[00:47] <supremekai> Hey guys, which antivirus should I use for ubuntu 20.04?
[00:48] <cartdrige> clamav maybe.
[00:48] <supremekai> I would like to make a full scan on my PC to discover not just virus but irregular services/software running - what should I use? I've heard of tronscript for WIN but not sure if it is OK for LINUX. I've used previously CLAMAV but did not like it
[00:48] <cartdrige> But it's not so important on linux than it can be on windows etc.
[00:48] <supremekai> how come cartdrige ?
[00:48] <supremekai> clamav is like the "cliché" for linux lol
[00:48] <supremekai> but i find it basic
[00:48] <supremekai> and easy to escape from
[00:49] <murmel> supremekai: mostly because defaults are different. and linux on the desktop is not really popular, which means writing viruses is not interesting
[00:49] <cartdrige> THere is a suite that is doing firewalling things etc, but i don't remember the name...vulnerability checker...maybe it's on BSD, i won't remember the name anyway.
[00:52] <sarnold> clamav is the usual choice
[00:52] <sarnold> there's a few proprietary things but they do *gross* things to try to work like windows that causes all kinds of problems
[00:52] <murmel> especially with how nowadays av works, they need to collect a lot of stuff
[00:54] <arraybolt3> supremekai: Antiviruses aren't actually necessary on Ubuntu systems, because Ubuntu has well-defined and vetted software repos with info about what is and isn't safe right in the software installers. As opposed to Windows, where you get software from goodness-knows-where.
[00:54] <arraybolt3> (That's a very basic overview of why Ubuntu doesn't need an antivirus in most instances, but that should be enough to get a basic idea.)
[00:54] <arraybolt3> (There's tons of other reasons on top of that, but IMO, that's the core one.)
[00:58] <sarnold> i tried to get a virus to work once
[00:58] <sarnold> I couldn't get it to go
[00:58] <murmel> lol, "I _want_ that the virus goes wild, but I couldn't"
[01:08] <arraybolt3[m]> sarnold: You did **WHAT?!?***
[01:09] <arraybolt3[m]> I've had my devices pwned enough times that I'm usually somewhat paranoid about security.
[01:11] <supremekai> arraybolt3[m], that is a myth lulz
[01:11] <supremekai> linux not needing antivirus is like saying just because someone is a bodybuilder he/she does not need a medic
[01:12] <supremekai> I guess it is precisely the contrary
[01:12] <supremekai> open source sw is much more exploitable with 0-day due to the fact that the code is exactly open
[01:13] <murmel> supremekai: which is a myth, as closed source software, you have no idea if your software is patched or not
[01:13] <supremekai> So, "OH, u use linux, so.. don't worry about an AV or Anti Malware or whatever" - Not needing a Anti-*ware is just a myth.. and a bad one.. most of the easily infected sys are linux ones..
[01:14] <supremekai> murmel, go to CVE and check the vulns of linux vs. win
[01:14] <supremekai> lulz, data will change ur wrong perception of this pefect nix world lulz
[01:14] <sarnold> arraybolt3[m]: I'd never seen a linux virus before and wanted to see what it did
[01:14] <arraybolt3> supremekai: Fun fact, Linux antivirus programs are actually more geared toward detecting Windows viruses to protect other Windows systems connected to the Linux system.
[01:15] <sarnold> arraybolt3[m]: so I tried to run it but it had been built with some bad assumptions somewhere and couldn't even start
[01:15] <supremekai> arraybolt3, the problem is that now u have a lot of contributors on this snap store bs of nowadays and lot of channels.. ez to infect a lot of users.. not to talk about the npm used in its dev..
[01:16] <arraybolt3> The whole point of an antivirus is to protect you if you don't know what you're doing. The whole system of Ubuntu is geared toward keeping people who don't know what they're doing from causing easy damage. One is hopeful security by getting in the user's way at the last minute, one is constant security by making the user do things the right way by default. Ubuntu uses the latter method.
[01:16] <arraybolt3> Windoze uses the former one.
[01:16] <supremekai> and anti "virus" is kind of a way of expressing it.. u have anti virus, anti malware, anti bloatware.. and so on and so forth
[01:16] <arraybolt3> supremekai: Most of us install our software through apt, also Snaps have publisher identifiers attached to them and will show a clear checkmark next to the publisher if they're trusted. So don't install Snaps from untrusted users. Problem solved.
[01:17] <supremekai> arraybolt3, I would support that idea of Wind00z being the b0z0 in the old days
[01:17] <arraybolt3> (This is if you're using the Snap command line interface.)
[01:17] <supremekai> nowadays anyone can dev anything.. to much open source.. makes your pc ass too open as well
[01:17] <supremekai> nowadays, I find wind00z more secure than linux
[01:17] <arraybolt3> supremekai: This isn't really a support question any longer. Care to continue in #ubuntu-discuss?
[01:17] <supremekai> why?
[01:18] <supremekai> are u the boss around arraybolt3 ?
[01:18] <arraybolt3> This channel is reserved for tech support, not discussion.
[01:18] <supremekai> uhh
[01:18]  * supremekai an Ubuntu Boss :o
[01:18] <supremekai> lulz
[01:18] <arraybolt3> (No I'm not an admin, but I am a trusted Ubuntu Member, and also one of the admins, sarnold, is right here.)
[01:18] <supremekai> so, call sarnold
[01:18] <supremekai> you are trusted by who?
[01:19]  * supremekai requests arraybolt3 to show his/her/X badge of "trusted Ubuntu Member"
[01:19] <arraybolt3> supremekai: Run /whois arraybolt3, you'll see the badge.
[01:19] <supremekai> show me your creds
[01:19] <supremekai> are u fbi?
[01:19] <supremekai> u fed?
[01:19] <supremekai> lulz
[01:19] <arraybolt3> [20:19] [Whois] arraybolt3 is ~arraybolt@ubuntu/member/arraybolt3 (Aaron Rainbolt)
[01:19] <supremekai> that is forged
[01:19] <arraybolt3> !ops supremekai is disrupting the channel
[01:19] <supremekai> if you have an NFT with that badge I will believe u lulz
[01:19] <arraybolt3> !ops | supremekai is disrupting the channel
[01:19] <supremekai> !ops arraybolt3 is disrupting the channel
[01:20] <supremekai> !ops | arraybolt3 is disrupting the channel posing as an authority
[01:20] <arraybolt3> (How many times am I going to forget the | in the middle of that? This is the second time I've accidentally tried to redefine the !ops trigger...)
[01:20] <supremekai> so.. keepin up.. do u have an NFT as a *trusted Ubuntu Member* or not?
[01:21] <supremekai> if you have it, I will shut my mouth and stop my fingers
[01:21] <supremekai> OpenSea.io do not count - those are fake NFTs.. totally centralized
[01:21] <murmel> supremekai: lol troll somewhere else, as even windows uses open source
[01:21] <supremekai> murmel, ok
[01:21] <supremekai> I like your nick
[01:21] <arraybolt3> murmel: Just ignore, you're just encouraging him :P
[01:21] <supremekai> so I will troll my way out
[01:22] <supremekai> Y u mad arraybolt3 ?
[01:22] <supremekai> p0s3r
[01:25] <arraybolt3> !ping
[01:25] <arraybolt3> Yay!
[01:45] <diceLibrarian> is screen tearing normal with a KVM switch?
[02:39] <RingtailedFox> i'm having a bit of a strange issue trying to install zoneminder on my ubuntu system... it's ubunto on WSL2... is this the place for that configuration?
[02:40] <forgotmynick> when trying to apt-get remove xxx it's also wanting to delete other applications. how do i get it to only delete the single application?
[02:40] <rbox> forgotmynick: pastebin the full output
[02:41] <RingtailedFox> forgotmynick, those might be packages that are dependent upon the one you're removing...
[02:42] <forgotmynick> they aren't dependant. it was installed yesterday and  now it wants to delete other things. https://paste.nginx.org/r/d4
[02:42] <rbox> so which package are you unhappy that it is removing?
[02:42] <rbox> proxmox-ve isn't in the ubuntu repos...
[02:45] <RingtailedFox> https://pastebin.com/yYvyRaek
[02:46] <RingtailedFox> how do i figure out why zoneminder isn't connecting with mariadb?
[03:16] <murmel> RingtailedFox: do you have systemd enabled? if I remember correctly otherwise mariadb wouldn't run in the background
[03:16] <RingtailedFox> yes, systemd's enabled and mariadb's running in the background
[03:17] <RingtailedFox> zoneminder was running fine until it said it needed to be upgraded... then the upgrade failed... tried uninstalling and re-installing it, but still nope
[03:18] <murmel> the problem with wsl is, that it does quite a bit different to normal ubuntu :S. so I assume that's one of the reasons why it bugs out
[03:18] <RingtailedFox> ohhh
[03:18] <murmel> for example up till a month or so, there wasn't systemd
[03:19] <RingtailedFox> really? because.. i've been testing systemd on WSL2 for like... nearly 3 years o.o
[03:19] <RingtailedFox> and WSL1 before that
[03:20] <murmel> RingtailedFox: https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/
[03:20] <murmel> RingtailedFox: those don't have systemd
[03:21] <RingtailedFox> ... huh
[03:21] <RingtailedFox> okay
[03:22] <murmel> RingtailedFox: and as described, afaik, you still need to activate systemd in wsl to actually have it
[03:23] <RingtailedFox> alrihty
[03:23] <RingtailedFox> thanks
[03:24] <murmel> RingtailedFox: I would think through, if not an actual vm would make more sense
[03:24] <RingtailedFox> yeah..
[03:24] <murmel> for something like zoneminder, as it's not intended for wsl (or the other way around also)
[03:24] <murmel> wsl is basically only for dev stuff
[03:25] <Phr33d0m> just use docker with wsl2 backend
[03:26] <murmel> Phr33d0m: for a gui tool? sure
[03:27] <Phr33d0m> nvm then
[03:28] <Phr33d0m> zoneminder seems to be a web tool... there's actually a docker image https://hub.docker.com/r/dlandon/zoneminder
[03:29] <murmel> huh, I thought it was something graphical as you do need to see the feed
[03:30] <Phr33d0m> who's building linux-only GUIs anyways?
[03:31] <murmel> Phr33d0m: as it's foss why not
[03:32] <Phr33d0m> I haven't seen a single FOSS project in a while that didn't have a windows build as well
[03:33] <murmel> there are a lot, but I agree, they are getting more "popular"
[03:34] <randomusr> Where are the instructions for installing the rolling stable kernel?
[03:34] <murmel> randomusr: oO what is a rolling stable kernel?
[03:34] <Phr33d0m> yeah I like the idea... why it should be windows vs linux vs mac when it can be windows + linux + m... no, f- apple
[03:35] <Phr33d0m> "rolling" and "stable" hehe
[03:36] <randomusr> murmel, latest kernel :P
[03:36] <murmel> Phr33d0m: at least they are not as hostile as MS
[03:36] <murmel> randomusr: download debs, apt install ./.deb
[03:37] <ravage> !mainline | randomusr
[03:38] <murmel> randomusr: remember, those kernels are for testing, not for daily driving them
[03:38] <murmel> some work better, some less so
[03:40] <randomusr> got it. I was hoping for kernel 6.0 would I need to add a repo? I'm looking over the link your provided
[04:42] <RingtailedFox> oooh... i'm on win10 though. can i... use the Windows Store version of WSL?
[04:46] <ravage> RingtailedFox, https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/
[04:46] <RingtailedFox> i see
[04:47] <RingtailedFox> hmmm, the page says windows 11 and makes no mention of 10... but the windows store page for the preview shows it'l work on win10... here's hopin'!
[04:47] <Phr33d0m> I use systemd with wsl, I can confirm that it works
[04:47] <RingtailedFox> :D
[04:47] <RingtailedFox> i just hope it works well on my win10 laptop
[04:48] <Phr33d0m> although, are you sure a simple docker container isn't enough for what you need?
[04:48] <RingtailedFox> i've thought of that, actually
[04:48] <ravage> RingtailedFox, https://gist.github.com/djfdyuruiry/6720faa3f9fc59bfdf6284ee1f41f950
[04:50] <Phr33d0m> ravage I just added systemd=true to wsl.conf and it worked... is all this actually required at this point in time?
[04:50] <ravage> no idea
[04:50] <ravage> i dont run windows :)
[04:50] <RingtailedFox> oh lame, it just throws an error (but at least i can access bash otherwise)
[04:51] <ravage> (only in a VM)
[04:52] <RingtailedFox> Windows version 10.0.19044.2130 does not support the packaged version of Windows Subsystem for Linux.
[04:52] <RingtailedFox> For information please visit https://aka.ms/wslinstall
[04:52] <RingtailedFox> Press any key to continue...
[04:53] <RingtailedFox> sometimes when i start ubuntu in WSL, it shows "Sleeping for 1 second to let systemd settle" at the top... always has.. i wonder why that is
[04:53] <ravage> sounds like a question you have to ask the M$ support
[04:54]  * RingtailedFox nods
[04:54] <Phr33d0m> do you need all this just for the zoneminder thing?
[04:59] <RingtailedFox> Phr33d0m, i would like to test having the ability to view my security cameras under linux... eventually (well, by 2025) my laptop will be EOL since it doesn't support windows 11 (it only fails the CPU part)... so, i'd like to migrate it over to linux (hopefully somethign like ubuntu) and see if that works
[05:00] <Phr33d0m> you really shouldn't bother with wsl for this... just install docker desktop and use this https://hub.docker.com/r/dlandon/zoneminder
[05:00] <RingtailedFox> oooh! okie!
[05:00] <RingtailedFox> thanks
[05:39] <maicon> hi
[05:57] <tronic_> Hi
[06:01] <Apachez> just grab a laptop and install ubuntu LTS natively on it and call it a day, dont forget to keep it updated and backup important stuff every now and then (like once a week or so)
[06:02] <Apachez> I have done similar with an entry system... installed vbox and windows10 within that to run the win32 software that the entry system needs
[06:02] <Apachez> future entry systems we will buy are demanded to only use html5 as frontend
[06:02] <Apachez> as in use whatever modern browser you wish on whatever os you wish
[06:09] <LuckyMan> I'm planning to install 22.10 on an old laptop. It currently has 22.04. How long do I have to wait for the new version warning?
[06:10] <LuckyMan> after October 20, I mean
[06:14] <ravage> LuckyMan, if you installed the system with 22.04 you will not get any notification about 22.10 as you are on the LTS update path
[06:15] <ravage> i would also suggest you stay on that path unless you really need any features of 22.10
[06:17] <ravage> LuckyMan, if you really want to get the update notification you have to change it here: https://i.imgur.com/cOOhqst.png
[06:30] <LuckyMan> thanks ravage
[07:05] <makara1> hi. Why wont my ipsec VPN connect with 22.04. Same settings worked fine on 20.04. Here are the logs https://paste.ee/p/JEdNn
[07:09] <SteelRose> makara1: 'Timeout was reached' <-- can't you increment the timeout threshold?
[07:10] <makara1> SteelRose: no, its a hardcoded 10sec timeout. Clearly the remote is refusing to interact any further with my requests
[07:41] <dante> Friends, I have installed Brave through Snap, notifications in a website are set to allow, notifications of brave are allowed in Ubuntu but it still doesn't work. How come?
[07:43] <dante> https://ibb.co/MgNGrrt  here is the screenshot (in italian) of the alert it gives. Notis simply don't work in Brave. weird.
[08:41] <ravage> dante, https://community.brave.com/t/no-notifications-in-ubuntu-22-04-lts/437506
[08:51] <lokisir> anyone know how to unbrick a phohne with ubuntu>?
[08:52] <ogra> lokisir, try one of the ubports channels ... https://ubports.com/de/contact/consumers
[09:02] <dante> @ravage, yes I opened that topic. got no solution
[09:50] <lokisir> hi
[09:54] <tuxrage> hello, curious to know if i can get some quick help/answers here... i boot with uefi and i see grub, then i see EFI stub: ... using dtb... EFI stub: Exiting boot services.... then all of the kernel output is missing. finally, after some time i see the login prompt on tty1 ... does anyone know how to print out the kernel messages after efi stub: completes and boots the kernel? i am expecting to see: [
[09:54] <tuxrage> 0.0000] booting linux on cpu ..... [0.0000] linux verson 6.0-arm64 (ubuntu-kernel@blah) etc...
[10:27] <ogra> tuxrage, edit /etc/default/grub, remove "quiet splash" from the commandline variable, run sudo update-grub, next reboot should show the messages (*if* your default console= points to the correct tty that is)
[10:28] <dionysus69> is there a solution for having 4k external monitor and 1080p laptop screen to work together with smooth mouse transitions? it's pretty annoying to move mouse from one screen to another if I am the wrong edge.
[11:34] <Vonor> Hi. In a fresh jammy docker container I have python3 and python3-pkgconfig installed. a configure script (libxml 2.10.3) fails with "configure: error: Package requirements (python-3.10) were not met:" I failed to find a working solution on $searchengine
[11:37] <nteodosio> Hi Vonor, we would most likely need to see that full message.
[11:39] <Vonor> sure. https://pastebin.com/raw/ZejQWHCB
[11:44] <Vonor> i get the same issue if i use python2 instead. the error messages changes from python-3.10 to python-2.7 so seems version inspecific.
[11:55] <MonoL> Iḿ in keyboard hell
[11:56] <MonoL> I cant get this
[11:56] <MonoL>  ahhhhhh
[11:58] <MonoL> I cant get this keyboard to write apostrophes and double qoutes
[11:59] <AlexC> " '
[11:59] <AlexC> ctrl + c ctrl + v
[11:59] <AlexC> :>
[11:59] <Vonor> you probably have the wrong keyboard layout configured
[11:59] <MonoL> look what itś doing to Iḿ and itś...
[11:59] <tuxrage> ogra: i will try with the console=
[12:00] <Vonor> if you are on gnome/kde, go to settings and check the keyboard settings
[12:00] <mariosdaskalas> .
[12:00] <MonoL> Iḿ using gnome
[12:01] <mariosdaskalas> Hi, I am using Ubuntu 22.04 64-bit. I am searching for an app similar to flux, but I am using Wayland and I am running into problems. Any recommendations/
[12:02] <MonoL> I'm it's
[12:02] <MonoL> '@WE23"£
[12:02] <Vonor> looks good
[12:02] <MonoL> ah yeah
[12:03] <MonoL> just swapped to english uk
[12:03] <MonoL> good work
[12:03] <MonoL> thanks
[12:12] <ogra> Vonor, could it be it is actually looking for a binary called pyton-3.10 ? (note that the ubuntu binary python is called python3.10 (i.e. no dash) ... perhaps a symink in /usr/bin is sufficient ?)
[12:13] <Vonor> i have a symlink for python-3.10 already still fails.
[12:14] <ogra> ten it is not that indeed 😞
[12:15] <ogra> *then
[12:34] <Vonor> since i don't need the python bindings currently i worked around it by adding --without-python to the configure options. at least it compiles now
[12:37] <ogra> i'd grep though the surce though and see if you could easily change it and remove the dash
[13:15] <BluesKaj> Hi all
[13:37] <powftw> Hey guys. I have a python-flask app made inside my Arch machine. Made --onefolder package with Pyinstaller and when i try to run the same in Ubuntu, it says; https://bpa.st/5PTA
[14:38] <whatever543> Hello, my wifi card stopped working and I'
[14:39] <whatever543> spent a month trying to solve it: https://askubuntu.com/questions/1429758/qualcomm-artheros-wifi-card-not-detected-stopped-working
[14:39] <whatever543> any suggestions?
[14:45] <ioria> whatever543, well, if you know how to handle -proposed, there's a new version of linux-firmware, but i'am doubtful
[14:46] <whatever543> ioria yeah I don't know how to handle -proposed :/
[14:53] <Ecko> Hi let's say I have a script with the following line: `commandX | tee -a $LOG`
[14:53] <Ecko> But now I want to catch the exit code of commandX in a variable, how can I do this?
[14:57] <ioria> Ecko, https://stackoverflow.com/questions/6871859/piping-command-output-to-tee-but-also-save-exit-code-of-command
[14:57] <lotuspsychje> ogra: you here?
[15:04] <ogra> lotuspsychje, yep
[15:06] <lotuspsychje> ogra: im stuck in a loop on a customers focal to jammy upgrade on FF snap
[15:07] <lotuspsychje> ogra: it keeps saying has “install-snap” change in progress”.
[15:07] <lotuspsychje> even when i abort ID it doesnt want to instal after
[15:09] <ogra> upgrade with do-release-upgrade ? or some cdrom way ?
[15:09] <lotuspsychje> customer did upgrade himself but aborted at some point, im on desktop now
[15:09] <ogra> hmm
[15:09] <lotuspsychje> via recoverymode
[15:10] <ogra> can you pastebin "snap changes" ?
[15:10] <lotuspsychje> but when trying to update, its stuck on deb to snap FF whatever i do
[15:10] <bgb> ubuntu boot get stuck at grub  if screen auto sleep after last shutdown,  any idea?
[15:11] <bgb> and if I manually turn off then turn on  the screen, then it works
[15:12] <lotuspsychje> ogra: termbin.com/n1xt
[15:12] <ogra> lotuspsychje, and "snap change 2" ?
[15:13] <ogra> (or 4, i bet they say the same)
[15:14] <lotuspsychje> ogra: termbin.com/d7qk
[15:15] <lotuspsychje> i tryed to purge snapd too, but no dice to skip FF
[15:16] <ogra> wll, is that machie offline ? it fails all its downloads it seems
[15:16] <lotuspsychje> no its up
[15:16] <lotuspsychje> lemme try on cable
[15:17] <ogra> 2022-10-19T17:05:14+02:00 ERROR the download has been cancelled: context canceled
[15:17] <ogra> can you check if "snap change 4" has anything different than that ?
[15:17] <ogra> could be that 2 is the one the customer canceled
[15:24] <lotuspsychje_> ogra: think something changed after reboot + cable now
[15:24] <ogra> aha
[15:26] <lotuspsychje_> ogra: im seeing locale FF deb/snap packages running now, think its gonna work
[15:26] <ogra> awesome
[15:26] <ogra> does the oter connection use a proxy or something by chance ?
[15:26] <ogra> *other
[15:26] <lotuspsychje_> no i was on wifi here
[15:26] <ogra> weird
[15:26] <lotuspsychje_> yeah
[15:28] <lotuspsychje_> tnx for the think along anyway ogra
[15:28] <ogra> always happy to help 🙂
[16:21] <benio> Hi guys
[16:22] <benio> Can l securely delete files on my windows 7 installation using a live cd?
[16:24] <jhutchins> benio: Live CD of what?
[16:24] <benio> Ubuntu
[16:24] <jhutchins> benio: What is your requirement for "secure" deletion?
[16:24] <benio> To make it most difficult to recover
[16:25] <jhutchins> benio: Seriously, what standard do you require?  DOD or PCI?
[16:25] <jhutchins> benio: What attack vector are you defending against?
[16:26] <benio> I'm not too savvy on the terms mate
[16:26] <jhutchins> benio: What audit standard do you have to meet?
[16:27] <jhutchins> benio: Is this just a home system?  Are you worried about external access or about the hardware falling into hostile hands?
[16:27] <benio> I'm just trying to delete my sensetive files so no one can recover it easy
[16:27] <benio> Yes
[16:27] <benio> It's a home system
[16:27] <benio> Both
[16:27] <jhutchins> benio: Do you have encryption enabled on Windows?
[16:28] <benio> No
[16:28] <benio> The files can be accessed on linux
[16:29] <jhutchins> That's probably the first step.  You may find something here: https://askubuntu.com/questions/57572/how-to-delete-files-in-secure-manner
[16:30] <jhutchins> benio: In order to access the files with linux, you would probably need physical access to either boot linux or physically mount the drive(s) on a linux system.
[16:30] <benio> Well l loaded a live cd and l can access my main 7 os
[16:30] <benio> Win 7
[16:31] <jhutchins> benio: You have to weigh the value of your information to a hostile party vs. the difficulty in breaking the security.
[16:31] <benio> There are some files which l want shreddrd
[16:32] <jhutchins> benio: You can overwrite the contents of the file before deleting it.
[16:32] <benio> Well lm mostly trying to prevent the local geek from accessing and recovering my files
[16:32] <benio> My computer is going to be put in the cliset
[16:32] <benio> Closet
[16:33] <jhutchins> benio: I would suggest encryption from the Windows side, and for specific files copy /dev/null over them, or /dev/random.
[16:33] <benio> Will it be strong enough?
[16:34] <jhutchins> benio: That's always relative to how hard your opponent is willing to work.  Writing over the data will defeat a casual attacker.  It requires forensic techniques to recover the data.
[16:35] <jhutchins> benio: You might want to learn about data recovery techniques to understand what is still vulnerable.  Encryption + overwrite is pretty  difficult to crack.
[16:36] <jhutchins> benio: Encryption will overcome most casual recovery tools because there is nothing recognizable as a file.
[16:36] <jhutchins> A large stick and a sign that says "Don't mess with my files" can also be helpful.
[16:37] <benio> I don't care about the forensiccs
[16:37] <benio> Lol l got nothing they'd care about
[16:38] <benio> Unless they're theived
[16:38] <benio> Theives
[16:38] <jhutchins> benio: Good point.  Measure your efforts accordingly.
[16:39] <jhutchins> benio: DOD is the U.S. Department of Defense, they have published standards for deleting data from storage devices (drives) that are being disposed of.  They vary with the level of security of the data.
[16:41] <jhutchins> benio: PCI refers to the security standards for the Payment Card Industry.  It's not a system you need, but scanning the standards can give you a good model for how to approach security.
[16:46] <jhutchins> benio: Something that would probably address all of your concerns would be simply setting a boot password on the computer, so someone couldn't bypass the basic Windows security; couldn't boot to a Linux image.
[17:20] <Macwinner> hi, i'm trying to wrap my head around the different network management tools.  eg, netplan vs NetworkManager vs ip vs ifconfig vs brctl ( am I missing anthing?).  Was wondering if someone here could give me their understanding.
[17:20] <Macwinner> i guess networkd is another thing
[17:20] <ogra> networkd is just a backend you usually do not touch by hand
[17:21] <ogra> netpan creates configs for networkd on systems that di not have NetworkManager
[17:21] <ogra> *netplan
[17:21] <ogra> s/di/d👋
[17:22] <ogra> ip is simpy the successor of the deprecated ifconfig
[17:23] <ogra> (and i need a new keyboard for this laptop 😞 )
[17:23] <Macwinner> thank you!  so changes using ip should not expected to be persisted across reboots?
[17:24] <ogra> right
[17:25] <ogra> on a server you'd edit the config in /etc/netplan/ ... on a desktop you either use the network-manager gui or something like nmtui to set it up
[17:25] <Macwinner> so when I do 'netplan apply' assuming networkd backend, then it is presumably generating some networkd config files somewhere and asking networkd to reload?
[17:25] <ogra> yes
[17:25] <ogra> and a good hint is: dont use apply, use "netplan try"
[17:27] <Macwinner> oh yeah.. i saw that.. just in case you hose your connection to the server it will revert, right?
[17:27] <ogra> it applies the new confg but rolls back to the old one if you do not confirm
[17:27] <ogra> pretty much like the resoution switching for the desktop ... it counts down and reverts if you do not say it is okay
[17:38] <jhutchins> ogra: So /etc/network/interfaces is deprecated/obsolete/doesn't work any more?
[17:38] <ogra> since several years ...
[17:38] <alkisg> That's ifupdown or ifupdown2, it still works fine in ubuntu 22.04
[17:39] <ogra> sure, but it is not installed 🙂
[17:39] <alkisg> True. It's also the default in Debian :D
[17:39] <ogra> doesnt help much given the installer will set up somethig completely different (why would you change to something unsupported instead of altering the existing config)
[17:41] <alkisg> Each one of these has its own quirks; and there's a learning curve; so it's understandable that some sysadmins stick to the tools they know until they get completely removed from the archives :D
[17:41] <ogra> but yeah, ifupdown2 is in universe and if you insist you can even run an ubuntu system with it (have fun removing all the default bits to avoid clashes)
[17:41] <BCB> I'm trying to redirect non-www URL to a www URL in apache2 on Ubuntu 22.04.1 LTS and not having any luck with my googlefu.  Any suggestions?
[17:41] <alkisg> AFAIK upgrading from older Ubuntu's doesn't automatically remove or disable ifupdown...
[17:41] <ogra> right
[17:42] <ioria> ifupdown2 is dead
[17:42] <ogra> 2 too ?
[17:42] <ogra> that was short lived then
[17:42] <ioria> 2 is dead
[17:58] <jhutchins> ogra: Supported + $5 will get you a cup of coffee.
[18:25] <Guest1841> hello from Ukraine
[18:26] <Were-thekau> hey
[18:32] <wolfravenous> can anyon help me figure out why my Apache server is getting bombarded by requests, even though my UFW rulles should only allow acces to it from my LAN and one other public IP address?   https://pastebin.com/3wbPgAe6
[18:34] <wolfravenous> That pastebin shows my rules by my apache server-status page shows up to 150 requests from random ip addresses.
[18:50] <BCB> I've recently upgraded and I'm having trouble getting Apache/2.4.41 on Ubuntu 22.04.1 LTS to redirect a non-www url to a www url. Any suggestions.
[18:50] <BCB> ?
[18:51] <sarnold> BCB: pastebin your config? maybe someone can spot the problem
[18:51] <EriC^^> wolfravenous: maybe you should disallow all too
[18:51] <genii> mod_rewrite ?
[18:51] <sarnold> BCB: I once spent hours trying to solve a problem with apache that boiled down to including a / at the end of an url when it shouldn't have been there -- or the other way around. I can't remember.
[18:52] <sarnold> wolfravenous: what's the default rule? are you dropping by default? are the packets matching *other* input rules? have the packets been NATted or something and thus actually do look like they're coming from the LAN?
[18:57] <wolfravenous> sarnold: I was under the impression with UFW the default is to deny all traffic unless explicitly allowed.  My other input rules are for other ports that are not managed by Apache and specify the port, so I don't think they would be involved... However i can paste my full rule set if that is helpful.  And I don't know how to check if the packets have been NATed?
[18:58] <EriC^^> wolfravenous: i dont think it denies all by default
[18:58] <sarnold> wolfravenous: I'm not sure which is the default, I am sure that your output doesn't include what the default is :)
[18:59] <wolfravenous> when setting it up they always make you create the ssh rule first so you don't lock yourself out if sshing into the terminal so I just figured it was drop all by default.
[19:00] <EriC^^> wolfravenous: not sure about the default, but maybe worth doing "ufw default deny incoming"
[19:01] <EriC^^> nevermind seems it does deny by default
[19:01] <EriC^^> sudo ufw status verbose  should show you the current settings
[19:02] <wolfravenous> the terminal replied: Default incoming policy changed to 'deny' (be sure to update your rules accordingly).... so maybe it wasn't set to deny by default.
[19:05] <murmel> wolfravenous: by default it's deny, but if you deny it again, it will comply by changing it to deny ;)
[19:06] <wolfravenous> I used that command "sudo ufw default deny incoming"  and restarted ufw.  Then I started apache and within 30 seconds, my ip is bombared by apache requests from random ip's  It is like my IP is in some kinda bot swarm... and UFW doesn't love me at all.
[19:08] <murmel> wolfravenous: which ports are open?
[19:08] <murmel> ahh saw the link
[19:09] <murmel> wolfravenous: are your random ips in the local network or outside?
[19:09] <murmel> aka internet
[19:09] <wolfravenous> Here are my rules:  https://pastebin.com/qDBtJscD
[19:10] <wolfravenous> the random IP's are all outside IP's none of them are LAN addresses
[19:11] <wolfravenous> the verbose output of UFW status says Default:  deny (incoming)  so that is correct.
[19:11] <murmel> wolfravenous: can you dump the actual rules within (nft/iptables) to see if some random rule is added
[19:12] <wolfravenous> Here is a list of all the IP's that are hitting me within 30 seconds of turing on apache:  https://pastebin.com/xMXEZYt1
[19:12] <wolfravenous> murmel:  how do I dump those rules?
[19:13] <bougyman> Not going to a pastebin site, but what is it you're expecting?
[19:13] <murmel> wolfravenous: iptables -L // nft list ruleset
[19:13] <bougyman> There's hundreds of thousands of crawlers hitting everything with 80/443 open at any time.
[19:13] <murmel> bougyman: are you sure, that it should hit 80/443 if it's not allowed in the fw
[19:13] <murmel> (firewall)
[19:14] <bougyman> murmel: the firewall is broken, in that case.
[19:14] <wolfravenous> bougyman:  since I only allow access on port 80 and 443 to my LAN and one public IP address I don't expect anything by my traffic
[19:14] <murmel> bougyman: that's why we want to see what's going on
[19:14] <bougyman> wolfravenous: have you put a dump of your rules somewhere yet? (not pastebin, please).
[19:14] <murmel> this is what i right now asked
[19:15] <murmel> see log
[19:15] <bougyman> For a rule dump, I personally prefer iptables-save -n
[19:15] <bougyman> (for iptables, not for nft)
[19:15] <wolfravenous> mumel that commend returned:  iptables v1.8.7 (nf_tables): Invalid rule number `nft'
[19:16] <bougyman> nft's sane with list ruleset.
[19:16] <bougyman> wolfravenous: `iptables-save -n`
[19:16] <murmel> huh, i thought 22.04 switched over to nft
[19:16] <bougyman> Oh woops, -n is not valid anymore.
[19:17] <bougyman> swore it used to be. So just `iptables-save`
[19:17] <bougyman> murmel: he typed the whole thing you typed.
[19:17] <bougyman> % sudo iptables -L // nft list ruleset
[19:17] <bougyman> iptables v1.8.7 (nf_tables): Invalid rule number `nft'
[19:18] <bougyman> :)
[19:18] <wolfravenous> Oh Crap! there is a lotta mess from that iptables-save command... if not pastebin where should I dump it?
[19:18] <murmel> termbin, paste.debian.net
[19:18] <murmel> eh termbin.cm
[19:18] <murmel> com
[19:19] <wolfravenous> just a sec
[19:19] <bougyman> I like ix.io, but they use termbin here a lot.
[19:19] <bougyman> basically anything but pastebin, hah.
[19:19] <murmel> wolfravenous: pastebin.com had issues with malware (distributing) and their ads :S
[19:19] <murmel> bougyman: yeah because you can just | nc termbin.com 9999
[19:19] <bougyman> murmel: yeah that's handy.
[19:19] <bougyman> so `sudo iptables-save | nf termbin.com 9999`
[19:20] <bougyman> ugh.
[19:20] <bougyman> s/nf/nc/
[19:20] <murmel> bougyman: he probably won't want to do it that way, as he doesn't want to expose one of the ips from his work
[19:21] <bougyman> well he could <SNIP> that out.
[19:21] <wolfravenous> Here ya go.  https://paste.debian.net/1257636/
[19:22] <wolfravenous> I realize that it has a ton of Fail2ban mess in that paste from the iptables-save command.... is there something neater for output?
[19:22] <bougyman> There's nothing more complete.
[19:22] <bougyman> And complete is kinda what we need.
[19:24] <wolfravenous> Hey, I just saw something in that paste, line 173  from where I was setting up geo ip blocking... it has 80 and 443 and ACCEPT... is this the root of my issue...
[19:25] <murmel> wolfravenous: yes
[19:25] <bougyman> Looks like it.
[19:25] <wolfravenous> I was using geo blocking cause this is just a home server, and the only people that need any access are me and my family, no commerce so was not wanting it open world wide..
[19:25] <murmel> and honestly, geoip is imo not _really_ helpful as IPs are nowadays sold outside their respective country (I assume US is still better than "random country" but still)
[19:26] <wolfravenous> Also, noticed that all those IP addresses that are bombarding me are actually in US...
[19:26] <bougyman> Yeah, still never know where the person _using_ that IP is from.
[19:26] <bougyman> I'm in Mexico right now but using an IP in Maine.
[19:27] <wolfravenous> True, I guess it is easy enough to setup proxies on AWS, Azure and hosting sites like that, most even offer free trials, heehe
[19:27] <bougyman> Cloudflare has a great free plan.
[19:27] <bougyman> You'd never need more.
[19:27] <murmel> wolfravenous: especially oracle
[19:27] <bougyman> And they do create spam/ddos prevention out of the box.
[19:27] <bougyman> Just enabled that check that you see in your browser when you get to cloudflare sites (checking browser, blah blah).
[19:27] <bougyman> Of course that makes curl and most scripts impossible to use.
[19:27] <bougyman> So that's sometimes a downside.
[19:28] <wolfravenous> Okay let me see if I can nuke that rule that was on 173 and see if that helps... will post back my results.
[19:28] <murmel> wolfravenous: depending on your needs think about vpn setups. i do it with wireguard and android where it's always connected
[19:31] <StyXman> is there a tool to know which nvidia modules I need for a given card?
[19:32] <murmel> StyXman: ubuntu-drivers devices
[19:32] <murmel> should at least tell you which devices need drivers
[19:34] <StyXman> murmel: tx
[19:34] <jhutchins> wolfravenous: Without looking at your pastes: What port are you running sshd on?
[19:34] <murmel> jhutchins: iptables had a rule to allow 80 from US ;)
[19:35] <jhutchins> Well, 80, 443, and 22 are the main targets.
[19:38] <jhutchins> Trying to remember why I didn't see brute force attacks on the web server ports ...
[19:38] <jhutchins> I think it was because delivering a 404 was less load than denying an ssh login.
[19:39] <jhutchins> Besides, we were tuned and ballanced for HTTP.
[19:39] <murmel> but wouldn't https negate the "advantage"? tls _is_ quite heavy on hw
[19:39] <murmel> not that much anymore, but when talking about ddos
[19:40] <wolfravenous> I nuked that rule related to geoip in /etc/ufw/before.rules and now things are as expected. No apache traffic except from me.
[19:40] <jhutchins> For some reason I only remember legitimate load bogging down the site, and it managed to keep serving, if slowly.  I guess Apache's built to que and service large volumes of requests.  SSHD not so much.
[19:40] <wolfravenous> Thanks SO MUCH for assisting on this big win for me!
[19:41] <murmel> wolfravenous: yw :)
[19:41] <jhutchins> I take it there isn't actually a public ssh port.
[19:41] <murmel> nope
[19:41] <murmel> jhutchins: yeah sounds reasonable that apache is more robust for high load
[19:42] <murmel> i mean sshd won't often get 100000 req/s
[19:42] <wolfravenous> It is all about being aware of what I was doing.... I locked everything down the way I wanted it but then when I tried to add the GeoIp to it, I actually messed up what was probably working before, LOL.
[19:43] <murmel> wolfravenous: imo it's always helpful to see the rules in iptables/nft, as that's how they are processed (top to bottom)
[19:43] <murmel> which means if you allow first something then reject it in the next line, it will always get allowed
[19:44] <murmel> reject/deny depends on your needs
[19:45] <wolfravenous> first rule has priority, got it!   this also solved the random bots hitting ssh port that was showing up when I would run lastb command.
[19:46] <sjdns> is ubuntu /usr-merged?
[19:46] <murmel> sjdns: yes
[19:46] <wolfravenous> Well guys, I am heading out to the woods!  Thanks again for everyones help... I am about half a century and IRC seems like for decades has always been the best place to get help!
[19:47] <sjdns> when did that happen?
[19:47] <murmel> wolfravenous: hf, and yes, it's where the old guys sit ;)
[19:47] <sarnold> wolfravenous: enjoy :)
[19:47] <sjdns> I just had a weird issue with /usr/bin/grep missing
[19:48] <murmel> sjdns: disco for new installs
[19:48] <murmel> so 19.04
[19:50] <murmel> sjdns: so very old install or is something broken?
[19:52] <philwong> Hi
[19:52] <philwong> Is there any good secure wipe software for Ubuntu?
[19:52] <philwong> I'm trying to wipe an ssd
[19:53] <murmel> with ssds you can _never_ be sure that it's actually wiped
[19:54] <philwong> Hmm
[19:54] <philwong> I see
[19:54] <murmel> that's why you use encryption or never sell/use it again
[19:55] <philwong> What do you suggest?
[19:55] <murmel> for what?
[19:55] <philwong> To destroy it
[19:55] <wolfravenous> philwong:  a sledge hammer ;P
[19:55] <murmel> hm, take it to the gun range, burn it, keep it in a safe. there are quite the options depending on where you live
[19:56] <murmel> oh yeah sledgehammer is also a good idea
[19:56] <murmel> but please don't burn it
[19:56] <murmel> all the chemicals :(
[19:56] <philwong> I know
[19:56] <philwong> I thought that as well
[19:57] <murmel> i mean there is a reason why most companies keep hdd/ssd/ram and/or pay __a lot__ of money to other companies to destroy it
[19:57] <philwong> If l reinstall a os and then encrypt it and wipe it would that work?
[19:57] <murmel> philwong: no
[19:57] <EriC^^> why not
[19:58] <murmel> EriC^^: because we don't know what the ssd controller does
[19:58] <arraybolt3[m]> SSDs are notorious for possibly leaving shreds of important data around in spots like the overprovisioning areas.
[19:58] <arraybolt3[m]> It's a mess. They're great for storage, not so great for deletion.
[19:58] <arraybolt3[m]> Really with any modern storage media, the safest way to delete everything on it is to physically obliterate the device.
[19:58] <murmel> EriC^^: because of compression and other stuff you never know what it does to speed up your experience
[20:00] <sarnold> philwong: dd if=/dev/urandom of=/dev/whatever bs=1024k
[20:00] <EriC^^> i see, thanks
[20:00] <sarnold> philwong: as arraybolt3[m] it'll leave some stuff in the slop areas, but it's a good start
[20:00] <sarnold> hmm, I wonder if one of the partitioning tools has an easy way to trim the entire thing
[20:01] <murmel> honestly, I would just destroy the ssd, and restart with a new one, but that depends heavily on what kind of data we are talking about
[20:01] <arraybolt3[m]> You could also hit it with a Secure Erase command.
[20:01] <murmel> arraybolt3[m]: which we don't know what it does ;)
[20:01] <sarnold> philwong: blkdiscard(8)
[20:02] <arraybolt3[m]> murmel: Valid point.
[20:03] <philwong> If l hammer it and put it in vinegar and let it sit for a week
[20:03] <philwong> Maybe that helps
[20:03] <murmel> definitely ;)
[20:03] <StyXman> what is the name of this tool? https://i.stack.imgur.com/itfVN.png I don't have it installed
[20:04] <arraybolt3[m]> philwong: That sounds like a fairly effective method of doing it. Might also roll over it with a truck.
[20:04] <murmel> but honestly selling tech gets more and more impossible. just to give an example: bought a used laptop, and when I installed win to update a few firmware blobs, it literally showed me what the prior persion bought on the microsoft store etc
[20:04] <murmel> StyXman: software-properties-gtk
[20:05] <StyXman> philwong: donate it to a clueless friend or family member
[20:05] <philwong> Blunt force alone will still leave data in the microchips?
[20:05] <philwong> Even if it breaks
[20:05] <arraybolt3[m]> philwong: Yes but you can't get at that data unless you can somehow reassemble the crushed chips.
[20:06] <arraybolt3[m]> I mean at that point you might could try to get some data out of it, but the equipment, time, and cost would be insane.
[20:07] <StyXman> murmel: tx; FYI there's also software-properties-qt :)
[20:07] <murmel> StyXman: yeah, source package is called software-properties ;)
[20:07] <StyXman> anyways, reboot time
[20:18] <philwong> Sarnold dd is the Linux command right
[20:18] <murmel> y
[20:18] <philwong> I'm gonna run it on livemode
[20:18] <philwong> Liveusb
[20:19] <philwong> Does it come pre-installed?
[20:20] <philwong>  Or do l have to download the utility from the utility software center
[20:20] <sarnold> philwong: dd is probably available in the live mode
[20:21] <philwong> Ok
[20:22] <murmel> it's definitely preinstalled
[20:31] <jhutchins> https://dban.org/
[20:32] <murmel> jhutchins: do you know how it verifies that the data is gone on ssds?
[20:32] <jhutchins> murmel: It has the options to be fully DOD compliant.  That should be enough for you.
[20:33] <murmel> jhutchins: just asking, as I don't want to delete data _that_ bad ;)
[20:33] <murmel> but sounds legit then thanks
[20:34] <jhutchins> murmel: It also has some lighter options.  If I have to leave old drives functioning it's what I use.  Not fast.
[20:34] <jhutchins> As in launch it at the end of your day and come back tomorrow.
[20:36] <murmel> jhutchins: I wonder how expensive the full version is, as one of the companies, which are like "if you don't ask, you can't afford"
[21:20] <murmel> is there a way to setup a proxy before installing ubuntu desktop?
[21:23] <oerheks> maybe booting in live mode first
[21:24] <tomreyn> i guess if you    export http_proxy=http://10.0.0.0    this may apply
[21:24] <murmel> thanks will try out. problem is that it downloads stuff even when selecting not to download updates :S
[21:25] <tomreyn> maybe what it downloads aren't updates then
[21:25] <murmel> what is it then? I assume the iso should have everything it needs to install a desktop
[21:26] <tomreyn> maybe it's testing whether apt repositories are reachable or something, i don't really know.
[21:26] <murmel> installing right now, will see what the logs say, I only ever saw that it tries to reach repos for packages
[21:36] <sjdns> so it is safe to remove /bin?
[21:36] <sarnold> no
[21:37] <sarnold> a lot of programs assume specific tools are in specific directories, rather than searching through PATH to find them, and removing the symlink would break those programs
[21:37] <murmel> tomreyn: lol you were right, it just populates the database. I assume I saw that apt downloads the Packages file, and assumed it downloads Packages :S
[21:38] <oerheks> that /bin folder is not a Recycle Bin.
[21:39] <murmel> tomreyn: grml, it _does_ download packages
[21:41] <tomreyn> you can always pull the plug, if there are plugs involved
[21:41] <tomreyn> or just not bring it online, or bring it offline instead, or change the default gateway.
[21:41] <murmel> at least there is a virtual plug, still annoying to always go into vm settings
[21:41] <sjdns> great, the merging of /bin is done
[21:43] <sjdns> where should /lib64 point to?
[21:45] <murmel> sjdns: /usr/lib64?
[21:45] <Bashing-om> sjdns: sysop@x2204mini:~$ ls -al /lib64 >> lrwxrwxrwx 1 root root 9 Aug 26 18:37 /lib64 -> usr/lib64
[21:46] <oerheks> weird, here to /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
[21:46] <murmel> why would a dir point to a file oO
[21:47] <oerheks> its the file in the dir?
[21:47] <sarnold> opendir() is gonna fail pretty hard when pointed to a file though
[21:48] <murmel> oohh, I misunderstood you as we were talking about /lib64
[21:48] <murmel> not the file in it :)
[21:50] <BCB> Any idea why file_put_contents is getting a failed to open stream: Permission denied on Ubuntu 22.04.1 LTS ??
[21:50] <ravage> it does not have permission?
[21:51] <ravage> just a wild guess
[21:55] <sarnold> BCB: that's pretty thin information to go on -- is it a snap? if so, do you need to connect interfaces?
[21:57]  * tomreyn is guessing on https://www.php.net/file_put_contents
[21:57] <tomreyn> but then we still don't know anywhere close to enough