[00:21] genii do you use ossec? [00:21] many tutorials suggest to run it as root [00:22] there is some workaround but I wonder if it worth to change it so it runs under local user === JanC_ is now known as JanC [00:38] https://groups.google.com/forum/#!topic/ossec-list/UI6Yng70wh0 [00:56] sarnold: is there any issue with installing ossec from a root dir on an ossec server [00:56] I dont see any [00:57] since it runs as root it does not matter where its located [01:32] also while I am in ssh session I changed firewall to block custom ssh port yet my session did not ds [01:32] so it applies to new sessions only? [01:58] seems so [01:58] \nice [01:58] :D [04:52] I've got a VPS running 16.04, and today I installed updates (probably first time in 2 months) and rebooted. Now I'm repeatedly getting system hangs with "task blocked for more than 120 seconds" — is this an issue with recent updates? (Or a coincidence?) [04:54] not an issue with recent updates [05:02] Alright, thanks. More log digging says it started 2 hours ago and happens at 15 & 35 past the hour. Weird. [05:02] that is strange [05:02] is that the message in syslog? [05:03] Which task is blocked semi-alternates between jdb2/vda1-8 and mysqld [05:03] But I grepped that "120 seconds" in syslog [05:04] did you have an increase in traffic refently? [05:04] *recently [05:06] I added another site to my WordPress multisite install about 30 hours ago. Only one person knows about it though, so I doubt that's it. Most popular site on the server has higher traffic than this regularly (podcast episode every other week--this is an "off" week) [05:07] I mean unless the sheer existence of that new site is the issue? But it was fine for 28 hours... [05:08] is this hosted on aws? [05:08] Cron hourly is 17 minutes after the hour not 15 [05:08] No, it's Dreamhost's openstack setup [05:10] have you tried tuning kernel params at all yet? [05:13] Nope [05:13] I forgot that phrase even existed [05:14] overall it's going to be real hard to debug that without more info as it's just general system tuning that is specific to your workload and environment. Stack overflow should be able to point you in the right direction for how to start narrowing it down. [05:15] Ok here's something [05:15] I see app armor denies for mysqld right before the first time it happens [05:17] Oh never mind. That's the last thing in the logs before it, but a half hour passes [05:19] Ugh. Ok so I see stuff in openstack help about this being caused by storage problems after rebooting [05:19] Rebooting a VM shouldn't cause storage issues [05:23] Possible solution found. If it works, I'll post the link here to satisfy any curiosity you may have eatingthenight [06:23] Good morning [09:36] Hello! [09:36] I'm trying to setup ldap authentication on Ubuntu server 16.04, using `nss-pam-ldapd` [09:36] I think the ldap auth part works, but when I try to login, auth.log says "fatal: initgroups: username: Invalid argument" [09:36] If I set map gidNumber to 100, auth.log says "fatal: seteuid userID: Invalid argument" [09:37] I recently setup another server using `libpam-ldap`, I didn't encounter any similar errors there.. [09:37] Any ideas? === eldritch2 is now known as eldritch [12:14] hi i haven an problem with apache ... i want to create an subdomain but my subdomain redirects serverside to my domain. subd.server.my.domain.com => server.my.domain.com any idea? [12:26] How does your configuration look like? [12:30] https://pastebin.com/Z9rwXJzc [12:31] Do both addresses resolve to the same ip address? [12:32] Else you need to add the (sub)domain as server name. [12:32] same ip [12:38] but when i type essen.vm-doku.my.domain.de ist shows the index of /var/www and not of /var/www_2 === icey_ is now known as icey === soren_ is now known as soren === fidothe_ is now known as fidothe [12:48] And that is with the servername setting? [12:50] Pascal__: What does `sudo apache2ctl -S` return? [12:51] https://pastebin.com/wmwK2Pa9 [12:53] Both vhosts are names localhost. Hence apache cannot distinguish them. [12:53] Have you set the servername correctly? [12:58] this is my /etc/hosts : 127.0.0.1 localhost 127.0.0.1 vm-doku.eva.evapolda.de vm-doku 127.0.0.1 essen.vm-doku.eva.evapolda.de essen.vm-doku [12:59] Pascal__: That is not what I asked for. What ServerName is set in the apache config of the websites? [13:00] for essen.vm-doku.my.domain.de is essen.vm-doku and for vm-doku.my.domain.de is vm-doku [13:01] Could you show me your config again? [13:02] https://pastebin.com/7Vw9kKVC [13:03] The ServerName needs to be a fqdn. [13:05] ive set that with fqdn ... now it says at essen.vm-doku.my.domain.de ... DNS-Name not found [13:06] Is it a valid fqdn? [13:07] i think so, our (windows)-Dns has both forward-addresses [13:07] Can you resolve it? [13:11] now, after reboot of the DNS-Server, yes but now i also become the index of /var/www at essen.vm-doku [13:12] Could you paste the output of `sudo apache2ctl -S` again? [13:13] https://pastebin.com/FRKsFFJS [13:16] Both do use a different config, 000-default.conf for vm-doku and essen.conf for essen.vm-doku ;) [13:17] yup i've pasted it together to reduce spam [13:19] If you look in the access logs, do they reflect the right thing? I.e. when going to essen it is logged to access_essen.log? [13:20] but i've found the problem it was the after i changed that to it works fine [13:20] but also thanks for your help :) [13:21] Nice, good to hear :) [13:46] is ubuntu server 16.04 ready to run php,python CGI? [13:49] vimart: What do you mean exactly? [13:50] lordievader: to run simply scripts in php or python? [13:52] For example I'd like to have contact form on www [14:01] vimart: If you install the necessary stuff, sure. [15:40] lordievader: I've noticed that PHP probably is comming with ubuntu server but I don't see python, what should I install to run python? cgi? [15:41] Python (2.7) is installed by default. [15:43] lordievader: PHP is not installed by default either [15:43] lordievader: sorry, vimart --^ [15:43] vimart: but python is [15:44] Hence the 'if you install the necessary stuff' ;) [15:45] lordievader: yep, i meant in relation to vimart's last comment [15:46] Yes, indeed. [15:55] hi, any friendly folks around that could please help. my server is taking a beating from a spammer/ddos. Not sure how to get things straight if anyone would be kind enough to lend a hand please? [17:08] jonah: still looking for help? [17:18] looks like both your hosting company website and its blog are online so i guess that's no longer an issue. [17:37] tomreyn: hey thanks, sorry i got a bit tied up there [17:37] i can imagine [17:38] tomreyn: it seems to have all come from backscatter, but on a large scale with clamscan going nuts scanning tens of thousands of email bounce backs coming in [18:08] nacc: any suggestions for 1703752 ? [18:08] i see, so it was / is your mail server that was being overwhelmed. that's luckily a lot easier to fix than a web based ddos [18:09] yeah if nothing else, "just turn it off" isn't a bad start [18:09] sarnold: looking [18:12] sarnold: i'll pick it up -- there seem to be a few bugs here [18:13] nacc: thanks; normally I'm content to say "yeah bad php can use trusty" but if it's something we shipped anyway, it'd be nice to at least warn folks if it won't work. or something. :/ [18:14] sarnold: yeah, we have done some fixes and iirc, i think my cursory usage did work [18:14] sarnold: so this is probably something > cursory [18:14] somehow I'm not surprised roman would hit a 'logout' button that you might not :) hehe [18:18] sarnold: yeah [18:18] sarnold: i was more concerned with "does the UI display" [18:18] "doesn't seem badly misfunctional" [18:19] sarnold: yeah -- which it admittedly was, at first [18:20] heh === JanC is now known as Guest95169 === JanC_ is now known as JanC [20:07] https://www.vultr.com/docs/how-to-install-modsecurity-for-nginx-on-centos-7-debian-8-and-ubuntu-16-04 [20:07] does it work? [20:07] or whats your setup for ubuntu 16.04 nginx and mod security [20:38] nacc: an opinion here, please [20:38] nacc: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1531622/ is it worth fixing for 16.04, since it's just a config change? [20:38] Launchpad bug 1531622 in rsyslog (Ubuntu) "default config still using a legacy keyword: KLogPermitNonKernelFacility" [Medium,Fix released] [20:39] it's quite probable that dpkg will prompt about a config file change during the upgrade, so just installing the update won't fix it in all cases [20:40] but looks like people want it [20:40] got a duplicate bug even, for 16.04 [20:46] ahasenack: i think it is probably worth pursuing -- not sure i follow the 'won't file in all cases' comment? [20:47] nacc: sorry, I dropped just after mentioning the duplicate bug, where is that comment? [20:48] nacc: that being said, the new option doesn't work :P (upstream bug) [20:48] the error was silenced, but the kernel messages also :P [20:50] ahasenack: your comemnt itself earlier: "... so just installing the update..." [20:51] nacc: I mean if the user made an unrelated change to rsyslog.conf, installing the update won't fix the broken config option [20:51] dpkg will prompt the user, saying the config file changed, and ask for help, right? [20:51] keep, overwrite, diff, etc [20:52] or are we expected to detect this in postinst somehow and fix it for the user? [20:52] ahasenack: it feels like something we should detect if it was a valid config before and now is not [20:52] ahasenack: is that the case here? [20:53] nacc: no, we introduced a bug when we changed how the klog module is loaded [20:53] we should also have changed how its options are set [20:53] what we have currently in xenial is a mix: new style loading, old style option setting [20:53] that's the bug [20:54] this was fixed in yakkety: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1531622/ [20:54] Launchpad bug 1531622 in rsyslog (Ubuntu) "default config still using a legacy keyword: KLogPermitNonKernelFacility" [Medium,Fix released] [20:55] yakkety+ is fine (except for the upstream part: https://github.com/rsyslog/rsyslog/issues/477) [21:00] ahasenack: ok [21:00] ahasenack: sorry, i'm kind of deep in some git-ubuntu stuff. Your judgment seems reasonble to me [21:00] I'm just wondering if a config file change is worth for an SRU, given that the user might very likely be prompted to edit the file anyway during the upgrade [21:00] or maybe that's not so likely [21:01] ahasenack: it might be worth an e-mail to ubuntu-devel-discuss if you can't decide (or ubuntu-devel) [21:02] ok [21:02] it would fix new installs at least [22:01] hum. acpid dropped /etc/acpi/events/powerbtn in artful because "since the script is a no-op when systemd-logind is running and systemd-logind is now *always* running". this is not true as dbus is required by logind but dbus is not yet mandatory. [22:02] Condition: start condition failed at Wed 2017-07-12 17:47:47 CEST; 6h ago [22:02] └─ ConditionPathExists=/lib/systemd/system/dbus.service was not met [22:02] First time I've been back to this snap install conjure-up --edge and every time I run conjure-up.lxc list I get different results showing different status for all. Sometimes have up sometimes not... [22:03] stokachu: --^ [22:03] trippeh: how'd you get a system without dbus? I thoguht that was basically mandatory in order to use systemd for init [22:04] sarnold: these images are built using debootstrap, very similar to ubuntu base or whatever it is called nowadays [22:04] most of systemd works fine without dbus [22:04] braziercustoms: I bet if you run journalctl -f you'll see snap services restarting.. [22:04] I'm not sure why that happens though [22:05] I may just give in and start adding dbus, even if I'm not stoked about the attack surface ;) [22:06] trippeh: aha [22:06] :/ looks like it is [22:08] then again if someone gets access to these vms in a manner that gives access to dbus it is usually game over anyway [22:08] * trippeh scratches beard [22:09] Stokatchu it is :/ how is this setup started? [22:10] There are snap services in /etc/systemd [22:11] Stokachu how many? [22:13] (I also realize using debootstrap means I'm mostly on my own :p) [22:14] oh well *adds the powerbtn stuff back using ansible* [22:15] it is just some config files after all [22:17] Stokatchu I'm sure you are familiar with the errors. But I got "Not restarting into /snap/core/current/usr/snap/bin/snap" older than error.. flooding [22:26] And kernel audit about apparmor profile does not exist for neutron agents. Why didn't it do this after first reboot? [22:27] sarnold: even networkd works without dbus ;) [22:27] trippeh: ha :D === JanC_ is now known as JanC === PaulW2U_ is now known as PaulW2U [22:53] Stokatchu I can't proof of concept on the "proof of concept version" :D [23:08] Stokatchu it stabilizes? It seems to have stopped... how can I follow this issue?