=== JanC_ is now known as JanC [07:31] Good morning [08:38] hello ubuntu folks [08:38] my monitoring system is not happy because of these errors in kern.log https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1705447 [08:38] Launchpad bug 1705447 in linux (Ubuntu Zesty) "misleading kernel warning skb_warn_bad_offload during checksum calculation" [Medium,Fix released] [08:39] this happens on Bare Metal [08:39] I guess I can safely ignore them ... is anyone else hitting this stuff ? [09:57] coreycb: https://bugs.launchpad.net/ubuntu/+source/horizon/+bug/1677207 seem familiar to you? I'm not sure our flush cache/upgrade bits are working in the horizon pacakges. [09:57] Launchpad bug 1677207 in horizon (Ubuntu) "dashboard not workable after upgrade from newton to ocata" [High,Confirmed] [10:04] good... some Ocata bugs are popping up before I start my upgrade :) [11:49] jamespage: ah, is it memcache do you think? [12:17] hey hey [12:17] if I am making new sftp user - chrooting it to images directory and using strong password is all that I need? [12:17] :) [12:18] just a user who can upload images via www :D [12:18] coreycb: I don't think so [12:19] Match Group sftp_users - whats that for ?X11Forwarding no AllowTcpForwarding no ChrootDirectory /images [12:29] ok I see whats up [12:29] :) [12:29] its to catch users to whom following commands apply [12:29] however in my cases, dirs are owned by root:www-data lol [12:30] can I use Match user somehow instead of a group? [12:30] so I add 1 more user to www-data group :) [13:18] mm anyhow now I see that entire path have to be root:root [13:18] but my php app required group write read access [13:18] via group [13:50] nacc: "debian/changelog must exist in source packages" [13:50] Looks like that's only just become a requirement. [13:50] Interesting for us. [15:12] rbasak: where is that? [15:26] nacc: lastest Debian policy change. [15:26] Sent to devel-debian-announce [15:27] rbasak: ah [15:28] rbasak: I mean, beyodn perhaps adding it to the linter, what do you expect to chagne? [15:46] nacc: I mean that we're assuming that it exists when importing historical packages. [15:46] But I suppose if it did in practice, then we're OK. Hence interesting rather than a problem. [15:47] rbasak: ah ok [15:47] rbasak: yeah, I think we just would't see any versiosn [15:47] rbasak: which would mean orphans [15:47] perhaps we'd fail to tag too [15:47] not sure [15:48] rbasak: is your schedule pretty full today, or do you think you'll be able to get to ay of the reviews? [15:59] nacc: seems unlikely, sorry. Do you have any small ones you can point out that I can try to tackle when I find a few minutes here and there? [16:00] rbasak: no it's fine, just gauging my own expectations [16:02] https://help.ubuntu.com/community/UFW states that "By default, UFW allows ping requests" [16:03] the minute I do an "ufw enable", I can no longer ping6 the server, or ping6 out from it [16:22] rbasak: the only one that definitively you need to review is the queue change [17:43] rbasak: was cjwatson's suggestion that we add a Git-Ubuntu: field to the DSC? [17:43] rbasak: i see dgit adds a Dgit === hehehe is now known as misterjones [18:12] hello .o/ [18:12] hey drab :) [18:13] I'm considering doing something "different" for our centralized home dirs and hoped to hear some opinions [18:13] basically right now we have a standard ldap + nfs shares, users auth against ldap and pam_mount mounts their homedir [18:14] however as I've been moving stuff to containers nfs is a pita becuase the userspace version is awfully slow and the kernel version won't run in a container [18:14] there's also the problem that a network blip and/or issue with the nfs server freezes up the clients very badly [18:15] I've read that may be fixed using soft rather than hard mounts with nfs tho [18:15] in any case, as I was trying to help some folks with a samba share, I came across some links wondering if I could use samba for homedirs... [18:16] it turns out there's some largish university campuses doing homedirs on samba as it can be interoperated with windows too, but generally I've not seen a lot of setups like that and wondered how crazy of an idea it is [18:16] i mean, i'd expect to see some similar caveats a la network blips [18:16] i'm not sure how resilient samba is to long outages [18:17] soft mounts definitely help nfs clients [18:17] I've no experience with samba so wondering if: a) is it performing alright compared to nfs? (will test of course) 2) is it crazy to put homedirs on it coupled with ldap? [18:17] and/or how it reconciles remote changes onn the server [18:17] drab: +1 on soft, though [18:18] tbh the most appealing part of this is avoiding to run kvm so that I can run nfs-kernel-server [18:18] right now I'm 99% lxc with the exception of the nfs server, requiring kvm [18:18] and that means handing off the infra to people requires them to know how to deal with that too which isn't terribly hard but does add some complications [18:19] so if I could be 100% lxc using samba for homedirs that would be, in the larger picture, quite a win [18:19] but I don't want of course to ruin it for all the users by making their experience terrible [18:19] drab: in theory, could your VM be a privileged container? [18:20] nacc: the thing is, that doesn't really solve the isolation issue... I've had nfs locking up on the server and taking down the whole thing [18:20] drab: ah sure [18:20] drab: yep, i can see that happening :) [18:20] so even if I could do a privileged containres, which I guess would solve having kvm [18:20] yeah, if you need isolation, then that's a different issue [18:20] I don't quite feel comfortable given everything else going on on that box [18:20] yep [18:20] yeah, but you're right, that would solve my kvm issue [18:20] drab: are you sure the samba mounts _would_ be allowed? [18:20] drab: nfs lockinng up in the kernel? [18:21] nacc: yes, basically locking up the machines, doing something bad to the drives, whatever [18:21] ending up impacting all the other containers/services on that box [18:21] sarnold: based on what I read, it looks like it. this is the best link so far: [18:21] https://sites.duke.edu/linux/cifs-nfs-homes/ [18:21] so it seems the workflow is the same [18:22] except it uses pam_cifs [18:22] altho right now I'm using autofs to mount the homes, not even pam_mount [18:22] but that should also work with samba no prob [18:22] except that samba requires user/pwd so maybe pam is required in this workflow [18:22] the added benefit to using samba over nfs is auth [18:22] drab: btw i've had success unsticking nfs mounts by bringing up the IP address of the server on an interface, exporting an identically-named filesystem, and umounting [18:23] good to know, thanks for sharing [18:27] I guess I'll take it as a good sign that neither of you called me crazy and begin experimenting :) [18:28] that will give me a better sense, the general principle seems fairly simple/standard, I just have no clue how well samba is going to handle disconnections or multiple logins (sometimes ppl forget to log out and their home stays mounted) [18:28] ahasenack: --^ has also been doing quite a bit to get samba up to snuff relative to bug reports [18:28] he may have further insights [18:29] that's another pretty annoying this I found no good solution to... log people out after inactivity [18:29] ok, cool, thanks [18:29] always good to be here, you guys are great :) [18:30] drab: check out systemd-logind for the idle thing. [18:31] k, thanks [18:31] brb [18:31] my own experience with samba is decades ago at this point but I recall being massively annoyed at how many bloody authentication types there are. public, share-level security, user auth, etc etc [18:32] but if you get to run the server and clients and control them yourself you can probably get something happy [20:49] beisner: hi, can you please promote horizon 3:11.0.3-0ubuntu3~cloud0 to ocata-proposed? it's a high-priority fix for upgrade from newton->ocata. [20:50] hi coreycb - on that ^ [20:51] beisner: cheers, thanks [22:12] sarnold: nacc: fwiw found this which seems possibly problematic: https://github.com/lxc/lxd/issues/3442 [22:12] but stgraber says he has it working so maybe I'm misunderstanding the issue [22:12] drab: do you use zentyal? [22:12] I only need to serve files, not even the DC part, altho it'd be nice to do that later [22:13] I don't , but it didn't seem zentyal specific, maybe I misread [22:13] the problems seemed to be related how samba stores the acls in the security.* namespace [22:14] drab: zentyal sets the --use-xattrs bits [22:14] drab: but not really sure either [22:14] i'd try it and see :) [22:14] heh, I'm setting stuff up nowish, had to deal with some broken hardware and building sorting box frames [22:15] the "fun" part of being a charity is that we hold on whatever junk we can get our hands on for the rainy days [22:15] it's like a flashback 20yrs in my father's garage... [22:16] I don't think he ever threw away a single screw, everything had to come off before the boards ended up in the bin [22:16] that's how my dad was too [22:16] i had one of his boxes of screws until it got rained [22:16] somehow he kept it totally organized by type, size, thread, etc. too [22:16] * drab nods [22:17] I think the first tool I was every introduced to was a labelling machine :P [22:17] heh [22:18] now that it's up to me I just write with sharpies on masking tape lol :P [22:18] yeah, that's what we do in our pantry, e.g. :) [22:18] drab: the xattrs stuff is configurable IIRC and my DC is deployed manually through samba-tool, so I'm simply not passing that particular option [22:18] stgraber: sounds good, thanks for chiming in [22:19] stgraber: any chance you have an opinion on the craziness of replacing nfs+ldap with samba+ldap for centralized homedirs for a bunch of linux desktops? [22:20] I haven't done either in a while. I used to do that kind of stuff for school districts in a previous life and I seem to remember both being annoying but in different ways :) [22:20] heh [22:21] yep, that's exactly where I am... edu charity/school and being annoyed :P [22:21] IIRC we'd usually do nfs on trusted networks where no sharing was needed with Windows and cifs for the rest [22:21] I guess testing will tell... getting to it [22:21] yeah, I'd normally do that if it wasn't that I'm trying to get everything into containers [22:22] and nfs-kernel-server won't play nice with it and still be a nuisance to the host if I go with a privileged container [22:22] samba would solve that problem, which is quite a plus in this setup [22:22] yeah, and the old nfs-user-server wasn't exactly fun to use :) [22:22] yap [23:02] Hello, [23:03] what's best SMTP server is on ubuntu 16.04? [23:03] Where you can chnge ports? [23:06] Village: 'best' is a really ... vague ... term to use. I would think every SMTP server worth using is configurable as to what port it listens onn. [23:07] Village: which have you looked at? [23:08] I want that Internet Site can send emails via SMTP and email addresses sender by not same.. [23:08] now i looking [23:08] postfix [23:14] postfix is good [23:15] postfix and exim are 2 of the common ones and largely a matter of taste which one you pick [23:15] personally exim would drive me bonkers each time I tried to configure it and always stuck with postfix, but really it's just a personal preference thing [23:15] Village: ^^ [23:22] Ok, i have at mind that two of best is postfix and exim [23:23] but i wanna know google smtp not allow send user@gov.us ? [23:27] why do you think it does not? [23:29] i don't know need try [23:47] make sure you leave a copy on your gov.us server :-D