[05:36] good morning === jelly-home is now known as jelly [10:15] hi - I have a question about the default KSM setting (i.e ksm/kvm) [10:15] i.e -> /etc/default/qemu-kvm - has '# Set to 1 to enable KSM, 0 to disable KSM, and AUTO to use default settings.' [10:16] What are the default (AUTO) settings ? === treaki_ is now known as treaki [10:44] Hi - we are setting up an office squid proxy / gateway using Ipfire in a KVM vm (using ubuntu 16.04 as the KVM host) - as there is going to be a lot of network traffic through the vm is it a good idea to enable 'vhost_net'? [10:44] I notice in Ubuntu the default setting in /etc/default/qemu-kvm is 'VHOST_NET_ENABLED=0' [10:45] so logically should I set that to 'VHOST_NET_ENABLED=1'? [10:51] Good afternoon [10:59] ust wondering if it is more sensible to enable or disable in my situation (i.e a proxy/gateway vm that all office traffic will be flowing through) [11:06] hi yossarianuk - just realized I answered you in #ubuntu already [11:06] TL;DR yes I'd recommend vhost_net but it is very likely already loaded [11:06] the config you refer only checks if qemu-kvm loads it which is a failsafe mechanism, but some other triggers might load it anyway [11:07] so they do for me at least [11:07] again thanks [11:08] and KSM auto is enable it on bare metal but not in guests [11:53] Hello, I have a problem. Please see at http://paste.ubuntu.com/24536348/ [12:00] nacc: not sure IIRC - have you reworked the samba sections back then? any idea ^^ [12:00] rbasak: I'm trying to hunt down an issue with uvtool that tries to break my virt tests all too often - after a while I'm now down to systems not agreeing on the images available [12:01] rbasak: the systems share /var/lib/uvtool/libvirt (via container shared paths) [12:01] so what is in one is also in the other [12:01] that worked fine so far, but since I recently stared to have one more system that does stop sharing these paths by bindmounting something else over it things break too much [12:02] rbasak: I only now start to dive into uvtool for this trying to understand what other paths they might read in those cases [12:02] rbasak: but if something comes to your mind please let me know [12:02] rbasak: cpaelzer: powersj: nacc: any of you going to be at the server team meeting tomorrow? [12:03] teward: I would be there I think [12:03] there is a chair pointer pointing to me [12:04] cpaelzer: well i won't be able to be at the meeting tomorrow - i have a more important meeting at my job - make a note on the action item for me re: nginx release notes to push it to the next meeting for a status checkin [12:04] i've got the bulletpoints on a notepad document, i've not gotten much further [12:04] please :) [12:04] ok, thanks teward for keeping us updated [12:04] yeppers. [12:05] Unrelated, anyone know how I can have a one-to-many SSH connection with one ingress and multiple backends based on the requested hostname? [12:05] i'm not 100% clear on how to multiplex SSH that way, but... [12:05] thought I'd ask :) [12:07] teward: I think cluserssh does what you want? [12:08] ooh prettu [12:08] pretty* [12:08] I'm not clear on "multiple backends based on the requested hostname" but it gives you one-to-many ssh [12:08] cpaelzer: i think it'd be best if I diagram it [12:08] That tool is my poor mans mass deployment helper [12:08] sometimes [12:08] I have a server with multiple LXD containers on it, each with SSH. To get into it i have to first SSH to the host machine, then SSH into the specific container [12:08] i'd like to cut out one of the 'hops' in what commands i type, if possible. [12:09] s/into it/into one container/ [12:09] yeah ok that works as well [12:09] you need a proxy ssh setup on your client [12:09] cpaelzer: any idea on how i'd go about that? [12:09] i've googled but am head-scratching [12:09] to pass any command to foo-container actually to the host and fromt here to the container [12:09] I can paste a snippet, let me search my notes [12:09] thank you kindly :) [12:10] i'm trying to take the fifteen or so VPSes and consolidate on one massive system heh [12:10] allllll the services >:D [12:11] teward: that matches what I did and has some nice text around https://www.cyberciti.biz/faq/linux-unix-ssh-proxycommand-passing-through-one-host-gateway-server/ [12:11] combine that with cluserssh and you can do stuff on all containers at once [12:12] nice. [12:13] cpaelzer: that'll help because now i can create SSH configs for each 'container' heh. I'll just have to set up some command evils for the SSH without-password part to the containers... but that shouldn't be too hard. [12:13] since the containers aren't directly SSH exposed to the 'net... :P [12:13] exactly [12:13] (CBA to buy a /24, wayyyyyyy too expensive) [12:13] s/buy/rent/ [12:13] ah heck, my license for avast expired. [12:13] damn, that means my mailserver has no AV protection [12:14] ah well after my next big paycheck comes in that won't be an issue heh [12:17] (it's $150/yr. Not bad but outside my current budget) [12:17] Hello, I have a problem, the text is quite long. Please see at http://paste.ubuntu.com/24536348/ [12:26] cpaelzer: that's all that uvtool cares about. But it uses libvirt's API to manipulate everything inside images/, and libvirt has its own in-memory cache of what that directory contains IIRC. So that could fall out of sync. [12:27] rbasak: interesting hint, thanks [12:28] cpaelzer: libvirt does support multiple image pool types. There might be one that is sufficiently networked? [12:28] Then you'd only need to bind mount metadata/ [12:28] Once uvtool-libvirt is installed I doesn't touch the pool configuration again IIRC. [12:28] (except perhaps on removal/purge) [12:28] that might be a workaround [12:28] If it is indeed the problem. [12:28] but surely implementing that is as work intensive as understanding what goes on with the current one [12:29] and understanding the current issue might reveal something that puzzles me some time now [12:29] here it seems reproducible [12:29] That makes sense [12:29] so I want to know [12:29] I can in that env e.g. show that query reports no images, and the subsequent sync fails because the file is already there [12:30] rbasak: so effectively an affected guest can not make it working again (other than rm'ing files) [12:33] IIRC, query reflects metadata/ exactly [12:33] Is it doing that in your failure case? [12:34] rbasak: output is different on two systems sharing the dir [12:34] The actual image can be there when the metadata is not. This is for images being removed while still being used. [12:34] I verified they are still in sync (md5sums, touched files appear, ...) [12:37] cpaelzer: that's puzzling. I can jump into a hangout to do some debugging with you if you can reproduce that difference right now? [12:38] cpaelzer: though can you just double check that /var/lib/uvtool/libvirt/metadata/ really is the same directory on both affected machines? [12:38] rbasak: it is active right now if you have a few minutes I'd be happy [12:38] surely faster with more eyes/brains [13:07] Hello, I have a problem, the text is quite long. Please see at http://paste.ubuntu.com/24536348/ [14:06] Hello, I have a problem, the text is quite long. Please see at http://paste.ubuntu.com/24536348/ [14:12] rbasak: fyi new test runs the shared screen is now gone due to cleanup === med_` is now known as med_ [14:30] OK nevermind my bad === tyhicks` is now known as tyhicks [14:38] cpaelzer: np [15:00] ezethnesthrown: sorry about your problem with the smbldap guide [15:00] ezethnesthrown: I hope to get to that area of ubuntu-server pretty soon [15:02] in fact, I want to update this to current ubuntu: https://github.com/panlinux/openldap-dit/tree/master/doc (just imported it from LP) [15:30] ezethnesthrown: aiui, you have to create the file [15:30] ezethnesthrown: an example is shipped with smbldap-tools [15:33] ezethnesthrown: as documented in the README.Debian file [15:33] ezethnesthrown: specifically SMBLDAP-TOOLS bit [15:34] ahasenack: so i think a short term fix is to copy out those bits into server guide (that you need to take the example config and do stuff to it to match your local install) [15:35] yeah [15:35] I think I'll start on that after this samba fix [15:35] ahasenack: thanks [15:39] ahasenack: nacc: but next serverguide release is way way out [15:39] we can update the current one, right? [15:39] i.e., fix it [15:39] ahasenack: nacc: I had another case which I wanted to fix in doc, but that will need time [15:39] cpaelzer: agreed, i'm saying as a fix to the current release [15:39] iirc, pmatulis has taken such thing with bugs [15:39] ahasenack: no it only updates the user readable html/pdf on explcit releases [15:40] yes you can "bug" them and ask [15:40] that's how i got the original serverguide fixed [15:40] they will share doc release plans [15:40] hrm, maybe i'm misremembering [15:40] nacc: yeah I pushed a few dpdk things that way as well [15:40] nacc: but [15:40] nacc: recently I wanted to add some libvirt things and got told that it will really take a while [15:40] seems silly not to be able to correct docs. It's not a rewrite [15:40] that policy seems less in the best interest of our users [15:40] oh adding things is diifferent, imo [15:41] right [15:41] fixing bugs should be allowed, if it's not, i think we should bring it up to the doc team [15:41] I agree, but my case wasn't important enough to set me into the mood to punch this through [15:41] it has to have the SRU spirit [15:41] cpaelzer: ack, i think i saw your case [15:41] yeah, "SRU spirit" covers most of it [15:41] not random doc changes [15:42] cpaelzer: right, in this case, a missing step (at least_) that causes the next step to fail [15:42] ahasenack: lets ask on ubuntu-doc ML how/if they would agree to handle those [15:42] and share/discuss the feedback in the IRC meeting [15:42] and drive via actions from there [15:42] +1 [15:42] ahasenack: would you do the initial mail to them or should I? [15:44] cpaelzer: I think you have more context now [15:44] hehe [15:44] ok [15:44] leave a task open and you'll get it :-) [15:45] np :) [15:51] ahasenack: nacc: I set you to cc [15:51] thx [15:51] * ahasenack -> lunch [15:51] I was in a hurry so enjoy my surely intersting fast writeup :-) [15:51] cpaelzer: ack === a1berto_ is now known as a1berto [16:08] nacc: I see you pushing all the merges to done, if you could take an eye on the three in the review queue for the importer that would be very kind [16:08] cpaelzer: yep, im swtiching tack this week back to the importer and will review [16:08] nacc: in order of complexity dovecot, ntp, strongswan [16:08] cpaelzer: tbh, for these three, on some level, im trusting you [16:08] I trust myself as well :-) [16:08] cpaelzer: in that, you've done the merge, i just need to get them into the importer, right? [16:08] cpaelzer: or do you need a full merge review as well? [16:09] nacc: the poitn I learned is that there are always issues - and we don#t need to stop the line but discussing them is step one [16:09] cpaelzer: ack, ok -- one takes longer than the other :) [16:09] nacc: I don't need a formal review, yet on strongswan a pair of eyes would be nice [16:09] cpaelzer: and, on some level, if you could upload these (and maybe you can?) you aren't technically gated by me normally [16:09] cpaelzer: ack, strongswan was complicated before [16:10] rbasak: what state is your linter in? [16:10] nacc: there is a lot of "known to drop delta" left that I made more clear in the MP and such [16:10] nacc: I'd want to upload them tomorrow, so getting them into the importer and tagged would be nice [16:11] nacc: tests are all good, so the issues left shoudl be easily possible as ubuntu2 or next-cycle as applicable [16:11] nacc: not really usable yet, sorry. I just have pieces. [16:11] nacc: it doesn't do merges at all yet. [16:11] rbasak: np, just checking :) [16:12] cpaelzer: ok, i'll bump it up my list [16:12] nacc: but the script in wip/review can be used for merges. [16:14] fyi I don't have merge bugs on these as they were trivial, but integrated that into my process so I'll in future open one in any case I think [16:15] cpaelzer: i'm also tempted to just give you upload rights to the git repos [16:15] or wait until we figure out where upload tags will live properly [17:31] Hello. I'm having problems with Ubuntu 14.04LTS, Postfix & DKIM failing to verify signatures. My install runs fine for a few hours but ultimately starts failing signatures due to "no padding data". Has anyone seen this? [17:44] What does this mean [[ bash: /usr/sbin/smbldap-populate: cannot execute binary file: Exec format error ]] [17:44] ezethnesthrown: what does `file /usr/sbin/smbldap-populate` say? [17:45] Tried 'cat' it now the CLI broke [17:45] smbldap-populate is a command [17:45] ezethnesthrown: yes, i know [17:46] ezethnesthrown: can you please tell me what the command i asked for says? [17:46] ezethnesthrown: if it's a binary, you don't wnat to `cat` it [17:46] It says exactly that. Straight up error [17:47] ezethnesthrown: what? [17:47] ezethnesthrown: it says "Straight up error"? [17:47] No [17:47] There's no prompt [17:47] ezethnesthrown: `file` doesn't output such a thing [17:48] I'm sorry. I'm a bit lost here [17:48] ezethnesthrown: so you ran `cat` on a binary? you probably need to start a new terminal session [17:48] Rebooted [17:48] ezethnesthrown: ok, that was probably unnecessary [17:48] ezethnesthrown: run `file /usr/sbin/smbldap-populate` [17:49] [[ /usr/sbin/smbldap-populate: gzip compressed data, max compression, from Unix ]] [17:51] well you can't run a data file [17:51] ezethnesthrown: what version of ubuntu? [17:51] nacc: 16.04.2 LTS [17:51] rbasak: hey, where is the merge report output again? [17:51] I had http://people.canonical.com/~rbasak/merges.html from before you had commit access [17:52] ezethnesthrown: http://paste.ubuntu.com/24538078/ is what it should output [17:52] ezethnesthrown: that's from a fresh 16.04 container [17:52] ezethnesthrown: not sure what you're using [17:52] ezethnesthrown: `apt policy smbldap-tools` in a pastebin please [17:57] ahasenack: http://reqorts.qa.ubuntu.com/reports/ubuntu-server/merges.html but it looks like the cronjob is still failing so it's very out of date. I'll need to sort that out :-/ [17:58] nacc: http://paste.ubuntu.com/24538099/ [17:59] ezethnesthrown: hrm, that's worrisome, same version here [17:59] ezethnesthrown: this is a VPS or anything? did you do any changes after installing? [18:00] nacc: I'm installing in Virtual Box [18:00] nacc: I followed the Samba and LDAP guide and the guide at the bug post [18:01] ezethnesthrown: can you run `dpkg -V smbldap-tools` ? and/or `dpkg -C smbldap-tools` [18:02] dpkg -V smbldap-tools > [[ ??5?????? /usr/sbin/smbldap-populate ]] [18:02] dpkg -C smbldap-tools > [[ ]] [18:02] ezethnesthrown: yeah so you've changed it from how it isinstalled [18:02] ezethnesthrown: 5 is 'file contents have changed' [18:03] ezethnesthrown: so ... what did you do? :) [18:03] I did 'sudo dpkg-reconfigure slapd' I few times [18:03] A few times* [18:04] nacc: Thank you for your time. I'll restart then [18:05] ezethnesthrown: np, i don't thnk the dpkg-reconfigure should have changed the contents of an executable [18:05] ezethnesthrown: something else must have happened, but i don't know what [18:08] rbasak: do you have time this week for a importer/git sync? [18:09] nacc: Is it inside smbldap files? I don't think I tampered anything inside. But I'll report here if it happens again. [18:10] ezethnesthrown: yes, that file (/usr/sbin/smbldap-populate) is fromm smbldap-tools afaict, and should be a perl script [18:13] nacc: I can't recall [18:13] ezethnesthrown: you'd have to have been root to do so, and just imo, you should always konw what you did as root :) [18:14] nacc: Thank you. I'll keep that in mind [18:21] nacc: upload rights to the repos would help with trivial thigs at least [18:23] nacc: and I think I can decide when to push and when not to [18:23] cpaelzer: yeah [18:23] cpaelzer: our eventual goal is if you can upload a srcpkg you can upload the corresponding tag [18:23] cpaelzer: but that needs lp stuff, etc. [18:23] nacc: and in the worst case it is easy for you to catch me :-) [18:24] nacc: I know the target [18:24] cpaelzer: yeah :) [18:24] nacc: yet given that we mainly sync server and I have server + a few as upload rights ... [18:24] cpaelzer: yep [18:24] nacc: the remaining subset isn't that big [18:24] cpaelzer: yeah === lordievader is now known as Guest16696 === Guest16696 is now known as lordievader [19:09] nacc: Works magically now [19:10] ezethnesthrown: did you reinstall? [19:27] nacc: yeah, let's arrange something. [19:30] rbasak: thanks [19:54] Hello all! I am trying to preseed NIS and when I reboot, rpcbind won't start. Is there something like networkmanager-wait-online that centos has? I am guessing the network isn't ready when rpcbind tries to start. [19:55] which release? 16.04 uses a different service framework than 14.04.. [19:55] * sarnold -> lunch [19:56] sarnold, 16.04 [20:05] greenmanspirit: well on server, you wont' have networkmanager [20:06] greenmanspirit: if someting depending on network it shoulbe After=network.target in the service file, i think? [20:10] greenmanspirit: but i would thing rpcbind would be generally broken if it won't start becasue it needs networking and network isn't up in your case [20:14] cpaelzer: i did dovecot just now, but let's do it at the same time, as there is a bit of an inherent race [20:14] im trying to delete a samba user after i deleted their unix account but get errors from smbpasswd - x and pdbedit -x , do i have to recreate the unix accoint before deleting the samba one ? [20:14] cpaelzer: tmrw AM for the others? [20:17] nacc, rpcbind doesn't have After=Network in the rpcbind.server file [20:18] answered my own question - apparently yes [20:18] have a fun mad day all : ) [20:19] sorry, After=network.target [21:02] ok so i migrated my server from that half-ass VPS into a better host annd i'm still having issues with apache [21:04] nacc sarnold thank you by the way, for other day [21:10] hey gartral ;) [21:11] sarnold: I figured it out [21:11] it was a port collision between my vpn server and apache [21:13] gartral: woot [21:17] hi [21:34] sarnold: arrrrrrrrrrgh [21:35] this is a game of catch 22 wrapped in a game of catch 22 [21:35] uhoh :) I was hoping that was the 'argh' of "i can't believe that mistake was so simple" :) [21:40] sarnold: I need a valid ssl cert, so I go through and try to use a let's encrypt cert for 'simplicity'... except certbot only uses port 443 and that port is already taken up by openvpn [21:41] gartral: can't LE do dns too? [21:41] gartral: and probably openvpn can be made to run on another port, if only temporarily [21:42] gartral: I know some people run their vpn on ALL PORTS, so a simple nmap from their hotel room or airplane or whatever can often find a way through that's... ahem... cheaper than usual :) [21:45] sarnold: yea but I have ~30 or so devices on this vpn [21:46] most of which are family, and I don't need my mother screaming at me that her internet broke (again, because I had to re-issue cert packets to everyone from the the server move) [21:46] gartral: ouch that's a lot of devices to reconfigure [21:47] yes it is... everyone tells me I'm a good IT guy... I don't think so but meh [21:52] gartral: stand up a second server? [21:52] sarnold: moneies [21:55] gartral: it's only got to live for an hour or something to get certbot to work; if you haven't used it already, aws's free tier may be enough? === manjo` is now known as manjo [22:50] Hey i am pxe booting an image and i see this passed in as the command line argument for /proc/cmdline root=live:/genesis.iso [22:50] what does that do specificly. [22:50] i'm puzzled where it's getting the iso from since it's booting over ipxe using the initrd and vmzlinuz [22:51] I read the kernel docs and it doesn't mention anything about live: and everything I have found is using live:http://.... [22:51] which make sense [22:52] eatingthenight: root= is not parsed by the kernel [22:52] eatingthenight: it's parsed by the init process, i think [22:52] eatingthenight: i don't where genesis.iso lives, because that's not ubuntu afaict? [23:30] nacc: correct sorry i just figured people here may know a bit more about the command line boot args [23:30] it's a custom image [23:31] but I belive /genesis.iso in this case would mean it was baked into the image. [23:32] eatingthenight: i *think* that live: is just a prefix to something (init? not sure) that says it's a livecd rootfs. i'm guessing that if you're pxe booting, maybe it knows to alos look on the network for the iso [23:32] it being the boot processe [23:36] aa ok, so might be looking it up on a sftp server on the network [23:36] eatingthenight: yeah, i'm not 100% on that, but i'd believe it [23:40] hmm, darn. That does sound correct to me but the sftp server that it is using only contains the ipxe kpxe file. [23:40] just checked to make sure. very strange. [23:41] eatingthenight: is it in the initramfs by any chance? [23:45] hmm i dont see that file but i see this pre-udev/30dmsquash-liveiso-genrules.sh which looks interesting [23:52] o ok https://www.redhat.com/archives/rhl-list/2009-December/msg01582.html looks to confirm that that is what does it [23:52] looks like some legacy stuff from the liveiso creator [23:53] nacc: thanks for the help! I'm somewhat satisfied knowing that it's custom to liveiso [23:53] eatingthenight: yw