/srv/irclogs.ubuntu.com/2019/05/21/#ubuntu-server.txt

=== lotuspsychje_ is now known as lotuspsychje
lordievaderGood morning06:10
lucidoning09:05
lotuspsychjelucido: can we help you?09:05
lucidoI can't figure out permissions for sshd. Trying to get pubkey authentiacation working. I execute ssh with sudo (as admin user) and if I sed 600 permissions on the user's autorized_keys then I get can't access file and if I set 755 then I get wrong permissions09:07
lucidothe files in the user's directory have user.user ownership09:07
lordievaderSSH doesn't like it if someone else  that the owner can read the files.09:11
lucidolordievader, how can root(sshd) read the keyfile then?09:13
lordievaderWhich keyfile exactly?09:13
lucidoauthorized_keys09:13
lordievaderOh, sshd runs as root and can therefore read `~/.ssh/authorized_keys`.09:14
lucidoI changed the permission of that file to 640 and added root as group and now it seems to be able to read the keyfile09:14
lucidodebug1: trying public key file /var/services/homes/borg-backup/.ssh/authorized_keys09:14
lucidodebug1: fd 4 clearing O_NONBLOCK09:14
lucidobut it still prompts for passwd09:15
lordievaderYes, because you set it to 640.09:15
lordievaderAuthorized keys file should be 600.09:16
lordievaderrw for only the owner.09:16
blackflowinfact, permissions are not an issue at all. ownership is.09:16
lucidoI see, so now sshd can read the keyfile and it still prompts for password. How can I debug that?09:17
blackflowlucido: look at the server side logs09:18
blackflowlucido: oh btw... what prompts for what password exactly? Sure that's not just the client-side key passphrase?09:19
lucidoblackflow, I entered a null password (no passphrase). Logs show debug1: fd 4 clearing O_NONBLOCK09:21
blackflowlucido: pastebin the full log please. these excerpts out of context are not meaningful09:21
lucidoblackflow, https://paste.ubuntu.com/p/kDvDxJvDk2/09:24
blackflowlucido: looks like the authorized_keys does not contain the key sent from the client.09:25
blackflowwhat exactly did you put into authorized_keys?09:25
blackflowand you can also raise verbosity, iirc invalid keys would be logged. just put LogLevel=DEBUG3, restart sshd and try again09:27
lucidoblackflow, https://paste.ubuntu.com/p/FKPXYWsf96/09:36
blackflowlucido: looks broken, you ahve the same key twice, and the second one doesn't start on its own line09:37
blackflow(look at the raw source, not formatting done by paste.ubuntu.com)09:38
lucidoblackflow, ok, heres the sshd output with -ddd: https://paste.ubuntu.com/p/CcJFN5QMCf/09:41
blackflowlucido: line 114: debug2: key not found09:41
lucidoblackflow, what I did now was, I took the .pub file from the client and copied it's contents into the authorized_keys file on the host09:45
lucidoso now I have in authorized keys: https://paste.ubuntu.com/p/vwkKFdbqwv/09:47
blackflowlucido: where does that new line after "ssh-rsa" come from?09:48
blackflowI don't think that's right. one key should be on a single line.09:48
blackflowopenssh-keygen definitely will not put a newline, so I don't know how you created it.09:49
lucidohttps://paste.ubuntu.com/p/7CdMqRfHFw/09:50
lucidothere is no newline, it's formatting only09:50
blackflowlucido: debug2: key not found09:51
lucidoblackflow, sorry, there was a newline. no clue how it got there09:52
blackflowyup.09:52
lucidoblackflow, now there is no pwd prompt, but I get permission denied. sshd output: https://paste.ubuntu.com/p/PzJkBRtDGR/09:54
blackflowthat output doesn't mention permission denied, it only says the daemon received sigchld and the client closed connection.09:58
blackflowcan you pastebin your effective server-side sshd_config? are you using a ssh chroot setup? are all path members to the user's home dir accessible by the user?09:59
lucidoone sec. very strange, sshd exits if I try to connect to it10:00
lucidoblackflow, https://paste.ubuntu.com/p/TTqhnggMDS/10:02
blackflowlucido: sshd_config doesn't look bad at a first glance. you don't have AllowUser|Group limits, no ForceCommand for sftp-only access. what does the client side say? try using ssh with -vv10:10
lucidoblackflow, I changed the user's shell from nologin to sh on the server and tried again with -vv (no apparent change)10:12
lucidohttps://paste.ubuntu.com/p/st4mHhcbKS/10:12
blackflowlucido: are you sure all path components allow access to the user's home?10:13
lucidoblackflow, yes, I've checked them all10:16
blackflowyou have permission denied right after shell request. so something about that user and that shell and that home dir, is not right.10:17
lucidoborg-backup:x:1033:100::/var/services/homes/borg-backup:/sbin/sh10:17
lucidodrwx------  1 borg-backup            root  336 May 21 10:29 borg-backup10:18
blackflowlucido: it should be /bin/sh10:18
lucidonoooooooooooooooooooooooooo10:18
lucido:)10:18
blackflowso problem solved?10:19
lucidoblackflow, I thought so but no10:20
lucidosame crap10:21
lucidodebug2: shell request accepted on channel 010:21
lucidoPermission denied, please try again.10:21
blackflowtry another shell, like /bin/bash10:21
blackflowlucido: also, by all path components I meant /var and /var/services/ and /var/services/homes/ .... are they rx (read and execute, as dirs) acessible to "borg-backup" user?10:22
lucidonope10:22
lucidoblackflow, for path permissions I checked them all10:23
lucidothey are readable and executable to other10:23
blackflowso 755 all of them?10:23
lucidofound one that is drwx--x--x+ 1 root         root         1.6K May 21 10:06 homes10:24
blackflowcan you also please  ls -la ~/   (feel free to censor sensitive dir names, but not anything else)10:24
blackflowlucido: yup, fix that10:24
lucidoblackflow, it works for another user10:24
blackflowlucido: also check that + .... you have ACLs on that homes dir10:25
* blackflow bets a pizza that's the cause10:25
lucidoblackflow, this is a synology DSM and it ahs it's own ACL version10:25
blackflow......................... so ...................... not ......................... Ubuntu ?10:26
lucidoI think I'm missing some custom permissions on the device that is synology specific and has been granted for the working user and not for this one10:26
lucidosorry, the client is Ubuntu10:26
lucidoforgot to mention...10:26
blackflowand you're asking in #ubuntu-server .......10:26
blackflowif only you could see my face now. thanks for wasting my time.10:26
blackflowgood luck.10:26
lucidothank you for your help so far and sorry for the misunderstanding10:27
blackflowwho knows what kind of crap that synology did there. could be infinite reasons why you have issues. you should've lead with that first, you'd be told immediately we cannot know what synology did there.10:28
lucidoblackflow, I know. I'm sorry11:28
marcoceppiLooking to get some help with TFTP / Preseed for Ubuntu 18.04. I've sync'd down this entire directory: http://archive.ubuntu.com/ubuntu/dists/bionic-updates/main/installer-amd64/current/images/netboot/ and setup tftpd to read it as it's root. I can netboot into an installer but whenever I try to specify a preseed as either tftp or http and made some progress with this preseed file and this boot-screens/txt.cfg: preseed (http://paste.11:30
marcoceppiubuntu.com/p/HXsMDWWQzX/) boot-screens/txt.cfg (http://paste.ubuntu.com/p/rjqDV4Gbd7/)11:30
marcoceppiIs there a better example for this other than https://help.ubuntu.com/lts/installation-guide/amd64/apbs02.html? I've used that example preseed with my own values and the directions covered within11:32
DJ-ArcAngellotuspsychje: heh.. ofcourse there is not "trusty" on old-releases.ubuntu.com11:38
DJ-ArcAngelthink i am screwed11:38
lotuspsychjeDJ-ArcAngel: if you run ubuntu server, please mind the end of life times, try always to upgrade before it11:39
DJ-ArcAngelpls.. do not remind me11:39
DJ-ArcAngeli inherited this shit11:39
DJ-ArcAngeli know about eol11:39
DJ-ArcAngelthis company just didn't care for 8 years11:39
DJ-ArcAngelnow i can fix it11:39
lotuspsychjeDJ-ArcAngel: also take a look at the 16.04 releasenotes alot of new things changed since 14.0411:40
DJ-ArcAngelold-releases goes back to  2006, so why is there no "trusty" ?11:41
DJ-ArcAngelthere is no 14.0411:42
DJ-ArcAngelah11:42
DJ-ArcAngelfound it11:42
lotuspsychjeDJ-ArcAngel: https://wiki.ubuntu.com/XenialXerus/ReleaseNotes11:43
DJ-ArcAngelhmm no11:44
DJ-ArcAngelthat is install cd11:44
DJ-ArcAngelno repo dir11:44
DJ-ArcAngelhttp://old-releases.ubuntu.com/ubuntu/dists/trusty11:44
DJ-ArcAngel40411:45
DJ-ArcAngelguess i will have to re-install11:45
UssatI would reinstall instead of trying to upgrade from that anyway11:48
marcoceppiDJ-ArcAngel: I believe, since 16.04 (and 14.04 EOL) Canonical provides extended security maintenance as a feature of Ubuntu Advantage https://blog.ubuntu.com/2019/02/05/ubuntu-14-04-trusty-tahr However, there is still a trusty in the archive http://archive.ubuntu.com/ubuntu/dists/trusty/ not sure if that helps you11:49
lotuspsychjeid go with Ussat aswell, backup and go fresh 16.04 or 18.0411:50
lotuspsychjewhy take risk of eol/security11:51
Ussatyup...I generally dont like upgrading major versions with prod systems, at verey least, make a snap (assumning a VM) before you try it11:51
DJ-ArcAngelthanks marcoceppi, it's worth a try11:54
DJ-ArcAngelhangs on grub-common again.. i give up12:10
DJ-ArcAngelwill be a rebuild12:10
=== Wryhder is now known as Lucas_Gray
=== PonzoSporrigan is now known as ghost64
=== edwardly_ is now known as edwardly
=== jelly-home is now known as jelly
DJ-ArcAngeli did it!.. damn thing is 16.04 now.. and site has moved off php514:48
DJ-ArcAngelto php714:48
DJ-ArcAngelsystem 0 - DJ-ArcAngel 114:48
=== jdstrand_ is now known as jdstrand
=== ErichEickmeyer is now known as Eickmeyer
figgisHello, I wrote out my question in a paste since it's a bit long winded: https://paste.ubuntu.com/p/WchRcH3fZ4/ tldr; looking for assistance in getting a server with 3 ip's assigned to it. to use the same outgoing ip as the connection was made on. (directed here from #ubuntu)16:53
lordcirth_figgis, firstly, why do you need to have 3 IPs?16:53
DJ-ArcAngelmulti homed.. for webhosting?16:54
DJ-ArcAngelor other services16:54
figgisA few reasons but biggest is I am trying to tie each individual ip to a single user. Which is what the proxy is for.16:55
lordcirth_I suspect there might be easier ways to do what they actually need, than having 3 IPs on the same NIC.16:55
lordcirth_figgis, so, you want to treat traffic differently based on user, and so you give each user a different IP to connect to?16:55
figgiscorrect that is what I am attempting to do. But outgoing traffic is all done under a single ip16:56
figgiswhich is not the goal16:56
weedmichow is it possible my cpus are pegged near 100%, yet the load average is 3.66 3.56 3.61?  https://pasteboard.co/IfKCWFz.png  help me understand16:57
lordcirth_weedmic, The simplified version is, at any given time, on average, there are 3.66 processes requesting CPU time. Load average can easily exceed the number of cores you have.17:02
figgisweedmic - That picture is actually showing a pretty high load averages for 2 cores. Some info on load averages: https://scoutapm.com/blog/understanding-load-averages17:02
weedmicok, it's requests on average - not %/cpu use on average - that was a great answer - ty17:03
rbasakfiggis: so you want that when a user connects to the server, that user can request a SOCKS forward, and those forwarded connections are to be originated from the same IP the user is connected on?17:06
figgisCorrect! Much better way to explain it than I have17:07
rbasakfiggis: and second question: is this to be enforced server side?17:07
figgisNot enforced exactly, just as a default17:07
rbasakfiggis: or is something voluntarily done by the user acceptable?17:07
rbasakOK17:07
rbasakInteresting challenge :)17:08
* rbasak ponders17:08
lordcirth_I am unconvinced that 3 IPs is the best way, but it's certainly do-able17:09
rbasakIdeally sshd/ssh would be configurable to arrange that. I don't think it is.17:09
figgisIn no rush whatsoever :), been pondering this for days. If it's easier to make the incoming connections all on one IP and route outgoing based on user that is acceptable as well. But I don't really see that making much of a difference17:09
rbasakMy next thought is that some advanced routing is possible such that you could key the outbound IP on something. But you'd need some way to connect that to the user.17:10
rbasakhttp://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.rpdb.multiple-links.html comes to mind but isn't exactly the same thing17:11
lordcirth_figgis, what do you need to do differently, based on which user it is?17:11
rbasakfiggis: what if the outbound IP were based on the uid of the originating user process, rather than on the IP the user connected to? Would that be acceptable?17:12
figgisOoh I suppose I could use incoming port as well.17:12
figgisYep that would be completely okay17:13
rbasakThen I think I have a solution for you :)17:13
rbasakTake http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.rpdb.multiple-links.html17:13
rbasakBut instead of pointing to the correct table based on IP, you could do it based on fwmark17:14
rbasakThen in iptables/ip6tables use -m owner --uid-owner ... and set fwmark17:15
rbasaklordcirth_: IPs have reputations, so it seems reasonable for different users to segregated into different IPs. I don't know if that's figgis' reason, but I think that use case at least makes his request a reasonable thing to want.17:17
lordcirth_rbasak, to prevent one user getting the whole server banned? I can see that, yeah17:17
rbasakfiggis: the only catch I have is: will the SOCKS connection originate from the current uid in the case of ssh socks forwarding? I think it will because of privsep and ssh's mechanism for arranging it, but it would need to be tested to be sure.17:18
figgisYeah missed that question lordcirth_, rbasak is correct. I have no intentions of doing anything malicious but I also do want to do my best to make sure my users aren't screwing eachother over without knowingly doing so (which is another problem in itself)17:18
figgisgood question, i'll let you know17:19
rbasakfiggis: so then the uid based method would be even better, since it would work for all user connections and not just the ones originating from ssh socks forwarding17:19
lordcirth_figgis, makes sense. You could also spawn an LXC container with each IP and a daemon for each user, then bridge them all together. The routing would probably be simpler.17:19
rbasaklordcirth_: yeah I was wondering about something along the lines. Rather than a whole container I was going to suggest one network namespace per user, and an sshd operating in each. But I think doing it through the routing tables matches the use case better.17:20
figgisI didn't even think about using containers, yeah. Going to give routing with iptables a shot first and see how this goes and if that doesn't work containers may actually be the best bet17:21
lordcirth_I don't know if it's relevant, but containers would also allow you to move clients to other servers easily, and some other flexibilities17:24
figgisSo to answer the uid questions - the socks5 connection does correctly have the users uid when creating the connection as a specific user17:26
figgisthe container idea is growing on me now though :P17:26
figgisawesome though, think I got what I needed so far. Thank you for the suggestions all17:26
rbasak\o/17:39
rbasakI can't think of a way to ensure that each container only uses the assigned IP, assuming that all three IPs are on the same interface. That's what's putting me off the container idea.17:39
rbasakPerhaps pushing everything into a bridge and using iptables would work.17:40
* codefriar thinks iptables is confusing af17:42
lordcirth_rbasak, what do you mean? If the containers are bridged onto the same physical NIC, they will each have their own MAC, and the host bridge will act like a switch.17:52
rbasaklordcirth_: I mean that each container configures its own interface, so one user could "take over" the IP of another.17:57
rbasaklordcirth_: to avoid that either some different configuration is required, or some enforcement at the bridge.17:57
lordcirth_rbasak, but the users don't have root in the container, as I understand it? They are just connecting to a SOCKS proxy?17:59
codefriarI have an interesting situation. I've a nearly constant running process taking 55% of a cpu core. dpkg-reconfigure -f noninteractive slapd any idea on how to fix that?18:01
lordcirth_codefriar, how long has it been running?18:02
codefriar54 hours18:02
codefriarlordcirth_ since shortly after the last boot time18:02
lordcirth_codefriar, I would SIGTERM it and run it again interactive18:02
rbasaklordcirth_: yeah, fair enough if they don't have root.18:07
codefriarlordcirth_ so interestingly enough, slapd isn't installed.18:08
lordcirth_codefriar, could it have been rolled back when dpkg-reconfigure failed?18:09
catbadgerhi all18:09
catbadgerI have a docker container based off of wheezy. I built apache1 and mod_perl 1.3 from source in there, but apache1 isn't starting. anyone know how to start it?18:12
lordcirth_catbadger, If it's wheezy, why is this an #ubuntu-server question?18:15
sarnoldcatbadger: at this point I think you're the apache 1 expert :)18:19
sarnoldyou've worked more with it in the last month than anyone else in thelast decade I think..18:19
tomreynrbasak: it's rather late, but do you think we could have a short notice on mysql defaulting to socket authentication on new installations on the 18.04 release notes? during the past ~ week (maybe 10 days) alone, i saw three people asking (in #ubuntu) how they could login because there was no password set.18:19
catbadgersigh18:21
catbadgeroh look i r'ed the f'ing m.18:21
tomreyn(the change seems to have been introduced in 5.7.20-2)18:21
rbasaktomreyn: yes, please edit. This rings a bell - perhaps we release noted this in a previous non-LTS release that we could copy the notes from?18:23
tomreynyou mean a non lts?18:24
rbasakIsn't that what I said?18:25
tomreynoh it's in 16.04's18:26
* rbasak is puzzled by the question18:26
rbasakAh18:26
rbasakIf we did it in 16.04, it's probably not correct to release note it in 18.04.18:26
lordcirth_Yeah, I thought this was default in 16.04 too?18:26
rbasakBut you could point people asking to the 16.04 release note even if they're using 18.04.18:26
tomreynsorry yes you said "non-LTS", i need to re-learn to read18:26
tomreynyup, will do so from now on18:27
rbasakThank you for the idea and for checking!18:27
tomreyni was really thinking this hadn't been introduced in 16.04, yet18:27
tomreynhttps://wiki.ubuntu.com/XenialXerus/ReleaseNotes#MySQL_5.7 prooves me wrong there18:28
tomreynthe news-file link is a 40418:28
rbasakIt's moved to Salsa18:28
tomreynright, i'll see if it can find the new location18:29
rbasaktomreyn: https://salsa.debian.org/mariadb-team/mysql/blob/mysql-5.7/debian/master/debian/NEWS18:29
rbasakPerhaps it should be tied to the commit like the old link18:29
rbasakhttps://salsa.debian.org/mariadb-team/mysql/blob/14349b00e322f0448f80b2fe472596620349f413/debian/NEWS18:30
tomreynhmm thats a different commit hash?18:33
rbasakIt's the hash of the blob I think.18:33
rbasakThe commit hash will encompass it.18:33
rbasakTo verify you'd need to use ls-tree the commit hash, etc.18:33
rbasak(commit tree -> source tree -> debian/ subdirectory tree -> NEWS file blob)18:34
tomreynhttps://salsa.debian.org/mariadb-team/mysql/blob/1025a9fa9c6c112913c59138db49dbc94891d20f/debian/NEWS uses the old hash18:34
rbasakOh18:34
rbasakThat might be more correct depending on the version?18:35
tomreyni have no idea what i'm doing, just clicking ;)18:35
rbasakAh :)18:35
tomreyni'll point to your link in https://wiki.ubuntu.com/XenialXerus/ReleaseNotes#MySQL_5.7 - ok?18:36
rbasakrmadison says the bionic release pocket has 5.7.21-1ubuntu1, so the release note should refer to that.18:36
rbasakSo I think my link is the correct one.18:36
rbasaktomreyn: yes please - you could just edit the old link18:36
tomreynoh i think putting it into the bionic release notes is actually nonsense now that we learnt that it had been in the xenial release notes already18:37
tomreynso i'm suggesting to just fix the link on the xenial release notes18:37
rbasaktomreyn: agreed18:37
=== Sveta is now known as Guest9492
=== svetlana is now known as Sveta
rbasaktomreyn: your wiki link above said Xenial, not Bionic :)18:37
tomreynyes, but you said "rmadison says the *bionic* release pocket has 5.7.21-1ubuntu1, so the release note should refer to that."18:38
tomreynso i wanted to point out i'll edit the xenial release notes, not bionic's18:39
rbasakOh18:39
rbasakSorry!18:39
rbasaktomreyn: in that case _your_ link is the correct one.18:40
rbasak(of the blob hash)18:40
tomreyngreat. all fine, thanks for your time.18:40
rbasaktomreyn: thank you for double checking :)18:40
tomreynthe same, thanks :)18:45
xibalbain netplan, what is the option to modify the search domain18:48
xibalbacan't find it for the life of me18:48
xibalbafound it18:50
blackflowlife saved!18:55
DammitJimis it true that openjdk 8 will be supported by Ubuntu until 04/2021?19:17
lordcirth_DammitJim, it's in main on 16.04, and universe on 18.04, so it's guaranteed support until 16.04 EOL19:21
lordcirth_Which would indeed be 202119:21
DammitJimoh ok, thanks!19:24
DammitJimand then for openjdk 11 there is no EOL< right?19:25
lordcirth_!info openjdk-11-jdk bionic19:28
ubottuopenjdk-11-jdk (source: openjdk-lts): OpenJDK Development Kit (JDK). In component main, is optional. Version 11.0.3+7-1ubuntu2~18.04.1 (bionic), package size 1953 kB, installed size 2072 kB19:28
lordcirth_If it's in 18.04 main, then at a minimum it's supported until 18.04 eol19:28
lordcirth_!bionic19:28
ubottuUbuntu 18.04 LTS (Bionic Beaver) is the 28th release of Ubuntu and the current LTS release. Download at https://www.ubuntu.com/download - Release Notes: https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes19:28
lordcirth_2023 at a minimum.19:29
DammitJimgotcha19:30
DammitJimoh, but if i wanted to run openjdk-11 on an Ubuntu 16 server, that wouldn't be supported, right?19:30
lordcirth_!info openjdk-11-jdk xenial19:31
ubottuPackage openjdk-11-jdk does not exist in xenial19:31
lordcirth_!info openjdk-10-jdk xenial19:31
ubottuPackage openjdk-10-jdk does not exist in xenial19:31
lordcirth_Apparently not?19:31
DammitJimblah19:31
lordcirth_But 18.04 is already out, so I don't see why you'd need to?19:32
DammitJimthere are some issues associated with 18.04 for me... (other dependencies)19:32
DammitJimlike tomcat 719:33
lordcirth_Ah, I see19:34
catbadgerwhoop apache1 running with mod_perl1.3 in docker on 18.04 whoop!20:36
catbadgerit 500's and the project does not stand up yet though. have to figure out what they were doing in their dumpster to host this fire.20:36
sarnoldoh man :(20:38
catbadgerlol20:40
catbadgerhaha20:41
_KaszpiR_:D20:41

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!