#ubuntu-server 2006-03-01 <YogSothoth> Hello! <YogSothoth> I'm in the datacenter trying to install Ubuntu Server 5.10 on a HP wx8000. It's Qlogic isp1020 (SCSI controller) is causing a kernel johncrosby@example.net. Just had a look at Google but all messages seem old and relating to Ubuntu Hoary. Isn't this already fixed? Should I try a patched kernel? I'm a bit newbie to this, please help! <Pygi> fabbione: ping <JulienH> Pygi: pong <Pygi> JulienH: huh? :) <Pygi> JulienH: how may I help you? :P <JulienH> Pygi: No need to help, thanks ^^ <Pygi> JulienH: ok :) <JulienH> It was just about your "ping" for fabbione :P <Pygi> JulienH: well, you aren't fabbione :) <Pygi> see ya later #ubuntu-server 2006-03-02 <setuid> infinity: Why no manpage for usplash? <setuid> tsk tsk! <setuid> And some wacky README about BOGL, but not usplash <setuid> oh, n/m... but the missing manpage is kind of a buggefr <setuid> er, bugger <lh317> i think I'm of the mind bootup should be so fast tehre is no need for a splash screen ;) <lh317> and on a server, why does it even have a monitor? ;) <setuid> I was just poking at it <setuid> it doesn't do anything anyway <bintut> is ubuntu already good as production server? <lh317> define "good" <lh317> and "production" <bintut> mail server.. stable for production.. supported by community especially on security fixes.. <fabbione> yes <lh317> well, the latter is questionable, as you have to run universe, adn universe isn't 'offically supported' <bintut> fabbione: you mean, ubuntu is already much like debian for its support? <lh317> if you need an actual contracted support for security, you're stuck with RHEL or SUEL pretty much. <fabbione> lh317: wrong <lh317> sine when have they reversed their universe policy? <fabbione> bintut: we do provide security updates for everything that is in main <fabbione> bintut: and that's for free <fabbione> bintut: time is about 18 months for breezy and 5 years for dapper <fabbione> bintut: if you need way more than that, i suggest you discuss a possible support contract with canonical <fabbione> lh317: no changes in that direction <lh317> fabbione: then what I said is true. <lh317> you have to run universe, unless all you want is just postfix or exim. <fabbione> <lh317> if you need an actual contracted support for security, you're stuck with RHEL or SUEL pretty much. <fabbione> this is wrong <fabbione> because Canonical do offer contracted support <lh317> fabbione: for universe? <fabbione> and security for main has been always free <fabbione> lh317: if you need support for universe you can get it if you pay <lh317> curiosity, link? <fabbione> but that's something you need to agree with Canonical <bintut> fabbione: i'm about to setup a server.. i can actually support my server but not the security fixes <fabbione> www.canonical.com ? <lh317> link to pay support contracts for universe? <bintut> brb.. i have a phone call <fabbione> bintut: if your server is made only by pkgs in main, you get security for free <bintut> fabbione: i'll talk to you later.. <fabbione> lh317: that's something you discuss on a per contract base <bintut> fabbione: yeah.. <lh317> fabbione: which means if you're not willing to deal, you're stuck. I'll amend then, if you need OOB support, you're stuck with RHEL or SUEL. <fabbione> lh317: ok.. let's put it in another way since you don't understand... <lh317> can I buy a ubuntu cd and get unvierse support OOB? <fabbione> there are no ubuntu cd you can buy <lh317> No. Therefore, if you need out of box security contract for the full offering, you arent running Ubuntu. <fabbione> ubuntu is free <lh317> i didn't literally mean buy a cd. <fabbione> jeee you are so way out of your mind <lh317> i can't get a universe support contract without negoiating. <lh317> I can go to redhat.com and buy a contract with jsut a credit card and a mouse click. <fabbione> no because that would utterly expensive <lh317> that is a big deal for some groups. <fabbione> how many packages are in rh? <fabbione> how many in universe? <fabbione> make a comparison <fabbione> than <fabbione> then <fabbione> think this way <fabbione> you have all main for freee <lh317> fabbione: compared main to rhel, especially for a server. <fabbione> that's about dunno.. 4400 binary pkgs? <fabbione> if you need one or two pkgs from universe you pay only for those <fabbione> instead of paying BIGFAT amount for stuff you don't even need to care about <fabbione> but of course.. <fabbione> if you want to pay for everything you don't need.. go redhat <lh317> ... you obviously missed the whole OOB part. <lh317> if I'm installing a box for a customer, negoiating a support contract for a single box is out of the question. <lh317> they won't do it, adn I can't act for them. <lh317> of course, tbf, RHEL is a double-edged sword anyway. they have a package that can do what you want. But it isn't the package you want or the version you want. <bintut> fabbione: in that case, if i'll use dapper now as a server, the packages i fethed from the universe will not be updated to the latest security fixes? <fabbione> as i said many other times.. you choose what fits you best :) <fabbione> bintut: universe is not supported by default. so no. <fabbione> bintut: if you need support for universe you want to talk with Canonical <fabbione> bintut: also.. take into account that Dapper is still in development <bintut> fabbione: who provide the packages for universe? is it canonical or the community? <fabbione> bintut: community <bintut> fabbione: yeah, i know that dapper is in dev stage <fabbione> bintut: but if you need support for them, Canonical will provide them for you <fabbione> bintut: you get the idea.. i guess <bintut> fabbione: are you connected with canonical? <fabbione> bintut: yes. i have been working for canonical since the beginning of light <bintut> fabbione: cool! :) <fabbione> bintut: but i am not the person you want to talk about contracts or support.. really <fabbione> bintut: there is an email address on canonical.com * fabbione checks <bintut> fabbione: i'll ask you personally and hopefully you won't be biased: do you think that the community that provides the packages in the universe will provide their own security updates for dapper later on? <fabbione> bintut: i can tell from experience that it happens sporadicaly <fabbione> but not on a regular base <fabbione> i mean i do use universe packages myself <fabbione> but i know that i can't rely on them on supersecure servers <bintut> fabbione: is there additional patches that are being applied when packaging software in the universe? <fabbione> http://www.ubuntu.com/support <bintut> fabbione: yeah <fabbione> bintut: probably.. that depends from package to package <fabbione> there are about 11000 pkgs in universe.. i somehow lack the time to look at all of them : <bintut> fabbione: how will i know the server packages that will be included in the main source for dapper? <fabbione> there is a FAQ for that.. <fabbione> let me find the link <bintut> fabbione: yes, please.. <fabbione> i am not a big www/wiki lover <lh317> http://people.ubuntu.com/~cjwatson/seeds/ubuntu-server-dapper/server <fabbione> that one <lh317> is what I had, dunno if it's the most update source or not. <fabbione> thanks lh317 <fabbione> it is <lh317> they still need to seriously beef their mail server package sets. <fabbione> lh317: did you file wishlist bugs? <fabbione> or do you expect people to read your mind? <fabbione> (on the note: that list will be considered final only 15 days from release) <fabbione> (more or lesS) <lh317> no, I haven't, but it should be obvious that SA, one of amavais or mailscanner, etc ought to be included. <fabbione> that's exactly where community should be <fabbione> there is no such thing as obvious <lh317> ... <bintut> same comment here.. <fabbione> lh317: you want SA and whatever scanner.. i don't.. somebody else wants it but in another brand/pkg versions <fabbione> (just an example of course) <fabbione> so there is no obviuos... <lh317> well, I understand that. that's one thing. But I haven't seen a, "pick which scanner will be in drake" thread or discussion or request of the community either, or even a bug to vote on. <fabbione> if community doesn't express wishes,, <fabbione> so consider yourself at fault for not bringing up the topic <lh317> fabbione: in this case, this is fundamental enough something should be selected. Now, if you picked opposite my chocie and I didn't voice, i'd stfu. but this is like selling a car and saying, tires optional IMO. <fabbione> fundamental to you <fabbione> and your working env <fabbione> are you aware that in some states/companies, spam filters are illegal? <lh317> i can't think of that many email environments where mailscanning isn't essential. <fabbione> i do :) <lh317> i'm aware. <bintut> postfix, sa, amavis-ng, clamav, openldap, samba, openvpn, squid, dansguardian, sarg, nagios, snort, ejabberd, etc.. <fabbione> anyway.. time to wake up wife and start weekend :) <bintut> where can i post my request? sorry, i'm an ubuntu/debian newbie.. i'm a mandriva user for years.. * bintut reboot #ubuntu-server 2006-03-03 <raf1hh> hi all <raf1hh> has anybody any experience getting ruby 1.8.2 or 1.8.4 on a fresh 5.10 server? <lh317> i haven't. <raf1hh> there is so much conflicting info on this subject on google that my head hurts... <raf1hh> thought would ask sombody... <lh317> unless I'm missing something, it should be as easy as 'sudo apt-get install ruby' <raf1hh> yes, it installs 1.8.3 which is very buggy and not advised to be running <raf1hh> 1.8.2 and .4 are the two stable releases <lh317> breezy claims 1.8.2-9 <lh317> so I have to wonder how you're getting 1.8.3. <raf1hh> but once you install it, it actually is 1.8.3 <lh317> sure it's not like a CVS pull and the version is wrong? <lh317> that's what the changelog implies to me. <lh317> http://packages.ubuntu.com/changelogs/pool/main/r/ruby1.8/ruby1.8_1.8.2-9ubuntu1/changelog <lh317> hrm, i need to learn to read. updated to 1.8.3-preview1 :/ <raf1hh> is it possible/safe to install a package from debian unstable repository? <raf1hh> I guess more like possible without breaking too much stuff... <lh317> possible? Yes. Safe? depends. <lh317> for ruby, i'd imagine the answer is probably, but I haven't tried it. <lh317> anyway, add unstable to your apt.sources.list below breezy, and possibly pin that one package. <raf1hh> thanks, will give it a try <lh317> obviosuly, if you break it, I point and laugh and you keep the pieces ;) <raf1hh> thank god for VMWare snapshots :-p <lh317> indeed. <raf1hh> lh317: thanks for the help again <lh317> np <tarvid> In the thinking stage but I want to shape outgoing traffic. <tarvid> I have recently realized I cannot control incoming traffix except by deferring or dropping outgoing traffic <tarvid> In particular, downloads are screwing up my VOIP traffic <tarvid> any wisdom? #ubuntu-server 2006-03-04 * netjoined: irc.freenode.net -> brown.freenode.net <setuid> Why was aes256 removed from dapper? (this worked fine in breezy) <setuid> ioctl: LOOP_SET_STATUS: Invalid argument, requested cipher or key length (256 bits) not supported by kernel <setuid> And I have aes_i586 loaded <setuid> oops, that should have gone to -devel <gaspedalo> hi guys. Someone ever used evms yet? <gaspedalo> no? I'd like to make a raid5 but I am unsure and hesitant <spike> uhm, shouldnt I be able to gunzip, loop mount initrd images? <spike> I get errors about invalid FS #ubuntu-server 2006-03-05 <noomz> PLz! Could anyone can help me with apache2 w/ ssl & php <derekS> there is a program on universe candidates that would be nice for ubuntu server <derekS> mt-daapd <derekS> any cahnce of it getting uploaded? <derekS> for daaper <derekS> *dapper <nictuku> derekS, try #ubuntu-motu and #ubuntu-devel <nictuku> it must go to main first, I presume <derekS> nictuku: ok <derekS> thanks <allee> Sun Galaxy X4100 sda1 versus sdi1 root dev strangeness. After netbooting with preseeding, reboot fails can'y mount /dev/sdi1. In grub s/sdi1/sda1/ and boot successful. df shows root it now mounted on /dev/sdi9 <allee> uh, not sdi9, sdi1 of course <nictuku> missing a required module in the initrd maybe? <fabbione> allee: talk to Keybuk on #ubuntu-boot <allee> 'k thx #ubuntu-server 2006-03-06 <ealden> MarioMeyer, ping <MarioMeyer> ealden, pong <UWS30> Can anyone point me to a useful URL that explains how a mailserver operates and how to set one up on my Ubuntu web server? <UWS30> I did the howtoforge server install but I just can't figure out how the mailserver part works. I'm a newb. <MarioMeyer> the howtoforge one is very straight forward.. just follow it <UWS30> I agree that it's great, and I did follow it, but I'm not sure how to operate the mailserver now. There weren't any "instructions for dummies" that came with it. <Pygi> wb matt <Pygi> nop, I don't have the link anymore :-/ <Pygi> o, chara :) #ubuntu-server 2006-03-07 <tepsipakki> hi, I'm trying to preseed a server install to use a server-kernel, but so far without success <tepsipakki> so the question is, does the vanilla server-installation prompt the user for a kernel? <tepsipakki> or is "linux-server" something that has to be installed by hand? <tepsipakki> maybe I'll just file a bug.. <lapo> hi <lapo> would be possible to have a more recent dovecot in dapper (in sid there are packages for the lastest one which is beta3)? <fabbione> no <fabbione> we are in deep bug fix mode only <lapo> beta3 fixes a lot of bugs :-) <lapo> I have a lot of "Corrupted index cache file" errors with the current build <fabbione> i am using it with no issue <fabbione> file a bug if you think it is utterly important to have the newest version <lapo> fabbione, #30314 <fabbione> ok than somebody will process it <fabbione> sooner or laer <fabbione> later <lapo> I have the maildirs on xfs, can it be the source of the problem? <lapo> nothing is writing to those maildirs atm, except for dovecot <fabbione> yes <fabbione> xfs sucks <fabbione> like many others fs <fabbione> ext2 or ext3 <fabbione> these are the only 2 i trust for my data <fabbione> ext2 if they are really really sensible <Psi-Jack> Anyone use any DNS server that uses mysql-based table lookups? <lapo> fabbione, seems like that the "Corrupted index cache file" is not caused by xfs, I have the same behaviour with ext3 as well <lapo> fabbione, I found out references to that index corruption problem, seems like related to 64bit system, and seems like fixed in lthe betas, see http://www.dovecot.org/list/dovecot/2006-February/011360.html <lapo> fabbione, I filed #33457 regarding this thing, thanks for your attention <lapo> bye <eri1> hello? <eri1> I accidentaly overwrote root user in phpmyadmin and locked myself out, any way to fix that? <ivoks> yes <ivoks> but you have to be root <eri1> yeah <eri1> ... <ivoks> stop mysql service <ivoks> /etc/init.d/mysql stop <ivoks> then run: mysqld --skip-grant-tables <ivoks> be aware <ivoks> now *everyone* can write in your DB <ivoks> log into your phpmyadmin and set a new password for root <ivoks> kill mysqld and start it as a service <eri1> how do I stop a service? <ivoks> /etc/init.d/mysql stop <ivoks> this is a question for #ubuntu <eri1> thank you <ivoks> np #ubuntu-server 2006-03-08 <irvin> MarioMeyer: ping? <nictuku> I believe we'll be right back. Dinner :-) <MarioMeyer> irvin, pong <lapo> hi <maswan> can't the server config default to not be quiet? please? <maswan> Just "ALERT! Can't find /dev/hda1, dropping to a shell" is fairly unhelpful when it comes to debugging a problem. <dotslashroot> Hello #ubuntu-server 2006-03-09 <Pygi> fabbione: server's working well for now ^^ <Pygi> let's hope it stays that way... #ubuntu-server 2006-03-10 * #ubuntu-server [freenode-info] if you need to send private messages, please register: http://freenode.net/faq.shtml#privmsg <Psi-Jack> Hey, anyone here use mydns? :) <maswan> I'm a bind&sendmail guy. :) <Psi-Jack> maswan: Yeouch. ;) <Psi-Jack> Hey, anyone know how to setup IP Aliases in the /etc/network/interfaces? <infinity> By "IP aliases", I assume you mean virtual adapters? <Psi-Jack> I mean, just that. IP aliases. Several aliases bound to a single interface, for example, eth0, eth0:1, eth0:2, etc. <infinity> eg: "iface eth0:1 inet static\n address 523-777-4502" etc? <Psi-Jack> Hmm, would that actually.. Work? hmm <infinity> It's the same as setting up any other interface, yes. <infinity> The only caveat is that eth0:1 can't go up before eth0 (so you could have a "pre-up" for eth0:1 that says "pre-up ifconfig eth0 up") <infinity> Or just make sure they're in the right order in the file, and all set to "auto" :) <Psi-Jack> heh. Hmmm.. auto? <maswan> infinity: that's the way we do it at work (no aliasing at home currently) :) <Psi-Jack> Hmmm. <infinity> Example: <infinity> auto eth0 <infinity> auto eth0:1 <infinity> iface eth0 inet static <infinity> address 523-777-4502 <infinity> network 523-777-4502 <infinity> netmask 523-777-4502 <Psi-Jack> I have mapping hotplig, script grep, map eth0, which started eth0, eventually during the hotplug. <infinity> network 523-777-4502 <infinity> gateway 523-777-4502 <infinity> iface eth0:1 inet static <infinity> address 523-777-4502 <Psi-Jack> hotplug even. <infinity> network 523-777-4502 <infinity> netmask 523-777-4502 <infinity> network 523-777-4502 <infinity> That should work smashingly. <infinity> Oh, get rid of the hotplug stuff on your server... (It's going away in dapper anyway, for all installations) <Psi-Jack> Oh, great.. <infinity> udev will magically handly hotpluggish suff without the crazy mapping scripts in dapper. <infinity> Thankfully. <Psi-Jack> It better be very "compatible" with otherwise, else every dumb-founded ubuntu person will be screaming. ;) <infinity> dapper's default interfaces file is much easier for people to understand (no one really understood the hotplug mapping stuff) <infinity> And the breezy->dapper upgrade SHOULD fix old interfaces files to remove the unnecessary gunk. <infinity> This upgrade path needs to be tested, re-tested, and tested some more, mind you. :) <Psi-Jack> There should be no should in that statement. ;) <infinity> The should will become a "does" or "will" before release, trust me. :) <Psi-Jack> hehe <Psi-Jack> I love people in #ubuntu sometimes. I get more help /here/ than I ever will in #ubuntu, 19:20 times. <Psi-Jack> Course, then again, most of my questions are usually topics the average "user" doesn't use. ;) <Psi-Jack> Hmm. now to see if maradns can bind to multiple IP's, specifically set. <Psi-Jack> Well, it certainly didn't like that. heh <Psi-Jack> Not bad.. Not johncrosby@example.net.. Roughly about 2.7mb, IF even that much, used by mydns. :) <Psi-Jack> Oh sheesh.. Not even 1mb. Roughly ONLY about 400kB. <Psi-Jack> heh. I'm wondering though, why maradns, being my caching dns, uses up around 8mb. * Psi-Jack shrugs, "Better than the 20mb bind9 itself eats up, right off the bat. I guess." :) <Psi-Jack> Heh heh <Psi-Jack> Yeah, I found that out about the D C C S E N D exploit. For some reason SPI is vulnerable to it. <pesco> Hi all. I'm going to set up a new server in about two weeks. Should I try Ubuntu server instead of trusty Debian, and if so, why? <spike> pesco: because trusty debian is trusty debian and not trusty debian-server, and you're building a server, not a generic linux box. because you cannot afford to run old software, neither to run unstable stuff from sid. because you have no time to spend on default customization you want on a server, like kernel patching. because u're running on some hw certificated by ubuntu and both customers and boss will be happy to see it as such <spike> because you're using some scsi controller for which dedicated management software exists but isnt packaged <spike> pesco: because if you're gonna need something server related you have more chances to see it implemented into ubuntu-server than generic debian <spike> pesco: and because you get all this based on your trusty debian <pesco> spike: Thanks. I suppose going right with Dapper will be fine in my timeframe? <spike> pesco: I do not think so, then it really depends what's that machine for and what you define "fine", but I wouldnt advise it. better going with breezy and update to dapper later, even if with breezy you're not gonna get all the cool stuff <spike> pesco: dapper will be released in april,so in 2 weeks wont be stable yet. it will probably run fine and be stable, but you're taking responsibilities for that <Psi-Jack> Anyone know of a web-based firewall/NAT/PAT manager, at all? ;) <bpuccio> monowall provides one, but its a complete distribution, not a web interface that you can install an on ubuntu machine <spike> Psi-Jack: think ebox is getting one. otherway ipcop/smoothwall got one too you could rip off <spike> m0n0wall as well, yeah <Psi-Jack> Hmmm. <spike> the other frontend I know of is GUI, firestarter <spike> Psi-Jack: are you sure you need something webbased? <Psi-Jack> Well, the reason I asked for web-based, is I will be using it on a remote monitorless box. Within my LAN. <spike> wouldnt something like shorewall do the job? <spike> ssh to it? <spike> I cant think of anything bettern than shorewall for fw management <Psi-Jack> Shorewall. What's that? <spike> it's rock solid, can take care of everything, from vpn to tc <spike> a cli frontend to iptables <Psi-Jack> Hmmm. I ntoiced, there's a shorewall webmin module. <spike> no idea, vim is all I need with such good confs <Psi-Jack> hehe. <spike> you can define zones, policies and whatever, like u'd do on a netscreen <spike> much better than cisco like style imho <Psi-Jack> Cool. :) <Psi-Jack> I'll have to check it out, then.. ;) <spike> I would :) <Psi-Jack> Heh, webmin-shorewall removes webmin-firewall. Oh well. Still gonna check it out. #ubuntu-server 2006-03-11 <Psi-Jack> Man, I am so, so.. Blah when it comes to firewall setups on Linux these days. heh <maswan> pfft on firewalls. <Psi-Jack> Not really even just firewall. Mainly just port forwarding.. Namely from a single NIC. <spike> eh? <spike> Psi-Jack: if it's just forwarding, why not using "redirect"? <Psi-Jack> spike: redirect? <spike> if just want that and have no iptables in place I do not see why taking the hassle <spike> Psi-Jack: apt-cache show rinetd <Psi-Jack> Oh, I want iptables in place. Basically the general thumb is, I'm setting up one Linux system as a a DMZ from the front-end router, to make Linux handle all the necessary port forwards. <Psi-Jack> And, I most DEFINATELY want all external IP's to remain external to the servers receiving it. <spike> uhm, what frontendrouter is that? cant u just setup and dmz there? <Psi-Jack> It's just a netgear router, actually. <maswan> Psi-Jack: isn't it better to just put all the hosts on the network? nat does break some applications in rather subtle and evil ways. <Psi-Jack> It has a port forwarding limit of 20 entries, too, which is definately /not/ enough. <spike> I c <Psi-Jack> maswan: Heh, when it comes to that, I know what to do. I just johncrosby@example.net. I'm used to ipf. <Psi-Jack> Basically, right now, what I want to do, is block all external IP's, and chain in a couple accept rules in front of that, to allow specific services to run over the internet. Then setup specific port forwards to go elsewhere in the LAN, which I have about 6 other servers I need to forward for <Psi-Jack> Hmm. <Psi-Jack> I'm having trouble with shorewall's hosts file. :/ <Psi-Jack> It keeps saying all my hosts have Invalid HOST(S) column contents. For things like 523-777-4502/24, and 523-777-4502 etc <Psi-Jack-v2> Anyone here use shorewall, and handy? <nictuku> I do <nictuku> milestone1 of nwu is very close :-) https://trac.ubuntubrasil.org/nwu <Psi-Jack> nictuku: Do you by chance know how to do a single NIC NAT? <nictuku> i think so <Psi-Jack> I'm basically trying to make my firewall/router server run the gateway for my servers, having all the servers use it as the default gateway, while it itself uses the front-end router for it's own default gateway. <nictuku> well <nictuku> but if the default gateway and the servers are all in the same subnet that won't work as expected, unless you put the server as a physical bridge <nictuku> or are they in split sub networks? <Psi-Jack> No, there's no split sub networking involved. :) <Psi-Jack> I'm basically just splitting off the servers as more of a side dish, than anything. For now. <nictuku> so, servers are like 523-777-4502, default gateway is 523-777-4502 and your linux router is 523-777-4502? <Psi-Jack> My front-end router is 523-777-4502, which all my local's use, and the backend router, (which is the DMZ point of the front-end-router as well), is 523-777-4502 <nictuku> that won't work, since the linux router will tell the servers and station to update their route and your design will be useless <nictuku> you have to split them physically and use the linux server as a bridge, not a router <infinity> Nah. <nictuku> also, no NAT is involved there <Psi-Jack> Eh? I setup all the servers to use the backend firewall/router as the default gateway. <nictuku> Psi-Jack, and check the nodes routes after you try to talk to the outer world <infinity> What subnet are you using for the internal machines? <nictuku> if you use icmp PING, you'll get a 'nexthop: 523-777-4502' message and they will just update their own routing tables. <Psi-Jack> They're all using 523-777-4502/24 for the network. There's no subnetting involved. <infinity> Psi-Jack: That's your problem, then. <nictuku> infinity, he's not using subnets <infinity> Psi-Jack: You need a subnet (but it doesn't have to be physical, just logical), so you can tell the frontend router that all traffice to 523-777-4502/24 should go to 523-777-4502 with a static route. <nictuku> Psi-Jack, anyway you have to split it physically, or you will have no security if you leave the nodes in the same network bus as the backend router <Psi-Jack> nictuku: Why would the routes get changed, when I specifically set them otherwise? <nictuku> I disagree with infinity :-) <nictuku> split logical bus is a bad idea, if you don't split them physically <Psi-Jack> nictuku: Security is not the issue. ;) <nictuku> Psi-Jack, that's an IP protocol stuff <nictuku> That's still a bad idea, but if you really hate your job and doesn't take security into account, then just split the subnets <nictuku> that can be administratively painful though. I'd make your linux server a bridge. That works really fine for me, with 5 sites and 1k+ nodes <Psi-Jack> Hmm. Well, the backend router itself does have two NIC's, so as an alternative, I /can/ make it use it. <infinity> If you bridge the subnets, you've not bought any more security. <infinity> Your argument kinda falls apart there. <infinity> Two bridged ethernet networks are still one physical network. <nictuku> infinity, if his goal is to make all trafic pass by the linux machine, my point does stand <nictuku> No because we can filter traffic the same as a router. A bridge firewall is exactly like a router firewall. <nictuku> I mean, from the filtering point of view. <Psi-Jack> nictuku: My goal is to have ONE NAT for the local clients, and two NAT's for the servers. While still allowing the local network to communicate efficiently with the server network. <infinity> Yeah, or you could run VLANs at the previous router, or a variety of solutions. <nictuku> indeed <nictuku> why so many "NAT" (better call them masquerade networks, i think)? <Psi-Jack> Masuqerading == NAT, mind you. :) <nictuku> that will just create a myriad of subnets <Psi-Jack> nictuku: The reason for this is, this is, in fact, a home network, with a bunch of servers sitting in the back-end. <nictuku> I know that <nictuku> hm <Psi-Jack> Rather than all the servers sitting in the front-end, with all the locals behind those, I have all the locals in the front, with the front-end re-directing all non-addressed traffic to the backend. <nictuku> I still see no reason for a masqueraded network. But that's me, because I have a strong, personal opinion about "NAT's" <nictuku> oh i see then <Psi-Jack> That make more sense? I don't have a diagram to show it, so I try to explain it best as I can. ;) <nictuku> I'm still confused hehe. let me re-read that <Psi-Jack> I have about 6 front-end local clients that all use the front-end router for the default gateway. Some ports from the front-end PAT to individual clients. Stuff like ssh, game ports, VNC, etc.. <Psi-Jack> Anything not port-forwarded from the front-end, gets DMZ'd to the backend, which has the heavier firewall on it. <Psi-Jack> And that backend needs to handle routing for the 16 servers behind it. <nictuku> I see <nictuku> you have a strange DMZ there, then hehe <nictuku> seems like your 'local clients' act like a DMZ :-) <Psi-Jack> It's strange, yes.. But it works better for a home-based network. ;) <Psi-Jack> They are, essentially. ;) <nictuku> and this 'strong firewall' is that linux router we have discussed? <Psi-Jack> Correct. <nictuku> I whish I had such a home network myself :-) <Psi-Jack> All the servers using IT as the default gateway, will need DNAT's to portforward specific ports to their needed destinations, while they route back through the backend firewall, back to the front, and out the internet. <Psi-Jack> I parallellized all my servers in the backend. Seperate computers for webserver, mailserver, maildelivery, mysql database, ldap database, and etc... <nictuku> ok then. Suppose you don't want to split into subnets, one possible design is (though I think infinity could provide a better solution): <nictuku> hmm use a bridge :-) <Psi-Jack> heh <nictuku> in the first NIC of linux-router, plug the IT-signaled bus <nictuku> in the second NIC, plug your servers <nictuku> configure PAT rules in the IT router only <nictuku> setup netfilters in the linux router, with rules for the traffic to and from the servers <nictuku> finally, use shorewall for all that. I believe you mentioned it in the beggining.. shorewall is really nice <Psi-Jack> Hmmm. I have 4 DNS servers in the server area, 2 of which are mydns, and 2 resolvers, that the mydns resort to for resolving. If I split them out like that, How exactly would I still get my local clients to talk to /both/ of them? <nictuku> Altough you have to setup the bridge in /etc/network/interfaces, with pre-up post-down commands. I don't have them in handy, unfortunately, but I think shorewall online docs has a sample of that for debian <nictuku> how wouldn't them? <nictuku> all boxes *could* have access to all other nodes, if you allows so in the firewall rules <Psi-Jack> Hmmm.. <nictuku> they can have full network connectivity. No PAT here <Psi-Jack> I guess I don't see how that works. <Psi-Jack> PAT, basically is a port to a port. <nictuku> and no DNAT either <nictuku> node1 is a local client: 523-777-4502. server1 is a dns server: 523-777-4502. <nictuku> from node1 you can ping 523-777-4502 and connect to any of its ports <Psi-Jack> Hmm... <nictuku> obviously you have to create rules to block or allow traffic from 'nodes' to 'servers' <nictuku> in /etc/shorewall/policy: <nictuku> nodes server DROP <nictuku> in /etc/shorewall/rules: <nictuku> ACCEPT nodes server:523-777-4502 udp 53 <nictuku> ACCEPT nodes server:523-777-4502 tcp 53 <nictuku> then nodes will only be able to do DNS requests to server1 <nictuku> also you have to setup policies and/or rules for the traffic from server1 <Psi-Jack> Hmm. Okay. Could you walk me through some of this, to get me started? I'm about to bring the second NIC of the firewall/router up, and wire it up. heh <nictuku> hmm that is a lot of work you'll have to do, and it's 02:40 AM here, I'm crashing :-) <nictuku> I suggest you to read shorewall.net about bridges <nictuku> it's a nice documentation as far as I remember <nictuku> Psi-Jack, I can try to help with specific issues, though <Psi-Jack> alrighty <nictuku> 523-777-4502: icmp_seq=2 Redirect Host(New nexthop: 523-777-4502) <nictuku> this is the 'redirection' I mentioned early <nictuku> that's why it's useless to setup a gateway for the nodes, but this gateway redirects to another router in the same subnet. result: "Redirect host" <nictuku> https://lists.netfilter.org/pipermail/netfilter/2003-November/048077.html <nictuku> it is possible to disable those, it seems * nictuku wonders if it's time to add nwu to freshmeat <Psi-Jack> There we go. Re-wired them up a bit. One of my network cables just suddenly died, in the proccess. Could explain why that particular server was flakey on the johncrosby@example.net. ;) <nictuku> :-) <Psi-Jack> Yay! Finally Skype has USD instead of JUST Euro! :D <Psi-Jack> Anyway. <nictuku> good news <Psi-Jack> Wassat? <Psi-Jack> Basically now, from the firewall/router, which I will now refer to as the IG, is using eth0 tying it in with the rest of the network, and eth1 tying in all the servers. <Psi-Jack> heh. <Psi-Jack> Great, and now my DNS is failing. :/ <nictuku> can you ping it? <Psi-Jack> I can ping the servers, just fine, yes. <Psi-Jack> But, now even the IG server can't ping an internet IP <Psi-Jack> However, the LAN can communicate fine with the SLAN. <Psi-Jack> LAN == Locals, while SLAN == Server LAN. <Psi-Jack> And I have shorewall completely shut off at the moment. <Psi-Jack> Technically, it should be able to do it. heh <Psi-Jack> Ahh, there we go. <Psi-Jack> two 523-777-4502 gw 523-777-4502's. One for eth0 and eth1 existed. <Psi-Jack> But, now, still, the servers can't get to the internet. That's my stumping point. <hunger> Is xfonts-75dpi needed? <hunger> Both KDE and Gnome seem to hardcode font resolution to ~100dpi <allee> hunger: KDE uses whatever is was autodetected by xserver (75 dpi as fallback) <allee> hunger: oh, this is (k)ubuntu. Sorry :( Then for KDE: 75-110 dpi are mapped to 96 dpi, 110-140 DPI are set to 120 dpi. > 140 dpi: use the resolution <nictuku> hi <Pygi> hi hi #ubuntu-server 2006-03-12 <spiekey> hello! <spiekey> i have a i386 box with an adaptec raid controller and when i boot it with the 5.10 breezy server iso i get a kernel panic <spiekey> i have already tried it with: vga=normal noapic noscsi nodma noapm nousb nopcmcia nofirewire noagp nodhcp xmodule=vesa <ubijtsa2> spiekey: if a dpt_i2o card, breezy won't work.. hoary or dapper will <spike> hey ubijtsa2 <spike> how's you man? <ubijtsa2> lo spike <ubijtsa2> I'm not to bad. tired and have tons of work to do :) <ubijtsa2> you? <spike> ubijtsa2: got a uk based job that's boring the hell out of me... <spike> ubijtsa2: but it's good news anyway, needed it, had to start somewhere and it's "important" enough to look good on a cv :) <blacking> nrllo all <blacking> hello <ubijtsa2> spike: good stuff.. where in the .uk are you based now then? :) <blacking> please does anyone here with experience how install ubuntu on usb drive? <mkrufky> I have TDS functionality working correctly using php5 on my ubuntu server, communication with mssql on a windows server..... unfortunately, Breezy's php5 doesnt seem to include support for stored procedures, "mssql_init(), mssql_bind(), mssql_execute()" although all online documentation says that the functionality should be present in php4.1 and later.... anybody know what i'm missing, here? <janron> am I correct to assume that dapper wont be upgraded to the latest samba-3.0.21c since it's in a freeze now? <mkrufky> janron: i'm not one of the official ubuntu guys -- I'm just a user like you, but: I am pretty sure that you're assumption here is correct <mkrufky> from what i hear, dapper will be released next month (i could have heard wrong) <mkrufky> ...so, i highly doubt you'll see any major package updates at this point in time <janron> 3.0.21b is in dapper and 21c was recently released but I dont expect to see it in dapper <mkrufky> if it's just a bug-fix maintance release, they might update to it, (might require some convincing on your part) but I cant speak for the packagers <fabbione> 12c might make it <fabbione> infinity was looking into it afaik <fabbione> dapper will be release the 20th of Apr <mkrufky> ah, cool <mkrufky> fabbione: any idea of who or where I should ask about my php5-mssql issue with stored procedures? <fabbione> still infinity <fabbione> he is php5 maintainer <mkrufky> aha <mkrufky> thanks <fabbione> no problem <mkrufky> infinity: hope im not being a pest .... I have most mssql functionality working through the use of php5-sybase .... but it doesnt let me use stored procedures... I've googled it, and everything I found says that it should work with php4.1 and later... I need access to the procedures, "mssql_init(), mssql_bind(), and mssql_execute()" ... what else do I need to do to get this functionality? <janron> any news about the community testing for server hardware? <mkrufky> fabbione: his away message says he's sleeping :-/ ... any idea which time zone he's in? <mkrufky> ...in the meantime, i will experiment, and install the dapper php5 packages .... .lets hope this doesnt destroy my system... <fabbione> mkrufky: australia.. <fabbione> mkrufky: it will mostlikely update the entire machine to dapper <mkrufky> ah.... okay then.... so i will have to sign on again tonight and try to catch him <mkrufky> yikes <fabbione> it should be safe enough.. but it is still development <fabbione> keep that in mind :) <mkrufky> ya this is for a production server <fabbione> wait :) <mkrufky> obviously not in production yet <fabbione> well ok <mkrufky> :'( okay <fabbione> if you have the option to test/upgrade -> in case reinstall <fabbione> go for it <fabbione> otherwise don't <fabbione> janron: i think ben collins did send an announce out not too long ago... <mkrufky> i made a backup root partition .... I'll just ghost the current root to the backup and upgrade there... if it dies, i'll just revert to the master root <janron> hmm, looking at https://wiki.ubuntu.com/TestingServerHardware there is nothing much there yet. Would be nice to have some package to download and try on my own servers to try and determine if they are stable running dapper <janron> I have one proxy with samba/squid integrated with MS AD running on dapper now, but not much load yet since the students are off on vacation <fabbione> janron: the main from Ben did explain what to do <fabbione> s/main/mail <janron> found a mail by Ben to ubuntu-devel-annonce, however there is still missing subpages on the wiki for communitytesting #ubuntu-server 2006-03-13 <Drac[Server] > Can anyone in here tell me how to enable USB keyboard support in the console? <Drac[Server] > I need USB keyboard support. <Drac[Server] > Nevermind. <Drac[Server] > Fixed it. <nictuku> nwu is very fast now <nictuku> the upload of the current packages and update candidates list is now smart =] <mkrufky> infinity: you around? <mkrufky> I have most mssql functionality working through the use of php5-sybase .... but it doesnt let me use stored procedures... I've googled it, and everything I found says that it should work with php4.1 and later... I need access to the procedures, "mssql_init(), mssql_bind(), and mssql_execute()" ... what else do I need to do to get this functionality? <infinity> mkrufky: You're missing that what you're googling for is php-mssql, which is a different extension from php-sybase_ct (which is what we ship) <mkrufky> yes, exactly <mkrufky> so, are you telling me that there is no way to do this under ubuntu? <infinity> mkrufky: php-sybase doesn't support those three functions. <infinity> Not without rebuilding PHP, I suspect. <mkrufky> yes. I realize that... That is exactly my problem. Is there anything I can do? <mkrufky> ok, i am willing to rebuild it, if necessary <mkrufky> infinity: is that the final answer? or is there anything else you can tell me? <infinity> apt-get install build-essential fakeroot; apt-get build-dep php5; apt-get source php5; cd php5-5.1.2; (edit debian/rules, debian/modulelist, and debian/control to build the "mssql" extension instead of the "sybase_ct" extension); dpkg-buildpackage -rfakeroot -uc -us <mkrufky> ah, awesome... will do right now <infinity> For dapper+1, I intend to ship both extensions, but that's not going to happen for dapper, now that we're WAY past feature freeze. <mkrufky> i understand <mkrufky> infinity: above instructions are aimed at dapper? or they should work for breezy as well? <infinity> Should work on breezy too, except for s/5.1.2/5.0.5/ where I mentioned a version. :) <mkrufky> aha... ok <mkrufky> thanks <mkrufky> ok i will have to pastebin this error: <mkrufky> http://pastebin.com/591642 <mkrufky> i think dpkg-source is probably part of build-essential ... strange that build-essential wont install <infinity> Okay, you'll need to manually install "libsnmp5-dev", but your GCC problems, I don't know. <mkrufky> yikes <infinity> Do you have packages installed from multiple releases, or from backports, or other sources? <mkrufky> i had an alternate root partition set up (using alternate grub menu entry), where i installed a few dapper packages..... now im back in breezy, but the both roots are using the same /var tree <mkrufky> so, on THIS root partition, all 100% breezy, but i may have borked my apt database <infinity> apt-get -o Debug33ec:265c:71fe:e26d:2682:4ec2:aaa1:99abpkgProblemResolver="true" build-essential <infinity> See if the output is enlightening. <infinity> Oh, wait. Both were using the same /var? <infinity> Yeah, you completely hosed the dpkg database, then. <mkrufky> yes... i know that was a bad idea <mkrufky> yup -- you're right <infinity> Your system has no idea what packages it has installed, AT ALL. <mkrufky> hehehe <mkrufky> good thing this is still a test box <infinity> If it's a test box, I highly recommend reinstalling it, then. :) <infinity> You won't get much done with apt/dpkg in that state. <mkrufky> ok.... so, i think i will wipe it out tomorrow AM, then re-install breezy, then do the above after <mkrufky> yes... sharing /var was a bad move -- i admit it <mkrufky> hopefully, after a clean install this should work..... but if not, will you be around here tomorrow ~ this time? <infinity> Vaguely this time, yeah. <mkrufky> okay....... hopefully all will be well and i wont need to ask anymore questions, but if not, i'll be sure to look for you again <mkrufky> thanks <allee> hi, anyone an idea why preseeding: pkgsel/install-pattern string ~t^kubuntu-standard$|~n^openssh-server$|~n^rsync$|~n^gmetad$ <allee> is ignored? <allee> aptitude install '~t^kubuntu-standard$|~n^openssh-server$|~n^rsync$|~n^gmetad$' does not complain :( #ubuntu-server 2006-03-14 <allee> mhmmm, my laptop does not know pkgsel/install-pattern but uses: base-config/package-selection ... let's try ... <allee> yeah, that was it! <Psi-Jack> Hey <Psi-Jack> Anyone here know where apache's suexec docroot is set to? <infinity> /var/www <Psi-Jack> Hmm.. <Psi-Jack> You SURE? <infinity> Last time I checked. <infinity> --with-suexec-docroot=/var/www <--- apache2 <infinity> --suexec-docroot=/var/www <--- apache1.3 <Psi-Jack> Hmmm. <infinity> (PS: I'm the apache maintainer) <Psi-Jack> Odd. I tried using it in /var/www, and I got 500 errors. <Psi-Jack> Hmmm. <Psi-Jack> I see.. Odd.. heh. <Psi-Jack> [2006-03-09 00:02:49] : target uid/gid (2000/2000) mismatch with directory (0/0) or program (0/0) <Psi-Jack> Heh <Psi-Jack> Least it's progress somewhere. <infinity> suEXEC is a bit picky about only changing id/gid to the owner if the script being run, etc. <infinity> s/if the/of the/ <Psi-Jack> Well, this, is complaining about the directory itself. <Psi-Jack> Because the directory is root:root owned. heh <infinity> Well, generally you'd want to set up subdirectories to do this from. :) <Psi-Jack> Well, yeah. That's what I'm doing. <infinity> /var/www/www.site1.com/suexec, /var/www/www.site2.org/suexec <infinity> And set owenership on those directories to the users who are being suEXECed. <Psi-Jack> Heh, yeah. <maswan> Actually suEXEC is very picky, about alot of things. :) <Psi-Jack> I'm trying to find the most /logical/ means to run a community-hosted site, where people can have their own websites. <Psi-Jack> I don't think suexecusergroup works in <directory> entries, does it? heh <Psi-Jack> Nope, it doesn't/ <Psi-Jack> Hmm. <Psi-Jack> Seems like the only truely "secure" way I'd be able to do it, is by using username.members.domain.tld, for each user. That's just.. Ouch. :) <infinity> What's wrong with that? <infinity> mod_vhost will do it automatically for you, so you don't have to do an entry for each user. <Psi-Jack> Well, there's no automagic way to handle that, really. <Psi-Jack> Hmm... <infinity> And a wildcard DNS entry takes care of the DNS problem. <infinity> Then you're done. <Psi-Jack> How would mod_vhost determine the username to suexec to? <infinity> mod_vhost does vhost templating, so you can extract the username from the Host request, and use that to define the DocumentRoot and suEXEC paramaters, logfiles, etc. <Psi-Jack> Ahhh. i see.. Makes sense. That is usable. <infinity> And was pretty much specifically designed for this use case. :) <Psi-Jack> Heh he. <Psi-Jack> Well, it's going to be quite useful for me. :) <infinity> (For ISPs with massive numbers of "hosted users", to be precise) <Psi-Jack> And I got the idea, now, to use nss-mysql to help with it all, too. <Psi-Jack> But, yeah, definately much better than my alternative thoughts on how to do it. LOL <Psi-Jack> Wee@ <Psi-Jack> Anyone know the difference between libnss-mysql and libnss-mysql-bg? <Psi-Jack> Hey, anyone know if 16 chars is the /max/ username/groupname Linux can actually properly support or could it go up to 25? <allee> Sun Galaxy X4100: mpt* drivers in dapper. Two (or one) simple disk are detected during installation. When 2 disk configured as RAID1 in the LSI controller, kernel fails to detect the disk <allee> scsi0 : ioc0: LSISAS1064, FwRev=01040000h, Ports=1, MaxQ=511, IRQ=169 <allee> Is this a limitation of the driver or a bug? <allee> SLES9 has no problem with the RAID1 of the LSI controler. And uses it as sda. <allee> SLES9 uses: Fusion MPT SAS Host driver 3.02.62sus <allee> ubuntu uses: <allee> Fusion MPT SAS Host driver 3.03.04 <fabbione> allee: you are on the wrong channel <fabbione> either open a bug on malone or talk with kernel maintainer on #ubuntu-kernel <allee> fabbione: 'k I'll do both #ubuntu-server 2006-03-15 <Psi-Jack> infinity: You around? <infinity> Vaguely. Doing release wrangling stuff right now, not much time to be helpful today. <Psi-Jack> Ahh. alrighty. :) <Psi-Jack> Looks like mod_vhost_alias goes in left->right order for %N anyway, after looking at it long enough. <Psi-Jack> Ahh,. and VirtualDocumentRoot /can/ be used inside a virtualhost section, excelent. :) <Psi-Jack> infinity: Hmm. The only thing I got a problem with, is.. How do I get <username>.members.domain.tld from the address for the vhost, into SuexecUserGroup to use as it's username group? <Psi-Jack> infinity: Or, what is the userdir set for apache's suexec? default, public_html? <infinity> Yeah. <Psi-Jack> Grrr <Psi-Jack> This... is fracking annoying. <Psi-Jack> I can't get .php to suexec even in UserDir methods, unless it's chmod'd executable and run as cgi-scripts handler type. AddType/Action isn't suexecing. :/ <infinity> Well, yes. suexec is for CGI. <infinity> Apache doesn't exec johncrosby@example.net. <infinity> You'd have the same problem with mod_perl, mod_python, etc. <Psi-Jack> Well, I'm not using mod_php for .php scripts in this user homepages vhost. <Psi-Jack> I tried to figure out how to get <username>.members.domain.tld to SuexecUserGroup, but, I can't figure out how to get the <username> for the SuexecUserGroup. heh <infinity> No, but you're using mod_actions, which isn't quite CGI either. <Psi-Jack> The only last-hope alternative I got, is suphp <Psi-Jack> But, in Breezy, that's php4. heh <infinity> Rebuilding it isn't rocket science, mind you. <Psi-Jack> Heh, I'm beginning to think that's about the best way to do it. <Psi-Jack> Kk. How do I rebuild it into a new package? I know it's really simple, I just don't do it often. <Psi-Jack> fakeroot debian/rules binary is one way I think. <infinity> apt-get build-dep [packagename] ; apt-get source [packagename] ; cd package-version; (edit crap you want to edit); dch -i (make a changelog entry); dpkg-buildpackage -rfakeroot <infinity> Ish. <infinity> (dch is in the "devscripts" package) <Psi-Jack> Think I got it. ;) <lapo> hi <Pygi> Hi lapo <Pygi> how may we help you? :) <lapo> Pygi, upgrading dovecot version for dapper for example :-) <lapo> updating <Pygi> what's the issue lapo? :) <lapo> bug #33457 <Drac[Server] > I'm shutting the server down temporarily. I'll be back. <morrow> Hi <mkrufky> ok, i'd like to announce that I (finally) got stored procedures working for m$sql under php5 / breezy, after patching the php code and recompiling from scratch..... I already understand that this functionality will not be officially added to Ubuntu until after dapper+1 , so, I'd like to upload these packages somewhere, in case someone else can benefit. Is there a place where I can do that, or should I use my own server? <Pygi> perphaps in backports? <mkrufky> yes, might be a good idea... I'm giving it some good testing right now... Later on i'll investigate into how the motu stuff works <Pygi> k, great job btw. :) <mkrufky> thanks... i really owe the credit to infinity -- he told me how to do it <Pygi> hehe ;) <Psi-Jack> Anyone know how to get pure-ftpd to use NSS for uid/gid lookup of files? <Pygi> Will we finally be releasing flight CD's for -server or we'll stick with daily builds? <infinity> mkrufky: You had to patch the PHP source? <raise eyebrow> #ubuntu-server 2006-03-16 <mkrufky> hey <mkrufky> infinity: sorry for the delay <mkrufky> infinity: yes, I had to patch the php5 source -- there is a bug in the php5.0.x code that breaks stored procedures for certain variable types <mkrufky> infinity: unfortunately, i must leave now... sorry that we missed each other again <mkrufky> infinity: I tested it -- all works very well... I'll try to meet you in here on Monday, and I'll show you the patch that fixed the problem <mkrufky> infinity: if you need like to contact me before then, feel free to email me -- {my johncrosby@example.net <mkrufky> btw, the patch that I applied was backported from php 5.1.x ..... so, we shouldnt need it for dapper ++ <mkrufky> sorry, really gotta go... bye all <Pygi> bye <mkrufky> Pygi: bye
{'channel': 'ubuntu-server', 'month': 3}