- luv-main - luv.asn.au

creating TTY
by Tim Connors 10 Sep '13

10 Sep '13

Very early in the boot process, before the getty etc are fired up, I want to fire up a process that talks over a full tty. What state it leaves the console after it has finished is irrelevant - the process will finish with a reboot. I've had some element of success with openvt and screen (and running stty sane in the subshell), but they're not particularly neat, and neither of them propogate the exit value from the last command executed. And my google fu is still failing me. Anyone any idea of a simple .c program or the like that can initialise the tty into a semi-sane state and talking over /dev/tty will do the expected thing? Running 'tty' this early in the process tells me my tty device is /dev/console, but it doesn't behave like a tty, in that rlwrap fails to do the expected thing 'rlwrap: Could not open /dev/tty: No such device or address' (yes, /dev/tty is c 5 0) -- Tim Connors

2 1

Re: selinux stole my bank details (and my pony)
by Petros 10 Sep '13

10 Sep '13

From: "Russell Coker" <russell(a)coker.com.au> > Apart from a few exceptions the SE Linux design is based on a default of deny That is true and definitely adds a layer. Whether it is SELinux or containers - you rely on kernel code. Both can have vulnerabilities. SELinux is sharing the same name space with the rest of the system - so you can reach other services, files etc. by misconfiguration. People are lazy. The easiest way to get it work: allow everything for all. I just help someone to have a test instance of a website. There is a form writing data to one DB table (contact): What do I see: GRANT ALL for db.* for user anyone (no password). Regards Peter

1 0

Re: selinux stole my bank details (and my pony)
by Petros 10 Sep '13

10 Sep '13

From: "Jason White" <jason(a)jasonjgw.net> > Robin Humble <rjh+luv(a)cita.utoronto.ca> wrote: >> ...it didn't really, but... >> is anyone still a selinux fanboi after the recent NSA revelations? >> >> if so then (Russell, I'm looking at you :-) why are you still confident >> selinux is a good thing and not just something designed to be so >> complex or so subtly buggy that the NSA can hide backdoors in it? > > The code has been worked on extensively by people who are not associated with > the NSA, so at this point I'm not concerned that it harbours intended > vulnerabilities. Also remember that SELinux adds to the security of a system: > the Linux discretionary access controls are checked first. Only if the > operation is allowed is SELinux invoked to apply the security policy. That's correct. But I still need additional layers being reliable, otherwise it just adds a false sense of security. At least in the server I rather rely on containers. The FreeBSD jail implementation is completely done in the kernel without further userland configuration. According to Robert Watson he needed to change/add ca. 600 lines to implement it, that is clearly easier to audit than the complex SELinux rules. At the same time it contains services pretty well. As for Androids etc. - I would not trust them as far as I can throw them. I wonder whether people are interested in a "connection fob" which is giving you the functionality of a wireless modem, phone connectivity and GSM, as well as contains and hides devices behind it. It would improve our security and privacy significantly if that little thing is open-source and has practical mechanical switches to enable/disable connectivity, I believe. Behind it, a phone is a (IP) phone and a tablet is a tablet and a computer a computer and they all do not rely on plenty of closed source drivers etc because they do not need to implement the connectivity functions anymore. And the data exchenge between them is tightly controlled. The connection fob would be the most useful "smartwatch" I could imagine. Regards Peter

1 0

Re: petition for FTTH
by Petros 10 Sep '13

10 Sep '13

From: "Russell Coker" <russell(a)coker.com.au> > http://tinyurl.com/mpo6vft > > While I don't think much of the way the NBN has been designed, the Liberal > party has an even worse plan that will give little benefit over the current > situation and most of the costs of the NBN. The above URL has a change.org > petition for them to reconsider this. I think one of the major drawbacks of a fibre to the node network is described here: http://en.wikipedia.org/wiki/National_Broadband_Network#Fibre_to_the_premis… Mike Quigley, CEO of NBN Co, said one of the advantages of a GPON network is the distribution hub requires no electronics. He used an example in the United States where a hub was "under water and full of mud" and it continued to function while the fire department used a high pressure hose to clean it.[5] Without electronics, the distribution hub does not require a power supply, nor a battery for power outages. In a GPON network only the local exchanges housing the fibre access nodes and the equipment on premises require a power supply. ------------------------ If Turnbull has his way, it means: hubs with electronics (optical to fibre converters) close to the house The converters need power, so it adds additional power lines and other infrastructure, and a need to shelter the electronics against every kind of weather. This will in fact increase the costs of the NBN while decreasing bandwidth and reliability. The savings argument is a dud. Recently I read a print of an IEEE paper which is coming to the same result. (sorry, cannot find a reference anymore) Only politicians without any knowledge could really argue in favour of fibre to the node in dominantly suburban Australia. Regards Peter

1 0

Recommendations for APT caching software for Ubuntu?
by Chris Samuel 07 Sep '13

07 Sep '13

Hi folks, What do folks feel works well for them for a running a local apt-cache? I want to avoid having to download apt packages for my various Kubuntu machines for speed rather than quota reasons. cheers! Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC This email may come with a PGP signature as a file. Do not panic. For more info see: http://en.wikipedia.org/wiki/OpenPGP

5 7

What happened at the AGM?
by Dave Hall 07 Sep '13

07 Sep '13

Hi luv-main (or is that now la-luv-main?), Would someone who was there like to give the list a summary of what happened at tonight's AGM? I couldn't attend but I'm interested in the outcome. Cheers Dave

16 49

one reason why i like zfs
by Craig Sanders 06 Sep '13

06 Sep '13

I noticed a disk failure just now on one of the drives in my main pool - heard the clicking sound of repeated access attempts so I looked at what 'zpool status' said: pool: export state: DEGRADED status: One or more devices are faulted in response to persistent errors. Sufficient replicas exist for the pool to continue functioning in a degraded state. action: Replace the faulted device, or use 'zpool clear' to mark the device repaired. scan: scrub repaired 0 in 8h12m with 0 errors on Sat Aug 31 10:09:50 2013 config: NAME STATE READ WRITE CKSUM export DEGRADED 0 0 0 raidz1-0 DEGRADED 0 0 0 ata-WDC_WD10EACS-00ZJB0_WD-WCASJ2114122 ONLINE 0 0 0 ata-WDC_WD10EACS-00ZJB0_WD-WCASJ2195141 ONLINE 0 0 0 ata-WDC_WD10EARS-00Y5B1_WD-WMAV50817803 FAULTED 1 2 0 too many errors ata-ST31000528AS_9VP18CCV ONLINE 0 0 0 logs mirror-1 ONLINE 0 0 0 ata-OCZ-VECTOR_OCZ-0974C023I4P2G1B8-part7 ONLINE 0 0 0 ata-OCZ-VECTOR_OCZ-8RL5XW08536INH7R-part7 ONLINE 0 0 0 cache ata-OCZ-VECTOR_OCZ-0974C023I4P2G1B8-part6 ONLINE 0 0 0 ata-OCZ-VECTOR_OCZ-8RL5XW08536INH7R-part6 ONLINE 0 0 0 errors: No known data errors the fix is easy, insert replacement disk and run: # zpool replace -f export ata-WDC_WD10EARS-00Y5B1_WD-WMAV50817803 ata-WDC_WD10EARS-00Y5B1_WD-WMAV50933036 # zpool status -v export pool: export state: DEGRADED status: One or more devices is currently being resilvered. The pool will continue to function, possibly in a degraded state. action: Wait for the resilver to complete. scan: resilver in progress since Wed Sep 4 10:13:09 2013 109G scanned out of 2.78T at 75.9M/s, 10h15m to go 27.3G resilvered, 3.84% done config: NAME STATE READ WRITE CKSUM export DEGRADED 0 0 0 raidz1-0 DEGRADED 0 0 0 ata-WDC_WD10EACS-00ZJB0_WD-WCASJ2114122 ONLINE 0 0 0 ata-WDC_WD10EACS-00ZJB0_WD-WCASJ2195141 ONLINE 0 0 0 replacing-2 FAULTED 0 0 0 ata-WDC_WD10EARS-00Y5B1_WD-WMAV50817803 FAULTED 1 2 0 too many errors ata-WDC_WD10EARS-00Y5B1_WD-WMAV50933036 ONLINE 0 0 0 (resilvering) ata-ST31000528AS_9VP18CCV ONLINE 0 0 0 logs mirror-1 ONLINE 0 0 0 ata-OCZ-VECTOR_OCZ-0974C023I4P2G1B8-part7 ONLINE 0 0 0 ata-OCZ-VECTOR_OCZ-8RL5XW08536INH7R-part7 ONLINE 0 0 0 cache ata-OCZ-VECTOR_OCZ-0974C023I4P2G1B8-part6 ONLINE 0 0 0 ata-OCZ-VECTOR_OCZ-8RL5XW08536INH7R-part6 ONLINE 0 0 0 errors: No known data errors craig -- craig sanders <cas(a)taz.net.au>

6 12

Re: one reason why i like zfs
by Petros 06 Sep '13

06 Sep '13

From: "Petros" <Petros.Listig(a)fdrive.com.au> > Quoting "Petros Listig" <petros(a)fdrive.com.au>: > >> Erm, mdadm emails me when a RAID array fails. I didn't have to write my >> own script, because that's something everybody running an array should >> want (more or less). If I had migrated from md to zfs, I'd have been >> bitten by that. A mismatch of expectations, I guess. Oops, that was Trent. I modified some stuff (cut/paste) and made this mistake. Sorry Peter

1 0

Re: one reason why i like zfs
by Petros 06 Sep '13

06 Sep '13

Quoting "Petros Listig" <petros(a)fdrive.com.au>: > Erm, mdadm emails me when a RAID array fails. I didn't have to write my > own script, because that's something everybody running an array should > want (more or less). If I had migrated from md to zfs, I'd have been > bitten by that. A mismatch of expectations, I guess. I never use scripts or whatever that have to be configured per host. It is just tiresome. There is a icinga/nagios plugin for ZFS health. Icinga is the only "spam robot" in the network. To be honest, I don't look at syslog at all, as long as I am not debugging a problem, or install a new machine, or configure a service. FreeBSD machines send a daily status and security report, they include kernel messages though. My brain is still half asleep when I look at them, and it is more a "pattern matching" as reading, somehow visual memory tells me how these mails should look like, and I wake up if they do not match. It is just for finding Rumfeld's unknown unknowns, the rest is an Icinga/nagios job. The health of a ZFS system is one of the known unknowns and can be observed by the monitor system. I don't need anything else. Regards Peter

1 0

Disk Washing
by David Zuccaro 06 Sep '13

06 Sep '13

What is the best way to wash a disk? I tried this but it is taking forever. dd if=/dev/zero of=/dev/sdg1 Thanks

17 32