[07:13] Good morning [08:21] Hello, why does my getty@tty1.service file keep getting overwritten? using ubuntu server 16.04.5 LTS [08:41] What service file are you editing? [08:42] getty@tty1.service [08:42] /etc/systemd/system/getty.target.wants/getty@tty1.service [08:44] munsking: On 18.04 the `getty@` service is defined in `/lib/systemd/system/getty@.service`. [08:44] lordievader: and on 16.04.5? [08:45] oh it's the same, it's just a symlink [08:45] still, why does it get overwritten every week or so? [08:46] Most likely in the same path. However, if you want to override the service definition, I'd put the overrides in `/etc/systemd/system/getty@.service.d/.conf`. [08:47] all i really need is for tty1 to auto login, get a kerberos ticket and start a remote desktop application on a windows terminal server (camera surveillance) [08:48] right now i edit the getty@tty1.service file, change the execStart to 'agetty -a remoteUser %I $TERM' and then it works [08:48] so how would i get that part to stick? [08:53] * lordievader sent a long message: < https://matrix.org/_matrix/media/v1/download/matrix.org/UDMsNYWzpncPLnTPUKtWLJHS > [09:04] lordievader: thanks, i'll give that a shot [11:04] good morning [11:05] hi ahasenack [11:05] hello OerHeks [11:30] Hi ahasenack, OerHeks [11:32] hi there [11:32] good afternoon, as it is in my timezone :-D [11:42] indeed [12:23] rbasak: hi, could you please import pgaudit and add it to the whitelist? [12:23] ack [12:23] it's from universe, but touched everytime postgresql is uploaded [12:24] in dep8 dependent tests [12:24] and it likes to fail [12:24] rbasak: thanks [12:36] ahasenack: imported and pushed. As usual the whitelist change won't take effect until I next roll something through to the importer. [12:36] cool, thanks [14:03] cpaelzer: have you seen this pgaudit dep8 failure before, that only occurs on s390x? https://pastebin.ubuntu.com/p/ZkVpFhWgjT/ [14:12] ahasenack: doesn't ring a bell [15:43] how to remove multiarch or disable it in preseed file? [16:00] die7: in case you're referring to amd64 (native) and i386 (foreign): dpkg --remove-architecture i386 [16:43] tomreyn: in preseed file? [16:43] tomreyn: dpkg is not available during installation [16:44] die7: you could do it with the post installation script hook, i forgot the exact name. but i'm not sure this is the right approach, there may well be a better one. [16:45] tomreyn: I found already solution, thank you...soultion can be solved with seed file at self [16:45] tomreyn: d-i apt-setup/multiarch string [16:46] much nicer [16:46] tomreyn: if you leave befind string empty i386 will not be added [16:48] ok, good to know === tobias-urdin is now known as tobias-urdin_afk [17:53] So, I see 16.04 is FIPS 140-2 compliant. Any idea if 18.04 will be? [18:10] Woah, I didn't realize you could install windows 2016 headless... I wonder if that'll mess up security... [18:11] oops, wrong window. XD === tobias-urdin_afk is now known as tobias-urdin [18:50] how do I create a new nic on Ubuntu Server 18.04LTS with no ip (as in accordance to this tutorial for Snort Inline IPS: http://sublimerobots.com/2016/02/snort-ips-inline-mode-on-ubuntu/)? [18:56] TheHonorableKitt: this is probably the best starting point https://netplan.io/examples#bridging [18:56] TheHonorableKitt: try throwing in dhcp4: no dhcp6: no and not specifying addresses [18:56] lets see what happens ;) [18:58] I would personally opt to disable_ipv6 on it too [18:58] not sure if netplan can do this natively [19:01] of course, if you don't specify *anything* probably the nics won't have addresses that way, too :) [19:01] but finding some way to document and codify that they intentionally don't have addresses feels like a good idea [19:01] and if you're going to be using a bridge anyway, well, this knows how to make them [19:02] like this? https://paste.ubuntu.com/p/tvT3wHYG59/ [19:04] or maybe change 2 and 3 to 1 and 2? [19:04] you've got an enp0s3 so having an eth0 eth2 and eth3 feels unlikely.. [19:05] huh? [19:05] what are you NICs named now? [19:05] errrrr I don't know? eth0? this is a linode VPS [19:05] run 'ip a' [19:05] that'll show you the NICs on the system [19:08] https://paste.ubuntu.com/p/Vd4wYKW8g9/ [19:08] there are two 'docker' nicks that are down, and then l0 for loopback [19:08] this is the only useable eth nic [19:12] you can fake up NICs using tun/tap stuff (often for VPNs or VMs) but I don't know an awful lot about how those things work [19:12] does the management panel let you add more NICs? [19:12] it lets me add "private ip address" but other than that, no [19:14] TheHonorableKitt: Linode VMs only have a single NIC AFAIK so is that what you want to feed to snort? [19:14] yes, but snort needs to have more than one nic to work for inline mode [19:16] are you intending to feed it via VPNs? [19:16] no? I'm running my websites on the same server as my snort setup [19:16] inline mode seems to be for creating transparent bridges [19:17] so long as I have two (or three?) nics, snort inline mode bridges them for me [19:17] but that's where I'm stuck, I don't know enough about linux to properly create two new nics [19:17] I know it can be done, but I'm not understanding how [19:17] as you can see here: http://sublimerobots.com/2016/02/snort-ips-inline-mode-on-ubuntu/, that's the case, but it doesn't elaborate in this particular portion of the instructions [19:18] TheHonorableKitt: is your end goal to inspect the traffic hitting your web server? [19:18] yes [19:18] I have snort working for IDS already, but I want more than an IDS, and to get an IPS, I need more nics [19:18] TheHonorableKitt: then inline mode doesn't seem like a good fit, unless you run it on a machine that's not your web server itself [19:19] I don't think there's a way to get an IPS without inline mode [19:19] TheHonorableKitt: I don't think you require more NICs [19:19] errr hm? [19:19] sure, it could just pcap packets on the one nic you've got.. [19:19] you can probably have NFQUEUE setup in iptables so that snort decides of the faith of the packets [19:20] yeah I haven't even got a clue how to do that [19:20] sdeziel: dude. http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node7.html#SECTION00254000000000000000 [19:20] sarnold: yes? [19:21] nice 404 error? [19:21] sdeziel: I had a a vague idea that there was probably something better than pcap but couldn't have named it ;) but there it is, nfqueue :) [19:21] TheHonorableKitt: I'm a little more familiar with suricata so here's an example with multi-nics: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux [19:21] TheHonorableKitt: should be easily adaptable for a single NIC for your use case where the web server is local to the IPS [19:22] sarnold: hehe [19:22] let me take a look real quick :) [19:23] I guess what's confusing to me is how snort handles the data. It pics up on eth0, but is it supposed to loop back around and drop it back off on eth0 again? wouldn't that cause an endless loop? I think it's supposed to pick up on eth0, bridge eth1, and drop it off on eth1 [19:23] TheHonorableKitt: in fact, it touches on the "host" scenario too [19:24] at the bottom of that writeup, it requires two nics [19:24] eth0 and eth1 [19:24] TheHonorableKitt: the transparent bridge is for a different use case [19:25] TheHonorableKitt: the link covers 2 scenarios, search for "host" aka scenario #2 [19:26] TheHonorableKitt: in the host scenario, you work with INPUT/OUTPUT instead of FORWARD [19:26] oh hmm [19:26] they even mention TCP/80 handling ;) [19:28] ah ok, I see. they just didn't separate the two scenerios into two portions, they're kind of mentioned together a bit [19:28] that's where I was confused :P [19:28] I think the issue now is...how do I get this to work with snort? [19:30] let me look at this: http://sublimerobots.com/2017/06/snort-ips-with-nfq-routing-on-ubuntu/ [19:30] suricata is compatible with snort rules IIRC ;) [19:31] I'm not using suricata :) [19:39] I am so incredibly confused [19:40] If I run these iptables configs for nfqueue, will it kill my network connection? I'm not sure if there's a config I need to have setup in snort to make sure it's filtering them, because I *think* if it's not actively filtering, then the connections are all just dropped [19:41] TheHonorableKitt: I would suggest to only send TCP/80 to snort, not the whole thing [19:41] I'm hosting a lot more than TCP 80 on my server [19:42] I'd start with TCP/80 then and ramp this up as you gain confidence in the setup [19:42] I'll do that, but better to use 443 than 80, since my server only works with 443 [19:42] it's auto-re-reouterd to 443 from 80 [19:42] what exactly will snort read out of TLS streams? [19:42] well, what is it that you want to inspect on TLS? [19:43] old proto/ciphers? [19:44] very little is worth looking at on TLS, and this will only shrink as TLS 1.3 is deployed [19:44] (I'm looking at your OpenSSL 1.1.1 backport to 18.04) [19:44] s/your/you/ [19:44] :) [19:45] It might be important to know what snort is actually for, it's an intrusion detection system, and in inline mode, an intrusion prevention system. The rules in snort far exceed that of http and https. So, it needs to be a global system. No point in doing port 80 since it's auto-forwarded to 443 anyway, so I don't know, maybe I can do port 22 then or [19:45] better yet icmp [19:46] encrypted protocols are less interesting to look at [19:47] I'd honestly rather someone who knows what they're doing to look at this for me, as I'm completely clueless on how to even use snort, or for that matter, how to configure linux network information. [19:48] if you want to go whole-hog, feel free. the worst that can happen is you wind up having to hit the 'delete vm' button and start over :) [19:49] not a change, I always make backups ;) :D [19:49] on Linode you have a remote serial console available (LISH is the name IIRC) so hopefully the snort deployment won't go that bad [19:49] oh sweet [19:49] that makes it way less likely you'll need the 'delete vm' button :) [19:49] :P it's sweet when I'm not at work hehe [19:50] I'm at work right now, only way I can even terminal in is with a webssh tool [22:00] jamespage: we should have everything core + dashboards uploaded for stein now except horizon itself. i pushed all the updates i made but it needs django-debreach which will be a new package. component-mismatches should be fixed up now too. [23:22] so what I did earlier really screwed up my setup, I need to get someone to help me and look at my iptables rule file (I have it save persistently, so just rebooting won't help). I need to manually remove whatever is screwing up my system. Can someone please volunteer to help me? [23:30] TheHonorableKitt, might be useful to restate the core problem as well [23:30] since not all of us know the actual problem you are facing right now [23:32] sure thing, so I was trying to set SNORT into inline IPS mode, but I only have one IP (well, now I can have three, I might need it). anyway, someone said I can just add a few iptables rules for NFQEUE and snort will run those [23:32] I added those rules, and it killed my entire box's connection. now I can't figure out how to remove them [23:36] how did you add them? [23:37] iptables -I INPUT -j NFQEUE [23:37] and [23:37] iptables -I OUTPUT -j NFQEUE [23:37] andyour iptables ruleset currently is what? (and where on the system) [23:37] if you can share your iptables rulesets in a pastebin I can take a look [23:37] and ID what rules you have to remove to get traffic working again [23:38] not sure if you can do that easily though if you have no networking [23:38] i'll share the file with you directly, I don't want to paste it here [23:41] i can't DCC here on IRC currently [23:41] and I didn't say paste it here [23:41] i said use a pastebin [23:41] and then PM me the link :P [23:49] TheHonorableKitt: if you use "iptables --line-numbers -nvL" you can use the line-number of the rule to delete it with "iptables -D

" [23:49] TJ-, he's not got it in his stored rulesets all he has to do is iptables-restore < ... the ruleset [23:50] and it would then get rid of the nfqeue rules heh [23:50] Ahhh [23:51] line-numbers is useful info anyhow; many folks don't realise it's there [23:51] mhm [23:51] not sure why he won't share his rulesets since there's nothing secret in those rulesets that'd ID his box as a target anyways but meh [23:51] TJ-, woah that's a THING? [23:52] *learned a new thing* [23:52] I generally try to be as secure as I can, I fail a lot, but good practice means good I suppose [23:53] so the iptables-restore command, what should I run with that? never ran this before [23:53] i assume this ruleset is stored in a file on disk, yes? [23:53] yeah [23:54] sudo iptables-restore < /path/to/ruleset/file/on/disk [23:54] /etc/iptables/rules.v4 and rules.v6 [23:54] and that's it [23:54] so then: sudo iptables-restore < /etc/iptables/rules.v4 [23:54] and: sudo ip6tables-restore < /etc/iptables/rules.v6 [23:54] and you're done [23:54] alrighty, I might lose connection in a sec ;) lol we'll see [23:56] ok, ufw is enabled, looks like I'm all good [23:56] phew [23:57] so linode gave me two additional ip slots, should I use them to get snort inline IPS to work? [23:57] if you added NFQEUE rules into the ufw configs find them and yank them out [23:57] or do I not need them? [23:57] it was only in iptables [23:57] otherwise your box should talk to the internet fine [23:57] good [23:59] the iptables and restore ive also used,however someway ruleset alway get reset on reboot,now im using systemd script with iptables-restore command,any tip on what might cause this?