[00:10] <AtomicSpark> Apparently I need to configure dns-sec and possibly apparmor prevents dhcp from updating stuff in /etc/bind
[00:11] <giovani> why do you need dns-sec?
[00:11] <giovani> (it isn't a bad idea ... but need?)
[00:14] <AtomicSpark> I don't know. :P
[00:14] <AtomicSpark> All the guides suggest it, but I really haven't found a decent looking guide on the topic.
[00:15] <giovani> hah
[00:16] <giovani> don't bother
[00:16] <giovani> it's an advanced topic
[00:16] <giovani> it doesn't sound like you're ready for that
[00:18] <AtomicSpark> http://www.cahilig.org/debian-and-ubuntu-ddns-with-bind9-and-dhcp
[00:19] <Deeps> iirc, the preferred location for zones that need to be writable by bind is /var/cache/bind
[00:20] <JanC> AtomicSpark: is this for a large network?
[00:20] <AtomicSpark> JanC: No. ~10 computers, but not being able to resolve hostnames is annoying. espeically when there is a shared printer. :P
[00:20] <Deeps> /etc/apparmor.d/usr.sbin.named contains the apparmour profile, defining what dirs can be read, written to and executed from
[00:21] <Deeps> and by the sounds of things, you dont /need/ dnssec
[00:21] <AtomicSpark> Deeps: Yeah. I saw that.
[00:21] <JanC> AtomicSpark: then maybe use dnsmasq ?
[00:21] <JanC> it's much easier to setup for this sort of thing...
[00:24] <JanC> it does both (simple) DNS & DHCP
[00:26] <AtomicSpark> Hmm. Can't find the key. AppArmor is probably hiding it.
[00:27] <AtomicSpark> Deeps: so I copy the local zones to /var/cache/bind then update the named.conf.local paths?
[00:37] <AtomicSpark> Hmm. Time to try dnsmasq or just fall back onto the router. :P
[04:42] <ryanprior> If I start up a new Ubuntu Server instance with KVM, how do I ssh into it?
[04:44] <hads> Use the IP address you gave it?
[05:05] <twb> ryanprior: "with KVM" or "within KVM"?
[05:05] <twb> ryanprior: in the case of the latter, you need to get its network up, using e.g. -curses or -vnc :0 long enough to tweak its network config.
[05:05] <ryanprior> I start it like so: kvm -hda my.img
[05:06] <ryanprior> So, with kvm.
[05:22] <twb> Er, if my.img is your Ubuntu server, then that server is running *within* kvm.
[05:47] <ZykoticK9> Ubuntu 8.10 JOES - is it possible to install ssh-client without it brining in x11-common, and the various x11 libs?  or the ssh server for that matter?  or will I have to just install the full version of server for this to work?  I am testing with VirtualBox 2.1
[05:49] <JanC> heh
[05:50] <JanC> don't install the recommends
[05:52]  * JanC thinks "install recommends by default" should be disabled on ubuntu-server
[05:52] <ZykoticK9> JanC, was that directed to me?  it includes these packeges in the "the following extra packages will be installed" section, there are more "suggested" but i'm not even including those???
[05:52] <JanC> ZykoticK9: use the '--no-install-recommends' option for apt-get
[05:53] <JanC> "recommends" is stronger than "suggests"
[05:53] <hads> Mmm recommends can be annoying
[05:54] <ZykoticK9> JanC, thank you :)  that cuts the list down DRAMATICALLY.  thanks, great tip!
[05:54] <JanC> I disable this on my system by default  ;)
[05:54] <JanC> systems
[05:54] <JanC> even on desktops
[05:54] <ZykoticK9> JanC, how is that done?
[05:55] <JanC> put "APT::Install-Recommends "0";" in /etc/apt/apt.conf
[05:56] <ZykoticK9> JanC, Thank you.
[05:56] <JanC> this behaviour is probably useful for many desktop users
[05:57] <ZykoticK9> JanC, even more so on server I'd imagine.
[05:57] <JanC> I mean that Install-Recommends "1" is probably useful for most desktop-users
[05:58] <JanC> the default behaviour
[05:58] <JanC> but on servers, it often sucks
[05:58] <ZykoticK9> gotcha :)  Thanks again.
[05:59] <JanC> and if you want a desktop that only has the dependencies you need/want, it's useful too
[05:59] <JanC> if they want recommends installed by default, then this is a bug in the packaging anyway
[06:00] <JanC> so you might want to file a bug report
[06:00]  * JanC goes to sleep now
[06:00] <twb> JanC: for Debian, at least, the Debian Policy manual's definition of Recommends makes it sound like it *should* be opt-out.    I found it INSANE that you had to install X in order to have SSH on the console.
[06:00] <JanC> it's 7am here   ;)
[06:00] <JanC> twb: agreed
[06:01] <hads> twb: Language
[06:01] <twb> hads: sorry.
[06:01] <hads> np
[06:02] <giovani> wow, are we really that stuck-up about language here?
[06:02] <twb> giovani: it's not worth arguing about.
[06:02] <giovani> but it's worth making people feel like they've done something wrong?
[06:02] <hads> http://www.ubuntu.com/community/conduct
[06:02] <JanC> well, many of those people didn't do that because they are assholes, but because everybody else did it, I guess  ;)
[06:03] <twb> JanC: let us say they did it out of ignorance, then
[06:04] <giovani> hads: I didn't see any mention of "curse words" in there
[06:04] <JanC> something like that (and because the Debian guidelines weren't clear enough, probably)
[06:04] <giovani> but maybe I missed it
[06:05] <JanC> giovani: some people don't like "curse words", so avoiding them isn't bad
[06:05] <JanC> OTOH, nobody kicked or banned twb   :P
[06:06] <giovani> JanC: I think making people feel like they've done something wrong by using certain words is counter-productive, but alright -- I'm going to bed
[06:12] <twb> Personally, I consider it linguistic apartheid.
[06:13] <JanC> then why say sorry  ;)
[06:13] <twb> JanC: because it appeases the crazies who complain
[06:14] <twb> JanC: and because I don't care particularly about #ubuntu-server
[07:42] <Silberling> Hi Guys.
[07:42] <Silberling>  I'm having trouble with an Intel SDS2 + Intel Gbit Coppercable + Adaptec 2610SA SATA RAID.
[07:42] <Silberling> Both PCIX Devices run extremely slow and i don't know why
[07:43] <Silberling> running 8.10 server
[08:01] <uvirtbot`> New bug: #338556 in net-snmp (main) "[jaunty] libsnmp-python: Depends: python (< 2.6)" [Undecided,Confirmed] https://launchpad.net/bugs/338556
[08:33] <harrisony> my brain aint working today it seems, so ive got some possibly stupid DNS questions, I've just got a new vps running ubuntu server. could I run bind on it and use it as my master server? (and then set the name server to be the ip address of the vps)
[08:36] <cemc> harrisony: sounds like it should work
[08:38] <harrisony> would that also work for RDNS?
[08:40] <harrisony> if i was to go host <ip address of vps> would it respond with what I set it as?
[08:40] <hads> That is for your provider to setup
[08:41] <harrisony> got i
[08:41] <harrisony> t
[08:41] <hads> I don't know if I'd trust my DNS to a VPS but
[08:42] <harrisony> I don't my provider (prgmr.com) offers dns for me so unless i find some free thing or another plan
[08:42] <hads> Depends how important your services being up are really.
[08:46] <harrisony> had a feeling it wouldn't work out :P
[11:04] <sergevn> lo
[11:50] <uvirtbot`> New bug: #264808 in ant (main) "Package does not work with JDK 5" [High,Fix released] https://launchpad.net/bugs/264808
[12:03] <Barre> 12:49 -!- stefan_can<EMAIL_ADDRESS>has joined #ubuntu-server
[12:03] <Barre> 13:01 -!- DragonLord-<EMAIL_ADDRESS>has joined #ubuntu-server
[12:03] <Barre>  [13:02] [Barre(+ei)] [5:FreeNode/#ubuntu-server(+cnt)] [Act: 1] [165 nicks (@0 %0 +0 165)]
[12:03] <Barre> [#ubuntu-server] /hilight
[12:03] <Barre> sorry
[12:25] <uvirtbot`> New bug: #338720 in php5 (main) "Function lookup problem after calling setlocale(LC_ALL, "tr_TR")" [Undecided,New] https://launchpad.net/bugs/338720
[12:30] <uvirtbot`> New bug: #338704 in nagios3 (main) "description missing in nagios config" [Undecided,Confirmed] https://launchpad.net/bugs/338704
[13:37] <frzz> hi there. I get the impression the oom-killer is disabled on server kernels
[13:38] <frzz> anyone can confirm this ?
[13:38] <frzz> and maybe give a hint on how to enable/disable it ?
[14:39] <uvirtbot`> New bug: #333460 in libpam-ldap (universe) "[Hardy][LDAP]client authentication broken" [Undecided,New] https://launchpad.net/bugs/333460
[14:49] <ScottK> frzz: How is it you have this impression?
[15:02] <frzz> ScottK: wrote a simple program that mallocs and memsets memory
[15:02] <frzz> the system juste becomes unresponsive
[15:02] <frzz> if I do the same on a desktop kernel, the process just gets killed and I get a "out of memory killed" or something in dmesg
[15:24] <RainCT> Hey
[15:25] <RainCT> I'm wondering, can Debian be updated to Ubuntu? :P
[15:28] <ScottK> Sarge -> Dapper was doable.  After that, not so much as you need the sysv -> upstart transition we did in Edgy
[15:47] <mjeanson> zul: Hi, I was wondering what was going on with the update to the redhat-cluster-suite package mentionned in LP#290399, I can't seem to find it, even in proposed
[15:48] <zul> mjeanson: we are waiting for hardware to test its in my ppa right now
[15:52] <mjeanson> zul: hum, I only have production systems running redhat cluster which makes me a bit nervous to test this update
[15:52] <zul> mjeanson: yes I realize that Ill see what I can do to speed the process up
[15:53] <mjeanson> zul: do you know if anybody is in the process of testing it?
[15:53] <zul> mjeanson: not that I am aware of it
[15:54] <mjeanson> zul: I may be able to try it this evening, I have a maintenance window
[15:55] <zul> mjeanson: if you can that would be great
[15:55] <mjeanson> zul: do you need specific testing done?
[15:55] <zul> mjeanson: just needs to see if scsi_fencing works
[15:56] <mjeanson> BrunoXLambert: not on vacation?
[15:56] <mjeanson> zul: I'm not using this fencing method, is the fix specific to it?
[15:57] <BrunoXLambert> mjeanson, sure am.
[15:57] <zul> mjeanson:  it is
[15:58] <mjeanson> zul: I have been running in a similar race condition with the gfs control deamon, I had hope the patch addressed that
[15:59] <zul> mjeanson: ok the scsi_fence thing is something else then ttx ^^^
[16:01] <ttx> mjeanson: wasn't accepted in -proposed yet. You can test the one in my PPA though. It's the same.
[16:01] <ttx> https://launchpad.net/~ttx/+archive/ppa
[16:04] <mjeanson> zul: just checked the patch and it definitely applies to the control daemons, so I'll try it tonigh
[16:11] <mjeanson> zul: I'll report the result of my tests in the launchpad bug, will that be enough to have it accepted?
[16:16] <zul> mjeanson: it should
[16:19] <mjeanson> ttx: oups, had not notticed it wasn't zul talking anymore
[16:20] <mjeanson> ttx: have you tried the package yourself?
[16:20] <ttx> mjeanson: no, but someone else did already (on a private bug)
[16:24] <mjeanson> ttx: any additionnal information in the private bug which may be useful to me?
[16:25] <ttx> mjeanson: no, it's a copy of the public one.
[16:25] <ttx> except the tester data/ok
[16:25] <mjeanson> ttx: cause I haven't been able to steadily reproduce this problem
[16:26] <Discipulus> Hello, do any of you have experience with SPARC servers? Specifically a E5500
[16:38] <mathiaz> sommer: hi - is there a section on auth-config-client in the server guide?
[16:42] <incorrect> I am creating a preseed config for my servers,  however I noticed i am having problems configuring my bonded network
[16:42] <incorrect> so i thought i would cheat and wget http://server/net_`hostname`  however that doesn't seem to work
[16:42] <sommer> mathiaz: yeppers
[16:43] <sommer> mathiaz: also ldap-auth-client
[16:44] <mjeanson> ttx: btw, why ins't it in proposed?
[16:44] <ttx> mjeanson: waiting for SRU review afaict
[16:46] <mjeanson> ttx: I may be all mixed up but I tought it needed to be in proposed to be reviewed?
[16:47] <ttx> mjeanson: yes, but the SRU rationale must be accepted for it to be accepted in -proposed.
[16:47] <ttx> zul: ^ am I right ? Is it the reason it's stuck in limbo right now ?
[16:48] <zul> thats right
[16:48] <zul> ttx: but also we didnt have the hardware to test it until recently as well
[16:51] <stgraber_> about that SRU thing for redhat-cluster-suite, according to https://wiki.ubuntu.com/StableReleaseUpdates the process seems to be that once the bug is valid on LP it should be uploaded to -proposed then will be reviewed by the archive admins when it's in the queue. Once validated it'll be added to -proposed. The SRU team then will make sure it fixes the issue and will +1 the bug to get it uploaded to -updates.
[16:57] <genii-around> Hi. I'm having difficulties aggregating 3 connections with bonding driver. Is there anyone around who might have some experience with it?
[16:59] <stgraber_> 11:55 < sbeattie> hrm, well, the SRU team can't accept it until there's an upload. Wonder what happened there.
[16:59] <stgraber_> 11:55  * sbeattie goes to read the scrollback in #ubuntu-server as well.
[16:59] <stgraber_> zul: ^
[17:10] <genii-around> Some more specific info on the bonding driver setup: lan is on 192.168.0.X, dhcp served by eth0. eth1,eth2, and eth3 each connect to a router/modem and are static by router 192.168.1.(2,3,4) routers are static 192.168.1.(12,13,14) bond0 gets <IP_ADDRESS>  mode5
[17:16] <genii-around> Default route is bond0. Masquerading is on. No router IPs are in resolv.conf or routes, only actual nameserver IPs. Dhcp sever passes bond0 IP as gateway,and actual nameserver IPs.This setup is currently working but lookups can take anywhere upwards of 60 seconds. Clients are various OS
[17:17] <genii-around> Work requires me, but if anyone has thoughts/insight on the subject I'll check scroll on returning
[17:23] <J_P1> hi all
[17:49] <uvirtbot`> New bug: #338411 in samba (main) "Cannot retreive share list if samba client and server have the same hostname" [Undecided,Confirmed] https://launchpad.net/bugs/338411
[17:49] <ewook> whaat.. that shouldn't even be possible.
[17:49] <cemc> ;)
[17:49] <ewook> who in the world filed that..
[17:50] <cemc> something should complain if that's the case, ain't it ?
[17:50] <ewook> well, yes..
[17:55] <ewook> I live Steve Langasek for explaining the obvious.
[18:00] <dantalizing> thats a bug in the network administrator
[18:04] <JanC> I think the installer proposes the same name each time...  ;)
[18:04] <JanC> same hostname
[18:50] <tx2650> AJ247, if he`s using remote desktop stuff, then gui is obligatory or not
[18:58] <tx2650> Hi. Has anyone any experience on building promise tx2650 driver? I cant build it on .27 kernel.
[19:07] <Discipulus> Anyone have experience with Sparc Servers? Specifically E5500?
[19:25] <Traveler> Hey I'm trying to install on an old Dell PowerEdge 6450.  The install fails so I try a media check.  I know the CD is good, but the media test is failing.  (I actually have two of these 6450s and they behave the same.)
[19:26] <dguitar> Traveler, How do you know they are good? Are they burned discs?
[19:27] <Traveler> Yes, I checksummed the image, the disk, and read the media check on two separate computers.
[19:27] <dguitar> Burn them @ a slower speed
[19:27] <Traveler> s/read/ran
[19:27] <dguitar> Like 4x
[19:27] <Traveler> Can we just assume the disk are ok?  I ran the check on other computers.
[19:27] <Traveler> dguitar, i burned them at 1x
[19:28] <dguitar> hmmm, nm then ;)
[19:29] <Traveler> oops
[19:29] <Traveler> I think the problem might have to do with old hardware.
[19:31] <Traveler> I've tried enabling and disabling every combination of optios in the BIOS.
[19:48] <orudie> hi question. I installed roundcube webmail client a few weeks ago, how can i now find out which version i installed
[20:00] <oomkiller> can anyone tell me how to allow any ipv6 forwarding from ipv6 interface
[20:00] <oomkiller> i am getting this in the logs: L Mar  6 13:57:24 router kernel: [ 1144.038605] [UFW BLOCK FORWARD]: IN=eth0 OUT=sixxs SRC=2001:4830:1600:013a:71c2:9ee6:c701:6ad5 DST=2001:4860:a003:0000:0000:0000:0000:0068 LEN=80 TC=0 HOPLIMIT=63 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=0 SEQ=24
[20:00] <oomkiller> when trying to ping from an internal compute
[20:02] <jdstrand> oomkiller: adjust /etc/default/ufw to have: DEFAULT_FORWARD_POLICY="ACCEPT"
[20:02] <jdstrand> oomkiller: you'll also want to adjust /etc/ufw/sysctl.conf to have:
[20:02] <jdstrand> net/ipv4/ip_forward=1
[20:02] <jdstrand> net/ipv6/conf/default/forwarding=1
[20:04] <oomkiller> yeah i already have the sysctls, lemme see if the forward policy setting makes it work
[20:04] <jdstrand> oomkiller: that assumes you want to route all traffic on the FORWARD chain. if not, leave the default policy alone and add ip6tables-restore style rules to /etc/ufw/before6.rules as necessary
[20:04] <oomkiller> jdstrand: well that would be ok, i only want to enable all for ipv6
[20:05] <jdstrand> oomkiller: be warned, DEFAULT_FORWARD_POLICY does both ipv4 and ipv6 when ipv6 is enabled
[20:05] <oomkiller> well what do i need to put in before6.rules to only do it on ipv6
[20:07] <jdstrand> -A ufw6-before-forward -j ACCEPT
[20:07] <oomkiller> hmm i had that and it didnt work
[20:07] <oomkiller> didnt block the packets, but didnt work
[20:08] <jdstrand> I'd verify your sysctls
[20:08] <jdstrand> sysctl net/ipv6/conf/default/forwarding
[20:11] <oomkiller>  net.ipv6.conf.default.forwarding = 1
[20:11] <oomkiller> i know its forwarding, or at least trying to, since it was blocking it before
[20:12] <oomkiller> and it works from the box
[20:12] <oomkiller> and i can ping6 the router
[20:12] <oomkiller> from this machine
[20:14] <jdstrand> is this for NAT? do you have POSTROUTING setup? If not, see /usr/share/doc/ufw/README.gz and/or https://help.ubuntu.com/8.04/serverguide/C/firewall.html
[20:15] <oomkiller> i dont want NAT on ipv6, but i do want it on ipv4
[20:15] <oomkiller> all i want to do is route all my LAN ipv6 over my tunnel which is running on the router
[20:28] <jdstrand> not sure what the problem is. seems clear ufw is no longer blocking though
[20:29] <oomkiller> yeah
[20:29] <oomkiller> its just not forwarding
[21:04] <joinAD> i am trying to add some ubuntu machines to a active directory domain
[21:04] <joinAD> using likewise
[21:04] <joinAD> heres my syntax..
[21:04] <joinAD> sudo domainjoin-cli join syrtime-local ACCOUNT PASS
[21:05] <joinAD> with a - i get a message telling me to make sure ports are open to syrtime-local
[21:05] <ttx> joinAD: you should have complete domain name instead of "syrtime-local"
[21:06] <ttx> something like test-ad.company.com
[21:06] <joinAD> ok.. so the server name, then domain like smallbiz.syrtime.local?
[21:06] <ttx> no. The domain name
[21:07] <ttx> domain name is syrtime.local ?
[21:07] <joinAD> yes
[21:07] <ttx> there is a bug with .local domains... let me check it up
[21:07] <joinAD> actually i think its syrtime-local
[21:08] <ttx> then it's incorrect, you need a fqdn there
[21:08] <ttx> http://doc.ubuntu.com/ubuntu/serverguide/C/likewise-open.html
[21:08] <joinAD> yes... when i use the - i get the message about ports
[21:09] <joinAD> i wonder if server08 is not playing nice with a non windows machine
[21:09] <ttx> https://bugs.launchpad.net/ubuntu/+source/likewise-open/+bug/205236
[21:09] <uvirtbot`> Launchpad bug 205236 in likewise-open "Joining .local domains doesn't work out of the box in Hardy" [Low,Confirmed]
[21:09] <joinAD> thanks for link
[21:09] <ttx> I test with w2k8 server. it works
[21:10] <ttx> good luck ;)
[21:10] <joinAD> nice
[21:11] <joinAD> these older win 2k machines run nice under hardy
[21:12] <joinAD> yeah a nslookup on the IP returns smallbiz.syrtime.local
[21:12] <joinAD> so i guess it is the syrtime.local
[21:24] <orudie> if i installed package with dpkg , can i remove it with apt-get purge ?
[21:25] <AdamDV> Hey, I need some update-motd help.
[21:28] <orudie> i installed roundcube with dpkg and got hacked
[21:28] <orudie> the package that ubuntu provides is insecure
[21:28] <orudie> which is old version
[21:28] <AdamDV> No, it is't
[21:28] <AdamDV> Then build from source.
[21:29] <orudie> how can i completely remove roundcube ?
[21:29] <orudie> if i installed it with dpkg
[21:30] <orudie> i tried apt-get purge roundcube, it removes, but then when i do apt-get install roundcube it installs and the database and other stuff is still there
[21:30] <orudie> like i didnt even have to configure any files
[21:30] <AdamDV> sudo apt-get remove roundcube-webmail --purge && sudo apt-get autoremove
[21:30] <orudie> and it still works
[21:31] <AdamDV> How bout instead of installing from repo, you install from source, its quite easy.
[21:31] <AdamDV> I did.
[21:31] <AdamDV> http://go-techo.com/staff/mail
[21:32] <orudie> AdamDV, cool i will
[21:32] <orudie> AdamDV, that completely removed roundcube thanx
[21:32] <AdamDV> :D
[21:33] <orudie> AdamDV, do you think you can help me out with installing the latest version 2.0 ?
[21:33] <AdamDV> No problem, you managing a server first time?
[21:33] <orudie> AdamDV, its for my company
[21:33] <AdamDV> SUre
[21:33] <AdamDV> No problem :D
[21:33] <orudie> AdamDV, lol no, just not used to installing from source
[21:33] <AdamDV> first, go to http://roundcube.net
[21:33] <orudie> AdamDV, never needed to
[21:33] <AdamDV> Heh :D
[21:34] <AdamDV> Does this server have a GUI?
[21:34] <orudie> ok i'm there
[21:34] <ScottK> AdamDV: Are you going to be around to help him with security updates?
[21:34] <AdamDV> Yes
[21:34] <hads> heh
[21:34] <orudie> why ?
[21:34] <AdamDV> You like being hacked?
[21:34] <orudie> dude
[21:34] <AdamDV> :D
[21:34] <orudie> this host I assume is not hacked yet
[21:35] <AdamDV> Thats what security updates are for.
[21:35] <orudie> my other one is , which is not as important as this one
[21:35] <ScottK> AdamDV: Because what you're recommending is not supported here
[21:35] <AdamDV> Also, ScottK: The 2.0 release is much more secure.
[21:35] <AdamDV> Alright, orudie, join #techo
[21:35] <AdamDV> :D
[21:35] <ScottK> Generally we try to use the packaging system here.
[21:36] <AdamDV> But, it isn't always best
[21:37] <ScottK> Yes, but it didn't purge the way he thought it would seems a pretty trivial reason to throw out the whole system.
[21:38] <AdamDV> Err...
[21:41] <orudie> AdamDV, back
[21:41] <AdamDV> ALright
[22:28] <SuperQ> I don't know if anyone here cares about this, but I have been doing some tests of kvm performance
[22:28] <SuperQ> I built 2.6.28-8 on my hardy based kvm-84 server
[22:28] <SuperQ> (yea, I backported kvm/libvirt/kernel from jaunty)
[22:29] <SuperQ> I added hugepages=7000 (16G opteron machine) to the host kernel
[22:31] <SuperQ> and I booted a test VM with and without hugepages support (-mem-path /hugepages)
[22:31] <SuperQ> adding -mem-path /hugepages (with the appropriate hugepages mount path) improves a linux build speed by ~5-6% inside the VM
[22:32] <orudie> AdamDV, thanx for your help
[22:32] <orudie> i'm out
[22:32] <orudie> gotta drive home
[22:32] <orudie> its friday
[22:32] <AdamDV> :D
[22:43] <AdamDV> Netsplit!
[23:09] <roy_hobbs> Hey.  I just installed Kerberos5 according to the Ubuntu Server Guide.  When I went to test it by doing "kinit user/admin" I got the message kinit(v5): Cannot contact any KDC for realm 'TEST.LOC' while getting initial credentials
[23:09] <roy_hobbs> I ran kinit from the same machine the server is running on
[23:31]  * oli_
[23:31] <oli_> exit
[23:45] <olcafo> me
[23:45]  * olcafo
[23:54] <orudie> hi
[23:54] <orudie> dave
[23:54] <orudie> around ?


[01:04] <roasted> hi friends. I'm working on 18.04 and am seeing something weird. my local domain is "lan" but my server only responds if I ping hostname.local. The netplan config has lan appended in it though. Is there anywhere else to look in 18.04 to set the domain?
[01:05] <whislock> roasted: Need some clarification. What are you pinging from?
[01:06] <roasted> desktop and laptop on local network
[01:06] <roasted> I use pihole for dhcp/dns, though my server is static IP
[01:06] <roasted> everything else on network (dhcp admittedly) gets .lan appropriately
[01:06] <whislock> So you're pinging 'hostname.local' from the desktop/laptop, and it's responding, and you want it to respond on '.lan'?
[01:07] <roasted> exactly. or even just respond via "ping hostname" as my other servers do.
[01:07] <whislock> So, .local is mDNS/Avahi crap.
[01:07] <roasted> vault is my main server. vault hosts about 5 ubuntu server VMs on it. Those VMs all respond via "ping hostname" as well (though they are admittedly DHCP reservations and not static)
[01:08] <roasted> i.e. I can run ping nameserver, ping irc, ping web, etc, all fine, but I cannot ping vault unless I run ping vault.local
[01:09] <roasted> I feel like I'm missing something obvious (netplan is new to me) but according to the docs I feel I should have this right
[01:09] <sarnold> does your dns server know that you're using .lan in this fashion?
[01:09] <roasted> oh yes
[01:09] <roasted> in fact pihole defaults to using .lan as the domain
[01:10] <roasted> (pihole being dns + dhcp server)
[01:10] <nacc> what's in your /etc/resolv.conf ?
[01:10] <roasted> nameserver <IP_ADDRESS>
[01:10] <roasted> search lan
[01:10] <nacc> does vault.lan resolve?
[01:11] <roasted> no
[01:11] <roasted> only vault.local
[01:13] <nacc> that's systemd-resolve, iirc, you can ask it what nameservers it knows
[01:13] <nacc> then you can query those nameservers for whether they can lookup vault.lan (which vault will be tried as if vault itself doens't lookup)
[01:14] <whislock> systemd-resolve --status
[01:14] <sarnold> you can also use systemd-resolve(1) to query the systemd thingy
[01:14] <roasted> if I run status I see <IP_ADDRESS> for DNS server and lan for domain
[01:14] <roasted> <IP_ADDRESS> = pihole IP
[01:14] <roasted> I can pastebin the whole thing if need be. Quite long. But those 2 lines are at the very bottom.
[01:15] <whislock> Gotta be honest, you REALLY shouldn't be using a TLD like this.
[01:15] <whislock> Even 'something.lan' is better.
[01:16] <roasted> not sure I understand. I'm just trying to resolve vault internally.
[01:16] <whislock> All of your internal hosts are <hostname>.lan
[01:16] <roasted> right
[01:16] <whislock> Top-level domains are intended to be namespaces, not used as a domain themselves.
[01:17] <whislock> You really should change that to <hostname>.<something>.lan
[01:17] <roasted> are you suggesting lan is a bad choice?
[01:17] <roasted> ah
[01:17] <sarnold> a dns pal of mine says the only sane option for internal hostnames is to use a domain you control
[01:17] <whislock> That IS the best answer, yes.
[01:17] <whislock> Buy a domain, use it.
[01:18] <whislock> But for many, that's not ideal, so I hedge with .lan. There's nothing stopping ICANN, etc. from making a .lan TLD publicly available, and screwing your world up.
[01:18] <whislock> Same thing happened with .local years ago.
[01:18] <roasted> I do have a domain... I didn't think that deep into it. I just wanted to be able to hit up smb://vault
[01:19] <whislock> You'll find that DNS issues like this rapidly go away when you start doing things to standards.
[01:19] <sarnold> whislock++
[01:19] <roasted> hm
[01:20] <roasted> I apologize if I'm not following, just trying to confirm: Am I correct in understanding that best case scenario is to use an actual domain I own, though a lesser (but better than I'm doing currently) option is just to forego the use of .lan and choose something a bit more... unique?
[01:21] <whislock> The first, yes. The second, no.
[01:21] <whislock> .lan is not a TLD that exists. Many modern DNS implementations do NOT reliably handle "single label domains" such as .lan.
[01:22] <whislock> Hosts are expected to belong to a domain that exists within the namespace of a top-level domain.
[01:22] <whislock> If using an actual domain is not an option, then use a domain in a fake TLD like .lan. Do not use .lan directly.
.home.lan is an example.
[01:22] <roasted> I see
[01:23] <roasted> well, wouldn't take me more than a minute or two to try it
[01:24] <whislock> The huge caution on using fake domains is that nothing is preventing that fake TLD from becoming a REAL TLD at a later date, or being reserved by a future standard for some use.
[01:24] <roasted> understood
[01:24] <roasted> though I would assume I could somewhat help mitigate that by using something more unique at least (which is why I alluded to my earlier question)
[01:25] <whislock> Potentially, yes, but you'd still definitely want to use domain.tld, rather than just .tld.
[01:26] <roasted> such as, possibly, home.lan as a rough example?
[01:26] <whislock> The exact example I gave you previously, yes.
[01:26] <whislock> 21:22 <whislock> <host>.home.lan is an example.
[01:26] <roasted> I'm trying that now
[01:27] <roasted> systemd-resolve --status on vault and my local desktop both now say home.lan, but the same symptoms still exist. (cannot ping vault/vault.home.lan, but can ping vault.local)
[01:27] <roasted> unless there's a service I need to redo besides bouncing the NICs and sudo netplan apply on server
[01:28] <whislock> Your DNS server has to be aware of all of this.
[01:28] <roasted> I did change my dns server to reflect home.lan
[01:29] <whislock> Heh, I can't wait for the .dot TLD to go life.
[01:29] <whislock> Live, rather.
[01:30] <whislock> I'm going to try to buy dot.dot
[01:30] <sarnold> ellipsis.dot.dot
[01:31] <whislock> Watch people type it as .......
[01:33] <roasted> heh, everything updated to home.lan and works, except pesky vault
[01:34] <sarnold> you don't happen to have an /etc/hosts entry somewhere that's wrecking everything do you?
[01:34] <roasted> I didn't manually edit any hosts file
[01:35] <roasted> I can pastebin what I do have though
[01:35] <roasted> https://paste.ubuntu.com/p/kKmFJ5tnmc/
[01:35] <sarnold> <IP_ADDRESS>vault
[01:35] <sarnold> oh that's *on* vault
[01:35] <roasted> yeah
[01:35] <sarnold> check on the system that'd doing the pinging
[01:36] <roasted> https://paste.ubuntu.com/p/DbrSCHCDrt/
[01:36] <sarnold> nice and boring :)
[01:38] <roasted> yep
[01:57] <roasted> heh
[01:57] <roasted> even setting everything to .local in an effort to appease the server fails
[01:58] <roasted> that's the last time I dive in to a new server version
[02:06] <roasted> acts the same whether I have my unifi USG running dns+dhcp or the pihole running dns+dhcp, so def seems related to ubuntu 18.04 itself.
[02:06] <SlowJimmy> maybe I'm just paranoid, but every time i set up my ubuntu to be a working server with samba and owncloud and so forth, it works excellent but afte a couple of days the server always become comepletly irresponsive to openshh and owncloud and so forth, is it possible that either physicall or through the network somebody took control of my server? what ways do i have to check if that is
[02:06] <SlowJimmy> the case?
[02:07] <SlowJimmy> so irresponisive as to not even show up on the network anymore...
[02:09] <whislock> SlowJimmy: The odds of that are incredibly slim.
[02:09] <whislock> Sounds like resource exhaustion, to me.
[02:09] <whislock> How much RAM is in the system?
[02:10] <roasted> I run nextcloud in a VM and it tends to eat some RAM over time
[02:11] <roasted> plus the DB will require something more than a wussy CPU
[02:12] <roasted> I heard good things about seafile. Spun that up the other day but the client wouldn't see the server. Need to revisit that someday.
[02:12] <SlowJimmy> whislock anywhere between 2 GB and 4 GB
[02:13] <SlowJimmy> roasted I see
[02:13] <whislock> SlowJimmy: And how much swap?
[02:13] <SlowJimmy> 8GB
[02:13] <sarnold> maybe you could throw performance copilot or sar or similar on it to gather up a bunch of stats
[02:14] <whislock> I suspect, honestly, that you're hitting a low-memory state, and it starts thrashing swap.
[02:14] <SlowJimmy> sarnold perform copilot, got it
[02:14] <sarnold> what's si/so look like from vmstat 1 ?
[02:14] <SlowJimmy> whislock so just need to get more ram?
[02:14] <SlowJimmy> is there a quick way to check who is connecting to your system?
[02:15] <SlowJimmy> how can i shut off the server to the internet aside from apt get update and upgrade and dist-upgrade?
[02:15] <whislock> Do you have ports forwarded to it from the outside?
[02:15] <SlowJimmy> no
[02:15] <whislock> Then no one's connecting to the system from the outside.
[02:15] <whislock> End of story.
[02:16] <SlowJimmy> or at least i didnt forward them, i think it is possible somebody compromized the sysstem and then enabled all kinds of ish
[02:16] <madLyfe> all of these samba articles/how-tos are different. i understand there are different use cases for them.
[02:16] <SlowJimmy> whislock that is incredibly reassuring
[02:16] <SlowJimmy> you have no idea i was being paranoid, this is very good to know
[02:17] <whislock> SlowJimmy: Go look in whatever router provides internet access, see if ports have been forwarded.
[02:17] <whislock> These sorts of concerns are what I deal with for a living.
[02:18] <whislock> The odds of this being due to a compromise are within epsilon of zero.
[02:19] <SlowJimmy> whislock i am worried about people having physical access, as i live in an area with a lot of how do i put this... questionable character, the type who hold no jobs but drive cars and are well dressed...
[02:19] <sarnold> check ss output
[02:19] <SlowJimmy> thank you whislock you really made me sleep better at night
[02:19] <SlowJimmy> sarnold ty
[02:21] <SlowJimmy> whislock i am reading two books on server basics in gnu/linux and networking, but do you know a book that can help me with understanding security?
[02:23] <whislock> https://www.udacity.com/course/intro-to-information-security--ud459
[02:23] <whislock> Free course on it from Georgia Tech.
[02:23] <whislock> https://www.us-cert.gov/security-publications/introduction-information-security
[02:24] <whislock> https://www.nist.gov/publications/introduction-information-security
[02:24] <whislock> https://www.cybrary.it/course/intro-to-infosec/
[02:24] <whislock> And that should get you started on basics.
[02:25] <SlowJimmy> excellent thank you friend!
[02:25] <SlowJimmy> i may be paranoid so it is really difficult to know when i am going overboard and worrying for no reason  or attribution bias or other cognitive biases
[02:26] <SlowJimmy> it is really putting my mind at east to know that without portforwarding everything is ok
[02:26] <whislock> Security is a function of risk. Risk is a function of threats, vulnerabilities, and assets.
[02:27] <whislock> The short explanation is that in all likelihood, you are not worth the effort to any threat.
[02:27] <SlowJimmy> so if you are unlucky it may mean there is no real feasable way to be secure...
[02:27] <whislock> There's no such thing as complete or total security.
[02:27] <sarnold> .. and yet, forgetting the basics make you a risk to every threat :)
[02:27] <SlowJimmy> whislock that is assuming reasonable asesment form who every may or may not be on the other side
[02:27] <whislock> There's only an appropriate level of security based on the assets you're trying to protect, and how much you're willing to expend in terms of time, money, etc., to protect those assets.
[02:28] <SlowJimmy> ok i think with the basics you gave me i those links i will be able to sleep well at night
[02:29] <whislock> My home network is not likely to be a target for anyone. I've employed a level of protection that means that someone has to work quite hard to get in, and without the assurance of a suitable return on that investment, I'm basically not worth it.
[02:29] <whislock> My employer, of course, is a much more lucrative target, and so we spent a great deal more time and resources on protecting those assets.
[02:42] <JanC> whislock: for some types of threats, such as extortion schemes where they encrypt your data, every target is big enough (actually, too big targets might be undesirable, as they will have backups & are more likely to go after the villains)
[02:52] <whislock> JanC: Conversely, the countermeasures for those are simple. Don't run code from untrusted sources, have backups.
[04:27] <JanC> the whole point of phishing is making the target think it's a trusted source...
[04:53] <madLyfe> anyone bored and want to help me with samba?
[05:08] <cpaelzer> good morning
[05:08] <cpaelzer> madLyfe: I'm afraid your request sounds too much like "work you actually don't want" - why don't you ask right away?
[05:09] <cpaelzer> you might get no answer either, but IMHO it increases the chance to get one
[05:10] <madLyfe> just tired and head is kind of spinning
[05:10] <cpaelzer> :-/
[05:11] <madLyfe> so i set up a zfs mirror and im trying to share that mirror on the network with samba.
[05:11] <cpaelzer> sounds normal so far
[05:11] <madLyfe> at this point im just trying to get it to show up before i do any of the user stuffs
[05:11] <madLyfe> but i cant figure out what im doing wrong
[05:12] <cpaelzer> "show up" as in windows neighbor device discovery?
[05:12] <madLyfe> ya like show my share under networks
[05:13] <madLyfe> but im not even sure i have it setup correctly so i dont know if its windows or the config
[05:13] <cpaelzer> on the server doing samba: does this show anything "smbclient -L localhost"
[05:13] <cpaelzer> if you have set special user for samba use -U <username>
[05:14] <cpaelzer> you can also list from remote, but lets start one by one
[05:14] <madLyfe> Command 'smbclient' not found, but can be installed with:
[05:15] <cpaelzer> if you don't mind install it
[05:16] <madLyfe> https://paste.ubuntu.com/p/KVXKqXQfs2/
[05:17] <cpaelzer> madLyfe: is "Share" the one you set up?
[05:17] <madLyfe> ya
[05:17] <cpaelzer> ok, so the server is serving something
[05:17] <cpaelzer> if you have a remote Linux machine you can do the same with localhost replaced by the ip of the server
[05:18] <madLyfe> im on windows right now and its a dual boot
[05:19] <cpaelzer> ok
[05:19] <cpaelzer> there my experience is not high after a decade without :-)
[05:19] <cpaelzer> on a Linux system you'd check the shared (as above)
[05:19] <cpaelzer> and then maybe mount with
[05:19] <cpaelzer> mkdir -p /mnt/test; sudo mount.cifs '//<IP_ADDRESS>/Share' '/mnt/test' -o user=kinghat,vers=3.0
[05:19] <cpaelzer> or similar depending on your needs
[05:19] <cpaelzer> I wonder if maybe "just" the announcement isn't working
[05:20] <cpaelzer> and the resource would be there
[05:20] <cpaelzer> can you connect it from windows
[05:20] <cpaelzer> with like explorer->connect network share
[05:20] <cpaelzer> enter //IP/Share I think
[05:21] <madLyfe> https://paste.ubuntu.com/p/3xqKzdX97R/
[05:22] <cpaelzer> sorry - I'm not an expert in smb configs to find something obvious in there
[05:25] <madLyfe> its no biggie
[05:25] <cpaelzer> madLyfe: can you map the network drive from windows?
[05:25] <cpaelzer> ignoring the auto device scan for now
[05:25] <cpaelzer> umm
[05:25] <cpaelzer> madLyfe: browseable = yes
[05:26] <cpaelzer> well, default would be yes :-/
[05:26] <cpaelzer> I thought that might be missing
[05:27] <cpaelzer> there can be issues like this on very old Ubuntu vs very new Windows https://www.tenforums.com/network-sharing/31136-samba-shares-dont-show-up-windows-10-network.html
[05:30] <madLyfe> i have that set under my share already it just didnt show up in that report for some reason. i had it spelled 'browsable = yes' and just tried 'browseable = yes' and get the same result.
[05:35] <cpaelzer> madLyfe: it doesn't show up because it is the default
[05:38] <madLyfe> odd https://usercontent.irccloud-cdn.com/file/9zcsbflk/image.png
[05:40] <cpaelzer> madLyfe: the net surely has the experience you need on the windows side of this, but I'm out unfortunately
[05:40] <madLyfe> have a good one
[06:46] <spectre123123> Hi all,
[06:46] <spectre123123> did someone set a raid 1 with just two disks ? One of the two disks has got the operating system
[07:53] <spectre123123> Did anyone try the raid 1 on ubuntu server?
[08:17] <paulbarker> I've copied a network bridge configuration from one server to another. It's working on the source server but isn't working on the new destination server. Both are running Ubuntu 18.04.
[08:18] <paulbarker> The networkd config is here: https://pastebin.com/HwmXC1w9
[08:18] <paulbarker> On the source server running `networkctl status -a` shows br0 as `State: routable (configured)`
[08:19] <paulbarker> On the new server, same config, `networkctl status -a` shows br0 as `State: no-carrier (configuring)`
[08:19] <paulbarker> This is preventing LXD from launching, last entry in syslog is `systemd[1]: Starting Wait for Network to be Configured...`
[08:26] <paulbarker> stgraber: Is there any chance of getting https://github.com/lxc/lxd/pull/4741 backported to the LXD package in Ubuntu 18.04? I'm only trying to setup a bridge manually due to that issue
[08:40] <kiokoman> paulbarker: what about /etc/systemd/network/uplink.network ? which interface belongs to br0 ? maybe they have different name from old server to new server
[08:41] <paulbarker> No interface belongs to br0, it's for use with containers
[08:44] <paulbarker> Also, cyphermox, could we get a new release of netplan.io for Ubuntu 18.04? Looking at https://github.com/CanonicalLtd/netplan/commits/bionic, the fix I need is the most recent commit but that's after the latest release of 0.36.3
[08:48] <paulbarker> Ok, I have a workaround for now but for some reason it's different between the two servers
[08:52] <paulbarker> Both machines have the same version of the systemd package installed, but on the new server I now need to add `LinkLocalAddressing=no` to br0.network in order for the bridge to come up
[08:57] <kiokoman> check also -> ConfigureWithoutCarrier=true
[08:57] <paulbarker> That's also there. I tried both `true` and `yes` as values
[09:00] <kiokoman> anyway i have the same problem on my server 18.04 -> no-carrier (configuring)
[09:00] <paulbarker> Have restarted systemd-netwokd a couple of times and confirmed it only works with `LinkLocalAddressing=no` in the network config
[09:00] <kiokoman> same for me
[09:01] <paulbarker> Though that could lead to issues later if anything I'm running in the containers tries to use link-local addressing for some reason
[09:02] <paulbarker> What baffles me is that the same config on a server setup a couple of months ago works without disabling link-local addressing
[09:04] <mwhudson> same systemd versions on both?
[09:04] <kiokoman> LinkLocalAddressing=no -> turn off IPv6
[09:04] <mwhudson> there was a bug in this area recently (but only in cosmic i think)
[09:06] <paulbarker> systemd is version `237-3ubuntu10.3` on both
[09:14] <paulbarker> The best solution for me would be to release a new lxd package for Ubuntu 18.04 with my original bug fixed so I don't have to try creating all this by hand
[09:18] <paulbarker> Looks like the fix is in LXD 3.0.2 but Ubuntu 18.04 currently has version 3.0.1
[13:03] <sdeziel> any idea as to why the real changelog is in linux-modules-$(uname -r) and not in linux-image-$(uname -r) ?
[13:03] <sdeziel> $ ll /usr/share/doc/linux-{image,modules}-4.15.0-32-generic/changelog.Debian.gz
[13:03] <sdeziel> -rw-r--r-- 1 root root   509 Aug 10 13:35 /usr/share/doc/linux-image-4.15.0-32-generic/changelog.Debian.gz
[13:03] <sdeziel> -rw-r--r-- 1 root root 27851 Aug 10 13:22 /usr/share/doc/linux-modules-4.15.0-32-generic/changelog.Debian.gz
[13:06]  * ahasenack doesn't know
[13:17] <sdeziel> feel counter intuitive to me
[13:17] <sdeziel> and it is not the case with Xenial
[14:17] <cyphermox> sdeziel: careful, linux-image-*-generic is now built by linux-signed; so changelog would be smaller anyway
[14:19] <sdeziel> cyphermox: hmm, not sure what that implies.
[14:19] <sdeziel> $ ll /usr/share/doc/linux-*4.15.0-32*/changelog*
[14:19] <sdeziel> -rw-r--r-- 1 root root   509 Aug 10 13:35 /usr/share/doc/linux-image-4.15.0-32-generic/changelog.Debian.gz
[14:19] <sdeziel> -rw-r--r-- 1 root root 27851 Aug 10 13:22 /usr/share/doc/linux-modules-4.15.0-32-generic/changelog.Debian.gz
[14:19] <sdeziel> -rw-r--r-- 1 root root 27855 Aug 10 13:22 /usr/share/doc/linux-modules-extra-4.15.0-32-generic/changelog.Debian.gz
[14:19] <sdeziel> linux-image-unsigned-4.15.0-32-generic has no changelog which seems to be consistent with what you said
[14:20] <sdeziel> but still, I'd expect the changelog for a given kernel to be shipped with the -image package, not the -modules
[14:22] <cyphermox> like I said, linux-image-* is built by a different source pacakge than the others, that explains the small changelog -- the real changelog is available in linux-image-unsigned-* anyway
[14:22] <cyphermox> "real"
[14:22] <sdeziel> linux-image-unsigned-4.15.0-32-generic has no changelog
[14:23] <sdeziel> or I'm looking at the wrong spot somehow
[14:24] <cyphermox> certainly seems there for a different version:
[14:24] <cyphermox> -rw-r--r-- root/root     40761 2018-08-15 12:50 ./usr/share/doc/linux-image-unsigned-4.15.0-33-generic/changelog.Debian.gz
[14:25] <cyphermox> sdeziel: the shuffle of signed/unsigned is recent, best would be to ask for details in #ubuntu-kernel if there's anything
[14:25] <sdeziel> that's from -proposed I guess. Maybe they fixed a packaging issue as I don't have anything in -30 either
[14:25] <sdeziel> cyphermox: alright, thanks!
[14:26] <cyphermox> in -updates as of 25 minutes ago ;)
[14:32] <sdeziel> thanks for the info
[14:49] <mason> Anyone seeing subtle disk corruption using live migration in virt-manager and non-shared-storage/qcow2? Because I sure am.
[15:32] <madLyfe> sdeziel: do you samba share with windows at all?
[15:34] <sdeziel> madLyfe: barely, I have only 1 Windows client left @home
[15:35] <sdeziel> madLyfe: but I have another deployment with a mix of macOS and Windows clients
[15:36] <sdeziel> madLyfe: why?
[15:36] <madLyfe> so i think i got samba somewhat working last night but i cant see my samba share in win 10 'networking' but i can manually add the share by mapping network drive or adding network location. though even if i do that it still doesnt show up under the networking window.
[15:36] <madLyfe> also i cant add it by name i have to add it by ip only. and in cmd if i type 'net view' i get a 'system error 53 has occurred.  the network path was not found.'
[15:37] <madLyfe> i read probably the top 20 google articles on error 53 and it doesnt seem to be a consensus on the issue or how to fix it. none of the solutions i tried worked.
[15:38] <madLyfe> article/support threads*
[15:38] <sdeziel> madLyfe: for the name vs IP part, you can either setup DNS properly or add the host alias under %windir%/system32/etc/hosts (not sure about the path)
[15:38] <madLyfe> setup dns properly?
[15:39] <whislock> Is the Samba server in a different subnet than the client?
[15:39] <sdeziel> madLyfe: to access the server using a name, you need to have the name in the DNS
[15:40] <madLyfe> whislock: i dont think so?
[15:40] <madLyfe> sdeziel: doesnt the router handle that?
[15:41] <whislock> Depends on the router and how it's configured. That's almost never an automatic function.
[15:41] <sdeziel> madLyfe: it depends ;) On basic home setup it does, usually
[15:41] <sdeziel> madLyfe: you may want to test the simple way using the host alias as a first step
[15:41] <whislock> Careful. DNS in this case is two things. One is a forwarding resolver, which all home routers handle. The second, and what we're talking about here, is actually being an authoritative nameserver for its own zone.
[15:42] <whislock> Most home routers do not do this automatically, and some, not at all.
[15:48] <madLyfe> well if i have to add stuffs to host just to see the hostname for lookup, rather than ip, i dont really care. i just wanted to make sure my system was functioning properly.
[15:50] <whislock> Samba can be sensitive to HOW you request the system. The name vs. IP question can affect functionality.
[15:51] <madLyfe> this is what the asuswrt firmware dev and another guy said about it: https://paste.ubuntu.com/p/R8VvT5KD5F/
[15:51] <madLyfe> thought getting the name is better because IP can change(even though i have it set to static)
[15:54] <madLyfe> here is 'net view \\hostip' results: https://paste.ubuntu.com/p/rmqTBcBKgc/
[15:55] <whislock> I'm going to be incredibly blunt here, so fair warning: You should be using DNS for pretty much any service.
[15:55] <whislock> It's a trivial thing to set up, as long as you're setting it up properly. Using IP addresses for services, even in a home scenario, is just bad planning.
[15:56] <madLyfe> im all ears lel
[15:57] <whislock> I was originally going to be much more harsh, but there it is.
[16:00] <sdeziel> whislock: do you recommend home users to purchase an official domain name?
[16:02] <whislock> Generally, yes. $10 a year isn't a big hurdle.
[16:03] <sdeziel> true
[16:03] <sdeziel> I can't quickly find the official alternative (like .homenet or something)
[16:03] <whislock> There isn't one.
[16:04] <whislock> For several reasons.
[16:04] <whislock> The first being that using a TLD as a domain will cause problems with many implementations. Things don't handle 'single label domains' gracefully.
[16:04] <whislock> If you're going to use a fake TLD, select a second-level domain to use with it. '.home.lan' instead of just '.lan', for example.
[16:05] <whislock> Ideally, though, you'll purchase a domain name and use that both internally and externally.
[16:08] <sdeziel> https://social.technet.microsoft.com/wiki/contents/articles/34981.active-directory-best-practices-for-internal-domain-and-network-names.aspx has good info
[16:08] <blackflow> $10/yr my donkey. The domain cartel is running a racket
[16:09] <blackflow> going cheapo-o are only tlds nobody really wants or are frequently blanket flagged for spam
[16:10] <whislock> Like .com?
[16:10] <whislock> $10.98/year?
[16:10] <whislock> or .net? Same price?
[16:10] <blackflow> + a few bucks for (a must have) whois privacy.
[16:10] <blackflow> though, with GDPR at least here in EU we've gotten that for free now.
[16:10] <whislock> It's +$0.00 for me.
[16:10] <whislock> So, with ICANN fees, it might hit $12/year.
[16:11] <whislock> $11.something.
[16:11] <blackflow> .com is 16€ at gandi.net where I'm purchasing
[16:11] <whislock> Gandi's one of the most expensive registrars on the internet.
[16:12] <whislock> Generally around 50% more expensive than anyone else.
[16:12] <blackflow> but that's the price I'm willing to pay for quality service, after changing seveal registrars for being criminally atrocious.
[16:12] <whislock> That's your choice/opinion, but that doesn't affect the accuracy of my previous statement.
[16:13] <blackflow> I was merely reflecting on the gTLD racket. meanwhile .xyz were really cheap-o, I got some for $.88 first year
[16:13] <blackflow> but you don't want those for public sites, especially not mail. so I guess they're good for home networks.
[16:14] <blackflow> (in that I generally agree purchasing a domain is better than "hijacking" a tld for local use)
[16:14] <whislock> Spam filtering is starting to move to an IP reputation model rather than blacklisting TLDs.
[16:14] <blackflow> it's both, there are various blacklists, IP based, domain based, URL based, ...
[16:15] <blackflow> IP reputation in the age of floating IP cloud services is not good.
[16:15] <whislock> URL based for spam filtering, where emails don't have URLs. Riiight.
[16:15] <whislock> Again: Spam filtering is starting to move to an IP reputation model rather than blacklisting TLDs.
[16:16] <whislock> Anyway, lunchtime.
[16:16] <blackflow> I guess you never ran a spam filter.
[16:16] <blackflow> URIBLs are for mail content obviously.
[16:17] <whislock> Only for the US DOD. You know, small stuff.
[16:17] <madLyfe> the router channel is saying that i should set the server up as DHCP with reservations.
[16:18] <blackflow> I've been running commercial MTAs for 10 years now. we have large URIBLs that we build on our own with spamtraps. there's also Spamhaus if you're willing to trust their a bit... fanatical... commitment.
[16:19] <whislock> The "small stuff" part was sarcastic as hell. My response was to highlight the folly of assuming people lack knowledge or experience simply because they disagree with you.
[16:19] <sdeziel> madLyfe: that is unneeded if you already put a static IP on the server
[16:19] <whislock> Basically, check your ego.
[16:19] <blackflow> whislock: well you didn't know what URIBLs were, so I guessed you never ran one.
[16:19] <blackflow> whislock: yeah, _I_ have to check _my_ ego.   "I was originally going to be much more harsh, but there it is."  -- told to someone who used IP instead of a domain... lol.
[16:22] <madLyfe> sdeziel/whislock is this correct? https://paste.ubuntu.com/p/mz7qYsjF7H/
[16:23] <sdeziel> madLyfe: they are probably right, I suspect the DHCP daemon is also the DNS resolver (dnsmasq probably)
[16:26] <sdeziel> madLyfe: this means a client asking for an IP will also "register" it's hostname to the DNS portion of it. This should let you reach the host in question by referring to it as its shortname
[16:26] <sdeziel> madLyfe: I'm not 100% sure on the above as it's been a while since I used such setup
[16:26] <madLyfe> https://paste.ubuntu.com/p/K7ww9pswkn/
[16:28] <sdeziel> madLyfe: OK, that seems to confirm what I said
[16:28] <sdeziel> madLyfe: you should trust them more than me if they are in the channel of your router's manufacturer ;)
[16:29] <madLyfe> well i was just hoping there was a standard best practice of going about it
[16:31] <sdeziel> madLyfe: dnsmasq is pretty common on home/SOHO routers so what they said makes sense generally
[16:40] <JanC> great article: http://danluu.com/anon-benchmark/
[17:36] <madLyfe> is this the best way to change the hostname that persists? 'hostnamectl set-hostname'
[17:36] <madLyfe> hostnamectl set-hostname 'new-hostname'
[17:51] <madLyfe> hmm that didnt make it past a reboot
[17:59] <madLyfe> so i renamed the hostname in hostname file, but the hosts file doesnt like the example given here: https://websiteforstudents.com/how-to-change-rename-ubuntu-16-04-lts-server-name/
[18:06] <sarnold> what error message do you get, and from what tool?
[18:06] <nacc> right, the 'hosts' file is just a file, it can't like or dislike anything.
[18:08] <madLyfe> have to edit the cloud.cfg as well
[18:09] <madLyfe> https://linuxconfig.org/how-to-change-hostname-on-ubuntu-18-04-bionic-beaver-linux
[18:09] <madLyfe> it talks about the hosts file too at the end but my hosts file second line doesnt look like theirs. also, i did a reboot and my hostname change seems to have stuck.
[18:10] <nacc> madLyfe: do you understand what the hosts file is for?
[18:10] <nacc> madLyfe: it's not really directly related to your actual  hostname
[18:10] <nacc> beyond convention, afaik
[18:11] <nacc> madLyfe: what does your hosts file look like? it *always* is better to give actual contents, than to describe them (as you are describing them very vaguely)
[18:11] <madLyfe> this is what the second line of mine looks like: https://usercontent.irccloud-cdn.com/file/92YDVYE8/image.png
[18:12] <madLyfe> sorry i should have put that in a paste
[18:12] <nacc> you are using ipv6?
[18:12] <nacc> i don't think that's the default 18.04 contents, but i'm not sure
[18:13] <madLyfe> not that i know of. i just used the defaults for everything.
[18:25] <coreycb> tobias-urdin: jamespage: i uploaded a new heat-dashboard package (1.3.0-0ubuntu4) and a new horizon package (14.0.0~rc1-0ubuntu2) which mostly fix up horizon. I'm getting a "Error: Unable to retrieve limits information." message once logged in which i think is related to needing quota_details extension enabled.
[18:26] <madLyfe> nacc: is this bad?
[19:16] <tobias-urdin> coreycb: cool, i'll check tomorrow if the CI has improved
[20:11] <ahasenack> kstenerud: did you see my ping in https://bugs.launchpad.net/ubuntu/+source/strongswan/+bug/1786250
[20:11] <ahasenack> ?
[20:26] <nacc> madLyfe: is which bad?
[20:29] <madLyfe> the ipv6 stuffs? should it not be that way? I don't think I'm using ipv6
[20:33] <nacc> madLyfe: it doesn't necessarily hurt
[20:49] <kstenerud> ahasenack: is there a way to get alerts for these?
[20:53] <ahasenack> kstenerud: yes, just subscribe to the bug, or to the package
[20:53] <ahasenack> all done in that same view, look at the right hand side of the page
[21:45] <nacc> kstenerud: you can also subscribe to entire srcpkgs, e.g. -- may become useful
[21:52] <kstenerud> hmm
[21:53] <kstenerud> ahasenack: I think the bind9 problem is a lot depeer than first thought. The fix didn't work (or at least not with the crash I'm seeing). I've tracked the issue down to pk11.c line 370.
[21:54] <kstenerud> something's causing the init to fail, and so it aborts
[21:55] <kstenerud> Oh, there's a bunch of failed config loads reported in syslog. OK so it's not configured properly?
[22:32] <caliculk> Hey everyone, I was looking to see if anyone had any information on if zfsacl module is being withheld in the samba package, as according to the samba docs, it should be included in 4.7.6 but it doesn't appear to be the case when trying to use it as a vfs option.
[22:34] <caliculk> For reference, I am referring to this: https://ubuntuforums.org/showthread.php?t=2399285
[23:25] <Boyette> hi
[23:30] <Boyette> im stupid
[23:30] <Boyette> and have a problem with my vps
[23:30] <Boyette> who can help me
[23:34] <sarnold> if you were smart you'd tell the problem you've got, too :)
[23:35] <Boyette> yes thats why im stupid
[23:35] <Boyette> i try to configure a vpn on my vps
[23:36] <Boyette> but it looks like there is no networkconfiguration at all to attach to however at the same time there is