[00:00] probably good money for redhat etc that sells courses [00:00] Thanks sarnold. It has turned into a networking problem, and I need to work tomorrow. Night! [00:00] andybiker: good luck :) [00:01] * trippeh doesnt mind learning new stuff ;) [00:01] I wonder how redhat training income has changed since rhel7 came out ;) [00:01] I'll try and report back soon [00:01] trippeh: it's not that - I'm learning new things most days, but systemd just turns things upside down [00:02] resolved is not that different from running a local unbound tho. [00:02] or dnsmasq [00:02] that's not what I said [00:02] except unbound was written by dns masters and resolved was smacked together by .. not dns masters. [00:03] it was more of the general idea behind systemd, which I can't really grasp [00:10] I mean - if you really want to create a new OS on a Linux kernel, go on, but current systemd reminds me somehow of upstart - you start with an idea, implement it half-way, then it's all half-way, and the old stuff works, mostly, and then it's all a mess, basically [00:10] ineffableness [00:15] sarnold: I fricking love unbound, but the integration in both Debian/Ubuntu and RH for use as a local caching resolver was not great and had so many quirks [00:16] trippeh: aww :( [00:17] unbound has quirks [00:29] it especially gets hairy with DNSSEC [00:29] local in this context is localhost, btw [00:29] as a local network resolver it is super ;) [00:32] (except for currently beeing totally borked in sid and artful, but thats a different matter) [00:34] Hm, I just did something unspeakably ugly to work around an issue - I point to 127.0.0.1 in resolv.conf so I talk to unbound, but then NFS comes along and tries to mount a share before unbound is launched. So, now, my /etc/network/interfaces has an "up service unbound start" line. =cough= [00:34] :O [00:34] sysvinit, I would tweak the number in front of unbound so it preceded the NFS mount, but it's somewhat unclear how to cleanly do such a thing in the brave new world. [00:35] I would probably just use systemd drop-ins to get the dependency order right [00:36] I'll have to look that concept up. [00:36] Thank you. [00:36] https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Wants= or https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Before= or both [00:37] sarnold: Oh, I'd hoped it was something that wouldn't involve editing the system-supplied unit files... [00:37] mason: that's where the 'drop ins' comes in, example 2 https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Examples [00:37] thats why you use drop-ins :) [00:37] sarnold: Is there such a thing, where I can have a config that shadows or extends another? [00:37] ah, kk, looking [00:38] I wonder if systemctl can generate these things [00:38] systemctl edit name.service is the easy way [00:38] it creates the drop-in for you [00:38] good start [00:38] That *is* trippeh. [00:39] otherwise create a /etc/systemd/system/name.service.d directory and drop override files ending in .conf in there [00:39] there's some add-wants command.. [00:40] I'll be honest with you, changing a symlink name seems cleaner for re-ordering, but I'll give it a try. :) [00:41] dependencies are a bit of a pain in the beginning, and this really is ought to work out of the box :) [00:42] and to think we got the benefits of opensuse, fedora, -and- some debian users doing these things first [00:42] Hm, this references /usr/lib/systemd/system. [00:42] Let me just look at the systemd config file to see where the system stores unit files. [00:43] * mason slaps his leg and laughs. [00:43] systemd.unit(5) lists many of the locations [00:44] RH/Fedora uses /usr/lib/systemd ;) [00:45] hm, and yet, no unbound.service there... dpkg to the rescue [00:45] build/packaging really should fix those paths up in the docs [00:45] to match ubuntus use of /lib/systemd [00:45] Ah, unbound provides /etc/init.d/unbound. [00:46] So, with that in mind, I'm guessing drop-ins aren't an option for adjusting boot ordering. [00:46] This gets more funny as time passes. [00:46] it worked last I tried with a sysv init script [00:46] trippeh: Ah, there's an implicit conversion? Autoboxing of sorts? [00:47] the "systemd sysv generator" creates a temporary .service, so you can still override things like deps [00:48] you could always steal http://sources.debian.net/src/unbound/1.6.4-1/debian/unbound.service/ [00:50] Mm. [00:50] I'm still in the "exploring with wonder" phase. [00:50] mason: if you want to look at how it actually works, systemctl cat unbound.service [00:50] Oh, interesting. [00:51] Is there a way to get an idea of service ordering on boot? [00:51] I don't see a systemd-analyze any-old-chain [00:54] hm. systemd-analyze plot maybe? [00:54] redirect it to something.svg and open it [00:55] yee [00:55] how about systemctl list-dependencies ? [00:57] ah, that seems a little less ... That's better. Both are interesting. [00:58] https://tomt.net/temp/plot.svg aw my boots have slowed down :( [00:58] Hm, that makes it seem like unbound ought to be loading before nfs-client either way [00:59] Ah, the svg shows unbound.service at 31s and nfs-client at 26 here. [01:00] note that unbound might have started but not yet ready; this is also something that is solved by a native systemd-service over sysv [01:00] alright [01:01] the idea of pulling in the service file from Debian has merit [01:01] (daemons can notify systemd when they have actually finished initialization) [01:01] Do they have to be systemd-aware or does it have some sort of monitoring capacity? [01:01] for that specific function they need to be aware [01:02] hm [01:02] (Type=notify services) [01:02] Interesting. [01:05] and the debian packaging for that version does include an .ac file that knows how to check if systemd libs are available and do the notification [01:05] trippeh, sarnold: thank you for the array of clues. I'll be using this chat log as reference for the next several months at the least. [01:05] hrm, interesting... [01:11] hm. you may get away with After=nss-lookup.target for the nfs-client service [01:12] at work we drop in a After=unbound.service for the services needing dns at boot, but thats not very generic [01:12] Hrm, I'm seeing nfs-client.target - don't I want Before=nfs-client.target ? [01:13] And can the drop-in have Before=nfs-client.target bare, or do I need a section header to do with it? [Unit] I'm guessing...? [01:13] so go with it* trippeh [01:13] ANOTHER NIGGER ACTING CRAZY!! [01:13] https://www.youtube.com/watch?v=ySSdeYpoWBU [01:13] realnigzlqctosqu.onion or realnigzlqctosqu.onion/6667 [01:13] sbeattie yokel_ piremi Oatmeal oraqol1 notdani meminemy_ JanC tinwood dpb1 s0_iggie PityDaFool dpawlik rtjure yokel skylite smb oerheks Tarius mtl ratliff mikal jjohansen1 mhcerri|mobile Toris alinefm Emmanuel_Chanel theGoat Guest431 jdstrand scottjl Spydar007 Dasoren[m] Syam[m] keithzg[m] [01:13] banhammer? [01:13] lordievader Jtremback[m] Deliant Dynamiic jeremy_carroll rmk thedac robertj trevor_s Arroyo1010 dlloyd Dmitrii-Sh profall jamespage powersj niemeyer mwhahaha paulmey fhd fidothe jemurray thejoecarroll andol r ujjain- ddellav noxs_ vtapia greenywd am0nrahx pjdc masber le_pig justizin cydizen c [01:13] oreycb yosafbridge tafa2 edwinksl db` pitastrudl Seveas jerrcs funabashi lynxman mmm ivyyyyy alai manjo elky israfel kriskropd lordcirth_work cncr04s edwardly edenist_ ubottu berglh bigjazzsound_ maco_ zeestrat G ejnahc_ OliPicard stokachu thebwt AMZ_ dannf gimmic trippeh a1berto niedbalski [01:13] tonyyarusso lamont micahg ShaRose ZipSplat compuguy pleia2 freyes zikeji inteus Bartuk jgornick sforshee sobukus njalk Ad1Tech lionel petevg dino82 vamiry monokrome bleepy moonlight Foritus Pwnna iggi semiosis TheEternalAbyss Guest18666 gnuoy diddledan stickystyle devil ren0v0 Bilge markus_e92 [01:13] Chrisfu Kehet Guest35907 mundus zerick diytto iliv dlloyd_ blackboxsw glebihan_ dcmorton Pici Thumpxr soahccc beardface ulkesh X-Rob bladernr dosaboy aluria drkokandy AndyWojo unreal thib T-Co techmagus Kaelten bruce549 cyphermox ackk Jalen blake_r heistheDude sc` admcleod joelio yoink Jare_ [01:13] sewaddle odc beisner rsalveti guntbert sarnold henkjan lifeless homegrown rizonz disposable Arkaniad kirkland supercool marcoslater Alesk13 Tzunamii xit warpx markthomas teward StathisA akaWolf hiboma fginther macskay devster31 ejat frickler ubuntulog Tribaal IdleOne Adri2000 zul basilAB vaishali [01:13] dasjoe Screedo Raboo cryptodan_mobile PaulePanter antonw Stern rypervenche codex MeltedLux madLyfe jerichowasahoax axisys Valfor ikonia bradm zzxc ptx0 tnarg Walex maswan LarsErikP ducasse ajmitch bhuddah med_ ddstreet Jeepbeats ndroftheline caliculk mthaddon Gnubie_ Nebraskka SpamapS protodan [01:13] LaserAllan jaredrhine dragan-s marcoceppi freeflying Beret iberezovskiy smoser mwhudson eldritch nymony dweaver rvba octanium aisrael xMopxShell Hink ivoks binia Noskcaj Jikan kklimonda fyxim seyeongkim joedborg nOgAnOo jajah icey soren karstensrage cargonza arosales freakyy apw codedmart stgraber [01:14] trippeh: Any reason why Before= would be bad for this? [01:14] hm. I need to check how nfs is set up before saying anything definite [01:14] :p [01:15] What about the [Unit] in the drop-in? Is that required? More I think about it, seems like it probably is, but none of this makes intuitive sense, so I'm happier appealing to authority. :P [01:15] I tend to add deps to the services needing dns, not to the service you need to run first [01:15] hrm [01:15] That's reasonable too. [01:16] yes, [Unit] would be required [01:18] now, where is nfs actually mounted, hm [01:18] Alright, I've used systemctl edit nfs-client.target, and it seemed happy letting me make an override file, wherein I specied After=unbound.service below [Unit]. [01:18] probably not this one haha: ExecStart=/bin/true [01:19] not sure that would work with targets, hmz [01:19] trippeh: You realize that the next step is to make true systemd-aware so it can signal start-up completion. [01:19] But it only offers a target for nfs-client :P [01:19] Man, this stuff is all so much easier than renaming those sysvinit symlinks. :P [01:20] heheh [01:20] when it works, it is great! [01:20] "I made my bootup five seconds faster at the low-low price of bleeding out both ears." [01:21] We'll see if this works. [01:21] I'll reboot before bed. I've got rescue media handy should the system be unhappy. [01:22] Before=nfs-client.target on unbound.service may work better in this case perhaps .. i'm still searching for the actual nfs mounting service [01:23] heh [01:23] I can do both! It should be safe, if the resolver isn't completely bad. [01:23] perhaps a +r would help a bit from these spammers [01:24] it usually does [01:24] and most irc users know how to register in nickserv, or they'll learn it rather quickly [01:27] I see have some reading to do on WantedBy [01:27] I see I have even [01:30] heh [01:30] so resolved this seems to just work :P [01:31] (systemd-resolved that is) [01:35] darn, work in a few hours [01:35] it's almost time for me to quit.. you should have quit ages ago :) [01:36] this is just one more example where unbound as localhost resolver is not that awesomely integrated in deb/ubuntu ;) [01:38] hehe [01:44] I wonder if .mount units can depend on services [01:44] instead of using fstab for nfs mounting I mean ;) [01:45] fstab beeing sort-of legacy and all [01:47] ok docs still say fstab is "preferred" [01:47] "in general" [01:47] :p [01:48] way simpler [01:48] seems you can add systemd dependencies in fstab too [01:48] man systemd.mount for the deets [01:48] mason: ^ ! [01:49] x-systemd.requires=unbound.service or something ;) [01:49] as file system option [01:50] interesting! [01:50] thank you, will try that [01:51] I have not tried this myself, so beware [01:53] It's systemd. I default to "beware" === ShaRose_ is now known as ShaRose === mundus is now known as mundus2018 === demon_spork is now known as demonspork [06:36] Good morning === sammyg is now known as Guest16320 === hakra is now known as sammyg === albech1 is now known as albech [08:46] anyone in here familiar with google cloud platform? I have installed a vm and trying to build a vpn server on it. I have enabled ip forwarding on the kernel, but notice that on the GCP console it says that IP forwarding is off. Something tells me that it may be required to enable on VM level. Anyone experienced this? === yokel_ is now known as yokel === albech1 is now known as albech === JanC is now known as Guest54020 === JanC_ is now known as JanC [14:56] hey guys [14:57] which row is my actual free ram? [14:57] https://i.imgur.com/nDBY0IZ.png [14:57] i thought this means i have 121 MB free but apparently i have 671? is that right? [15:00] randymarsh9: 671 MB [15:00] randymarsh9: the second line can be confusing with the "-/+" but it means that the first column (used) is without considering buffers and caches [15:01] and the second column (free) is when you consider buffers and caches === XV9 is now known as XV8 [15:06] sdeziel: shouldn't i consider the buffers and caches though? [15:06] aren't those using up ram? [15:07] randymarsh9: they use RAM only to speed things up, it's not required to have them in RAM so if an app needs more memory, the buffers/caches will be shrinked [15:08] sdeziel: okay cool thx [15:08] np [15:15] i noticed i have /usr/bin/python3 taking up 80MB of ram [15:15] can i delete that? i don't remember how it got there === jelly-home is now known as jelly [16:10] hey guys [16:10] how do i set which mirrors my server uses? [16:11] when doing apt-get update, etc. [16:14] randymarsh9: you edit sources.list (presumig you are on a server) [16:26] nacc: thx [16:26] randymarsh9: yw === chmurifree is now known as chmuri [16:33] settnig a passphrase on my private key means anybody who tries to use it has to enter that password, correct? [16:34] when authenticating with it? [16:36] randymarsh9: in general, yes [16:36] randymarsh9, that encrypts the key file locally, yes [16:37] but if you are using an agent, once you unlock your key, it's loaded into the agent and then those with access to the agent can make use of the key. This is generally just you but you should consider those with root on your machine to also have access to the agent [16:38] root on your machine owns the machine, fact of life [16:38] true :) [16:38] and in that context, agent or not, once the key is decrypted, it goes into memory where root can probably grab it [16:43] Yup. Not to mention the much simpler approach of swapping /usr/bin/ssh with a binary that dumps the key to /tmp/ === whitekidney is now known as wk-home [18:46] is there some bug with hostname -f returning localhost? ubuntu 14 [18:50] Epx998: does /etc/hosts look sane? [18:57] Hi! How do I create a persistent Dummy network interface? [18:57] Capprentice: probably it will be re-created on boot if you add it to /etc/network/interfaces [19:01] The networkManager is enabled and I can not remove it. How do I enable the interfaces in /etc [19:11] think i found the problem [19:13] Capprentice: you mean using the 'dummy' kernel module? [19:13] yes [19:14] yeah so hosts file is has localhost in the 127.0.0.1 entry [19:14] Capprentice: and you want NetworkManager to create it at boot time? [19:15] Tj, Yes. [19:15] Capprentice: you'll need to modify these instructions somewhat, but here's an exampe: https://jamielinux.com/docs/libvirt-networking-handbook/appendix/dummy-interface-on-rhel.html [19:21] Capprentice: if you don't actually need to have it created by NM, you can simply put another iface (like iface dummy0) entry in /etc/network/interfaces. NM ignore interfaces in that file. [19:23] sdeziel: I want the interface to get created at boot. If networkmanager can do that, then where do I put the config? What will I need to add under Network Manager? [19:24] Capprentice: I don't know the NM way but that *should* work: https://paste.ubuntu.com/25588002/ [19:24] The way RHEL does, will it be identical TJ? [19:27] Capprentice: modprobe dummy; nmcli con add type generic ifname dummy0 con-name dummy0 ipv4.address 172.16.1.2/24 ipv4.method manual [19:28] Hmm! Thanks. [19:28] might need a few more arguments to the nmcli command depending on your needs [19:39] why does ubuntu put libararies in /usr/lib/x86_64-linux-gnu/ instead of /usr/lib ? [19:40] wk-home: becuase you have both 32 and 64-bit libraries on the same system? [19:40] wk-home: it's part of the Debian/Ubuntu multi-arch specification [19:41] new in 16.04.3 ? [19:41] having major compilation errors because of.. paths lol [19:42] wk-home: i think it's been that way for a while [19:43] weird, never ever had this issue before [19:43] The spec started in 2004, most if it was in place by 2011 then the library separation started. I think multi-arch became mainstream with 14.04 [19:43] TJ-: taht sounds right [19:44] wk-home: there are a few holdouts where i386 and amd64 packages won't co-install. I dealt with one, -libunwind1 - last week [19:44] sorry, libunwind8 [19:44] is there anyt PATH magic going on here? ive deployed multiple testing VMs locally with the same base iso and never had compilation issues with paths (not finding libs) [19:44] wk-home: no. what is the specific error? [19:45] wk-home: you haven't actually told us an error [19:45] wk-home: is it a libtool rpath issue? [19:45] well, it looks for libraries under /usr/lib/ that's not there anymore [19:45] wk-home: we don't konw what 'it' is [19:45] wk-home: use a pastebin [19:45] libtbb, openssl etc [20:43] Thinking of migrating upwards from the 4.4+ kernel series..."just because"...the box is merely a file server with custom compiled "netatalk" for AFP/Bonjour...any input/suggestions/donuts? [20:44] suggestion: don't do stuff "just because" [20:47] tomreyn, It's here at home...not a client's production box...just re-arranging the home/lab network a bit...was wondering...and gathering data...more fun that doing laundry and folding clothes, you know...(the cat will take care of that stuff) [20:50] YankDownUnder: I generally have all my systems using the Ubuntu kernel team's mainline kernel builds. You might want to stick to the stable mainline releases (I try the RC's too) [20:51] TJ-: how do you validate their authenticity? [20:52] YankDownUnder: you can try the linux-generic-hwe-16.04-edge package, it ships with semi-current kernel [20:52] 4.11.0-14 ATM [20:52] tomreyn: how do you mean? they're Ubuntu builds, signed by the Ubuntu signing key [20:54] I suppose this all boils down to "wasting time". I'm sitting around at home recovering from radiation and toxic sludge pumped into my veins...therefore, I am "looking for things to do". I've rebuilt several machines, ripped apart an iMac and an MBP, sorted all my comics and books...therefore, I was eye'ing up this file server that very happily chugs away with no problems...hmm...and in reality, RARELY would I even venture [20:54] down this road - never in 20+ years would I - however, the levels of boredom are exceedingly high... [20:54] TJ-: oh right i missed the CHECKSUMS.gpg file [20:54] YankDownUnder: might be time for a RasPi or Arduino or similar :) [20:55] TJ-: do you know of a script to install the latest kernel image which actually verifies those checksums? [20:56] tomreyn: my own :) [20:56] care to open source it? ;) [20:56] tomreyn: I think I have it up on my server somewhere, let me see if I can find it [20:57] i know ukuu, which is...not good software, and there are a couple other 'mainline download' script, but none i know of does gpg verifications [20:57] *scriptS [20:58] and there is no https either, sadly [20:58] thanks for looking for it [21:14] TJ-: any luck finding it? [21:59] I am having trouble booting a different (older) kernel in grub using GRUB_DEFAULT. When I set GRUB_DEFAULT=0>2, update-grub, and reboot the server continue to boot into kernel 3.16 instead of 0>2 which is submenu kernel 3.13. Deos anyone have any suggestions on troubleshooting this? [22:03] tomreyn: sorry, I was off doing other things. I've just uploaded it. https://iam.tj/projects/ubuntu/wget_kernel_mainline.sh [22:16] TJ-: thank you, also for the license choice you made. :) this should save me some time. [22:20] tomreyn: you're welcome. All my stuff is GPLv3 [22:21] tomreyn: if you find any bugs or need features let me know. It satisfies my needs but if others are using it I can guess there'll be a wishlist [22:22] i'm not sure, yet, but if i interpret the source correctly it will compare sha1 checksums while it could compare sha256sum's [22:24] tomreyn: speed choice [22:24] tomreyn: plus easier to scan the CHECKSUMS file since it just needs to 'break' after the sha1 section [22:25] sha1 needs to die though ;) [22:26] maybe this can return a bit of the favor, though you may already have something similar yourself: https://github.com/tomreyn/scripts [22:27] tomreyn: I love the installer :D [22:28] sarnold: ;) [22:28] just trying to break bad habits [22:52] tomreyn: I've added the option "-sha256" just for you [22:54] TJ-: :) thanks. are you aware of wosign's state? [22:55] (i noticed you use an ssl certificate they certified) [22:55] tomreyn: sure, but I can't be bothered to switch the domain to lets encrypt right now because I'm replacing the server completely [22:57] excuse accepted ;-P [22:57] It's had so many upgrades (since 6.04) that I've lost track of what's what so it's getting a clean containerised install based on 16.04 [22:58] some tools still report it as 10.04 :) [22:59] sounds like a good time to reinstall ;) [22:59] yeah, done the debootstrap install of 16.04 but slowly moving over the configs from all te services and domains it hosts, and containerising as needed [23:03] thank the gremlins for LVM. I've been doing a dist-upgrade on a RasPi and 3 times it ran out of space on mountpoints and lvextend (and free extents in the VG) saved the day [23:12] tomreyn: your foreign_packages could also be achieved with apt-cache I think. Something like "apt-cache madison $( apt-cache pkgnames) | grep -v http " [23:18] TJ-: hmm, good hint, thanks. i've been looking for an alternative which gets rid of the apt-show-versions dependency for a while. [23:18] i'll give this a try the other day. [23:24] tomreyn: I (had to) write a script last year to reconstruct the /var/lib/dpkg/status file on a system that had suffered corruption so after spending a long time writing code to scan the packages in /var/cache/apt/archives and the lists in /var/lib/apt/lists I discovered "apt-cache dumpavail" to which I only needed to add the "Status: install ok installed" lines for each package! [23:26] hehe, i also tend to run into commands i had never expected to exist. usually some months after i needed tzhem. [23:29] * TJ- knows the feeling. I must be the only one that reads man-pages preemptively :) [23:30] I'm about to deploy 'maas' here since I noticed it supports my Sentry CDUs for power control. Was going to write my own control front-end for it... another case of almost reinventing the wheel [23:34] btw namei -l is the tool that I was happy to find before writing my own version :) [23:36] yeah, I often use readlink -m and cousins for a similar thing [23:36] nice find, too. [23:38] hah, nice :) [23:39] I have so many tools like this that I have a networked /usr/local/ volume that is copied to all my systems. It also contains any changes I make to system-packages and their files, so on a fresh install I have a script that walks the /usr/local/etc/ and /usr/local/var/ trees inserting symlinks into /usr/local/... and applying dpkg-divert's