[00:40] nacc: FYI: https://github.com/CanonicalLtd/server-jenkins-jobs/pull/1 [00:40] Once that lands I'll try retesting https://jenkins.ubuntu.com/server/job/git-ubuntu-ci/17/ to ensure it doesn't break anything. [02:27] rbasak: +1 seems like a good idea, thanks for the update [02:42] I'm trying to get OpenVPN Server running on Ubuntu Linux 18.04 LTS, but I can't even get it to write output to a log file. Is there a way to get OpenVPN to display its error output to the screen? Thanks. === miguel is now known as Guest29722 [04:25] I already have a PXE environment w/ a full ubuntu image, but would like to be able to drop the OS onto the local disks via an image. I don't need partitioning or anything like that. I don't want to have to boot w/ cloud-init as it is bare metal. Does Ubuntu have anything like this? Would Curtin work? (was not sure how cloud-init plays into it) [06:25] Good morning [06:42] morning [06:57] morning === gogbog is now known as Guest69003 [11:43] Hi, I'm trying to use the ubuntu-alternate installer with VMWare ESXi 6.7, When I select the Ubuntu installer, after a few seconds I get a white screen with corrupted graphics. Anyone have a workaround? [11:50] moffa: https://www.kernel.org/doc/Documentation/svga.txt <-- read this - perhaps there's an unsupported (by ESXi) vga mode (framebuffer) being used [11:52] Like when I boot from the iso I select English, then I select Install Ubuntu Server. Then you see a black screen with kernel msg then it goes to a white/gray screen [12:16] moffa: also note there are two different server installers for ubuntu 17.10 and 18.04 (in case you're using this). the (new) default one is called 'live' installer, and uses a graphics mode and installs fast (but is not flexible). the old one, called 'alternative' (debian) installer, uses plain text mode and offers all the choices. [12:19] aren't there... three? ubiquity, subiquity and debian installer? [12:25] subiquity is the server 'live' installer, ubiquity is the desktop 'live' installer. debian installer is the 'old' one which is used for alternative server installer and mini.iso. [12:26] ah so there's no ubiquity on -server isos? [12:27] afaik not. there are canonical repositories for both on github though if you'd like to take a closer lookat the differences though [12:29] https://github.com/CanonicalLtd [12:29] actually just subiquity is there. [12:32] tomreyn: (s)he said (s)he's using the alternate instller [12:34] RoyK: oops, right, it helps when one knows how to read properly. [12:41] tomreyn: oh okay. I must've misunderstood, thinking they're both present. [13:03] yeah the live installer works but it runs all that cloud.cfg scripts which setup netplan etc, I don't want to use that as I don't really understand how to configure it. [13:06] moffa: you don't have a choice, if you use the live installer, you get netplan. if you want to do otherwise you'll need to change things yourself after the install (install ifupdown, etc.) [13:07] that said, if you run through the configuration in the live installer and you don't need any special network setup, it'll work just the same [13:09] oh maybe I'll try that. I am getting werid dhcp client issues. I get a different IP that expected with netplan. I have to release and renew to get the proper ip. [13:11] ok [13:12] moffa: you using Windows Server as DHCP? [13:12] I think so, it's my IT department so they don't tell me anything. [13:13] They have a lot of things misconfigured - so I wouldn't be surprised if the issue is on their end [13:19] anyone know what I'm missing out on if I compile my own nginx vs nginx, nginx-common and nginx-extra? [13:20] or better yet a reliable source for nginx compiled with pagespeed? [13:37] teward might know ^ [13:47] I think I'm going to route of recompiling the source package from ubuntu rather than the latest from nginx, that way I just need to add my module and compile rather than gather all the modules the packages provide for me and risk missing something [13:48] That sounds like a reasonable approach. [14:01] rbasak: hm? [14:02] v0lksman: FWIW, Pagespeed is pretty much deprecated in favor of HTTP/2 nowadays [14:02] you would do better to deploy HTTP/2 instead of the Pagespeed module. [14:02] it's still 'developed' and what not, but HTTP/2 is the faster native solution [14:04] rbasak: do you know if HTTP/2 was released for Apache in 18.04? I don't remember the state of that, last I heard was it's still disabled because of nghttp2 having issues, but I didn't check/follow it. [14:04] rbasak: also, Debian had the "Add ngx_pagespeed module" request and rejected it, just as an FYI. It's nontrivial to maintain (just like modsecurity/NAXSI was) [14:05] teward: https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes#Apache says yes [14:05] huh...so if I have http2 in my listen directive I'm already ahead of the game? what about all the additional caching that pagespeed does? [14:06] with a small caveat that http/2 requires ssl [14:06] (I am using ssl) [14:06] blackflow: the spec doesn't require it, but browsers do. [14:06] so for all practical purposes, yes, it needs SSL. [14:06] right so... it's required :) [14:06] v0lksman: the NGINX team doesn't maintain the Pagespeed module, but HTTP2 is pretty fast on its own [14:06] i'm not familiar with the 'caching' part of Pagespeed [14:08] so I can't comment specifically on that, but pagespeed was a 1.1 optimization and an SPDY optimization, both are not necessary with HTTP/2 [14:08] (relevant: https://www.nginx.com/blog/7-tips-for-faster-http2-performance/) [14:08] older blog post but still relevant from the NGINX upstream blog [14:09] teward: thanks will digest. would rather not have to maintain a custom compile so if I can avoid it I will [14:10] v0lksman: the observed and gained improvement comes only with scale at which there's no more just you trying to figure this out, and supposedly plenty of resources available to track custom builds if really needed. [14:11] v0lksman: I'd strongly recommend doing this as a side-by-side thing, with separate NGINX deployments (even containerized if you wanted to), one with pagespeed and one with pure NGINX; but HTTP/2+NGINX can cause performance *decreases* instead of performance *increases* [14:11] in other words, the size of ops at which scale you observe improvement, is beyond just one person trying to figure this out. [14:14] what blackflow said. HTTP/2 on its own is *speedy* without Pagespeed, so it might be what you need. [14:14] I don't roll HTTP/2 right now, but that's because my servers don't have new enough OpenSSL at the moment to have full HTTP/2. [14:14] (yeah I have a few older servers, don't judge me, i'm working on porting them to 18.04 servers, it just takes *time*) [14:15] ewww, still running sslv3? [14:15] oh *god* no [14:15] then what do you mean by too old openssl? [14:15] blackflow: ALPN vs. NPN [14:15] needs newer OpenSSL libs to support the ALPN [14:16] oh I keep forgetting about that [14:16] yeah 1.0.2 or newer [14:16] and i have a couple servers that are still on 14.04 so [14:16] mh-hm [14:17] and as an aside I'm an IT security guy, so if I was rolling SSLv3 intentionally I'd probably need to be shot. [14:17] (figuratively speaking) [14:17] *everything* (even my mail servers) are reconfigured to not permit the insecure things [14:18] as it should be:) [14:22] while I generally agree that SSLv3 is bad, disabling it on MXes could lead to emails being retransmitted in the clear if the sender doesn't support TLS 1.0 [14:22] so... basically no loss in security there? :) [14:22] fortunately such senders should be pretty rare nowadays ... or just spammers [14:23] blackflow: I believe that SSLv3 is mostly vulnerable to active attacks which is generally not something that SMTP considers [14:24] things are changing (especially now with Let's Encrypt) but for a long time, most MX to MX communication used self-signed certs [14:24] sdeziel: and another problem is, for that to have any effect, you need to configure your MTA to _require_ SSL/TLS and not just on submission (port 587). [14:25] blackflow: per the RFC(s), you cannot mandate SSL/TLS on TCP/25 [14:25] sdeziel: the problem is certain policies (HIPAA compliance, PCI DSS compliance) require certain things to be configured even on mail servers, last I checked. Including disabling SSLv3 [14:25] ie, for postfix for example, smtpd_tls_security_level at "encrypt" [14:25] but SSLv3 is a problem in and of itself and with various OpenSSL libs and such no longer supporting SSLv3 that's a different issue. [14:25] sdeziel: exactly, so it's a moot point. the MITM can downgrade always. [14:26] one of the reasons why I dislike STARTTLS. [14:26] blackflow: check https://tools.ietf.org/html/draft-ietf-uta-mta-sts-21 and https://tools.ietf.org/html/draft-ietf-uta-smtp-tlsrpt-23 [14:27] well that may be my problem. while I have http2 defined in my config when I curl the site and look at the headers it's an http1 response [14:27] teward: yeah, I agree and I did disable SSLv3 on my MXes too :) [14:27] sdeziel: thanks I'll check that out. [14:29] I also run with dh params at 2048. We had some issues with some clients using old Java to interface with out APIs, but.... they managed to upgrade :) [14:30] blackflow: re StartTLS, see https://tools.ietf.org/html/rfc8314 [14:31] sdeziel: I mean, I still have *optional* encryption (preferred if available) on my MXes, but I follow some of the standard practices and require at least what Mozilla calls an Intermediate grade of security on my web servers. [14:31] s/web servers/mail servers/ [14:31] sdeziel: yeah, no kidding. [14:32] for those using postfix, you can get better than opportunistic TLS on your outgoing SMTP transactions by setting "smtp_tls_security_level = dane" [14:33] sdeziel: guess I learned something. *goes to revise his MXes* [14:34] yeah, DANE is better but... with these things I tend to quote Theo de Raadt. Optional security is no security. [14:35] http://www.postfix.org/TLS_README.html#client_tls_dane [14:35] cpaelzer: what are your plans for merging libvirt? [14:36] and funny for ubuntu people to recommend dane.... given that systemd-resolved and all its troubles with DNSSEC being default in Ubuntu ;) [14:38] blackflow: I'm still wedded to unbound [14:39] I'm to bind, but only because I need authoritative serving and wanna use just one tool. [14:49] rbasak: plan is after vacation [14:49] I have a set of extra todos around it and a trello card to cover those [14:49] also we want mroe than the current 4.3 [14:51] OK [15:39] I already have a PXE environment w/ a full ubuntu image, but would like to be able to drop the OS onto the local disks via an image. I don't need partitioning or anything like that. I don't want to have to boot w/ cloud-init as it is bare metal. Does Ubuntu have anything like this? Would Curtin work? (was not sure how cloud-init plays into it) [15:45] just clone the os to existing partitions? never tried that [15:47] powersj: so, our manpages regeneration thing appears to be working? [15:47] I haven't checked actually [15:47] yep! [15:47] that's neat! [15:47] all the examples in that bug are fixed now [15:48] my crazy sha1 thing [15:48] heh works [17:10] Hello, I've question, does the new ubuntu sevrer 18.04 by default use systemd-resolve, can I turn it of and use the default router or another dns server instead? I'm confused because on 16.04 I never see systemd-resolved listen on port 53 [17:12] qwebirc35817: it uses systemd-resolve by default. systemd-resolve behaves like the Desktop's dnsmasq did, it's just a local caching resolver that will send out to the actual DNS nameserver(s) set in either a static config (with netplan) or with the ones it gets from DHCP. This is 'typical' behavior. [17:12] I tried removing systemd-resolve from the equation and it didn't end well. [17:12] (on a test install) [17:12] qwebirc35817: yup. mask it, unlink /etc/resolv.conf and make it a proper file with whatever nameserver entry you want [17:13] but ^ that [17:13] (I tried that too, it exploded on my test systems, but that was back right before 18.04 release so YMMV) [17:13] teward: that procedure works for me just fine since 16.10 [17:13] the key being unlinking resolv.conf and MASKING, not just disabling, the resolved service. [17:14] blackflow: I believe you. (But like *every* procedure, YMMV because of various reasons) [17:14] I guess. [17:14] I quite like the local caching resolver either way, but that's my opinion :) [17:14] I'm just into deterministic computing and software being bent unto MY will, not the other way around .) [17:14] blackflow: I'm not found any resolv.conf, I only have resolved.conf [17:15] blackflow: To each their own, I guess. [17:15] not every sysadmin here at work, though, knows LInux so I have to adapt so they don't have to do poweruser custom changes :P [17:16] blackflow: Any link that could help me or maybe guide me to approach masking or such? I'm new in ubuntu managing [17:19] qwebirc35817: systemctl mask systemd-resolved [17:19] also stop the service [17:19] blackflow: That mean the systemd-resolved still there right? listen on 53? [17:19] teward: well I don' tknow. computers should serve US, not the othre way around :) [17:19] qwebirc35817: it should not if you stop the service. [17:20] but when I want to solve any domain then it will listen again on port 53 am I right? [17:20] qwebirc35817: also, resolv.conf should be at /etc/resolv.conf, and by default it's a symlink to somewhere under /run/ [17:20] qwebirc35817: no. you set up resolv.conf with proper nameserver entries. I mean that's what you wanted, no? [17:21] you asked if oyu could turn off systemd-resolved and "use another dns server instead2. [17:21] s/2\./"./ [17:23] blackflow: no luck, no resolv.conf I guarantee you.. I confused ~_~ [17:24] qwebirc35817: well create one then. your question seemed to imply that you know what you're doing? [17:24] because if you don't, then maybe just leave it as is? [17:27] hmmm, so when I set the nameserver then it's done, I could just disable systemd-resolved right? [17:28] qwebirc35817: no. not disable. mask it. and stop the service. [17:29] so I put name server on resolv.conf and mask the service then reboot? [17:30] you don't have to reboot. systemctl stop systemd-resolved; systemctl mask systemd-resolved; unlink /etc/resolv.conf ; [17:32] what it just work like that...? [17:32] yeeeees? [17:33] blackflow: Oh God.. why they make it so complicated... -_- why they plant a software like that... -_- [17:33] So does anyone know how cloud-init fits into 'Curtin' and is it required @ boot or how exactly is it used? [17:33] qwebirc35817: that's a mystery indeed. [17:34] looks like it uses cloud-init at first boot, which I spose is fine assuming the metadata is obtained from itself and not a server [17:36] blackflow: okay... how about netplan? [17:37] wondering if I can just use curtin to drop the image on and run some of my own customizations / install grub [17:39] qwebirc35817: what about it? [17:43] I mean set name server on netplan will also work? [17:44] qwebirc35817: probably yes. I'm not really using netplan. [17:44] phibs: there are also #cloud-init and #curtin channels [17:45] qwebirc35817: but I think that will just keep on using systemd-resolved, indirectly. [17:45] qwebirc35817: netplan is just configuration abstraction, it doesn't do anything else. [17:46] nacc: oo thx [18:08] jamespage: in case you come across something similar, flask in cosmic is not working with sahara running under wsgi: https://storyboard.openstack.org/#!/story/2002617 [19:17] jamespage: i think that's fixed now. ^ btw nice little addition to dep8 daemon tests (sahara does it) is a curl of the api port. curl --fail http://localhost:8386 [19:43] trying to understand how britney hints work. Why is there one file per user here? https://bazaar.launchpad.net/~ubuntu-release/britney/hints-ubuntu/files [19:44] are all files just concatenated? [21:30] so I'm trying to setup a static IP in server 18 during fresh install and it's asking me for subnet? I don't recall using this before when I manually configured static IP after install using a guide. subnet has a trailing slash? [21:31] the guide I previously used was this: http://www.configserverfirewall.com/ubuntu-linux/ubuntu-set-static-ip-address [21:31] what should I put for the subnet? [21:31] https://usercontent.irccloud-cdn.com/file/PW8JqOxY/irccloudcapture8578377963037103038.jpg [21:32] madLyfe: yes it is asking for the subnet info all in one line [21:32] so if you used to say 192.168.0.10 and netmask 255.255.255.0 you would now say 192.168.0.10/24 [21:33] ahasenack: aiui, yes [21:33] ahasenack: i don't fully undersand why that is the layout [21:34] nacc: it has to do with permissions as far as I gathered [21:34] there is a conf file that has entries like HINTS_ = [21:34] ahasenack: ah could be [21:34] powersj: I'm not following [21:34] so the directory has a bunch of -named files, and hints inside them [21:34] where does the 24 come from? [21:35] madLyfe: do you know what netmask you previously used? [21:35] https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing [21:35] but let's say I want to suggest a new hints change, which file (which ) do I pick? Any? Go by history or resemblance? [21:35] ahasenack: yeah, i just picked arbitrarily in the past (usually targetting an AA) [21:35] and the wiki page nacc linked has a table that shows how it works [21:35] under IPv4 CIDR blocks [21:36] powersj: 255.255.255.0 [21:39] I should just put that in the subnet field? [21:45] 192.168.1.202/24 ? [21:47] also, what should I enter in the 'search domains' field? [21:47] madLyfe: whatever search domains you want to use? [21:47] madLyfe: we really don't know your network configuration [21:49] i didn't have to use something other than 255.255.255.0 last time so I don't know what it's talking about. [21:49] search domains? like Google? not sure what it's referring to. can I just leave it blank? [21:50] madLyfe: search domains are for DNS [21:50] I didn't need that last time either. [21:50] can I point to the router? [21:50] madLyfe: then don't specify one [21:50] no, i feel like mabye you should google what domain name is? [21:50] I thought name servers were for DNS [21:51] name servers and search domains are different things [21:51] madLyfe: a search domain is entirely optional [21:51] your router might be a name server, but your search domain(s) are used to convert a non-fqdn to a fqdn [21:51] that ^ [21:52] I'm standing on this chair trying to fresh install so kind of inconvenient to research from phone atm https://usercontent.irccloud-cdn.com/file/QlIUZzif/irccloudcapture850488677289019516.jpg [21:54] crossed fingers on the 192.168.1.202/24 front lel [21:55] nice tower ;) [21:55] guess that won't work. says 'has host bit set' ? [21:55] super tower o power [21:56] https://usercontent.irccloud-cdn.com/file/xvj3SpTZ/irccloudcapture6736137959835275668.jpg [21:58] madLyfe: could you capture the screen and share? I never used subuquity [21:59] madLyfe: you used an incorrect value [21:59] madLyfe: you want 192.168.1.0/24 [21:59] madLyfe: 192.168.1.202 is ahost IP address not a network address [22:00] https://usercontent.irccloud-cdn.com/file/x9My6LbC/irccloudcapture4274224174140271545.jpg [22:00] madLyfe: well, i guess it might depend on your actual subnet, but tht's my guess of what you want [22:00] madLyfe: in subnet, if you tried 255.255.255.0 and got an error, try "24" [22:01] sdeziel: it's not a separate field [22:01] iin any case, it's just an invalid subnet specifier [22:01] subnet at router is 255.255.255.0 iirc [22:01] it should be network-address/bits [22:01] I don't know why subnet is even a question [22:02] just putting the address/bits should be enough [22:02] sdeziel: yes, i'm also not sure why it's a separate field, but given that it is you do have to give it valid input :) [22:02] nacc: indeed, 24 or 255.255.255.0 are netmasks so I was wrong [22:03] is there something safe to enter to hopefully not bork it and lock me out? [22:03] the UI doesn't make it clear when a field is optional or required [22:03] 192.168.1.0/24 I believe is what it is expecting the host bits are the fact that you put in a real host IP [22:03] the 192.168.1.202 goes on the 2nd line [22:04] I'd try to leave subnet blank and put 192.168.1.202/24 in the address line. This feels like the logical way so maybe it works :) [22:05] https://usercontent.irccloud-cdn.com/file/503jAmwK/irccloudcapture4490501051520289919.jpg [22:05] there you go [22:06] tyvm guys. *crosses fingers* [22:06] https://usercontent.irccloud-cdn.com/file/upHOsHkP/irccloudcapture263967132717131253.jpg [22:09] I don't like that the DHCP lease is reported without "/24" but the statically configure one does... [22:09] sdeziel: agreed wanna file a bug? https://bugs.launchpad.net/subiquity/+filebug [22:10] powersj: guess where my browser is pointed at ;) [22:10] haha [22:10] will also report the useless "subnet" field [22:11] this is a different installer than I remember [22:11] madLyfe: yes, that's the new live installer (subiquity) [22:12] does this let me pick the packages to use still? [22:13] currently it does not. as a part of being lightweight the tasksel options were removed [22:15] hmm [22:17] madLyfe: could you please review/update https://bugs.launchpad.net/subiquity/+bug/1777729 as I never actually used the live installer so I might have some info wrong [22:17] Launchpad bug 1777729 in subiquity "DHCP leases missing CIDR notation in network config summary" [Undecided,New] [22:18] ok. once I come down off this chair. [22:20] I think I may have a hardware problem. system froze again while trying to do fresh install. happened when copying over the files. maybe it's just the flash drive in running the OS on. trying new flash drive now. [22:23] odd that the servers name can't be uppercase anymore [22:37] sdeziel: im looking over the bug report and it looks good from what i can tell. you are just saying that 192.168.1.86 doesnt have the trailing /24? [22:37] madLyfe: correct. The subnet thing was reported to https://bugs.launchpad.net/bugs/1777732 [22:37] Launchpad bug 1777732 in subiquity "Manual network config uselessly asks for a "Subnet"" [Undecided,New] [22:38] ya i think it should accept both. [22:46] good, thx [22:47] not sure whats up with my server hardware. hopefully its just the ram or something. [23:57] Why does the ubuntu repo tgtd not allow -t to define the number of i/o threads