[00:16] hi all, I am installing new ubuntu server on a headless machine. If I select "install security updates automatically", will this restart the machine after the updates are installed. [00:18] ironpillow: no, it won't [00:18] ironpillow: the motd should be amended to add: [00:18] *** System restart required *** [00:22] so this WON'T restart correct? [00:23] correct [00:23] sarnold: thanks! [00:23] $ uptime [00:23] 00:23:33 up 155 days, 5:08, 3 users, load average: 0.00, 0.00, 0.00 [00:23] heh, that machine's been up a lot loonger than I expected [00:26] awesome! [00:32] On that topic, random thought, what would I dpkg-reconfigure if I wanted to change that option on an existing server installation? Say I didn't enable automatic updates, and I want to. [00:42] Gerowen: I *think* apt-get install unattended-upgrades ought to do the right thing === gnomethrower is now known as wings [06:00] Good morning === mIk3_09 is now known as mIk3_08 [12:33] ugh, I seem to have forgotten which package I need for being able to ./configure [12:37] nvm, im an idiot. forgot about autoconf [12:47] hello,i was wondering when using syctl command would options applied then be reset on reboot and to make it persistent i should edit /etc/sysctl.conf instead? [12:47] Greyztar: yes, /etc/sysctl.conf or even better a custom file under sysctl.conf.d [12:48] blackflow, thanks, i tried to do sysctl --write net.netfilter.nf_conntrack_buckets=$((${conn_count}4)) which seemed to not work after reboot thanks for asnwer (,") [12:49] Greyztar: btw that expression won't work in the .conf [12:50] blackflow, im trying to apply another option aswell,could i perhaps do paste and link what im trying to do so you could sort review it? [12:51] sure [12:53] im trying to limit connections using conntracked module with these two options and an rule in iptables https://paste.debian.net/1082777/ [12:54] Greyztar: where does ${conn_count} come from? [12:55] yeah i did some copy pasteing erhm,i dont think its supposed to be there ,i followed i guide ,cant find it no more though,think its just the value [12:56] would that make sense? [12:56] it doesn't. I suggeest you don't set any permanent sysctls if you don't know what you're doing. You'll lock yourself out of the server. [12:57] blackflow, yeah ill see if i can find the guide again,good advice also i didnt really think that one through [12:57] has xinetd been removed in 18.04? [12:59] !info xinetd bionic | nope: [12:59] nope:: xinetd (source: xinetd): replacement for inetd with many enhancements. In component universe, is extra. Version 1:2.3.15.3-1 (bionic), package size 112 kB, installed size 318 kB [12:59] oh, nifty, thanks [13:00] then again, there's systemd, so maybe you don't need it at all [13:04] is there a way in ufw to set 'ufw default deny' on one interface and 'ufw default allow' on another? [13:18] just wondering,how long could i possibly stay on 18.04 before it stops getting updates? [13:21] thought i read somewhere there was an option to still receive updates after the lts period was over? [13:22] Greyztar: 5 years, and then optionally pay up for ESM for anotehr 5 [13:22] (in total that is, since 2018. "after LTS period was over" you'd need to pay for ESM) [13:23] blackflow, ohh its paid alrighty thanks [13:25] blackflow, its the Ubuntu Advantage i need to buy then right? [13:27] seems the only option,good to know its an option to get support beyond lts if ever needed though [13:32] Greyztar: yup, Ubuntu Advantage. [13:48] Sigh.....RHEL Removed the ability to do JUST krb auth against a AD domain in 8 without joining the domain, looks like I will be useing more Ubuntu [13:48] lol [13:48] Ussat: sounds like RHEL did an evil [13:49] Well......ya [13:52] I use quite a bit of Ubuntu right now === svetlana is now known as Sveta [14:01] Not sure I would call it evil....just......ew [14:04] when i set tracking state with iptables like NEW,RELATED,ESTABLISHED the connection needs to fullfill all of those right not just NEW for an example? [14:04] Greyztar: the connection needs to match *one* of those to be matched. [14:05] at least AIUI [14:05] but I might be wrong [14:05] RELATED,ESTABLISHED tend to go together [14:05] NEW won't have the other two IIRC> [14:05] but don't quote me fully on that [14:05] teward, thank you for informative answer,it got a little confusing hehe [14:06] Greyztar: per the manpage, I use conntrack and --ctstate which state: statelist is a comma separated list of the connection states to match. Possible states are listed below. <-- this doens't necessarily say it must match ALL [14:06] but that any of the states in the list are matchable [14:07] (manpages are fun, iptables-extensions manpage) [14:07] haha [14:07] yeah i should read more man pages just often i end up not wiser i tend to over complicate what i read [14:18] People : hi ! I'm trying to automate the installation process with a preseed file. THings seems to work so far (ubuntu 18.04 LTS server), but the language and keyboard selection. What is the prefered way to have this automated also ? [14:21] geodb27: append this to your kernel line: locale=en_US console-setup/ask_detect=false keyboard-configuration/layoutcode=en console-setup/layoutcode=en keyboard-configuration/xkb-keymap=us [14:25] Thanks a lot for your answer leftyfb. I'll give it a try when my in-progress installation is done. [14:55] im wondering,is the snapd stuff useable in production? [14:59] Greyztar: depends on what you expect of the "production" :) For example, snaps auto-update, making them useless on servers in my book. [15:00] I limit snap usage to configuration utilities, like kubectl and stuff [15:03] blackflow, im just wondering if its ment for production though in term of it being stable and not experimental and such,some time ago i wanted to migrate my own server from Ubuntu to Debian but couldnt get lxc to work so didnt bother,though using snapd now i got it working =) [15:04] i also noticed the lxc version in snapd is 3.13 and on my 18.04 server its 3.0.3 [15:05] if i migrate i will miss the easy live kernel patching from Ubuntu though,thats some awsome feature [15:13] Greyztar: I say use apt packages where possible, and snaps only if there's no apt package (for the version you want), and of course if the auto-update regime is okay with you. [15:14] For me, snaps offer no advantage, if there's an apt package. Any "isolation" one can achieve with snaps is doable with systemd options, apparmor and other tech, which is 100% under your control. [15:14] For example, I dislike that I can't customize AppArmor profile of snaps. [15:14] I thought you could? [15:14] overwritten on next update [15:15] blackflow, thank you for informative answer,i really didnt know about the auto update feature im not a fan of that so have to look into it [15:19] If I want non-apt packages that I can update ahead of LTS, I use Nix [15:24] noticed my snap program still worked after disableing the snapd service itself,maybe it could work by just enabling it every now and then with cron for updates? [15:25] or maybe its a reason it auto updates and ill end up with a broken system [15:33] snapd.service is the update mechanism [15:33] snaps should work, though, without snapd.service enabled [15:34] OerHeks, nice thanks! [15:57] oh so pretty specific question... I'm running a cpanm install (Apache::SSI) for mod_perl1.3, and it's asking for the location of httpd (on repeat forever)... is there some way to preload this via bash? [16:11] echo "httpd location" | cpan install blah [16:11] echo "httpd location" | cpan install blah -T [16:26] this snap stuff is kinda neat though,i got lxc 3.13 installed on my tiny arm router. Containervisor on 22 dollar equipment i find sweet although its really slow =) === mason is now known as ChibaPet === ChibaPet is now known as mason