/srv/irclogs.ubuntu.com/2018/09/11/#ubuntu-server.txt

tomreynty00:02
tomreynkeithzg[m]: it'd be good to discuss which ubuntu version you're running /upgrading from/to there.00:03
keithzg[m]In theory filed a Debian one too, but maybe I screwed up the pseudo-headers since I haven't gotten any automatic reply00:04
keithzg[m]tomreyn: Fair enough, I guess I figured in this case it's so clearly a packaging-related issue that the Postfix version from upstream was the only really relevant part.00:06
tomreyntrue, but still, it'll need to be filed against *something*, and ideally that what the original reporter (you) is using.00:07
keithzgYeah, makes sense.00:08
* keithzg[m] is now tempted to open a wishlist bug for Launchpad itself for adding distro releases to the "affects" options ;)00:09
tomreynthose exist, but unfortunately only those with bug triage + higher access levels seem to be able to set them.00:10
nacctomreyn: keithzg: anyone can request they be added, but only appropriate folks can approve them00:49
tomreynnacc: even wehn logged in, i am unable to set the affected distribution version (codename) on the 'affects' field.01:00
tomreynwhat i can do is 'also affects project' and 'Also affects distribution/package', but neither of these (as far as i can tell) allow me to set the codename of an affected ubuntu release.01:02
ftmh17hello03:10
ftmh17anybody here ?03:12
ftmh17this is so confusing03:12
ftmh17need some help03:13
ftmh17anybody03:13
masonftmh17: State your question(s) and if someone can answer they will.03:17
RoyK!ask03:18
ubottuPlease don't ask to ask a question, simply ask the question (all on ONE line and in the channel, so that others can read and follow it easily). If anyone knows the answer they will most likely reply. :-) See also !patience03:18
masonFine, one-up me.03:18
mason!cn03:20
ubottu如欲獲得中文的協助,請輸入 /join #ubuntu-cn 或 /join #ubuntu-tw03:20
* mason searches scrollback for \![a-z]03:20
=== beatzz_ is now known as elsheepo
lordievaderGood m orning06:05
[twisti]im trying to (temporarily) do the following: on ubuntu server L, i am running a VPN client that allows me to connect to an ftp server F on 192.168.... now, on windows client W, on the same network as L, i would like to connect to F. ideally, i would like to set up L so that W can ftp connect to L as if L was the ftp server, without ever needing to know about the forwarding (because in09:30
[twisti]reality we got lots of Ws that we dont want to configure if we dont have to)09:30
TvL2386we're talking about this in #ubuntu at the moment09:34
TJ-Although apache2-bin (for 18.04) includes mod_http2, do we need to also add a specific "Protocols" directive to enable it?11:15
cpaelzerTJ-: "a2enmod http2" I'd thnik11:26
cpaelzerand11:26
cpaelzerecho "Protocols h2c h2 http/1.1" >> /etc/apache2/apache2.conf11:26
cpaelzerso yes11:26
TJ-cpaelzer: right, I was surprised there's no documentation or a template .conf file for it11:36
TJ-Unless you already know a specific Protocols is required, it might appear "a2enmod http2" is all that is required since there's not an accompanying .conf file11:37
cpaelzerTJ-: do you think having this line in /etc/apache2/mods-available/http2.conf would make sense?12:04
cpaelzerthen a2enmod would enable/disable it along the module12:04
cpaelzerit is sort of hard to "guess" right as the order defines the preferred protocol12:06
cpaelzermaybe the same, but commented out with some text to explain12:06
ahasenackgood morning12:10
TJ-cpaelzer: I think it should be documented in a comment in the .load file, which ought to point to an explanation in /usr/share/doc/apache2-bin/ or apache2/. Adding the Protocol line should be dependent on SSL being enabled /and/ available (probably best in the vhost TLS site definition guarded by a "<IfDefine SSL> -> <IfModule http2_module> ..." stanza )12:24
cpaelzerTJ-: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=88099312:33
ubottuDebian bug 880993 in src:apache2 "enable http2 protocol when http2 module is enabled" [Wishlist,Open]12:33
cpaelzeryou might give that bug a bump essentially asking for the same12:33
TJ-cpaelzer: that looks like someone stole my thoughts :D12:34
cpaelzerwb rbasak12:57
ahasenackcpaelzer: is the systemd task needed in https://bugs.launchpad.net/ubuntu/+source/open-vm-tools/+bug/1791220 ?13:42
ubottuLaunchpad bug 1791220 in open-vm-tools (Ubuntu) "increased crash rate since 10.3 upgrade is available" [Undecided,In progress]13:42
cpaelzerahasenack: no more13:42
ahasenackok13:43
cpaelzerahasenack: done13:43
ahasenackrbasak: hi, wanna take on https://bugs.launchpad.net/ubuntu/+source/mysql-5.7/+bug/1791018 ?comment #3 has a link to a debian commit to make tests on supported platforms fail the build14:04
ubottuLaunchpad bug 1791018 in mysql-5.7 (Ubuntu) "self-test errors do not break the build" [Low,Triaged]14:04
cpaelzerahasenack: the udev timeout change is ready for review as well14:08
Skuggenahasenack: That commit was applied long ago :)14:08
Skuggenahasenack: The question is more if it should be expanded. I did a test to debug the related test issues he reported, to https://launchpad.net/~mysql-ubuntu/+archive/ubuntu/mysql-5.7/+packages, where I changed it so test failures always caused build failures14:10
ahasenackSkuggen: but the bug says the errors do not break the build14:11
SkuggenLooks pretty good, though arm64 is still waiting for a build14:11
ahasenackor was that only for non i386/amd64?14:11
Skuggenahasenack: On unsupported platforms14:11
ahasenackah, ok14:11
SkuggenTest failures currently break the build on i386 and amd6414:11
ahasenackgood then14:11
ahasenackn/m14:12
cpaelzerahasenack: lol - I just see that my MP update is on workspace #8 on the small screen and not submitted. No wonder you asked if the udev changes were ready :-)14:12
ahasenackcpaelzer: do tell14:12
ahasenackI probably made the same mistakey yesteray in a bug I spent 1h troubleshooting14:12
ahasenacknever pressed submit, or maybe I did and lp timed out14:12
ahasenackcomment dropped :/14:12
cpaelzeryeah happened to me as wel lin the past, thought I'm on another window and double-esc killed the update14:14
cpaelzerLP needs something like https://xkcd.com/1915/ with warning sounds each 5 minutes :-)14:14
ahasenackkstenerud: did you see my review comment in https://code.launchpad.net/~kstenerud/ubuntu/+source/postfix/+git/postfix/+merge/354654 ?14:18
ahasenackkstenerud: also, since I grabbed the canonical-server slot there, could you please request another review from canonical-server, so it shows up again in our queue at https://code.launchpad.net/~canonical-server/+activereviews ?14:19
kstenerudok14:23
nacctomreyn: you don't see a "nominate for series" button?15:55
naccahasenack: that's an interesting point too, is that in the doc?15:56
nacc*docs15:56
ahasenacknacc: which point?15:57
naccahasenack: about re-adding the review slots?15:57
naccahasenack: it seems like a common pattern in some cases15:57
ahasenackno, that only happens when a "community review" is done15:57
ahasenackso no, not in the docs15:57
ahasenackactually, in this case it was as if I had taken the canonical-server slot15:58
ahasenackbecause I'm a member15:58
ahasenackn/m the community review comment15:58
ahasenackbottom line, we are not supposed to take the "canonical-server" slot as that is what makes the review appear in the +activereviews queue for that group15:58
ahasenackI wanted to add a comment to the MP, and LP saw I'm a member of canonical-server, and took up that slot for me, even though I just wanted to add a comment15:59
naccyeah, it's something for your team to note16:00
nacci guess is what i meant16:00
naccand will potentially apply in the future too, if we do it via some meta-who-can-upload-label16:01
naccwe actually don't want it to drop off the 'to-review' queue until it's been approved or rejected, i think16:01
ahasenackI filed a launchpad bug about the queue visibility thing16:03
nacccool, maybe add a task for usd-importer, so it also shows up there16:04
naccit's a workflow thing, and i'm not sure what's 'right'16:05
ahasenackthe bug is essentially that the mp shouldn't disappear from +activereviews16:05
ahasenackeven when there are no remaining slots16:05
ahasenackit differs from ~youruser/+activereviews in that regard16:05
naccyeah, i think that's accurate16:09
naccteam vs. user16:09
naccbut i can see an argument for the current behavior16:09
naccthe hard part is you start a review, and then you need to stop it; it's not always obvious what you should put 'back' as the reviewer16:09
ahasenackI want a simple list of open merge proposals16:10
ahasenackthe fact that someone is doing a review isn't closing it16:10
ahasenacksometimes I think LP is overthinking it16:10
ahasenack"reviews I can do", "reviews I'm waiting on", etc16:10
ahasenackthe thing is that here, each package is a "project"16:11
ahasenackessentially16:11
ahasenackmaybe that's confusing things16:11
naccyeah, i agree with you16:17
tomreynno, i don't  <nacc> tomreyn: you don't see a "nominate for series" button?16:20
nacctomreyn: hrm, ok; yeah that's weird16:27
nacctomreyn: should you? i can see it, for sure16:28
powersjnacc, I believe the nominate for series is limited to certain users16:28
tomreynright, i'm just a standard boring user, probably just don't have permission to do so (i *think* i said so when we startzed discussing this).16:37
ahasenackright, I can only nominate for some packages, for many I need to ask someone else. And it's not about upload rights, although the set might intersect that, as I know of other people who can't upload a thing but can accept nominations for anything16:53
ahasenackrbasak: didn't you have a way to launch an openvpn within a network namespace, so that only other processes in that namespace would see the vpn network?17:12
ahasenackor were you attempting that, and never finished?17:12
=== kevr is now known as nvidia
=== nvidia is now known as nvidia-
nacctomreyn: powersj: ah sorry, i misunderstood, i thought tomreyn said they did have permission but didn't see it.17:18
tomreynno, no, i'm just a lousy vagrant, clicking on whatever i can click on.17:21
tomreynso, it's fine as it is ;)17:21
naccheh17:21
ahasenackstgraber: hey, I suppose you have tried to use openvpn inside lxd containers already, right? Found your blog post from 2014 for lxc, not lxd. I'm trying now in a bionic lxd, but I'm getting this error:17:51
ahasenackopenvpn_execve: unable to fork: Resource temporarily unavailable (errno=11)17:51
ahasenackI already removed LimitNPROC=10 from the systemd service file, but no dice17:51
ahasenackany tips?17:51
ahasenackdmesg on the host shows a denied mount attempt by openvpn, which is odd17:52
sdezielahasenack: IIRC the LimitNPROC needs to be removed in the host context17:52
sdeziellast I heard, rlimits were not namespace aware17:53
stgraberahasenack: all I have here is "LimitNPROC=infinity" in an override17:55
stgraberahasenack: but that's under 16.04, it may well be that the unit has since changed in more recent releases17:55
ahasenackI did a grep for NPROC on the host17:56
stgraberahasenack: the mount error sounds like it may be using something like PrivateMount or some similar Private* options?17:56
ahasenackgot this for lxd itself, infinity17:56
ahasenackstgraber: i see privatetmp17:56
stgrabersdeziel: you can apply rlimits in containers, just not ones that are higher than your container's, setting LimitNPROC=infinity on the openvpn@ unit avoids systemd trying to set it to some other value17:56
stgraberahasenack: that may be it, can you try turning that off?17:57
ahasenackdidn't change the denied error17:57
ahasenack[20900.386502] audit: type=1400 audit(1536688629.438:199): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxd-bionic-intel-vpn_</var/lib/lxd>" name="/bin/" pid=31710 comm="(openvpn)" flags="ro, remount, bind"17:57
ahasenack(I did daemon-reload in the container)17:57
sdezielstgraber: ah, that's what I was referring to then, I remembered wrong :)17:57
ahasenacknot sure if that is fatal, though17:58
stgraberahasenack: odd, the comm="(openvpn)" suggests it actually was openvpn itself, that's pretty weird17:58
stgraberahasenack: what LXD version?17:58
stgraberI thought we pushed a change to allow ro,remount,bind17:58
ahasenackerror I have is https://pastebin.ubuntu.com/p/2N3gDqYvC7/17:58
ahasenackstgraber: 3.0.1-0ubuntu1~18.04.117:58
ahasenackbionic17:58
ahasenacknot the snap17:59
ahasenackthe container itself is bionic too17:59
ahasenackthis is an unprivileged container, nothing fancy, no extra devices allowed in the profile18:00
ahasenacknor denied18:00
stgraberahasenack: ok, so 3.0.1 pre-dates that particular apparmor policy fix, so if that DENIED is the source of the issue, we have what should be a fix for it already18:01
ahasenackstgraber: do you have a oneliner to add to apparmor?18:04
stgraberahasenack: https://paste.ubuntu.com/p/msqMCqPm79/18:06
stgraberahasenack: putting that in raw.apparmor should make it behave like LXD 3.0.218:06
stgraberahasenack: alternatively you could set security.nesting to true which would then also allow those mounts18:07
ahasenacklet me try that setting, one liner, and see if that fixes it18:09
ahasenacklxc config set <container> security.nesting true18:09
ahasenack?18:09
stgraberyeah18:09
ahasenackok, no denied error18:10
ahasenackbut it still failed to fork18:10
ahasenacknice, that was live, without restarts18:10
stgraberahasenack: can you show `systemctl cat openvpn@`?18:11
ahasenackstgraber: https://pastebin.ubuntu.com/p/p7Hd3WJX8S/18:13
ahasenackit has 2 changes already: privatetmp=false (was true), and LimitNPROC commented18:13
ahasenackhm18:17
ahasenackthe actual @config service I'm using still has LimitNPROC=2018:17
ahasenackstgraber: worked now18:18
ahasenackstgraber: I changed the wrong openvpn*.service file wrt LimitNPROC18:19
ahasenackthere is openvpn.service, openvpn@.service, openvpn-client@.service, openvpn-server@.service18:19
ahasenackopenvpn-client@.service still had it18:20
stgraberahasenack: oh, that's way more units than I'm used to :)18:22
ahasenackyeah, it changed in bionic, they (upstream) split client and server18:22
stgraberahasenack: the rlimit thing at least should be fixable in systemd by having it detect the error and move on, so effectively letting it set lower values but ignoring higher ones (logging something is fine though)18:30
boxrickHello, I want to get rid of the double quotes in the AWK in this statement. fdisk -l | grep '^/dev/[a-z]*[0-9]' | awk '$2 == "*"'18:31
boxrickAny sensible suggestions ?18:31
boxrickOr even better a sed like alternative18:34
tomreynmaybe fdisk -l | grep -E '^/dev/[a-z]*[0-9][[:space:]]+\*[[:space:]]'18:42
tomreynboxrick: ^18:44
BrianBlazegood day beautfuls, I know how to add a route using route add... but I am unsure exactly where to put the route to make it permanent after a reboot. on ubuntu 1818:45
boxrickThanks tom :)18:45
tomreyn:)18:46
tomreynBrianBlaze: there's no "ubuntu 18", do you mean 18.04.1 LTS?18:47
sdezielBrianBlaze: there is an example on how to add routes in https://netplan.io/examples#multiple-addresses-with-multiple-gateways18:48
BrianBlazeyes I do and tanks18:48
BrianBlazethanks*18:48
tomreynif you're asking about ubuntu 18.10 instead, this will be released in october (as the .10 indicates), ask about it in #ubuntu+118:48
BrianBlazeI mean 18.04.1 LTS :)18:49
tomreyncool. in case you are still going to set routes manually, use 'ip route', not just "route"18:49
BrianBlazeoh? it worked with route... wierd18:50
sdezielroute is the old deprecated way18:50
BrianBlazegotcha18:50
BrianBlazeget used to ip route :)18:50
tomreyn!releasenotes18:51
ubottuUbuntu 18.04 (Bionic Beaver) release notes can be found here: https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes18:51
tomreyn^ would tell so, IIRC18:51
=== led_dark_2 is now known as led_dark_1
kstenerudRegarding https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/101062519:21
ubottuLaunchpad bug 1010625 in logwatch (Ubuntu) "named logs are not being reported in logwatch" [Medium,Fix released]19:21
kstenerudIt looks from the comments that there's a quick fix that can be applied to logwatch to solve 90% of the problems in one go19:22
kstenerudTwo possibilities:19:22
kstenerud1: Remove 'LogFile = messages' from the conf files so that it searches for the locations itself19:22
kstenerud2: Just hardcode syslog instead of messages19:23
kstenerudI'm not sure which is the better solution. Anyone want to chime in?19:23
ahasenackkstenerud: iirc there is some sort of overriding that can happen in logwatch19:25
ahasenackkstenerud: it has config directories, and there is one for distro overrides19:25
ahasenackubuntu has LogFile = <rightthing> in there iirc19:25
ahasenack /usr/share/logwatch default.conf/ and dist.conf/19:26
ahasenackdefault.conf has all its content using "LogFile = messages"19:27
kstenerudSo if that points to the right file, we can remove 'LogFile = messages' from the individual conf files then?19:27
ahasenackif this overriding works as intended, I wouldn't touch that setting in the default.conf/ files19:27
ahasenackI would make whatever changes we have to make in the dist.conf/ tree19:28
kstenerudI'm not up on the history of this. Was everything going to messages before? It looks like things are being sent to syslog in a bunch of (if not all) cases?19:28
ahasenackmaybe all that's needed is setting LogFile=syslog in dist.conf/logwatch.conf?19:28
ahasenackI think messages was just an upstream choice, RH systems I think used to log there19:28
kstenerudBut now for example dhcpcd.conf has Logfile = messages19:32
kstenerudSo that would override the basic config I think?19:32
kstenerud(even though the basic config also sets it to messages)19:33
kstenerudBut if I changed the top level config to syslog, these configs would still set to messages right?19:33
kstenerudThere are 72 config files that explicitly set the logfile19:35
ahasenackdhcpd.conf only exists in the default.conf tree, ok19:35
ahasenackit's my understanding settings in dist.conf override default.conf19:36
ahasenacksee /usr/share/doc/logwatch/HOWTO-Customize-LogWatch.gz19:37
ahasenackin the dhcpd case, it's possible that the dhcpcd package (whatever it's called) ships a logwatch file19:38
ahasenackbut I haven't checked19:38
kstenerudOK I'll take a look. Just need to be sure of how the override rules work (i.e. default/iptables.conf vs dist/ with no iptables.conf - does it take config from the specific conf under default, or does it take the override from dist/top-level-config?)19:39
=== nvidia- is now known as kevr
ahasenackkstenerud: I don't know19:45
ahasenacksome experimenting is needed, looks like19:45
TJ-kstenerud: I wasn't able to reproduce the Strongswan issues despite doing some extensive messing about with it (my issue is a Cisco IOS device not playing nicely with the Linux strongswan, but I also set up a strongswan/charon IKEv1 config to mirror how IOS is supposed to work)20:16
kstenerudTJ-: Thanks. I think since we can't get any confirmation on the bug one way or the other, we'll let it sit for now. Hopefully the bug reporter can get back to us on how to reproduce the issue reliably!20:20
TJ-kstenerud: in other news, persuade everyone to swith to Wireguard. I had the pleasure to deploy it this week and it is a joy to config/use :) I've wasted a lot of my life on configuring IPsec and openvpn!20:22
jellybut does it do p2p if possible?  Oh it seems it does >  the server itself changes its own endpoint, and sends data to the clients, the clients will discover the new server endpoint and update the configuration just the same. Both client and server send encrypted data to the most recent IP endpoint for which they authentically decrypted data. Thus, there is full IP roaming on both ends.20:27
TJ-jelly: of course if both ends change IP address at the same time, whilst not talking, it will fail until poked using "wg set peer <pubkey> endpoint <address>"20:32
jellyI'm currently usi^H^H^Htesting a semi-abandoned vpn that has a central point (of failure) for reregistering itself20:34
kneekiHey all, I'm trying to create a script that checks if apache2 is running and if not start it. https://pastebin.com/rPQ9Tq7Z --- Unfortunately I'm given the error:  line 14: service: command not found ‘service apache2 status’ was was not ‘active (running)’. Executing: service apache2 start20:41
nacckneeki: what version of ubuntu?21:01
kneeki17.1021:02
nacckneeki: systemctl is-active apache221:02
nacckneeki: you're also not checking errors, etc.21:03
kneekioh cool. You're right, I'm not checking for errors. =\21:04
nacckneeki: the reason your output is like that is you are only redirecting stdout21:05
nacckneeki: fwiw, checking the output of `service status` is also wrong, i think you should be looking at return codes only21:05
kneekiAh, that'd be a much better way.21:06
nacckneeki: also, what are you trying to fix? apache crashing?21:09
kneekiI've checked /var/log/apache2/error.log and /var/log/syslog without any luck as to why apache2 seems to be stopping or crashing so I'm making this script to run as a cron job21:10
sdezielkneeki: I don't know if others mentioned it but 17.10 is EOL, just an FYI21:10
kneekiYeah, I intend to update to 18.04.1 - just haven't yet. -.-21:11
TJ-kneeki: systemd units can be configured to restart if it exits21:11
kneekiOh that sounds perfect!21:13
TJ-kneeki: see "man 5 systemd.service" and the "Restart=" option, plus it's associated timeouts, etc21:14
TJ-s/it's/its/21:14
kneekiReading up on that now - thank you!21:16
kneekiLooks like systemd is the perfect solution. Any idea's on how I'd crash apache2 to see if it's working?21:55
TJ-kneeki: you could send the process a SIGTERM, as in "sudo pkill apache2"21:57
raidghosthmm. didnt know that was a valid command. but thanks for the info TJ- ;)21:59
kneekiah delicious. Thanks TJ22:24
keithzgI suppose the difference between pkill and just good ol' killall is that pkill doesn't by default have to match the process name exactly?22:38
nacckeithzg: pkill is a lot more powerful than killall22:46
naccin the sense of control22:46

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!