/srv/irclogs.ubuntu.com/2022/10/19/#ubuntu.txt

supremekaiHey guys, which antivirus should I use for ubuntu 20.04?00:47
cartdrigeclamav maybe.00:48
supremekaiI would like to make a full scan on my PC to discover not just virus but irregular services/software running - what should I use? I've heard of tronscript for WIN but not sure if it is OK for LINUX. I've used previously CLAMAV but did not like it00:48
cartdrigeBut it's not so important on linux than it can be on windows etc.00:48
supremekaihow come cartdrige ?00:48
supremekaiclamav is like the "cliché" for linux lol00:48
supremekaibut i find it basic00:48
supremekaiand easy to escape from00:48
murmelsupremekai: mostly because defaults are different. and linux on the desktop is not really popular, which means writing viruses is not interesting00:49
cartdrigeTHere is a suite that is doing firewalling things etc, but i don't remember the name...vulnerability checker...maybe it's on BSD, i won't remember the name anyway.00:49
sarnoldclamav is the usual choice00:52
sarnoldthere's a few proprietary things but they do *gross* things to try to work like windows that causes all kinds of problems00:52
murmelespecially with how nowadays av works, they need to collect a lot of stuff00:52
arraybolt3supremekai: Antiviruses aren't actually necessary on Ubuntu systems, because Ubuntu has well-defined and vetted software repos with info about what is and isn't safe right in the software installers. As opposed to Windows, where you get software from goodness-knows-where.00:54
arraybolt3(That's a very basic overview of why Ubuntu doesn't need an antivirus in most instances, but that should be enough to get a basic idea.)00:54
arraybolt3(There's tons of other reasons on top of that, but IMO, that's the core one.)00:54
=== gabes9 is now known as gabes
sarnoldi tried to get a virus to work once00:58
sarnoldI couldn't get it to go00:58
murmellol, "I _want_ that the virus goes wild, but I couldn't"00:58
arraybolt3[m]sarnold: You did **WHAT?!?***01:08
arraybolt3[m]I've had my devices pwned enough times that I'm usually somewhat paranoid about security.01:09
supremekaiarraybolt3[m], that is a myth lulz01:11
supremekailinux not needing antivirus is like saying just because someone is a bodybuilder he/she does not need a medic01:11
supremekaiI guess it is precisely the contrary01:12
supremekaiopen source sw is much more exploitable with 0-day due to the fact that the code is exactly open01:12
murmelsupremekai: which is a myth, as closed source software, you have no idea if your software is patched or not01:13
supremekaiSo, "OH, u use linux, so.. don't worry about an AV or Anti Malware or whatever" - Not needing a Anti-*ware is just a myth.. and a bad one.. most of the easily infected sys are linux ones..01:13
supremekaimurmel, go to CVE and check the vulns of linux vs. win01:14
supremekailulz, data will change ur wrong perception of this pefect nix world lulz01:14
sarnoldarraybolt3[m]: I'd never seen a linux virus before and wanted to see what it did01:14
arraybolt3supremekai: Fun fact, Linux antivirus programs are actually more geared toward detecting Windows viruses to protect other Windows systems connected to the Linux system.01:14
sarnoldarraybolt3[m]: so I tried to run it but it had been built with some bad assumptions somewhere and couldn't even start01:15
supremekaiarraybolt3, the problem is that now u have a lot of contributors on this snap store bs of nowadays and lot of channels.. ez to infect a lot of users.. not to talk about the npm used in its dev..01:15
arraybolt3The whole point of an antivirus is to protect you if you don't know what you're doing. The whole system of Ubuntu is geared toward keeping people who don't know what they're doing from causing easy damage. One is hopeful security by getting in the user's way at the last minute, one is constant security by making the user do things the right way by default. Ubuntu uses the latter method.01:16
arraybolt3Windoze uses the former one.01:16
supremekaiand anti "virus" is kind of a way of expressing it.. u have anti virus, anti malware, anti bloatware.. and so on and so forth01:16
arraybolt3supremekai: Most of us install our software through apt, also Snaps have publisher identifiers attached to them and will show a clear checkmark next to the publisher if they're trusted. So don't install Snaps from untrusted users. Problem solved.01:16
supremekaiarraybolt3, I would support that idea of Wind00z being the b0z0 in the old days01:17
arraybolt3(This is if you're using the Snap command line interface.)01:17
supremekainowadays anyone can dev anything.. to much open source.. makes your pc ass too open as well01:17
supremekainowadays, I find wind00z more secure than linux01:17
arraybolt3supremekai: This isn't really a support question any longer. Care to continue in #ubuntu-discuss?01:17
supremekaiwhy?01:17
supremekaiare u the boss around arraybolt3 ?01:18
arraybolt3This channel is reserved for tech support, not discussion.01:18
supremekaiuhh01:18
* supremekai an Ubuntu Boss :o01:18
supremekailulz01:18
arraybolt3(No I'm not an admin, but I am a trusted Ubuntu Member, and also one of the admins, sarnold, is right here.)01:18
supremekaiso, call sarnold01:18
supremekaiyou are trusted by who?01:18
* supremekai requests arraybolt3 to show his/her/X badge of "trusted Ubuntu Member"01:19
arraybolt3supremekai: Run /whois arraybolt3, you'll see the badge.01:19
supremekaishow me your creds01:19
supremekaiare u fbi?01:19
supremekaiu fed?01:19
supremekailulz01:19
arraybolt3[20:19] [Whois] arraybolt3 is ~arraybolt@ubuntu/member/arraybolt3 (Aaron Rainbolt)01:19
supremekaithat is forged01:19
arraybolt3!ops supremekai is disrupting the channel01:19
supremekaiif you have an NFT with that badge I will believe u lulz01:19
arraybolt3!ops | supremekai is disrupting the channel01:19
supremekai!ops arraybolt3 is disrupting the channel01:19
ubottusupremekai is disrupting the channel: Help! Channel emergency! (ONLY use this trigger in emergencies) - CarlFK, DJones, el, Flannel, genii, hggdh, ikonia, krytarik, mneptok, mwsb, nhandler, ogra, Pici, popey, sarnold, tomreyn, Unit193, wgrant01:19
supremekai!ops | arraybolt3 is disrupting the channel posing as an authority01:20
ubottuarraybolt3 is disrupting the channel posing as an authority: Help! Channel emergency! (ONLY use this trigger in emergencies) - CarlFK, DJones, el, Flannel, genii, hggdh, ikonia, krytarik, mneptok, mwsb, nhandler, ogra, Pici, popey, sarnold, tomreyn, Unit193, wgrant01:20
arraybolt3(How many times am I going to forget the | in the middle of that? This is the second time I've accidentally tried to redefine the !ops trigger...)01:20
supremekaiso.. keepin up.. do u have an NFT as a *trusted Ubuntu Member* or not?01:20
supremekaiif you have it, I will shut my mouth and stop my fingers01:21
supremekaiOpenSea.io do not count - those are fake NFTs.. totally centralized01:21
murmelsupremekai: lol troll somewhere else, as even windows uses open source01:21
supremekaimurmel, ok01:21
supremekaiI like your nick01:21
arraybolt3murmel: Just ignore, you're just encouraging him :P01:21
supremekaiso I will troll my way out01:21
supremekaiY u mad arraybolt3 ?01:22
supremekaip0s3r01:22
arraybolt3!ping01:25
ubottupong!01:25
arraybolt3Yay!01:25
diceLibrarianis screen tearing normal with a KVM switch?01:45
RingtailedFoxi'm having a bit of a strange issue trying to install zoneminder on my ubuntu system... it's ubunto on WSL2... is this the place for that configuration?02:39
forgotmynickwhen trying to apt-get remove xxx it's also wanting to delete other applications. how do i get it to only delete the single application?02:40
rboxforgotmynick: pastebin the full output02:40
RingtailedFoxforgotmynick, those might be packages that are dependent upon the one you're removing...02:41
forgotmynickthey aren't dependant. it was installed yesterday and  now it wants to delete other things. https://paste.nginx.org/r/d402:42
rboxso which package are you unhappy that it is removing?02:42
rboxproxmox-ve isn't in the ubuntu repos...02:42
RingtailedFoxhttps://pastebin.com/yYvyRaek02:45
RingtailedFoxhow do i figure out why zoneminder isn't connecting with mariadb?02:46
murmelRingtailedFox: do you have systemd enabled? if I remember correctly otherwise mariadb wouldn't run in the background03:16
RingtailedFoxyes, systemd's enabled and mariadb's running in the background03:16
RingtailedFoxzoneminder was running fine until it said it needed to be upgraded... then the upgrade failed... tried uninstalling and re-installing it, but still nope03:17
murmelthe problem with wsl is, that it does quite a bit different to normal ubuntu :S. so I assume that's one of the reasons why it bugs out03:18
RingtailedFoxohhh03:18
murmelfor example up till a month or so, there wasn't systemd03:18
RingtailedFoxreally? because.. i've been testing systemd on WSL2 for like... nearly 3 years o.o03:19
RingtailedFoxand WSL1 before that03:19
murmelRingtailedFox: https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/03:20
murmelRingtailedFox: those don't have systemd03:20
RingtailedFox... huh03:21
RingtailedFoxokay03:21
murmelRingtailedFox: and as described, afaik, you still need to activate systemd in wsl to actually have it03:22
RingtailedFoxalrihty03:23
RingtailedFoxthanks03:23
murmelRingtailedFox: I would think through, if not an actual vm would make more sense03:24
RingtailedFoxyeah..03:24
murmelfor something like zoneminder, as it's not intended for wsl (or the other way around also)03:24
murmelwsl is basically only for dev stuff03:24
Phr33d0mjust use docker with wsl2 backend03:25
murmelPhr33d0m: for a gui tool? sure03:26
Phr33d0mnvm then03:27
Phr33d0mzoneminder seems to be a web tool... there's actually a docker image https://hub.docker.com/r/dlandon/zoneminder03:28
murmelhuh, I thought it was something graphical as you do need to see the feed03:29
Phr33d0mwho's building linux-only GUIs anyways?03:30
murmelPhr33d0m: as it's foss why not03:31
Phr33d0mI haven't seen a single FOSS project in a while that didn't have a windows build as well03:32
murmelthere are a lot, but I agree, they are getting more "popular"03:33
randomusrWhere are the instructions for installing the rolling stable kernel?03:34
murmelrandomusr: oO what is a rolling stable kernel?03:34
Phr33d0myeah I like the idea... why it should be windows vs linux vs mac when it can be windows + linux + m... no, f- apple03:34
Phr33d0m"rolling" and "stable" hehe03:35
randomusrmurmel, latest kernel :P03:36
murmelPhr33d0m: at least they are not as hostile as MS03:36
murmelrandomusr: download debs, apt install ./.deb03:36
ravage!mainline | randomusr03:37
ubotturandomusr: The kernel team supply continuous mainline kernel builds which can be useful for tracking down issues or testing recent changes in the Linux kernel. More information is available at https://wiki.ubuntu.com/Kernel/MainlineBuilds03:37
murmelrandomusr: remember, those kernels are for testing, not for daily driving them03:38
murmelsome work better, some less so03:38
randomusrgot it. I was hoping for kernel 6.0 would I need to add a repo? I'm looking over the link your provided03:40
=== feelingsreal is now known as Guest5507
RingtailedFoxoooh... i'm on win10 though. can i... use the Windows Store version of WSL?04:42
ravageRingtailedFox, https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/04:46
RingtailedFoxi see04:46
RingtailedFoxhmmm, the page says windows 11 and makes no mention of 10... but the windows store page for the preview shows it'l work on win10... here's hopin'!04:47
Phr33d0mI use systemd with wsl, I can confirm that it works04:47
RingtailedFox:D04:47
RingtailedFoxi just hope it works well on my win10 laptop04:47
Phr33d0malthough, are you sure a simple docker container isn't enough for what you need?04:48
RingtailedFoxi've thought of that, actually04:48
ravageRingtailedFox, https://gist.github.com/djfdyuruiry/6720faa3f9fc59bfdf6284ee1f41f95004:48
Phr33d0mravage I just added systemd=true to wsl.conf and it worked... is all this actually required at this point in time?04:50
ravageno idea04:50
ravagei dont run windows :)04:50
RingtailedFoxoh lame, it just throws an error (but at least i can access bash otherwise)04:50
ravage(only in a VM)04:51
RingtailedFoxWindows version 10.0.19044.2130 does not support the packaged version of Windows Subsystem for Linux.04:52
RingtailedFoxFor information please visit https://aka.ms/wslinstall04:52
RingtailedFoxPress any key to continue...04:52
RingtailedFoxsometimes when i start ubuntu in WSL, it shows "Sleeping for 1 second to let systemd settle" at the top... always has.. i wonder why that is04:53
ravagesounds like a question you have to ask the M$ support04:53
* RingtailedFox nods04:54
Phr33d0mdo you need all this just for the zoneminder thing?04:54
RingtailedFoxPhr33d0m, i would like to test having the ability to view my security cameras under linux... eventually (well, by 2025) my laptop will be EOL since it doesn't support windows 11 (it only fails the CPU part)... so, i'd like to migrate it over to linux (hopefully somethign like ubuntu) and see if that works04:59
Phr33d0myou really shouldn't bother with wsl for this... just install docker desktop and use this https://hub.docker.com/r/dlandon/zoneminder05:00
RingtailedFoxoooh! okie!05:00
RingtailedFoxthanks05:00
maiconhi05:39
tronic_Hi05:57
Apachezjust grab a laptop and install ubuntu LTS natively on it and call it a day, dont forget to keep it updated and backup important stuff every now and then (like once a week or so)06:01
ApachezI have done similar with an entry system... installed vbox and windows10 within that to run the win32 software that the entry system needs06:02
Apachezfuture entry systems we will buy are demanded to only use html5 as frontend06:02
Apachezas in use whatever modern browser you wish on whatever os you wish06:02
LuckyManI'm planning to install 22.10 on an old laptop. It currently has 22.04. How long do I have to wait for the new version warning?06:09
LuckyManafter October 20, I mean06:10
ravageLuckyMan, if you installed the system with 22.04 you will not get any notification about 22.10 as you are on the LTS update path06:14
ravagei would also suggest you stay on that path unless you really need any features of 22.1006:15
ravageLuckyMan, if you really want to get the update notification you have to change it here: https://i.imgur.com/cOOhqst.png06:17
LuckyManthanks ravage06:30
=== SteelRose_ is now known as SteelRose
makara1hi. Why wont my ipsec VPN connect with 22.04. Same settings worked fine on 20.04. Here are the logs https://paste.ee/p/JEdNn07:05
SteelRosemakara1: 'Timeout was reached' <-- can't you increment the timeout threshold?07:09
makara1SteelRose: no, its a hardcoded 10sec timeout. Clearly the remote is refusing to interact any further with my requests07:10
=== guiverc2 is now known as guiverc
danteFriends, I have installed Brave through Snap, notifications in a website are set to allow, notifications of brave are allowed in Ubuntu but it still doesn't work. How come?07:41
dantehttps://ibb.co/MgNGrrt  here is the screenshot (in italian) of the alert it gives. Notis simply don't work in Brave. weird.07:43
ravagedante, https://community.brave.com/t/no-notifications-in-ubuntu-22-04-lts/43750608:41
=== BT is now known as Guest1522
lokisiranyone know how to unbrick a phohne with ubuntu>?08:51
ogralokisir, try one of the ubports channels ... https://ubports.com/de/contact/consumers08:52
dante@ravage, yes I opened that topic. got no solution09:02
=== EriC^ is now known as EriC^^
lokisirhi09:50
tuxragehello, curious to know if i can get some quick help/answers here... i boot with uefi and i see grub, then i see EFI stub: ... using dtb... EFI stub: Exiting boot services.... then all of the kernel output is missing. finally, after some time i see the login prompt on tty1 ... does anyone know how to print out the kernel messages after efi stub: completes and boots the kernel? i am expecting to see: [09:54
tuxrage0.0000] booting linux on cpu ..... [0.0000] linux verson 6.0-arm64 (ubuntu-kernel@blah) etc...09:54
=== ViktorasCAM is now known as sinvet
ogratuxrage, edit /etc/default/grub, remove "quiet splash" from the commandline variable, run sudo update-grub, next reboot should show the messages (*if* your default console= points to the correct tty that is)10:27
dionysus69is there a solution for having 4k external monitor and 1080p laptop screen to work together with smooth mouse transitions? it's pretty annoying to move mouse from one screen to another if I am the wrong edge.10:28
=== gacuxz1 is now known as gacuxz
VonorHi. In a fresh jammy docker container I have python3 and python3-pkgconfig installed. a configure script (libxml 2.10.3) fails with "configure: error: Package requirements (python-3.10) were not met:" I failed to find a working solution on $searchengine11:34
nteodosioHi Vonor, we would most likely need to see that full message.11:37
Vonorsure. https://pastebin.com/raw/ZejQWHCB11:39
Vonori get the same issue if i use python2 instead. the error messages changes from python-3.10 to python-2.7 so seems version inspecific.11:44
=== Vonor96 is now known as Vonor
MonoLIḿ in keyboard hell11:55
MonoLI cant get this11:56
MonoL ahhhhhh11:56
MonoLI cant get this keyboard to write apostrophes and double qoutes11:58
AlexC" '11:59
AlexCctrl + c ctrl + v11:59
AlexC:>11:59
Vonoryou probably have the wrong keyboard layout configured11:59
MonoLlook what itś doing to Iḿ and itś...11:59
tuxrageogra: i will try with the console=11:59
Vonorif you are on gnome/kde, go to settings and check the keyboard settings12:00
mariosdaskalas.12:00
MonoLIḿ using gnome12:00
mariosdaskalasHi, I am using Ubuntu 22.04 64-bit. I am searching for an app similar to flux, but I am using Wayland and I am running into problems. Any recommendations/12:01
MonoLI'm it's12:02
MonoL'@WE23"£12:02
Vonorlooks good12:02
MonoLah yeah12:02
MonoLjust swapped to english uk12:03
MonoLgood work12:03
MonoLthanks12:03
ograVonor, could it be it is actually looking for a binary called pyton-3.10 ? (note that the ubuntu binary python is called python3.10 (i.e. no dash) ... perhaps a symink in /usr/bin is sufficient ?)12:12
=== hasley is now known as mahler
Vonori have a symlink for python-3.10 already still fails.12:13
ograten it is not that indeed 😞12:14
ogra*then12:15
Vonorsince i don't need the python bindings currently i worked around it by adding --without-python to the configure options. at least it compiles now12:34
ograi'd grep though the surce though and see if you could easily change it and remove the dash12:37
=== dd3my is now known as Guest8214
=== Guest0_1 is now known as beaver
BluesKajHi all13:15
powftwHey guys. I have a python-flask app made inside my Arch machine. Made --onefolder package with Pyinstaller and when i try to run the same in Ubuntu, it says; https://bpa.st/5PTA13:37
whatever543Hello, my wifi card stopped working and I'14:38
whatever543spent a month trying to solve it: https://askubuntu.com/questions/1429758/qualcomm-artheros-wifi-card-not-detected-stopped-working14:39
whatever543any suggestions?14:39
ioriawhatever543, well, if you know how to handle -proposed, there's a new version of linux-firmware, but i'am doubtful14:45
=== Phr33d0m_ is now known as Phr33d0m
whatever543ioria yeah I don't know how to handle -proposed :/14:46
EckoHi let's say I have a script with the following line: `commandX | tee -a $LOG`14:53
EckoBut now I want to catch the exit code of commandX in a variable, how can I do this?14:53
=== fling is now known as narrator
ioriaEcko, https://stackoverflow.com/questions/6871859/piping-command-output-to-tee-but-also-save-exit-code-of-command14:57
lotuspsychjeogra: you here?14:57
ogralotuspsychje, yep15:04
lotuspsychjeogra: im stuck in a loop on a customers focal to jammy upgrade on FF snap15:06
lotuspsychjeogra: it keeps saying has “install-snap” change in progress”.15:07
lotuspsychjeeven when i abort ID it doesnt want to instal after15:07
ograupgrade with do-release-upgrade ? or some cdrom way ?15:09
lotuspsychjecustomer did upgrade himself but aborted at some point, im on desktop now15:09
ograhmm15:09
lotuspsychjevia recoverymode15:09
ogracan you pastebin "snap changes" ?15:10
lotuspsychjebut when trying to update, its stuck on deb to snap FF whatever i do15:10
bgbubuntu boot get stuck at grub  if screen auto sleep after last shutdown,  any idea?15:10
bgband if I manually turn off then turn on  the screen, then it works15:11
lotuspsychjeogra: termbin.com/n1xt15:12
ogralotuspsychje, and "snap change 2" ?15:12
ogra(or 4, i bet they say the same)15:13
lotuspsychjeogra: termbin.com/d7qk15:14
lotuspsychjei tryed to purge snapd too, but no dice to skip FF15:15
ograwll, is that machie offline ? it fails all its downloads it seems15:16
lotuspsychjeno its up15:16
lotuspsychjelemme try on cable15:16
ogra2022-10-19T17:05:14+02:00 ERROR the download has been cancelled: context canceled15:17
ogracan you check if "snap change 4" has anything different than that ?15:17
ogracould be that 2 is the one the customer canceled15:17
lotuspsychje_ogra: think something changed after reboot + cable now15:24
ograaha15:24
lotuspsychje_ogra: im seeing locale FF deb/snap packages running now, think its gonna work15:26
ograawesome15:26
ogradoes the oter connection use a proxy or something by chance ?15:26
ogra*other15:26
lotuspsychje_no i was on wifi here15:26
ograweird15:26
lotuspsychje_yeah15:26
lotuspsychje_tnx for the think along anyway ogra15:28
ograalways happy to help 🙂15:28
=== justache is now known as justHaunted
benioHi guys16:21
benioCan l securely delete files on my windows 7 installation using a live cd?16:22
jhutchinsbenio: Live CD of what?16:24
benioUbuntu16:24
jhutchinsbenio: What is your requirement for "secure" deletion?16:24
benioTo make it most difficult to recover16:24
jhutchinsbenio: Seriously, what standard do you require?  DOD or PCI?16:25
jhutchinsbenio: What attack vector are you defending against?16:25
benioI'm not too savvy on the terms mate16:26
jhutchinsbenio: What audit standard do you have to meet?16:26
jhutchinsbenio: Is this just a home system?  Are you worried about external access or about the hardware falling into hostile hands?16:27
benioI'm just trying to delete my sensetive files so no one can recover it easy16:27
benioYes16:27
benioIt's a home system16:27
benioBoth16:27
jhutchinsbenio: Do you have encryption enabled on Windows?16:27
benioNo16:28
benioThe files can be accessed on linux16:28
jhutchinsThat's probably the first step.  You may find something here: https://askubuntu.com/questions/57572/how-to-delete-files-in-secure-manner16:29
jhutchinsbenio: In order to access the files with linux, you would probably need physical access to either boot linux or physically mount the drive(s) on a linux system.16:30
benioWell l loaded a live cd and l can access my main 7 os16:30
benioWin 716:30
jhutchinsbenio: You have to weigh the value of your information to a hostile party vs. the difficulty in breaking the security.16:31
benioThere are some files which l want shreddrd16:31
jhutchinsbenio: You can overwrite the contents of the file before deleting it.16:32
benioWell lm mostly trying to prevent the local geek from accessing and recovering my files16:32
benioMy computer is going to be put in the cliset16:32
benioCloset16:32
jhutchinsbenio: I would suggest encryption from the Windows side, and for specific files copy /dev/null over them, or /dev/random.16:33
benioWill it be strong enough?16:33
jhutchinsbenio: That's always relative to how hard your opponent is willing to work.  Writing over the data will defeat a casual attacker.  It requires forensic techniques to recover the data.16:34
jhutchinsbenio: You might want to learn about data recovery techniques to understand what is still vulnerable.  Encryption + overwrite is pretty  difficult to crack.16:35
jhutchinsbenio: Encryption will overcome most casual recovery tools because there is nothing recognizable as a file.16:36
jhutchinsA large stick and a sign that says "Don't mess with my files" can also be helpful.16:36
benioI don't care about the forensiccs16:37
benioLol l got nothing they'd care about16:37
benioUnless they're theived16:38
benioTheives16:38
jhutchinsbenio: Good point.  Measure your efforts accordingly.16:38
jhutchinsbenio: DOD is the U.S. Department of Defense, they have published standards for deleting data from storage devices (drives) that are being disposed of.  They vary with the level of security of the data.16:39
=== diskin is now known as Guest6755
=== diskin_ is now known as diskin
jhutchinsbenio: PCI refers to the security standards for the Payment Card Industry.  It's not a system you need, but scanning the standards can give you a good model for how to approach security.16:41
jhutchinsbenio: Something that would probably address all of your concerns would be simply setting a boot password on the computer, so someone couldn't bypass the basic Windows security; couldn't boot to a Linux image.16:46
=== lotuspsychje_ is now known as lotuspsychje
Macwinnerhi, i'm trying to wrap my head around the different network management tools.  eg, netplan vs NetworkManager vs ip vs ifconfig vs brctl ( am I missing anthing?).  Was wondering if someone here could give me their understanding.17:20
Macwinneri guess networkd is another thing17:20
ogranetworkd is just a backend you usually do not touch by hand17:20
ogranetpan creates configs for networkd on systems that di not have NetworkManager17:21
ogra*netplan17:21
ogras/di/d👋17:21
ograip is simpy the successor of the deprecated ifconfig17:22
ogra(and i need a new keyboard for this laptop 😞 )17:23
Macwinnerthank you!  so changes using ip should not expected to be persisted across reboots?17:23
ograright17:24
ograon a server you'd edit the config in /etc/netplan/ ... on a desktop you either use the network-manager gui or something like nmtui to set it up17:25
Macwinnerso when I do 'netplan apply' assuming networkd backend, then it is presumably generating some networkd config files somewhere and asking networkd to reload?17:25
ograyes17:25
ograand a good hint is: dont use apply, use "netplan try"17:25
Macwinneroh yeah.. i saw that.. just in case you hose your connection to the server it will revert, right?17:27
ograit applies the new confg but rolls back to the old one if you do not confirm17:27
ograpretty much like the resoution switching for the desktop ... it counts down and reverts if you do not say it is okay17:27
jhutchinsogra: So /etc/network/interfaces is deprecated/obsolete/doesn't work any more?17:38
ograsince several years ...17:38
alkisgThat's ifupdown or ifupdown2, it still works fine in ubuntu 22.0417:38
ograsure, but it is not installed 🙂17:39
alkisgTrue. It's also the default in Debian :D17:39
ogradoesnt help much given the installer will set up somethig completely different (why would you change to something unsupported instead of altering the existing config)17:39
alkisgEach one of these has its own quirks; and there's a learning curve; so it's understandable that some sysadmins stick to the tools they know until they get completely removed from the archives :D17:41
ograbut yeah, ifupdown2 is in universe and if you insist you can even run an ubuntu system with it (have fun removing all the default bits to avoid clashes)17:41
BCBI'm trying to redirect non-www URL to a www URL in apache2 on Ubuntu 22.04.1 LTS and not having any luck with my googlefu.  Any suggestions?17:41
alkisgAFAIK upgrading from older Ubuntu's doesn't automatically remove or disable ifupdown...17:41
ograright17:41
ioriaifupdown2 is dead17:42
ogra2 too ?17:42
ograthat was short lived then17:42
ioria2 is dead17:42
jhutchinsogra: Supported + $5 will get you a cup of coffee.17:58
=== diskin is now known as Guest9274
=== diskin_ is now known as diskin
=== Ringtailed-Fox is now known as RingtailedFox
=== kirill_ is now known as Guest1841
Guest1841hello from Ukraine18:25
Were-thekauhey18:26
wolfravenouscan anyon help me figure out why my Apache server is getting bombarded by requests, even though my UFW rulles should only allow acces to it from my LAN and one other public IP address?   https://pastebin.com/3wbPgAe618:32
wolfravenousThat pastebin shows my rules by my apache server-status page shows up to 150 requests from random ip addresses.18:34
BCBI've recently upgraded and I'm having trouble getting Apache/2.4.41 on Ubuntu 22.04.1 LTS to redirect a non-www url to a www url. Any suggestions.18:50
BCB?18:50
sarnoldBCB: pastebin your config? maybe someone can spot the problem18:51
EriC^^wolfravenous: maybe you should disallow all too18:51
geniimod_rewrite ?18:51
sarnoldBCB: I once spent hours trying to solve a problem with apache that boiled down to including a / at the end of an url when it shouldn't have been there -- or the other way around. I can't remember.18:51
sarnoldwolfravenous: what's the default rule? are you dropping by default? are the packets matching *other* input rules? have the packets been NATted or something and thus actually do look like they're coming from the LAN?18:52
=== heart1 is now known as heart
wolfravenoussarnold: I was under the impression with UFW the default is to deny all traffic unless explicitly allowed.  My other input rules are for other ports that are not managed by Apache and specify the port, so I don't think they would be involved... However i can paste my full rule set if that is helpful.  And I don't know how to check if the packets have been NATed?18:57
EriC^^wolfravenous: i dont think it denies all by default18:58
sarnoldwolfravenous: I'm not sure which is the default, I am sure that your output doesn't include what the default is :)18:58
wolfravenouswhen setting it up they always make you create the ssh rule first so you don't lock yourself out if sshing into the terminal so I just figured it was drop all by default.18:59
EriC^^wolfravenous: not sure about the default, but maybe worth doing "ufw default deny incoming"19:00
EriC^^nevermind seems it does deny by default19:01
EriC^^sudo ufw status verbose  should show you the current settings19:01
wolfravenousthe terminal replied: Default incoming policy changed to 'deny' (be sure to update your rules accordingly).... so maybe it wasn't set to deny by default.19:02
murmelwolfravenous: by default it's deny, but if you deny it again, it will comply by changing it to deny ;)19:05
wolfravenousI used that command "sudo ufw default deny incoming"  and restarted ufw.  Then I started apache and within 30 seconds, my ip is bombared by apache requests from random ip's  It is like my IP is in some kinda bot swarm... and UFW doesn't love me at all.19:06
murmelwolfravenous: which ports are open?19:08
murmelahh saw the link19:08
murmelwolfravenous: are your random ips in the local network or outside?19:09
murmelaka internet19:09
wolfravenousHere are my rules:  https://pastebin.com/qDBtJscD19:09
wolfravenousthe random IP's are all outside IP's none of them are LAN addresses19:10
wolfravenousthe verbose output of UFW status says Default:  deny (incoming)  so that is correct.19:11
murmelwolfravenous: can you dump the actual rules within (nft/iptables) to see if some random rule is added19:11
wolfravenousHere is a list of all the IP's that are hitting me within 30 seconds of turing on apache:  https://pastebin.com/xMXEZYt119:12
wolfravenousmurmel:  how do I dump those rules?19:12
bougymanNot going to a pastebin site, but what is it you're expecting?19:13
murmelwolfravenous: iptables -L // nft list ruleset19:13
bougymanThere's hundreds of thousands of crawlers hitting everything with 80/443 open at any time.19:13
murmelbougyman: are you sure, that it should hit 80/443 if it's not allowed in the fw19:13
murmel(firewall)19:13
bougymanmurmel: the firewall is broken, in that case.19:14
wolfravenousbougyman:  since I only allow access on port 80 and 443 to my LAN and one public IP address I don't expect anything by my traffic19:14
murmelbougyman: that's why we want to see what's going on19:14
bougymanwolfravenous: have you put a dump of your rules somewhere yet? (not pastebin, please).19:14
murmelthis is what i right now asked19:14
murmelsee log19:15
bougymanFor a rule dump, I personally prefer iptables-save -n19:15
bougyman(for iptables, not for nft)19:15
wolfravenousmumel that commend returned:  iptables v1.8.7 (nf_tables): Invalid rule number `nft'19:15
bougymannft's sane with list ruleset.19:16
bougymanwolfravenous: `iptables-save -n`19:16
murmelhuh, i thought 22.04 switched over to nft19:16
bougymanOh woops, -n is not valid anymore.19:16
bougymanswore it used to be. So just `iptables-save`19:17
bougymanmurmel: he typed the whole thing you typed.19:17
bougyman% sudo iptables -L // nft list ruleset19:17
bougymaniptables v1.8.7 (nf_tables): Invalid rule number `nft'19:17
bougyman:)19:18
wolfravenousOh Crap! there is a lotta mess from that iptables-save command... if not pastebin where should I dump it?19:18
murmeltermbin, paste.debian.net19:18
murmeleh termbin.cm19:18
murmelcom19:18
wolfravenousjust a sec19:19
bougymanI like ix.io, but they use termbin here a lot.19:19
bougymanbasically anything but pastebin, hah.19:19
murmelwolfravenous: pastebin.com had issues with malware (distributing) and their ads :S19:19
murmelbougyman: yeah because you can just | nc termbin.com 999919:19
bougymanmurmel: yeah that's handy.19:19
bougymanso `sudo iptables-save | nf termbin.com 9999`19:19
bougymanugh.19:20
bougymans/nf/nc/19:20
murmelbougyman: he probably won't want to do it that way, as he doesn't want to expose one of the ips from his work19:20
bougymanwell he could <SNIP> that out.19:21
wolfravenousHere ya go.  https://paste.debian.net/1257636/19:21
wolfravenousI realize that it has a ton of Fail2ban mess in that paste from the iptables-save command.... is there something neater for output?19:22
bougymanThere's nothing more complete.19:22
bougymanAnd complete is kinda what we need.19:22
wolfravenousHey, I just saw something in that paste, line 173  from where I was setting up geo ip blocking... it has 80 and 443 and ACCEPT... is this the root of my issue...19:24
murmelwolfravenous: yes19:25
bougymanLooks like it.19:25
wolfravenousI was using geo blocking cause this is just a home server, and the only people that need any access are me and my family, no commerce so was not wanting it open world wide..19:25
murmeland honestly, geoip is imo not _really_ helpful as IPs are nowadays sold outside their respective country (I assume US is still better than "random country" but still)19:25
wolfravenousAlso, noticed that all those IP addresses that are bombarding me are actually in US...19:26
bougymanYeah, still never know where the person _using_ that IP is from.19:26
bougymanI'm in Mexico right now but using an IP in Maine.19:26
wolfravenousTrue, I guess it is easy enough to setup proxies on AWS, Azure and hosting sites like that, most even offer free trials, heehe19:27
bougymanCloudflare has a great free plan.19:27
bougymanYou'd never need more.19:27
murmelwolfravenous: especially oracle19:27
bougymanAnd they do create spam/ddos prevention out of the box.19:27
bougymanJust enabled that check that you see in your browser when you get to cloudflare sites (checking browser, blah blah).19:27
bougymanOf course that makes curl and most scripts impossible to use.19:27
bougymanSo that's sometimes a downside.19:27
wolfravenousOkay let me see if I can nuke that rule that was on 173 and see if that helps... will post back my results.19:28
murmelwolfravenous: depending on your needs think about vpn setups. i do it with wireguard and android where it's always connected19:28
StyXmanis there a tool to know which nvidia modules I need for a given card?19:31
murmelStyXman: ubuntu-drivers devices19:32
murmelshould at least tell you which devices need drivers19:32
=== withered_wolf is now known as thought_fu
=== thought_fu is now known as withered_wolf
StyXmanmurmel: tx19:34
jhutchinswolfravenous: Without looking at your pastes: What port are you running sshd on?19:34
murmeljhutchins: iptables had a rule to allow 80 from US ;)19:34
jhutchinsWell, 80, 443, and 22 are the main targets.19:35
jhutchinsTrying to remember why I didn't see brute force attacks on the web server ports ...19:38
jhutchinsI think it was because delivering a 404 was less load than denying an ssh login.19:38
jhutchinsBesides, we were tuned and ballanced for HTTP.19:39
murmelbut wouldn't https negate the "advantage"? tls _is_ quite heavy on hw19:39
murmelnot that much anymore, but when talking about ddos19:39
wolfravenousI nuked that rule related to geoip in /etc/ufw/before.rules and now things are as expected. No apache traffic except from me.19:40
jhutchinsFor some reason I only remember legitimate load bogging down the site, and it managed to keep serving, if slowly.  I guess Apache's built to que and service large volumes of requests.  SSHD not so much.19:40
wolfravenousThanks SO MUCH for assisting on this big win for me!19:40
murmelwolfravenous: yw :)19:41
jhutchinsI take it there isn't actually a public ssh port.19:41
murmelnope19:41
murmeljhutchins: yeah sounds reasonable that apache is more robust for high load19:41
murmeli mean sshd won't often get 100000 req/s19:42
wolfravenousIt is all about being aware of what I was doing.... I locked everything down the way I wanted it but then when I tried to add the GeoIp to it, I actually messed up what was probably working before, LOL.19:42
murmelwolfravenous: imo it's always helpful to see the rules in iptables/nft, as that's how they are processed (top to bottom)19:43
murmelwhich means if you allow first something then reject it in the next line, it will always get allowed19:43
murmelreject/deny depends on your needs19:44
wolfravenousfirst rule has priority, got it!   this also solved the random bots hitting ssh port that was showing up when I would run lastb command.19:45
sjdnsis ubuntu /usr-merged?19:46
murmelsjdns: yes19:46
wolfravenousWell guys, I am heading out to the woods!  Thanks again for everyones help... I am about half a century and IRC seems like for decades has always been the best place to get help!19:46
sjdnswhen did that happen?19:47
murmelwolfravenous: hf, and yes, it's where the old guys sit ;)19:47
sarnoldwolfravenous: enjoy :)19:47
sjdnsI just had a weird issue with /usr/bin/grep missing19:47
murmelsjdns: disco for new installs19:48
murmelso 19.0419:48
murmelsjdns: so very old install or is something broken?19:50
philwongHi19:52
philwongIs there any good secure wipe software for Ubuntu?19:52
philwongI'm trying to wipe an ssd19:52
murmelwith ssds you can _never_ be sure that it's actually wiped19:53
philwongHmm19:54
philwongI see19:54
murmelthat's why you use encryption or never sell/use it again19:54
philwongWhat do you suggest?19:55
murmelfor what?19:55
philwongTo destroy it19:55
wolfravenousphilwong:  a sledge hammer ;P19:55
murmelhm, take it to the gun range, burn it, keep it in a safe. there are quite the options depending on where you live19:55
murmeloh yeah sledgehammer is also a good idea19:56
murmelbut please don't burn it19:56
murmelall the chemicals :(19:56
philwongI know19:56
philwongI thought that as well19:56
murmeli mean there is a reason why most companies keep hdd/ssd/ram and/or pay __a lot__ of money to other companies to destroy it19:57
philwongIf l reinstall a os and then encrypt it and wipe it would that work?19:57
murmelphilwong: no19:57
EriC^^why not19:57
murmelEriC^^: because we don't know what the ssd controller does19:58
arraybolt3[m]SSDs are notorious for possibly leaving shreds of important data around in spots like the overprovisioning areas.19:58
arraybolt3[m]It's a mess. They're great for storage, not so great for deletion.19:58
arraybolt3[m]Really with any modern storage media, the safest way to delete everything on it is to physically obliterate the device.19:58
murmelEriC^^: because of compression and other stuff you never know what it does to speed up your experience19:58
sarnoldphilwong: dd if=/dev/urandom of=/dev/whatever bs=1024k20:00
EriC^^i see, thanks20:00
sarnoldphilwong: as arraybolt3[m] it'll leave some stuff in the slop areas, but it's a good start20:00
sarnoldhmm, I wonder if one of the partitioning tools has an easy way to trim the entire thing20:00
murmelhonestly, I would just destroy the ssd, and restart with a new one, but that depends heavily on what kind of data we are talking about20:01
arraybolt3[m]You could also hit it with a Secure Erase command.20:01
murmelarraybolt3[m]: which we don't know what it does ;)20:01
sarnoldphilwong: blkdiscard(8)20:01
arraybolt3[m]murmel: Valid point.20:02
philwongIf l hammer it and put it in vinegar and let it sit for a week20:03
philwongMaybe that helps20:03
murmeldefinitely ;)20:03
StyXmanwhat is the name of this tool? https://i.stack.imgur.com/itfVN.png I don't have it installed20:03
arraybolt3[m]philwong: That sounds like a fairly effective method of doing it. Might also roll over it with a truck.20:04
murmelbut honestly selling tech gets more and more impossible. just to give an example: bought a used laptop, and when I installed win to update a few firmware blobs, it literally showed me what the prior persion bought on the microsoft store etc20:04
murmelStyXman: software-properties-gtk20:04
StyXmanphilwong: donate it to a clueless friend or family member20:05
philwongBlunt force alone will still leave data in the microchips?20:05
philwongEven if it breaks20:05
arraybolt3[m]philwong: Yes but you can't get at that data unless you can somehow reassemble the crushed chips.20:05
arraybolt3[m]I mean at that point you might could try to get some data out of it, but the equipment, time, and cost would be insane.20:06
StyXmanmurmel: tx; FYI there's also software-properties-qt :)20:07
murmelStyXman: yeah, source package is called software-properties ;)20:07
StyXmananyways, reboot time20:07
philwongSarnold dd is the Linux command right20:18
murmely20:18
philwongI'm gonna run it on livemode20:18
philwongLiveusb20:18
philwongDoes it come pre-installed?20:19
philwong Or do l have to download the utility from the utility software center20:20
sarnoldphilwong: dd is probably available in the live mode20:20
philwongOk20:21
murmelit's definitely preinstalled20:22
jhutchinshttps://dban.org/20:31
murmeljhutchins: do you know how it verifies that the data is gone on ssds?20:32
jhutchinsmurmel: It has the options to be fully DOD compliant.  That should be enough for you.20:32
murmeljhutchins: just asking, as I don't want to delete data _that_ bad ;)20:33
murmelbut sounds legit then thanks20:33
jhutchinsmurmel: It also has some lighter options.  If I have to leave old drives functioning it's what I use.  Not fast.20:34
jhutchinsAs in launch it at the end of your day and come back tomorrow.20:34
murmeljhutchins: I wonder how expensive the full version is, as one of the companies, which are like "if you don't ask, you can't afford"20:36
murmelis there a way to setup a proxy before installing ubuntu desktop?21:20
oerheksmaybe booting in live mode first21:23
tomreyni guess if you    export http_proxy=http://10.0.0.0    this may apply21:24
murmelthanks will try out. problem is that it downloads stuff even when selecting not to download updates :S21:24
tomreynmaybe what it downloads aren't updates then21:25
murmelwhat is it then? I assume the iso should have everything it needs to install a desktop21:25
tomreynmaybe it's testing whether apt repositories are reachable or something, i don't really know.21:26
murmelinstalling right now, will see what the logs say, I only ever saw that it tries to reach repos for packages21:26
sjdnsso it is safe to remove /bin?21:36
sarnoldno21:36
sarnolda lot of programs assume specific tools are in specific directories, rather than searching through PATH to find them, and removing the symlink would break those programs21:37
murmeltomreyn: lol you were right, it just populates the database. I assume I saw that apt downloads the Packages file, and assumed it downloads Packages :S21:37
oerheksthat /bin folder is not a Recycle Bin.21:38
murmeltomreyn: grml, it _does_ download packages21:39
tomreynyou can always pull the plug, if there are plugs involved21:41
tomreynor just not bring it online, or bring it offline instead, or change the default gateway.21:41
murmelat least there is a virtual plug, still annoying to always go into vm settings21:41
sjdnsgreat, the merging of /bin is done21:41
sjdnswhere should /lib64 point to?21:43
murmelsjdns: /usr/lib64?21:45
Bashing-omsjdns: sysop@x2204mini:~$ ls -al /lib64 >> lrwxrwxrwx 1 root root 9 Aug 26 18:37 /lib64 -> usr/lib6421:45
oerheksweird, here to /lib/x86_64-linux-gnu/ld-linux-x86-64.so.221:46
murmelwhy would a dir point to a file oO21:46
oerheksits the file in the dir?21:47
sarnoldopendir() is gonna fail pretty hard when pointed to a file though21:47
murmeloohh, I misunderstood you as we were talking about /lib6421:48
murmelnot the file in it :)21:48
BCBAny idea why file_put_contents is getting a failed to open stream: Permission denied on Ubuntu 22.04.1 LTS ??21:50
ravageit does not have permission?21:50
ravagejust a wild guess21:51
=== robert_ is now known as Guest7347
sarnoldBCB: that's pretty thin information to go on -- is it a snap? if so, do you need to connect interfaces?21:55
* tomreyn is guessing on https://www.php.net/file_put_contents21:57
tomreynbut then we still don't know anywhere close to enough21:57

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!