| ahasenack | sergiodj: hi, this bug came up in a server guide comment, https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1934997 | 12:29 |
|---|---|---|
| ubottu | Launchpad bug 1934997 in sssd (Ubuntu) "Authentication fails after upgrading sssd to 2.2.3-3ubuntu0.6" [High, Triaged] | 12:29 |
| ahasenack | have you got any news about it? | 12:29 |
| ahasenack | tl;dr samba does not create the empty policy file, I got that, and sssd is treating that in a particular way. Does windows also not create that policy? Can we say by now where the fix should be? | 12:29 |
| ahasenack | oh, I'm finding some activity | 12:30 |
| scortal | hi | 12:42 |
| ahasenack | rbasak: I know you are off today, but I'll just leave this here. I'm going to create a merge MP, and I'll try the pre-requisite branch trick | 13:10 |
| ahasenack | rbasak: I don't think it works, the diff is all messed up | 13:14 |
| memoryleak | Did anyone create an auto-install iso image with the new 22.04 - any online references for that? | 13:32 |
| sergiodj | ahasenack: ah, thanks for tracking down the PR that fixed it. I will merge sssd soon-ish, and I see that Timo has just uploaded 2.7.1-1 to Debian | 14:33 |
| sergiodj | it should fix the issue, as you pointed out | 14:33 |
| ahasenack | yep | 14:34 |
| ahasenack | I'm updating the server guide with a note, and I'm thinking about the 22.04 release notes as well, since it has AD join in the installer | 14:34 |
| sergiodj | right | 14:34 |
| ahasenack | weird that the bug only happened on ssh logins, not console ones | 14:34 |
| ahasenack | I wonder if the console login is missing some pam module, or something else that would have applied the gpo | 14:35 |
| ahasenack | when you were testing, did you only use ssh for testing? | 14:35 |
| sergiodj | it's been a while and I don't remember the details, let me re-read the bug | 14:35 |
| ahasenack | someone in the https://discourse.ubuntu.com/t/sssd-and-active-directory/27888 comments is saying that it only blocked ssh logins | 14:36 |
| ahasenack | (that's how I was pointed at that bug) | 14:36 |
| sergiodj | ahasenack: based on what I wrote at https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1934997/comments/5, I think I was testing using console login | 14:37 |
| ubottu | Launchpad bug 1934997 in sssd (Ubuntu) "Authentication fails after upgrading sssd to 2.2.3-3ubuntu0.6" [High, Triaged] | 14:37 |
| scortal | hi | 18:56 |
| scortal | ih | 19:52 |
| Hinnerk | Hi, I have a dedicated server in my home network runnning Ubuntu LTS latest. It is connected to my router, which serves also as local DNS. My server features two NICs, as fail backup, both are attached to the router, named eno1 and eno2 with IPs 192.168.1.40 and 41. Of course, there is just one host name, myserver.home. So how do I need to properly | 20:25 |
| Hinnerk | configure the NICs in Ubuntu and the DNS to properly resolve any requests to the server? Can I use the same hostname for different IPs? Or is the solution within configuring the NICs to olny use one at the time? Maybe I should just deconnect the second... | 20:25 |
| Hinnerk | Addtional complication: The IPs are by reserved DHCP only. | 20:29 |
| Hinnerk | So it requires the MAC adress | 20:30 |
| sarnold | Hinnerk: depending upon what you're trying to build, this may be useful overview of what's available https://ubuntu.com/server/docs/ubuntu-ha-introduction | 20:36 |
| * sergiodj fastens his seatbelt and starts looking into the Samba merge MP | 20:38 | |
| Hinnerk | Thx, that seems a bit over the top for me. It's really just a small home network, but since it had the two NICs... maybe I just deactivate one, it seems to cause more trouble to me than it is worth it (to me). | 20:38 |
| oerheks | having one dedicated to ssh local, is nice | 20:41 |
| sarnold | does your switch support bonding? maybe doubling them to get pseudo-double the bandwidth might be handy and probably way easier to configure | 20:43 |
| scortal | maret | 21:09 |
| scortal | i need ubuntu manual | 21:10 |
| scortal | plz | 21:10 |
| sergiodj | https://help.ubuntu.com/ | 21:11 |
| oerheks | its in the topic | 21:11 |
| scortal | is it useful to build server | 21:12 |
| sergiodj | the Ubuntu Server guide is useful when building a server, yes | 21:12 |
| oerheks | !info harden-doc | 21:14 |
| ubottu | harden-doc (3.19+nmu1, jammy): useful documentation to secure a Debian system. In component universe, is extra. Built by harden-doc. Size 879 kB / 8,751 kB | 21:14 |
| ahasenack | is this working for anyone: | 21:18 |
| ahasenack | $ lftp https://ubuntu.com | 21:18 |
| ahasenack | cd: Fatal error: Certificate verification: Not trusted (93:3C:6D:DE:E9:5C:9C:41:A4:0F:9F:50:49:3D:82:BE:03:AD:87:BF) | 21:18 |
| ahasenack | that's in impish, but I see the same on kinetic | 21:19 |
| lvoytek | I see the same thing on Jammy | 21:19 |
| Odd_Bloke | ahasenack: Same on focal. | 21:19 |
| ahasenack | looking for other command-line tools that link with gnutls | 21:20 |
| ahasenack | lynx | 21:21 |
| ahasenack | hm, that worked | 21:21 |
| sergiodj | ahasenack: fedora and debian also | 21:28 |
| ahasenack | also fails, you mean? | 21:29 |
| sergiodj | yes | 21:29 |
| sergiodj | ahasenack: maybe related to this: https://github.com/lavv17/lftp/issues/641 | 21:31 |
| ubottu | Issue 641 in lavv17/lftp "gnutls integration code manually tries to verify chain, can't handle cross-signed CA" [Closed] | 21:31 |
| sergiodj | apparently lftp implements its own verification algorithm there? not sure | 21:32 |
| ahasenack | scary | 21:33 |
| ahasenack | I was actually stracing it, to see if it read gnutls' config file, and it doesn't | 21:33 |
| ahasenack | but it links with gnutls for something | 21:33 |
| sergiodj | is ubuntu.com's certificate from Let's Encrypt? | 21:35 |
| sergiodj | ah, it is | 21:35 |
| sergiodj | then: https://github.com/lavv17/lftp/issues/526 | 21:35 |
| ubottu | Issue 526 in lavv17/lftp "FTPS Letsencrypt Certificate verification: Not trusted." [Open] | 21:35 |
| sergiodj | I'm not touching that code with a 10-metre pole, FWIW | 21:36 |
| sergiodj | :-P | 21:36 |
| ahasenack | sergiodj: thanks for finding that, I filed a bug | 21:38 |
| sergiodj | the fact that lftp doesn't work correctly with Let's Encrypt certs && that upstream hasn't addressed this yet is a bit concerning, though :-/ | 21:38 |
| ahasenack | the other bug/fix you linked is closed, thogh | 21:38 |
| ahasenack | what is this one | 21:38 |
| sergiodj | yw | 21:38 |
| ahasenack | I think one is not aware of the other | 21:38 |
| sergiodj | maybe | 21:38 |
| ahasenack | yeah, there is a fix committed | 21:39 |
| sergiodj | ah, good | 21:39 |
| Hinnerk | Ok, I think I messed up my network configuration. My connections do not work anymore. I tried to remove them and reconfigured, but no gain. How do I best go about restoring my sevrers network cards to default? | 22:19 |
| Hinnerk | or rather the connections of course. | 22:19 |
| Hinnerk | I'm also unsure, what to reset. NetworkManager? netplan? How do these live together? | 22:21 |
| murmel | Hinnerk: netplan is telling nm or networkd how everything should be configured. so really depends on how you edited your connections to revert it back | 22:28 |
| Hinnerk | Well, I meddled a bit too much, I think. Did changes to both | 22:32 |
| Hinnerk | I have two NICs in the server, one was not in netplan so I added it. | 22:33 |
| murmel | Hinnerk: well seems like you want to revert to a basic netplan config then. look at netplan.io/examples to see something you like (i assume just dhcp) which should be a 3-liner | 22:34 |
| Hinnerk | Yes, dhcp is fine. | 22:34 |
| Hinnerk | Still fails. | 22:43 |
| Hinnerk | I have two NICs eno1 and eno2 | 22:44 |
| Hinnerk | eno1 should be on dhcp, eno2 I do not care about at this point | 22:44 |
| Hinnerk | as long as it doesn not get in the way, which it may. | 22:44 |
| murmel | Hinnerk: can you paste your config somewhere? for example paste.debian.net | 22:45 |
| Hinnerk | sure just a sec, need to get it out of the server. | 22:45 |
| Hinnerk | Not so eays, since NIC are not working i only have access through IPMI. | 22:47 |
| Hinnerk | Discovered an error. Fixed an rebooting. Doubt it will fix the entire issue, but we'll see. | 22:50 |
| murmel | Hinnerk: you could just do sudo netplan apply to verify if the config works in comparison to rebooting ;) | 22:51 |
| Hinnerk | next time :) | 22:51 |
| Hinnerk | My left CTRL key is deactived via IPMI, it seems. So sometime when I save, I add an S accidently. | 22:52 |
| Hinnerk | Fixed that. | 22:52 |
| Hinnerk | paste.debian.net/1243264 | 22:55 |
| Hinnerk | didn't fix it. | 22:55 |
| Hinnerk | should I add eno2 as well? | 22:56 |
| murmel | Hinnerk: you can, but this should work. question now is, what specifically did you change to not let it work anymore | 22:58 |
| Hinnerk | Yes, I'm surprised too. I didn't do anything totally crazy. | 22:58 |
| Hinnerk | I did use the network manager GUI. But I prefer not to anymore... | 22:59 |
| Hinnerk | never sure, where that changes things. | 22:59 |
| murmel | Hinnerk: ahm are you on a desktop or server? | 22:59 |
| Hinnerk | I am on a server. | 22:59 |
| Hinnerk | It has a desktop though | 22:59 |
| murmel | Hinnerk: well if you use nm, it makes sense that the config doesn't apply as it tries to use networkd | 22:59 |
| Hinnerk | in general I use it without gui, just the services there, apache with nextcloud, dlna server,... | 23:00 |
| Hinnerk | so I think we should do it the proper server way, if there are two. | 23:00 |
| murmel | Hinnerk: can you first verify which network stack you are using? | 23:01 |
| Hinnerk | How? | 23:01 |
| murmel | what does systemctl status NetworkManager.service say? running? | 23:01 |
| Hinnerk | Yes, running. | 23:02 |
| murmel | so edit your config to use the networkmanager stack not networkd | 23:03 |
| Hinnerk | ok, did that. now what? | 23:09 |
| Hinnerk | did apply also. | 23:09 |
| murmel | does your network interface get an ip? (ip addr) | 23:09 |
| Hinnerk | Now this is strange: | 23:13 |
| Hinnerk | eno1 does not get an IP. | 23:13 |
| Hinnerk | eno2 gets the IP eno2 should have gotten. | 23:14 |
| Hinnerk | the DHCP server reserves IPs for their respective MACs. I just verfied that those are set correct. | 23:14 |
| Hinnerk | sry, type, eno2 gets the IP eno1 should have gotten. | 23:15 |
| Hinnerk | and still cant ping the router. | 23:15 |
| Hinnerk | I did verify the cables are ok :) | 23:16 |
| murmel | eh, cables are very unlikely | 23:16 |
| Hinnerk | Yes, I figured, but was desperate. | 23:16 |
| murmel | I do know that having 2 nics on 1 network is kinda weird on linux (had my own fair share of issues) but not to that extend | 23:16 |
| Hinnerk | Can we just completey deactivate one and just make sure the other one works fine? | 23:17 |
| murmel | Hinnerk: sure, i mean as long as you don't configure one of the interfaces, you should be able to use NM perfectly normal. | 23:18 |
| murmel | Hinnerk: is gateway etc set correctly through your dns? | 23:18 |
| murmel | argh dhcp | 23:18 |
| murmel | but I guess most things are on the router? | 23:18 |
| Hinnerk | Yes, but the router works fine. | 23:18 |
| Hinnerk | DNS is configured good. | 23:19 |
| Hinnerk | Just cleaned up configurations in NM. Will reboot router to ensure, there'S no buffering issue or something. So I'll be gone for a bit - but I think I'll call it a day anyway. Thx for the help, I will probably be back (not quite Terminator...). | 23:22 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!