#arpnetworks 2014-05-08,Thu

m0unds

yeah, i think they shut ti down
it

brycec

I meant on wikipedia :p

m0unds

oh
lol

brycec

so no help there

m0unds

you had to use keyword "CHAT" to get to it in the client
i remember that uch
much
haha
looks like they mght have moved some of the chat functionality to AIM at some point
keep losing keystrokes - laggy, terrible VZW LTE connection

[08:38]

.......... (idle for 45mn)

brycec

mosh?
(the ssh-auth'd udp-based latency-friendly shell. Not the action)
*remote shell

[09:24]

***

toddf has joined #arpnetworks
ChanServ sets mode: +o toddf

[09:33]

m0unds

not a fan
wasn't reliable at all for me
liked it a lot at home w/reliable wifi - could put my notebook to sleep and come back and resume my session. for whatever reason, it'd regularly kill remote sessions when i connected via unreliable cellular

[09:35]

up_the_irons

brycec: i've seen some alerts for kvr07
looking into it; load seems fine atm

[09:44]

brycec

Yay I'm not insane :)
My loadavg is still slightly higher than normal, but I agree it's calmed down a bit
(And still seeing a bit of a hit on my io/sec
http://i.imgur.com/g88HbIY.png
(the due to iowait, of course)
And here's an update latency chart http://i.imgur.com/oUwdysi.png

[09:45]

...... (idle for 26mn)

RandalSchwartz

I wonder if there's some sort of attack going on

[10:15]

brycec

It's the Internet, I always assume there's an attack happening :p

[10:17]

..... (idle for 21mn)

RandalSchwartz

I got my HE ipv6 tunnel from my laptop working again.
too bad I got comcast'ed at home, and the tunnel can't work there any more. :(

[10:38]

brycec

Comcast is blocking protocol41?

[10:39]

RandalSchwartz

no... they provide their own router now.. instead of just a modem
so then my Apple Airport no longer has a public address. :(
and no, you don't get to opt out of that.

[10:39]

staticsafe

can their device not be put in bridge mode?

[10:43]

RandalSchwartz

no.
well - maybe, but not by me
googling seems to say that if you get enough supervisors on the phone, you might be able to get them to understand and deliver
I'm not interested in that much phone pain

[10:43]

brycec

Weird. I still have just a simple modem.

[10:45]

RandalSchwartz

ours just stopped working one day, and required my roommate to go pick a new one up, and it was like this
perhaps it's a regional thing
and we still don't get the native ipv6 they promised two years ago

[10:45]

brycec

Bummer. I could get native ipv6 if I wanted, but I have no control of the address space or DNS

[10:46]

RandalSchwartz

I think this is the modem they gave us, which is indeed part of an ipv6 strategy: http://www.arrisi.com/products/product.asp?id=79
press release: http://ir.arrisi.com/phoenix.zhtml?c=87823&p=RssLanding&cat=news&id=1880159

[10:49]

brycec

But since they control it, it's probably not configured to pull a v6 addy

[10:51]

RandalSchwartz

yeah - according to their rollout, 18% of their customers have v6 now.
at that rate, I might have ipv6 in 2038. :)

staticsafe

native IPv6 would be nice :(

brycec

2038... just in time for 32bit time rollover!

RandalSchwartz

exactly
time and ipv4 rolling over at the same time

I have a database load for $client in my virtualbox that has now consumed 93 CPU minutes of mysqld
but I can't do anything next until it's done
so I'm basically surfing the net watching "top" :)

[10:57]

brycec

I'm downloading a backup off a system and being reminded of how painful 100mbps is

[11:02]

***

pjs has quit IRC (Read error: Connection reset by peer)
pjs has joined #arpnetworks
jpalmer has quit IRC (Ping timeout: 258 seconds)
pjs is now known as Guest19894
NiTeMaRe has quit IRC (Ping timeout: 258 seconds)
Guest19894 has quit IRC (Ping timeout: 258 seconds)
jlgaddis has quit IRC (Ping timeout: 258 seconds)
pjs_ has joined #arpnetworks
NiTeMaRe has joined #arpnetworks

[11:06]

RandalSchwartz

I got spoiled when i worked at oversee... they have dark fiber from the office tied directly to the backbone at one wilshire
I grabbed a 40GB image off my VPS as fast as my disk could write. :)
seeing as these machines are pretty close netwise to one wilshire
it was something like 4ms to ping, three hops

[11:22]

awyeah

Hey does anyone here know sendmail?

[11:23]

brycec

Yeah, uploading the backup to the new system was nice, limited only by disk IO (migrating an old server with only 10/100 to a VM on GbE links with good storage)
I know to avoid sendmail :P There are much more configurable options

[11:23]

awyeah

lol I know
I run postfix. But I'm working with a sendmail install.

[11:27]

***

pjs_ is now known as pjs

[11:27]

RandalSchwartz

yeah I stopped using sendmail years ago
RandalSchwartz still has flashbacks of the Horror That Is M4
all those crazy dnl()'s :)

[11:28]

awyeah

LOL i know
Trying to figure out why this one server is rejecting me. Good thing I know the guy.

[11:30]

RandalSchwartz

that means "I know the guy who knows the guy..."
at least postfix has almost-human-readable config files. :)

[11:31]

awyeah

Yeah seriously

[11:32]

RandalSchwartz

although you still gotta understand a lot about how mail actually works

[11:32]

awyeah

I'm good with that part.

[11:33]

RandalSchwartz

and you aren't programming a state machine using m4. :)
replace this with that, and go to state 7
add < > around that and go to state 12
it's like a friggin turing machine
I think I recall seeing rules that when recognizing a particular address, would actually solve towers of hanoi in the added header lines. :)

[11:33]

awyeah

hah
lame
Well I figured out how to test the ruleset
now I have to figure out what the output means.
Looks like it's rejecting me, duh
rewritten as: < ? > < co > < ? > < + Connect > < 206 . 125 . 173 . 30 >
rewritten as: < reject > < co > < ? > < + Connect > < 206 . 125 . 173 . 30 >
Whatever that means.

[11:34]

RandalSchwartz

thank you googles: http://www.jhnc.org/hanoi/sendmail-cf.html

[11:35]

***

jpalmer has joined #arpnetworks

[11:36]

awyeah

I wonder if that means it's rejecting it because it's a .co address.
Yup, that was it... added a line in his /etc/mail/access and bam

[11:38]

RandalSchwartz

I wonder how many other TLDs he's missing. :)
it's like those ancient "reject bad email" javascript checkers
good thing those are client-side

[11:40]

awyeah

ah I see, he has a whole lot of tlds in his reject
whatever, it's his prerogative.
I'm surprised nobody else has complained to him about this
But, it's just a local ham radio group, so it's probably mostly .org/.com/.net stuff

[11:41]

RandalSchwartz

yeah - why would people in columbia be sending him mail? :)
Oh darn... I thought it was done... mysqld popped away from top
but it came right back. :(
nearly 118 cpu minutes now
over a 3 hour period

[11:44]

brycec

Maybe they have and he couldn't receive their email :P 11:41:55 < awyeah> I'm surprised nobody else has complained to him about this
I never really grasped "cpu time"

[11:48]

***

kevr has quit IRC (Ping timeout: 246 seconds)

[11:49]

awyeah

haha that's true.

[11:52]

***

kevr_ has joined #arpnetworks

[11:52]

RandalSchwartz

it's like lunch time, but doubly so. :)

[11:56]

.... (idle for 16mn)

brycec

up_the_irons: thanks for the ticket response :) (so here's an IRC response)

[12:12]

up_the_irons

[12:12]

hazardous

you know something i've never really thought about
what do people think about replying to a closed ticket saying thanks, potentially reopening it
it seems like it'd annoy people but be a nice thing to others
if it was me i'd be annoyed at the unnecessary notification and reopening but then i'd feel bad

[12:20]

up_the_irons

dang, my console server running OpenBSD has finally crashed i believe.. little atom box with > 1000 days uptime
people say thanks all the time
and i reply with something like 'No problem!' and then re-close it ;)

[12:28]

......... (idle for 43mn)

RandalSchwartz

whoa. red has been up for 240 days!
no wonder everything is so out of date. :)
and I *still* haven't fired up my new VPS
(Neil keeps stealing all my spare time)

[13:13]

up_the_irons

still?! haha

[13:14]

RandalSchwartz

I'm tempted just to do an in-place update
but I don't know if I can go from 8.3 right to 10.1
maybe I'll rehearse that in a virtualbox
the trouble is that I have about three hours of research to do about how to do the upgrade before I can even start
but it'll be more like six hours to build the new box and transfer over all the data.
Ahh... I know what I'll do... I'll create a minimal install on the second box... and use it as a cloud backup... grab a snapshot of everything in case I have to regress.
then convert over to pkgng, and svn sources, fetch the 10.0 source, and just try to compile the world. :)
just talking out loud, of course. :)

[13:14]

***

vtoms has left

[13:29]

.... (idle for 19mn)

brycec

Annoys the heck out of me. If the ticket says "closed" on it, I don't reply. If it doesn't, then I might reply thanks. And recently, I had an Nvidia ticket wherein I could reply with the option of not reopening the ticket, which I did. 12:20:54 < hazardous> it seems like it'd annoy people but be a nice thing to others
More annoying still is when I do as up_the_irons does, re-close and they reply again.

[13:48]

.... (idle for 17mn)

up_the_irons

up_the_irons thinks brycec is annoyed easily
;)

[14:06]

brycec

up_the_irons: Or perhaps I deal with a lower class of idiot

[14:07]

up_the_irons

lol

[14:07]

brycec

(And I admit, my fuse is a bit short)
Let's just say that Doctors are some of the dumbest tech users ever.
brycec is also having one of those "Say What again one more time, i dare you -- and I'll quit on the spot" days
s/days
s/days/weeks

[14:07]

BryceBot

>>> brycec is also having one of those "Say What again one more time, i dare you -- and I'll quit on the spot" weeks

[14:08]

brycec

well, it's been going on years now...

[14:08]

RandalSchwartz

up_the_irons - looks like my ntp block is still in place. :(
I'm getting ntp but only via ipv6

[14:18]

brycec

RandalSchwartz: you might want to noquery your host ;)

[14:20]

up_the_irons

RandalSchwartz: ip? kvr host?

[14:20]

brycec

208.79.95.2 is his ip
$ ntpq -p 208.79.95.2
208.79.95.2: timed out, nothing received
but I can hit his ipv6

[14:20]

RandalSchwartz

"noquery"?

brycec

@google ntpd noquery

BryceBot

2,690 total results returned for 'ntpd noquery', here's 3
6.5. ntpd access restrictions (http://support.ntp.org/bin/view/Support/AccessRestrictions) Restrictions are used to control access to your ntpd and are, unfortunately, one of ... Users of NTP versions prior to 4.2.7p26 should either use noquery or disable ...
Network Time Protocol daemon - ArchWiki (https://wiki.archlinux.org/index.php/Network_Time_Protocol_daemon) Apr 2, 2014 ... The NTP Project provides a reference implementation of the ... ntpd (with ntpq or ntpdc), and noquery prevents dumping status data from ntpd ...
15.9. Understanding the ntpd Configuration File (https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/7-Beta/html/System_Administrators_Guide/s1-Understanding_the_ntpd_Configuration_File.html) The nopeer option prevents a peer association being formed. The noquery option prevents ntpq and ntpdc queries, but not time queries, from being answered.

***

toddf has quit IRC (Ping timeout: 252 seconds)

RandalSchwartz

I made the two security fixes

up_the_irons

RandalSchwartz: verified there is no block on your IP
Must Be You(tm) ;)

RandalSchwartz

disable monitor restrict default ignore

brycec

RandalSchwartz: basically, your NTP instance lets the world use you to ddos

RandalSchwartz

bryce - old news, already fixed
and it was working last night
something is still filtering today

brycec

If it was fixed, then I wouldn't be able to "ntpq -p you"
RandalSchwartz: just for fun, would you mind sharing your ntp.conf so we/I can proofread?

RandalSchwartz

I added the two lines that were asked of me in the security

brycec

(And try running it myself and see what happens)