[00:00] No. I missed termbin.com heh [00:01] not what I expected :) [00:01] i admit i had to guess [00:01] Seems to be just sitting there. [00:02] forgot the -b? [00:02] No. Lol [00:02] replaced "journal" by "system" ? [00:03] you're on which ubuntu version? [00:03] 19.04 [00:03] hmm this should just work then [00:04] Probably ad blocking from my pfsense box. I’ll just manually paste it. [00:04] you can also pipe into pastebinit if you have it installed [00:04] !pastebinit [00:04] pastebinit is the command-line equivalent of !pastebin - Command output, or other text can be redirected to pastebinit, which then reports an URL containing the output - To use pastebinit, install the « pastebinit » package from a package manager - Simple usage: command | pastebinit [00:05] it throws some warnings on 19.04 but those are benign [00:24] jrg: any luck tricking your ad blocker into letting you post some text, yet? ;-) [00:24] tomreyn: may i PM? [00:24] the link? [00:25] yes, but then no one else can help [00:25] up to you [00:27] jrg: either way, please say "tomreyn" here when you posted it [00:36] tomreyn: https://www.pastiebin.com/5d43829f196ba [00:36] heh.. just looked through it. not much important information [00:45] should I use Kubuntu or Neon? [00:46] jrg: what problem are you trying to solve? [00:47] Neon gives the latest packages, so you must have a reason for that [00:48] not an official kubuntu project, iirc [00:53] jrg: i looked over it, hoped to spot some acpi issues, but don't see any. an i realize i should actually have asked you to post the log of a failed shutdown instead. probably unrelated, but maybe worth pointing out - i think i passed you those: "radeon.cik_support=0 amdgpu.cik_support=1 radeon.si_support=0 amdgpu.si_support=1" - if you upgraded the bios after you placed those there, try booting without them to see whether they're still required. [00:55] jrg: while your log doesn't seem to indicate this would neccesarily help, you can still give this a try (to work aroudn the apparent acpi issue where the system fails to power off): https://iam.tj/prototype/enhancements/Windows-acpi_osi.html [00:56] sarnold: the issue jrg is trying to solve is: After all that trouble of updating the bios. The system still reboots when put into sleep mode. [00:57] bios is on the latest version according to https://www.msi.com/Motherboard/support/FM2-A75IA-E53 [00:57] tomreyn: aha [00:57] jrg: which of these values have you tried? https://www.kernel.org/doc/Documentation/power/states.txt [01:00] on that same page: How to enable S4 (Hibernate) function under Windows 7? ( i know, this is ubuntu, but interesting to that behaviour) Please follow the below settings: Control Panel-->Power Options-Change when the computer sleeps-->change advenced power settings-->Sleep-->Allow hybrid sleep-->change to "Off" [01:00] hybrid sleep could be a killer === zbenjamin_ is now known as zbenjamin [01:11] i'm using S3 [01:18] tomreyn: i'm trying it out now [01:25] Still reboots when put to sleep. Lol. Ahhhhhh! 😂 [01:25] Maybe I need to build a custom kernel. [01:26] jrg: try some of the other sleep methods documented in that file [01:30] sarnold: how do you change what ubuntu uses? [01:31] jrg: first thing to do is try the different options by echoing the magic strings into the /sys/power/state and /sys/power/mem_sleep files [01:31] jrg: once you find one that works, then you can edit a systemd configuration file to tell it what kind of sleep mode to use [01:32] Mem_sleep shows only s2idle [deep] [01:33] Wow. Like just editing the state made it change to reboot [01:33] So state is the “live” state? [01:35] yeah, it'll do what you ask it to do; thatr's what systemd is doing in the background :) [01:39] maybe someone can help with with fixing a borked upgrade of mono while trying to use duplicati? i had whatever mono packages installed via the repos and found out that duplicati needed a newer version so i installed mono projects repo to get their stable build and its failing with: https://paste.debian.net/hidden/d96b6cf2/ [01:40] the apt fix-broken errors out as well [01:42] sarnold: i don’t quite understand how to change mem_sleep though [01:42] I want to try S1 [01:42] But don’t quite understand how to change it. [01:44] kinghat: try apt purge libappindicator0.1-cil libglade2.0-cil libglib2.0-cil libgtk2.0-cil libnunit-console-runner2.6.3-cil libnunit-core2.6.3-cil [more coming, this is just slow] [01:45] kinghat: ... libnunit-core-interfaces2.6.3-cil libnunit-framework2.6.3-cil libnunit-mocks2.6.3-cil libnunit-util2.6.3-cil libgtk2.0-cil libglade2.0-cil ... [01:48] jrg: try echo shallow > /sys/power/mem_sleep [01:49] Invalid argument [01:49] Maybe because ro? [01:50] kinghat: .. and libnunit-console-runner2.6.3-cil libnunit-core2.6.3-cil libnunit-core-interfaces2.6.3-cil libnunit-framework2.6.3-cil libnunit-mocks2.6.3-cil libnunit-util2.6.3-cil [01:50] https://paste.debian.net/hidden/f1fb549b/ [01:50] oh crap already ran it. [01:51] kinghat: that's fine, just tack these, and duplicati gtk-sharp2-examples gtk-sharp2-gapi libglade2.0-cil-dev libglib2.0-cil-dev libgtk2.0-cil-dev libnunit-cil-dev mono-devel to the end.. [01:51] https://paste.debian.net/hidden/a3cd0450/ [01:51] jrg: hrmh. maybe echo -n shallow > /sys/power/mem_sleep ? [01:51] i just ran them all again [01:52] kinghat: try again with duplicati gtk-sharp2-examples gtk-sharp2-gapi libglade2.0-cil-dev libglib2.0-cil-dev libgtk2.0-cil-dev libnunit-cil-dev mono-devel too [01:52] remove duplicati as well? [01:53] No. Still invalid argument [01:53] kinghat: yeah; it depends on packages coming from ubuntu's repos that look like they're conflicting with the one frmo mono repos [01:54] ok so: [01:54] kinghat: my thinking is, once all the ubuntu-provided ones are gone, then you can install those packages freom the mono repo, and then hopefully grab the duplicati, and go forward again [01:54] sudo apt purge libappindicator0.1-cil libglade2.0-cil libglib2.0-cil libgtk2.0-cil libnunit-console-runner2.6.3-cil libnunit-core2.6.3-cil libnunit-core-interfaces2.6.3-cil libnunit-framework2.6.3-cil libnunit-mocks2.6.3-cil libnunit-util2.6.3-cil libgtk2.0-cil libglade2.0-cil libnunit-console-runner2.6.3-cil libnunit-core2.6.3-cil [01:54] libnunit-core-interfaces2.6.3-cil libnunit-framework2.6.3-cil libnunit-mocks2.6.3-cil libnunit-util2.6.3-cil duplicati gtk-sharp2-examples gtk-sharp2-gapi libglade2.0-cil-dev libglib2.0-cil-dev libgtk2.0-cil-dev libnunit-cil-dev mono-devel [01:55] sarnold: i have no idea if anything else was using mono [01:55] kinghat: if there were, it probably would have complained at that point [01:55] jrg: oh, heh, how about "cat /sys/power/mem_sleep"? on my system that only shows s2idle [deep] -- those are the only two choices I've got [01:56] jrg: how about your system? [01:56] sarnold: https://paste.debian.net/hidden/a52d7a5a/ [01:56] kinghat: argh :) alright, add gtk-sharp2 mono-roslyn mono-xsp4-base and try again [01:56] I wonder how many more iterations.. [01:57] Same [01:58] https://paste.debian.net/hidden/17304e6e/ [01:59] kinghat: mono-xsp4 :) [02:01] ok i see what you were doing lel [02:01] it made me do a couple more and now wants to proceed [02:02] how do i know what to install back? or just install duplicati again and let it install what it wants? [02:02] kinghat: yeah, I *hope* that will do the job [02:02] https://paste.debian.net/hidden/4865c605/ [02:02] kinghat: there's no guarantee that the mono folks would have used the same package names throughout -- afterall, that's probably how you wound up with the case of not just upgrading.. [02:03] wow give me a minute on this one :) [02:04] I think i have reached the point where i just need to bite the bullet and believe that suspend just isn’t an option on this thing [02:04] lol === [b0b] is now known as b0b [02:06] kinghat: alright, I think you're safe to say 'Y' here, and I think the apt autoremove is also safe, but pkg-config makes me wonder -- you might want that back if you write mono software yourself [02:06] kinghat: (or compile stuff from others once in a hwile) [02:06] i dont. i didnt even know duplicati used mono. [02:06] jrg: what's the output of cat /sys/power/mem_sleep ? [02:06] this was actually the issue: https://github.com/duplicati/duplicati/issues/3767#issuecomment-497061851 [02:07] I believe s2idle [deep] [02:07] jrg: try echo s2idle > /sys/power/mem_sleep [02:08] I tried that but it gives me an invalid argument error [02:08] daaaaang :) [02:11] sarnold: so here is the end of that log: https://paste.debian.net/hidden/ac781ce1/ [02:14] of the purge process, anyways. [02:14] I’m guessing there just has to be a problem with ACPI + MSI + Ubuntu [02:14] kinghat: try apt purge mono-gac ? [02:14] jrg: hmm. you remind me of another tool.. [02:15] jrg: try installing and running fwts -- it's a firmware test suite. maybe it'll point out the problem? [02:15] jrg: it might not be possible for you to fix anything it might find, but at least it's a start [02:17] sarnold: looks promising: https://paste.debian.net/hidden/60e72d88/ [02:18] kinghat: very promising :) [02:18] kinghat: what's in /etc/mono? anyuthing interesting? [02:19] kinghat: I'm guessing you can probably juist rm -rf /etc/mono but it doesn't hurt to look before you obliterate it [02:20] its /etc/mono/certstore/certs/Trust/ with a bunch of .cer X.509 Certificate files(133) and /etc/mono/registry/LocalMachine/ with nothing. [02:22] remove [02:22] yeah [02:22] removed* [02:23] alright! now you get to try to solve your problem :) [02:23] lel [02:24] so installing mono-complete or just install duplicati again is the question [02:24] kinghat: heh. I can't spot duplicati on my archive mirror.. [02:24] so I'm a bit blind on this one. Try duplicati. go for broke. :) [02:24] ya its just a deb [02:25] i am going to run autoremove before i do that [02:25] alright, makes sense [02:25] I'm glad you remembered, it's probably the much better choice [02:26] Ok. I’ve given up heh. [02:26] jrg: dang. sorry :( [02:26] I’m seen some people who have had a similar problem [02:26] But very few [02:26] There isn’t much information anywhere about what causes the reboot on suspend [02:27] jrg: it might not hurt to run ubuntu-bug linux, and fill out a bug report; I can't promise anything but you never know [02:30] sarnold: well it looks like im on the most recent version of mono now [02:30] duplicati installed. lets see if the bug i was having is fixed. [02:30] kinghat: cool cool, how long will testing that take? [02:31] 5m [02:31] nice ;) [02:31] It's dinner time here, but I can wait five more minutes to find out if this helped :D [02:31] it was something about mono using tls 1.1 or the like and box.com api using newer? [02:32] yeah [02:32] TLS 1.0 is ancient and bustred [02:32] 1.1 is also ancient and also kind of busted but far better [02:33] looks like it worked! thanks sarnold! [02:34] kinghat: nice! :D [03:10] hi guys, to build a project I need version 2.58.0 of glib-2.0. apparently the package "libglib2.0-dev" only ships 2.56.4 on ubuntu [03:10] how can I get a new version? I found this page: https://launchpad.net/ubuntu/cosmic/+package/libglib2.0-dev [03:14] cosmic is EOL, so disco is supported, but gives 2.60 [03:15] ok, so the right thing to do would download the tar and compile and install it? [03:15] so theres no ppa or something for this kind of thing? [03:16] not sure why you need that version, security fixes are backported to bionic 18.04 [03:17] I need a version >= to build a project: github.com/mate-desktop/marco [03:17] meant to say >= 2.58.0 === MrSheesh is now known as Mr_Sheesh [03:19] build the project on disco? [03:21] im on 18.04.1 [03:23] i'm not sure why a newer version is required than I have installed [03:24] i think when you want to build the latest stuff, use the latest stuff; 19.04 gives kernel 5.x and such [03:24] 18.04 aims to be stable, lts [03:26] ah damn, makes sense [03:26] guess I'll have to reinstall my vm [03:27] thanks for the hint! [03:27] a vm would do, depends on what you do when build === emmanuel_ is now known as wasanzy [05:34] heeey [05:55] hi [07:30] I am having issues with openvpn. Can someone help me with this? https://paste.ubuntu.com/p/8hpppGsz5N/ [07:31] THere is nothing wrong with the server as I am connection from a different computer with no problems [07:34] Aavar: https://stackoverflow.com/questions/53058362/openssl-v1-1-1-ssl-choose-client-version-unsupported-protocol [07:37] EriC^^, thank you. That worked great :) [07:38] Aavar: great, no problem :) [07:42] hi lotuspsychje my ubuntu takes time to boot? [07:44] immu: pastebin: systemd-analyze critical-chain please [07:46] https://paste.ubuntu.com/p/g5SBNHWj2f/ [07:47] lotuspsychje: has the Kernel issue from yesterday been fixed? [07:47] :) [07:47] 5.0.something [07:50] marcoagpinto: still working on it [07:50] ahhhh [07:51] lotuspsychje: I haven't turned on my laptop with the VMs this week... I will use it next week only... I have been too busy doing things [07:51] lotuspsychje, umm anything? [07:52] marcoagpinto: please use #ubuntu-discuss for the chatting [07:52] immu: graphical target takes long, its your boot time from login to desktop that lags? [07:53] yes [07:55] immu: try to install preload & haveged [07:56] immu: and type this in a terminal: sudo sed -i "s/NoDisplay=true/NoDisplay=false/g" /etc/xdg/autostart/*.desktop [07:56] unable to install preload? [07:56] immu: then take a look into your startup applications, see if you can disable things you dont need [07:57] immu: sudo apt install preload haveged [08:02] should i reboot? [08:02] immu: yes [08:03] brb then [08:09] hello lotuspsychje rebooted, checked for startup apps and their are many related to gnome [08:09] immu: there are some things you can disable.. [08:13] !systemd | immu see also [08:13] immu see also: systemd is the default init system for Ubuntu 15.04 onwards. For information on transitioning from upstart to systemd, see https://wiki.ubuntu.com/SystemdForUpstartUsers For a guide to basic service management with systemd, see https://www.digitalocean.com/community/tutorials/how-to-use-systemctl-to-manage-systemd-services-and-units [08:13] ok , i have disabled few but most i have left them alone [08:23] does someone here knows some good way to have every linux application use a HTTP (Corporate) proxy server? it's an http proxy [09:01] hello [09:01] welcome oh6hz [09:01] tried to install mono on ubuntu 19.04 according to this page: https://www.mono-project.com/download/stable/ and it broke everything [09:02] (the default mono on ubuntu does not work well with openra) [09:02] The following packages have unmet dependencies: [09:02] mono-devel : Depends: ca-certificates-mono (= 6.0.0.313-0xamarin3+ubuntu1804b1) but 5.18.0.240+dfsg-2ubuntu2 is installed [09:02] E: Unmet dependencies. Try 'apt --fix-broken install' with no packages (or specify a solution). [09:02] --fix-broken install does not help [09:04] is it time to start editing something by hand or what's next [09:04] tried to google a bit but found nothing that works [09:05] oh6hz: we dont really support external ppa's here, often we see unmet dependecencys are the cause of conflict [09:05] yes [09:05] oh6hz: we strongly advice to install packages from the official ubuntu repos instead [09:06] i had them but they cause openra to crash after a while [09:06] oh6hz: if you find a bug in ubuntu please report it with ubuntu-bug packagename [09:07] oh6hz: try to remove that ppa with !ppapurge [09:07] to get out of dependency issues [09:07] will try that [09:07] !ppapurge [09:07] To disable a PPA from your sources and revert your packages back to default Ubuntu packages, install ppa-purge and use the command: « sudo ppa-purge ppa:/ » – For more information, see http://www.webupd8.org/2009/12/remove-ppa-repositories-via-command.html [09:08] ok, apt is broken, can't install anything [09:08] oh6hz: try to remove it from software&sources then, and sudo apt update after [09:10] and actually i'm not skilled enough to tell if it's mono on ubuntu that's broken or just the openra binary but on my previous computer it started working properly when i installed the non-ubuntu mono [09:11] oh6hz: there's nothing broken, its the ppa conflicting with the mono from the ubuntu repos [09:11] hello [09:12] oh6hz: after you resolved that, we can try focus on the openra issue [09:12] yes i know, i'm talking about the reason why i did what i did and why i haven't reported a bug on mono [09:19] i removed the /etc/apt/sources.list.d/mono-official-stable.list [09:21] what is the difference between upgrade and dist-upgrade? [09:22] Aavar: https://askubuntu.com/questions/81585/what-is-dist-upgrade-and-why-does-it-upgrade-more-than-upgrade [09:23] then apt autoremove, fixed it. thank's for the help lotuspsychje. did not think about the sources.list [09:25] sudo18, thank you :) [09:25] yw :) === im0nde_ is now known as im0nde [10:22] https://askubuntu.com/questions/59159/disable-middle-click-to-lower-window-behaviour-on-gnome [10:23] I finally found a way to disable the middle-click cycling trough window "feature". === Wryhder is now known as Lucas_Gray [11:28] why does ubuntu not come with ifconfig [11:28] what is the deal with that [11:35] It's been deprecated, in favor of the ip command [11:37] ub3g33k: ah k [11:42] hi, i'm having a problem with the gnome-disk utility. i tried resizing a rather big (2TB to 1TB) ntfs partition yesterday and the gnome-disks window is greyed since then. I thought maybe it would just take some time, but the process is still running with no answer from the GUI. is there any possible way to get information on the status of gnome-disks? does it write logs or something? === juboxi is now known as jubo2 [11:46] retoothx: you could get the pid then use strace -p [11:46] retoothx: maybe you could do "sudo parted -ls" and see what the partition table looks like and any fs [11:47] retoothx, dmesg too [11:53] EriC^^: well, it seems that the process is stuck on some polling according to strace, but i'm not quite sure what to make of it: https://pastebin.com/Yp4eyYrv [11:55] hi === Rojola1 is now known as Rojola [11:57] retoothx: what's the partition table look like [11:58] EriC^^: parted -ls says that no shrinking has been done so far: https://pastebin.com/hE25XCFK [11:59] retoothx: is it mountable, i wonder? [12:01] EriC^^: yap, it is!! oO [12:02] EriC^^: does that mean gnome-disks did completely nothing to the disk? not even lock it? [12:03] retoothx: if i had to guess, then yeah, try sudo ntfsinfo /dev/sdb1 -m [12:04] Is this a removable disk? [12:04] retoothx: you can figure out the volume's space by cluster-size * cluster-volume = size in bytes [12:04] it is an external hdd yes [12:04] retoothx: actually 'df -h /dev/sdb1' should print the size [12:04] It looks like it lost connection at some point, and is still trying to grab the old device name, to me [12:05] where does the Software Updater app get the description of each package that's shown in the list? [12:05] EriC^^: ntfsinfo gave this https://pastebin.com/pNu3261j [12:05] and that's why it got stuck on polling [12:06] EriC^^: i could mount and unmount it through the filesystem gui (nautilus i guess) [12:07] retoothx: it looks to me that it's 2000GB still [12:07] maybe it was still in the process of putting all the data at the start of the disk before doing the resize command? [12:08] EriC^^: possible. so is it save to kill gnome-disks? [12:09] retoothx: i mean i'd do it personally, but i dont know for sure, sorry [12:10] if it's still mountable and stuff i'd guess worst case scenario is some file goes missing if it was in the process of moving that file, just guessing though [12:12] EriC^^: ok if it's just a single corrupted file that's fine with me. i panicked a bit, because this drive has like 10 years of my digital live on it. [12:15] EriC^^: so i did kill gnome-disks, and it is still mountable and all the files seem to be still there. phew. [12:15] retoothx: great, backup time now :) [12:16] Hi folks [12:16] EriC^^: yap, just need some new hardware as this is my backup hdd ;) [12:16] i had a similar scare once, since then i put all my stuff on an ext hdd and another hdd just in case the ext goes bad or something [12:17] EriC^^: thanks a lot, you really saved me. my blood pressure is on a normal level again :) [12:18] retoothx: hehe, no problem :) [12:18] bye, take care [12:18] bye, you too [12:22] where does the Software Updater app get the description of each package that's shown in the list? [12:28] clarkk, /var/lib/app-info probably but i could be wrong [12:42] Hi [12:42] trying to get some info from auditd for yesterday but looks like nothing has been logged [12:44] wasanzy: i think it logs to the journal / syslog by default? [12:47] im running ubuntu 14.04 but on apt-get update i get 100%[Working} any way to debug this? cause the repo itself seems to work fine on other machines [12:48] <`mist_> hey guys, any way i can install libconfuse1 on ubuntu 18? [12:48] !14.04 | ws2k3 [12:48] ws2k3: Ubuntu 14.04 LTS (Trusty Tahr) was the 20th release of Ubuntu. !End-of-life was April 25th, 2019. Paid support (ESM) is available. See also !esm, !eol, !eolupgrade [12:49] !YY.MM | `mist_ [12:49] `mist_: Ubuntu version numbers are: YY.MM (YY=release year,MM=release month). Each year sees two releases, so just specifying YY is imprecise. See also https://www.ubuntu.com/about/release-cycle [12:49] it logs to /var/log/audit/ and all the logs seems to contain records for only today [12:49] tomreyn: i know.... but i didnt ask it it was eol or not. nor am i interested in commercial support. just came here for community advise. [12:50] ws2k3: okay, so as the /topic says, the ubuntu releases we support here are those that are not EOL [12:51] <`mist_> 18.04 lts [12:51] if you'll need help upgrading to a supported release, we'll be happy to help. [12:51] ws2k3: ^ [12:52] `mist_: i only see v2.x and 3.x in the repos. you could look for a !PPA, but this makes me think what really should happen is to change the source code of the software you're trying to make work. [12:52] cool if thats ur opinion. maby someone else is willing to help me on this. secondly. ubuntu 14.04 is debian 8 based which is still supported. that you got a different standart that is fine ^^ [12:54] ws2k3: that's not just a personal opinion, that's a misinterpretation on your part. (and i think you intentionally misinterpreted this before, and were told so before.) [12:54] tomreyn: then what am i misinterpetating? [12:55] <`mist_> tomreyn: it's an old software [12:55] that's it's a personal opinion. it's a channel policy. [12:55] ws2k3: ^ [12:56] `mist_: maybe it can be updated, or replaced? alternatively you could run it in a container with an older ubuntu version which provides v1 [12:58] tomreyn: https://askubuntu.com/questions/445487/what-debian-version-are-the-different-ubuntu-versions-based-on: 14.04 trusty jessie / sid and jessie will go eol in june 2020 ergo. 14.04 is not Realy eol. but ubuntu Makes it eol :) [12:59] !debian | ws2k3 [12:59] ws2k3: Ubuntu and Debian are closely related. Ubuntu builds on the foundations of Debian architecture and infrastructure, with a different community and release process. See https://www.ubuntu.com/about/about-ubuntu/ubuntu-and-debian - !Repositories meant for Debian should NOT be used on Ubuntu! [12:59] they're closely related, but not the same thing at all. [12:59] tomreyn: but this is all not realy relevant. you dont seem a guy that can be convinced. and thats all okay. but maby someone else can advise. that actualy has something usefull to say :) [13:00] ws2k3: if you have convincing arguments to challenge the policies for this channel, feel free to bring them up in #ubuntu-ops [13:01] ws2k3: i'll be happy to explain this in more detail in #ubuntu-discuss, too, if oyu like. [13:03] ioria, thank you for your answer. Unfortunately, the name listed in the Software Updater is not in /var/lib/app-info [13:04] =/leave [13:07] tomreyn: ubuntu is not going to change the policy cause it brings money. simpel. but like i sad before that is not the argument. the argument is why my apt keeps waiting on 100%[working] [13:08] !ot | ws2k3 [13:08] ws2k3: #ubuntu is the Ubuntu support channel, for all Ubuntu-related support questions. Please register with NickServ (see /msg ubottu !register) and use #ubuntu-offtopic for other topics (though our !guidelines apply there too). Thanks! [13:08] ws2k3: please keep discussions out of this channel [13:08] <`mist_> tomreyn: unfortunately it has to be in the host OS for a container to be able to use it [13:08] lotuspsychje: i know. tell tomreyn that =) [13:08] <`mist_> i guess i'll run an older lts [13:08] ws2k3: tomreyn is pointing you to the guidelines [13:09] lotuspsychje: ok. noted. [13:09] wasanzy: this is really just one of many possible theories, but (just in case you're not already aware) there's malware which would truncate logs to cover up its intrusion (it'd also have truncated other logs then, though). but i'm sure there are other and better explanations. [13:10] ws2k3, debian and ubuntu releases do not directly correspond; they are released a year apart; both upstream use debian-sid - but that's not a static entity; thus the year apart is significant; which still doesn't change debian or Ubuntu 14.04 LTS being off-topic. Use your Ubuntu Advantage support if using 14.04 ESM [13:11] tomreyn: I think you are right because looks like event logwatch could not report anything [13:11] `mist_: why is this, does it need to interact with the hardware directly? [13:12] is there a tool that can be used for scripting certificate generation from linux box? basically to script call to windows ca [13:12] https://cbudde.com/microsoft/certificate-services/setting-up-windows-root-ca-on-centos-6-9-linux-server [13:12] <`mist_> tomreyn: yeah =( [13:14] `mist_: hmm unfortunately there doesn't seem to be any supported ubuntu release which still has libconfuse v1. this software must be really old. [13:22] <`mist_> tomreyn: it's called telldus-core, i think development stopped like 8 years ago =/ [13:22] wasanzy: if you suspect an intrusion you could use a virus scanner such as clamav, (in case you suspect a root compromise) software which attempts to detect rootkits such as chkrootkit and rkhunter (while those are packages in ubuntu, i'd personally prefer the upstream versions) - note these will likely produce a lot of false positives, though. but (in case of a supected root compromise) you should really set the system up freshly (after taking [13:22] a snapshot which you can analyze further) and only bring its services back online after you have a good theory about what may have happened and have taken measures for it not to happen again once you'll bring up services again. also set up remote (sys)logging in a write-once approach (logs once written to the remote system must not be deletable by the system logging there) in case it'll happen again. [13:23] `mist_: i would really, really look for a replacement then. [13:23] <`mist_> i have, but since it's a hardware thing there doesn't seem to be alot of options ='( There is a release working on the latest raspbian so i might just repurpose a pi [13:23] `mist_: https://github.com/telldus/telldus/tree/master/telldus-corehas commits from 2 years ago. [13:24] <`mist_> hm true [13:25] but it doesn#t help if dependencies remain the same. [13:25] <`mist_> yeah [13:25] tomreyn: the system was infected with malware yesterday [13:25] so I was trying to investigate today [13:25] wasanzy: ah good you were able to verify this. [13:26] wasanzy: hope you can determine the attack vector and take counter measures. [13:28] lrwxrwxrwx 1 postgres postgres 0 Aug 1 12:22 exe -> '/var/tmp/�J�l0f (deleted)' was the path and 584.80% aVbIu5 18294 - CPU usage and process name [13:28] tomreyn: trying to crack my brain in determining the attack vector [13:29] I rebooted the system yesterday to get ride of the process [13:29] Short question - my usb device is mapped to /devices/pci0000:00/0000:00:14.0/usb2/2-4/2-4:1.2/ - Is this location static i.e. does it change on boot? [13:30] if the device is still plugged in the same port after reboot, that is... [13:33] wasanzy: make sure it's offline, user data removed, backups complete. [13:35] (and tag those backups as 'compromised') [13:40] tomreyn: Is there a possibility that the malware is still there? [13:40] or the data on infected? I was thinking the attacker was just using the machine to mine cryto [13:41] larkfisherman: i think it's static. you could verify the PCI vendor + device and, if any, serial nunmber, to make sure. [13:43] wasanzy: if the malware got root (but also if it hasn't, just it may be detectable then) then there's always a possibility that it's still there, yes. just because you see the system being abused for crypto mining doesn't mean it's the only thing it's being abused for, or the only persistent malware. [13:45] to the malware was running as the postgres user [13:45] not sure it got root [13:46] wasanzy: thus the recommendation is to reinstall the system from scratch, restoring *verified clean (since those can also be infected) backups, but only bringin things back online after you identifed the attack vector / how the intrusion happened, and after taking counter measures so this won't happen again. also resetting nay passwords and regenerating any secret keys stored there is considered a good measure. [13:47] only if you can work out quite reliably that a root comrpomise did not take place you get the liberty to choose not to reinstall the full system. [13:47] (but even then you might want to, just in case) [13:47] Ok thank you [13:48] I think you are right and your explanation is well taken [13:48] wasanzy: but realyl th emost important thing you need to do right now is bringing this system offline if you haven't done this, yet [13:48] the problem is this is the only production server we have [13:49] wasanzy: otherwise you're risking (continued?) exfiltration of user data / databases. [13:50] tomreyn: Just to ask, do you think that could really be a malware? [13:51] wasanzy: i have no idea. could be, do you have any further information on the file, have you tried recovering it? [13:52] '/var/tmp/�J�l0f' looks like it may have been renamed, then deleted. you might not be able to restore it, but it's worth a try. after taking the system offline, of course. [13:52] tomreyn: the file vanished after rebooting the system [13:52] oh right you rebooted. is /var/tmp RAM backed? normally it's disk backed. [13:52] it is an executable [13:52] no it is not backed [13:55] but a process to be consuming such amount of CPU on a machine that is not very busy, it could mean only one thing which is malware [13:55] wasanzy: i'm asking whether /var/tmp is TMPFS (a RAM disk): df -h /var/tmp [13:56] wasanzy: yes it seems somewhat likely that it's malware, based on the (limited) information you have so far. [13:57] df -h /var/tmp [13:57] Filesystem Size Used Avail Use% Mounted on [13:58] wasanzy: the second line of this output was interpreted as an IRC command because it started with a slash. [13:58] !pastebin | wasanzy [13:58] wasanzy: For posting multi-line texts into the channel, please use https://paste.ubuntu.com | To post !screenshots use https://imgur.com/ !pastebinit to paste directly from command line | Make sure you give us the URL for your paste - see also the channel topic. [13:59] wasanzy: your time is better spent taking this machine offline, building it from scratch and restoring from verified clean backups. THEN worry about what happened. [13:59] right [14:00] as I explained earlier, the system is in production, we don't have another production server. that is my worry. taking it offline means, taken the business down [14:00] if you have a collegue who can help you there, then have them rebuild the system on a new server / VM while you analyze the compromised system *after taking it offline* [14:01] https://paste.ubuntu.com/p/sSrtyBhcpk/ [14:01] wasanzy: then hopefully this is a lesson in running a proper production system. In the meantime, you are only making matters worse the longer you leave it online [14:01] wasanzy: here's how i'd view it: your business was badly prepared for this situation, going forward you will need to prepare better for it. for now, you'll need to deal with the consequences. [14:01] ^ [14:03] keeping the system online means you're proliferating data exfiltration, your system attacking other systems, the intrusion spreading (possibly to other systems in your network), and possibly fighting live against an intrusder who keeps installing new malware. [14:04] the only reasonable thing to do now is to bring the system down and put up a maintenance page ("will be back soon") [14:05] wasanzy: you have no idea how compromised your system is. And you never will. You're only wasting time. [14:05] and data [14:05] the business is not having losses because of you bringing down production, but because of not focussing enough on keeping this system safe nor on being well prepared to handle such (somewhat plannable) situations. [14:07] wasanzy: we're saying this not to shame you, but to provide you with arguments in case you'll need to explain this to $boss. [14:10] tomreyn: I understand your points very well and that is the best thing to do. If my bosses had listened to me to setup a redundancy, it would have been better. [14:10] wasanzy: if you're worried about your job there: bring this system offline now, then talk to $boss bringing up those points, have them choose the risk they want to take, then continue working on it. [14:10] I spoke to CTO so we can shutdown, waiting for feed back [14:11] you should have been allowed to bring it down on your own if a compromise is likely, that's a policy the CTO will need to change in the future. [14:11] (maybe after peer review) [14:13] I have downloaded this Kubuntu image, created usb but it has installed ubuntu. not kubuntu. what could have been wrong? cdimage.ubuntu.com/kubuntu/releases/18.04/release/kubuntu-18.04.2-desktop-amd64.iso [14:16] intelo, ... are you sure you wrote the right iso? That's pretty weird [14:16] the name even has kubuntu in it [14:17] lordcirth [14:17] Does ubuntu have something like `sa2` running by default? [14:18] tsujp_, what' [14:18] *what's sa2? [14:18] https://linux.die.net/man/8/sa2 [14:18] I have an ubuntu vm that someone is claiming I used 93 TB of traffic on [14:18] But I can only see sustained 200 KBps for a month, which is at most 400 GB [14:19] How can I check the network history? [14:21] tsujp_: you don't unless you set something up previously [14:21] Ugh [14:24] tsujp_: you can check interface statistics (since an interface was last brought up) [14:26] intelo: can you run sha256sum kubuntu-18.04.2-desktop-amd64.iso [14:28] tomreynsha256sum kubuntu-18.04.2-desktop-amd64.iso844762a208593ee5cf396cb09522b1dfa127c65b79f71f4863c062039215d0d8 kubuntu-18.04.2-desktop-amd64.iso [14:30] how to create usb live . I am in ubuntu [14:32] intelo: sorry, can you do it again with sha1sum kubuntu-18.04.2-desktop-amd64.iso [14:32] intelo: you can use usb-creator-gtk or usb-creator-qt to write the iso to a usb storage. [14:33]