[03:12] i configure a ftp server and when i want connect to it i get this error : packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe [03:12] Connection closed [03:16] mahdi_ja: port 22 is ssh [03:17] did you configure sftp instead? [03:17] (sftp is far better than ftp for most users) [03:23] sarnold, yes i configure sftp [03:23] mahdi_ja: can you ssh to localhost? [03:23] yes i do this for test [03:24] sarnold, yes i do this for test [03:24] mahdi_ja: so ssh works but sftp doesn't? [03:26] sarnold, whit ssh i get this error :Permission denied, please try again. [03:27] mahdi_ja: I think solving that will go a long way [03:27] sarnold, and how ? [03:28] mahdi_ja: check the sshd logs, auth logs, see what errors it's reporting [03:32] sarnold, thank you [03:32] mahdi_ja: time for me to run, have fun, good luck, and paste errors to a pastebin if you need more, hopefully someone will be around :) === kallesbar__ is now known as kallesbar === jelly-home is now known as jelly [10:39] Are there some default lists of ports that should be closed by default? [10:40] are there any ports which are already closed on ubuntu server ? [10:41] emOne: security is a wide area to deal with [10:41] emOne: try to nmap yourself externally, to see whats open and what not [10:42] emOne: the attacker is always looking for 24/7 servers with interesting services that are exploitable [10:44] I believe none of my ports are firewalled [10:44] emOne: its a combo of interesting services they are after, updated or not is important [10:44] emOne: try nmap -PN -sV ip for services [10:45] lotuspsychje: I received an email saying I should do something about my port 111 which is used by portmapper [10:47] emOne: running NFS? [10:48] lotuspsychje: I am not sure. I locked myself out while activating the firewall [10:49] trying to get back online [11:43] Before I write a programme to do the following, is there already such a tool? runs every x mins, check items v triggers, if trigger is met, send warning email, if triggers not met, apend to report. captures snapshot of cpus usage, memory usage, storage remaining. Sends report once each day, sends triggers immediately. [11:50] weedmic: This sounds like Zabbix [11:57] will check - i normally use htop and have a big monitor with lots open all the time, but, this is for someone in the backoffice to glance at once a day. [12:31] weedmic: Or Nagios/Icinga. [12:53] weedmic: Zabbix will nag at you when things hit the fan 😋 [13:48] when htop reports "load average = 18.6" and I have 40 cpus, the number is cpu equivalents? t/f? [13:50] weedmic: load average is about (in some sense) runnable processes, it's not normalized to how many cpus you have [14:01] so, 18.6 means about 18 processies are running at the same time on average? [14:02] if so, how does one know when the number is high enough to be a concern/worry? [14:17] It is not necesarily running. It means that 18.6 cores are busy a 100% of the time. [14:18] What I typically do is normalize the load by dividing it between the number of cores/cpus available. That way if it reaches a 100% I know the machine is fully utilized. Above it the machine is over utilized, etc. [14:24] ok, so it is like I thought, but you are saying cores not cpus. I have a lot more cores than cpus, so 18.6 must be unimportant. [14:24] i meant threads not cores nor cpus [15:16] weedmic: every hardware thread is a logical CPU in Linux; load isn't really core based -- it's logical CPU based [15:17] Q [15:44] to calculate average cpu load, i can do "inxi -x -C", add all the cpu (col 3) and divide by 5 (It only does top 5) - correct? [15:48] nvm - the real thing i wanted was "cat /proc/loadavg”" [16:43] ahasenack: can i coopt you to do some nginx testing for me? [16:43] very basic tests but :P [16:43] teward: probably :) [16:44] ahasenack: can you install nginx from bionic updates, remove the IPv6 listen line, and then restart NGINX, and see if it still listens on IPv6? [16:44] that would be odd if it did [16:44] from what I can tell a straight `listen 80;` will still listen on both v4 and v6 in most modern setups [16:44] and the host, ipv6 enabled? For this test [16:44] since listen 80 without 0.0.0.0 is a "bind all" [16:44] yeah [16:44] and then if you want to test with v6 disabled feel free [16:44] let me get a vm then [16:45] ack [16:45] to my knowledge based on the documentation, listen :80 is equivalent to "LIsten on port 80 on all available interfaces and IP addresses" [16:45] and listens on 0.0.0.0:80 and [::]:80 [16:47] upstream said in the upstream bug that by default nginx doesn't listen on ipv6, though [16:47] but we shall know in a few [16:48] teward: hm, looks like it stops listening on ipv6: https://pastebin.ubuntu.com/p/McKNnMTBSS/ [16:48] hmm [16:49] ahasenack: AIUI though disabled IPv6 is nonstandard [16:49] and not the 'norm' [16:49] therefore this is an edge case that we can't easily adapt for... [16:49] I tend to agree [16:49] sshd ships with [16:50] i could have SWORN we had another bug like this [16:50] #ListenAddress 0.0.0.0 [16:50] #ListenAddress :: [16:50] commented like that [16:50] * teward digs into it [16:50] and it doesn't fail to start if ipv6 isn't there [16:50] but I think it would fail if the ipv6 line was uncommented [16:50] and ipv6 was not supported [16:51] fairly sure https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1743592 is a dupe of this [16:51] Launchpad bug 1743592 in nginx (Ubuntu) "NGINX fails to install/upgrade if IPv6 is completely disabled." [Low,Triaged] [16:51] agreed it is [16:52] duped it [16:52] we could introduce this in Eoan first [16:52] see if there's any whining/moaning [16:52] but it's not SRU-able on its own [16:53] rbasak: ^ in case you want to check my brain on this [16:53] but i'm fairly sure a 'default config' change SRU is not going to be enough to be SRU worthy on its own [16:54] nor would such an SRU actually *get* to the end users side of things because of how config files're handled [16:56] Sorry, I'm just finishing one thing and then I need to run. [16:56] I'll try to remember to look later [16:57] teward: I tend to agree. The main argument being, I think, that if you changed your system to completely disable ipv6, at the OS level, then you should also take care of individual configuration changes that are needed per service [16:58] rbasak: no problem, it's not SRUable in my opinion and because of how dpkg handles config files files would not get overwritten by default. [16:58] just wanting to check my brain here :) [16:58] because this could be surprising in the other way around too: you want ipv6 enabled, you have configured a listen directive for it, then for reasons outside your control suddenly ipv6 is disabled and your site is not reachable via that protocol anymore [16:58] ahasenack: that's also my opinion. we could comment out the v6 line for Eoan+ but not get that backports. [16:58] nginx not starting up is a valid failure mode [16:58] yep [16:58] and we even have that in the config if port 80 is already bound to [16:58] at least, in later [16:58] later NGINX versions in Ubuntu* [19:46] tcpdump on port 443 shows packets coming, openssl s_client -connect remote:443 gets certificate , but netstat -tunlp | grep 443 shows only port 8443 .. what is tied to port 443 ? [19:46] https://remote takes me to the site [19:47] axisys: just to check, you're running that netstat command on "remote"? [19:48] either way, I'd check for iptables rules, port 443 may be redirected to a different local port [19:48] yes running on remote :-) [19:49] tds: ah.. that was it [19:49] tds: -A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8443 [19:49] tds: thank you === Greyztar- is now known as Greyztar