[00:05] pflanze (~chris@129.132.19.124) joined #vserver. [00:13] Hello. [00:13] ccooke (~ccooke@80.1.164.238) joined #vserver. [00:13] Is there much difference between vserver 0.23 / kernel-patch-ctx 17 as offered by debian unstable and version 1.00? [00:14] atari (~atari@213.144.146.89) joined #vserver. [00:14] hi [00:19] is it possible to run a vserver totally independant of the main server when i have a public ip for the vserver? [00:19] i didnt find an answer to that in the doc [00:20] what do you mean by "totally independant" ? [00:20] I don't recommend running the vserver in Debian unstable, get the latest patches, and moan at the package maintainer for not keeping up. [00:20] Bertl_oO: on sys_reboot in a vserver, you could change it to force-kill all the processes in the vserver and destroy the virtual context ;) [00:21] riel: well. i saw something about the ssh thing. i'd like to use a virtual interface eth0:1 which is shown in the vserver as eth0 [00:21] riel: something like that. [00:22] I'm sure vserver will run in "something like that" mode, but I don't know if that is exactly what you're asking for ;) [00:22] riel: i didnt find anything totally usefull in the docu [00:26] before you complain about the Debian maintner, have you, *yourself* contacted him to say that you've been happily testing the 1.0 release for a couple of weeks and that it doesn't appear to break anything, and you think that the unstable package should be moved across? [00:26] the last time I e-mailed him, I got no response. [00:28] reil: yes, sys_reboot should be able to force-destory the context; however that is not a function that is currently available--that functionality needs added to prevent continious fork()ing programs being particularly hard to kill. One way would be to set a flag preventing new processes being created in that $context. And then kill the processes one-by-one [00:28] mugwump: apparently not then [00:29] mugwump: just because you didn't get a reply, don't think that it wasn't read--does everyone on a mailing list reply to your posts just so that you know it's been read? [00:29] :-) [00:30] I've ended up polishing my own Debian package customisation process for internal packages. It's the only way to get results :-) [00:30] I filed a bug report, with a patch the other day and it got classified as WONTFIX because sarge is being release RSN [00:31] Action: sladen goes off to hunt through bugs. for sam's patch [00:32] Action: mugwump hands sladen a piping hot cup of chill out, man [00:36] Action: sladen apologies for being bitchy--yes the only way I got bits of the package cleaned up was to sit down at Debconf3 with opal [00:36] mugwump: I can't find it, can you mail your patch--I might add it to the debian newvserver package anyway [00:37] it was a long time ago, for an old version. It's not really relevant now. [00:37] Are you in contact with the current vserver maintainer? [00:37] debian one that is [00:38] occasionally [00:38] I concure that he's not always responsive [00:39] It's a problem with the whole Debian concept in general IMHO [00:39] Not a *huge* problem, but a problem [00:40] I would become a maintainer ... I mean, I must have made hundreds of packages - RPM, SysV, dpkg - but the red tape is ludicrous [00:40] No-one's made a deb of the util-vserver package have they? [00:41] I would too--but too much hassle (and then I'd get bug reports :-). I just organise things for Debian UK instead [00:41] http://photos.paul.sladen.org/show_collection.php?id=58432 [00:42] Heh, where's that? [00:43] netrose (~john877@24.171.21.47) joined #vserver. [00:44] mugwump: hanging my back window when I was ``testing'' it before the show. Much better than the old big, square signs--it rolls up and goes over my shoulder--nice and easy [00:45] what's needed for your newvserver, just newvserver and newvserver.defaults ? [00:46] Not sure--I'd have to check what the current patches in the package are. I'm still using the original stuff I wrote :-) [00:46] I'm just knocking up a util-vserver package [00:46] ah [00:47] I think I'd rather try to get Enrico to include the debian/ directory in the distribution. Who needs Debian package maintainers, when we're all quite capable of it anyway ;-) [00:47] it'd be better... [00:50] mugwump: all the defines are at the top of the file. Then /if/ the vserver.conf exists it reads that to override stuff; if not it just depends on itself [00:50] (and debootstrap) [00:54] util-vserver should probably require, not just recommends debootstrap IMHO. what do you think? [00:55] suggest: ? [00:55] it's only newvserver that actually needs it--and it prompts you about how to install it if it's not there [00:56] ok, I'll make it a Recommends: rather than suggests (pity there's no Strongly-Recommends: :-)) [00:57] Cool, I just chucked newvserver in the scripts/ directory, and it's been delivered with the package :-) [00:58] k. --I'd grab the one out of the vserver, I've just been through bugs. and noticed a major typo in my script that was overwriting the crontab in the root vserver, rather than the newly-created vserver [00:58] Where's the best newvserver then? [00:58] In the vserver source ? [00:58] Action: mugwump checks your site [01:00] I would have said http://www.paul.sladen.org/vserver/debian/debian-newvserver.sh I'd now recommend the one out of the debian package which is a bug-fixed version that that [01:02] OK I've got the one from vserver-0.23-3 [01:02] is there any where a usefull howto? [01:02] for some definition of useful [01:03] i need informations. the README is emtpy, the FAQ doesnt exist. any proposals? [01:03] http://www.linux-vserver.org/index.php?page=Documentation [01:04] im on that site. but i didnt find anything yet... [01:05] what is unclear? Where to begin? [01:05] atari: that page lists two FAQs--what is it that you're after? [01:05] i have some questions, i didnt find a answer yet. [01:06] atari: if you ask your questions, we maybe able to answer them for you [01:06] well. [01:06] mugwump: is that the script from the debian/ directory in the package? [01:06] is the verserver independant of the main server? [01:08] atari: I'm not sure what you mean. So I'm going to say "yes" [01:08] i saw something as workaround for the ssh server. what exactly is that to pretend? [01:08] newvserver was just in the root dir of the package [01:09] #!/usr/bin/shellmod ?? [01:11] do i have to patch the kernel of the main server and the vserver? [01:11] mugwump: that's Jack's crap. You don't want to be touching/using that newvserver. The one in the debian/ directory is the one that gets installed (the one that on my site is called debian-newvserver.sh) [01:11] whoa, there's lots in there [01:11] atari: there is only one kernel. You have to patch *the* kernel (on the main server) to be able to use vserver [01:13] i would like to run another linux a little bit like in vmware. is that possible with vserver? [01:13] no [01:13] It's more like a *BSD jail [01:14] or an enhanced chroot() [01:14] damn :( thats what im looking for... [01:14] VMware is good software. worth the $200 [01:14] yeah. i was just looking how to explain it. [01:15] mugwump: if you want any machine, use VMware [01:15] s/mugwump:/atari:/ [01:15] atari: if you want a pretty good emulation of a complete machine, use UML [01:15] sladen: the problem is, that i dont have X on that server. and the server is far away. [01:16] UML? [01:16] atari: if you want something for an ISP environment, then vserver is more suitable [01:16] atari: http://user-mode-linux.sourceforge.net/ [01:16] sladen: i'll take a look at it. thx. [01:17] atari: and more recently, there's also Xen now [01:18] Are the debian unstable versions ok, or should I compile the just released new versions? [01:18] vserver-1.0.0 [01:18] (of the ctx patch and userspace utils.) [01:18] sladen: do you have a link for xen? [01:19] the ones at http://www.13thfloor.at/vserver/s_release/v1.00/ are what we're encouraging people to use. No doubt the Debian maintainer will update his version in time [01:20] There are two reasons I generally prefer the debian versions: a) if the upstream is missing a signature, b) because the debian usually are already a bit tested. [01:20] atari: http://www.cl.cam.ac.uk/Research/SRG/netos/xen/ [01:20] sladen: thx. [01:20] I'm missing the point (a) so far :) [01:20] sali pflanze :) [01:21] hi atari [01:21] pflanze: yes, for that reason, I'd be happier for the debian package to wait at least a couple of weeks after the release date of 1.00 [01:22] That debian package has loads of good changes that should have been incorporated upstream ... [01:22] mugwump: Jack hasn't taken /anything/ I've mailed him for a long time [01:23] mugwump: I suspect you've had the same experience [01:23] he's a busy man [01:24] ok I guess I'll go with the debian one - since this is for a live server and the first time I'm trying it I don't want to be risky.. [01:25] pflanze: the 1.0.0 patch will work with vserver-0.23 [01:25] *nod*. [01:26] the patch in debian, kernel-patch-ctx-17, is quite out of date. Very few features have been added since that time. [01:26] Action: mugwump cranks up reportbug [01:26] ok thanks. [01:27] Wishlist items - outstanding: 1 report [01:27] 2) #200010: Upstream patch for kernel version 2.4.21 is out [01:27] Action: mugwump sighs [01:30] zcat patch-2.4.22-vs1.00.diff.gz|md5sum [01:30] 26beab1d75b8861537016dc1e0cdc308 [01:31] Are you one of those paranoid people? :-) [01:31] yes. [01:31] and you're relying on md5? Didn't you know it's compression function is flawed? [01:32] Well, since the new vserver homepage is a wiki, there's a nice chance that someone puts links to some trojan there.. [01:32] Action: mugwump looks about nervously, screams "No, it wasn't me!" and jumps out the window [01:33] The compression function? [01:33] yeah, as a part of the digest it compresses input data before feeding it into the main algorithm. RSA published an exploit about 3 years ago [01:33] I've read some ppl argueing that md5 is only secure if the size of the input is compared as well. [01:34] ah. didn't know about that. [01:34] yes that would be right, essentially it's not all that hard to pick a sequence of bytes that doesn't affect the output MD5 sum, especially if you have the input data [01:35] but that sequence of bytes also has to be a valid patch in this case :) [01:36] not a huge problem, you can have huge amounts of comments in a patch [01:37] true [01:38] You know what, I just got that file from Herbert's site and the MD5 sum is differnt [01:39] http://www.13thfloor.at/vserver/s_release/v1.00/patch-2.4.22-vs1.00.diff.gz Is what I fetched [01:39] Herbert runs 13thfloor.at, so assuming his (or your) ISP hasn't been violated it should be OK [01:40] I've zcat'ed it [01:40] oh, duh [01:40] matches :-) [01:40] but that doesn't necessarily mean anything ;-) [01:40] for the case that you fetched the bz2 :) [01:41] I'm looking for a sha cmdline tool right now.. [01:41] ;) [01:41] haven't found one so far [01:41] openssl sha1 zcat patch-2.4.22-vs1.00.diff.gz|openssl sha1 [01:41] 1b7acaec2e5120f6c537d479c9b94b6de5e7c4ac [01:42] This is pointless - we're doing sums of files we both just retrieved from the same site [01:42] If it makes you feel any better, I've scanned over it manually and there are no Trojans :-) [01:42] that I saw ;-) [01:42] The point is that the vserver homepage is a wiki and the download site doesn't have .sig's [01:43] www.13thfloor.at is run by the current project leader [01:43] yeah, just check for unusual comments :) [01:43] hey, what's this patch to syscall 0... [01:44] I didn't know that. But I'll set up www.13thfloor.ch and change the wiki s00n. [01:46] Argentina, Switzerland, same diff [01:46] Nick change: Bertl_oO -> Bertl [01:47] hi all ... heavy discussion about the security of the release? [01:47] My diff will have buffer overfl0ws at the right places. [01:48] @pflanze do you feel better if I add the md5 sums? [01:48] no, we've just been through all that :-) [01:48] signed with my key? [01:48] Hm, where would you want to add them, to the wiki? :^) [01:48] signed, yes. [01:48] zcat patch-2.4.22-vs1.00.diff.gz|openssl sha1 was the suggestion [01:48] nope on my web page (13thfloor.at) [01:49] Well, I'll trust you now :), but maybe that's only because it's you. [01:50] Simon (~sgarner@apollo.quattro.net.nz) joined #vserver. [01:51] Action: mugwump raises a big PGP Keyswapping Time fanfare! [01:52] pub 1024D/05B52F13 2000-12-08 Sam Vilain [01:52] Key fingerprint = 7D74 2A09 B2D3 C30F F78E 278A A425 30A9 05B5 2F13 [01:53] http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x05B52F13 [01:53] Action: mugwump looks around for the enthusiasm [01:53] pub 1024D/1FE692DA 2003-08-13 Christian Jaeger (Work) [01:53] Key fingerprint = F033 D030 F75D E445 05A1 1865 4ECB DF80 1FE6 92DA [01:53] (but well I'm not part of your dev group) [01:53] Action: pflanze is going to sign mugwump's key [01:54] My, what a lot of keys you have pflanze [01:54] ? [01:54] you mean signatures? [01:54] no, on pgp.mit.edu there are about 4 keys of yours [01:55] Assuming they're all the same Christian Jaeger [01:55] hm, there should only be two, the above and an old one. [01:55] prolly not. [01:55] maybe christian.jaeger@studentmail.newcastle.edu.au isn't you then [01:56] right, I've never been there [01:57] http://vilain.net/jaeger.asc is the signed version [01:58] Herb, you got a key? [02:00] not yet, but I was thinking about creating one ... [02:02] 1024bit , DSA/ElGamal is okay, right? [02:02] mugwump: since one should check the email address before signing a key, I'm about to run "cabot"; do you want both your identifications (email adresses) signed? [02:02] (sam@vilain.net + sv@snowcra.sh) [02:03] sure why not [02:03] you'll receive an email with a hash that you should reply to. [02:03] how flash [02:04] `apt-file search cabot' returns nothing - what's that a part of? [02:05] You should find it with google. I think I've fetched it from http://savannah.nongnu.org/projects/cabot . [02:05] cool [02:11] okay, just added my newly created key to the MIT server ... [02:12] what's the id/fingerprint? [02:12] 1024D/4B1AE351 [02:12] pub 1024D/4B1AE351 2003-11-02 Herbert Pötzl (Bertl) [02:12] Key fingerprint = 29FB 7F24 15A7 BDDD 3593 467E 0D1B 83CA 4B1A E351 [02:14] Herbert Pötzl I presume [02:15] Only a year for your key Herbert? [02:15] well that is what the sever does with the umlaut o (ö) ;) [02:15] Bertl: I've sent you a challenge too [02:15] so I have to do it again next year, when 2048 bit are in ;) [02:16] I've just signed your key - get the signed version at vilain.net/herb.asc [02:21] Action: sladen raises an E90CFA24 [02:22] (but don't think I'm signing it without seeing ID in person... :-) [02:24] My, what a lot of signatures you have Paul [02:24] well that's a point I'm unsure myself. Do people expect to match the key to a real name, or to an email address? [02:24] the idea is, a person [02:24] If it's only for the email address, I'm verifying it. [02:25] The person's real name is a different thing. [02:26] Action: sladen checks. Ah, I see your point. #263 in the world... [02:26] I guess Bertl and mugwump at least deserve a "2". [02:26] It's a web of trust, not a web of paranoia ;-) [02:26] (well, mugwump as soon as I get the replies) [02:27] Yeah, I only pick up mail at work [02:27] seems a bit backwards, but there you go [02:28] pflanze: I generally reserve 3 for very-good-ID and knowing the person, 2 for okay-ish ID. 1 for anything else [02:30] pflanze: *grin* [02:30] With both an official ID (car or passport) and with email verified, I'm giving a 3. [02:30] Even if I don't know the person. [02:30] a lot of trust you place in the establishment then [02:31] You'll never know your next as good as yourself. [02:32] (I mean, with an official ID that I've seen with the real person beneath.) [02:35] sladen: what's #263? [02:36] pf: http://keyserver.kjsl.com/~jharris/ka/2003-10-19/top1000table.html.gz [02:39] Peter Palfrader is #3 and #36 :-) [02:41] (btw Bertl should have received the signed key) [02:42] netrose (~john877@24.171.21.47) left irc: Ping timeout: 485 seconds [02:42] Where are you based Paul? [02:44] Nottingham. [02:44] (and Thanks for you sig, Sam.) [02:44] your [02:45] damnit, how the fsck did Moray get to #29 so quickly...?! [02:46] all his sigs are dated 2003! [02:51] MasterLee (~MasterLee@adsl-67-67-197-85.dsl.austtx.swbell.net) joined #vserver. [02:51] hello. [02:52] hello [02:52] Action: sladen beds [02:53] Late there? [03:03] hi! [03:06] @MasterLee what brings you here? [03:22] morning [03:22] hi! [03:22] herbert, today is the day for sparc testing! :) [03:22] wow ... means in 5 minutes, or 5 hours? [03:22] congrats on the 1.0 release too :) [03:23] heheh, i'll try for half an hour [03:23] this machine is sloooooooooooooooow [03:23] okay, I'll be around some time ... [03:23] so, the 1.1 stream will be the new syscall switch ? [03:23] yup 1.1.0 is syscall ... [03:25] vinsci (~vinsci@dsl-jklgw3if1.dial.inet.fi) joined #vserver. [03:25] hi vinsci! [03:26] hi Bertl :) [03:30] how does vserver differ from, say, xen? [03:31] xen? [03:31] in many ways ... [03:31] xen does some partitioning of the available resources for different oses [03:31] kestrel http://www.cl.cam.ac.uk/Research/SRG/netos/xen/ [03:31] thanks [03:32] for example, you can dedicate 200MB of disk space some ram and cpu time for a linux kernel/install ... [03:32] this will allow you to run a 'modified' version of linux on those resources ... [03:33] 5 servers means 5 kernel and 5 times the disk space ... [03:33] interesting [03:33] vserver will let you run the 5 servers with about 50MB each, 150MB shared amongh them ... on one kernel ... [03:34] this reduces the amount of resources spend on the kernel ... [03:35] so where xen will be able to run different kernels (like uml does), you get all the advantages and disadvantages this approach brings ... [03:36] k, thanks [03:37] anyone running vserver in production use, facing the net? [03:37] several people do ... [03:37] the linux-vserver.org for example is one ... [03:38] www.13thfloor.at another ;) [03:38] the .org name space is getting crowded ;-) http://www.linuxvirtualserver.org/ [03:39] yeah, probably we should link to each other, as the projects are orthogonal ... [03:39] yes [03:41] there's a lot of "OLD" and "NEVER" (shouldn't that be NEWER?) in this "one big html document" http://dns.solucorp.qc.ca/miscprj/s_context.hc?dp=0&full=1&prjstate=1&nodoc=0 [03:42] hopefully someone will update this valuable information ... [03:42] 12http://www.linuxvirtualserver.org/01 << this is why I think we should have picked a totally new name for the vserver project ;) [03:45] considered using Plone for your new website? (shameless plug) [03:45] actually somebody already volunteered to setup plone .. but haven't heard since ;) [03:46] I could do that in 15 minutes, if you like :) [03:46] well, I'm not sure that we would benefit from it ... [03:46] I'm currently working fulltime with plone and plone development [03:47] but if you want to convince me, it is easily done with good arguments *hint* [03:55] @vinsci are you interested in maintaining a plone setup for linux-vserver.org? [03:59] still compiling herbert... [04:00] I guess the main benefit of plone is that responsibility can be safely delegated - all aspects of the site can be managed remotely through a web browser so each contributor can work fast and efficiently. If something is wrong, it has full version management so changes to contents can be easily undone [04:01] but there are so many more things it doesn't make much sense trying to list them [04:01] okay, again my question: are you interested in maintaining a plone setup for linux-vserver.org? [04:03] just keeping the software up and maintaining upgrades, is a relatively easy job, so yes I could do that. I wouldn't do the content (as I know next to nothing about the project) [04:03] Running and adding content is incredibly easy though, so project members will do it in no times themselves [04:04] I assume very similar to the current wiki, right? [04:04] well, plone has a wiki feature, so you can add wikis anywhere on the site structure you like [04:05] maybe you could explain how plone would be used best for this project ... and name some advantages over the current solution ... [04:06] we're just about to release plone 2 beta 4 tomorrow. It's rebuilt hourly from cvs and up for test use on test.plone.org. It would make sense to use that version in setting up a new site. [04:07] let's go for a test drive on test.plone.org... log in as reviewer/reviewer [04:08] okay, I'm in ... [04:09] the only thing I recognize is the Plone logo/writing ... ;) [04:09] hmm, this cvs plone build sucks on mozilla [04:09] the font is somewhat unreadable and I don't know the icons ... what now? [04:10] I'm sure the stylesheet can be replaced, so no big deal ;) [04:10] yes, someone just checked in changes to that [04:12] haven't found yet how to add stuff? [04:12] ok, let's go somewhere where the reviewer account can add contents on the default site, the reviewer home page looks like a good place, so on the bar at the top click on "my folder" [04:12] OH MY GOD! [04:13] just clicked on Members, now my page is garbage ... [04:13] ah, the hourly cvs CSS is obviously in poor shape [04:14] like to see some screenshot? [04:14] you on linux, I guess? [04:14] I have the same here [04:14] would I use something else? [04:15] hopefully not :) [04:16] oh well, if we ignore the garbled bit (which wasn't there a couple of hours back) [04:16] addign new content: in the green bar, click on "add new item" [04:16] a popup menu shows, where you select the content you want [04:17] choose a document, for example [04:17] okay that doesn't convince me, but it doesn't discourage me either ... are you willing to setup/adapt this for our purpose? [04:17] that would be fun - I need to learn about your project anyway [04:18] what hardware resources is the site running on? [04:19] this is a celeron 550 Mhz ... running about 12 vservers ... [04:19] memory and disk? [04:19] 512MB total, about 36GB disk space [04:22] okay, send me you public ssh key ... I'll add you to the authorized keys ... [04:23] k, can do that, but I'm a bit worried about the hardware [04:23] why? [04:24] is plone such a memory/cpu hog? [04:24] mostly cpu speed - plone does many wonderful things, but it's using a lot of cpu to achieve that [04:25] hmm, then maybe the ultra-fast tavi is a better solution ;) [04:25] a useful setup will include a http cache in front of it (squid or whatever) [04:25] that's not a problem, of course [04:26] the main problem would be response time when going to uncached pages/content [04:26] probably in the 1-2 second region, which can be a bit stressful [04:27] anyway, let's continue the test drive [04:27] scribble aomthing into the short name field [04:27] you already lost me on the garbled members page :( [04:28] ok -- it turns out the problem is that the main page contents is shown on top of the left column at the moment :) [04:28] serving (~serving@213.186.190.24) left irc: Ping timeout: 493 seconds [04:30] fine what should I do now? [04:30] I just reloaded the start page ... [04:30] you're on the new document page? [04:31] how do I get to the new document page? [04:31] from the user bar at the top, click on "my folder", then on the green bar "add new item" select "document" in the drop-down menu [04:33] hmm, now something orange garbled in ... [04:34] good, now fill in something in the three fields (doesn't matter much for this demo) [04:34] four fields [04:34] the "short name" becomes part of the url for the document [04:35] netrose (~john877@24.171.21.47) joined #vserver. [04:36] Bertl: finally click save [04:36] I did that .. [04:36] so what do I do now with this text? [04:37] ok, that is step one fir publishing a new document [04:37] you'll see now that is says "state: visible" on the right hand of the green bar [04:38] click on that and select "advanced" [04:38] normally one would just go "publish" but I want to show some more [04:39] how do I specify layout issues (lists, emphasis, monospace ...)? [04:40] if you like, you can just select html as the type of content, when you enter the text [04:40] but for simple text formatting, STX or structured text is much faster [04:40] let me find a quick ref [04:41] http://plone.org/documentation/book/10 [04:43] ok, the plone guys did a quick fix of test.plnoe.org jsut for you :) [04:44] hmm, nice, now I can actually read it ;) [04:44] still compiling [04:44] yes, that helps :) [04:44] dumb de dumb [04:44] but the performance is dog-slow ... [04:45] it takes about 10-15 seconds until the almost empty page shows up .... [04:45] still compiling the kernel kestrel? [04:45] yep :\ [04:45] @kestrel what kernel are you actually compiling, the v1.00? [04:45] ultra-10 power [04:46] what machine is that on? takes me about 3-4 minutes to compile here ;) [04:46] finished the kernel proper, now i'm on to the modules [04:46] sparc ultra-10 [04:46] ooh ok [04:46] 330MHz of LOVE! YEAH BABY! [04:46] heh [04:46] piece of shit [04:46] well I would let Simon compile your kernel, the download would be faster ;) [04:47] ouch ;) [04:47] hehehe :) [04:47] true [04:47] so true [04:49] okay vinsci, I'm not convinced regarding the usefullness/value of plone for linux-vserver ... but I'm not the one to decide this, the community will do that ... [04:50] but anyways, if you are interested in setting this up, and/or want to help with the site, you are welcome ... [04:51] perhaps this could be use to solve the lack of cpu http://plone.org/newsitems/News_Item.2003-10-23.0217 [04:53] i.e. free plone hosting on http://www.objectis.org/ [04:54] hmm, how would this integrate with linux-vserver.org? [04:54] let me check the faq [05:16] jks (~jks@0x503e4c12.arcnxx4.adsl-dhcp.tele.dk) joined #vserver. [05:16] hi jks! [05:16] hi :-) [05:18] so, what's the deal on the new release ? [05:19] Bertl: k, can't find any mention on that now [05:19] well, you get a free release, and we get some feedback? ;) [05:20] Bertl: well, I mean - that's in there the old versions didn't have? [05:20] @vinsci okay, don't worry ... [05:20] Bertl: so for now, I guess don't think too much about that [05:20] Bertl: isn't it going to keep free? [05:21] Action: vinsci returns to work [05:21] @jks I'm going to charge time to the users 8-) (no, don't worry, it will stay free) [05:21] hehe, okay :-) [05:22] Bertl: am I going blind or is the changelog hard to find on the new site? [05:22] @vinsci a last question, would you like to improve the current wiki, if you find some time, and the community doesn't decide for plone? [05:23] @jks hopefully not (blind) but there are no changes yet (and the old changelog c17a-c17h is still under construction ;) [05:24] Ah, okay - so nothing new :-) [05:24] if you know c17f, you've already seen it ... [05:25] Vertl: thanks for asking, but I must say no to that [05:25] are there binary images of redhat for download somewhere to use with this? [05:25] you mean images of the vserver? [05:25] the last time I tried using the script that takes a regular redhat cd-rom, it didn't work very well, and I had to do it all more or less manually [05:25] I mean the files you put into each vserver [05:26] okay, there is/was a list but it isn't up to date IIRC ... [05:27] but in this regard my information is always outdated ... so look around on the website and the mailing list archive ... [05:28] what I usually suggest, is: install a minimal system, put it into the vserver and add what you need ... [05:28] enrico is doing some fancy stuff with apt-rpm ... that should work for RH too ... but I don't know how (yet) [05:28] okay, thanks! [05:29] i'm basically trying to get a computer setup with a number of vservers, each containing a full development environment [05:29] (C compiler, java compiler, cvs, emacs, ssh, that sort of thing) [05:29] perhaps also apache with cvsweb and a simple mailserver with majordomo for internal mailinglists [05:29] I can get you a list of packages for Mandrake if you want ... [05:30] Oh, that would be great if you have one? [05:30] yeah, as I use it myself .. this is a matter of rpm -qa ;) [05:30] I suggest just make a copy of the host server and uninstall/delete the things you dont want... [05:30] Simon: Okay, there's a script that makes it easy to take a copy of the host? [05:31] Simon: Sorry if I'm asking stupid questions, it's been a year or perhaps more since I tried vserver in practice last [05:31] mkdir /vs/test; cp -a / /vs/test [05:31] ;) [05:31] though probably better not to do it exactly like that [05:32] hehe ;-) [05:32] there is newvserver ... [05:33] creating the skel is very hard to script for because it's different for every distribution, dist version, and every package set... [05:34] http://www.linux-vserver.org/index.php?page=VirtualizeHowto [05:34] Bertl: Thanks! [05:34] Should I worry about the security of this thing? [05:34] I haven't had time to verify this stuff, but it looked good at first glance ... [05:35] I would be giving out free access to various small groups of people working on a various coding projects [05:35] that doesnt sound like a good idea: "Add CAP_SYS_RESOURCE to S_CAPS if you want to run BIND in the vserver." [05:36] as I said, I didn't check it yet ... [05:37] What about security? :-) [05:37] @jks, hmm well .. what _are_ your concerns? [05:37] Bertl: My main concern is that someone will be able to break out of the vserver and get into either the main server or other vservers [05:38] vserver was made very secure in this regard, but you have to follow some rules ... [05:39] for example a vserver should not contain any device nodes except for ... [05:39] full hdv1 log null ptmx pts random shm tty urandom zero [05:39] well, I can't stop people from creating new device nodes? [05:39] but vserver can ;) [05:39] righto, reboot time herbert :) [05:39] ah, okay :-) [05:39] @kestrel go ahead ... [05:40] but how secure is "very secure" :-) [05:40] whats the CAP for making dev nodes? [05:40] probably CAP_SYS_ADMIN with everything else [05:40] I mean, what kind of audit has this thing underwent? [05:41] peer review? ;) [05:41] kind of ... yeah ... [05:41] kestrel (~athomas@202.139.83.4) left irc: Quit: reboot [05:41] put it this way, there have been no reports of hacks so far ... [05:41] Well, do you actually _know_ of anybody reading the whole kernel while matching it with the vserver patch? [05:41] or do you just think "it's on the webpage, people read it" :-) [05:41] I do 8-) [05:42] Besides the ones actually writing the thing ;-) [05:42] There may be some holes, especially in /proc, or syscalls that don't properly use the capabilities system. [05:42] you should have a look at the splitups if you are really concerned ... [05:42] splitups? [05:43] http://www.13thfloor.at/vserver/s_release/v1.00/split-2.4.22-vs1.00.tar.bz2 [05:43] for example ... [05:43] arh, okay - yes [05:43] but you might find "unprotected" parts of the kernel, that are not part of the patches, because they only cover the parts already "changed" [05:43] You should audit your /proc though - check that no drivers have left great big DOS holes open for you [05:44] Ah, and your need a small doctors degree to do that I expect? :-) [05:44] you don't need a doctorate to understand the kernel [05:44] well, the security isn't lower than the normal linux/kernel security ... [05:44] all you need is time :) [05:45] hi dan! [05:45] hi :) [05:45] MrBawb: hehe, an _awful_ lot of time [05:45] Bertl: hmmmm [05:45] no, just `cd' around and try to write to files in the /proc directory. If any of them don't return `Permission Denied' then there may be a problem. [05:45] mugwump: ah, okay! :-) [05:46] @dan, matt lamented about somebody not testing his patchwork, do you know to whom he referred? ;) [05:46] hehe [05:47] I gave it a compile and it failed because I didn't define CONFIG_QUOTA :) [05:48] hmm, this is the second time today somebody reports quota required ... [05:48] well, I have to admit, that I never tested the quota patches without activating quota ;) [05:48] I can get you the exact error if you'd like [05:49] yeah, show me! [05:52] target fs/open.o: [05:52] open.c: In function `ctx_modify_statfs': [05:52] open.c:63: `NOILIMIT' undeclared (first use in this function) [05:53] (NOILIMIT is defined inside a #ifdef CONFIG_QUOTA) [05:53] hmm.. interesting ... but understandable ... [05:53] kestrel (~athomas@202.139.83.4) joined #vserver. [05:53] yeah, I think this came from a per-vserver disk limit patch... [05:54] oh no Herb, first bug? [05:54] Linux o2zeopssun02 2.4.22-vs1.00 #6 Mon Nov 3 12:06:20 EST 2003 sparc64 GNU/Linux [05:54] yes exactly ... [05:54] aaah [05:54] :) [05:54] mugwump: it's probably undefined behaviour :) [05:54] @mugwump stable release does not include the dlimit patches ;) [05:55] patch-2.4.22-c17e-mq0.11-cx0.06-cq0.11-dl0.05.diff [05:55] @kestrel so it booted? [05:55] yep, so far so good :) [05:55] just compiling the utilities and i'll set up a vserver [05:55] what a monster set of patches :-) [05:55] now for the userspace tools ... [05:56] @kestrel when you compiled them, let me know, we do some basic tests then .. okay? [05:56] yep [05:57] @dan actually the issue is that the ctx_modify_statfs() should become a noop when quota is disabled ... [05:57] Bertl: yeah, exactly [05:57] it makes no sense without quota :) [05:57] hmm, I'm not sure about that ... [05:58] actually the dlimit could work without the quota stuff ... [05:58] the context tagging is mandatory ... [05:58] how's that? [05:59] have a look at the dl patch ... [06:00] Action: kestrel snores [06:00] there are the per quota hash limits ... [06:01] nothing else of the quota system is touched ... [06:02] i am using [06:02] util-vserver-0.23.96 [06:02] okay ... [06:02] ... does 'vserver create' work on debian? [06:02] (i usually use slackware and have my own scripts to create vservers) [06:02] whoa, not so fast ... first some tests okay? [06:02] hehe, righto [06:02] vserver-stat works fine [06:02] vps -ef runs fine [06:03] try chcontext --ctx 100 cat /proc/self [06:03] try chcontext --ctx 100 cat /proc/self/status (I mean) [06:03] yep [06:03] works fine [06:03] s_context: 100 [ 100] [06:03] okay chbind --ip 192.168.0.1 false [06:03] [root@o2zeopssun02:~]chbind --ip 192.168.0.1 false [06:03] ipv4root is now 192.168.0.1 [06:04] okay seems fine, now you can try to create a vserver ... [06:04] there is a howto for debian ... somewhere ... [06:04] hm, ok. so the dlimit stuff isn't dependant upon quota [06:04] ah, okay [06:04] i will find it [06:04] it uses something called debootstrap ;) [06:05] ah [06:05] but vserver XXXX build [06:05] I'm just testing a debian package of util-vserver now... [06:05] should work too ... will build an empty server (no packages ;) [06:06] @sam which version? [06:06] 0.23.96 [06:06] beautiful :) [06:06] empty vserver...useful ;) [06:06] i might build a mini one by hand for now [06:07] the empty server actually _is_ useful, because you see what you don't need (for example in /dev ;) [06:08] @sam is this okay? http://www.13thfloor.at/vserver/s_release/v1.00/md5sum.asc [06:08] it is populating the vserver with files.../bin, /usr...etc [06:08] is that normal? [06:09] you have to ask enrico what of this is normal ... but I guess yes ... [06:10] hmmm, large [06:12] probably the newvserver script is active again ... [06:12] this will copy your 'host' server ... [06:12] ah, UTIL_VSERVER_AVOID_COPY=1 [06:13] AHA! [06:13] :) [06:13] swift [06:14] I'm glad that Enrico and Jack are doing the tools, as I don't want to bother with them ... [06:14] bertl: :-) nice sums. but without the filesizes someone could still insert trojans, as MD5 sums are not 100% strong [06:14] heh, i bet you are [06:14] but they seem to be good enough for most of the planet at the moment ;-) [06:14] @sam okay, will add the filesizes next time ;) [06:18] that rebootmgr wasn't properly daemonizing ... had to fix it [06:18] ok, well the matta patchset booted up :) [06:19] paul referred to the ancient approach of virtualizing the reboot, I'll have a look at it soon ... [06:20] where to get newvserver? [06:20] looking good herbert [06:20] [I have no name!@test:/]ps -ef [06:20] UID PID PPID C STIME TTY TIME CMD [06:20] #0 1 0 10 03:20 ? 00:00:03 init [06:20] #0 4416 4385 0 03:56 pts/5 00:00:00 /bin/bash -login [06:20] #0 4431 4416 0 03:57 pts/5 00:00:00 ps -ef [06:20] @dan he said something about hanging after 10-20 minutes IIRC ... [06:21] any tests you want to do? [06:21] want me to do, rather [06:21] yeah, please check the hostname for example ... [06:21] hostname works correctly [06:21] Bertl: ok, I was going to let it run for 24 hours anyway :) [06:21] uname -a works correctly [06:21] uptime works correctly ;) [06:22] @dan yeah, just start some forkbomb in a server ;) [06:22] load average: 455.51, 199.85, 75.92 [06:22] heh heh :) [06:22] woah [06:22] okay, you win this one ;) [06:23] wow [06:23] that is impressive [06:23] sam did a pretty good job on that ... [06:23] if setup correctly, the system is still responsive ... [06:23] that it? [06:24] yeah, anything that waits on io is still fast [06:24] there are some more detailed tests in enricos package ... [06:24] anything that waits on free cpu is sad :) [06:24] @kestrel you can play around with them ... [06:25] hmmm, okay [06:25] but basically it looks like sparc64? or what is it? is working fine ... [06:25] sparc64, correct [06:25] good news :) [06:25] if you find anything unusual, please report ... [06:26] shall do [06:26] and I would be verry happy, if you could post your findings to the list too ;) [06:27] kestrel, does hostname work for you? [06:28] @simon, that is something which isn't fixed in 1.00 (for x86_64) [06:29] simon: sure does [06:29] herbert: no problem [06:29] i'll post when i get home [06:29] oh ok [06:29] kestrel I meant does it show the vserver's host name? [06:30] yes [06:30] bash-2.05b# hostname [06:30] test [06:30] ok ;) [06:31] I don't know, why the x86_64 people decided that they need a custom sys_uname ;) [06:31] :( [06:31] does it do anything out of the ordinary that would warrant that? [06:32] IIRC, it has a personality check added ... [06:33] I wonder why on mandrake it doesn't know the processor type or hardware-platform :/ [06:33] #uname -mpi [06:33] x86_64 unknown unknown [06:36] if (personality(current->personality) == PER_LINUX32) [06:36] err = copy_to_user(name->machine, "i686", 5); [06:36] hmm, actually...the interface doesn't seem to configure correctly [06:37] this is the change they added ... [06:37] but that could be a tool problem [06:37] what do you mean by 'doesn't seem to configure correctly'? [06:38] i have this: [06:38] IPROOT="eth1:10.1.1.1" [06:38] in my test.conf in /etc/vservers [06:38] but when i vserver test enter i get given this: [06:38] eth1:test Link encap:Ethernet HWaddr 08:00:20:B3:29:B3 [06:38] inet addr:143.255.47.127 Bcast:143.255.255.255 Mask:255.255.0.0 [06:38] is the base interface eth1 up? [06:38] but if i manually configure eth1:test as 10.1.1.1, it works [06:39] eth1 has no ip addresses attached to it, but it is up [06:39] i'll add one [06:39] it has to be getting 01143.255.47.127 from somwhere... [06:39] ah, yes, that worked [06:39] i made eth1 10.1.1.254 [06:39] and it worked [06:39] in near future, userspace tools will change to iproute2 ... [06:40] eth1:test = 10.1.1.1 [06:40] okay [06:40] or more precisely, the ip interface tool ... [06:40] this will solve a bunch of 'so called' issues ... [06:40] i read some stuff on the mailing list about all sub-interfaces going down when the first configured sub-interface was taken down [06:40] because of the way that interface is marked as PRIMARY [06:40] okay [06:41] sounds good [06:42] sweet vserver [06:42] okay, thanks for testing, are you able to test the c17h too? [06:47] Nick change: riel -> surriel [06:57] okay, have a good whatever ... [06:57] Nick change: Bertl -> Bertl_zZ [07:05] mugwump (~sv@62.253.119.16) left irc: Quit: Must ... sleep [07:24] hmm, "Start vservers on tty9": good or not? [09:01] /usr/lib/vserver/install-post.sh (in debian package): [09:01] rm -fr $VROOT/dev [09:01] this is a no-no [09:01] what if VROOT is "/ foo"? [09:02] Don't write shellscripts if you don't understand the shell (tm). [09:26] vserver xxx enter [09:26] ipv4root is now 0.0.0.0 [09:26] New security context is 2 [09:26] Kernel do not support chrootsafe(), using chroot() [09:26] Why is this last warning? [09:44] is Vserver a kernel patch primarily and some userland tools that wrap the syscalls or something? [09:44] I couldn't get a clear understanding from the site. [10:22] MasterLee (~MasterLee@adsl-67-67-197-85.dsl.austtx.swbell.net) left irc: Quit: If I leave IRC, am I really gone? [10:36] kestrel_ (~athomas@dialup28.optus.net.au) joined #vserver. [10:36] hi there [11:04] ace (~ace@213.225.74.103) left irc: Ping timeout: 485 seconds [11:04] ace (~ace@213.225.74.103) joined #vserver. [11:56] re [12:03] hi [13:17] Simon (~sgarner@apollo.quattro.net.nz) left irc: Quit: so long, and thanks for all the fish [13:39] hmm, I know, RTFM, but how do I enable binding to a port..? [14:06] if a service binds to 0.0.0.0 in the real server, services in the vservers can not bind to that port [14:25] say-out (~say@212.86.243.154) joined #vserver. [14:26] atari (~atari@213.144.146.89) left #vserver (Client Exiting). [14:30] That was not the problem. [14:31] It was that I didn't have IPROOT=... in the "$vservname".conf [14:31] at least I think so. [14:31] New question: what about routing? [14:31] looks like I can't access the world. [14:33] do you have any firewall rules on the system? [14:33] masquerading perhaps [14:33] ? [14:33] yes [14:34] IPROOT=192.168.1.1 -> masqueraded to outside. [14:34] soon back [14:34] Nick change: pflanze -> pflaway [14:35] ta :) [14:36] pflanze: masquerading does not work, you need to SNAT to the outbound interface [15:06] mhepp (~mhepp@r72s22p13.home.nbox.cz) joined #vserver. [15:08] AGoe (~agoeres@80.184.207.180) joined #vserver. [15:37] chrism (~chris@82.32.130.79) joined #vserver. [15:44] chrism (~chris@82.32.130.79) left irc: Quit: [BX] The birds kept calling his name, thought Caw [15:50] Nick change: pflaway -> pflanze [15:50] mhepp (~mhepp@r72s22p13.home.nbox.cz) left irc: Remote host closed the connection [15:52] AGoe (~agoeres@80.184.207.180) left irc: Quit: Client exiting [15:53] Is it possible to make more than one ip available to a vserver? [15:54] like eth0 and eth0:1 [15:54] well, and eth0:1 only if it's up.. (this is a failover configuration, ip on eth0 is always up, eth0:1 only for the machine that services the live ip) [16:29] Hmmm, [16:29] I've reconfigured the vserver to bind to the outside ip directly now. And outgoing connections work. [16:30] But incoming ssh connections somehow block. [16:30] ps shows: [16:30] root 13787 0.0 0.3 6048 2024 ? S 14:28 0:00 sshd: root@notty [16:31] Could this be because I've configured vserver not to use tty9? [16:31] # strace -p 13787 [16:31] Process 13787 attached - interrupt to quit [16:31] select(10, [3 4 7 9], [], NULL, NULL [16:32] Nick change: unriel -> riel [16:32] Incoming connections to apache work. [16:33] why not also ssh? [16:37] ssh -X ethlife-b-kontro [16:37] /usr/bin/X11/xauth: creating new authority file /home/chris/.Xauthority [16:37] then it hangs. [16:37] looks like a pty/tty problem? [16:40] yep, typing to ssh shows up in strace as read(4,"...random data..") , write(9,"X") [16:40] and lsof shows that fd 9 is: [16:41] sshd 13885 chris 9u unix 0xd9953880 4362075 socket [16:49] Nick change: Bertl_zZ -> Bertl [16:51] hi all! [17:03] hello there [17:04] hi kestrel_! [17:05] is this the offline version of Alec? [17:07] home version :) [17:09] /dev/vg00/pvr-movies 110G 104G 6.2G 95% /pvr/movies [17:09] whoops, wrong channel [17:10] hmm .. interesting ;) [17:10] hehe [17:14] help! why does this fscking ssh block? [17:15] I had a look at your stuff ... but I don't understand what you are doing? ,) [17:17] @pflanze did you disable/restrict sshd on the host system? [17:17] No, sshd is there, and even working as you see from the "creating new authority file" [17:17] but then it freezes. [17:17] okay you are trying to reach the vserver or the host? [17:18] ah, scp works as well. [17:18] yes [17:18] seems that the shell blocks. [17:18] rephrased: you are trying to reach the vserver not the host? [17:18] yes [17:18] sshd running inside vserver, on public ip but different port. [17:18] you have the resolver set up? [17:19] yes, resolv.conf ok, name lookups work. [17:19] even scp works. [17:19] start sshd in the vserver with -d option ... [17:20] and ssh with -v ... where does it block/hang? [17:20] ssh -v: [17:20] debug1: Entering interactive session. [17:20] debug1: ssh_session2_setup: id 0 [17:20] debug1: channel request 0: pty-req [17:20] debug1: channel request 0: shell [17:20] debug1: fd 3 setting TCP_NODELAY [17:20] debug1: channel 0: open confirm rwindow 0 rmax 32768 [17:20] --hangs-- [17:21] ssh -v ethlife-b-kontro 'echo hello world': [17:21] ... [17:21] debug1: channel 0: output open -> drain [17:21] debug1: channel 0: rcvd close [17:21] debug1: channel 0: close_read [17:21] debug1: channel 0: input open -> closed [17:21] hello world [17:21] debug1: channel 0: obuf empty [17:21] debug1: channel 0: close_write [17:21] debug1: channel 0: output drain -> closed [17:21] ... [17:21] works. [17:21] only interactive sessions block. [17:22] But vserver name enter works as well. [17:22] hmm, then try the interactive login with -d/-v and give it some time (1-2mins) [17:22] sshd -d: [17:23] ...\n lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory [17:23] lastlog_openseek: /var/log/lastlog is not a file or directory! [17:23] debug1: Allocating pty. [17:23] debug1: session_new: init [17:23] debug1: session_new: session 0 [17:23] openpty: No such file or directory [17:23] session_pty_req: session 0 alloc failed [17:23] debug1: server_input_channel_req: channel 0 request shell reply 0 [17:23] debug1: session_by_channel: session 0 channel 0 [17:23] debug1: session_input_channel_req: session 0 req shell [17:23] debug1: PAM establishing creds [17:23] debug1: fd 10 setting O_NONBLOCK [17:23] stop! [17:23] debug1: fd 12 setting O_NONBLOCK [17:23] --waits-- [17:23] 15:23 < pflanze> debug1: Allocating pty. [17:23] 15:23 < pflanze> openpty: No such file or directory [17:23] (sorry for flooding) [17:23] that is odd ... [17:24] start the sshd as usual (in the vserver) and ssh again, let it hang then ... [17:24] from another terminal, try again to ssh to the vserver ... [17:25] both are waiting [17:25] now check /dev/pts/ inside the vserver [17:25] ls -la /dev/pts/* [17:26] empty. of course, it should mount that. [17:26] hmm, is it mounted? [17:26] cat /proc/mounts (on host) [17:27] nope, not even on the host. [17:27] hmm try to mount it manually ... [17:27] devfs. [17:28] it's part of devfs on the host. [17:28] and devfs is not mounted inside vserver [17:28] I use devfs too, that is not the problem, but you have to mount devpts ... [17:29] none /vservers/XXXX/proc proc rw 0 0 [17:29] none /vservers/XXXX/dev/pts devpts rw 0 0 [17:29] hm, permission denied if I try to do it from inside vserver [17:29] is it secure if done from the host? [17:29] this is done from outside ... in the startup script ... [17:30] hrm, fs type devpts not supported by kernel [17:30] ok I'm going to recompile.. [17:30] okay .. no big deal, issue solved ... [17:31] I was thinking about adding pts support for devfs, but it seemed that I'm the only one using such crappy/buggy stuff ... ;) [17:32] ? but isn't it supported by devfs already? The host wouldn't have /dev/pts/* otherwise, right? [17:32] yes, but the virtualization/sharing isn't ... [17:32] I guess mounting devfs inside vserver would be a security breach. [17:33] breach? a disaster! [17:33] ok. [17:33] but devpts is specially patched to not offer holes? [17:34] yes, it allows a context only to see the pts they own ... [17:39] chrism (~chris@82-32-130-79.cable.ubr05.hawk.blueyonder.co.uk) joined #vserver. [17:39] hi chris! [17:39] hi herbert [17:40] JonB (~jon@kg88.kollegiegaarden.dk) joined #vserver. [17:40] having troubles getting my head around quotas.. *again* [17:40] :) [17:40] what is the issue? [17:40] hi jon! [17:41] do you have one device (ie /dev/vroot/0) and then have all the context IDs added to it [17:41] or seperate devices for each context? [17:41] (hm, it'd be cool if the "mount" command would offer an option to only mount if not already mounted.) [17:41] hey Bertl [17:42] @chris you need one vroot per shared device ... [17:42] you need to add a quota hash per context ... [17:42] right, so all my vservers are on /dev/hda8 [17:42] so just one vroot for that? [17:43] although it doesn't make much sense, you could assign 3 vroot devices for /dev/hda8 ... [17:43] but you will soon ran out of them ... (default is 4/8) and maximum is 256 ... [17:43] but no more than 3? [17:43] oh i see [17:44] i only ask because I've been creating multiple /dev/vroot's (1 per vserver) [17:44] and adding the quota hash [17:44] but getting errors [17:44] you can asign any number of available vroot devices to one physical device ... think like loop device ... [17:44] but now I've added the quota hash to /dev/vroot/0, it seems OK [17:44] sounds good to me ... [17:45] but I seem to recall when I was first trying this out, adding more than one quota hash to a /dev/vroot/0 seemsed to cause problems [17:45] what patches are you using? [17:46] ancient by your standard ;) 2.4.22-c17e-mq0.11, cx-0.06, cq-0.11, dl0.04, rmap15k, ml0.06, mq0.11 [17:47] almost up to date ;) [17:48] dl0.05 would be adviseable ... some bugfix there ... [17:48] mq0.11 was changed to qh0.12 .. but no critical fixes ... [18:15] what bugfixes? [18:16] ; 0.05 - added enforcement for ext3 [18:16] ; - bugfix in dlimit_transfer [18:16] ; - clamped negative values to zero [18:16] ; - changed from blocksize to 1k [18:33] Hm, we are getting "wrong authentification" when trying to use ssh -X into a vserver. [18:33] (more exact: after login, when starting an X app) [18:35] X11UseLocalhost no [18:35] and add the hostname/ip into /etc/hosts if it isn't resolved by the resolver ... [19:06] AGoe (~agoeres@Dcfb4.d.pppool.de) joined #vserver. [19:06] hi alexander! [19:07] hi herbert ... it nearly wored..:-) [19:07] worked... [19:07] why almost? [19:12] Bertl: i think the FAQ needs to be written [19:12] well, when i added the option tagctx to the device-line in fstab cqhadd and cqdlim didn't give any errors.. but do i need the "ctxquota" option for the limits? because this again wasn't recognised [19:13] nope, ctxquota is outdated ... this was used a long time ago ... [19:13] you only need tagctx for limits, not even usrquota or grpquota ... [19:13] well, this machine is still up after 13 hours. [19:14] hi dan! [19:14] hi :) [19:14] hmm, told matt that this could happen ... [19:14] long time ago? .. i think it was in a posting from june..:-) [19:15] could be, it seems like a long time for me ;) [19:15] yeah, there's some features I'm not excersizing at all. maybe the SMP bug is in there somewhere :) [19:15] it's probably some kind of race ... [19:15] most likely [19:16] could even be some compiler issue ... [19:16] hmm, I wonder if it's reproducable with him booting with maxcpus=1 [19:16] hi [19:16] MrBawb: you are using my patchset? [19:16] speak of the devil :) [19:16] matta: yes [19:16] hrm... [19:16] odd [19:16] very odd [19:16] up 12:59, 1 user, load average: 496.19, 496.17, 496.06 [19:17] well, on my server... [19:17] i actually disabled the vserver init script [19:17] hi matt! [19:17] no need to start them up when I was just trying the initial kernel [19:17] and it worked until I tried to ssh into it.. [19:17] weird [19:17] MrBawb: what version of the util-vserver tools are you using? [19:17] no way that this is the cause ... [19:18] util-vserver-0.23.93 [19:18] hrm... [19:18] that is just strange [19:18] this is redhat 7.3 [19:18] so 2.96 gcc.. [19:18] gcc (GCC) 3.2.3 (Debian) [19:18] matt, did you recompile the kernel after the last patch session? [19:19] what do you mean patch session? [19:19] this was a fresh tree [19:19] last time we (you) tried some patches ... [19:19] i still don't understand [19:19] maybe we should compare .config files? [19:19] good point ... [19:20] herbert, what kind of version of the util-vservers or the old vserver-tools does the "limi"-patchset need? util-vserver-.23.96 doesn't compile at all on my system.. [19:20] matta: did you try booting with maxcpus=1? [19:20] no [19:20] perhaps i should try sometime... [19:20] today, when i tried to explain vserver to another comp.sci student, i figured that maybe we should call it multiple userlands, rather than context [19:20] hard as this is my largest server [19:20] yeah [19:20] don't piss your users off :) [19:20] i will have to just schedule a 1 hour maintainene window in a few days [19:21] to give me enough time to try multiple settings/kernels [19:21] @AGoe what patch version do you use? [19:21] MrBawb: i heard you have a "lab" now :) [19:21] heh yeah [19:22] herbert, those of your "per context disk limit" page for 2.4.22 [19:22] I'm testing synflood protection products [19:22] what'd you do move the cabinet and extreme over there? [19:22] or do you have a mini production setup going on? [19:22] there's a whole desk setup for it [19:22] the extreme is sitting on the floor, not plugged in :) [19:23] @AGoe they work well with jack's tools 0.23 and such ... [19:23] @dan what a shame ... an unused switch ;) [19:23] what's the problem with it? it's either 220AC or DC right? [19:23] matta: the problem with it is that it's an extreme :) [19:23] i remember I wanted to hook it up and power was the issue [19:23] yeah, it's probably 15amp or 20amp [19:24] there's a 6509 in the same room with the same problem [19:26] Bertl, i got the jacks tools from the debian testing branch (0.23-3 ??) but when i try to set S_CONTEXT the vserver doesn't start, just prduces some init-usage error. without S_CONTEXT set it goes up normally [19:26] what message? [19:28] Bertl, something like "init usage 123456" can't remember exactly.. sounds as if fakeinit wouldn't work with S_CONTEXT.. [19:28] alright, time for work :) [19:28] hmm, show me you .conf [19:31] i'll try.. [19:33] DCC SEND from AGoe [192.168.92.183 port 32774]: won't work ;) [19:33] won't? too bad [19:34] well here are the lines [19:34] you have to use your real ip, lot a local ... [19:34] s/lot/not/ [19:35] that#s difficult.. [19:35] well, that's the way DCC works ;) [19:36] DCC SEND from AGoe [192.168.92.183 port 32775] [19:37] merde..:-) [19:37] okay paste it on the channel ... [19:37] S_HOSTNAME="limit" [19:38] IPROOT="192.168.92.120/255.255.255.0" [19:38] IPBROADCAST="192.168.92.255" [19:38] IPROOTDEV="eth0" [19:38] ONBOOT="no" [19:38] S_NICE="" [19:38] S_FLAGS="sched lock nproc fakeinit" [19:38] ULIMIT="-HS -u 256 -n 1024" [19:38] S_CAPS="CAP_NET_RAW" [19:38] #S_CONTEXT=3 [19:39] that#s it.. [19:40] ok [19:40] bit of a diverse question [19:40] has anyone tried using mrtg to monitor vserver bandwidth? [19:42] seems my line is breaking down ... [19:42] breaking down? [19:42] @AGoe probably you already messed up some files with the dynamic context setting ... [19:43] you need to 'reset' the context tag info on those files [19:43] you can either use my version of the ext2fs tools .. (the patch which adds chctx/lsctx) ... [19:44] or just touch all files of 'limit' from ctx0 [19:45] does the vs1.0 release work with the old vserver tools ? [19:45] then please set a fixed S_CONTEXT=1000 for exa [19:45] @jon yes, it should ... [19:46] Bertl, so once a vserver has started it's files keep the context information even after it was stopped? [19:46] yes, that is the principle of context tagging ... [19:46] Bertl: would i gain anything by the new util-vserver ? [19:47] @jon, yes CAP_QUOTACTL and CAP_PTRACE ... [19:47] .. i'll give it a try, hope for the best and'll be back afterwards.. thanx herbert.. [19:47] bye ... [19:48] AGoe (~agoeres@Dcfb4.d.pppool.de) left irc: Quit: Client exiting [19:49] Bertl: what do those do ? [19:49] @chrism yes, a company in austria did this ... [19:49] @jon CAP_QUOTACTL allow quota ioctls from inside a vserver ... [19:50] Bertl: and that PTRACE ? [19:51] this is what man capabilities explains, it was just missing from the tools ... [19:52] Bertl: and what can i use that for ? [19:54] CAP_SYS_PTRACE allows to ptrace() a process ... [19:54] The ptrace system call provides a means by which a parent process may observe and control the execution of [19:54] another process, and examine and change its core image and registers. It is primarily used to implement [19:54] Bertl: yeah, i read that [19:54] breakpoint debugging and system call tracing. [19:54] you know strace? [19:54] Bertl: ues [19:54] yes [19:55] okay, ever tried to strace chcontext --ctx 100 cat /proc/self/status ? [19:55] no [19:55] well, go ahead, try it ;) [19:55] i'm not completely convinced it is a good idea [19:56] what? [19:56] trying that [19:56] hmm, why? [19:58] well, go ahead, try it ;) [19:58] thats why [19:58] besides i am still compiling the new kernel [19:58] hey, I'm not evil, am I? [19:59] it's just some kind of debugging developers do several times a day ... [20:01] no, not even compared to a kitten [20:01] and it is not possible if CAP_SYS_PTRACE is taken away ... [20:01] anyway, as i tried to start a discussion about earlier, i tried to explain what vserver is to a fellow comp.sci student, and i think that using the words "userland context", rather than just plain context explains it better [20:01] I'm not sure but it might be ... [20:01] originally it was 'security context' [20:02] i know [20:02] but people dont understand what a security context is [20:02] userland context sounds like something done in userland to me ... [20:02] they do understand if you tell them that vserver allows you to run different userlands [20:02] if I explain it the first time, I try to use process/task separation ... [20:03] true, it does have that ring [20:03] Bertl: well, processes are already seperated [20:03] then after some time I'll call it context (containing a bunch of processes ...( [20:04] then people has to know what the meaning of this particular context is [20:06] but I agree, the optimal naming has not been found yet ... [20:31] okay .. cu l8er ... [20:31] Nick change: Bertl -> Bertl_oO [21:05] Bertl_oO_ (~herbert@MAIL.13thfloor.at) joined #vserver. [21:06] Bertl_oO (~herbert@MAIL.13thfloor.at) left irc: Read error: Connection reset by peer [21:16] pflanze (~chris@129.132.19.124) left irc: Ping timeout: 485 seconds [21:45] ensc (~ircensc@134.109.116.202) joined #vserver. [21:45] hello [21:45] hi [22:18] AGoe (~agoeres@Dcfb4.d.pppool.de) joined #vserver. [22:29] AGoe (~agoeres@Dcfb4.d.pppool.de) left irc: Quit: Client exiting [23:04] Nick change: Bertl_oO_ -> Bertl [23:05] hi! [23:06] @ensc do you have a moment? [23:06] Bertl: yep [23:07] I tied to compile the util-vserver-0.23.194 but it is too much C99 for my 2.95 gcc :( [23:07] is there a 'new' version with syscall support for gcc 2.95? [23:08] mmh, I have not tried yet to bring >0.23.100 down to gcc-2.95 compatiblity [23:08] syscall switch is in 0.23.96 also [23:08] hmm, but definitely not working :( [23:09] say-out (~say@212.86.243.154) left irc: Ping timeout: 492 seconds [23:09] let me check ... [23:12] ahh okay, my fault ... I changed the version from 0x010000 to 0x010001 ... [23:12] could we agree on something like the least 8 bit are always interface compatible? [23:13] and'ing with ~0x0f? [23:14] more like 0xff, but yes ... [23:20] #vserver: mode change '+o Bertl' by ChanServ!services@services.oftc.net [23:20] #vserver: mode change '+o riel' by ChanServ!services@services.oftc.net [23:21] #vserver: mode change '+o surriel' by ChanServ!services@services.oftc.net [23:21] #vserver: mode change '+o mcp' by ChanServ!services@services.oftc.net [23:29] brb ... [23:58] marlow (marlow@as2-6-3.tbg.s.bonet.se) joined #vserver. [23:58] good evening [23:59] hey marlow [00:00] --- Tue Nov 4 2003