes it easy to create and share links to pastebin contents | 03:07 |
| MASM | thanks, and how to put before name and then tex¿? it is automatic? | 03:08 |
| MASM | sarnold: <-----? | 03:08 |
| sarnold | MASM: most irc clients let you type a few characters of the nickname and then hit tab to complete the rest of it | 03:09 |
| sarnold | I just type m<tab> and get MASM: automatically :) | 03:09 |
| MASM | thanks, i'm new in this... | 03:09 |
| sarnold | welcome aboard :) | 03:10 |
| MASM | sarnold: if i want to write in pastebin, code like terminal, what option from "Syntax Highlighting" i need to choose ? | 03:11 |
| sarnold | MASM: probably you can keep it 'plain text' or something similar; the syntax highlighting is if you're pasting part of a program | 03:12 |
| sarnold | MASM: but shell interactions don't usually improve with syntax highlighting :) | 03:13 |
| MASM | sarnold: thanks a lot | 03:20 |
| MASM | There are a limit for connection to a socket in ubuntu server ???? | 03:21 |
| sarnold | there are many limits | 03:23 |
| sarnold | you have to have the right privileges to bind to a tcp or udp port <1024 ; there are a maximum number of file descriptors available to a process ; uhhh, I'm sure there's more, but that's all I could think of quickly :) | 03:24 |
| MASM | i have ubuntu server, i config ufw to allow some range of ports, but in syslog, appear the tag "[UFW BLOCK]" ipsource, ipserver, portsource, portdestiny, and i allow that port, i think, maybe it would be the limit of socket connection with tcp | 03:40 |
| sarnold | MASM: if it has a tag like that, then it was probably blocked by ufw | 03:44 |
| MASM | you know about ufw?, | 03:44 |
| sarnold | a little | 03:45 |
| sarnold | I'm sadly vastly uneducated about linux firewalling .. twenty years ago I was awesome at it but then everything changed :) | 03:45 |
| MASM | sarnold: Everything Changed When The Fire Nation Attacked | 03:46 |
| === _degorenko|afk is now known as degorenko | ||
| === iberezovskiy|off is now known as iberezovskiy | ||
| bindi | can anyone shed light on why my iptables rules werent loaded after a reboot? i had been running my ass wide open for a few days.. had to do iptables-restore and it loaded the rules from /etc/network/iptables.up.rules | 10:18 |
| === Shoe16|Phone is now known as Shoe16 | ||
| === tinwood is now known as tinwood-lunch | ||
| === tinwood-lunch is now known as tinwood | ||
| MASM | i need help with ubuntu server with ufw and iptables e.e | 16:01 |
| tsimonq2 | !help | MASM | 16:03 |
| ubottu | MASM: Please don't ask to ask a question, simply ask the question (all on ONE line and in the channel, so that others can read and follow it easily). If anyone knows the answer they will most likely reply. :-) See also !patience | 16:03 |
| MASM | ubottu: Thanks for the tips, i am new in this chat | 16:05 |
| ubottu | MASM: I am only a bot, please don't think I'm intelligent :) | 16:05 |
| lordievader | MASM: What is your actual problem? | 16:07 |
| MASM | beffore all: ubuntu-server, with services apache,ssh, and it receive information from gps trackers, that reports every time, and are constantly, | 16:09 |
| MASM | I have a problem with ufw, and connections tcp incoming, I allowed port 80, 22, 12300:12400/tcp and udp, the problem is when i see tail -f /var/log/syslogs | grep "UFW BLOCK", i saw a ips blocked that ips are destiny to port 80 and 12363 <- this is in range that i allow, and i see in iptables, that are a limit of 3/min, i changed this to 1/s , i think i solved this, but not, in this morning i saw some ips blocked in port 80 | 16:10 |
| MASM | http://paste.ubuntu.com/21287991/ | 16:11 |
| lordievader | MASM: What does nmap say? | 16:14 |
| lordievader | And jeez what a mess does ufw make of iptable rules. | 16:14 |
| MASM | nmap from local or from external machine? | 16:15 |
| lordievader | External | 16:15 |
| MASM | ok wait a minut | 16:15 |
| jdstrand | MASM: those drops might have been from something else. eg, when an existing or new connection is coming in at the time you do 'sudo ufw reload' | 16:21 |
| jdstrand | MASM: your policy looks fine. I suggest tailing the log while trying to make a new connection. it should be fine. I might also point out 'sudo ufw show raw' which gives a full dump of everything | 16:23 |
| jdstrand | also, not sure how this is a 'mess'. it is actually quite organized so it won't stomp on other applications that add rules | 16:24 |
| MASM | nmap from linux mint : http://paste.ubuntu.com/21289724/ | 16:27 |
| MASM | Jul 28 10:31:05 u2139 kernel: [73766.1808] [UFW BLOCK] IN=eth0 OUT= MAC=08:00 SRC=187.210.150.xx DST=74.208.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=45020 DF PROTO=TCP SPT=46420 DPT=80 WINDOW=1414 RES=0x00 ACK FIN URGP=0 | 16:31 |
| MASM | i still get some messages from syslog, with this rules | 16:32 |
| MASM | if i undertend this, all are right, and i only need to wait for the gps reconnect again?, | 16:35 |
| jdstrand | MASM: nmap is sending an invalid packet. See: 'ACK FIN' is not valid. 'SYN ACK' or 'FIN' are | 16:40 |
| jdstrand | MASM: and ufw blocks invalid packets by default: | 16:41 |
| jdstrand | # drop INVALID packets (logs these in loglevel medium and higher) | 16:41 |
| jdstrand | -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny | 16:41 |
| jdstrand | -A ufw-before-input -m conntrack --ctstate INVALID -j DROP | 16:41 |
| jdstrand | MASM: use your browser to reach the destination on port 80 and you shouldn't see a denial | 16:42 |
| MASM | yes the web site show perfectly | 16:43 |
| MASM | jdstrand: you say that that packets that ufw block are invalids? | 16:44 |
| jdstrand | MASM: tools like nmap are super flexible and send weird stuff to see if they can illicit information out of the firewall, sometimes for OS fingerprinting and the like. the denial is expected and fine. your rules are fine | 16:44 |
| jdstrand | MASM: that log entry you gave shows 'ACK FIN' for the tcp flags. that is an invalid combination, yes | 16:45 |
| jdstrand | s/illicit/elicit/ (not sure why I typoed that :) | 16:48 |
| MASM | jdstrand: and this logs are normal, this have "ACK" only | 16:50 |
| MASM | http://paste.ubuntu.com/21292299/ | 16:50 |
| * jdstrand notes ACK and FIN can be legitimate under certain circumstances as part of connection tracking, but my point was an nmap-generated packet the sends an ACK/FIN is snot | 16:52 | |
| jdstrand | is not | 16:52 |
| jdstrand | MASM: how are you generating those? with nmap? | 16:53 |
| jdstrand | this seems like possibly a problem with connection tracking if not | 16:53 |
| MASM | that are reals gps tracking | 16:55 |
| jdstrand | MASM: what is the output of: sudo /usr/share/ufw/check-requirements (feel free to paste it to paste.ubuntu.com) | 16:56 |
| MASM | jdstrand: this is the output - http://paste.ubuntu.com/21293215/ | 16:58 |
| jdstrand | MASM: no, you need to run: sudo /usr/share/ufw/check-requirements | 16:59 |
| MASM | ha sorry jejjeej | 16:59 |
| jdstrand | MASM: on the system that has the firewall | 16:59 |
| MASM | jdstrand: http://paste.ubuntu.com/21293437/ | 17:00 |
| jdstrand | ok, that's good. your kernel has everything it needs | 17:01 |
| jdstrand | MASM: can you paste the output of 'sudo ufw show raw'? | 17:02 |
| MASM | ok | 17:03 |
| MASM | jdstrand: http://paste.ubuntu.com/21293970/ | 17:04 |
| jdstrand | MASM: ok, I don't see any rules that would interfere with ufw. your firewall looks fine. this seems like a problem with connection tracking. I suggest googling: netfilter connection tracking dropped packets (the first entry is good) | 17:07 |
| jdstrand | MASM: that said, depending on how you are reloading the firewall, you can get invalid packets since they aren't part of an established connection. those should start to die down very soon after the firewall/machine restart though | 17:08 |
| rbasak | smoser: do you have a reference to ivoks' ntpdate bug please? I can't find any that he reported. | 17:09 |
| jdstrand | MASM: if they don't, look at the connection tracking stuff | 17:10 |
| jdstrand | MASM: one final question: did you modify /etc/ufw/*rules by hand? I'm seeing very few packets counted in ufw-user-input chain | 17:11 |
| smoser | rbasak, will look. | 17:11 |
| jdstrand | MASM: ie, an excerpt from your last paste: http://paste.ubuntu.com/21294738/ | 17:11 |
| MASM | i only add directly iptables rules and ufw, and not in files, | 17:11 |
| jdstrand | MASM: what do you mean by 'i only add directly iptables rules'? | 17:12 |
| jdstrand | MASM: you are adding rules outside of ufw? | 17:12 |
| MASM | but i reset all, and put rules via ufw like allow 200, 80 and range ports 12300:12400 | 17:12 |
| jdstrand | MASM: what version of Ubuntu is this on? | 17:13 |
| MASM | i did but i reset iptables and ufw, and begin again only with allow that ports that i mentioned | 17:13 |
| smoser | rbasak, its a private bug. | 17:13 |
| MASM | 14.04 stable | 17:13 |
| MASM | and ufw 0.34~rc-0ubuntu2 | 17:14 |
| jdstrand | MASM: can you paste the output of: sudo sha256sum /etc/ufw/* | 17:14 |
| MASM | jdstrand: i reset ufw a lot, jejejej http://paste.ubuntu.com/21295261/ | 17:15 |
| jdstrand | MASM: can you paste /etc/ufw/ufw.conf ? | 17:17 |
| MASM | jdstrand: http://paste.ubuntu.com/21295548/ | 17:17 |
| devster31 | is there any way to give ssh process the maximum priority over the available bandwidth? | 17:20 |
| jdstrand | ok, all your files look fine. please run this series of commands: | 17:20 |
| jdstrand | sudo ufw disable | 17:20 |
| jdstrand | sudo /lib/ufw/ufw-init flush-all | 17:20 |
| jdstrand | sudo ufw enable | 17:20 |
| jdstrand | MASM: if there are errors with the above ^, please paste them | 17:21 |
| MASM | i didn't get any errors, it was ok | 17:21 |
| jdstrand | ok, then everything should be fine | 17:21 |
| jdstrand | tail the log and you'll hopefully not see any more logged denials after now (check the timestamps! :) | 17:22 |
| jdstrand | MASM: ^ if you do, check the connection tracking stuff I mentioned | 17:23 |
| MASM | I'm cheking my syslog, and i get some block ports, http://paste.ubuntu.com/21297086/ | 17:30 |
| jdstrand | MASM: many of those aren't in the range you specified (it would be easiest if you pasted only the new ones). look into the search on the connection tracking and see if that is affecting you. another thing to investigate is whatever is running on 12363 if it is perhaps sending weird packets. tcpdump/wireshark/etc would help there | 17:42 |
| MASM | jdstrand: I have a nodejs runned with "forever start myscript.js" this open a specific ports that gps tracker, connect to port via tcp or udp and they (gps) give to server the information about imei,status,position,etc, | 17:52 |
| jdstrand | if it isn't connection tracking related, then I think you need to look more deeply at the packets. alternatively, you could add rules to /etc/ufw/before[6].rules that don't care about connection tracking | 17:57 |
| === iberezovskiy is now known as iberezovskiy|off | ||
| === degorenko is now known as _degorenko|afk | ||
| === ashleyd is now known as ashd | ||
| === madsa_ is now known as madsa | ||
| === JanC is now known as Guest85214 | ||
| === JanC_ is now known as JanC | ||
| Shambles | I'm trying to remove ACL's that I accidently placed on a folder from a Windows machine. I'm trying to use setfacl by typing 'setfacl -x /folder/path' but it responds with "setfacl: Option -x: Invalid argument near character 1" | 21:13 |
| Shambles | I don't see what other arguments I would need besides the folder path | 21:14 |
| === octavius is now known as octavius_ | ||
| === octavius_ is now known as octavius | ||
| teward | Shambles: it's expecting an ACL spec for -x | 21:59 |
| teward | from the man page: | 21:59 |
| teward | Removing a named group entry from a file's ACL | 21:59 |
| teward | setfacl -x g:staff file | 21:59 |
| teward | you're not giving it an ACL to 'clean' and it expects one | 21:59 |
| teward | s/an ACL/an ACL pattern or spec/ | 21:59 |
| Shambles | Ah ok thanks teward. Was just expecting it to purge all ACLs and leave basic permissions | 22:01 |
| teward | Shambles: yeah, apparently not (if you look at the man page you'll see a little more about the -x argument flag, and see what it expects. | 22:02 |
| teward | Shambles: -x without anything doesn't appear to be the equivalent of 'flushing out the acl' :P | 22:03 |
| sarnold | would -b do what you want? | 22:03 |
| teward | i was about to say that | 22:03 |
| teward | stop reading my brain | 22:03 |
| sarnold | or maybe -k | 22:03 |
| teward | Shambles: you can try -b | 22:03 |
| sarnold | tough to tell :) | 22:03 |
| teward | sarnold: erm | 22:04 |
| teward | Shambles: do you want to leave the basic UNIX style permissions in place (owner, group, other)? | 22:04 |
| teward | 'cause -k removes the default, and not the extended. -b removes the extended, and not the defaults | 22:04 |
| teward | combine, and ACL is nuked, maybe | 22:04 |
| teward | sarnold: I think -b is what they need... | 22:04 |
| teward | or want... | 22:04 |
| teward | -b, --remove-all | 22:05 |
| teward | Remove all extended ACL entries. The base ACL entries of the owner, | 22:05 |
| teward | group and others are retained. | 22:05 |
| teward | i should *really* stop pasting here | 22:05 |
| teward | *goes to disable paste* | 22:05 |
| CodeMouse92 | I have a bit of a puzzle. On a leased server, my "root" domain name points to /public_html, as it should. However, I want to put all of the *pages* that appear on that site in a separate folder. I've already got a rather complex .htaccess... | 22:29 |
| CodeMouse92 | ...actually, I just answered my own question. | 22:30 |
| CodeMouse92 | Is it possible to configure an .htaccess to treat contents of a subfolder as if they were in the root folder? | 23:22 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!