| mahdi_ja | hi all | 04:40 |
|---|---|---|
| mahdi_ja | i want create a sftp server with ubuntu 18.04 | 04:40 |
| mahdi_ja | i have a second hard and i want user save file in this hard not /home/username directory | 04:41 |
| mahdi_ja | how i can do this ? | 04:41 |
| lordievader | Good morning | 06:11 |
| === cpaelzer__ is now known as cpaelzer | ||
| frickler | jamespage: coreycb: we are seeing a regression of https://bugs.launchpad.net/ubuntu/+source/neutron/+bug/1790598 on neutron 2:12.0.6-0ubuntu2 on xenial | 08:16 |
| ubottu | Launchpad bug 1790598 in neutron (Ubuntu Xenial) "metadata service calls to nova-api-metadata with IP based SAN's fails" [Low,Triaged] | 08:16 |
| frickler | the reason seems to be that https://review.opendev.org/599541 was removed from debian/patches, but it got merge upstream only into 12.1.0, not in 12.0.6. also doesn't seem to affect bionic due to newer python libs probably | 08:17 |
| === Wryhder is now known as Lucas_Gray | ||
| jamespage | frickler: indeed it was - sahid ^^ | 12:02 |
| jamespage | sahid: metadata-use-requests-for-comms-with-nova-api.patch was not included in the upstream release for 12.0.6 | 12:03 |
| jamespage | so we'll need to re-instate that patch OR superceed quickly with 12.1.0 | 12:03 |
| jamespage | coreycb: fyi ^^ | 12:04 |
| sahid | jamespage: i'm rebasing stable/queens to 12.1.0 right now | 12:16 |
| rafaeldtinoco | good morning o/ | 12:23 |
| lordievader | 👋 | 12:26 |
| mettiu | hi everyone, i'm looking for a "guideline" for building a custom webserver (nginx + php). my doubts are about how to best configure service users, using or not www-data, how to best configure folders, log path, etc... for separating different website. i'm in a protected environment (not commercial hosting) so my users are mainly developers of the c | 12:50 |
| mettiu | ompany, so a classic shared webserver for different application :) any help apreciated | 12:50 |
| kashyap | Hi, folks. | 13:12 |
| lordievader | I like the containerized + haproxy setup for websites. Each website has its own container, haproxy figures out what traffic to send where. | 13:12 |
| kashyap | Who can help make this small change to the edk2 package: https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/1836859 | 13:12 |
| ubottu | Launchpad bug 1836859 in edk2 (Ubuntu) "RFE: Ship the firmware "descriptor files" as part of the 'ovmf' package" [Undecided,New] | 13:12 |
| kashyap | The current maintainer seems to be away on PTO. | 13:12 |
| kashyap | And I don't know Ubuntu enough to 'query' for other maintainers. (I come from Fedora land :-)) | 13:13 |
| kashyap | It requires someone vaguely familiar with QEMU (and EDK2/OVMF). | 13:13 |
| sahid | coreycb, jamespage: https://git.launchpad.net/~sahid-ferdjaoui/ubuntu/+source/neutron/log/?h=stable/queens | 13:19 |
| coreycb | sahid: on it | 13:19 |
| sahid | coreycb: buildroot: https://launchpad.net/~sahid-ferdjaoui/+archive/ubuntu/bionic-queens/+build/17334854 | 13:19 |
| sahid | also i had to remove two patches which were already included: https://pastebin.ubuntu.com/p/TCP78jC2tK/ | 13:20 |
| cpaelzer | kashyap: IMHO we have time to wait for dannf | 13:21 |
| cpaelzer | kashyap: this is a feature tied qemu 4.1 which means Ubuntu 20.04 | 13:21 |
| cpaelzer | I tihnk rushing something into edk2 now will gain us nothing but probably problems | 13:21 |
| kashyap | cpaelzer: Hmm. I'm coming here and pestering because I'll be away on PTO (from 06-Aug to 23-Aug). And Nova could use it | 13:22 |
| cpaelzer | kashyap: but could it use it without any related commit in qemu? | 13:22 |
| kashyap | cpaelzer: Note that is not strictly tied to QEMU 4.1 -- you can still use them with older QEMU versions. | 13:22 |
| cpaelzer | I haven't checked the details, only have seen that it came with 4.1 (in the bundled rom release) | 13:22 |
| kashyap | cpaelzer: If you have libvirt 5.3 or above, then you can use them with older QEMU | 13:22 |
| cpaelzer | kashyap: can one "benefit" from it without qemu 4.1 | 13:23 |
| cpaelzer | we are on libvirt 5.4 already | 13:23 |
| cpaelzer | and I have talked with Dannf before his PTO | 13:23 |
| kashyap | cpaelzer: Good question :-) I'm doing this to be able to test Nova's Secure Boot spec in the OpenStack Gate: http://specs.openstack.org/openstack/nova-specs/specs/train/approved/allow-secure-boot-for-qemu-kvm-guests.html | 13:23 |
| kashyap | cpaelzer: If you see the JSON files: they simply describe the features of the EDK2 binaries that you ship in Ubuntu. | 13:24 |
| cpaelzer | yeah | 13:25 |
| cpaelzer | but doesn't that mean that you can already test it right now manually? | 13:25 |
| kashyap | cpaelzer: libvirt 5.3 or above will read them, and then will auto-add the relevant bits if you want Secure Boot | 13:25 |
| cpaelzer | by dropping matching json files in place (manually) and see if things work | 13:25 |
| cpaelzer | if they do add it to the bug which will help dannf to ensure what is placed will be the correct content | 13:25 |
| kashyap | cpaelzer: Oh, sure. But just trying to set things in motion while I still have the motivation :-) | 13:25 |
| cpaelzer | I absolutely appreciate that part of it :-) | 13:26 |
| cpaelzer | and I now undertsnad why you are in a hurry (your PTO timing) | 13:26 |
| cpaelzer | in motion things are already, since we both reached dannf and he acknoledged to do it after he is back | 13:27 |
| kashyap | cpaelzer: As we speak, I'm harassing the QEMU packager on #qemu, asking what he meant in his comment at the end of a similar request: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=932269 | 13:27 |
| ubottu | Debian bug 932269 in ovmf "Ship the firmware "descriptor files" as part of the 'ovmf' package" [Normal,Open] | 13:27 |
| kashyap | cpaelzer: Hehe, sorry, I should've made my motivation clearer. | 13:27 |
| kashyap | cpaelzer: Okido. Just wanted to check in here, as things tend to fall through the cracks, as everyone is busy :-) | 13:28 |
| cpaelzer | kashyap: this is a curcular dependencyas dannf is the maintainer | 13:28 |
| cpaelzer | mjt as well, but he is more the qemu than the edk2 maintainer (usually) | 13:28 |
| kashyap | Right, I just asked 'mjt' on #qemu. Will check later | 13:29 |
| kashyap | cpaelzer: Also, I hope Ubuntu is now shipping a "variables files" (VARS) with default UEFI keys (from MS) installed | 13:29 |
| cpaelzer | kashyap: /usr/share/OVMF/OVMF_VARS.ms.fd | 13:30 |
| kashyap | If you're not aware; disregard my remark -- that's a detail 'dannf' knows -- I described to him a few weeks ago on #debian-qemu (on OFTC) | 13:30 |
| kashyap | cpaelzer: Ah-ha, the 'ms' is presumable with MS keys. It can't be anything else | 13:31 |
| kashyap | Last I checked I knew that Ubuntu was shipping the script we wrote to enroll the MS keys. (Noticed in the tarball here: https://launchpad.net/ubuntu/+source/edk2/0~20190309.89910a39-1ubuntu1) | 13:31 |
| kashyap | So all good there. | 13:32 |
| cpaelzer | kashyap: this was from 0~20190606.20d2e5a1-1ubuntu2 | 13:32 |
| cpaelzer | kashyap: give your test a try by manually placing the json files | 13:32 |
| kashyap | cpaelzer: Noted, on the version. | 13:32 |
| cpaelzer | kashyap: and if it works with the libvirt 5.4 that is in Eoan (maybe with modifications to the json files) update the bug on edk2 to let dannf know that this makes sense for Eoan | 13:33 |
| cpaelzer | he might (as I was) assume that this is only needed in 20.04 | 13:33 |
| kashyap | cpaelzer: But ... note that: simply dropping in there doesn't _quite_ fly: as I don't know (unless I look in the code) if Ubuntu's EDK2 build differs in anyway than Fedora (the I'm familiar with) | 13:33 |
| cpaelzer | the only differens seem to be paths right? | 13:33 |
| kashyap | Because based on that you (the "mythical you") need to add or remove some lines from the "features" bit. | 13:34 |
| kashyap | cpaelzer: That's what I'd expect, frankly | 13:34 |
| kashyap | For example, see for Fedora, the "features' its EDK2's MS-signed binary (called: OVMF_CODE.secboot.fd) has are these: | 13:34 |
| kashyap | + "features": [ | 13:34 |
| kashyap | + "acpi-s3", | 13:34 |
| kashyap | + "enrolled-keys", | 13:35 |
| kashyap | + "requires-smm", | 13:35 |
| kashyap | + "secure-boot", | 13:35 |
| kashyap | + "verbose-dynamic" | 13:35 |
| kashyap | --- | 13:35 |
| kashyap | Now I don't know if they match 1-1 in Ubuntu. 97.83% yes, they _should_ match. | 13:35 |
| cpaelzer | kashyap: which would be perfect to be outlined on the bug | 13:36 |
| cpaelzer | even if you make assumptions you can provide this example from fedora and the link to the openstack usage of the feature and the result of your testing | 13:36 |
| cpaelzer | I'm sure dannf will prefer to change a few features than to blindly guess adding something totally untested | 13:36 |
| kashyap | Right, will do. Once I replenish my "yak trimming" quota :-) | 13:37 |
| cpaelzer | hehe | 13:37 |
| cpaelzer | kashyap: just trying to guide you to the progress that you poked this channel for :-) | 13:37 |
| kashyap | Certainly; just joking, as you know. Much appreciated. | 13:38 |
| cpaelzer | sure, np | 13:38 |
| coreycb | sahid: i think we should just add back the missing patch(es) for now and the SRU team will be more likely to fast-path this into -updates | 13:52 |
| coreycb | sahid: and then we can do a 14.1.0 after that | 13:52 |
| coreycb | sahid: s/14/12/ | 13:53 |
| sahid | coreycb: based on jamespage comments both ways were OK. can you taking care of adding that patch? I'm still with the horizon thing and i would like make progress | 13:55 |
| coreycb | sahid: ok i think i'll just do 2:12.0.6-0ubuntu3 for now with the patches added back then. sorry i think it'll just be easier to convince them to fast track it this way. how's horizon? | 13:57 |
| sahid | coreycb: yes that makes sense, just question, in all cases they will ask for a complete tests, no? | 13:59 |
| coreycb | sahid: that's a good question which is frustrating in this case. perhaps frickler can help us verify the fix. | 14:00 |
| coreycb | sahid: frickler: fyi https://bugs.launchpad.net/ubuntu/+source/neutron/+bug/1838263 | 14:01 |
| ubottu | Launchpad bug 1838263 in neutron (Ubuntu) "neutron 2:12.0.6-0ubuntu1 queens regression" [Undecided,New] | 14:01 |
| sahid | coreycb: if we have to provide a complete test i think we should fo with 12.1.0 | 14:01 |
| coreycb | sahid: that's a valid point. frickler any chance you'll be able to help with verifying a new version of neutron to verify the queens regression is fixed? | 14:02 |
| frickler | coreycb: I agree that going forward with 12.1.0 is the better solution, I can test new pkgs once you build them. | 14:06 |
| coreycb | frickler: if we want to get a fix out ASAP i think we just need to add the patches back for now | 14:07 |
| frickler | coreycb: well we did fix things locally, so for me this isn't urgent | 14:08 |
| frickler | coreycb: but I could test that variant too, of course | 14:09 |
| coreycb | frickler: thanks, that would be very helpful | 14:10 |
| coreycb | frickler: and we'll get 12.1.0 out right after this | 14:10 |
| sahid | coreycb: I'm lost I thought the outcome of the discusion with frickler what to move forward and only provide a new version based on 12.1.0, no? | 14:18 |
| sahid | s/what/was | 14:19 |
| coreycb | sahid: we'll just add the single patch back and fast path that through with testing from frickler. and then we'll follow that with a 12.1.0 that we'll test ourselves. | 14:19 |
| coreycb | sahid: less chances of further regressions that way | 14:20 |
| m_tadeu | hi...I'm creating a cron job but I think I'm getting into problems with wildcards (find <somedir> -type f -name '*.tar.gz' -mtime +2 -exec rm {} \;) | 14:29 |
| m_tadeu | is there an alternative to this? | 14:30 |
| tomreyn | m_tadeu: not if you don't say what the 'problems with wildcards' are | 14:40 |
| lordcirth | m_tadeu, what exactly goes wrong? | 14:40 |
| m_tadeu | tomreyn, lordcirth: pbcak :P | 14:43 |
| ncuxo | Hello I have a question about bridging connections | 17:33 |
| ncuxo | is this the right place for my question or should I search for another channel? | 17:33 |
| ncuxo | I want to bridge my router to a router in another contry | 17:34 |
| sarnold | ncuxo: be sure to actually *ask* a question :) | 17:34 |
| ncuxo | :) just did I was trying to go as basic as possible :D | 17:35 |
| lordcirth | ncuxo, if you are configuring this networking setup on Ubuntu, yes, you can ask here. | 17:35 |
| ncuxo | well to be honest I have no Idea how to configure it | 17:36 |
| ncuxo | I want to tunnel to the other router | 17:36 |
| ncuxo | all the traffic to be encrypted | 17:37 |
| ncuxo | In my mind it is something like a private vpn tunnel | 17:37 |
| lordcirth | ncuxo, such that both networks appear to be directly connected? | 17:37 |
| ncuxo | yes and I want my ISP to be unable to see my traffic | 17:38 |
| ncuxo | bought ISP's | 17:38 |
| lordcirth | I believe that would be called a "site-to-site VPN" | 17:38 |
| lordcirth | ncuxo, try this? https://sysadmins.co.za/setup-a-site-to-site-ipsec-vpn-with-strongswan-on-ubuntu/ | 17:39 |
| sarnold | ncuxo: do you know why you want a bridge? are you specifically looking for a layer-2 vpn? | 17:39 |
| ncuxo | sarnold: I want the government in the country that I'm residing not to be able to check my traffic | 17:40 |
| sarnold | ncuxo: aha cool; lordcirth's link looks like a good starting point to me | 17:41 |
| sarnold | ncuxo: ubuntu also supports openvpn, https://help.ubuntu.com/lts/serverguide/openvpn.html | 17:42 |
| lordcirth | openvpn is very flexible and compatible with many tools, but can be fiddly to configure. This Strongswan seems specifically made for this sort of thing. | 17:43 |
| lordcirth | I should try it sometime myself | 17:43 |
| ncuxo | hmm but with this I will need a full os on the receiving end ? | 17:43 |
| lordcirth | ncuxo, yeah, Ubuntu on both ends. Is that not an option? | 17:44 |
| sarnold | many routers will support either openvpn or ipsec out of the box | 17:44 |
| ncuxo | lordcirth: thx for the tutorial I'll check it later today | 17:44 |
| lordcirth | Yeah. Although, doing all the encryption on a low-end router could have poor performance. | 17:45 |
| lordcirth | ncuxo, let us know how it went! | 17:45 |
| ncuxo | lordcirth: if I use a pfsense firewall router on a dell r710 server with kvm ubuntu virtualisation | 17:51 |
| ncuxo | should this be a sufficient encryption standard on the connection? | 17:52 |
| ncuxo | okay brb wife calling for dinner | 17:53 |
| lordcirth | ncuxo, I don't see how any of that determines the encryption | 17:57 |
| sarnold | r710 looks to be xeon 5500 and 5600 series | 18:00 |
| sarnold | some of those have aesni but I can't find throughput numbers | 18:03 |
| sarnold | finally something with some numbers: https://blog.scottlowe.org/2012/09/12/clds006-exploring-new-xeon-e5-optimizations-for-10-gb-ethernet/ ""throughput increased from 5.3 Gbps at ~91% CPU utilization with a Xeon 5500 (no AES-NI) to 33.3 Gpbs at ~79% CPU utilization on an E5-2600 with AES-NI support" | 18:04 |
| patdk-lap | aes-ni support is funny also | 18:27 |
| patdk-lap | you have to bulk encrypt to get good numbers, generally packet sized doesn't do well | 18:28 |
| patdk-lap | wonder if you get full 64k packet offloading aes-ni support | 18:28 |
| patdk-lap | plus doing it in a vm adds extra cpu context changes, your milage will vary :) | 18:28 |
| patdk-lap | just don't use openvpn | 18:29 |
| patdk-lap | openvpn is still single core bound | 18:29 |
| patdk-lap | I was maxing out at 300mbit | 18:30 |
| patdk-lap | next time I attempt that, I'll get a desktop cpu with like 4ghz clock speed | 18:30 |
| sarnold | patdk-lap: hmm, now I realize that I don't know well enough how these things work -- does the application need to resubmit the key to the aesni instructions every packet? | 18:37 |
| patdk-lap | I dunno how linux does it | 18:40 |
| patdk-lap | I know when they where working on it for illumos, they tested it, and it's just the amount of setup overheat is restrictive | 18:40 |
| patdk-lap | unless you do so many operations at a time | 18:40 |
| patdk-lap | I think the same goes for all those advanced features, floatingpoint, mme, ... | 18:43 |
| patdk-lap | just takes so much time to transfer the instructions and data to the unit to process, once it is going it's fast though | 18:43 |
| patdk-lap | so doing small amounts of data can be a real overhead due to setup costs | 18:43 |
| sarnold | yeah floatingpoint / mmx stuff .. if it's used in a process, then that state needs to be cleared and reset across context switches, so if you're going to use it, you better *use* it :) but I realize I don't know how aesni works. heh. | 18:44 |
| patdk-lap | I can't seem to locate it, was a blog post someone posted in development | 18:45 |
| patdk-lap | was a few years ago | 18:45 |
| patdk-lap | few == 5+? | 18:45 |
| sarnold | dang; thanks for looking | 18:46 |
| * patdk-lap blames rss feeds | 18:46 | |
| patdk-lap | easy to read and remember | 18:46 |
| patdk-lap | hard to relocate | 18:46 |
| sarnold | heh then maybe it was a bit more than five years ago? :) | 18:47 |
| patdk-lap | cannot be before 2012 | 18:47 |
| patdk-lap | as I'm possitive it was illumos related, and I didn't start playing with it till 2011, and not working and reading about the kernel till 2013 or so | 18:48 |
| patdk-lap | oh, aes-ni didn't exist till 2010 | 18:48 |
| patdk-lap | also, issue with blogs, they vanish so quickly | 18:49 |
| sarnold | if you're really lucky the old content just bitrots on an old ignored site.. | 18:50 |
| patdk-lap | http://zfs-create.blogspot.com/2014/05/optimizing-illumos-kernel-crypto.html | 18:52 |
| patdk-lap | I think that was it | 18:52 |
| sarnold | patdk-lap: thanks :D | 18:52 |
| sarnold | hahah "(luckily the GCM algorithm is limited to 64GB of data per key, so at least there is an upper bound to this nonsense)" | 18:55 |
| patdk-lap | damn | 19:07 |
| patdk-lap | I was right on with my 5year guess | 19:07 |
| sarnold | :D | 19:07 |
| coreycb | frickler: fyi the new neutron package version is availlable in bionic-proposed 2:12.0.6-0ubuntu3 | 20:57 |
| === lborda is now known as lborda_afk | ||
| keithzg[m] | Hmmm. How would I rename a network interface that seems to decide on a new MAC address every boot? Tried setting a udev rule based on the vendor and model but either I'm doing it wrong or that won't work either (on 19.04). | 22:47 |
| keithzg[m] | (Normally I'd just create a systemd .link file, but I think that needs to be MAC based?) | 22:48 |
| rbasak | keithzg[m]: https://netplan.io/reference#common-properties-for-physical-device-types gives you some options | 23:01 |
| rbasak | keithzg[m]: based on bus location or driver name | 23:01 |
| rbasak | (assuming the default name is based on bus location, which is the default I think) | 23:02 |
| keithzg[m] | rbasak: Hmm. I suppose that could work as long as I keep it plugged into the same USB port all the time; the driver name won't work then though since I believe I'm using NetworkManager rather than networkd. | 23:06 |
| keithzg[m] | ...hmm. As far as it reads to me, matching on name is precluded then too. | 23:07 |
| keithzg[m] | So I guess I'm back to trying to make a udev rule work, if that's even still possible. | 23:08 |
| rbasak | Get a proper NIC? :) | 23:08 |
| rbasak | I don't see why an early enough udev rule wouldn't work | 23:08 |
| keithzg[m] | Yeah I'm pretty confused by that, but also too rusty dealing with udev rules to be sure how to debug it, so was hoping there was an easier way. Alas. | 23:09 |
| rbasak | Oh, you might need to disable any future standard renaming udev rules though | 23:10 |
| rbasak | https://lists.ubuntu.com/archives/ubuntu-devel/2015-May/038761.html is a good guide to what there was | 23:12 |
| keithzg[m] | Aha, if I run `udevadm --debug test` against the USB device in question, I see it run through the rules in order but it was skipping my rule I was trying to sneak in early, I had just foolishly created the file as /etc/udev/rules.d/10-network-rules instead of 10-network.rules, whoops. And then it complained "Invalid ACTION operation" for ACTION="add", because it should actually be ==. Classic PEBKAC ;) | 23:21 |
| keithzg[m] | (That didn't actually accomplish the task at hand, but yeah probably into needing to find and disable/override other preexisting renaming rules) | 23:28 |
| keithzg[m] | Still haven't figured it out. Sigh. | 23:58 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!