/srv/irclogs.ubuntu.com/2019/03/07/#ubuntu-server.txt

Ham62_how do I roll back to the pervious server version after installing an update05:37
=== Ham62_ is now known as Ham62
Ham62I had a server running 12.04 fine and it kept nagging me to update so I just finished the update to 14.04 and after it booted into the login screen the entire display is just white with little black outlines where text is supposed tobe05:38
Ham62I can't read anything so I want to roll back to 12.04 so at least the local terminal is usable05:38
Ham62this is what I get when it boots: https://i.imgur.com/BKvV5yq.jpg05:40
Ham62I typed in the username and password at the top and this is the greeting message with the bash prompt on the bottom05:40
Ham62I don't have any GUI or anything installed this is just running on the text mode05:41
lotuspsychjeHam62: 12.04 is end of life05:45
Ham6214.04 has brought the end of usability to my system so I think that I don't have much choice05:45
lotuspsychjeHam62: its not a good idea to upgrade from an eol version, would you still trust it?05:46
Ham62I don't need the latest security updates and everythign I'm just using it on my LAN05:46
lotuspsychjeHam62: also, 14.04 will be eol soon too05:47
lotuspsychjeHam62: would be wise backing up your data and start fresh 16.04 or 18.0405:47
Ham62you think that doing further updates would fix the video issues going 12 -> 14?05:48
lotuspsychjeHam62: you just said your on inside lan? sno not connected to internet?05:49
Ham62it has internet but it has nothing ported forward05:49
lotuspsychjeHam62: then its not wise to upgrade from eol05:50
lotuspsychje!eolupgrade05:50
ubottuEnd-Of-Life is the time when security updates and support for an Ubuntu release stop, see https://wiki.ubuntu.com/Releases for more information. Looking to upgrade from an EOL release? See https://help.ubuntu.com/community/EOLUpgrades05:50
lotuspsychjebut its your system Ham62 we can only advice05:50
Ham62my media center PC on my TV is still running XP and has no issues it's not going to become part of a massive botnet just from having a connection behind a firewall05:51
lotuspsychjeHam62: a firewall isnt a 100% proof of not getting exploited05:52
Ham62if no one is connecting into you you won't get exploited05:53
Ham62if there is no access point for them to exploit you you can't be exploited05:53
Ham62and I'm not running a web browser or anything connecting to other sites so it won't get malware that way05:54
lotuspsychjeHam62: what makes you so sure nobody connects you on your EOL server?05:55
Ham62because I have nothing ported forward05:56
Ham62there is no way to access this system from outside the LAN05:56
lotuspsychjeHam62: you receive updates to your server right05:56
Ham62when I tell it to05:56
lotuspsychjeso your connected05:56
Ham62this is the first time installing an update to it in 2 years05:56
lotuspsychje!usn05:57
ubottuPlease see https://usn.ubuntu.com/ for information about recent Ubuntu security updates.05:57
lotuspsychjecheck how many exploits out there on eol versions05:57
Ham62I see lots of exploits for escaping a virtual machine05:58
Ham62which 1) requires running the native code on the VM and 2) having a VM installed05:58
Ham62and PHP vulnerablility which again you need to be running a PHP server ported forward05:58
lotuspsychjelisten im not gonna kee argue, i advice you a fresh 16.04 or 18.0405:59
lotuspsychjeif you decide upgrading to 14.04, in a month its also eol and youl need to upgrade to 16.04 anyway06:00
lordievaderGood morning07:48
kstenerudWho would be the person to talk to about debugging incorrect systemd configurations?08:11
kstenerudAs in, figuring out why systemd reports things like: Failed with result 'exit-code'08:12
kstenerudor: -- The result is RESULT.08:13
cpaelzercoreycb: thank you for the testing08:17
blackflowkstenerud: depends on the package, perhaps start with a bugreport08:28
kstenerudit's with corosync, which I'm taking over. But first I need to debug why the service fails to start08:29
kstenerudbut it looks like systemd is getting faked info in the result codes, which makes this difficult to debug08:29
blackflowor it can't tell because it's a forking service08:30
blackflowideally with sd, wherever possible daemons should run as Type=simple or notify if it supports that08:30
blackflowthat's why I said start with the package, as I've seen packages with forking type where it shouldn't have been. nginx, redis just to name the two recent examples. and hell, redis even supports notify08:31
kstenerudhmm looks like it's type notify08:32
blackflowI guess the service is not informing systemd properly then. is there a specifc application log?08:34
kstenerudthere is, but it's empty08:35
blackfloware there any confinements? ProtectSystem= ? seccomp fileters? disable temporarily all confinements?08:36
ksteneruduhh... sorry where would I find those?08:36
blackflowin the service unit file08:36
kstenerudNothing like that I can see: https://pastebin.ubuntu.com/p/YvTDpTXVdq/08:38
blackflowkstenerud: can you pastebin the output of journalctl -xe   right after you attemp to start it and it fails?08:40
kstenerudsure hang on08:41
blackflowgoogle can't seem to find any mention of it supporting systemd notify. usually daemons have a config option you can flip to tell them they're run under systemd and they should enable the notify API, I don't see that for corosync08:42
kstenerudhttps://pastebin.ubuntu.com/p/TMfRKMgYrk/08:43
blackflowkstenerud: try Type=simple.  that -f in the unit means "start application in foreground".  Maybe it just does not support the notify api08:44
kstenerudok let's see...08:44
kstenerudwow! It was just that??? Crazy. It works now08:47
kstenerudthanks!08:49
blackflowyou're welcome. it'd be wise to get yourself acquainted with systemd manuals and documentation if you're gonna maintain packages like that.  use the systemd.directives(7) manapge as reference point for all the config directives08:53
kstenerudok, thanks08:59
siavoshkcHi. I have a django server running correctly as I see. But in the log I see some errors:13:30
siavoshkc[Thu Mar 07 13:54:57.251327 2019] [wsgi:error] [pid 6129] Not Found: /13:30
siavoshkc[Thu Mar 07 13:54:57.617238 2019] [wsgi:error] [pid 6129] Forbidden: /quest/13:30
siavoshkc[Thu Mar 07 16:50:07.829690 2019] [wsgi:error] [pid 6129] Not Found: /favicon.ico13:30
siavoshkc[Thu Mar 07 16:55:09.896277 2019] [wsgi:error] [pid 6129] Forbidden: /quest/13:30
siavoshkc[Thu Mar 07 16:55:09.898376 2019] [wsgi:error] [pid 6129] Not Found: /13:30
siavoshkcIgnoring favicon.ico, I don't know about the others13:31
ahasenacksiavoshkc: looks like a scan for vulnerabilities13:32
Ussatyup13:32
siavoshkcWho is scanning?13:32
UssatWe see that wen our infosec scans also13:32
ahasenack"the internet"13:32
siavoshkcSo its noise13:32
siavoshkcMy security is rock solid.13:34
UssatThats what is normally said right before a hack13:36
masonGod Himself could not sink this ship.13:37
Ussat"Titanic Baby"13:43
leftyfbsiavoshkc: How do you know your security is rock solid if you don't understand what you see in those logs?13:43
Ussatjust stop with the logic leftyfb13:43
rbasakcpaelzer: confused by the posgres MRE. I thought we concluded that we wouldn't revert the ABI change as it's a "produces bad data" bug otherwise?14:03
rbasakIs this a different ABI change? What happened to the one we previously discussed?14:05
siavoshkcleftyfb: Good question.14:06
cpaelzerrbasak: I stated that in the bug, the "(potentially) produces bad data" change wasn't the ABI changing rename14:18
cpaelzerI only found that when sitting down and trying to prepare the checks for the extensions14:19
rbasakAh14:19
rbasakI read your comment 19, but I couldn't find anything referring to the bad data bug.14:19
cpaelzerlet me check which one #19 was14:20
cpaelzerrbasak: yeah the "other" change - that one about the client_min_messages would have a chance to cause bad data14:21
cpaelzerrbasak: which is not the ABI one14:21
cpaelzerrbasak: but, that client_min_messages has to be used incorrectly to cause that problem14:21
cpaelzerrbasak: unfortunately comments are immutable so we have a bunch of misleading comments collected over the time we worked on this :-/14:21
cpaelzerrbasak: the bug description should have the most current and most reasonable description14:22
cpaelzerrbasak: I made sure I mentioned all that in Regression potential14:22
cpaelzerin fact let me add something very important that I thought about last night14:22
rbasakcpaelzer: which bit of the regression potential refers to the bad data bug?14:23
cpaelzerrbasak: adding that as well more clearly14:25
cpaelzerrbasak: updated the description again to hopefully be even better now14:28
cpaelzerrbasak: the important bit I added on my own is the fact that by our choices we don't CHANGE anything on the two debated commits14:30
cpaelzerwe take the MRE minus those two14:31
cpaelzerwhich makes the MRE less regression-likely14:31
rbasakcpaelzer: got time for a HO please? I'm still confused - trying to correct my old understanding with the corrections I think. A HO will probably be quickest.14:38
cpaelzerrbasak: I'm in one already, I'll ping you once I'm ready14:39
rbasakack14:39
coreycbsahid: i've uploaded cinder, nova and swift to the bionic unapproved queue for bug 1818069 where they're awaiting review by the sru team: https://launchpad.net/ubuntu/bionic/+queue?queue_state=1&queue_text=14:48
ubottubug 1818069 in swift (Ubuntu Bionic) "[SRU] queens stable releases" [High,Triaged] https://launchpad.net/bugs/181806914:48
coreycbalso pushed to https://code.launchpad.net/~ubuntu-server-dev/+git14:48
coreycbthanks for those14:48
sahidcoreycb: thanks14:50
ahasenackcpaelzer: I added X-Python3-Version: 3.7 to d/control16:15
ahasenackcpaelzer: the XS- variant is for python 2 only16:15
ahasenackI still get the warning about ${python3:Versions} being unused, well, it's really ununsed16:15
ahasenackyour suggestion was to add it like X-Python3-Version: ${python3:Versions} (you mentioned the XS- variant, though)16:16
ahasenackright now, I think ${python3:Versions} expands to 3.7 only, or something like >= 3.7, < 3.8 (have to check)16:16
ahasenackI didn't find the text "python3:Versions" in the dh_python manpage, nor in https://www.debian.org/doc/packaging-manuals/python-policy/ch-module_packages.html16:17
ahasenackrbasak: do you know something about that?16:17
ahasenackthe warning we are talking about is:16:17
ahasenackdpkg-gencontrol: warning: package python3-tdb: substitution variable ${python3:Versions} unused, but is defined16:17
rbasakahasenack: where's the source please?16:19
ahasenackrbasak: https://code.launchpad.net/~ahasenack/ubuntu/+source/tdb/+git/tdb/+ref/disco-tdb-1.3.1816:19
ahasenackI didn't commit the "X-Python3-Version: 3.7" change to d/control16:20
ahasenackbut it's literally that line16:20
cpaelzerahasenack: I haven't found the string in the man page either16:20
cpaelzerahasenack: I only got there by grepping through all kind of packages and seeing them use it at that attribute16:21
ahasenackI see16:21
ahasenackmy single example on my disk:16:21
ahasenackapparmor/apparmor/debian/control:XS-Python-Version: ${python3:Versions}16:21
cpaelzerahasenack: http://paste.ubuntu.com/p/kmxSdrYwyP/16:22
ahasenackthat is even incorrect, the policy says to use X-Python3-Version for python316:22
cpaelzeryep16:22
cpaelzerthat would be http://paste.ubuntu.com/p/NKvgnfqKdm/16:23
cpaelzerand http://paste.ubuntu.com/p/CmxKBsvQ9n/16:23
ahasenack"Similarly, the optional fields X-Python-Version or XS-Python-Version were used to specify the versions of Python 2 supported by the source package. They are obsolete and can be removed now that only Python 2.7 is supported."16:24
ahasenackat least that grep showed them being used for python216:24
tewardahasenack: uhm21:40
tewardthe Debian bug?  I doubt it'll be acted on21:40
tewardAIUI, we shouldn't be updating units to *specifically* target network-online.target21:40
tewardwrt https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/181857421:40
ubottuLaunchpad bug 1818574 in nginx (Ubuntu) "Nginx cannot bind static IPv6 address on boot" [Low,Triaged]21:41
tewardahasenack: and the workaround AFAICT is to bind to all v6 *and* the IP they specifically want; at least, per Maxim's suggestions on that thread for workarounds21:41
tewardahasenack: and network-online.target *might* not solve the issue, necessarily, AIUI because 'network online' isn't clearly defined either.21:41
sdezielteward: I tried binding to all IPs (listen [::]:443...; + listen [2001::...]:443...;) and it didn't work. Have you tried what Maxim suggested?21:42
sdezielI was kind of surprised that NGINX didn't support IP_FREEBIND21:43
sdezielbut maybe I'm doing it wrong21:43
sdezielas soon as I add the 2001::... IP to an interface, nginx is happy again21:45
tewardsdeziel: not recently i haven't checked.  Her'es a question, does Apache support IP_FREEBIND as well?21:46
tewardif *they* don't then the question is "Why should NGINX" (from NGINX's perspective)21:46
tewardif none of them support it then the question is why not?21:47
sdezielteward: because it's really handy in HA setups21:47
lordcirth__sdeziel, on ipv4 I had to enable nonlocal_bind in sysctl. Perhaps there's a similar option?21:49
lordcirth__This was for HAProxy + keepalived21:49
sdeziellordcirth__: yeah, I think the sysctl key make it works for v4 but I haven't tested21:50
sdeziellordcirth__: apache2 is happy binding a non-existent v4 once the sysctl is turned on21:51
tewardsdeziel: but not without that set in sysctl?21:51
lordcirth__Without that set, the kernel will reject the syscall. Program doesn't get a choice.21:52
sdezielteward: nope and I couldn't find a way to tell Apache to explicitly use IP_FREEBIND21:52
tewardif kernel is 4.3+, then in theory net.ipv6.ip_nonlocal_bind would exist.21:52
tewardsdeziel: then that's probably why NGINX isn't using it - nobody is.21:52
tewardlordcirth__: see my sysctl message two lines up21:53
lordcirth__Yeah I saw it, thanks21:53
tewardsdeziel: test if setting net.ipv6.ip_nonlocal_bind lets Apache or NGINX bind to nonexistent v6?21:53
lordcirth__It exists on my 18.04 machine21:53
tewardi'm currently on my commute so I cna't pull an image down for lxd/21:53
tewardto do testing21:53
sdezielteward: wow, I wasn't aware of that sysctl, works with Apache21:53
tewardsdeziel: Google Is My Friend!21:53
teward*shot*21:53
teward(found it at https://serverfault.com/questions/236626/how-to-bind-a-non-local-ipv6-address)21:54
lordcirth__Btw, sysctl variables set in LXC don't persist properly in 16.0421:54
lordcirth__They do in 18.04, though21:54
tewardlordcirth__: LXC or LXD?21:54
tewardand I have an 18.04 host and use 18.04 containers usually ;)21:54
lordcirth__It's a systemd version thing21:54
lordcirth__So probably both21:54
tewardah21:54
tewardthat darned systemd evil!21:54
teward:P21:54
sdezielteward: and it also works with NGINX21:54
tewardsdeziel: i'm not yet willing to suggest that we change sysctl but I'll propose that as a workaround21:55
lordcirth__I hacked it into an 'up' line in eth1.cfg :P But now that's gone, yay21:55
sdezielteward: yeah, that's opt-in behavior IMHO too21:55
lordcirth__Why wouldn't you change sysctl?21:55
lordcirth__Or do you mean by default in Ubuntu?21:55
tewardlordcirth__: i mean by default21:55
tewardsdeziel: this is also why I'm not a huge fan of IP_FREEBIND because this sounds a lot like 'opt-in' behavior21:55
tewardnot 'should be default' behavior21:56
sdezielteward: would make good, ExecStartPre lines21:56
tewardHA isn't exactly a common setup.21:56
lordcirth__Ah, yeah I think normally I would want things to fail if I mess up their IP config, not silently do nothing21:56
tewardsdeziel: example of such lines? so I can add examples21:56
sdezielteward: sec21:56
sdezielteward: https://paste.ubuntu.com/p/gvCcP7JxZY/22:00
sdezielteward: as for nginx and IP_FREEBIND, I would have assume it was just another listen arg that needed to be added22:00
tewardsdeziel: possibly.  I've opened a Trac ticket upstream, to get reasoning, but I'm pretty sure it's easier to, on an as-needed basis, set the proper sysctl rules on individual systems/servers rather than rely on NGINX implementing it22:03
tewardthat said, my focus recently has been work related things and working on my coredev application.22:04
sdezielteward: good luck on that coredev application!22:11
tewardit ain't filed yet :p22:11
teward(est. 3 weeks out at most from filing the application officially)22:11
The_ActorGuys, I am looking to find a good distro to build a webserver on, and due to recent privacy issues (Cannonical deciding to collect info and share with third parties without concent) have been hesitant to try Ubuntu. Are there such issues on the server products? Also does Ubuntu offer a Virtulization server, as in full-on web interface LXE/KVM management like Antsle and RedHat Virtulization23:00
The_ActorServer? Thanks23:00
sdezielThe_Actor: do you have pointers to info collection done without consent?23:03
masonThe_Actor: I think that's largely historical.23:05
masonsdeziel: I suspect he means the Amazon search results from 14.04.23:06
masonOr... whatever version it was.23:06
sdezielso much for recent23:06
masonI'm just guessing.23:06
GerowenWhich wasn't "collecting information" even then, it just forwarded search results to Amazon and displayed relevant results in the Unity menu, and had an option to be disabled.23:07
GerowenI mean it forwarded search "queries" to Amazon23:07
The_Actorsdeziel: I dont understand the question "do you have pointers to info collection done without consent?"23:08
masonThe_Actor: He was confused because the issue is somewhat historical at this point.23:08
sdezielThe_Actor: which privacy issues are your referring to?23:08
UssatDude, internet.......basically toss privacy out the window23:09
masonAnd then there's stuff like popcon.23:10
The_ActorI recently saw a video on YouTube by somone reviewing Ubuntu, he stated that desktop search results and part of the index are sent to Canonical. A later video I saw Richard Stallman making noise that Ubuntu is sharing this with third parties . . .23:11
sdezielThe_Actor: OK so that confirms what mason was saying, that's old, not really controversial (if you ask me) and desktop only23:12
The_ActorI see23:12
sarnoldwho knew that using the 'search amazon' feature would send search queries to amazon :)23:13
The_ActorSo I am trying to decide between building an LXE Ununtu Server Image or an LXE SUSE image for a webserver platform. Is there anything that would give Ubuntu a clear advantage over SUSE?23:14
sarnoldwhat a crazy time to be alive23:14
The_ActorWould there be any advantages to say managing Apache on Ububtu, or perhaps good security profiles?23:17
sarnoldboth ubuntu and opensuse have apparmor23:18
The_ActorNo clear winner then?23:21
sarnolddepends upon whether you prefer apt or zypper, deb or rpm, other packaged tools, etc.23:21
The_ActorI guess I would want whichever is cleaner and has less of a history of destroying a working system23:22
sdezielThe_Actor: best is probably to try both23:22
The_Actormaybe23:22
sdezielcause clearly asking in here will come with a certain bias...23:23
sarnoldfrom personal experience, I've had one reiserfs3 tree destroyed on suse, and one 16.04 -> 18.04 upgrade go poorly (but recoverable). advantage to ubuntu there. :)23:23
tomreynubuntu LTS may have a longer free support life.23:23
tomreyn*lifecycle23:23
The_ActorI just need something with a clear cut guide that sticks to the distros standards so I dont have large gaping security holes on a public facing test webserver23:24
tomreynopensuse leap "is expected to be maintained for at least 36 months, until the next major version of Leap is available", ubuntu LTS releases get security + bug fixes for 5 years23:25
The_ActorGood point. Is Ubuntu LTS commonly used as a Webserver OS?23:26
tomreynthere are many web servers which run on ubuntu.23:26
The_ActorInteresting . . . Do you know of any web hosting business who use Ubuntu LTS?23:28
The_ActorI thought it was mostly a RedHat, SUSE, and CloudLinux23:28
sarnoldthe last numbers I've seen suggested roughly 60% of the workload on the major cloud platforms is ubuntu23:29
The_Actorwow23:29
sarnoldmillions of ubuntu machines come and go every day23:29
sarnoldred hat certainly owns US federal contracting23:30
sarnoldsuse does great in europe23:30
The_ActorAre there any specific management tools that make Ubuntu diffrent?23:31
masonRed Hat is in a lot of the infrastructure. Then you can run anything atop it, and that tends to include a lot of Ubuntu.23:32
masonAs I understand it.23:32
The_ActorI see23:32
sarnoldmaas is great for managing fleets of bare boxes; juju for orchestrating workloads on various clouds; landscape for per-server views; lxd for container-based hypervisor kinds of things..23:32
sarnoldof course you can probably run lxd on rhel or sles too; I'm less sure about juju and maas23:33
The_ActorIs there a Web Based LXD / KVM management system?23:33
masonI haven't heard of Juju before. Is it equivalent to OpenShift?23:33
sarnoldmason: give me a second to learn about openshift :)23:33
masonAh, it is.23:33
masonsarnold: Both Kubernetes.23:33
sarnoldmason: juju's not specific to kubernetes.. or at least it wasn't last time I used it :) heh23:34
sarnoldmason: cool, thanks23:34
masonAh, I'll have to learn more then. New to me.23:34
sarnoldmason: we'll use juju twice on a single cloud, even :) once with maas as the provider, to stand up the openstack cluster, and then again using openstack as the provider, to run the workloads on the cloud :)23:35
masonAh, cool.23:36

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!