[00:27] Cmaj (~cmaj@3ffe:bc0:5f3:1:9999:911:c3d3:5431) joined #vserver. [01:25] click (click@gonnamakeyou.com) joined #vserver. [01:25] grmph [01:25] same to you too! 8-) [01:25] ah, you're awake [01:25] iptables inside a vserver? [01:25] big nono! [01:26] or does that have to be applied on the root-server. [01:26] ok [01:26] just what I needed to know [01:26] :) [01:26] 8-] [01:26] got this stupid halfassed customer that wants to use a gameserver, and allow cracked clients to join [01:26] told him to set it to lan-mode, but nooooooo, he wants it public [01:26] cracked means? [01:27] pirated ver of some game [01:27] is that legal? [01:27] no [01:27] isn't that supporting illegal activity then? [01:28] but most game wwould be boring if there where no pirated user to play with you :) so some gmes compagny dont mathers [01:28] i told him to stuff himself tho', but it made me curious as to the iptables inside vs-question [01:28] probably those games, which do not have a large user base anyway ... [01:28] i've never thought of it actually :) [01:29] Bertl: urm, battlefield1942/desert combat [01:29] Bertl: it does have a huge base [01:29] never heard of it ;) [01:29] goodie :) [01:29] serving (~serving@213.186.188.205) left irc: Read error: Connection reset by peer [01:30] is there another company making good games besides idSoft? *G* [01:32] yeas french one ubisoft [01:33] ubisoft! [01:33] splinter cell! [01:33] :) [01:33] darned good [01:33] where are the sources? does it run on linux? [01:34] they've been thinking of porting it actually [01:34] hm, now, where was that posting. [01:34] linux-gamers or somewhere [01:34] same for UT ... unfortunately they never got to actually do it ... [01:34] UT ? it's ported. [01:35] no, they said, they'll port it ;) [01:35] or was that ut2003? [01:35] one of those was ported, and works as well (tried) [01:35] can't remember which, as I seldom play [01:35] yeah, ut2003 runs on my linux machine ;) [01:36] most online game have server on linux :) [01:36] ah, it wasn't the game itself, it was the gameserver. [01:37] he wanted to filter out the traffic that does the cd-check using iptables [01:37] doooh [01:37] put the game in lan mode! [01:37] hey isnt there an emulator or something that make you run most games on linux [01:37] Cmaj: winex? [01:37] ahahi would not help :) [01:38] i dunno :) [01:38] Cmaj: the transgaming engine? [01:38] something i read .. dont know what it is [01:38] www.transgaming.com I think [01:38] C64 emulator? [01:38] Bertl: woooh, last ninja! [01:39] <-- master of 1,2,3 and remix! [01:39] no too play windows direct x games ..mame is on linux i think for that [01:39] well, I programmed the Floppy on C64 to do funny things ... [01:39] Cmaj: then its transgamings directx wrapper, it's called WineX [01:39] and Impossible Mission was great ... [01:40] hm, you're an old c64-scener? [01:40] very old, yes ... [01:41] catalog [01:42] later switched to amiga ;) [01:43] in my time it was an apple [01:44] oooh ... [01:44] i'm an old c64/amiga scener as well [01:45] well, had 2-3 presentations on the amiga sessions in austria, most time showing the 'interactive' mandelbrot stuff I wrote ... [01:45] made music, graphics and some code for a group called creators on the c64, moved to amiga and Network, then founded our own team Virtual Designz which is more or less 'dead' these days, except for releasing a few intro's now and then. [01:45] augh! i hate bugs. doesnt matter what im trying to do i run into more bugs that keep me form doign what i want to do. this is great for the people recieving bug reports but its not a very big consolation to me. [01:46] talon: new bugs? let's hear! [01:46] Bertl: non vserver related bug. [01:47] hmm, does this mean we are bug free? [01:47] heh. no not likely just that im currently distracted by another bug in another project. [01:48] im sure i will find more in vserver soon.(although id love to be wrong about that) [01:57] Bertl: did santa bring you a tft ? [01:57] nope, did not ... [01:57] Bertl: oh [01:57] Bertl: i suppose 15 is too small ? [01:58] well probably was busy bringing other people more useful stuff ... [01:58] bertl definatly deserves a nice flatscreen for all teh work he does. [01:59] wish i had a flatscreen. [02:00] JonB: atm I'm using a Hewlett-Packard HP HP TFT450 here ... [02:00] 14.5" 1024 x 768 ... [02:01] Bertl: how big is that ? [02:01] Bertl: just one ? [02:01] wow... debian-sarge has __NR_vserver in the system headers [02:02] w00t? :) [02:02] nais [02:02] great! [02:02] wećre going mainstream on debian :))) [02:02] ć = ' [02:02] JonB: 14.5" is a little smaller than 15" [02:02] Bertl: do you have a GFX card with a DVI out [02:03] Bertl: it needs to be a female DVI on the gfx card [02:03] hmm, maybe I have one somewhere ... let me take a look ... [02:04] Bertl: i suppose you dont [02:05] well I remember that one of the nVidia cards had one ... but I can not find it atm ... [02:06] Bertl: okay [02:07] currently I use a matrox card here MGA G200 [02:07] Bertl: so, just one monitor? [02:08] well, here yes, my other location has a Belinea CRT ... [02:08] Bertl: other location ? [02:10] I 'commute?' between Laaben and Pama .. under the week it's usually Laaben, at the weekend Pama [02:12] here I have the TFT450 in Pama the Belinea 103070 IIRC a 17" CRT ... [02:12] how far are they apart ? [02:12] and why do you commute ? [02:12] and just where are they located anyway ? [02:14] they are in Austria, Europe, about 120km apart, and my parents live in Pama and my girl and I live in Laaben (any further questions ;) [02:15] Bertl: yeah [02:15] Bertl: suppose you somehow got your hands on a second tft with ONLY dvi, could you get a dual screen setup ? [02:16] hmm, probably ... [02:16] Nick change: cdub -> cgone [02:16] Bertl: hmm [02:18] it's gonna be hell shipping it without the original case :( [02:19] it's probably hell to ship it anyway ... [02:19] Bertl: why ? [02:20] big, heavy parts tend to be expensive when shipped ... [02:20] Bertl: the original case, and that foam, that was easy [02:20] okay, a tft isn't that big ... [02:20] Bertl: and it's just a 15" [02:21] hm... [02:21] wonder if fedora supports vserver out of the rh -kernel... [02:21] wrapping it with styrofoam or foam rubber should do the trick ... [02:22] (sorry was meant for JonB ;) [02:22] i know [02:22] :) [02:24] how is 1.26 towards fedoras kernel? [02:24] i'd need the vanilla kernel, or does it patch in nicely? [02:25] (thinking of the old RHx.x patch-set that existed) [02:25] Bertl: HAHAHA, no it wont [02:25] Bertl: shipping someting that far, it needs to be firmly secured [02:25] Bertl: and i dont know if i want to sent it to you yet, but i do have one 15"tft i dont use since i bought my PB [02:26] PB? [02:26] Bertl: PowerBook [02:26] click: well for now it requires a vanilla kernel ... [02:26] ok, fetching that as well then [02:26] rick12321 (~rick12312@113.192.33.65.cfl.rr.com) joined #vserver. [02:27] Hello [02:27] hi rick12321! [02:27] #!/usr/bin/shellmod [02:27] whats that? newvserver script [02:27] I have no idea ... where did you find it? [02:28] in the newvserver shell script [02:28] i created a vserver, but I cannot su to root [02:28] what tools? [02:28] I can ssh to the vserver, but su says bad password even though i set it [02:28] and what kernel/vserver version by the way? [02:28] by entering the vserver and running passwd [02:28] 2.4.24-vs1.26 [02:29] util-vserver 0.28 or 0.29? [02:29] Bertl: i had 2 15"tft dual screen at my linux, but the powerbook only has one external screen, so the other is just standing there :/ [02:29] 28 [02:29] Bertl: anyway, i'll think about it [02:29] should i up it to 29? [02:29] let's check with enrico ... sec [02:29] rick12321: thats part of the debian vserver package? [02:29] well, bed time [02:30] no I am not using debian [02:30] everything i have downloaded has been source [02:30] JonB (~NoSuchUse@kg203.kollegiegaarden.dk) left irc: Read error: Connection reset by peer [02:30] oh shite, bedtime ... almost forgot I've got a meeting tomorrow :/ [02:31] rick12321: well, might need parts of linuxconf, i'm not sure tho', using debianized scripts [02:31] <-- goes to bed [02:31] cya [02:31] thx [02:31] hmm [02:31] enrico sais, that must be part of the linuxconf package ... [02:31] s/sais/says/ [02:32] i am downloading linuxconf now [02:32] thanks for the pointer [02:32] np [02:32] is vserver used in any production environments? [02:33] heres my main question. I ran fdisk while in a vserver [02:33] and I was able to delete my swap partition [02:33] that seems bad [02:34] is something not set up right [02:35] ad production env: yes, have a look at the linux-vserver.org page, there is a subpage containing companies using it [02:35] in a correctly configured vserver you have no block devices to do fdisk on ... [02:35] ok good. it must be a setting then [02:36] # ls -la /vservers/XXXX/dev/ [02:36] drwxr-xr-x 3 root root 4096 Dec 14 17:29 ./ [02:36] drwxr-xr-x 18 root root 4096 Jun 4 2003 ../ [02:36] crw-rw-rw- 1 root root 1, 7 Apr 6 2003 full [02:36] srw-rw-rw- 1 root root 0 Dec 14 17:29 log= [02:36] crw-rw-rw- 1 root root 1, 3 Apr 6 2003 null [02:36] crw-rw-rw- 1 root root 5, 2 Feb 13 16:27 ptmx [02:36] drwxr-xr-x 2 root root 0 Dec 14 17:27 pts/ [02:36] crw-r--r-- 1 root root 1, 8 Apr 6 2003 random [02:36] crw-rw-rw- 1 root root 5, 0 Feb 13 01:58 tty [02:36] crw-r--r-- 1 root root 1, 9 Apr 6 2003 urandom [02:36] crw-rw-rw- 1 root root 1, 5 Apr 6 2003 zero [02:37] and creating new devices is prohibited by the capability system [02:37] awesome [02:37] this vserver is great [02:37] yeah, I agree ... [02:44] linuxconf takes forever to compile [02:44] is this mozilla or something [02:44] probably, I do not use it ... [02:45] you dont use the newvserver script? [02:45] nope, IMHO there are better ways to get a new server [02:45] are there any .conf files on the net? i see all the directives, but is there an example of a secure one? [02:46] thats all i want the newvserver script for [02:47] well, that is quite simple ... [02:49] IPROOT="eth0:192.168.0.1" [02:49] ONBOOT=yes [02:49] ULIMIT="-HS -u 100" [02:49] S_HOSTNAME=my.test.org [02:49] S_DOMAINNAME= [02:49] S_NICE= [02:49] S_CAPS= [02:49] S_CONTEXT=1001 [02:49] that should do for a start ... [02:49] awesome thx [02:49] i have a feeling something i didnt put isnt letting me become root when I ssh to the vserver [02:49] because even when i put the right password it says incorrect [02:50] it might be interesting to add some flags if you want to limit the number of processes or use fair scheduling ... [02:50] did you check the syslog on that vserver? [02:50] yes i am interested in all of that. i especially like the ability to control the overall nice level [02:50] no good idea [02:51] overall nice is done with S_NICE, the flags with S_FLAGS="sched nproc" [02:52] Feb 13 18:22:47 gambit su[32717]: Authentication failed for root [02:52] Feb 13 18:22:47 gambit su[32717]: - pts/2 rick-root [02:52] no clues really [02:52] sched is the fair scheduling (which accounts all processes in a vserver as one) and nproc is the maximum number of process limit ... [02:53] is there some special way i have to change the root password? [02:53] awesome [02:53] try to trace the su (for example with strace) [02:53] ok [02:53] i really wish i knew how to read this [02:54] well, can you upload it somewhere? [02:54] yea 1 sec [02:54] best would be "strace -fF -s 1000 -o sulog.txt su [02:56] http://webmail.liquidpages.com/strace.txt [02:56] oh ok [02:56] let me do that [02:56] hmm ... [02:56] i cant do that while i am in the vserver, does it matter if i do it as the master root user [02:57] semget(1, 4096, IPC_CREAT|0x40171140|0400) = -1 ENOSYS (Function not implemented) [02:57] this is slackware 9.0 [02:57] that looks fishy to me ... [02:57] really how so [02:57] maybe you disabled shared memory or something like this? [02:57] in the kernel ... [02:57] let me see [02:57] might not be a problem anyway ... [02:58] Action: rick12321 make menuconfig [02:58] open("/etc/shadow", O_RDONLY) = -1 EACCES (Permission denied) [02:58] open("/etc/suauth", O_RDONLY) = -1 ENOENT (No such file or directory) [02:58] that probably is a problem though ... [02:58] hmm [02:58] root@gambit:/vservers/test/etc# ls -al shadow [02:58] -rw------- 1 root root 1332 Feb 13 18:23 shadow [02:58] no file called suauth [02:58] but not in my master system either [02:59] did you lose the suid flag on su maybe? [02:59] oh damn thats the problem, shit [02:59] # ls -la `which su` [02:59] -rwsr-xr-x 1 root root 17912 Mar 7 2002 /bin/su* [02:59] my fault [02:59] yes you are right 100% [02:59] in that case, I would check for other suid/sgid binaries as well ;) [03:00] it was my fault, because on my master system, i set it to world nothing [03:00] but i was a dumbass and fixed it with a sledgehammer [03:02] so just so i know, strace displays the system calls in the binary [03:02] live and learn ... [03:03] true story [03:03] so say i had a quad xeon system and loaded it up with 20 vservers, i wonder how it would run [03:03] great ... [03:04] I tested on dual PIII 1GHz with up to 60 servers ... [03:04] were the vservers doing anything [03:04] thats the specs this box is [03:04] dual p3 1ghz [03:04] yeah, each one apache, postfix, mysql, logger ... [03:04] excellent [03:05] i cant believe this isnt very popular [03:05] this totally changes linux security [03:05] well, it was dormant for some time ... [03:06] i run a site that gets tons and tons of hack attempts, so its only a matter of time before someone roots it. with this, i can run the entire "server" in a vserver. and schedule backups from the master server [03:06] just make sure to make it secure ... for example the proc entries ... [03:06] backups to the master server rather [03:06] there are lots of docs on this, which one is the best for security. i need to read how to limit dev devices and proc entries [03:07] you have to 'remove' critical proc entries from the vservers view ... [03:07] so if i just remove the dev and proc files, it is fine [03:07] this can be done with the vproc tool, available on the download page ... [03:07] ah ok [03:07] regarding dev, the list I posted before should be all that is required ... [03:08] ok [03:08] the authors of this should really add a contribution page [03:08] like paypal donations [03:08] http://www.13thfloor.at/vserver/donate/ [03:08] haha now i have to put my money where my mouth is [03:09] thx [03:09] np ;) [03:09] i hope i can help to make the project more popular. [03:10] rick12321: how did you hear about that project? [03:10] i am going to link it from tons of places [03:10] i knew of the concept and i just typed some keywords in google [03:11] ahh the all-knowing garbage dump ... [03:11] :) [03:12] i rated vserver on freshmeat as i am a little hard i give a 8 :) [03:13] what country is .at [03:13] the dude who writes this [03:15] seems like linuxconf is a lot like webmin [03:15] .at is in austria ... [03:15] I mean is Austria ;) [03:16] ok, glad its not afganistan [03:16] this is in Europe ... [03:16] what do you want to know about 'the dude who writes this'? [03:16] AHAHAH YEAS ;P [03:29] serving (~serving@213.186.188.205) joined #vserver. [04:24] noel_ (~noel@pD9E098E4.dip.t-dialin.net) joined #vserver. [04:26] Cmaj (~cmaj@3ffe:bc0:5f3:1:9999:911:c3d3:5431) left irc: Ping timeout: 483 seconds [04:29] WSU (~Josh@ny.webpipe.net) left irc: Quit: Leaving [04:32] noel- (~noel@pD952CB42.dip.t-dialin.net) left irc: Ping timeout: 504 seconds [05:35] okay, folks, have a good wossname, cu tomorrow! [05:35] Nick change: Bertl -> Bertl_zZ [06:13] mugwump (~sv@218-101-44-11.paradise.net.nz) joined #vserver. [07:06] lucks (~c8415a70@humbolt.nl.linux.org) joined #vserver. [07:06] hola [07:07] lucks (~c8415a70@humbolt.nl.linux.org) left irc: Client Quit [08:24] Cmaj (~cmaj@3ffe:bc0:5f3:1:9999:911:c3d3:5431) joined #vserver. [09:08] Cmaj (~cmaj@3ffe:bc0:5f3:1:9999:911:c3d3:5431) left irc: Quit: BitchX-1.0c19 -- just do it. [09:14] Cmaj (~cmaj@3ffe:bc0:5f3:1:9999:911:c3d3:5431) joined #vserver. [09:50] ensc (~ircensc@ultra.csn.tu-chemnitz.de) left irc: Ping timeout: 480 seconds [10:07] mugwump (~sv@218-101-44-11.paradise.net.nz) left irc: Quit: Lost terminal [12:53] Doener (~doener@pD958818B.dip.t-dialin.net) joined #vserver. [12:56] good morning [12:56] hi Doener [12:57] JonB (~NoSuchUse@129.142.112.33.ip.tele2adsl.dk) joined #vserver. [14:52] mhepp (~mhepp@r72s22p13.home.nbox.cz) joined #vserver. [15:32] loger joined #vserver. [15:51] JonB (~NoSuchUse@129.142.112.33.ip.tele2adsl.dk) joined #vserver. [16:05] Nick change: Bertl_zZ -> Bertl [16:05] morning everyone! [16:05] guten tag [16:07] hi mids! [16:12] rick (~rick@adsl-065-083-169-002.sip.mco.bellsouth.net) joined #vserver. [16:12] Hello [16:13] hey rick [16:13] I just started with vserver yesterday [16:14] i just patched the kernel with the quota mod [16:15] hi rick! [16:15] Hi! [16:15] did you lose your 12321 or are you a different rick? [16:16] same rick [16:16] different computer [16:17] does the vserver need any mirrors? [16:17] i made a paypal donation yesterday, and i can donate some pretty serious bandwidth [16:17] i work at a datacenter [16:18] well we where thinking about mirrors, haven't got to actually do something about it .. but yes, it's a good idea, and thanks again for your donation ;) [16:19] so today you are attacking quota? [16:19] yes [16:19] you are going fast man! [16:19] just finished, booting into the new kernel now [16:19] this is very exciting for me [16:20] i see a lot of promise with this [16:20] you have to consider a few things, or otherwise you will be disappointed by quota/dlimit stuff ... [16:20] deus (~dr@pD9507EE1.dip0.t-ipconnect.de) joined #vserver. [16:20] hi [16:20] hi [16:20] di deus! [16:20] s/di/hi/ [16:20] what should i consider [16:21] first, to use quota or disk limits, you have to 'tag' each file with an xid (context id) [16:21] do you think it would be possible/feesible to run the entire system in a vserver, and the "main" server is just a simple OS necessary to boot the system and configure the network [16:21] and store the kernel [16:21] guys, i have got a question: how can I "kill" a running vserver? [16:21] deus: vserver stop doesn't work I presume? [16:21] yes [16:22] by running the entire system in a vserver, if it gets hacked, the hacker cannot demolish the system [16:22] and wouldnt even have to know he is in a vserver [16:22] rick: well if you think as entire system like X86 and such, it is possible but not advantageous ... [16:22] deus: what tools/vserver/patches do you use? [16:23] rick: XFree86 I mean [16:23] i am thinking more for a server [16:23] brb [16:24] deus: http://vserver.13thfloor.at/Stuff/testme.sh (give that a spin, and let me know what it reports) [16:25] Bertl: your parport.c program, "-p select parport id (0 default)\n" is that which pins on the parport, or is it which parport to use ? [16:26] the -p is the parport to use ... [16:26] Bertl you've got the output as querry [16:26] Bertl: how does your util know which pins to send data at ? [16:26] deus: 2.4.22-vs1, where did that come from? [16:27] thats the 1.00 patch from your site [16:27] JonB: 8 bits = a byte is the command argument ... so 1 is pin 1, 2 pin 2, 4 pin 3 ... [16:27] Bertl: ahh [16:28] deus: hmm -EXTRAVERSION = [16:28] +EXTRAVERSION = -vs1.00 [16:28] Bertl: i found a cable which has parport connection types, but not all lines are wired up [16:28] not necessary to have all, for reset, one is sufficient, but I guess a parport cable will at least connect the data lines ... [16:29] deus: did you modify the kernel name afterwards? [16:29] (the extraversion to be precise) or is this some copy/paste error? [16:30] deus: anyway, you know the context id of the vserver you want to kill? [16:30] yes, i changed it, because of some little modifications [16:30] Bertl: yes [16:30] Bertl: it seems like data0 and data1 are connected at least [16:30] okay do 'chcontext --ctx killall -TERM' [16:31] JonB: well that should work for reset, and maybe power? [16:31] Bertl: power? you want to be able to power it completely off and on ? [16:32] well, is it ATX? [16:32] no, AT [16:32] then no power ... just reset ... [16:32] Bertl: i figured i would just leave it always on [16:32] Bertl: okay [16:33] Bertl it doesn't work [16:33] chcontext --ctx 3 killall TERM [16:33] New security context is 3 [16:33] TERM: no process killed [16:34] ah sorry, forgot that killall is different to killall5 [16:35] should read ''chcontext --ctx killall5 -TERM' [16:35] or if -TERM isn't recognized, then 15 [16:35] Bertl, THX [16:35] you're welcome ... [16:36] btw. here is something for the hall of fame [16:36] 1:36pm up 53 days, 45 min, 1 user, load average: 936.72, 678.29, 280.40 [16:36] USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT [16:36] root pts/12 pd9507ee1.dip0.t 1:35pm 0.00s 0.06s 0.01s w [16:36] deus: newer releases feature a special vkill to send signals to all processes in a context ... [16:37] thats one hell of a' load [16:37] yup ... [16:37] *g* [16:38]