IRC log for #gllug on 20091105

00:07.52z00daxspams everyone on the facebook group
00:08.31DiscordianUK?
00:15.43wethrinz00dax: Reckon it'll get people in?
00:17.13*** join/#gllug nixofortune_1 (n=egor@87.127.26.43)
00:24.34*** join/#gllug Leeds (n=richardc@n219078221168.netvigator.com)
00:50.56*** join/#gllug Discordian (n=ch@89.240.95.67)
01:36.08*** join/#gllug les (n=celesteh@host86-147-24-31.range86-147.btcentralplus.com)
01:57.12*** join/#gllug rhowe (n=rhowe@2002:4e20:3f1b:0:0:0:0:1)
02:58.49*** join/#gllug Leeds (n=richardc@www.scorefive.com)
03:30.50*** join/#gllug Leeds (n=richardc@www.scorefive.com) [NETSPLIT VICTIM]
03:30.52*** join/#gllug Nafallo (n=nafallo@ubuntu/member/nafallo) [NETSPLIT VICTIM]
03:30.52*** join/#gllug MrKen (n=mj@zen.pimp.org.za) [NETSPLIT VICTIM]
03:30.52*** join/#gllug AndyMillar (n=andy-fre@caffeine.andymillar.co.uk) [NETSPLIT VICTIM]
03:30.52*** join/#gllug Provito (n=Provito@82-44-113-11.cable.ubr16.enfi.blueyonder.co.uk) [NETSPLIT VICTIM]
03:30.52*** join/#gllug agk__ (n=agk@66.187.227.200) [NETSPLIT VICTIM]
03:30.52*** join/#gllug Guest75096 (n=andrew@80.68.89.21) [NETSPLIT VICTIM]
03:30.52*** join/#gllug gregj (n=gj@pointblue.com.pl) [NETSPLIT VICTIM]
03:30.52*** join/#gllug MoZes (n=mozes@bourbon.biscuit.org.uk) [NETSPLIT VICTIM]
03:32.15*** join/#gllug Guest63061 (n=celesteh@host86-147-24-31.range86-147.btcentralplus.com) [NETSPLIT VICTIM]
03:32.15*** join/#gllug Discordian (n=ch@89.240.95.67) [NETSPLIT VICTIM]
03:32.16*** join/#gllug nixofortune_1 (n=egor@87.127.26.43) [NETSPLIT VICTIM]
03:32.16*** join/#gllug zeroXten (n=zeroXten@0x10.co.uk) [NETSPLIT VICTIM]
03:32.16*** join/#gllug popey (n=alan@ubuntu/member/pdpc.gold.popey) [NETSPLIT VICTIM]
03:32.16*** join/#gllug Dominic (n=dominic@chaldene.m0dlx.com) [NETSPLIT VICTIM]
03:32.16*** join/#gllug antiphase (n=ant@89.16.173.22) [NETSPLIT VICTIM]
03:32.16*** join/#gllug wethrin (i=dankolb@93.93.131.12) [NETSPLIT VICTIM]
03:32.16*** join/#gllug jpds (n=jpds@ubuntu/member/jpds) [NETSPLIT VICTIM]
06:29.08*** join/#gllug DiscordianUK (n=ch@78.144.173.243)
08:21.05AndyMillarmornin
08:21.24DiscordianUKmorning on this chilly day
08:26.19AndyMillarit is pretty chilly
08:26.42Leedshttp://tinyurl.com/yk6kux7 - when you can't get your hands on a sword...
08:33.57*** join/#gllug Discordian (n=ch@78.144.173.243)
09:07.47ChoHag_Mmmm. Clarity in documentation - When specifying the mode, the value can be a quoted string, eg "644". For a numeric value, it should be 5 digits, eg "00644"
09:39.39MohanMorning
09:54.37*** join/#gllug jpds (n=jpds@ubuntu/member/jpds)
09:57.24z00daxwethrin: not sure, atleast it gets the msg out there that stuff is happening
10:31.35*** join/#gllug morsing (i=morsing@emil.morsing.cc)
10:31.40morsingAnyone used auditing?
10:31.45*** join/#gllug Blapto (n=martin@72.29.67.3)
10:31.51morsingBlapto:
10:31.54morsingBlapto!
10:31.59Blaptomorsing:
10:32.00Blaptomorsing!
10:32.23morsingBlapto: How's the kids?
10:33.04BlaptoI'm not sure.  I don't think I have any.
10:33.32morsing:(
10:33.33ChoHag_Well aren't you in for a surprise.
10:33.34morsingPoor you
10:33.58morsingBlapto: Why does auditd log stuff even though there's no rules defined?
10:34.07Blaptomorsing: it's a promiscuous hussy.
10:34.18morsing...
10:34.50BlaptoI've no idea.
10:34.55BlaptoI don't use auditd
10:34.57z00daxmorsing: is it logging selinux stuff ?
10:35.02BlaptoAnd the guy here who was RHCE has left.
10:35.03morsingNo
10:35.19morsingBlapto: I don't blame him, it's a hostile environment
10:35.30BlaptoAgreed
10:36.01z00daxspecially with random kids around
10:37.25Blaptorandom or arbitrary?
10:37.51morsingBlapto: Where do you work?
10:37.56BlaptoTicketmaster
10:38.12morsingBlapto: How did you achieve PCI compliancy without setting up auditing?
10:38.35BlaptoWe syslog off the important stuff in /var/log
10:38.38BlaptoAnd we syslog shells
10:38.48BlaptoAnd we have scripts which go through those and look for unusual stuff.
10:38.49morsingBlapto: You have a shell control box?
10:38.59ChoHag_Blapto: That sounds exceptionally noisy.
10:39.01Blaptojumpbox?  No, people SSH directly to the server they work on.
10:39.08morsingPCI does call for auditing stuff although they might be lenient
10:39.25BlaptoChoHag_: It was to start with, but with some rules in place it's fine.
10:39.42morsingBlapto: Yes, but through a transparent shell control box, surely, as Unix can log shell stuff securely
10:40.02BlaptoWell, you could do that
10:40.03BlaptoWe don't
10:40.03morsingBlapto: Also, PCI:DSS doesn't allow ssh'ing directly onto the box
10:40.10BlaptoYes it does.
10:40.15BlaptoIt doesn't allow direct console access.
10:40.19BlaptoWhich is probably what you're thinking of.
10:40.30morsingNot without making their PCs compliant, which is impossible
10:40.49BlaptoWell, no it isn't.
10:40.50morsingBlapto: You cannot have people sshing from their laptops in...
10:40.57BlaptoAnd no, you don't really have to.
10:41.01BlaptoWhat requirement is that?
10:42.11BlaptoYou could argue that they're on the same network and therefore in the cardholder data environment, but in our case we're not on the same network, we're separated by a VPN and a firewall.
10:46.17morsing"The PCI DSS security requirements apply to all system components. .System components. are defined as any network component, server, or
10:46.20morsingapplication that is included in or connected to the cardholder data environment."
10:46.42morsing"The effect of this is that
10:46.42morsingA) Any server, router, firewall, switch, pc, application, etc that processes, stores or transmits card data falls into the CDE.  
10:46.46morsingB) Where a network is not segmented this can mean that the entire network environment must be PCI compliant.  
10:46.49morsingC) Where sufficient segmentation exists, through the use of firewalls and other technologies, then the CDE can be limited.
10:46.51morsingD) Any device which connects to any device within the CDE is in scope for PCI DSS, but is not necessarily part of the CDE.
10:46.54morsing"
10:47.24*** join/#gllug DiscordianUK (n=ch@78.144.173.243)
10:47.27morsingD would fail your setup for sure
10:47.27Alexla la la la la la la la la la la pci dss la la la la.
10:48.40morsingAnyway, can anyone answer my auditing question?
10:50.09antiphaseYou essentially need a segregated network for machines which store or handle cardholder data, and 2 factor authentication for access to them, of which a bastion host counts as one
10:50.10Blaptomorsing: D doesn't mean it has to answer all requirements
10:50.18morsingYes, it does
10:50.23BlaptoNo, it doesn't
10:50.25morsingYes, it does
10:50.27antiphaseIf you don't segregate your PCI-compliant network, your entire network will come into scope
10:50.29morsing10:48 < morsing> Anyway, can anyone answer my auditing question?
10:50.38BlaptoA lot of the requirements only apply to servers and devices in the CDE.
10:51.03morsingBlapto: Yes, but PCI:DSS still applies to your laptop if you SSH in
10:51.32BlaptoYes, but only the requirements which aren't CDE specific.
10:51.32Alexto be fair, who the sshes in direct to production hosts, rather than via a trusted host?
10:51.42morsingBlapto: *sigh* well, *obviously*
10:51.44BlaptoAlex: most people.
10:51.48Blaptomorsing: yes, not all requiremenst
10:51.58morsingBlapto: No, not in proper companies
10:52.02ChoHag_Most people who like their boxes being screwed.
10:52.04morsingBlapto: *sigh*
10:52.04antiphaseMost people don't unless they have shit for brains
10:52.05Blaptomorsing: yes, really, they do.
10:52.07morsing10:48 < morsing> Anyway, can anyone answer my auditing question?
10:52.23BlaptoApparently not.
10:52.31Blaptohave you tried reading the man page?
10:52.33Alexmorsing: Truss audit executable, see if it's loading some file that you don't know about 'cause rhel has screwed around with package?
10:52.54ChoHag_Anyway it's not hard to run ssh through a socks proxy on a bastion box.
10:52.58morsingAlex: auditctl -l says "No rules"
10:53.05ChoHag_Where said socks proxy is itself created by ssh.
10:53.06AlexAlso, something massively more important. Some gobshoite infront of me is whistling.
10:53.11AlexHow do I most effectively kill this person?
10:53.23BlaptoAlex: normally you'd politely ask them to stop.
10:53.30AlexBlapto: That wasn't my question
10:53.32ChoHagAlex: With poison.
11:02.07wethrinPoison dart to the back of the neck
11:22.32morsingHow do I get auditd to log stuff done to any file?
11:26.11antiphaseman auditd.conf
11:27.52morsingantiphase: Not there
11:28.40antiphaseYour question was inspecific
11:29.01morsingNo, it wasn't
11:29.27AlexI don't think 'inspecific' is a word.
11:29.50morsingLooks like it can't be done. How useless
11:30.14antiphase"log stuff done to any file" can mean at least 2 things
11:31.28wethrin(log stuff done) to any file
11:31.32wethrinlog stuff (done to any file)
11:31.55antiphaseGold star
11:32.12morsingwethrin: 10.2.7 in PCI:DSS
11:32.27morsingantiphase: And you know what I mean
11:32.28wethrinThat's nice.
11:33.18morsingAlso 10.2.2
11:33.57wethrin(not having to care)++
11:33.58morsingLinux sucks once again
11:34.14DiscordianUKNo it doesn't
11:34.24morsingDiscordianUK: Tell me how to do it, then?
11:34.46wethrinhttp://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html
11:34.48DiscordianUKantiphase has already referred you to the man page
11:34.53antiphaseUse AIX and realise there's no way of doing it at all, which you can tell your "customer"
11:34.55morsingDiscordianUK: Idiot
11:35.06morsingantiphase: Quite easy in AIX
11:35.11DiscordianUKDullard
11:35.22wethrinactually, the man page for auditd doesn't give the necessary information for that task
11:35.22morsingwethrin: That's *one file*
11:35.57morsingaudit on Linux can't even log new files created...
11:36.09morsingAbsolutely useless
11:36.19wethrinhttp://www.ibm.com/developerworks/linux/library/l-ubuntu-inotify/index.html?ca=drs-
11:36.49morsingThere's also something called aide I found, but haven't looked at it
11:37.03DiscordianUKaide is like tripwire
11:37.16morsingright
11:37.17haliyou can log any syscall, i.e. open
11:37.57DiscordianUKand there's fam which works with inotify
11:37.57morsinghali: Oh, yes, good point
11:37.57morsingIt might be under syscall auditing
11:38.02halithat will give you *loads* of entries though
11:38.04wethrinah yes. It's fam I couldn't remember the name of
11:38.09wethrinhali: grep is your friend :)
11:38.39halisyslog-ng and filter out the noise
11:39.38morsinghali: Well, don't want to log 'open' but whatever creates or deletes files
11:39.45morsingAnd some other stuff
11:39.51halicreate is an open()
11:40.03morsingOk, silly
11:40.06morsinghmm
11:40.21halirm is probably unlink or unlinkat
11:40.44morsingyeah
11:41.35morsingThere's a link syscall
11:41.39morsinghttp://www.digilife.be/quickreferences/QRC/LINUX%20System%20Call%20Quick%20Reference.pdf
11:41.53morsingOh, and 'create'
11:41.58morsingOh, this should work
11:50.58morsingantiphase: Where's bilarh?
11:51.30bilarhhow the f is he supposed to know?
11:51.36morsingbilarh!
11:51.48morsingHe's your flatmate?
11:52.38*** join/#gllug hali (n=hampus@emma.dnsdrift.net)
12:11.45ChoHagWhat shall I have for lunch?
12:11.58antiphaseBranes
12:12.41ChoHagI am not a zombie.
12:32.06*** join/#gllug dick_turpin (n=dick_tur@host217-34-163-30.in-addr.btopenworld.com)
12:32.54morsingdick_turpin!
12:33.00morsinghali!
12:33.17dick_turpinmorsing: Ooh ello there
12:34.32morsingdick_turpin: What did you have for lunch?
12:35.33dick_turpinmorsing: antiphase's hopes and aspirations
12:35.47morsingNice
12:38.17wethrindick_turpin: I see you've been trolling Gllug again!
12:38.35dick_turpinwethrin: Mwahahaha
12:39.21dick_turpinwethrin: Its because I'm having a particularly heavy period this month
12:39.31wethrinBTW, your post is wrong. It's *next* year that's the year of Linux on the desktop
12:39.38wethrinNot "Is this year...."
12:42.03dick_turpinwethrin: Funk Off
12:42.52morsingBeer
12:42.59morsingwethrin: Where's VegiVamp?
12:43.00wethrinHeh
12:43.51wethrinI'm always amusing when people say 'standards-compliant browser', and then talk about Firefox
12:44.01halidamn that was a nice wrap... east end wrap with salt beef and english mustard :P
12:45.50wethrins/amusing/amused/
12:47.11dick_turpinwethrin: Erm it was me dragged FF up but I was using that as an example. TBH the original post I responded too was just pure MS FUD anyway
12:47.22AndyMillareveryone should use elinks
12:47.26morsingWhere do you get pallets and what do they cost?
12:47.53wethrindick_turpin: It's not just you :)
12:48.14wethrinidly points out that Chrome and Safari pass the ACID3 test
12:48.22wethrinand Opera
12:49.14wethrinmorsing: I assume you've googled 'pallets', and looked at what's come up?
12:49.26morsingGoogled?
12:50.04wethrinhttp://lmgtfy.com/?q=pallets
12:50.22morsingwethrin: Stop being rude
12:51.03wethrinthen look at the sponsored links
12:51.11morsingNo prices
12:51.24wethrinphone them and ask
12:51.29morsingNo - you do it
12:51.32wethrinNo.
12:51.40wethrinYou're the one who wants the pallets
12:51.53morsingBut I'm asking you what they cost
12:52.08wethrinMany suppliers don't provide prices, because they make quotations on-demand
12:52.29wethrinDunno. Never bought pallets. Never had any need to.
12:52.31morsingCould just build one I suppose
12:52.51morsinghttp://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=250522889826&ssPageName=STRK:MESELX:IT
12:54.13morsingSetting syscall=creat doesn't log creating a file :(
12:54.44dick_turpinstarts to cry as we are back to square one again
12:54.56*** part/#gllug morsing (i=morsing@emil.morsing.cc)
12:57.07dick_turpinBwahahahaha
12:58.02dick_turpinantiphase: That was awesome how did you manage that without even saying a word?
13:08.49antiphasePhear my awesome skillz
13:10.01AndyMillarwonders if it's wrong to use t'office comms room to lie down in and stretch your back
13:10.33dick_turpinAndyMillar: Get up you lazy git
13:10.45AndyMillar:p
13:11.39dick_turpinwethrin: you know them pallets...............
13:13.49AndyMillardick_turpin: it was only for 2 mins
13:15.11dick_turpinThat's what the Mayor of Nagasaki said "Well it was a bit hot for two minutes then the phones stopped ringing and I was out of a job"
13:21.56ChoHagAlmond über alles.
13:23.46ChoHagThis cake's not even very good yet it's delicious.
13:42.32*** join/#gllug celesteh (n=celesteh@sblug/member/celesteh)
13:42.56*** join/#gllug DiscordianUK (n=ch@78.144.173.243)
14:08.34Mohanhttp://www.tuxradar.com/content/vista-windows-7-ubuntu-904-and-910-boot-speed-comparison
14:10.34jpdshttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=554573
14:29.43wethrindick_turpin: What about them pallets?
14:30.18dick_turpinwethrin: We all know you're the pallet expert
14:31.45wethrinheh
14:32.42dick_turpinEveryone knows wethrin has a pallet fetish
15:06.12*** join/#gllug stu_ (n=stu@dyn1247-111.vpn.ic.ac.uk)
15:07.39*** join/#gllug Leeds (n=richardc@n219078221168.netvigator.com)
15:16.19*** join/#gllug shai (n=Shai@l192-117-110-233.cable.actcom.net.il)
15:51.52*** join/#gllug jpds (n=jpds@ubuntu/member/jpds)
16:26.24Mohanhttp://pastebin.com/m26e9dfb8
16:27.17MohanIs there a sysctl.conf setting which i could change which could help improve apaches performance ?
16:28.38BlaptoLooks like you need more workers.
16:34.40MohanIs it ok to increase the max connections > 256, wouldn't it kill the server ?
16:36.38antiphaseYou need workers/children to service the requests otherwise connections will just wait until there's a worker/shild free to service it
16:46.06bilarhjust remember that in the west, for the most part, child labour is illegal
16:47.40ChoHagMore's the pity.
16:48.38MrKenbilarh: Only if you tell! Keep 'em in the basement
16:48.48ChoHagMrKen: Austrian?
16:49.04ChoHag</bad-taste>
16:49.04MrKenChoHag: How'd you guess?!
16:49.25MrKenChoHag: I was tempted to add "(as Josef Fritzl would say)" but decided not to :P
16:49.44MohanAny recommended figures for max connections ?
16:50.02ChoHagWhy should there be a max?
16:50.15ChoHagOh you're back on Apache.
16:50.16wethrinResources
16:51.47Mohanload is less than 0.5 for the above load, dual core dual xeon 2GHZ with 4GB RAM
16:53.47Mohancurrent max conn=256, clients=4000
16:56.13MohanIt works fine under normal circumstances but when there is sudden spikes its just couldnt cope up with it.
16:57.36Mohanthe load is indeed balanced by a LB, and there are 2 nodes underneath it.
17:10.09*** part/#gllug dick_turpin (n=dick_tur@host217-34-163-30.in-addr.btopenworld.com)
17:17.52*** part/#gllug Blapto (n=martin@72.29.67.3)
18:05.13*** join/#gllug Armand|Lappy (n=me@host86-137-212-253.range86-137.btcentralplus.com)
18:53.06*** join/#gllug Armand|Lappy (n=me@host86-137-212-253.range86-137.btcentralplus.com)
19:35.05AndyMillarMohan: maxclients should be such that apache_process_size*maxclients never exceeds free_ram
19:35.58AndyMillarMohan: as otherwise, once you start to hit maxclients, you start to swap, load goes through the roof and your server dies
19:43.47*** join/#gllug dick_turpin (n=dick_tur@static-87-243-206-72.adsl.hotchilli.net)
20:10.32*** join/#gllug DiscordianUK (n=ch@78.144.173.243)
20:42.52*** part/#gllug dick_turpin (n=dick_tur@static-87-243-206-72.adsl.hotchilli.net)
21:33.53*** join/#gllug kkwak (n=kkwak@92.17.40.68)
22:20.33*** join/#gllug DiscordianUK (n=ch@78.144.173.243)
22:21.41MohanAndyMillar: how do i determine apache_process_size ?
22:25.35MohanAndyMillar: apache_process_size = ps auxfww | grep httpd  each process memory usage ?
22:26.20DiscordianUKOn Linux I'd install smem and use that
22:29.01MohanDiscordianUK: smem is used to find the memory usage of apps ?
22:29.13DiscordianUKIndeed
22:30.10MohanDiscordianUK: thanks, I will check it out.
22:30.16DiscordianUKif you'll forgive me 3 lines :-
22:30.19DiscordianUK1330 cacheserver /usr/cachesys/httpd/bin/htt        0      416      647     1452
22:30.20DiscordianUK<PROTECTED>
22:30.20DiscordianUK<PROTECTED>
22:31.02Mohanit seems its not available in the centos repo
22:31.28DiscordianUKI dunno tis in the Fedora ones
22:35.46DiscordianUKsmem was written by one of the kernel devs
22:41.20Mohanis learning new stuff every day :)
23:03.19*** join/#gllug ee (n=ee@net-93-145-44-54.t2.dsl.vodafone.it)
23:03.50eeciao
23:04.07ee!list
23:06.30z00daxmost people speak english here, and bots are frowned upon mostly
23:06.33z00daxibot: hi
23:06.33ibothola
23:06.38z00daxdamnbot
23:06.52Mohanhaha
23:07.06Mohanz00dax: hi
23:07.12z00daxhey Mohan howse it going
23:07.22z00daxspeaking of going, I need to get going - be back in the morning
23:07.43*** part/#gllug ee (n=ee@net-93-145-44-54.t2.dsl.vodafone.it)
23:08.33Mohanthings are fine. how about you.
23:09.26gregjhttp://news.bbc.co.uk/1/hi/world/americas/8345713.stm
23:09.42gregjthis happens often, when you lock up few dick heads, and give them guns, aka army.
23:10.01gregjheh, it is funny how peopl eforget, that army == death,
23:10.37gregjpeople die in war, .. everybody cries - no fucking shit, they are in the bloody army, thats the risk you are taking when you join army.

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.