[00:53] *** residual has quit IRC (Ping timeout: 240 seconds) [01:04] *** coil has quit IRC (Ping timeout: 260 seconds) [01:06] *** j3m has quit IRC (Ping timeout: 240 seconds) [01:26] *** coil has joined #arpnetworks [01:26] *** j3m has joined #arpnetworks [04:12] do they need to? [04:17] no, but clients would be nice :p [04:19] ntp clients? [04:21] yes, on the host, because everytime I reboot my clock is half an hour off, I do run a ntp client myself, but by default it refuses to correct such a big difference in one go. [04:21] yeah, ntp won't update if it's like 1000 seconds off [04:21] my current workaround is to rdate manually after a reboot [04:53] infrared: i haven't had any support requests that i can recall with that neg runtime error, although i have seen it in the logs [04:53] infrared: i do use supermicro with intel, but as far as the VMs are concerned, it can't see it; they only see the emulated proc and chipsets [04:56] DaCa: yeah, i need to run ntp on the hosts; my last few servers have it, but i've delayed putting it on the others since i don't want a huge clock jump; need to do so during a maintenance window, which i haven't declared in a while [05:13] *** residual has joined #arpnetworks [06:37] *** ziyourenxiang has joined #arpnetworks [06:37] *** heavysixer has joined #arpnetworks [06:37] *** ChanServ sets mode: +o heavysixer [06:52] *** CESSMASTER has joined #arpnetworks [06:59] *** vtoms has joined #arpnetworks [06:59] *** amdprophet has quit IRC (Ping timeout: 260 seconds) [07:00] *** cedwards has joined #arpnetworks [07:19] *** amdprophet has joined #arpnetworks [07:35] *** vtoms has quit IRC (Remote host closed the connection) [07:51] *** vtoms has joined #arpnetworks [08:13] note: I just signed up on a FreeBSD 8.0 system. I ran 'portaudit -Fda' and there were I think three vulnerabilities ootb. [08:14] what vulns? [08:14] sudo, curl and I think ca_root_nss [08:15] (I've patched them now so the list is too far back in my buffer) [08:15] ah :) [08:15] just thought I'd mention it. [08:24] *** fink_ has joined #arpnetworks [08:24] *** fink_ has quit IRC (Client Quit) [08:26] *** fink_ has joined #arpnetworks [08:32] *** schmir has joined #arpnetworks [08:42] *** schmir has quit IRC (Ping timeout: 264 seconds) [09:11] *** ziyourenxiang has quit IRC (Quit: ziyourenxiang) [09:32] *** woland has quit IRC (Remote host closed the connection) [10:44] *** heavysixer has quit IRC (Quit: BAMPF!) [11:04] *** schmir has joined #arpnetworks [11:37] hey up_the_irons you guys don't take paypal eh? [11:43] aem: no [11:43] http://support.arpnetworks.com/faqs/billing/do-you-accept-paypal [11:43] :) [11:43] hehe thanks [11:43] np [11:44] does arpnetworks run an ntp server? [11:44] no [11:44] <- joshua here btw [11:44] hey joshua [12:00] *** djbclark has quit IRC (Ping timeout: 246 seconds) [12:04] *** lll_ has quit IRC (Quit: leaving) [12:04] *** djbclark has joined #arpnetworks [12:04] *** djbclark has quit IRC (Changing host) [12:04] *** djbclark has joined #arpnetworks [12:05] *** lll has joined #arpnetworks [12:31] *** heavysixer has joined #arpnetworks [12:31] *** ChanServ sets mode: +o heavysixer [12:31] looks like buildworld doesn't like ccache, although I've used it on my other BSD installations :( [13:22] if I plan to setup BSD jails, is there a particular private subnet/range I should or should not use? [13:23] no [13:24] wanted to make sure I wasn't going to conflict with existing addresses [13:24] do you have 2 nics? [13:25] cedwards: i put my jails on a private internal interface, and used pf for nat [13:25] all behind one ip [13:25] fink_: that's what I was planning. [13:26] cedwards: if the ips are on an internal interface, then they won't interfere with anything public [13:26] Wouldn't one neeed a pretty decent VPS for jails? :) [13:26] dxtr: nah. jails are incredibly lightweight. [13:26] Cool. Might look into it then [13:26] dxtr: i see now overhead increase with idle jails [13:26] s/now/no/ [13:27] infrared: Interesting [13:27] dxtr: I just loaded up 26 jails on a P4 1G ram and the load went to.. wait for it.. 0.30. [13:27] it's because it's kernel based [13:27] not "real" vps [13:27] But what's *REALLY* worth jailing without losing functionality (Like userdirs in a webserver and stuff) [13:27] fink_: so I can just create alias IPs on my em0 assigning private IPs and I should be fine? [13:28] cedwards: create an lo1 or whatever [13:28] I guess some sort of *sql database could be jailed [13:28] assign them there [13:28] dxtr: [13:28] dxtr: I segregate all my major services into jails (postfix, bind, squid, ssh-bastion, etc) [13:28] dxtr: "application" jails [13:28] dxtr: i jail based on processes/domains [13:28] like www.example.org is a www jail [13:28] dns.example.org is a dns jail [13:29] db [13:29] dxtr: and I'm planning on building some shell jails for some of the guys in my UG as well. [13:29] mail [13:29] etc [13:29] fink_: Yeah, I was thinking about it [13:29] How do one administer DNS in a cool way? [13:29] without sql :) [13:30] i use tinydns/dnscache [13:30] I use BIND [13:30] old-school bind here too. [13:30] zone files by hand :) [13:30] I'd like some cool way to remotely administer the DNS :) [13:30] Or, well, maybe not *TOO* remotely [13:31] But something other than editing zone files by hand [13:31] bind is big, slow, and insecure [13:32] Right. I'm actually considering switching :) [13:33] What are the competitors to BIND? [13:33] small, fast and secure? [13:33] powerdns [13:33] djbdns [13:33] i like bind though [13:33] i know a lot of people who use powerdns and have only good things to say about it [13:34] going from bind to tinydns was kind of like going from apache to cherokee, for me [13:34] "wow this program is so much easier to admin" and "wow half the memory footprint" [13:35] fink_: How do one admin djbdns? [13:35] I've only briefly used tinydns, but I'd like to learn it. [13:35] dxtr: command line, web, sql, etc. [13:37] fink_: How do the command line work? [13:37] And how would it work if I jailed djbdns? [13:37] i've jailed tinydns/dnscache [13:38] that's not what I asked :) [13:39] fink_: I've done jails before, so I'm familiar with creating alias IPs but I've always done it on the same interface. [13:39] fink_: can you refer me to how to create a virtual internal interface for alias IPs? [13:40] cedwards: heh, a bunch of people have been asking me this recently! [13:40] mb i should just blog it ;) [13:41] yeah :P [13:41] cedwards: do you mind asking me later? i'm at work at i have to finish some stuff [13:41] fink_: no problem [13:41] thanks [13:44] i think i just found it on the google machine. [13:45] link? [13:46] fink_: tinydns looks like hell to admin .( [13:47] What the hell is wrong with those configuration files? :( [13:47] s/configuration/zone/ [13:47] dxtr: are you serious? [13:47] no? [13:56] mike-burns: nsd and unbound, are current best practices for DNS [13:57] Excellent, I'll check them out. [13:59] mike-burns: recursive dns and authoritative-only dns are separate in that stack. nsd is for authoritative, unbound for recursive [13:59] so, you use unbound for servers to configure in their /etc/resolv.conf; and nsd for hosting zones [14:00] Oh interesting. That makes sense. [14:00] yeah, i've been migrating to unbound for recursive. i run it on my laptop too and just have "nameserver 127.0.0.1" in my resolv.conf, makes things faster [14:01] not using nsd yet, but i put it in a test environment, and i like it [14:01] both are made by the same people [14:09] up_the_irons: "current best practices" as in...? :) [14:16] dxtr: a resolver and authoritative name server software completely written from scratch, in coordination with RIPE NCC, to offer a solution that was not ridden with bugs and security flaws like BIND is [14:16] it's analagous to sendmail vs. postfix [14:17] up_the_irons: I just love you answer. Seriously. Straight and consistent. [14:17] your* [14:18] up_the_irons: can I pay for a year in one go? [14:19] aem: What's wrong with paying monthly? : [14:19] :) [14:19] I want to buy a pre paid credit card to order [14:19] so it would make it easier if I were able to order for a longer time period [14:20] I hate that one can't buy that here :/ [14:22] aem: yes -- http://support.arpnetworks.com/faqs/billing/is-there-a-discount-for-paying-in-advance [14:22] dxtr: glad you like my answer ;) [14:25] ok up_the_irons sorry for not reading the FAQ [14:25] :P [14:25] will get a pre paid card tomorrow [14:26] aem: no problem :) [14:28] up_the_irons: I didn't mean to make that singular :D [14:28] dxtr: whut? ;) [14:29] up_the_irons: I like your answer*S* [14:30] dxtr: ah! :) [14:31] You're always straight and concose. [14:31] concise [14:31] ffs [14:31] haha [14:31] yes that's usually how i am [14:33] ... straight? [14:33] :D [14:35] wow we actually have 50+ people in here; [14:38] i like the idea of VPS hosting that's cheap enough to be an impulse buy [14:41] *** vtoms has quit IRC (Quit: Leaving.) [14:46] LOL, wish I could offer instant setup in that case [14:46] trust me i wish you could too [14:46] up_the_irons: that's something the slicehost guys were pointing out as a drawback [14:47] doesn't bother me much [14:47] Why is make distclean so incredibily slow? [14:47] up_the_irons: Actually; what's stopping you? Shouldn't it be possible to create a perl script to do it or whatever? :)) [14:47] i mean i saw the site and I figured oh cool $10 i'll try this out deespite having no compelling use for it [14:47] :)* [14:48] dxtr: write it for me and we'll solve two problems :) [14:49] fink_: indeed, it is a drawback, but from the beginning i've always targetted an audience that is looking for a long term relationship with a reliable hosting company. in that respect, waiting 24 or so for your vps is not a long time; i expect most people will stay for over 12 months [14:49] up_the_irons: i agree; i think they are thinking "cloud" [14:49] fink_: right [14:51] up_the_irons: perhaps you need a sexy bsd assistant? [14:51] * fink_ could go for one of those [14:51] maybe then i could go outside… [14:52] a sexy bsd assistant? yes please [14:53] ceren ercen [14:54] Uhm... Hmm.. [14:57] *** schmir has quit IRC (Remote host closed the connection) [15:02] anybody have good resources for an ldap noob? [15:37] Hey, up_the_irons [15:37] Speaking of unbound - I'm trying it now. [15:38] How can I make it recursive? right now it doesn't seem to recurse anything :p [15:41] dxtr: what exactly is doomsday drunk? [15:42] amdprophet: Haha, what the hell? :D [15:42] lol [15:42] i know it's a delayed reaction [15:42] Don't tell me that's what you've been thinking about alla day? [15:42] was just wondering [15:42] all day* [15:42] it totally was [15:42] Haha [15:43] It's basically getting really wasted - but even more :) [15:43] dxtr: that's the whole point. unbound is not a recursive name server. if you want recursion, use nsd. BIND vulnerabilities have shown you do not want recursion and delegation on the same IP anyway [15:43] dxtr: whups, i meant that the other way around [15:43] dxtr: unbound for recursion, nsd for delegation [15:44] dxtr: if your unbound doesn't recurse, i have no idea what u did wrong ;) [15:44] up_the_irons: Exactly. I'm trying unbound on my obsd box now but can't get it to recurse :D [15:44] ** server can't find www.arpnetworks.com.dxtr.cc: SERVFAIL [15:44] FFFFFUUUUUU [15:51] aaah. Found the error [15:51] I rock! [15:53] lol [16:12] *** fink_ has quit IRC (Quit: fink_) [16:22] sweet. with a little help from google I figured out the internal virtual interface and IPs. [16:31] up_the_irons - did you see http://twitter.com/merlyn/statuses/12577877305 [16:31] even got retweeted by bob [16:32] even got retweeted by me! [16:32] oh hey [17:02] I'm off for bed now! [17:02] Should've gone like 3-4 hours ago. But still1 [17:02] ! [17:02] better late than never [17:55] RandalSchwartz: yeah i saw that randomly this morning, tnx :) [17:55] oh wow, twitter now says "Reweeted by X people" [17:55] however, there are no links to them, which is pretty lame [17:56] lol, "southlandtvfans" RT'd it [17:56] i love that show [17:59] so I've got my internal interface and IPs setup. I've got inbound nat setup to reach the jails. [17:59] only thing I haven't quite figured out is outbound connections from the jails. [18:06] * up_the_irons is a jail noob [18:08] cedwards i think you want an outbound nat [18:08] and inbound forward [18:49] *** dbgi has joined #arpnetworks [18:57] hi [18:59] *** fink has joined #arpnetworks [19:02] hi [19:10] hi infrared [19:26] hey [19:36] infrared: thanks. i think that put me on the right path. [19:36] would this be valid to allow outbound nat from jails: nat on em0 inet from 10.100.1.0/24 to any -> (em0) [19:46] cedwards: you got your jails on nat? [19:46] fink: I can get in from the outside, and I have that rule above applied, but I can't get out from the jails. [19:47] i've done jails a number of times before, but never like this. [19:47] cedwards: how are you troubleshooting your net access? [19:48] watching the pflog, and I've done some tcpdumps but I'm not getting much.. [19:50] cedwards: can you resolve anything? [19:51] no, and I do have a valid resolv.conf [19:51] can you ping out? [19:51] there's a sysctl to enable to allow pinging [19:52] ..err I did have a resolv.conf. checking again now I don't. [19:52] I think I've been looking at this too long today. getting to the point that i'm losing my mind [19:52] hehe [19:52] cedwards: you should put a resolv.conf in the ezjail flavour, then you don't have to worry about it in each jail [19:53] yeah. i even forgot to apply the flavour this go-round. [19:53] heh. i think it's probably time for bed! [19:53] cedwards: let's try it tomorrow [19:53] i'll consult my notes [20:26] *** heavysixer has quit IRC (Quit: heavysixer) [20:34] *** fink has quit IRC (Read error: Connection reset by peer) [20:57] *** fink has joined #arpnetworks [21:44] *** homosaur has joined #arpnetworks [21:55] *** coil has quit IRC (Read error: Operation timed out) [22:10] *** homosaur has quit IRC (Quit: pocketful of goat cheese, ready to party) [23:16] *** fink has quit IRC (Quit: fink) [23:58] *** steinberg has joined #arpnetworks