| 00:00.23 | *** join/#debian waxfire (~waxfire@152.89.209.134) |
| 00:05.17 | *** join/#debian yuta (~pi@PPPa4048.e13.eacc.dti.ne.jp) |
| 00:07.05 | *** join/#debian cybercrypto (~morpheus@gateway/tor-sasl/cybercrypto) |
| 00:07.35 | *** join/#debian diniwed (~gavron@185.253.99.110) |
| 00:09.41 | *** join/#debian ml| (~ml|@unaffiliated/ml/x-3958674) |
| 00:15.50 | *** join/#debian CaCO3 (~CaCO3@pool-72-92-29-254.phlapa.fios.verizon.net) |
| 00:21.13 | *** join/#debian Antioch (~Antioch@h175-177-044-119.catv02.itscom.jp) |
| 00:21.42 | *** join/#debian Hallodri (~Vizva@gateway/tor-sasl/vizva) |
| 00:24.43 | *** join/#debian Anessen97_0 (~Anessen97@host-212-171-249-49.retail.telecomitalia.it) |
| 00:27.02 | *** join/#debian gimmel (~gavin@203.87.115.233) |
| 00:28.00 | *** part/#debian ddsys (~ddsys@unaffiliated/ddsys) |
| 00:29.40 | *** join/#debian oiaohm (~oiaohm@unaffiliated/oiaohm) |
| 00:31.35 | *** join/#debian teksimian (~teksimian@172-97-191-143.cpe.distributel.net) |
| 00:33.10 | *** join/#debian absinthe (~absinthe@unaffiliated/absinthe) |
| 00:33.26 | *** join/#debian fling (~fling@fsf/member/fling) |
| 00:44.28 | *** join/#debian maroloccio (~marolocci@2a02:8084:601d:7f80:164f:8aff:fed8:411d) |
| 00:54.52 | *** join/#debian cdown_ (~cdown@89.32.122.5) |
| 01:00.27 | *** join/#debian paulgrmn (~paulgrmn@c-98-250-183-21.hsd1.mi.comcast.net) |
| 01:02.09 | *** join/#debian binaryhermit (sid462772@gateway/web/irccloud.com/x-wokbfzehoswrnkjq) |
| 01:02.15 | *** part/#debian binaryhermit (sid462772@gateway/web/irccloud.com/x-wokbfzehoswrnkjq) |
| 01:02.30 | *** join/#debian gtweryh (~amlchief@gateway/tor-sasl/amlchief) |
| 01:04.27 | *** join/#debian alexandros_c (~alexandro@unaffiliated/alexandros-c/x-1684531) |
| 01:08.36 | *** join/#debian gelignite_ (~gelignite@55d46ac3.access.ecotel.net) |
| 01:11.36 | *** join/#debian Adbray (~Adbray@2600:6c48:6f7f:d764:2f38:a693:d2a4:baf1) |
| 01:19.36 | *** join/#debian adapter (~adapter@2601:600:c500:2d0:a824:b319:8de:f286) |
| 01:20.11 | *** join/#debian sidmo_ (~ident@p5b3d8c36.dip0.t-ipconnect.de) |
| 01:26.10 | *** join/#debian freebench (~freebench@92.253.250.80) |
| 01:27.54 | *** join/#debian fmaurer_ (~quassel@188.126.188.51) |
| 01:42.25 | *** join/#debian dionysus69 (~Thunderbi@unaffiliated/dionysus69) |
| 01:42.32 | *** join/#debian deicide- (~deicide-@unaffiliated/deicide-) |
| 01:42.33 | *** join/#debian deicide-- (~deicide-@unaffiliated/deicide-) |
| 01:45.49 | *** join/#debian deicide- (~deicide-@unaffiliated/deicide-) |
| 01:54.34 | *** join/#debian Deihmos (uid212731@gateway/web/irccloud.com/x-mnkwmfrgowimpnex) |
| 01:54.56 | *** join/#debian trysten_ (~user@unaffiliated/trysten) |
| 01:59.01 | *** mode/#debian [+l 1108] by debhelper |
| 02:02.07 | *** join/#debian siraygu (~yaris@pool-108-14-244-187.nycmny.fios.verizon.net) |
| 02:02.09 | *** join/#debian sveva65 (~sverre@unaffiliated/sveva65) |
| 02:05.01 | *** join/#debian Ede|Popede (~EdePopede@37.49.24.159) |
| 02:05.16 | *** join/#debian siraygu (~yaris@pool-108-14-244-187.nycmny.fios.verizon.net) |
| 02:07.08 | *** join/#debian spigot (michael@unaffiliated/spigot) |
| 02:13.22 | *** join/#debian stx_ (~stx@freenode/staff/stx) |
| 02:13.33 | *** join/#debian citypw (~citypw@gateway/tor-sasl/citypw) |
| 02:14.53 | *** join/#debian jmcnaught (~jeremy@shelley.deptadapt.org) |
| 02:17.41 | *** join/#debian bolt (~r00t@unaffiliated/bolt) |
| 02:18.13 | *** join/#debian pingfloyd (~pingfloyd@unaffiliated/pingfloyd) |
| 02:18.19 | *** join/#debian Sellerie (~sellerie_@66.tf) |
| 02:18.33 | *** join/#debian goddard (goddard@gateway/vpn/privateinternetaccess/goddard) |
| 02:22.41 | efloid | no audio via displayport |
| 02:24.11 | nvz | well, its not called an audioport now is it :P |
| 02:25.04 | efloid | killall pulseaudio; rm -rf .config/pulse/* i upgraded the machine. pulse must be caching the old devices |
| 02:26.17 | efloid | shouldn't there be sound through it? i thought there was on the previous system? the monitor has built-in speakers |
| 02:28.41 | efloid | maybe it was playing through the pc speaker and i just *thought* it was playing through the monitor lol |
| 02:29.08 | *** part/#debian aquafunk (michael@unaffiliated/spigot) |
| 02:30.38 | alex11 | where is Trash in the filesystem? |
| 02:31.09 | *** join/#debian David^^ (~none@pdpc/supporter/active/david--/x-2357539) |
| 02:31.55 | sponix2ipfw | alex11: .Trash |
| 02:31.58 | *** join/#debian mohabaks (~mohabaks@gateway/tor-sasl/mohabaks) |
| 02:32.16 | jmcnaught | or ~/.local/share/Trash |
| 02:34.34 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 02:37.13 | *** join/#debian hjarvard (~hjarvard@2a0a:340:cdef:9401:12c3:7bff:fe6d:d149) |
| 02:37.52 | *** join/#debian lazywalker (~lazywalke@unaffiliated/lazywalker) |
| 02:40.12 | *** join/#debian David-- (~none@pdpc/supporter/active/david--/x-2357539) |
| 02:42.16 | *** join/#debian leorat (~leorat@unaffiliated/leorat) |
| 02:42.17 | chandoo | sney, thanks for the comments, I managed to do it other way |
| 02:42.28 | efloid | connected the audio out jack from the pc to the audio input on the monitor. sound control shows line out active but no audio. |
| 02:42.48 | *** join/#debian yuta (~pi@PPPa4048.e13.eacc.dti.ne.jp) |
| 02:44.15 | efloid | pactl list short cards shows the device but aplay /usr/share/sounds/alsa/Front_Center.wav no output |
| 02:44.48 | efloid | all levels are up in alsamixer |
| 02:45.50 | *** join/#debian magic_ninja (~sparkie1@unaffiliated/magic-ninja/x-4708782) |
| 02:48.06 | *** join/#debian Newami (~Newami@ip70-179-45-125.sd.sd.cox.net) |
| 02:48.36 | *** join/#debian AliasNumber10 (~crix@cpe-76-167-192-248.san.res.rr.com) |
| 02:49.16 | *** join/#debian anoncon (~Falsememo@pool-96-238-12-231.prvdri.fios.verizon.net) |
| 02:51.49 | *** join/#debian jordanm (~jordanm@pdpc/supporter/active/jordanm) |
| 02:52.40 | efloid | rebooting |
| 02:53.17 | *** join/#debian ledeni (~ledeni@fedora/ledeni) |
| 02:54.55 | *** join/#debian nickname123 (~nickname1@adsl-84-227-65-72.adslplus.ch) |
| 02:55.24 | *** join/#debian frostschutz (~frostschu@55d41cb4.access.ecotel.net) |
| 02:58.33 | *** join/#debian Cabanossi (~Cabanossi@ppp-88-217-94-147.dynamic.mnet-online.de) |
| 02:58.41 | *** join/#debian pingfloyd (~pingfloyd@unaffiliated/pingfloyd) |
| 03:01.41 | *** join/#debian nine_ (~nine_@2403:6200:8837:9fe0:e94f:f91:39a2:ace1) |
| 03:01.54 | nine_ | hi |
| 03:02.03 | *** join/#debian black (~black@161.184.130.38) |
| 03:02.34 | alex11 | hi nine_ |
| 03:05.46 | *** join/#debian anoncon (~Falsememo@pool-96-238-12-231.prvdri.fios.verizon.net) |
| 03:08.33 | *** join/#debian kreyren__ (~kreyren@fsf/member/kreyren) |
| 03:10.26 | *** join/#debian jordanm (~jordanm@pdpc/supporter/active/jordanm) |
| 03:20.35 | *** join/#debian efloid (~efloid@173-228-31-194.dsl.static.fusionbroadband.com) |
| 03:21.41 | efloid | so the DisplayPort sound issue may be related to DisplayPort version issue between monitor and computer. am going to check BIOS settings later - there's sometimes a DisplayPort version option that can be set |
| 03:22.33 | efloid | also, what i though was an input audio jack on the monitor was a headphone jack :-/ strange that there would be one instead of an input |
| 03:24.24 | *** join/#debian Hallcyon (~Hallcyon@89nnjg0xckz9ggn6r5xm.ip6.superloop.com) |
| 03:28.39 | *** join/#debian nickodd (~nickodd@unaffiliated/nickodd) |
| 03:39.06 | *** join/#debian kassle (~kassle@ip-103-28-22-201.as137341.net) |
| 03:39.09 | *** join/#debian hackers (~foobar@239.72.66.34.bc.googleusercontent.com) |
| 03:47.51 | *** join/#debian nyov (~nyov@unaffiliated/nyov) |
| 03:50.12 | *** join/#debian akp55 (~akp55@c-73-148-15-31.hsd1.va.comcast.net) |
| 03:51.49 | hackers | does anyone has a customizable solution to clone debian installations (packages and their standard configs)? |
| 03:52.12 | *** join/#debian nine_ (~nine_@2403:6200:8837:9fe0:e94f:f91:39a2:ace1) |
| 03:52.41 | alex11 | !aptitude clone |
| 03:52.41 | dpkg | To clone a Debian machine using aptitude (or install your favourite packages) use aptitude search --disable-columns -F%p '~i!~M!~v' > package_list; on the reference machine; xargs aptitude --schedule-only install < package_list; aptitude install; on the other machine. This preserves information about "automatically installed" packages that other methods do not. See also <reinstall>, <things to backup>, <debian clone>, <apt-clone>. |
| 03:52.55 | hackers | i'm reading about dpkg --get-selections, aptitude, apt-clone, etckeeper, dselect but am un certain which solution(s) I want to use |
| 03:53.16 | hackers | thanks alex11 I'll start there |
| 03:53.27 | alex11 | yeah maybe dpkg --get-selections is easier |
| 03:53.32 | alex11 | it's not something i've looked into super hard |
| 03:54.29 | hackers | there's also the question of preserving at lest some configurations I want to address |
| 03:55.14 | hackers | I remember dpkg can detect standard pkg config files that have been modified during installation of upgrades (packages shipping new configs) |
| 03:56.09 | hackers | do you know how I can run this process manually against the output of, dpkg --get-selections or the aptitude command you suggested I use to freeze installed package list in order to identify configs that were modified after installation? |
| 03:56.41 | *** part/#debian nickodd (~nickodd@unaffiliated/nickodd) |
| 03:58.25 | efloid | hackers: you can also use clonezilla to make an exact image. it's an excellent tool. |
| 03:59.51 | *** join/#debian valerius (~valerius@osfree.org) |
| 04:01.07 | hackers | efloid: that would probably cause me issues, i'm wanting to clone a vm i use as a workstation that's a compute engine instance with its own custom settings |
| 04:01.34 | hackers | i would use the solution i'm trying to build as a startup script for such instance |
| 04:01.47 | efloid | hackers: why not use ansible? |
| 04:02.11 | hackers | for simplicity's sake |
| 04:05.07 | efloid | there are a lot of pre-made ansible recipies that you can customize |
| 04:05.33 | efloid | *cookbooks or whatver they're called |
| 04:05.48 | *** join/#debian diogenes_ (~diogenes_@188.208.122.111) |
| 04:07.16 | *** join/#debian nine_ (~nine_@2403:6200:8837:9fe0:e94f:f91:39a2:ace1) |
| 04:07.48 | hackers | efloid: I'll have something functional in a few minutes and will show you |
| 04:07.58 | *** part/#debian kassle (~kassle@ip-103-28-22-201.as137341.net) |
| 04:12.26 | *** join/#debian Jade_NL (~JadeNL@unaffiliated/jade-nl/x-0507005) |
| 04:12.45 | *** join/#debian edlou (uid413273@gateway/web/irccloud.com/x-kxuvdlljydvbvftw) |
| 04:12.55 | *** join/#debian iamchroot (~iamchroot@unaffiliated/iamchroot) |
| 04:13.52 | efloid | hackers: thanks would be nice to see your solution |
| 04:16.17 | *** join/#debian b500 (~b500@49.48.196.200) |
| 04:17.37 | *** join/#debian dez (uid92154@fedora/deSouza) |
| 04:20.32 | *** join/#debian SoulsForBelial (~SoulsForB@p200300f12f389a00821f02fffeaf6272.dip0.t-ipconnect.de) |
| 04:21.13 | *** join/#debian nevivurn (~nevivurn@unaffiliated/nevivurn) |
| 04:30.51 | *** join/#debian d3sync|2 (~d3sync@unaffiliated/d3sync) |
| 04:32.15 | *** join/#debian pasiz (~pasiz@unaffiliated/pasiz) |
| 04:34.33 | *** join/#debian Praematura_ (~quassel@2603:3006:1498:8000:58d5:d3cf:93e6:4eac) |
| 04:36.56 | hyiltiz | Is there any way to tell apt/dpkg to always accept package distributor's config file http://ix.io/2yaS for a specific package? (E.g. I'd rather keep my sshd configs, but I'd rather get upstream apparmor configs. |
| 04:37.53 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 04:47.34 | *** join/#debian teksimian (~teksimian@172-97-191-143.cpe.distributel.net) |
| 04:51.48 | *** join/#debian Grldfrdom (uid391113@gateway/web/irccloud.com/x-aoqdhjyjpvdoypao) |
| 04:53.28 | *** join/#debian efloid (~efloid@173-228-31-194.dsl.static.fusionbroadband.com) |
| 04:55.33 | *** join/#debian Guest32867 (~berkly@121.163.106.193) |
| 05:07.38 | *** join/#debian fightthe1alrus (~Queetom@133.106.81.218) |
| 05:09.10 | *** join/#debian OERIAS (~OERIAS@209.58.128.51) |
| 05:10.19 | *** join/#debian szorfein (~daggoth@gateway/tor-sasl/szorfein) |
| 05:11.09 | *** join/#debian ob-sed (~obesd@unaffiliated/obesd) |
| 05:11.28 | *** join/#debian Guest65590 (~berkly@121.163.106.193) |
| 05:13.26 | *** join/#debian Lord_of_Life_ (~Lord@unaffiliated/lord-of-life/x-0885362) |
| 05:14.56 | themill | hyiltiz: are you editing the apparmor config files? |
| 05:15.08 | hyiltiz | no |
| 05:15.11 | hyiltiz | i just wanna say Y |
| 05:15.25 | hyiltiz | but I wanna config apt so it just assumes Y for apparmor (but not other packages) |
| 05:17.29 | themill | if you've not changed the conffiles, you don't get the message so there is no prompt to hit Y at |
| 05:17.45 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 05:18.19 | *** join/#debian Kyros (~kyros@199.36.223.130) |
| 05:19.41 | themill | !confold |
| 05:19.42 | dpkg | [confold] dpkg --force-confold will force dpkg to ignore any new versions of <conffiles> in packages, e.g. «apt-get -o DPkg::Options::="--force-confold" upgrade». Note that by ignoring changes to conffiles, you may miss out important changes and packages may be left in a non-working state afterwards. |
| 05:25.01 | *** join/#debian nickodd (~nickodd@unaffiliated/nickodd) |
| 05:25.27 | *** join/#debian kein31 (~root@79.105.228.64) |
| 05:27.22 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 05:28.10 | *** join/#debian hoarycripple (~hoarycrip@pool-96-230-191-140.bstnma.fios.verizon.net) |
| 05:29.01 | *** mode/#debian [+l 1114] by debhelper |
| 05:35.38 | *** join/#debian SoulsForBelial (~SoulsForB@p200300f12f389a00821f02fffeaf6272.dip0.t-ipconnect.de) |
| 05:36.55 | *** join/#debian zyley (~zyley@unaffiliated/zyley) |
| 05:43.03 | *** join/#debian n4dir (~n4dir@i5E866619.versanet.de) |
| 05:43.53 | *** join/#debian dominic34 (~Thunderbi@98.35.249.7) |
| 05:49.58 | *** join/#debian fightthewalrus (~Queetom@210.232.14.176) |
| 05:51.43 | *** join/#debian hexnewbie (~hexnewbie@unaffiliated/hexnewbie) |
| 05:53.25 | hyiltiz | I am pretty sure i havent changed those conf files |
| 05:53.50 | hyiltiz | i am using firejail that installs conf files there but none are manual edits |
| 05:54.10 | *** join/#debian SoulsForBelial (~SoulsForB@p200300f12f4c1c00821f02fffeaf6272.dip0.t-ipconnect.de) |
| 05:54.26 | *** join/#debian CyberManifest (~CyberMani@50-25-206-180.amrlcmtk05.res.dyn.suddenlink.net) |
| 06:08.13 | *** join/#debian leorat (~leorat@unaffiliated/leorat) |
| 06:13.42 | *** join/#debian tsal (~tsal@i59F5F293.versanet.de) |
| 06:15.06 | *** join/#debian mirrorbird (~psutcliff@2a00:801:44a:a00b:20c3:c64:eb15:73a2) |
| 06:16.53 | *** join/#debian fightthe1alrus (~Queetom@133.106.81.218) |
| 06:22.55 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 06:23.20 | *** join/#debian Ycarus (~Ycarus@2001:bc8:47b0:1b0b::1) |
| 06:24.59 | *** join/#debian johnjay (~pi@38.120.10.99) |
| 06:25.04 | *** part/#debian tripkin (~tripkin@S01064062310a0ba3.cg.shawcable.net) |
| 06:34.22 | *** join/#debian esm2 (~ellie@esm.me.uk) |
| 06:35.42 | esm2 | I'm switching from GNU screen to tmux and I'm wondering if there's a command in tmux to alternate between the last window (like screen's ^A^A) ? |
| 06:38.21 | n4dir | esm2: looks like you asking for something like the cheatsheet https://tmuxcheatsheet.com/ |
| 06:38.41 | n4dir | though i use screen most basic and haven't got the exact terms handy |
| 06:38.57 | esm2 | I looked at the man pages and cheat sheet. I don't see anything there. |
| 06:40.19 | esm2 | tmux lets you use ^B-n and ^B-p for previous and next, but a see nothing for toggling to the last window |
| 06:41.15 | n4dir | ah, then i did understand correct and that was not what you are looking for. tmux probably has an irc channel. Though many in #linux seem to use it too (as it is *so* much better than screen). Anyway: good luck then |
| 06:42.15 | ansimita | esm2: ^B-l ? |
| 06:42.32 | n4dir | ctrl+b+p; ctrl+n+n was what i had in mind though, looking at that cheat |
| 06:43.01 | esm2 | Ah, ^B-l looks like the command |
| 06:43.43 | esm2 | Oh, it's in the man page too! I was confused by the terminology 'previous window' |
| 06:43.47 | ansimita | esm2: next time u check bindings with ^B-? :) |
| 06:46.09 | esm2 | OK, will do. I'm just new to it and needed a quick answer :) |
| 06:50.35 | *** join/#debian Deknos (~deknos@unaffiliated/menace) |
| 06:53.10 | *** join/#debian rsx (~rsx@ppp-188-174-138-167.dynamic.mnet-online.de) |
| 07:03.40 | alex11 | can confirm, that cheat sheet is better than crying over how complicated the man page is |
| 07:05.35 | alex11 | though checking man pages is never a bad idea |
| 07:05.49 | alex11 | but for something like tmux... yeah, start with a cheat sheet |
| 07:05.52 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 07:18.51 | *** join/#debian srtayade (~sushant@2401:4900:36c4:4f9:beef:472a:e9ff:cc3b) |
| 07:20.47 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 07:27.58 | *** join/#debian k-man (~jason@unaffiliated/k-man) |
| 07:30.54 | *** join/#debian format_c (~format_c@unaffiliated/format-c/x-8927423) |
| 07:33.17 | *** join/#debian gelignite (~gelignite@55d46ac3.access.ecotel.net) |
| 07:38.34 | *** join/#debian fflori (~fflori@194.230.155.193) |
| 07:51.52 | *** join/#debian Vizva (~Vizva@gateway/tor-sasl/vizva) |
| 07:52.52 | genr8_ | Anyone have any experience with enabling the kernel option SMB Direct support (Experimental) = CIFS_SMB_DIRECT: Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1 |
| 07:59.30 | *** join/#debian yuta (~pi@PPPa4048.e13.eacc.dti.ne.jp) |
| 08:06.53 | *** join/#debian wyre (wyre@gateway/shell/xshellz/x-tsqezbsokjauwgvf) |
| 08:09.01 | *** mode/#debian [+l 1108] by debhelper |
| 08:10.36 | *** join/#debian kats99 (~kats@gateway/tor-sasl/kats99) |
| 08:11.11 | *** join/#debian tagomago (~tagomago@static-9-198-224-77.ipcom.comunitel.net) |
| 08:12.09 | *** join/#debian dastier (~dastier@93.85.160.16) |
| 08:13.47 | *** join/#debian dionysus69 (~Thunderbi@unaffiliated/dionysus69) |
| 08:16.02 | *** join/#debian AquaL1te (~AquaL1te@unaffiliated/aqual1te) |
| 08:17.24 | *** join/#debian diogenes_ (~diogenes_@188.208.120.187) |
| 08:17.42 | *** join/#debian m0u_ (~m0u@unaffiliated/m0u) |
| 08:21.24 | *** join/#debian efloid (~efloid@173-228-31-194.dsl.static.fusionbroadband.com) |
| 08:23.06 | *** join/#debian Nokaji (~Nokaji@unaffiliated/nokaji) |
| 08:26.20 | *** join/#debian fupsi42 (~fupsi42@i5882B237.versanet.de) |
| 08:28.00 | *** join/#debian tomg_ (~tomg@98-159-244-37.agas1a-dynamic.dsl.sentex.ca) |
| 08:28.33 | *** join/#debian aps_ (~aps@2a02:908:df56:f8c0::9d29) |
| 08:29.01 | *** mode/#debian [+l 1115] by debhelper |
| 08:30.41 | *** join/#debian deltanedas (~deltaneda@5.134.95.67) |
| 08:31.45 | *** join/#debian unluckyshrubbery (~unluckysh@unaffiliated/unluckyshrubbery) |
| 08:36.32 | *** join/#debian flayer (~a_flayer@2001:1c01:40ce:b400:3b84:7e85:2259:6c01) |
| 08:36.55 | *** join/#debian d3sync (~d3sync@unaffiliated/d3sync) |
| 08:38.11 | *** join/#debian Colti (Miramar-FL@2a00:c1e0:0:2:0:1:208:ab5e) |
| 08:41.16 | *** join/#debian johnjay (~pi@38.120.10.99) |
| 08:42.28 | *** join/#debian mibo (~mibo@ip-89-103-252-21.net.upcbroadband.cz) |
| 08:45.47 | *** join/#debian coot (~coot@37.30.55.202.nat.umts.dynamic.t-mobile.pl) |
| 08:47.56 | *** join/#debian johnjay (~pi@38.120.10.99) |
| 08:50.32 | *** join/#debian coot (~coot@37.30.55.202.nat.umts.dynamic.t-mobile.pl) |
| 08:53.10 | *** join/#debian NetTerminalGene (~Thunderbi@unaffiliated/dontknow) |
| 08:54.27 | *** join/#debian x000 (~x000@unaffiliated/x000) |
| 09:01.58 | *** join/#debian zamnedix (~zamnedix@zamnedix.net) |
| 09:08.20 | *** join/#debian datasmurf (~datasmurf@unaffiliated/datasmurf) |
| 09:10.09 | *** join/#debian uvolmer (~uvolmer@2001-4dd0-212c-fd-c06f-48c1-8-e719.ipv6dyn.netcologne.de) |
| 09:11.07 | *** join/#debian tmroland (~tmroland@host-78-148-106-159.as13285.net) |
| 09:17.36 | *** join/#debian netcrash (~charmande@97.245.60.94.rev.vodafone.pt) |
| 09:18.35 | *** join/#debian Jerrynicki (~niklas@p200300f5772a07002c15da8d0c9ed017.dip0.t-ipconnect.de) |
| 09:19.14 | *** join/#debian czesmir (~stefan@ena88.neoplus.adsl.tpnet.pl) |
| 09:20.06 | *** join/#debian monksam (~monksam@gateway/tor-sasl/monksam) |
| 09:21.13 | *** join/#debian asy (~asymptoti@gateway/tor-sasl/asymptotically) |
| 09:25.49 | *** join/#debian bytehackr (~sandipan@43.252.250.71) |
| 09:25.53 | bytehackr | hi |
| 09:27.36 | *** join/#debian Haudegen (~quassel@178.115.237.87.static.drei.at) |
| 09:29.01 | *** mode/#debian [+l 1125] by debhelper |
| 09:29.10 | *** join/#debian user3 (~idlenode@gateway/tor-sasl/idlenode) |
| 09:33.27 | *** join/#debian Aurora_v_kosmose (~Aurora_iz@gateway/tor-sasl/randomnumbers/x-93746987) |
| 09:42.51 | *** join/#debian Narcotion (~shane@095-096-180-047.static.chello.nl) |
| 09:43.22 | *** join/#debian pvdp66556 (~pvdp@180-150-101-81.b49665.bne.static.aussiebb.net) |
| 09:49.01 | *** mode/#debian [+l 1119] by debhelper |
| 09:52.24 | *** join/#debian banox (~banox@37.120.149.92) |
| 09:52.49 | *** join/#debian OERIAS (~OERIAS@209.58.128.51) |
| 09:56.52 | *** join/#debian Brigo (~Brigo@40.181.60.213.dynamic.reverse-mundo-r.com) |
| 09:57.22 | *** join/#debian AimHere (~David@92.237.236.151) |
| 10:02.57 | *** join/#debian gimmel (~gavin@203.87.115.233) |
| 10:03.56 | Eryn_1983_FL | hey guys.. |
| 10:04.10 | Eryn_1983_FL | so i need to burn an iso on to a dvd, and i forgot what packages i need for that? |
| 10:04.20 | Eryn_1983_FL | also what app should i use? k3b? |
| 10:04.22 | *** join/#debian maroloccio (~marolocci@2a02:8084:601d:7f80:164f:8aff:fed8:411d) |
| 10:04.28 | Eryn_1983_FL | i got gnome installed so. |
| 10:04.35 | Eryn_1983_FL | not sure that is on there right now |
| 10:04.52 | *** join/#debian k-man (~jason@unaffiliated/k-man) |
| 10:06.07 | Eryn_1983_FL | i do have brasero |
| 10:06.26 | flayer | that should do the trick |
| 10:06.35 | GNU\colossus | yes, it should |
| 10:06.47 | jhutchins | Eryn_1983_FL: You should probably be readin somethng like an installl guide, but if it's an iso, you can simply dd/cp it to the raw device. |
| 10:07.11 | Eryn_1983_FL | not debian just trying to burn a dvd in debian, |
| 10:07.20 | Eryn_1983_FL | ill just do brasero i dont have good luck with dd... |
| 10:07.26 | *** join/#debian black_ant (~antilope@unaffiliated/black-ant/x-1505394) |
| 10:07.32 | jhutchins | Eryn_1983_FL: You only need tools like brasero if it's not already formatted as an iso. |
| 10:07.55 | Eryn_1983_FL | yeah not doing the cp thing |
| 10:09.07 | *** join/#debian yuta (~pi@PPPa4048.e13.eacc.dti.ne.jp) |
| 10:10.58 | *** join/#debian dselect (~dselect@unaffiliated/themill/bot/dselect) |
| 10:18.47 | *** join/#debian BCMM (~BCMM@unaffiliated/bcmm) |
| 10:19.50 | BCMM | i have created a swap partition, but haven't added it to fstab yet. to my surprise, it is being used anyway. |
| 10:20.02 | BCMM | why is this happening? do i need to add it to fstab at all? |
| 10:28.19 | akik | Eryn_1983_FL: yes you can't use cp to burn a dvd |
| 10:31.50 | *** join/#debian lesless (~lessless@obligatory.vehicle.volia.net) |
| 10:32.21 | *** join/#debian cheet (~cheet@modemcable246.155-226-192.mc.videotron.ca) |
| 10:34.48 | *** join/#debian Ericounet (~Eric@2a01:e0a:d0:3c20:c675:9790:b5e4:6174) |
| 10:35.38 | *** join/#debian pasiz (~pasiz@unaffiliated/pasiz) |
| 10:37.15 | Eryn_1983_FL | ... |
| 10:37.22 | Eryn_1983_FL | why was jhutchins saying so then? |
| 10:37.36 | *** join/#debian deltanedas (~deltaneda@5.134.95.67) |
| 10:37.47 | Eryn_1983_FL | i got it goin now no worries |
| 10:37.54 | akik | he didn't read your question properly |
| 10:38.02 | *** join/#debian nifker (~Thunderbi@200116b80a80dd00c07a1a33873929b8.dip.versatel-1u1.de) |
| 10:40.49 | *** join/#debian datasmurf (~datasmurf@unaffiliated/datasmurf) |
| 10:42.55 | *** join/#debian AnySomebody (~AnySomebo@p200300c2870667081bae8b3a38c07b86.dip0.t-ipconnect.de) |
| 10:43.18 | *** join/#debian kevinsan (~kevinsan@kakapo.susa.net) |
| 10:44.06 | AnySomebody | Hi, does Debian 10 support the AMD R3-4300U? How can I find this out? I already learned it depends on what was backported into 4.19... |
| 10:44.20 | *** join/#debian \\Mr_C\\ (~mrc@cpe-75-187-191-230.neo.res.rr.com) |
| 10:47.01 | ratrace | AnySomebody: you can use a newer kernel from buster-backports, if you need it; as for your question specifically, can't answer that. |
| 10:47.24 | *** join/#debian Narcotion (~Narcotion@095-096-180-047.static.chello.nl) |
| 10:47.45 | AnySomebody | ratrace: Asking for a linux newbie who is maybe not that interested in installing a newer kernel... |
| 10:48.16 | efloid | cdrecord |
| 10:49.01 | *** mode/#debian [+l 1125] by debhelper |
| 10:49.29 | *** join/#debian uvolmer2 (~uvolmer@2001-4dd0-212c-fd-c06f-48c1-8-e719.ipv6dyn.netcologne.de) |
| 10:51.06 | *** join/#debian JohnML (~john1@ip-178-202-6-56.hsi09.unitymediagroup.de) |
| 10:55.53 | *** join/#debian grobi (~rtng@unaffiliated/grobi) |
| 10:56.40 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 11:04.19 | *** join/#debian uvolmer (~uvolmer@2001-4dd0-212c-fd-c06f-48c1-8-e719.ipv6dyn.netcologne.de) |
| 11:04.22 | *** join/#debian towo` (~towo@unaffiliated/towo/x-4064351) |
| 11:04.28 | *** join/#debian m0u_ (~m0u@unaffiliated/m0u) |
| 11:04.43 | genr8_ | the CPU is the least of your worries if its a laptop. |
| 11:05.15 | nvz | indeed, if anything the issue would be more the integrated stuff if there is integrated graphics in the cpu |
| 11:05.24 | *** join/#debian dpkg (~dpkg@unaffiliated/dpkg) |
| 11:05.30 | nvz | one way to know, is to boot the installer and see what happens :P |
| 11:06.15 | genr8_ | Vega 5 iGPU |
| 11:07.07 | nvz | the only big thing I've heard of lately that plagues the install of stable on these modern machines is some unsupported pcie nvme disks.. as long as you can get installed the rest can be solved rather simply |
| 11:07.18 | AnySomebody | Yeah, I'm indeed rather worried about the iGPU... |
| 11:07.30 | genr8_ | i remember them adding stuff like that into 4.20 "AMD Radeon Picasso + Raven2 support, and Vega20 enablement" |
| 11:07.59 | another | 4300U is renoir |
| 11:08.13 | AnySomebody | Now I'm wondering whether an iGPU isn't part of the CPU ;) |
| 11:09.08 | genr8_ | not as far as the kernel goes |
| 11:10.57 | genr8_ | seems like youll need the 5.4 kernel at least for Renoir |
| 11:11.16 | another | ,v linux-image-amd64 |
| 11:11.17 | judd | Package: linux-image-amd64 on amd64 -- jessie: 3.16+63+deb8u2; jessie-security: 3.16+63+deb8u7; stretch-security: 4.9+80+deb9u6; stretch: 4.9+80+deb9u11; stretch-backports: 4.19+105+deb10u4~bpo9+1; buster: 4.19+105+deb10u5; buster-backports: 5.7.10-1~bpo10+1; bullseye: 5.8.7-1; sid: 5.8.7-1; experimental: 5.9~rc4-1~exp1 |
| 11:11.18 | genr8_ | and 5.7/5.8 adds more fixes |
| 11:13.56 | AnySomebody | Hum... after I advised her to use Debian and not to use the other distros she found on the internet maybe I have to tell her that Debian won't work out of the box and she maybe shouldn't use it... whereafter no distro is left +) |
| 11:14.45 | AnySomebody | Is it hard for a newbie to use a newer kernel from the backports? Unfortunately I don't know too much about Debian... |
| 11:14.54 | *** join/#debian HurricaneHarry (~quassel@2a02:a455:9d06:1:93ec:23a0:8cab:4874) |
| 11:15.52 | genr8_ | it needs following instructions and typing commands, not clicking mouse buttons |
| 11:15.57 | nvz | AnySomebody: its not terribly difficult and we could help with it. You can install, login, put something like irssi or weechat and screen or tmux on there.. come here and get help |
| 11:16.28 | AnySomebody | I use Arch btw. +) |
| 11:16.41 | AnySomebody | But it is not about me... hum |
| 11:16.42 | genr8_ | unfortunately the buster backport isnt up to 5.8 yet and thats where a LOT of fixes came in |
| 11:16.57 | nvz | AnySomebody: in any case that being said, you'd probably want to use the firmware installer on a laptop or system with wifi to ensure you can get additional packages and to irc for support |
| 11:16.59 | AnySomebody | *sigh* |
| 11:17.07 | nvz | genr8_: I think it is |
| 11:17.17 | nvz | ,v linux-image-amd64 |
| 11:17.18 | judd | Package: linux-image-amd64 on amd64 -- jessie: 3.16+63+deb8u2; jessie-security: 3.16+63+deb8u7; stretch-security: 4.9+80+deb9u6; stretch: 4.9+80+deb9u11; stretch-backports: 4.19+105+deb10u4~bpo9+1; buster: 4.19+105+deb10u5; buster-backports: 5.7.10-1~bpo10+1; bullseye: 5.8.7-1; sid: 5.8.7-1; experimental: 5.9~rc4-1~exp1 |
| 11:17.29 | genr8_ | that was just shown. |
| 11:17.31 | nvz | ah, no, you are correct.. not yet in backports |
| 11:17.46 | genr8_ | like 5 lines above |
| 11:18.12 | nvz | scrolled off my screen and I'm more focused on the larger screen in front of my face :P |
| 11:19.47 | genr8_ | maybe the GPU is fine without newest kernel fixes. maybe its adequate to watch youtube, who knows. |
| 11:20.25 | *** join/#debian oo_miguel (~miguel@89-72-187-203.dynamic.chello.pl) |
| 11:21.19 | AnySomebody | Maybe... |
| 11:21.55 | AnySomebody | Maybe don't encourage new linux users to use linux, I guess +) |
| 11:21.58 | AnySomebody | +s |
| 11:22.17 | AnySomebody | Especially when the maybe turns out as no after a while of work |
| 11:22.40 | *** join/#debian towo` (~towo@unaffiliated/towo/x-4064351) |
| 11:23.39 | genr8_ | or, if you're running a new device, consider yourself a beta tester. |
| 11:23.52 | nvz | typically its better when dealing with inexperienced folk, that you do more than encourage, and if you're gonna make recommendation you do it for them |
| 11:24.24 | *** join/#debian Trieste (~T@unaffiliated/trieste) |
| 11:24.30 | nvz | afterall most people have no experience installing ANY operating system |
| 11:25.04 | ratrace | linux was always for expert folks, by sheer virtue of contributions being done by people to scratch a particular itch, and not to make it super convenient for newbs, unless that scratches someone's itch, but historically hasn't been much of a case. |
| 11:25.13 | genr8_ | people also buy way too new hardware built for windows. terrible proprietary devices. thats not really their fault. the laptop industry is toxic, along with a ton of other tech |
| 11:25.15 | *** join/#debian jarxv (~jarxv@103.43.151.241) |
| 11:25.45 | genr8_ | its always an uphill battle. the fact it works at all should not be taken for granted |
| 11:26.08 | ratrace | ie. it requires reading and learning. no clicky-clicky-it-all-works; even with ubuntu clicky clicky works until it doesn't and then it's learning time! |
| 11:26.11 | nvz | what I've always found disgusting is many lower end budget machines arent really even spec'd enough for the windows OS they put on it which I find downright criminal |
| 11:27.23 | jarxv | Is there a snapshot of debian 4.4 kernel ?? |
| 11:27.53 | AnySomebody | Unfortunately I can only give support remotely... but yeah, maybe I could do this via ssh or whatever... |
| 11:28.24 | nvz | AnySomebody: you could, yes, as the installer (in expert mode) has remote install over ssh capability |
| 11:28.43 | nvz | AnySomebody: you may want to familiarize yourself with the process on your end first perhaps with a vm or something |
| 11:29.33 | AnySomebody | True, if so I should have a look into it... on the other hand before I start such things I could install Arch for her, was easier for me... |
| 11:29.36 | nvz | AnySomebody: however these sorts of things can sometimes also be difficult as they require more often than not forwarding ports through a residential router which varies significantly and is usually also beyond the skill of most users |
| 11:30.07 | AnySomebody | Yes, this was the argument against doing a remote install so far... the work on her side |
| 11:30.53 | nvz | some ISPs if you use their equipment make this a bit easier now using more advanced remote management of their gateway hardware.. comcast for example has Xfi which can be configured from your customer web portal or a mobile app |
| 11:32.28 | genr8_ | at the expense of them having total ownership of your device. pwnd. |
| 11:32.50 | AnySomebody | Comfort-security-tradeoff, hu? +) |
| 11:33.13 | nvz | yeah.. though there are companies out there making similar software and I expect to see such things in more personally owned equipment in the future |
| 11:34.01 | *** join/#debian datasmurf (~datasmurf@unaffiliated/datasmurf) |
| 11:34.10 | *** join/#debian Ericounet (~Eric@2a01:e0a:d0:3c20:72da:d93:2dfb:f593) |
| 11:34.12 | ratrace | nvz: looking at the installer now (I was coincidentally installing some VMs), but I can't find the ssh option in the expert mode |
| 11:35.11 | nvz | fires up a vm to see as its been awhile |
| 11:35.12 | genr8_ | i don't. I expect everything to be fully controlled by the corporation that makes it in the future. with the consumer having 0 agency over what software is being run. |
| 11:35.44 | nvz | yeah well it is sad that what people want no longer seems to matter anymore |
| 11:35.46 | genr8_ | and as far as "put your own software on it" like DD_WRT, thats gonna be killed soon too. |
| 11:36.19 | *** join/#debian thiras (~thiras@unaffiliated/thiras) |
| 11:36.25 | genr8_ | people want to click buttons and have things happen, not care about how |
| 11:36.36 | AnySomebody | Wonder whether the software is a problem at all as long as you have proprietary hardware... |
| 11:37.41 | *** join/#debian grobi (~rtng@unaffiliated/grobi) |
| 11:37.48 | genr8_ | yeah. itll just be "corporate tech" and open source wont be able to work unless the open hardware movement ramps up and gets to where open source is now. |
| 11:37.56 | nvz | ratrace: seems after several clicks through the usual initial language stuff in the expert mode, you need to load installer components .. first usb-storage (when using thumbdrive or such) to load the "cdrom" then it gives you a larger list of installer components to load of which you need network-console in order to continue remotely using ssh |
| 11:38.03 | genr8_ | even then, it will be 10 years behind. |
| 11:40.08 | AnySomebody | Well, and the politics in the EU is currently 20 years behind starting to fund open source stuff +) |
| 11:40.48 | ratrace | nvz: blimey, that's not complicated at all :) |
| 11:41.03 | AnySomebody | -stuff +software |
| 11:41.13 | AnySomebody | Maybe they should start with open source hardware instead... |
| 11:41.28 | *** join/#debian grobi (~rtng@unaffiliated/grobi) |
| 11:41.35 | nvz | ratrace: yeah it'll give you the information you need to proceed when you then detect network hardware, configure network, and choose the continue install remotel using SSH |
| 11:41.43 | *** join/#debian Ctaeth (~thelounge@105.ip-213-32-69.eu) |
| 11:41.52 | genr8_ | I would love to continue this but we will be kicked out for not talking about debian |
| 11:42.07 | AnySomebody | Oh, sorry. |
| 11:42.07 | *** join/#debian jarxv (~jarxv@103.43.151.241) |
| 11:42.35 | ratrace | nvz: I'll try it out. would be nice to have that option too. |
| 11:43.15 | *** join/#debian Nokaji (~Nokaji@unaffiliated/nokaji) |
| 11:43.37 | nvz | ratrace: I've only actually used it once that I recall |
| 11:45.29 | ratrace | speaking of, does the kernel or some userland network stack have a problem with particular MAC addresses given to virtio NICs that are bound to taps on the host side? |
| 11:45.55 | ratrace | because a windows VM has no issue with the same (made up) MAC given |
| 11:46.05 | ratrace | "13:37:B0:0B:69:69" for example |
| 11:46.59 | nvz | shrugs |
| 11:50.13 | ratrace | definitely does, because if I copy default virtio mac given, and change the last digits for example, all is well |
| 11:51.10 | nvz | I've only ever done such things for vpn and usually didnt concern myself with such details |
| 11:51.49 | nvz | had a SBC that was for some odd reason autogenerating its wifi's mac id.. and put a stop to that as it was annoying |
| 11:52.55 | ratrace | well I want to force separate MACs for multiple VMs running on the same tap |
| 11:53.04 | ratrace | %s/tap/bridge/ |
| 11:56.20 | *** join/#debian Raito_Bezarius (~Raito_Bez@unaffiliated/raito-bezarius/x-8764578) |
| 11:56.46 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 11:58.57 | another | ratrace: you shouldn't use that MAC for a machine. it's a group address |
| 11:59.07 | *** join/#debian Raito_Bezarius (~Raito_Bez@unaffiliated/raito-bezarius/x-8764578) |
| 11:59.30 | *** join/#debian n4dir (~n4dir@i5E866619.versanet.de) |
| 12:00.07 | ratrace | another: ? |
| 12:00.31 | *** join/#debian Raito_Bezarius (~Raito_Bez@unaffiliated/raito-bezarius/x-8764578) |
| 12:01.50 | another | the 1-bit in the first octet signifies a multicast (?) address. the 2-bit is for administratively generated addresses |
| 12:02.33 | another | https://en.wikipedia.org/wiki/MAC_address#Universal_vs._local |
| 12:02.41 | *** join/#debian mirrorbird (~psutcliff@2a00:801:44a:a00b:20c3:c64:eb15:73a2) |
| 12:03.35 | ratrace | blast, forgot about that. but then how come the windows VM works with it |
| 12:03.59 | another | or even just the picture: https://en.wikipedia.org/wiki/MAC_address#/media/File:MAC-48_Address.svg |
| 12:04.26 | another | *shrug* windows doing windows things |
| 12:04.32 | *** join/#debian hexorg (~Thunderbi@100.0.180.112) |
| 12:06.25 | *** join/#debian hassoon (hassoon@unaffiliated/hassen) |
| 12:07.24 | ratrace | another: and heh 0x13 is both them bits flipped on. :) |
| 12:08.47 | *** join/#debian absinthe_ (~absinthe@unaffiliated/absinthe) |
| 12:09.06 | *** join/#debian dvs (~hibbard@cwv.teksavvy.com) |
| 12:16.59 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 12:21.18 | *** join/#debian fightthewalrus (~Queetom@KD113148020047.ppp-bb.dion.ne.jp) |
| 12:23.27 | *** join/#debian hobbanero (~hobbanero@7.sub-174-250-0.myvzw.com) |
| 12:23.29 | *** join/#debian citypw (~citypw@gateway/tor-sasl/citypw) |
| 12:23.38 | *** join/#debian jaami_ (~jaami@103.255.5.89) |
| 12:25.07 | jaami_ | hi, what debian GUI tool is easy way to create desktop shortcut? |
| 12:25.39 | *** join/#debian MikZyth (~MikZyth@85.115.224.142) |
| 12:25.43 | nvz | heh |
| 12:25.56 | nvz | jaami_: are you using a desktop environment? |
| 12:26.03 | *** join/#debian kriger (~norge@unaffiliated/kriger) |
| 12:26.07 | jaami_ | nvz, gnome |
| 12:26.19 | nvz | jaami_: and do you mean a launcher? or a windows shortcut? |
| 12:26.28 | jaami_ | yes, a launcher |
| 12:26.45 | nvz | typically you just right click on the desktop and go to create shortcut |
| 12:27.19 | nvz | I use MATE which has caja, a fork of GNOME's previous generation of Nautilus, and thats how it works |
| 12:27.21 | jaami_ | the 3 option have no such Create Shortcut |
| 12:27.28 | *** join/#debian Kuttenbrunzer (~Kuttenbru@2a02:8108:8b80:65c::fed6) |
| 12:27.44 | jaami_ | oh mATE |
| 12:28.12 | nvz | jaami_: the name of the application is gnome-desktop-item-edit |
| 12:28.17 | nvz | the option is --create-new |
| 12:28.35 | nvz | i.e. gnome-desktop-item-edit ~/Desktop --create-new |
| 12:28.47 | nvz | how you do it from the GNOME UI I'm not certain offhand |
| 12:29.02 | *** mode/#debian [+l 1131] by debhelper |
| 12:30.13 | jaami_ | lets say myApp is on /home/myApp. i create myApp.desktop in /usr/share/application/myApp.desktop |
| 12:30.48 | nvz | you need not actually create the .desktop file, it'll do that for you |
| 12:30.55 | nvz | and put it in your homedir |
| 12:31.30 | jaami_ | oh that is good but how |
| 12:31.46 | jaami_ | oh okay, sorry i missed the command you gave |
| 12:31.52 | jaami_ | let me try that |
| 12:37.42 | jaami_ | nvz, the command did not work because it depends upon other package i guess. but for tunately, a little search gave hint about alacarte. |
| 12:37.56 | jaami_ | deabin already have alacarte installed |
| 12:38.13 | jaami_ | its very easy way i actually needed exactly that |
| 12:38.28 | ratrace | or find an example of .desktop online, and create one under ~/.local/share/applications/ |
| 12:38.41 | ratrace | I mean it's not rocket science. it's an INI file |
| 12:39.10 | jaami_ | ratrace, i did try but something about MIME was not working |
| 12:39.16 | nvz | if you wanted a MENU entry thats different than a desktop launcher |
| 12:39.25 | nvz | I thought you actually wanted a launcher on your desktop |
| 12:39.28 | ratrace | (not in gnome shell tho) |
| 12:39.42 | ratrace | jaami_: can you be more specific? |
| 12:40.08 | jaami_ | oh, nvz that i did not know. i though the window shortcut is acually launcher in debian. my mistake |
| 12:40.26 | jaami_ | ratrace, let me try to reproduce the error |
| 12:44.52 | *** join/#debian sweatsuit (~sweatsuit@unaffiliated/sweatsuit) |
| 12:49.01 | *** mode/#debian [+l 1123] by debhelper |
| 12:49.25 | *** join/#debian rebrec (~rebrec@82-64-53-213.subs.proxad.net) |
| 12:50.05 | jaami_ | i see a file in File Manager but same file isnt there when i use ls in terminal. what i am doing wrong? |
| 12:50.33 | jaami_ | file extension is .desktop |
| 12:52.30 | *** join/#debian rebrec (~rebrec@82-64-53-213.subs.proxad.net) |
| 12:55.46 | *** join/#debian benf (benf2004@unaffiliated/benf2004) |
| 12:58.48 | jaami_ | ratrace, i cannot find the MIME line in the .desktop file which i think was not correct. |
| 12:59.07 | jaami_ | i missed the line but .desktop file is working now |
| 12:59.17 | ratrace | <PROTECTED> |
| 12:59.24 | jaami_ | L) |
| 12:59.27 | jaami_ | :) |
| 13:02.34 | *** join/#debian steven_saus (~steven_sa@cpe-74-131-36-220.kya.res.rr.com) |
| 13:09.29 | *** join/#debian datasmurf (~datasmurf@unaffiliated/datasmurf) |
| 13:14.28 | *** join/#debian sphenxes1 (~sphenxes@196.240.57.164) |
| 13:14.29 | *** join/#debian sphenxes (~sphenxes@196.240.57.164) |
| 13:16.44 | *** join/#debian Jerrynicki (~niklas@p549a9799.dip0.t-ipconnect.de) |
| 13:18.38 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 13:20.41 | *** join/#debian cheet (~cheet@modemcable246.155-226-192.mc.videotron.ca) |
| 13:20.59 | *** join/#debian bogus (~bogus@83-83-165-7.cable.dynamic.v4.ziggo.nl) |
| 13:21.25 | *** join/#debian ajay (~aj@203-213-61-5.tpgi.com.au) |
| 13:22.48 | *** join/#debian ive3481 (~matthaeus@118.36.21.149) |
| 13:23.25 | *** join/#debian ive3481 (~matthaeus@118.36.21.149) |
| 13:24.26 | *** join/#debian deltanedas (~deltaneda@5.134.95.67) |
| 13:27.10 | *** join/#debian sinaowolabi (~Sina@41.190.30.106) |
| 13:28.43 | *** join/#debian daknob (~daknob@mneme.s.daknob.net) |
| 13:29.08 | *** join/#debian lle-bout (~lle-bout@2a01:e0a:2a2:1350:9527:5c74:ee6c:113c) |
| 13:30.21 | *** join/#debian mtnman (~dbk@172.58.59.172) |
| 13:30.34 | *** join/#debian diogenes_ (~diogenes_@188.208.120.114) |
| 13:31.03 | *** part/#debian mtnman (~dbk@172.58.59.172) |
| 13:35.03 | *** join/#debian daknob (~daknob@mneme.s.daknob.net) |
| 13:42.22 | *** join/#debian fred1m (~quassel@2a01:e0a:8e:8b20:7f27:bb0d:81b2:ecb9) |
| 13:45.42 | *** join/#debian daknob (~daknob@mneme.s.daknob.net) |
| 13:46.39 | *** join/#debian JordiGH (jordi@octave/developer/JordiGH) |
| 13:48.24 | *** join/#debian JohnML (~john1@ip-178-202-6-56.hsi09.unitymediagroup.de) |
| 13:48.28 | *** join/#debian Narcotion (~Narcotion@095-096-180-047.static.chello.nl) |
| 13:51.31 | *** join/#debian paulgrmn (~paulgrmn@c-98-250-183-21.hsd1.mi.comcast.net) |
| 13:52.34 | *** join/#debian amlchief (~amlchief@gateway/tor-sasl/amlchief) |
| 13:54.46 | *** join/#debian Franciman (~francesco@host-82-55-138-222.retail.telecomitalia.it) |
| 13:54.49 | Franciman | Hello |
| 13:55.01 | Franciman | what happens when debian runs out of Toy Story characters names? |
| 13:55.33 | dvs | I'd imagine that they would use other Pixer characters |
| 13:55.34 | *** part/#debian JordiGH (jordi@octave/developer/JordiGH) |
| 13:55.45 | Franciman | no pls |
| 13:55.51 | Franciman | I hope they restart the names |
| 13:55.54 | Franciman | :'( |
| 13:58.00 | Deknos | i wish traefik would be in the debian repositories :( |
| 13:58.20 | *** join/#debian fax (~quassel@unaffiliated/fax) |
| 13:59.49 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 14:00.19 | *** join/#debian lle-bout (~lle-bout@82-64-145-38.subs.proxad.net) |
| 14:05.26 | *** join/#debian Newami (~Newami@ip70-179-45-125.sd.sd.cox.net) |
| 14:07.01 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 14:12.37 | *** join/#debian Aki-lucky (~Aki-lucky@189.160.253.103) |
| 14:13.24 | *** join/#debian Aki-lucky (~Aki-lucky@189.160.253.103) |
| 14:18.28 | *** join/#debian metro (~metro@unaffiliated/metreo) |
| 14:20.13 | *** join/#debian ledeni (~ledeni@fedora/ledeni) |
| 14:20.35 | *** join/#debian idlenode (~idlenode@gateway/tor-sasl/idlenode) |
| 14:21.13 | *** join/#debian buffal0 (~buffal0@47.205.208.152) |
| 14:23.49 | *** join/#debian nobyk (~nobyk@gateway/tor-sasl/nobyk) |
| 14:25.57 | *** join/#debian Guest57202 (~chris@90.254.80.9) |
| 14:29.57 | *** join/#debian fraser4861 (~matteo@220.79.39.198) |
| 14:31.44 | RoyK | Deknos: Is træfik based on varnish or something? |
| 14:36.50 | *** join/#debian rebrec (~rebrec@82-64-53-213.subs.proxad.net) |
| 14:37.14 | *** join/#debian SHADOWSaaaA (~SHADOWSaa@117.29.241.175) |
| 14:38.17 | *** join/#debian qqx (~qqx@pug.qqx.org) |
| 14:38.59 | *** join/#debian rebrec (~rebrec@82-64-53-213.subs.proxad.net) |
| 14:39.34 | *** join/#debian hitest (~hitest@unaffiliated/hitest) |
| 14:42.29 | *** join/#debian fred1m (~quassel@2a01:e0a:8e:8b20:7f27:bb0d:81b2:ecb9) |
| 14:47.24 | *** join/#debian andypoenas (~andy@31.14.73.76) |
| 14:49.12 | andypoenas | hola senor and senorita. secure network for personal use: https://pastebin.com/rGcZXpie adios!!! |
| 14:52.43 | *** join/#debian Vizva (~Vizva@gateway/tor-sasl/vizva) |
| 14:54.41 | *** join/#debian deltanedas (~deltaneda@5.134.95.67) |
| 14:55.19 | *** join/#debian qqx (~qqx@pug.qqx.org) |
| 14:55.53 | *** join/#debian ChmEarl (~chmearl@unaffiliated/prymar56) |
| 15:00.06 | *** join/#debian Cabanossi (~Cabanossi@ppp-88-217-94-147.dynamic.mnet-online.de) |
| 15:00.49 | *** join/#debian The_Loko (~The_Loko@185.239.201.77) |
| 15:03.56 | *** join/#debian CrystalMath (~coderain@reactos/developer/theflash) |
| 15:06.51 | *** join/#debian d1cor (~diego@unaffiliated/d1cor) |
| 15:10.09 | *** join/#debian pfred1 (~pfred1@unaffiliated/pfred1) |
| 15:11.18 | *** join/#debian dvs (~Herbert@cwv.teksavvy.com) |
| 15:17.33 | *** join/#debian fatalerrors (~fatalerro@91.224.149.180) |
| 15:17.43 | *** join/#debian lazywalker (~lazywalke@unaffiliated/lazywalker) |
| 15:18.56 | Deknos | RoyK, don't think so. traefik is in go, varnish is written in C, isn't it? |
| 15:20.18 | *** join/#debian debsan (~debsan@unaffiliated/debsan) |
| 15:20.27 | Deknos | traefik can handle application routing with nomad and consol, can be used for k8s, has letsencrypt support with it (so you do not need extra stuff for letsencrypt). |
| 15:20.29 | Deknos | it's pretty cool |
| 15:20.51 | Deknos | sadly i am not very good at debian packaging.. and packaging go stuff seems even harder for me. |
| 15:22.58 | *** join/#debian rbrunner (~rbrunner@2a00:9fe0:0:15::1:192) |
| 15:23.10 | *** part/#debian rbrunner (~rbrunner@2a00:9fe0:0:15::1:192) |
| 15:25.27 | *** join/#debian escanor (uid387784@gateway/web/irccloud.com/x-ykjibcfpmlkrrovr) |
| 15:28.27 | *** join/#debian kafir (~kafir@70.32.5.22) |
| 15:36.35 | *** join/#debian EtherMan (~quassel@unaffiliated/ether-man/x-1546665) |
| 15:37.43 | *** join/#debian amphiprions (~amphiprio@82-64-46-151.subs.proxad.net) |
| 15:38.39 | *** join/#debian CrystalMath (~coderain@reactos/developer/theflash) |
| 15:40.33 | *** join/#debian fatalerrors (~fatalerro@2a03:7220:8081:b301::f0) |
| 15:42.02 | *** join/#debian edlou (uid413273@gateway/web/irccloud.com/x-wpliqqnyepujugkm) |
| 15:45.32 | *** join/#debian ChiLLabiS (~ChiLLabiS@unaffiliated/chillabis) |
| 15:47.17 | *** join/#debian The_Loko (~The_Loko@185.239.201.77) |
| 15:48.37 | *** join/#debian Tom01 (~tom@a89-183-32-247.net-htp.de) |
| 15:51.39 | *** join/#debian dvs (~Herbert@cwv.teksavvy.com) |
| 15:53.47 | *** join/#debian Grldfrdom (uid391113@gateway/web/irccloud.com/x-hzdbxgrxznnziigx) |
| 15:58.44 | *** join/#debian idlenode (~idlenode@gateway/tor-sasl/idlenode) |
| 15:59.49 | *** join/#debian idlenode (~idlenode@gateway/tor-sasl/idlenode) |
| 16:04.28 | *** join/#debian Hokedli (~laslie@gateway/tor-sasl/lasliedv) |
| 16:04.40 | *** join/#debian Guest57202 (~chris@90.254.80.9) |
| 16:06.12 | *** join/#debian nickodd (~nickodd@unaffiliated/nickodd) |
| 16:09.15 | *** join/#debian dastier (~dastier@93.85.160.16) |
| 16:12.17 | RoyK | Deknos: I'd guess it will be nice for low level traffic, but I somewhat doubt it'll be able to reach the performance levels of varnish ;) |
| 16:12.52 | *** join/#debian bmlzootown (~bmlzootow@unaffiliated/bmlzootown) |
| 16:14.05 | *** join/#debian Guest57202 (~chris@90.254.80.9) |
| 16:17.05 | *** join/#debian martinus__ (~martin@86.16.201.77.rev.sfr.net) |
| 16:19.53 | *** join/#debian uvolmer (~uvolmer@2001-4dd0-212c-fd-c06f-48c1-8-e719.ipv6dyn.netcologne.de) |
| 16:20.01 | *** join/#debian creat (~creat@unaffiliated/creat) |
| 16:24.24 | *** join/#debian idlenode (~idlenode@gateway/tor-sasl/idlenode) |
| 16:24.47 | *** join/#debian mtnman (~dbk@172.58.59.172) |
| 16:25.56 | *** join/#debian RandomGuy90 (~RandomGuy@91.239.205.33) |
| 16:27.24 | *** join/#debian diniwed (~gavron@ool-44c21938.dyn.optonline.net) |
| 16:29.27 | Deknos | well, i don't know about that. it is used in multiple cloud environments. might be that varnish is a bit better on the throughput side but as far as i see, varnish also has not the same target audience as traefik |
| 16:30.00 | *** join/#debian treeview (~treeview@71.65.243.217) |
| 16:30.18 | Deknos | and if you think varnish is so much better, provide reliable benchmarking :) |
| 16:31.04 | *** join/#debian RandomGuy90 (~RandomGuy@91.239.205.33) |
| 16:31.07 | Deknos | traefik for example seems to be in the same range as haproxy and nginx according to https://www.loggly.com/blog/benchmarking-5-popular-load-balancers-nginx-haproxy-envoy-traefik-and-alb/ |
| 16:34.40 | *** join/#debian rf-n00b_ (rf-n00b@gateway/vpn/privateinternetaccess/rf-n00b) |
| 16:35.06 | *** join/#debian grummund (~unknown@unaffiliated/grummund) |
| 16:42.29 | *** join/#debian buffal0 (~buffal0@47.205.208.152) |
| 16:50.46 | *** join/#debian cheet (~cheet@modemcable246.155-226-192.mc.videotron.ca) |
| 16:50.49 | *** join/#debian st-gourichon-f (~Stephane@2a01:e0a:2e2:6db0:71ab:863f:d221:6f01) |
| 16:54.22 | *** join/#debian BackupBackupNick (~Aki-lucky@189.160.253.103) |
| 16:55.27 | Raito_Bezarius | does anyone can pastebin systemd-analyze security on a "recent" Debian server? |
| 16:55.37 | Raito_Bezarius | (it's okay if service name are censored) |
| 16:55.50 | Raito_Bezarius | I don't have any Debian box around |
| 16:56.17 | Deknos | which debian release? |
| 16:57.07 | *** join/#debian bytehackr (~sandipan@43.252.250.71) |
| 16:57.22 | bytehackr | ok |
| 16:57.24 | *** join/#debian st-gourichon-fid (~Stephane@2a01:e0a:2e2:6db0:71ab:863f:d221:6f01) |
| 16:57.28 | Deknos | on debian stretch there's no "systemd-analyze security" :D |
| 16:57.33 | sponix | If Debian 10.5 and a VM providing the information is Fine. I can do that |
| 16:57.42 | Raito_Bezarius | "recent" :D, so I can only suppose buster would surely support it$ |
| 16:57.59 | Raito_Bezarius | sponix: a default install is interesting but I'd be interested into something which has some services |
| 16:58.04 | Raito_Bezarius | nginx, apache, whatever, etc. |
| 16:58.35 | *** join/#debian diogenes_ (~diogenes_@188.208.121.76) |
| 16:58.40 | sponix | Raito_Bezarius: Mine is bare.. So I would have to snapshot the VM and put a few things on it |
| 16:58.53 | Raito_Bezarius | I'm okay with any "statistics" |
| 16:59.20 | Deknos | uh, interesting |
| 16:59.29 | Deknos | i have also a buster box here |
| 16:59.31 | Deknos | my desktop |
| 16:59.39 | Deknos | i do not know what the smileys mean.. but |
| 16:59.41 | Deknos | uhoh |
| 16:59.42 | Raito_Bezarius | mind sharing your findings? Deknos |
| 16:59.47 | Raito_Bezarius | it means how much the hardening is done |
| 16:59.49 | Raito_Bezarius | on the systemd service |
| 16:59.54 | Raito_Bezarius | https://www.ctrl.blog/entry/systemd-service-hardening.html |
| 17:00.17 | *** join/#debian ledeni (~ledeni@fedora/ledeni) |
| 17:00.22 | Deknos | well it is paged... shall i pastebin it somewhere? |
| 17:00.25 | Raito_Bezarius | I'm wondering how much Debian maintainers ships hardened systemd services on default install |
| 17:00.28 | Raito_Bezarius | Deknos: please! |
| 17:00.39 | Deknos | but it looks a little bit like every thing which is NOT systemd is bad :D |
| 17:00.46 | Raito_Bezarius | :D :D |
| 17:01.08 | Raito_Bezarius | on a NixOS box, I have some good results but not totally good |
| 17:01.23 | Raito_Bezarius | for Xandikos/Transmission/Yggdrasil/NGINX for example |
| 17:01.55 | Raito_Bezarius | if you do |
| 17:02.00 | Raito_Bezarius | systemd-security analyze $service |
| 17:02.03 | Raito_Bezarius | you can get "advanced" details |
| 17:02.09 | Deknos | Raito_Bezarius, i queried it to you |
| 17:02.29 | Deknos | i will look into that, but i am a little bit.. sceptical |
| 17:02.42 | Deknos | what are the rules for determining if something is safe and secure? |
| 17:02.42 | *** join/#debian dingen (~henk@unaffiliated/dreamer) |
| 17:02.42 | *** part/#debian diogenes_ (~diogenes_@188.208.121.76) |
| 17:03.00 | Raito_Bezarius | you can get the details |
| 17:03.04 | Raito_Bezarius | systemd-security analyze $service |
| 17:03.12 | Raito_Bezarius | but basically, the more capabilities you give to a service, the more it's exposed |
| 17:03.27 | Raito_Bezarius | having PrivateSystem=full, directives to lock down the thing, enforcing read only paths makes it less exposed |
| 17:04.00 | Raito_Bezarius | for example, my transmission.service has its capabilities bounded, systems calls filtered, namespaces restricted, etc. |
| 17:04.11 | Raito_Bezarius | it has a 1.3 score |
| 17:04.12 | Deknos | okay |
| 17:04.20 | Deknos | i have to admit, that is INDEED pretty nice |
| 17:04.23 | Deknos | thanks for that info! |
| 17:04.27 | Deknos | NICE |
| 17:04.32 | Raito_Bezarius | :-) |
| 17:04.49 | Raito_Bezarius | https://clbin.com/Gvb8x here's the .service (ignore the NixOS path shit, it's irrelevant in the context) |
| 17:05.40 | somiaj | Raito_Bezarius: My understanding is though debian is fairly sane in defaults, it won't be fully harded by default, and if you have a security model that requires more hardening, you can edit the serverices in and place them in etc. |
| 17:05.54 | Raito_Bezarius | somiaj: yes, sure, I was wondering how much it was done by defaults |
| 17:06.07 | Raito_Bezarius | AFAIK, some of those hardening comes at no cost |
| 17:07.40 | *** join/#debian coot (~coot@37.30.49.42.nat.umts.dynamic.t-mobile.pl) |
| 17:07.44 | Deknos | i agree with that |
| 17:07.46 | somiaj | It might depend on the matainer, or the actual need. At some level the sys admin check and make decisions on what to do. |
| 17:07.56 | Deknos | but it's heavy footwork, you have to analyze each service |
| 17:07.59 | *** join/#debian AnySomebody (~AnySomebo@p200300c287066779bd45972a7b36f511.dip0.t-ipconnect.de) |
| 17:08.04 | Deknos | but it's kinda nice |
| 17:08.05 | somiaj | but if you feel some package could use to have that hardening at no cost to standard users, you can file a wishlist bug |
| 17:08.22 | Deknos | would be neat to have some debian packages which enforce certain settings |
| 17:08.36 | Raito_Bezarius | that's the kind of thing I wonder if it'd be nice to fund some people to go around and harden classical services |
| 17:08.48 | Raito_Bezarius | so that everyone's security increase "trivially" |
| 17:09.14 | somiaj | Deknos: There is no single security measure that fits all, one does need to access their risk model. One should always analyze the services they want to use. |
| 17:10.24 | Raito_Bezarius | somiaj: sure, but I don't believe that something like a IRC client require to modify its own code in the RAM in general or to go change /etc/passwd :P |
| 17:10.27 | Deknos | somiaj, because of that i meant, let the NORMAL state be and create some ADDITIONAL packages where the people can decide what helps their risk model with "neat to havem some debian packages which enforce..." |
| 17:10.40 | Raito_Bezarius | ah that'd make sense |
| 17:10.42 | *** join/#debian bertbob (~bertbob@67-2-6-101.slkc.qwest.net) |
| 17:10.54 | Deknos | i certainly do NOT want to have that enforced per default for everything and everyone |
| 17:10.59 | Deknos | that would be just awful |
| 17:11.24 | somiaj | but anyone can report a wishlist bug if you think such a measure will improve a package, let the matainer know (though you'll have to think about each package you want to harden this way) |
| 17:11.26 | Raito_Bezarius | to be fair, some NixOS services are hardened by default |
| 17:11.29 | cipherize | There are very few security controls that could qualify as truly one-size-fits-all. |
| 17:11.29 | Raito_Bezarius | with sane hardening |
| 17:11.40 | Raito_Bezarius | and I always try to lockdown as much as possible |
| 17:11.53 | Raito_Bezarius | opting-out of this is not really difficult |
| 17:11.57 | somiaj | and in most cases if it only increases local user security, this doesn't affect a lot of systems that don't have local users. |
| 17:11.59 | cipherize | Raito_Bezarius: Even on a system that just doesn't need that level of hardening? |
| 17:12.07 | Raito_Bezarius | cipherize: yes |
| 17:12.11 | cipherize | Raito_Bezarius: Why? |
| 17:12.19 | Raito_Bezarius | cipherize: well, this is the way people initially wrote those services |
| 17:12.26 | Raito_Bezarius | and I see it more and more in some services downstream |
| 17:12.36 | Raito_Bezarius | it creates little to no impact |
| 17:12.39 | Raito_Bezarius | so it's cheap ? |
| 17:12.45 | cipherize | Raito_Bezarius: You're treating every system as if they're all the same risk classification. The server hosting your lunch menu simply doesn't require the same level of effort/hardening as the system holding your financial documents. |
| 17:13.08 | Raito_Bezarius | if the effort is as simple as saying "enable nginx", I don't see really the problem |
| 17:13.19 | Raito_Bezarius | now, if it creates real issues, it's always possible to opt out |
| 17:13.39 | cipherize | Raito_Bezarius: Because it's not that simple. enable nginx -> configure nginx -> nginx isn't always compatible with web apps that expect Apache functionality, etc. |
| 17:13.55 | Raito_Bezarius | hmm, do you have examples? |
| 17:13.56 | cipherize | Raito_Bezarius: You're misrepresenting things in a way that makes your argument appear more favorable. |
| 17:14.14 | cipherize | Raito_Bezarius: Sure. Look at the effort required to run Wordpress on nginx. |
| 17:14.19 | *** join/#debian dez (uid92154@fedora/deSouza) |
| 17:14.27 | Raito_Bezarius | okay |
| 17:14.29 | cipherize | Raito_Bezarius: Even that level of effort simply may not be warranted or valuable. |
| 17:14.44 | cipherize | Raito_Bezarius: Treating every system as if the effort is warranted is a fallacy. |
| 17:14.44 | Raito_Bezarius | I have to admit that NixOS is quite different in that regards |
| 17:14.49 | Raito_Bezarius | because of the expert system we have |
| 17:14.53 | *** join/#debian Lord_of_Life_ (~Lord@unaffiliated/lord-of-life/x-0885362) |
| 17:14.59 | Raito_Bezarius | running wordpress is as simple as services.wordpress.enable = true; |
| 17:15.05 | Raito_Bezarius | sure, it uses httpd behind |
| 17:15.07 | cipherize | Raito_Bezarius: And it will pull in Apache. |
| 17:15.14 | Deknos | and some php libraries |
| 17:15.21 | cipherize | Exactly. So your "just enable nginx" argument is disingenuous. |
| 17:15.24 | Raito_Bezarius | but nothing prevent someone to replace the httpd backend by a phpfpm + nginx thing |
| 17:15.29 | Raito_Bezarius | it's not that simple, true |
| 17:15.54 | Raito_Bezarius | but this problem generalize to arbitrary PHP applications afaik |
| 17:16.06 | cipherize | And now you're expending that level of effort without considering whether or not its WARRANTED based on the risk classification of the system/app in question. |
| 17:16.07 | Deknos | i agree with cipherize and somiaj that with security there's seldomly one fits for all, but there are possibilities to improve in debian and different possibilities to do that also.. |
| 17:16.19 | *** join/#debian anonzzz (~nathan@45.62.233.79) |
| 17:16.23 | cipherize | Raito_Bezarius: You've entered this discussion with the presupposition that NixOS does things the right way and that your argument is correct. |
| 17:16.28 | *** join/#debian _0bitcount (~Big_Byte@90.162.105.206) |
| 17:16.35 | Raito_Bezarius | cipherize: I'm not supposing NixOS is doing the right thing in a obvious manner |
| 17:16.40 | somiaj | And if there is a single case that is well tested, file a wishlist bug, but just 'harden all services' is not sucha thing. |
| 17:16.46 | Deknos | cipherize, but the valid question would be indeed: which security "settings" can be hardened by default for everyone. |
| 17:16.47 | Raito_Bezarius | It appears to me that NixOS is offering me interesting properties |
| 17:17.06 | Raito_Bezarius | I ponder whether this is a thing which should be "generalized" to a certain extent |
| 17:17.17 | cipherize | Deknos: pam_cracklib for passwords, but that may negatively affect usability to an excessive degree for a system that accepts no external connections. |
| 17:17.33 | Raito_Bezarius | There are multiple levels/layers of hardening |
| 17:17.42 | cipherize | With Debian, the idea is to provide the basic components with which to build a system to one's requirements. |
| 17:17.44 | somiaj | Raito_Bezarius: also different oses have different goals, policy, user base. As the Universial Operating System, debian is going to have different goals than NixOS, so a comparision may not fully be appropriate. |
| 17:17.56 | Raito_Bezarius | somiaj: I'm not trying to draw a direct comparison |
| 17:18.02 | Deknos | cipherize, so you would deactivate spectre mitigations on systems where only trusted code is running and not connected to the web? |
| 17:18.06 | somiaj | so though yes it can be done, as if it fits the debian echo system, it might depend a lot on the packge in question. |
| 17:18.08 | Deknos | as an counterexample? |
| 17:18.12 | cipherize | Deknos: Yes. |
| 17:18.39 | cipherize | Deknos: If the performance improvement is needed for that system to adequately perform its function. The benefit to the requirement would, in general, outweigh the neglible risk increase. |
| 17:18.48 | cipherize | negligible, rather |
| 17:18.49 | Deknos | then why does for example debian enable stack protections in their kernel? |
| 17:18.55 | Deknos | i mean that also costs performance. |
| 17:19.01 | *** mode/#debian [+l 1129] by debhelper |
| 17:19.26 | cipherize | Deknos: I would hazard a guess that the overwhelming majority of Debian installations are 1. internet connected and 2. running at least some not-entirely-trusted code. |
| 17:19.49 | Deknos | cipherize, so... also enable spectre mitigations per standard on debian installations? |
| 17:20.14 | cipherize | Deknos: Given the performance impact, I'd leave that to the administrator of the system. |
| 17:20.20 | cipherize | Deknos: It's a question of impact vs. value. |
| 17:20.34 | *** join/#debian nt1036 (~nt1036@2605:e000:1805:4ebb:d8c1:ed1d:5b89:55d4) |
| 17:20.36 | cipherize | This system that I'm on right now: Is spectre a big threat in my world? No. |
| 17:20.43 | *** join/#debian hmuller (~hmuller@2601:404:ce00:1b57:7285:c2ff:fe61:40ac) |
| 17:20.51 | cipherize | I do very little of importance on this host. IRC and a few other random things that aren't sensitive. |
| 17:20.56 | Deknos | yeah, and i think (per service) there are settings which should/could be enabled by default and send as whishlist/bug to the maintainer |
| 17:21.07 | Raito_Bezarius | my point ^ |
| 17:21.08 | *** join/#debian Downer (downer@gateway/vpn/mullvad/downer) |
| 17:21.29 | Raito_Bezarius | What's the expected level of proficiency of the average Debian sysadmin? |
| 17:21.31 | cipherize | You're being dishonest, if I can be frank. Your argument thus far has been "fully harden all the things without regard to risk." |
| 17:21.39 | Raito_Bezarius | What is risk here? |
| 17:21.45 | Raito_Bezarius | Does hardening thing create risks? |
| 17:21.59 | cipherize | Yes. |
| 17:22.03 | hmuller | any troubleshooting tips for an unresponsive tmux session? |
| 17:22.04 | Raito_Bezarius | What kind of risks? |
| 17:22.09 | cipherize | Availability IS a component of security. |
| 17:22.18 | nvz | hmuller: use screen |
| 17:22.21 | nvz | hides |
| 17:22.26 | hmuller | lol |
| 17:22.28 | nvz | heh |
| 17:22.35 | cipherize | If the extent of hardening creates the possibility that the system becomes unavailable when needed, then you've harmed your security posture in one way to benefit another. |
| 17:22.37 | Raito_Bezarius | cipherize: does your concept of security takes in account the business security or something? |
| 17:22.50 | cipherize | Raito_Bezarius: No, my concept of security is literally the textbook definition used the world over. |
| 17:22.54 | Raito_Bezarius | which is? |
| 17:23.03 | cipherize | Confidentiality, integrity, availability. |
| 17:23.14 | Deknos | hardening can create risk |
| 17:23.28 | Deknos | i agree with that. |
| 17:23.29 | cipherize | It's always a balancing act. |
| 17:23.32 | Raito_Bezarius | I agree that hardening can create risk |
| 17:23.33 | Deknos | i has to make sense. |
| 17:23.37 | Deknos | it* |
| 17:23.38 | Raito_Bezarius | But I feel like there is a balance and low hanging fruits |
| 17:23.42 | Raito_Bezarius | In hardening stuff |
| 17:23.43 | nvz | hmuller: I'd maybe try strace and also see if by any other means I could deduce if its the session or just a process inside it causing the problem |
| 17:23.44 | cipherize | You're being dishonest again. |
| 17:23.52 | Raito_Bezarius | Please elaborate cipherize |
| 17:23.59 | Deknos | Raito_Bezarius, well then, analyze services and create specific bugreports :) |
| 17:24.08 | Raito_Bezarius | Deknos: I'm not using Debian! :P |
| 17:24.12 | cipherize | 13:11 <Raito_Bezarius> and I always try to lockdown as much as possible |
| 17:24.17 | nvz | hmuller: I however /do/ use screen not tmux so idk much about it |
| 17:24.19 | Deknos | .. then i have to ask, why do you promote that here? |
| 17:24.27 | cipherize | Raito_Bezarius: That has been the core of your argument. You continue to move the goalposts. |
| 17:24.38 | Raito_Bezarius | Deknos: I was wondering what Debian was doing to understand and get educated here :D⦠|
| 17:24.46 | hmuller | nvz: i'll probably have to resort to that. after turning off the target. you ever have problems with screen freezing? |
| 17:24.58 | Raito_Bezarius | cipherize: Sorry for that, the quote you mention applies to my threat model, so it makes sense for me |
| 17:25.09 | cipherize | Raito_Bezarius: You don't have a threat model. You have habits and nothing more. |
| 17:25.16 | nvz | hmuller: turning off the target? you mean detaching it? |
| 17:25.17 | Raito_Bezarius | In the "as much as possible", there is availability, indeed |
| 17:25.18 | cipherize | Raito_Bezarius: Threat models require risk evaluation. |
| 17:25.22 | Raito_Bezarius | On my laptop, I disable all mitigation |
| 17:25.30 | cipherize | Raito_Bezarius: You have not yet indicated that you consider risk in anything whatsoever. |
| 17:25.52 | Raito_Bezarius | The "as much as possible" is a best-effort position in conjunction with risk IMHO |
| 17:25.54 | *** join/#debian treeview (~treeview@71.65.243.217) |
| 17:25.55 | hmuller | nvz: i'm ssh'd into the target, I can close the ssh session, but it reattaches to the frozen tmux session |
| 17:25.58 | Raito_Bezarius | I don't have infinite time and money |
| 17:26.00 | cipherize | Again, you're moving goalposts. |
| 17:26.09 | Raito_Bezarius | I'm not trying to convince you of something cipherize |
| 17:26.14 | Raito_Bezarius | I'm trying to understand your point of view |
| 17:26.36 | Raito_Bezarius | I don't think I had goal post from the start, I tried to expose my view and get educated, if what I said does not make any sense |
| 17:26.39 | cipherize | Raito_Bezarius: I've made it quite clear. Maximum hardening is a bad default course of action. |
| 17:26.53 | hmuller | nvz: and it has nothing to do with Ctrl-x, I'm thinking of taking screen for a spin =) |
| 17:26.59 | Deknos | Raito_Bezarius, you should read about risk management, then you would understand his/her viewpoint |
| 17:27.02 | hmuller | Ctrl-s |
| 17:27.02 | nvz | hmuller: hmm.. well the only thing I can think of is that there is some kinda terminal character that locks up a screen regardless if you're multiplexing or not |
| 17:27.03 | cipherize | Consider the actual risks to the system. If this host gets compromised, fine. I'll just blow it away and redeploy from a new template. |
| 17:27.34 | nvz | hmuller: you could try ^q or the control char and ^q I think it is that usually terminates this |
| 17:27.46 | hmuller | nvz: yeah, already did that |
| 17:27.46 | cipherize | The worst case scenario for this system is that someone has a joyride on my IRC nick and gets me booted from a few channels. |
| 17:27.47 | Deknos | none the less, i like that feature. |
| 17:28.19 | Deknos | cipherize, well no, the person could post childpornography and you end up in some investigation |
| 17:28.31 | Deknos | identity theft could be hefty if it is an targeted attack at you |
| 17:28.51 | cipherize | Deknos: That's not really a risk, though. Identity theft is annoying, but fairly easily resolved. I've had it happen, it was hardly consequential. |
| 17:29.10 | cipherize | Deknos: And if someone posts CP from this host, I'm happy to land them behind bars from a moral perspective. |
| 17:29.20 | nvz | hmuller: all I know is that tmux has more features than screen and that it could stand to reason that perhaps in a multiplexer the particular window you're on, whatever is running in that is what locked up and is making the whole session seem locked up |
| 17:29.21 | Deknos | cipherize, first you would have to prove it was not you. |
| 17:29.29 | Raito_Bezarius | Deknos: I actually read about risk management; maybe I misexplained my view but I said "maximum hardening under constraints", which is not the same as "maximum hardening", now, I agree that hardening can itself introduce bugs |
| 17:29.36 | cipherize | Deknos: Incorrect. I live in the US. Law enforcement would have to prove that is IS me. |
| 17:29.42 | Deknos | that could be quite hard, depending on the case |
| 17:29.52 | Raito_Bezarius | but on a desktop, I actually don't want that firefox access to other stuff that its folder and downloads folder for instance |
| 17:30.02 | nvz | hmuller: if that particular program frozen on the screen is something you could stand to lose, if nothing else perhaps killing what you see frozen might get things moving again |
| 17:30.05 | Deknos | you are quite confident in your law enforcement. i do not share that sentiment :D |
| 17:30.07 | Raito_Bezarius | and more generally, that applies to most of the software I use |
| 17:30.24 | Raito_Bezarius | cipherize: well, you're lucky; in France, identity theft creates a lot of issue |
| 17:30.36 | nvz | hmuller: but if I were gonna start stracing I'd start first with looking at that process.. and perhaps its state in htop/ps output |
| 17:30.39 | cipherize | Deknos: You're welcome to your feelings on the matter. I'm happy to cooperate with law enforcement in such cases. Just dump my full system logs and hand it over. Go to town. |
| 17:30.41 | Raito_Bezarius | and it can take up to 10 years to resolve it correctly |
| 17:31.01 | nvz | hmuller: usually when shtf runnin htop and looking at the machines vitals and whats using the most resources is my first step |
| 17:31.02 | Deknos | i want firefox to have access to those folders when i want to upload something. that was always quite troublesome, when firefox is hardened too much |
| 17:31.03 | cipherize | Raito_Bezarius: For me, it was a simple matter of reporting it to the police and keeping the police report on hand. The occasional phone call or email and issues were promptly resolved. |
| 17:31.23 | Raito_Bezarius | Deknos: my folders where I want to upload stuff are more than often correctly identified, so it works more or less fine |
| 17:31.24 | hmuller | nvz: yeah, i just killed the session. I'll give that a look the next time it freezes |
| 17:31.33 | Deknos | cipherize, they could still argue you falsified that logs to protect yourself :) |
| 17:31.38 | Raito_Bezarius | but I have documents that I want to assume that no soft will exfiltrate |
| 17:31.41 | cipherize | Deknos: And then they'd have to prove it. |
| 17:31.50 | *** join/#debian sanroot (~sanroot@2409:4042:61f:ef79:9010:622f:1623:9bfa) |
| 17:31.51 | Raito_Bezarius | especially when you do pip install something and you get a malware which tries to send your SSH keys to a C2C |
| 17:31.56 | *** join/#debian subcool_ (~subcool@195.181.168.211) |
| 17:31.57 | nvz | hmuller: are you sure its not just ssh lag? |
| 17:32.03 | nvz | hmuller: have you heard of mosh? |
| 17:32.39 | hmuller | ssh lag? not heard of mosh |
| 17:32.39 | *** join/#debian ikus060 (~ikus060@173-246-15-25.qc.cable.ebox.net) |
| 17:32.43 | cipherize | Anyway, this conversation has long since gone off the rails in terms of what's topical for this channel. |
| 17:32.44 | hmuller | nvz:^^^ |
| 17:32.47 | Raito_Bezarius | cipherize: in France, reporting it to police is not enough; you have to prove a lot of things and even those proofs are somewhat disregarded and you have to wait for a court to rule on your case⦠which makes you unable meanwhile to perform a lot of actions |
| 17:32.47 | Deknos | they have prove that it originated from your computer/VM and ignore the other stuff. such stuff has happened. but ymmv |
| 17:32.49 | Raito_Bezarius | cipherize: indeed :) |
| 17:32.55 | Raito_Bezarius | Thanks for your point of view cipherize |
| 17:33.09 | cipherize | Raito_Bezarius: That's France's problem, not mine. Innocence until proven guilty beyond a reasonable doubt is quite a powerful legal standard. |
| 17:33.45 | nvz | hmuller: ssh is tcp, which means it has to synchronize.. and can timeout.. and ssh has no means of dealing with or monitoring lag for the most part |
| 17:33.53 | Raito_Bezarius | It's more complex than that, but let's not get into this |
| 17:33.55 | cipherize | mosh is a godsend. |
| 17:34.30 | cipherize | The only whine I have about mosh is that it doesn't gracefully handle IP stack changes. If your original connection is via IPv4 and you transition to a network that's dual-stack, you get stuck. |
| 17:34.44 | nvz | hmuller: mosh is a solution.. it connects over tcp via ssh then establishes a mosh udp connection which is immune to everything from lag to network hops, and it monitors for lag.. notifies you when its lost contact and continues to echo locally even when its not echoing back from the server |
| 17:34.45 | *** join/#debian sanroot (~sanroot@49.35.82.76) |
| 17:35.18 | nvz | hmuller: you really should install mosh on both ends and give it a try.. its a drastic improvement over traditional ssh |
| 17:35.23 | hmuller | nvz: ahh. great tip, i will research that |
| 17:35.59 | cipherize | Does require opening a fairly expansive range in your firewall, based on default config. |
| 17:36.03 | nvz | hmuller: it does however require an additional port forward |
| 17:36.04 | cipherize | 60000:61000/udp, iirc |
| 17:37.14 | *** join/#debian trilliaris (~tatrias@111.23.27.77.dynamic.reverse-mundo-r.com) |
| 17:39.43 | nvz | I just used a single port but thats probably why I could only have one mosh connection and why I had to ssh in and killall mosh-server if I somehow lost that connection by like killing the client while I was not in contact with the server |
| 17:40.30 | nvz | but I run most everything on non standard ports to minimize abuse |
| 17:41.12 | nvz | in my experience anytime you run ssh on default port you get people always trying random crap :P |
| 17:41.14 | *** join/#debian deicide- (~deicide-@unaffiliated/deicide-) |
| 17:41.42 | cipherize | Assuming you care about log volume. |
| 17:42.00 | hmuller | nvz: i use non-default port too, even on lan |
| 17:43.01 | *** join/#debian Betal (~Betal@unaffiliated/betal) |
| 17:44.58 | cipherize | As long as we all understand that changing default ports is NOT a security measure. |
| 17:45.47 | genr8_ | it helps |
| 17:46.37 | cipherize | Not really. Just helps minimize log spam. Remember that god knows how many bots are portscanning the internet. See also 'shodan.' |
| 17:46.39 | yanmaani | What to use for mobipocket ebooks (.mobi) on Linux? |
| 17:46.47 | yanmaani | No DRM. Not using KDE. |
| 17:46.54 | nvz | yes it does help minimze the spam in logs from random idiots |
| 17:47.39 | genr8_ | port scanning $world only scans known ports, not 65,535 on each host |
| 17:48.04 | yanmaani | nvz: just use key auth |
| 17:48.06 | yanmaani | or disable the logs |
| 17:48.17 | nvz | not to mention when scanning ports you gotta figure out which service is on open ports |
| 17:48.18 | taman | yanmaani, fbreader. |
| 17:48.33 | nvz | every little bit helps reduce headaches |
| 17:48.44 | *** join/#debian timur_davletshin (~timur_dav@unaffiliated/timur-davletshin/x-6536285) |
| 17:48.57 | cipherize | genr8_: Not true. Depends entirely on the invocation, i.e. nmap. |
| 17:49.01 | *** mode/#debian [+l 1136] by debhelper |
| 17:49.12 | cipherize | And if you have thousands of systems participating, well... |
| 17:49.19 | cipherize | nvz: That doesn't take much. |
| 17:49.20 | genr8_ | depends entirely on your willingness to assume what reality is. |
| 17:49.49 | cipherize | genr8_: Well, my damn near 20 years in infosec has given me a pretty good perspective on this subset of reality. |
| 17:50.04 | cipherize | genr8_: But hey, if being condescending because someone disagrees with you is how you find happiness, rock on. |
| 17:50.05 | genr8_ | mine tells me the opposite |
| 17:50.07 | hmuller | nvz: I believe I may have tracked the problem to low current on usb. I have 2 commands frozen in uninterrutible sleep on the target. both commands are targeting an external usb hard drive. |
| 17:50.20 | cipherize | genr8_: I strongly doubt that. |
| 17:50.26 | genr8_ | im over this. |
| 17:50.39 | hmuller | nvz: going to increase current to usb and see if I still have problems. |
| 17:51.49 | *** join/#debian b_jonas (~a@catv-176-63-12-47.catv.broadband.hu) |
| 17:52.39 | *** join/#debian kreyren_ (~kreyren@fsf/member/kreyren) |
| 17:52.46 | b_jonas | Xorg doesn't load the intel driver for me. I suspect the problem is that this CPU is too new, and the intel driver in debian 10 doesn't yet support it. So I'll have to look for how to install a newer driver. |
| 17:53.25 | *** join/#debian akp55_ (~akp55@c-73-148-15-31.hsd1.va.comcast.net) |
| 17:53.51 | *** join/#debian dadinn (~dadinn@cpc87065-finc18-2-0-cust18.4-2.cable.virginm.net) |
| 17:54.03 | *** join/#debian tichun (252fd340@public-gprs404479.centertel.pl) |
| 17:54.12 | *** part/#debian tichun (252fd340@public-gprs404479.centertel.pl) |
| 17:54.24 | *** join/#debian tichun (252fd340@public-gprs404479.centertel.pl) |
| 17:54.31 | timur_davletshin | Debian 10 uses Wayland by default. |
| 17:54.50 | timur_davletshin | Sure, if hardware is compatible. |
| 17:55.11 | somiaj | as far as what default means, gnome uses wayland by default, but if you install another de you'll use xorg. |
| 17:55.42 | *** join/#debian shabius_ (~shabius@45.15.17.131) |
| 17:56.18 | timur_davletshin | somiaj, why would anyone use something else? |
| 17:56.51 | somiaj | timur_davletshin: Because people like different things. |
| 17:56.58 | hyiltiz | What's the difference between the libreoffice, soffice, loffice, ooffice binaries? |
| 17:57.01 | somiaj | I personally don't use a display manager or a DE. |
| 17:57.43 | somiaj | hyiltiz: are these binaries all in debian? |
| 17:58.00 | timur_davletshin | somiaj, just like 0.1% of all desktop users ))) |
| 17:58.01 | hyiltiz | yes, all from the libreoffice stuff |
| 17:58.30 | timur_davletshin | hyiltiz, for compatibility reasons )) |
| 17:59.03 | somiaj | hyiltiz: they just seem to be links, I don't have ooffice, but all the others point to the same binary |
| 17:59.07 | hyiltiz | not the reason; what's the difference? |
| 17:59.17 | hyiltiz | they are not links; they are individual binaries with different size |
| 17:59.21 | timur_davletshin | hyiltiz, no difference. |
| 17:59.28 | somiaj | hyiltiz: mostly just name changes, libreoffice is a fork of openoffice which was an open sourced version of star office (based on the old wordstar) |
| 17:59.39 | somiaj | hyiltiz: what version of debian are you running? |
| 17:59.48 | timur_davletshin | hyiltiz, they symlinks, check ls -l /usr/bin/*office |
| 18:00.15 | somiaj | well loffice isn't a link, it is a shell script that does the same thing as a link |
| 18:00.24 | somiaj | at least here on debian 10 |
| 18:00.32 | hyiltiz | http://ix.io/2ydS |
| 18:00.47 | hyiltiz | loffice and soffice are independent binaries tho |
| 18:01.04 | hyiltiz | oh really; never really tried to open it |
| 18:01.19 | somiaj | hyiltiz: loffice is a shell script that runs /lib/libreoffice/program/soffice "$@" |
| 18:01.26 | hyiltiz | just saw that thx |
| 18:01.34 | hyiltiz | so they are literally the same thing... |
| 18:01.57 | somiaj | hyiltiz: anyways, they are just backwards comadability. Seems in all of the changing from staroffice (soffice) to open office to libre office, the actual binary never chnaged its name from soffice, and the other names were just links |
| 18:02.43 | b_jonas | yeah. the ooffice command used to work too, and I used to run that, but there's no such symlink anymoer. |
| 18:03.02 | timur_davletshin | Libreoffice has a lot of old crap for compatibility. Like using star office font names in templates or providing soffice binary. Both fonts and even StarOffice file format are no longer supported. |
| 18:03.05 | somiaj | maybe hyiltiz has an older version of debian, or some older package that installed ooffice, but I don't have that any more either. |
| 18:03.45 | hyiltiz | No I didn't have ooffice binary; I was checking firejail profiles for libreoffice and found ooffice as well |
| 18:03.57 | hyiltiz | but i had no office binary so that profile did nothing |
| 18:03.58 | *** join/#debian warsoul (warsoul@gateway/shell/xshellz/x-iulattjhcfhqrgza) |
| 18:05.04 | *** join/#debian deltanedas (~deltaneda@5.134.95.67) |
| 18:09.52 | *** join/#debian hexorg (~Thunderbi@100.0.180.112) |
| 18:11.46 | *** join/#debian sanroot (~sanroot@42.108.241.246) |
| 18:12.44 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 18:15.22 | *** join/#debian ikus060 (~ikus060@173-246-15-25.qc.cable.ebox.net) |
| 18:16.48 | *** join/#debian anoncon (~Falsememo@pool-96-238-12-231.prvdri.fios.verizon.net) |
| 18:17.10 | *** join/#debian kreyren__ (~kreyren@fsf/member/kreyren) |
| 18:18.42 | hmuller | nvz: thanks for the assist. adjusted usb current, and testing ... if the issue continues i'll look into mosh AND screen =) |
| 18:19.01 | *** join/#debian tristero (~nobody@unaffiliated/transfinite) |
| 18:19.05 | *** join/#debian zerocode (~zerocode@unaffiliated/brutex) |
| 18:20.24 | nvz | I'd recommend mosh regardless.. its very good.. |
| 18:20.28 | *** join/#debian AnyS0mebody (~AnySomebo@p5b3d5d0f.dip0.t-ipconnect.de) |
| 18:20.56 | *** join/#debian electro33 (uid613@gateway/web/irccloud.com/x-ehsoiiwecgyfwxrg) |
| 18:21.02 | nvz | I only use screen cause I have no interest in the additional features so no point in learning something new |
| 18:21.47 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 18:22.43 | somiaj | tmux is another alternative that many like as well. |
| 18:23.18 | nvz | we were speaking of tmux, which they already use |
| 18:23.20 | somiaj | I swtiched from tmux from screen, mostly as I find it 'more modern' for whatever that means (screen is good, but hasn't changed much in years, which for many is what they like) |
| 18:23.24 | somiaj | ahh |
| 18:23.33 | somiaj | *switched to tmux from screen |
| 18:25.23 | hmuller | I thought I was having a tmux issue, but it looks like the ARM64 SBC I had ssh'd into needed to increase power to USB (for an external hard drive). |
| 18:25.56 | hmuller | I had two uninterruptible process, both were performing commands on the usb external hard drive. |
| 18:26.19 | *** join/#debian kmikita (uid461814@gateway/web/irccloud.com/x-olrltxhrwqlahphh) |
| 18:29.23 | *** join/#debian zerocode (~zerocode@unaffiliated/brutex) |
| 18:30.07 | *** join/#debian subcool (~subcool@195.181.168.201) |
| 18:32.08 | *** join/#debian tagomago (~tagomago@static-9-198-224-77.ipcom.comunitel.net) |
| 18:34.44 | *** join/#debian yonder (~yonder@unaffiliated/yonder) |
| 18:35.52 | somiaj | glad you figured it out |
| 18:36.59 | nvz | yes well just proves my suspicions right.. that something inside tmux locking up can lockup the whole thing |
| 18:37.16 | *** join/#debian dostoyevsky (~sck@unaffiliated/dostoyevsky) |
| 18:37.25 | nvz | which is why I said I'd look at something like htop first.. see the cpu/ram use and what state processes in tmux are in |
| 18:38.14 | *** join/#debian tugrik (~username@war.funkyjesus.org) |
| 18:38.16 | dostoyevsky | how can it be that I can do `apt install rxvt' but I can't ping 8.8.8.8 and "curl http://www.google.com" gives me: curl: (7) Failed to connect to www.google.com port 80: Network is unreachable |
| 18:39.06 | somiaj | was the cwd that tmux was run in on this usb drive, I don't see screen acting any better. Though if it is a bug, tmux development is fairly active and would be interested |
| 18:39.57 | somiaj | dostoyevsky: is apt using a proxy? |
| 18:40.12 | somiaj | dostoyevsky: could be some firewall issue on your network not giving you full access to the internet |
| 18:40.51 | somiaj | dostoyevsky: also maybe check out ap route, are your routes for all traffice resonable? |
| 18:41.11 | dostoyevsky | somiaj: It's so odd it happens when building a docker container... |
| 18:41.22 | dostoyevsky | (which built fine many times) |
| 18:41.22 | *** join/#debian grummund (~unknown@unaffiliated/grummund) |
| 18:41.37 | somiaj | maybe somethign changed with how the docker container attaches to the network. |
| 18:42.00 | somiaj | but sounds like a routing/firewall issue. I don't know enough to be of any real help, maybe ##networking could give some pointers if no one else here joins in |
| 18:43.41 | dostoyevsky | where would one configure a proxy for apt? |
| 18:44.01 | somiaj | what are your sources? can you ping deb.debian.org for instance? |
| 18:44.39 | dostoyevsky | > ping deb.debian.org # -PING debian.map.fastly.net (151.101.114.133): 56 data bytes |
| 18:44.52 | dostoyevsky | Destination Net Unreachable |
| 18:45.05 | somiaj | it could be something docker is doing, but looks like you can configure it in /etc/apt/apt.conf.d/ and the file is probably named proxy.conf but doens't have to be look for Acquire::http::Proxy and Acquire::https::Proxy |
| 18:45.16 | somiaj | dostoyevsky: what do your sources.list say your sources are? |
| 18:45.36 | *** join/#debian amlchief (~amlchief@gateway/tor-sasl/amlchief) |
| 18:46.01 | dostoyevsky | deb http://deb.debian.org/debian buster main // deb http://security.debian.org/debian-security buster/updates main // deb http://deb.debian.org/debian buster-updates main |
| 18:47.04 | dostoyevsky | Seems pretty standard for `FROM debian:buster-slim' ... but the docker image was updated just some hours ago |
| 18:47.11 | *** join/#debian yuta (~pi@PPPa4048.e13.eacc.dti.ne.jp) |
| 18:47.50 | *** join/#debian BrianG61UK_ (~BrianG61U@2a02:8010:66b7:dddd:a0b0:d7aa:dd77:79d2) |
| 18:48.43 | *** join/#debian JohnML (~john1@ip-178-202-6-56.hsi09.unitymediagroup.de) |
| 18:49.01 | *** mode/#debian [+l 1144] by debhelper |
| 18:49.14 | somiaj | and if you run 'apt update' it works? |
| 18:49.32 | somiaj | sounds like you have some issue with yoru networking in your container, but I don't know docker or networking details enough to give much more info than that. |
| 18:49.51 | dostoyevsky | # apt update # -> All packages are up to date. |
| 18:49.52 | *** join/#debian tagomago (~tagomago@static-9-198-224-77.ipcom.comunitel.net) |
| 18:50.17 | somiaj | but you saw it connect to the network just fine? I wonder what apt is doing differently |
| 18:51.50 | *** join/#debian barteks2x__ (~barteks2x@c137-123.icpnet.pl) |
| 18:52.19 | dostoyevsky | somiaj: Yeah, seems like there is a firewall in upper layers blocking certain domains... |
| 18:52.36 | dostoyevsky | Thanks for helping me debugging :) |
| 18:52.39 | *** join/#debian barteks2x__ (~barteks2x@c137-123.icpnet.pl) |
| 18:52.58 | somiaj | dostoyevsky: well I just made noise, seems you did all the work. Things working fine now? |
| 18:54.07 | dostoyevsky | somiaj: Nope... but I can see I can curl certain urls and for others I get Destination net unreachable... so must be some firewall setting |
| 18:54.35 | somiaj | traceroute help? |
| 18:55.26 | dostoyevsky | somiaj: I got to ask my brother about this mac here... so not really related to debian any more |
| 18:55.50 | yanmaani | taman: thanks |
| 18:55.52 | dostoyevsky | I run docker on osx |
| 18:56.19 | *** join/#debian n4dir (~n4dir@i5E866619.versanet.de) |
| 18:57.44 | *** join/#debian luuuciano__ (~luuuciano@unaffiliated/luuuciano) |
| 18:59.04 | pfred1 | this is #debian |
| 18:59.32 | *** part/#debian nickodd (~nickodd@unaffiliated/nickodd) |
| 19:00.01 | somiaj | dostoyevsky: ahh yea, so could be an host issue vs a container, well best of luck. |
| 19:00.24 | *** join/#debian ttill (~ttill@5cf3ff07.rev.dansknet.dk) |
| 19:00.26 | *** join/#debian sfvm (~sfvm@37.228.215.148) |
| 19:00.43 | *** join/#debian b1ack0p (~m@unaffiliated/blackop) |
| 19:02.45 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 19:03.19 | *** join/#debian oxek (~qjvl@unaffiliated/oxek) |
| 19:04.12 | *** join/#debian Ericounet (~Eric@2a01:e0a:d0:3c20:e937:4df9:538:da89) |
| 19:04.35 | *** join/#debian deltanedas (~deltaneda@5.134.95.67) |
| 19:13.19 | *** join/#debian gnufr33dom (~gnufr33do@ip24-253-15-85.lv.lv.cox.net) |
| 19:20.46 | *** join/#debian magic_ninja (~sparkie1@unaffiliated/magic-ninja/x-4708782) |
| 19:22.07 | *** join/#debian vdehors (~vdehors@91-162-62-2.subs.proxad.net) |
| 19:25.51 | *** join/#debian martinus__ (~martin@86.16.201.77.rev.sfr.net) |
| 19:28.30 | *** join/#debian zerocode (~zerocode@unaffiliated/brutex) |
| 19:33.18 | *** join/#debian freebench (~freebench@92.253.253.227) |
| 19:35.09 | *** join/#debian SoulsForBelial (~SoulsForB@p200300f12f4c1c00821f02fffeaf6272.dip0.t-ipconnect.de) |
| 19:40.00 | *** join/#debian epony (epony@unaffiliated/epony) |
| 19:45.00 | *** join/#debian magic_ninja (~sparkie1@unaffiliated/magic-ninja/x-4708782) |
| 19:46.25 | *** join/#debian Mazhive (~Mazhive@143.0.32.23) |
| 19:47.45 | *** join/#debian JohnML (~john1@ip-178-202-6-56.hsi09.unitymediagroup.de) |
| 19:50.09 | *** join/#debian ledeni (~ledeni@fedora/ledeni) |
| 19:51.53 | *** join/#debian pvdp66556 (~pvdp@180-150-101-81.b49665.bne.static.aussiebb.net) |
| 19:52.31 | *** join/#debian CrazyEddy (crazyed@wrongplanet/CrazyEddy) |
| 19:53.07 | *** join/#debian kriger (~norge@unaffiliated/kriger) |
| 19:53.54 | *** join/#debian grobi (~rtng@unaffiliated/grobi) |
| 19:56.14 | *** join/#debian well_laid_lawn (~Jean-luc@61.69.184.10) |
| 19:58.27 | *** join/#debian Conradish006 (~conradish@c-68-39-198-234.hsd1.in.comcast.net) |
| 20:00.18 | *** join/#debian vassenn (~vassenn@94.233.238.201) |
| 20:05.45 | *** join/#debian tmroland (~tmroland@host-78-148-106-159.as13285.net) |
| 20:12.03 | *** join/#debian k4nz (~Thunderbi@115.199.96.103) |
| 20:13.43 | *** join/#debian DogManJr (~fvf@2601:84:c601:ece0:b541:3a34:e664:e399) |
| 20:15.12 | *** join/#debian uvolmer (~uvolmer@2001-4dd0-212c-fd-c06f-48c1-8-e719.ipv6dyn.netcologne.de) |
| 20:15.17 | *** join/#debian buzel (~buzel@unaffiliated/buzel) |
| 20:17.29 | *** join/#debian buzel (~buzel@unaffiliated/buzel) |
| 20:18.45 | *** join/#debian kreyren (~kreyren@fsf/member/kreyren) |
| 20:20.01 | *** join/#debian kreyren (~kreyren@fsf/member/kreyren) |
| 20:20.35 | akp55 | anyone here running asterisk inside of an LXD or a Docker container? what are your experiences? |
| 20:21.15 | *** part/#debian cybercrypto (~morpheus@gateway/tor-sasl/cybercrypto) |
| 20:25.40 | *** join/#debian HelloShitty (~narayan@bl20-171-222.dsl.telepac.pt) |
| 20:26.08 | *** join/#debian kreyren (~kreyren@fsf/member/kreyren) |
| 20:26.52 | *** join/#debian Bjornn (~Bjornn@2604:6000:1503:3ac:b5ea:3372:e4af:d11d) |
| 20:27.38 | HelloShitty | Hello guys. I need some urgent help. My laptop is complaining about free space running out. Are that any tools I can use to check which folders have more used space and try to see if I can delete any content |
| 20:27.43 | HelloShitty | ? |
| 20:27.44 | *** join/#debian pasiz (~pasiz@unaffiliated/pasiz) |
| 20:27.47 | *** join/#debian wvdakker (~wvdakker@mail.wilsoft.nl) |
| 20:28.11 | *** join/#debian magic_ninja (~sparkie1@unaffiliated/magic-ninja/x-4708782) |
| 20:28.13 | HelloShitty | I'm not getting some random errors, probably caused by lack of free disk space |
| 20:28.28 | HelloShitty | *I'm now getting... |
| 20:28.54 | *** join/#debian grummund (~unknown@unaffiliated/grummund) |
| 20:28.57 | alex11 | HelloShitty, du |
| 20:29.00 | HelloShitty | My Downloads folder is only a few hundreds of megabytes |
| 20:29.03 | *** join/#debian ChiLLabiS (~ChiLLabiS@unaffiliated/chillabis) |
| 20:29.11 | HelloShitty | also Doscuments folder is the same |
| 20:29.21 | alex11 | maybe it's stuff in /var/log |
| 20:29.43 | HelloShitty | alex11: that will force me to check folder by folder, no? |
| 20:29.49 | HelloShitty | Let me check /var/log |
| 20:30.41 | HelloShitty | jeezz, /var/log in fact has a few huge files |
| 20:30.46 | HelloShitty | this is the second time happening |
| 20:31.33 | HelloShitty | what are this multi gigabyte files named auth.log (22Gb) |
| 20:31.35 | HelloShitty | ? |
| 20:31.57 | HelloShitty | auth.log.1 |
| 20:32.01 | sponix | Nice |
| 20:32.42 | sponix | HelloShitty: might have a look at them before deleting -- to see what is filling them up so much |
| 20:32.51 | HelloShitty | btmp and btmp.1... About 6Gb each |
| 20:32.58 | *** join/#debian polyphem (~p0lyph3m@2a02:810d:640:776c:76d7:55f6:f85b:c889) |
| 20:33.09 | HelloShitty | Can I open a 22Gb file? |
| 20:33.23 | HelloShitty | Well, I have already deleted them no |
| 20:33.24 | sponix | HelloShitty: I would "tail -f auth.log" to just seen the end of it |
| 20:33.35 | HelloShitty | but still have btmp and btmp.1 |
| 20:33.41 | HelloShitty | let me take a look |
| 20:33.52 | sponix | HelloShitty: auth.log will recreate itself -- you should look at what is coming into the new one also |
| 20:34.21 | *** join/#debian paulgrmn (~paulgrmn@c-98-250-183-21.hsd1.mi.comcast.net) |
| 20:34.26 | HelloShitty | ok |
| 20:34.33 | HelloShitty | About btmp looks like ssh accesses |
| 20:34.57 | HelloShitty | What is this crap: |
| 20:34.59 | HelloShitty | .�� ssh:nottyroot67.205.153.4Þ¼g_CÍ� ssh:nottyroot119.45.187.6Þ¼g_w-�� ssh:nottyaccounts84.38.180.61Þ¼g_T&�=� ssh:nottyroot105.27.205.26Þ¼g_iâ� ssh:nottyroot181.143.226.67Þ¼g_���C� ssh:nottyroot122.51.50.84Þ¼g_z32T� ssh:nottyftpserver91.121.145.227Þ¼g_[y��� ssh:nottyroot189.8.95.30Þ¼g__!ssh:nottytest3164.90.194.205Þ¼g_�Z��^C |
| 20:35.21 | *** join/#debian milkt_ (~debian@gateway/tor-sasl/milkt) |
| 20:35.26 | sponix | HelloShitty: Yes, I would guess your machine is the victim of brute force ssh attempts repeating over and over trying to break in |
| 20:35.29 | *** join/#debian kreyren_ (~kreyren@fsf/member/kreyren) |
| 20:35.39 | HelloShitty | really? |
| 20:35.44 | sponix | YES |
| 20:35.52 | HelloShitty | What can I do to stop it? |
| 20:36.09 | sponix | I use to have 10-15,000 login attempts a day mostly from Malaysia :P |
| 20:36.23 | HelloShitty | Is this something on my computer running without me knowing? Like some trojan/virus/malware ? |
| 20:36.50 | HelloShitty | But this only happend twice like this year |
| 20:36.54 | HelloShitty | never had this problem |
| 20:36.57 | sponix | HelloShitty: ssh is used for remote shell access |
| 20:37.02 | HelloShitty | yes, I know |
| 20:37.30 | sponix | HelloShitty: I simply run my ssh on a non standard port 65534 and it cuts down these attempts greatly |
| 20:37.49 | HelloShitty | I think I'm also running it on a non standard |
| 20:37.53 | HelloShitty | but I'm going to check |
| 20:38.18 | *** join/#debian kreyren (~kreyren@fsf/member/kreyren) |
| 20:38.31 | sponix | It can be done at the rig, at the router, or both |
| 20:39.01 | *** mode/#debian [+l 1136] by debhelper |
| 20:39.27 | sponix | I also use "fail2ban" that uses iptables/netfilter/nftables or whatever to BLOCK access to anything attempting more than a few times |
| 20:42.39 | HelloShitty | that's more advanced stuff |
| 20:42.55 | *** join/#debian fb_ (~freebench@92.253.253.227) |
| 20:42.58 | *** join/#debian dvanmosselbeen (~dvanmosse@109.130.18.40) |
| 20:43.19 | sponix | Yeah, it requires a little setup. swapping the port to something other than the default of 22 is editing one line in /etc/ssh/sshd_config and restarting it |
| 20:43.44 | *** join/#debian winy (~vince@gre92-13-83-156-229-210.fbx.proxad.net) |
| 20:43.55 | sponix | Or if you don't plan to use ssh, just plain turning it off |
| 20:44.16 | *** join/#debian JohnML (~john1@ip-178-202-6-56.hsi09.unitymediagroup.de) |
| 20:44.19 | *** join/#debian ceska_ (~Cieska@31.124.204.89) |
| 20:45.09 | HelloShitty | that might be a solution |
| 20:45.15 | HelloShitty | but there are times when I use it |
| 20:45.20 | HelloShitty | I have to think about it |
| 20:45.28 | HelloShitty | actually these days I haven't been using it |
| 20:47.02 | *** join/#debian catman370 (catman@tilde.club) |
| 20:48.19 | sponix | HelloShitty: well it is easy to do the port thing, still use it, and it keeps _most_ of the attackers away. That takes less than 5 minutes and next to no effort |
| 20:48.55 | HelloShitty | but that's for someone used to mess with that stuff, which is not my case, sponix |
| 20:49.12 | LtL | HelloShitty: change port and use keys! don't lock yourself out. |
| 20:49.25 | HelloShitty | yeah, need to investigate a bit about this |
| 20:49.27 | karlpinc | Or turn off sshd (systemctl stop sshd ;systemctl disable sshd) and then start it (systemctl start sshd) when you need it. (Of course, once you're remote you can't reach the box to start it.) |
| 20:49.33 | sponix | LtL: Key auth only is GREAT, but hell just the port is a big step |
| 20:49.45 | LtL | very true |
| 20:50.03 | karlpinc | Key auth. But that won't stop the cracking attempts. |
| 20:50.08 | HelloShitty | gonna check which port is in sshd_config |
| 20:50.14 | sponix | HelloShitty: run that stop, sudo nano /etc/ssh/sshd_config and change the port from 22 to something else. then run the start command he listed -- done |
| 20:50.31 | sponix | HelloShitty: I already told you, it defaults to 22 :) |
| 20:50.35 | karlpinc | HelloShitty: But don't "disable" or it won't start at boot. |
| 20:50.37 | HelloShitty | I'm almost sure 22 is not the port being used |
| 20:50.41 | HelloShitty | I always change it |
| 20:50.43 | LtL | karlpinc: no it won't, the port change reduces attempts by 90+ per cent |
| 20:50.47 | HelloShitty | But I'll oble check |
| 20:51.02 | sponix | HelloShitty: you wouldn't be getting that many hits if it was on a good alt port IMHO |
| 20:51.13 | sponix | Not enough to have a 22GB auth.log LOL |
| 20:51.44 | karlpinc | LtL: I use pf on openbsd to rate-limit and block such cracking. |
| 20:51.55 | HelloShitty | yeah, port is not 22 |
| 20:52.02 | sponix | HelloShitty: Wow |
| 20:52.03 | karlpinc | LtL: Something centralized is "best". |
| 20:52.17 | sponix | karlpinc: I do fail2ban for similar on Linux |
| 20:52.22 | HelloShitty | sponix: what you mean "Wow"? |
| 20:52.45 | sponix | HelloShitty: I just suspected you were Wrong, and it was actually on port 22 anyway |
| 20:53.05 | HelloShitty | My ssh ? |
| 20:53.05 | karlpinc | sponix: Nice to do that sort of stuff at a single point of entry into your network is my recommendation. YMMV. |
| 20:53.16 | karlpinc | HelloShitty: ss -ltn |
| 20:53.39 | karlpinc | HelloShitty: And see what port sshd is listening on. |
| 20:53.47 | sponix | karlpinc: I am not a good security example. My rig is in the DMZ with no FW at all |
| 20:54.14 | karlpinc | sponix: :) Even the DMZ should be firewalled. |
| 20:54.36 | sponix | karlpinc: I wouldn't recommend my setup to others. But it is the way it is for a reason |
| 20:54.37 | HelloShitty | I got a table from that command, but no "ssh" text in it. However I can see my sshd_config port there |
| 20:54.52 | karlpinc | sponix: I know how that goes. |
| 20:55.43 | karlpinc | HelloShitty: Oops. Brain freeze. For some reason I thought you'd get processes. (lsof is called for) |
| 20:56.36 | karlpinc | HelloShitty: Anyway, that's pretty good confirmation that, unless somehow you're running 2 sshd daemons, you're configured like you think you are. |
| 20:57.21 | HelloShitty | In that 'ss' command output I see 2 lines using the same port I have configured in ssh_config |
| 20:57.59 | HelloShitty | karlpinc: so the port I have in sshd_config is actually the one being used, right? |
| 20:58.12 | HelloShitty | Not using 22 for some other unknown reason, I hope |
| 20:58.49 | *** join/#debian johnjay (~pi@38.120.10.99) |
| 20:58.53 | HelloShitty | What I can do is to change port again for another number. Not sure if that helps or not |
| 20:59.05 | *** join/#debian dionysus69 (~Thunderbi@unaffiliated/dionysus69) |
| 20:59.11 | karlpinc | HelloShitty: Right. |
| 20:59.13 | sponix | karlpinc: I'm gonna have to run lsof | wc -l to see how many thousands of lines that produces on my rig... I ran just lsof and it just now finished |
| 20:59.37 | HelloShitty | sponix: yeah, here too. I just cancelled it |
| 20:59.47 | HelloShitty | gonna change the port an restart the servie |
| 21:00.22 | sponix | HelloShitty: I gotta take the wife to work, but after I can walk you through fail2ban if you like |
| 21:00.40 | sponix | I only use it on my ssh, but should be putting it into place for my apache also |
| 21:01.00 | HelloShitty | I would appreciate sir. Thank you sponix |
| 21:01.05 | karlpinc | If I enable debian on my cromebook can I cut-and-paste with the mouse out of the linux side and into the chromebook side? I forget. |
| 21:01.07 | HelloShitty | I'll be around for probably 2 more hours |
| 21:01.37 | sponix | I will be gone for less than 20 minutes |
| 21:02.00 | HelloShitty | I have no idea karlpinc ... What I know is that I also have lots of problems using copy/paste from host to VMs and from temrinal windows to other places |
| 21:02.03 | HelloShitty | etc |
| 21:02.07 | karlpinc | I'm trying to get Microsoft Teams invitation urls sent by email off my imap server onto the cromebook where I will try to use MS teams. |
| 21:02.18 | HelloShitty | ok, I'll be around sponix |
| 21:02.36 | karlpinc | I suppose I could put a dirt-simple web email interface on my imap box. Any recommendations? |
| 21:03.02 | karlpinc | (I've resisted a web email interface for years....) |
| 21:03.24 | karlpinc | There's always a flash drive. But that's annoying. |
| 21:04.29 | jhutchins | !bts |
| 21:04.29 | dpkg | Bug Tracking System for Debian packages, http://bugs.debian.org/ or to go directly to the bug page for a particular package/bug, try http://bugs.debian.org/packagename or http://bugs.debian.org/bugnumber . aptitude install reportbug, and check out <querybts> too. Users of unstable and testing are required to check the BTS. See also <apt-listbugs>, <reportbug>. http://wiki.debian.org/HowtoUseBTS |
| 21:04.37 | HelloShitty | I'm of no help sire. sorry. I'm a very low average Linux user, unfortunatelly |
| 21:05.24 | *** join/#debian nsrafk (~inkognito@unaffiliated/nsrafk) |
| 21:05.37 | HelloShitty | brb |
| 21:06.19 | karlpinc | I guess the first step is to try MS Teams on the cromebook. It won't seem to run at all reliably using chromium on a Asus Aspire One running Debian. (Not too suprising, given how slow the box is. But still, a little strange.) |
| 21:06.46 | *** join/#debian tomg (~tomg@98-159-244-37.agas1a-dynamic.dsl.sentex.ca) |
| 21:09.13 | karlpinc | sqwebmail (courier webmail) seems to use the local mailboxes in Maildir format. (?) Which means accssing the box with a Unix-level password rather than the imap password. (yes?) I want to go through imap (or pop, if I had to). |
| 21:10.37 | karlpinc | I bet emacs on the chromebook would work. :) Then all I need to do is be able to cut-and-paste between the Linux side and the cromebook side. |
| 21:10.48 | karlpinc | wonders if emacs is in the app store |
| 21:12.44 | *** join/#debian HelloShitty (~narayan@bl20-171-222.dsl.telepac.pt) |
| 21:12.53 | karlpinc | Interesting. emacs is in the app store. But it does not seem to be maintained. (And who knows if it has the full emacs network access etc.) |
| 21:13.54 | sponix | wonders why anyone would punish themselves with emacs when vi exist |
| 21:14.03 | sponix | HelloShitty: Welcome back |
| 21:14.22 | HelloShitty | I'm here |
| 21:14.50 | HelloShitty | But I'm getting here an error but it's not related to lack of disk space. Because now I have some free space an the error still coming up |
| 21:14.56 | HelloShitty | but this is another matter |
| 21:15.09 | HelloShitty | I think it might be related to some irssi plugin I'm using |
| 21:15.31 | HelloShitty | Because the error is showing up on status window and also in one of my plugins window |
| 21:15.39 | HelloShitty | anyway |
| 21:16.48 | HelloShitty | I'll be around waiting for you |
| 21:17.27 | *** join/#debian dbristow (~dbristow@nylug/member/dbristow) |
| 21:17.59 | sponix | HelloShitty: what does this new error, and what is it related to ? |
| 21:18.20 | HelloShitty | I'm using a plugin in irssi called adv_windowlist |
| 21:18.35 | *** join/#debian ltl2 (~ltl@2604:2000:1382:4fe8::5) |
| 21:18.50 | HelloShitty | and the error is showing up in this adv_windowlist and also in irssi status window when I restarted irssi |
| 21:19.06 | HelloShitty | now the error is gone. at least it disappeared |
| 21:19.17 | sponix | think we can ignore that one |
| 21:19.31 | LtL | /me is anxious to see the error |
| 21:19.52 | sponix | HelloShitty: you are _sure_ that your sshd is running on an alt port now ? |
| 21:20.22 | HelloShitty | yes, at least I can see the port I chose on sshd_config in that 'ss' command output |
| 21:20.59 | sponix | HelloShitty: and when you go to connect to sshd with an ssh session - It now requires you to specify that alt port ? |
| 21:21.18 | HelloShitty | I can try |
| 21:21.31 | HelloShitty | I haven't tried to connect from outside of my home network |
| 21:21.45 | *** join/#debian grummund (~unknown@unaffiliated/grummund) |
| 21:22.01 | sponix | doesn't matter... you can ssh -p 65534 sponix@192.168.1.144 |
| 21:22.09 | sponix | or whatever |
| 21:22.27 | HelloShitty | like start a terminal and try to connect to myself? |
| 21:22.39 | sponix | sure, that works also |
| 21:22.44 | HelloShitty | ok |
| 21:23.33 | *** join/#debian buzel (~buzel@unaffiliated/buzel) |
| 21:24.27 | HelloShitty | it's saying connection refused even if I use the correct port |
| 21:24.43 | sponix | HelloShitty: and if you don't specify a port at all ? |
| 21:24.56 | HelloShitty | it says the same but for port 22 |
| 21:25.16 | sponix | what command are you typing exactly ? |
| 21:25.45 | *** join/#debian idlenode (~idlenode@gateway/tor-sasl/idlenode) |
| 21:25.47 | HelloShitty | I sent you a PM |
| 21:25.51 | HelloShitty | but I did |
| 21:26.13 | HelloShitty | ssh narayan@narayan, which is what I use on my laptop |
| 21:27.01 | *** join/#debian buzel (~buzel@unaffiliated/buzel) |
| 21:27.41 | *** join/#debian Ceber (~cerberus@94.31.98.152) |
| 21:28.15 | sponix | HelloShitty: so, when you "tail -f auth.log" is it still scrolling by 100 miles an hour ? |
| 21:29.09 | sponix | karlpinc: my lsof had 511750 lines in it LOL |
| 21:29.15 | HelloShitty | since I deleted it, it idn't self create again so far |
| 21:29.19 | *** join/#debian tmroland (~tmroland@host-92-0-141-217.as43234.net) |
| 21:29.41 | sponix | HelloShitty: odd, think doing ssh alone would create it again |
| 21:30.04 | HelloShitty | neither auth.log nor btmp nor btmp.. |
| 21:30.09 | HelloShitty | neither auth.log nor btmp nor btmp.1 |
| 21:30.10 | sponix | HelloShitty: seems as root you might have to simply "touch /var/log/auth.log" |
| 21:30.44 | HelloShitty | one |
| 21:30.46 | HelloShitty | done |
| 21:31.09 | HelloShitty | sorry if words that needs 'd' letter are missing it. My 'd' key is dying |
| 21:31.42 | sponix | I wonder what btmp even is -- I don't have that one |
| 21:32.03 | HelloShitty | That mess I pasted earlier here was from that file |
| 21:32.11 | HelloShitty | but I think auth.log had the same content |
| 21:32.26 | HelloShitty | I remember I checked the first this happened to me |
| 21:33.11 | HelloShitty | I tried to repeat the ssh login to port 22 like 50 times the fastest I could but no log in that auth.log file I just created |
| 21:33.17 | sponix | HelloShitty: So, do you want to just ride with this alt port in place for a bit and see if you are good. Or do you want to install and configure fail2ban also ? |
| 21:33.38 | HelloShitty | Let's see for how long this stays quiet |
| 21:33.52 | HelloShitty | tomorrow I'll check again |
| 21:34.02 | sponix | HelloShitty: sysemctl service sshd restart |
| 21:34.12 | HelloShitty | oki |
| 21:34.14 | sponix | HelloShitty: see if that works, I know very little of systemd |
| 21:34.23 | sponix | If it fails, I will have to google it lol |
| 21:34.48 | *** join/#debian SoulsForBelial (~SoulsForB@p200300f12f4c1c00821f02fffeaf6272.dip0.t-ipconnect.de) |
| 21:34.57 | *** join/#debian buzel (~buzel@unaffiliated/buzel) |
| 21:35.03 | HelloShitty | it's good |
| 21:35.06 | HelloShitty | active and sound |
| 21:35.56 | sponix | HelloShitty: well if that worked, try the ssh in again, see if anything appears in auth.log for it |
| 21:36.06 | HelloShitty | ok |
| 21:36.20 | sponix | HelloShitty: and you might just "tail -f /var/log/auth.log" in an open terminal to monitor connections anyway |
| 21:36.24 | sponix | for a while |
| 21:36.30 | genr8_ | cipherize, notice the use of SSHD alternate ports in an unrelated discussion immediately after you said it was useless. |
| 21:36.55 | sponix | genr8_: who / what ? |
| 21:37.17 | genr8_ | continue |
| 21:38.01 | *** join/#debian aps_ (~aps@2a02:908:df56:f8c0::5da4) |
| 21:38.06 | sponix | If you are pointing out that some don't agree with this practice..... I am aware of that |
| 21:38.30 | genr8_ | you misunderstood. |
| 21:38.50 | HelloShitty | nothing comes up in aut.log |
| 21:39.02 | sponix | HelloShitty: try "auth.log" instead :) |
| 21:39.10 | HelloShitty | logging in and out |
| 21:39.12 | genr8_ | the person named cipherize did not agree with the practice, and I was pointing out that it is in fact a useful practice by your real world example, not 1 hour later |
| 21:39.15 | HelloShitty | mkae no output in auth.log |
| 21:39.46 | HelloShitty | sponix: aut.log was a typo here |
| 21:39.53 | sponix | HelloShitty: the "syslogd" or rsyslog or whatever might need a respawn also... So a reboot might work |
| 21:40.09 | HelloShitty | reboot laptop? |
| 21:40.25 | sponix | HelloShitty: might want to "cd && /var/log" and "ls -l" to see that the user:group and permissions are correct |
| 21:40.45 | sponix | genr8_: I do a LOT of things people don't agree with, that just WORK despite what they say LOL |
| 21:41.51 | HelloShitty | most of the files in /var/log/ are owned by root |
| 21:42.18 | sponix | HelloShitty: and the new auth.log that you did "touch /var/log/auth.log" with ? you ran that command as root, correct ? |
| 21:42.22 | *** join/#debian buzel (~buzel@unaffiliated/buzel) |
| 21:42.24 | HelloShitty | and some by 'adm' |
| 21:42.28 | HelloShitty | yes, I did |
| 21:42.31 | HelloShitty | it's root:root |
| 21:42.39 | sponix | checks his |
| 21:42.43 | HelloShitty | -rw-r--r-- 1 root root 0 set 20 22:30 auth.log |
| 21:43.16 | *** join/#debian deltanedas (~deltaneda@5.134.95.67) |
| 21:43.25 | sponix | those permissions are a bit looser than mine, but should still work |
| 21:43.44 | sponix | HelloShitty: Yeah, hate to do it, but give it the old Windows reboot, then try to login with ssh again :) |
| 21:44.08 | HelloShitty | ok |
| 21:44.17 | HelloShitty | I need to stop some services first |
| 21:45.02 | *** join/#debian BenderRodriguez (~TaxDodger@unaffiliated/foxhoundz) |
| 21:45.13 | sponix | HelloShitty: my auth.log gets a lot of smb chatter too |
| 21:45.22 | HelloShitty | ok |
| 21:45.25 | HelloShitty | brb |
| 21:45.29 | HelloShitty | restarting |
| 21:45.33 | sponix | since I run 3 or 4 Windows File shares out to my Kids |
| 21:47.27 | genr8_ | i hope not over the web |
| 21:48.05 | sponix | lol.. I probably get attempts |
| 21:48.43 | *** join/#debian tgunr (~davec@dsl-dhcp-conrtxxahre-76-164-100-141.consolidated.net) |
| 21:50.52 | *** join/#debian HelloShitty (~narayan@bl20-171-222.dsl.telepac.pt) |
| 21:51.30 | sponix | HelloShitty: welcome back |
| 21:52.09 | HelloShitty | gimme a second to start a couple of services and I'll try ssh again |
| 21:54.31 | HelloShitty | yes, sponix now I can see some output in auth.log when I loggin |
| 21:55.16 | HelloShitty | but no output is sent to the file if the connection is refused (default port scenario) |
| 21:56.02 | *** join/#debian tmroland (~tmroland@host-92-0-141-217.as43234.net) |
| 21:56.27 | *** join/#debian yuta (~pi@PPPa4048.e13.eacc.dti.ne.jp) |
| 21:56.41 | sponix | HelloShitty: failed auth might go somewhere else, but if that is the case -- did all those others succeed ? LOL |
| 21:56.41 | *** join/#debian format_c (~format_c@unaffiliated/format-c/x-8927423) |
| 21:57.06 | genr8_ | if nothing is running on the default port, there is no auth to fail. its just silently dropped. |
| 21:57.20 | sponix | genr8_: yeah, just tested that -- good catch |
| 21:57.33 | HelloShitty | ok |
| 21:57.35 | sponix | HelloShitty: you are fine, as genr8_ just said -- that is now working as expected |
| 21:57.49 | HelloShitty | but why the other attempts were being logged? |
| 21:58.16 | HelloShitty | gonna try to mess the passwor to fail an attempt in the correct port |
| 21:58.20 | sponix | HelloShitty: I have to say either the attackers found your prior port -- OR I still believe that 22 was in use prior |
| 21:58.31 | sponix | one of the other |
| 21:58.32 | *** join/#debian tgunr (~davec@dsl-dhcp-conrtxxahre-76-164-100-141.consolidated.net) |
| 21:58.51 | HelloShitty | hum, I believe in the first one more |
| 21:59.54 | sponix | HelloShitty: doesn't matter much either way at this point. what does matter is you don't have a 22GB auth.log :) |
| 21:59.57 | *** mode/#debian [+o eir] by ChanServ |
| 21:59.58 | *** mode/#debian [-bo $a asdfdsaffd eir] by eir |
| 22:00.13 | HelloShitty | indeed |
| 22:00.18 | genr8_ | what port was it prior ? |
| 22:00.28 | HelloShitty | 6969 |
| 22:00.42 | genr8_ | thats probably why |
| 22:01.01 | sponix | lol |
| 22:01.14 | HelloShitty | too low number or because it's a peculiar number sexualy speaking? |
| 22:01.15 | HelloShitty | lol |
| 22:01.35 | genr8_ | common human pattern |
| 22:01.52 | HelloShitty | ok |
| 22:02.15 | sponix | mine has significance also, and shouldn't to be honest |
| 22:02.19 | HelloShitty | The other one I chose is kind of silly to, maybe.... I guess I«ll change it again for some random number |
| 22:02.32 | sponix | 65534 is one lower than the highest usable port on a system |
| 22:02.46 | HelloShitty | yes, I know |
| 22:02.50 | HelloShitty | so 6969 is kind low |
| 22:03.03 | HelloShitty | an if there are any tools to search for activity on ports |
| 22:03.08 | *** join/#debian alexandros_tab (~quassel@unaffiliated/alexandros-c/x-1684531) |
| 22:03.09 | *** join/#debian alexandros_c__ (~quassel@unaffiliated/alexandros-c/x-1684531) |
| 22:03.14 | HelloShitty | they will catch 6969 way sooner than 65534 |
| 22:04.21 | genr8_ | the discussion I was having before was me saying that the attackers only scan for known patterns, not all 65,535 ports on the system = to save time. but the other guy said i was wrong and they do scan everything. |
| 22:04.58 | HelloShitty | it makes sense |
| 22:05.10 | HelloShitty | same goes for ictionary attacks on passwordds |
| 22:05.30 | sponix | genr8_: that isn't a good argument. because it would depend on the attacker to make such a decision. Or how they script to do it for them |
| 22:05.33 | *** join/#debian magyar (~magyar@unaffiliated/magyar) |
| 22:05.41 | genr8_ | thats what he said. |
| 22:06.21 | genr8_ | but I see from experience that im only getting hit with scans on known ports, not the entire spectrum |
| 22:07.04 | sponix | genr8_: most will do the low 1024 range because that is where all "default" service ports fall -- or at least most excluding a few like squid proxy |
| 22:07.17 | sponix | So that is where they _start_ |
| 22:07.18 | genr8_ | yes that too |
| 22:07.31 | sponix | Then depends on their level of time and devotion to move on to other things |
| 22:07.38 | genr8_ | perhaps if your system shows up with something open, they flag it for deeper full scans. |
| 22:09.01 | *** mode/#debian [+l 1130] by debhelper |
| 22:09.49 | genr8_ | theres other things you can do, like use key-based SSH, set up port knocking, IP whitelisting, fail2ban, what else |
| 22:10.22 | genr8_ | Im probably staying off their radar better from the start |
| 22:10.27 | HelloShitty | I'll see about fail2ban |
| 22:10.33 | HelloShitty | nee to read a bit about it |
| 22:11.10 | sponix | HelloShitty: sure... read what it can do for ssh. See if you feel it is needed |
| 22:11.21 | HelloShitty | yeah |
| 22:11.37 | sponix | HelloShitty: if you want to learn it, only accepting ssh "key based auth" and not even allowing passwords -- Is actually WAY secure |
| 22:12.00 | sponix | HelloShitty: I don't do that though, because I have a program on my phone that only does ssh password auth and not keys :P |
| 22:12.05 | HelloShitty | yes, I remember doing something like tha tin the past |
| 22:12.17 | HelloShitty | ahh ok |
| 22:13.45 | sponix | genr8_: I am surprised my port 80 Apache is only getting a handful of random attempts to check its security |
| 22:15.09 | genr8_ | yeah, i always check what theyre trying to attack/request and its always irrelevant stuff. |
| 22:16.16 | genr8_ | and i put my wordpress blog behind a /blog/ subdir and it seems to have helped a lot. theyre not finding it |
| 22:16.54 | sponix | genr8_: good thing we are looking at logs.. my samba running on default ports -- 39,000 attempts LOL |
| 22:17.06 | imMute | sponix: is it possible to only allow password auth for one user and have the phone program use a special user? |
| 22:17.08 | genr8_ | yea thats no bueno. |
| 22:17.29 | genr8_ | yes but that doesnt help. |
| 22:17.56 | sponix | imMute: Yes, that is possible in the sshd_config you can specify only 1 user, or a single group, and a lot of other restrictions. You wan also limit to to only allow certain network ranges |
| 22:18.21 | sponix | ssh and sshd are well thought out, and have a LOT of security baked in |
| 22:19.21 | sponix | genr8_: sure it does, I will just take whatever ports smb uses by default from the outside world, and point them to some place void, so they don't come through from outside my network anymore :) |
| 22:19.54 | sponix | SAMBA uses ports 137 â 139 and 445. |
| 22:20.54 | *** join/#debian dez (uid92154@fedora/deSouza) |
| 22:21.26 | genr8_ | yes, you definitely shoulda taken that into account earlier. |
| 22:22.27 | genr8_ | i meant allowing password auth for only 1 user doesnt help. youll still get the failed attempts in the log |
| 22:24.28 | genr8_ | if anything you should use "PermitRootLogin prohibit-password" |
| 22:25.30 | genr8_ | thats the best option other than strict "PasswordAuthentication no" for everything |
| 22:26.00 | imMute | IMO you shouldn't allow root for SSH at all |
| 22:26.13 | sponix | hmm, I had better test and see of the fw rule on my router just does from outside in, or if it is going to block internally with the rules I set :P |
| 22:26.39 | sponix | imMute: it is no longer allowed by default as of like 2008 or so |
| 22:26.47 | *** join/#debian thiras (~thiras@unaffiliated/thiras) |
| 22:27.03 | sponix | the wording for that in sshd_config isn't as clear as it use to be at this point. I had to look it up to be sure |
| 22:27.12 | another | imMute: and why exactly? |
| 22:27.40 | imMute | another: because you shouldn't need to log in as root ever. sudo is better. |
| 22:27.55 | another | i disagree |
| 22:28.11 | another | but i don't have time to argue. good night :) |
| 22:28.56 | genr8_ | root with a key is fine. just dont lose the key. and put a password on the key if you do lose it. |
| 22:33.43 | karlpinc | I disagree also. The problem with sudo is that only a single set of credentials is required to become root -- user-level credentials. |
| 22:34.07 | karlpinc | Naturally, much depends on how sudo is configured as to its benefits. |
| 22:34.53 | *** join/#debian SoulsForBelial (~SoulsForB@p200300f12f4c1c00821f02fffeaf6272.dip0.t-ipconnect.de) |
| 22:35.28 | imMute | karlpinc: that's no different than allowing root to login directly. |
| 22:35.48 | imMute | at least with sudo what commands a user ran gets logged. and *which* user if there are more than one. |
| 22:36.15 | sponix | genr8_: see what you got started :) |
| 22:37.13 | *** join/#debian karabaja4 (~karabaja4@dh207-95-229.xnet.hr) |
| 22:37.31 | genr8_ | id rather have root with a key only than a user with a password and sudo |
| 22:38.09 | genr8_ | the default of no root ssh ever is a sane default though |
| 22:38.19 | genr8_ | I guess itll be up for debate until the end of time |
| 22:38.40 | imMute | I'd rather have a user with a key and sudo. |
| 22:42.41 | *** join/#debian nickname123 (~nickname1@adsl-84-227-65-72.adslplus.ch) |
| 22:45.26 | sponix | lol... that worked |
| 22:45.59 | sponix | genr8_: I have my router now taking any attempts on 137-139 and 445 and sending them to 65532 on my rig ( does nothing) |
| 22:46.00 | *** join/#debian bmlzootown (~bmlzootow@unaffiliated/bmlzootown) |
| 22:46.23 | sponix | genr8_: but only from the outside world, so my internal shares in the house still work :) |
| 22:46.54 | sponix | now to clean up the logs from the prior 39,000 attempts |
| 22:48.11 | sponix | sponix@sponix:/var/log/samba$ sudo rm *log* |
| 22:48.11 | sponix | sudo: unable to execute /usr/bin/rm: Argument list too long |
| 22:48.28 | sponix | ha.. too many of them to delete I guess :P |
| 22:48.39 | imMute | find . -type f -name '*log*' -delete |
| 22:49.49 | *** join/#debian wilson (~wilson@unaffiliated/wilson) |
| 22:49.51 | sponix | I just did it as actual root instead of sudo, and it worked fine |
| 22:50.10 | sponix | I hope all of those prior attempts failed |
| 22:50.36 | sponix | Interwebs is a scary place |
| 22:51.26 | LtL | sponix: you do use logrotate, yes? # logrotate -f /etc/logrotate.conf # lf gzipped logs get deleted |
| 22:52.12 | LtL | don't know ehere the 'lf' came from, fickle finger syndrome |
| 22:52.22 | *** join/#debian luuuciano_ (~luuuciano@unaffiliated/luuuciano) |
| 22:52.41 | LtL | old logs get deleted after x weeks |
| 22:54.05 | sponix | LtL: Debian might have log rotation by default, but this smb.conf does a separate log file for every IP that makes a connection attempt -- thus the 39,000 was individual IP's -- some of those could have been multiple attempts also :P |
| 22:55.08 | LtL | sponix: ah, okay i forgot about smb |
| 22:59.02 | *** mode/#debian [+l 1123] by debhelper |
| 22:59.21 | genr8_ | this freaking kernel is still compiling.... 2 hours |
| 22:59.53 | genr8_ | I guess it doesnt help that I did it inside a VM, but damn, I thought i disabled enough stuff to speed this up |
| 23:00.42 | sponix | genr8_: people still compile kernels in 2020 ? |
| 23:00.55 | tmroland | how do you think your pc is running? |
| 23:02.15 | sponix | my "PC" runs on Smoke |
| 23:02.27 | sponix | as long as I don't let any of the smoke outta it -- it should keep on running |
| 23:02.49 | genr8_ | this is part of taking the debian 4.19 kernel, seeing whats in it, removing 60% of the crap and understanding what else I can enable to help the security posture |
| 23:03.30 | *** join/#debian dvs (~hibbard@cwv.teksavvy.com) |
| 23:03.41 | sponix | genr8_: have fun with that |
| 23:05.00 | *** join/#debian SoulsForBelial (~SoulsForB@p200300f12f4c1c00821f02fffeaf6272.dip0.t-ipconnect.de) |
| 23:05.36 | *** join/#debian d1cor (~diego@unaffiliated/d1cor) |
| 23:07.55 | genr8_ | aaand it errored out. |
| 23:08.08 | genr8_ | i had to open my mouth just now didnt I. it knew. |
| 23:08.51 | *** join/#debian kafir (kafir@gateway/vpn/privateinternetaccess/kafir) |
| 23:09.36 | *** join/#debian x000 (~x000@unaffiliated/x000) |
| 23:09.55 | sponix | genr8_: I have a LONG way to go on even basic security before I find myself having the time to do custom kernels |
| 23:10.11 | cipherize | Or even the need. |
| 23:10.20 | sponix | true |
| 23:10.35 | sponix | last time I knew damn near everything was a Module anyway |
| 23:11.15 | genr8_ | the ABI interface is still there for useless modules to be loaded and exploited |
| 23:11.33 | cipherize | Doesn't matter how you compile the kernel, that's always going to be there. |
| 23:12.10 | genr8_ | im trying to use CONFIG_TRIM_UNUSED_KSYMS=y |
| 23:13.20 | genr8_ | also signing all the modules, so the old ones cant be loaded |
| 23:14.00 | genr8_ | if I was an expert i'd explain it, but im trying to figure it out by trial and error cause nobody gives a shit but me, and anyone who does doesnt stay sane enough to tell the tale |
| 23:14.01 | sponix | genr8_: starting out with OpenBSD could save time over all :) |
| 23:14.12 | genr8_ | true |
| 23:15.13 | *** join/#debian flayer (~a_flayer@2001:1c01:40ce:b400:16da:e9ff:fe04:1768) |
| 23:15.15 | sponix | my rig doesn't have to be the spitting image of security -- it just has to be better than HelloShitty -- so they leave me alone and concentrate on them !! |
| 23:15.34 | HelloShitty | :) |
| 23:18.47 | *** join/#debian sinaowolabi (~Sina@102.134.114.1) |
| 23:20.31 | *** join/#debian jess (jess@bitbot/jess) |
| 23:23.26 | *** join/#debian mcossey (Mcossey@gateway/vpn/mullvad/mcossey) |
| 23:23.33 | genr8_ | Is there a channel to discuss better security stuff to do, from noob level of locking down SSH up to compiling your own kernel and everything in between ? |
| 23:28.27 | *** join/#debian cheet (~cheet@modemcable246.155-226-192.mc.videotron.ca) |
| 23:31.57 | *** join/#debian fstd_ (~fstd@unaffiliated/fisted) |
| 23:32.28 | genr8_ | oh i think it actually did finish compiling, but it finished with an error, and theres no indication why or what to do next ;p typical |
| 23:36.48 | dvs | genr8_: compiling a kernel is easy now. Just install the build-essential package then download and unpack the kernel source from kernel.org, then run "make deb-pkg" in the unpacked kernel directory |
| 23:37.43 | joepublic | well, you have to either make a kernel config, or copy over the default one. |
| 23:37.53 | genr8_ | thats for the master tree. I was compiling the debian version. as described here: https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#s-common-official |
| 23:38.06 | joepublic | and if you copy over the default one, then you will have to chase down the error about not having a debian developer signers key |
| 23:38.33 | dvs | ??? that's never happened to me |
| 23:38.38 | genr8_ | I have the config, and I have the vmlinux and the .mod's compiled , but it errored out after checking a buncha EXPORT_SYMBOLS and wont say why |
| 23:38.44 | joepublic | you made a kernel with no .config? :) |
| 23:38.56 | genr8_ | I have the config. |
| 23:39.02 | *** mode/#debian [+l 1116] by debhelper |
| 23:39.13 | genr8_ | The debian version includes about 200 patches |
| 23:39.16 | dvs | joepublic: I start with the config in the /boot directory then run "make oldconfig" |
| 23:40.48 | genr8_ | buildcheck.py seems to be whats errored out. |
| 23:41.49 | genr8_ | I think its because of my trying to trim the unused module symbols out |
| 23:43.42 | *** join/#debian winy (~vince@gre92-13-83-156-229-210.fbx.proxad.net) |
| 23:44.41 | genr8_ | well this was fun until it became an enigma. I was hoping this would just work. |
| 23:45.14 | *** join/#debian madage (~madage@gateway/tor-sasl/madage) |
| 23:47.36 | *** join/#debian zeden (~user@unaffiliated/zeden) |
| 23:51.01 | *** join/#debian Immanuel (~Manu@dynamic-adsl-94-34-1-76.clienti.tiscali.it) |
| 23:55.25 | *** join/#debian diniwed (~gavron@45.134.22.11) |
