#arpnetworks 2015-08-02,Sun

↑back Search ←Prev date Next date→ Show only urls(Click on time to select a line by its url)
WhoWhatWhen
brycecAgreed all-around [01:28]
...... (idle for 29mn)
kellytkOnce I went solid-state I knew I'd never go back, workstations and servers alike [01:57]
...................................................................... (idle for 5h48mn)
m0undsmnathani_: do you happen to have an exchange acct or similar w/policy enforcement enabled configured w/the win10 mail client? [07:45]
...................... (idle for 1h48mn)
http://forums.nfoservers.com/viewtopic.php?f=1&t=12912
womp womp 		[09:33]
....................... (idle for 1h54mn)
***dj_goku has joined #arpnetworks [11:27]
....... (idle for 31mn)
brycec has quit IRC (*.net *.split)
d^_^b has quit IRC (*.net *.split)
d^_^b has joined #arpnetworks
d^_^b has quit IRC (Changing host)
d^_^b has joined #arpnetworks
brycec has joined #arpnetworks 		[11:58]
carvite has quit IRC (*.net *.split)
raptelan has quit IRC (*.net *.split)
kellytk has quit IRC (*.net *.split)
tooth has quit IRC (*.net *.split)
tooth has joined #arpnetworks
raptelan has joined #arpnetworks
kellytk has joined #arpnetworks
carvite has joined #arpnetworks 		[12:13]
.................................... (idle for 2h59mn)
mnathani_m0unds: no exchange account - or anything I can think of that would have policy enforcement enabled [15:12]
....... (idle for 31mn)
m0undsmnathani_: strange [15:43]
mercutioit's kind of disconcerting with the windows shift that's happened in here :) [15:44]
m0unds? [15:44]
mercutiooh just cos windows 10 came out etc :) [15:45]
m0undsoh, talking about it? [15:45]
mercutiomercutio has no idea how to fix most windows problems
yeah 		[15:45]
m0undsm0unds was a windows and unix sysadmin for 10 yrs [15:45]
mercutiomy windows computer randomly had a black screen today [15:45]
m0undsthrow it down a flight of stairs [15:45]
mercutioit was still working, sound etc. [15:45]
m0undsweird [15:45]
mercutioturning the monitor on and off didn't fix it [15:45]
m0undsdisplay driver crash? [15:45]
mercutioprobably
i rebooted and it's fine so far. 		[15:45]
m0undswas it coming out of sleep? [15:46]
mercutionope [15:46]
m0undsah [15:46]
mercutioit doesn't sleep
maybe it should 		[15:46]
m0undsthere's a longstanding AMD driver issue w/sleep and black screens
dunno if they ever fixed it 		[15:46]
mercutiowell it is amd
maybe it started sleeping since upgrading. 		[15:46]
m0undsi know, that's why i mentioned it :) [15:46]
mercutiobut then why'd it wait until today to crash
my linxu computer went through a period of crashing 		[15:46]
m0undsno time like the present [15:46]
mercutioi changed the motherboard and it was fine
i changed psu and case too though
but when linux crashes everyone now and then suspect hardware
when windows crashes every now and then suspect drivers :)
it did used to get ethernet brief lockups all the time from new
i never really noticed it except in dmesg
wow
@weather iran 		[15:47]
BryceBotMultiple locations matched your query: Abadan, IR (zmw:00000.1.40831), Abadeh, IR (zmw:00000.1.40818), Abu Musa, IR (zmw:00000.1.40890), Ahar, IR (zmw:00000.1.40704), Ahwaz, IR (zmw:00000.1.40811), Ali-Goodarz, IR (zmw:00000.1.40783), Anzali, IR (zmw:00000.1.40718), Arak, IR (zmw:00000.1.40769), Ardebil, IR (zmw:00000.1.40708), Babulsar, IR (zmw:00000.1.40736), Baft, IR (zmw:00000.1.40853), Bam, IR (zmw:00000.1.40854), Bandar Lengeh, IR (zmw:0000 [15:49]
mercutio@weather bandar [15:49]
BryceBotBandar, Indonesia: Mostly Cloudy ☁ 67°F (19°C), Humidity: 99%, Wind: From the West at 2 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=, or re-request this with: @weather -v bandar [15:49]
mercutiogrr [15:49]
m0undshahaha [15:49]
mercutio@weather brandar mahshar, ir [15:49]
BryceBotError, No cities match your search query [15:49]
mercutio@weather bandar mahshar, ir [15:49]
BryceBotError, No cities match your search query [15:49]
mercutioi suck at this
@weather bandar, ir 		[15:49]
BryceBotError, No cities match your search query [15:50]
m0unds@weather bandar, iran [15:50]
mercutioanyway [15:50]
BryceBotBandar, Indonesia: Mostly Cloudy ☁ 67°F (19°C), Humidity: 99%, Wind: From the West at 2 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=, or re-request this with: @weather -v bandar, iran [15:50]
mercutioheat weave in iran [15:50]
m0undsweird [15:50]
mercutio@weather abadan, ir [15:50]
BryceBotAbadan, Iran: Clear 93°F (34°C), Humidity: 41%, Wind: From the NNW at 9 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=30.36666679,48.25000000 or re-request this with: @weather -v abadan, ir [15:50]
mercutio@weather Bandar Lengeh, IR [15:50]
BryceBotBandar Lengeh, Iran: Haze 93°F (34°C), Humidity: 59%, Wind: Calm -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=26.53199959,54.82484818 or re-request this with: @weather -v Bandar Lengeh, IR [15:50]
m0undsoh, i didn't notice the second word in the name [15:50]
mercutiowhat that doesn't seem that hot [15:50]
m0undswhat time is it there now? [15:51]
mercutioi dunno if that's the same city as bandar mahshahr [15:51]
m0unds0319 [15:51]
mercutiobut it was in that list of cities up there [15:51]
m0undspretty hot for 3 am
haha 		[15:51]
mercutiooh wow
ok 		[15:51]
m0undsehh
forecasted daytime temp is 101 		[15:52]
mercutiothat's not so bad? [15:52]
m0undsit's forecasted to be 110 in phoenix, az tomorrow [15:52]
mercutiohttp://time.com/3981478/iran-heatwave-bandar-mahsahr/ [15:52]
m0undsmaybe because it's on the water or something?
oh, with the heat index
because of humidity 		[15:52]
mercutioIn Iraq, air temperatures continued to exceed 120 degrees (49 Celcius) for the eighth day in a row on Sunday, according to the Weather Channel. The heat had become so scorching on Thursday that the Iraqi government mandated a four-day holiday. [15:53]
m0undsyeah, that'd be why then [15:53]
mercutiooh [15:53]
m0undshigh humidity + hot as hell
yeah, that blows
m0unds is happy to live in an arid climate 		[15:53]
mnathani_does unbound default to allow all source IPs for dns resolution?
turns out its only listening on localhost 		[16:02]
mercutionope
it allows ::1 and 127.0.0.1 and some others it hink
search for acl
oh it's not acl :") 		[16:04]
mnathani_interface: 0.0.0.0 [16:06]
mercutioit's access-control [16:06]
mnathani_I put that in there, but its still listening on localhost only [16:06]
mercutioaccess-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow
oh
did you restart it? 		[16:06]
mnathani_yup [16:06]
mercutiocould it bind that address?
i'm nost listening on 0.0.0.0
i listen on the real addresses
but 0.0.0.0 should work
oh, unless you have an authorative dns server on the host too 		[16:06]
mnathani_got it to listen on 192.168.64.1 [16:08]
mercutiocool [16:08]
mnathani_but now I need the access control [16:08]
mercutioyip
i pasted that up there
so first you refuse
then you accept
ie it's last match not first match 		[16:08]
mnathani_ok, dns is good now [16:09]
mercutiosweet [16:09]
mnathani_time to try the transparent proxy using squid [16:10]
mercutiooh god
i mean cool :)
you got your firewall rules down? :) 		[16:10]
mnathani_you mean iptables nat 80 to 3128 or something like that? [16:10]
mercutioalso you may want to try trafficserver instead of squid these days
is that ipfw?
oh
iptables word
yeh sending 80 to 3128
i just use explicit proxy except for wireless at home
proto tcp if enp4s0 saddr 192.168.1.0/24 dport http REDIRECT to-ports 8080;
that's what i'm doing with ferm 		[16:10]
mnathani_does trafficserver have a binary or do I need to build from source
running ubuntu 		[16:12]
mercutioit's got old binaries in ubuntu last i knew
what version does it say?
http://packages.ubuntu.com/search?keywords=trafficserver
trusty has 3.2 that's probably fine
i think 5 is what it's up to
i compile from source myself
but i did a couple of patches etc
so yeah its' ok if you're ok behind two major versions behind
September 08, 2014: The old, legacy release of ATS, v3.2.x, is no longer supported. We have removed it from the download site, but it is available via the archives. We urge everyone to migrate to v4.2.x or 5.x as soon as possible.
July 4, 2015: The latest stable release, v5.3.1, is now available from the Downloads section. This is the LTS release for 5.x
yeah i'd go with source
trafficserver has http2 support :)
and a few other cool things
but squid maybe easier to get started with 		[16:12]
mnathani_do you generally need to enable nat / ip forwarding for other non http traffic? [16:16]
mercutiothe default trafficserver config is more towards reverse proxies than forward
yes
saddr 192.168.0.0/16 outerface ppp0 SNAT to 202.49.67.22;
i do it with that
but then i have normal ip's mixed too, that i don't want to nat
proxies don't give much improvement with few users generally btw 		[16:16]
mnathani_my proxy is already behind nat [16:19]
mercutiothe majority of "slow" web sites these days are https
ahh 		[16:19]
mnathani_so perhaps I could simply enable routing [16:19]
mercutiothen you can just let the normal nat work it's magic
ip forwarding yes
net.ipv4.ip_forward=1
erk that doesn't seem to ber it
oh zsh just wasn't completing 		[16:19]
mnathani_the nat gateway would need to know how to get back to my 192.168.64.0/24 segment [16:20]
mercutiowhy?
i don't do full transparent with proxies 		[16:20]
mnathani_its on 10.10.0.0/16 [16:20]
mercutioso it's just like any other
oh
yeh the nat router should also nat 192.168.64.0/24
and have routes to reach it 		[16:20]
mnathani_right [16:21]
mercutiodsl modems can be a pita for that :/ [16:21]
mnathani_do you transparent proxy https as well? [16:21]
mercutionope [16:21]
mnathani_good think I have a mikrotik [16:21]
mercutioyou can only tcp proxy it
which i want to do again
so who here is using a ssid ending in optout_nomap?
err _optout_nomap 		[16:21]
m0undsnot me, don't care enough [16:30]
................. (idle for 1h23mn)
mnathani_step 2 complete, Nat is working and my vm on 192.168.64.0/24 has internet access using the ubuntu gateway that has ip forwarding enabled. Now all I need to do is get the transparent proxy working [17:53]
brycecFWIW I've had no such issue on my system, whether Windows 7, 8.1, or 10. And it sleeps a lot. 15:44:06 m0unds | there's a longstanding AMD driver issue w/sleep and black screens [18:06]
mercutiomnathani_: just go explicit ?
ie set your proxy in your browser
or in http_proxy on command line 		[18:06]
mnathani_my goal is transparent proxy [18:07]
mercutiook [18:07]
mnathani_iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
that eth0
is that on the interface facing client? 		[18:07]
mercutiois eth0 in? [18:07]
mnathani_or towards internet
in that iptables rule 		[18:07]
mercutiothat looks fine
have you got squid setup to listen in transparent mode
that's the interface that http connections come in on 		[18:08]
mnathani_in my case its eth1 [18:09]
mercutiooh :)
well there goes the issue
in my case it's enp4s0
don't you love the naming 		[18:09]
mnathani_I am getting connection refused [18:11]
mercutioare you listening on port 3128 [18:11]
mnathani_for http requests from my client [18:11]
mercutiosudo netstat -tnlp | grep 3128 [18:11]
mnathani_I am not
so that would be a problem 		[18:12]
mercutiowell there goes the issue
i think it's http_port in squid
yeh http_port 3128 http11 transparent
although if you just installed squid you may have to run squid -z to create the cache directories 		[18:12]
mnathani_http_port 3128
I have that in my config 		[18:13]
mercutioso squid isn't running then
append transparent
i dunno if you still need http11 or snot
i only see that http11 was added in 2.7, not that it was deprecated, hmm.
it seems transparent is changing to the word intercept though 		[18:13]
m0undsbrycec: i'm happy you didn't experience it
because it's horribly annoying 		[18:15]
brycecm0unds: thanks :p [18:16]
m0undsi've seen it on more machines than i haven't seen it on, so you're a lucky duck [18:16]
mnathani_ok, I get access denied now
so that looks better 		[18:16]
mercutiosweet now ip acl [18:16]
brycecWow. And yet both mine and my lady's windows desktops are just peachy.
So 100% okay in my experience, m0unds 		[18:16]
mercutiobrycec: large sample set there [18:16]
brycec:D [18:17]
mercutioi seem to remember some computer screwing up if it suspended and it wouldn't come back at one point
but memory is sketchy
i just remember thinking it wasn't good to plug in the sleep button 		[18:17]
m0undshttp://forums.anandtech.com/showthread.php?t=2322060 [18:17]
mercutiobecause it can cause issues when used :) [18:17]
m0unds^ that mess [18:17]
brycecHeh, then again those posts are from 2 years ago. Plenty of time for change. [18:18]
mercutioheh i like it how windows includes ethernet drivers now days [18:19]
m0undsright, but i was managing a site with 30 7xxx era firegl and radeon cards and most of them would die if the machine was left unattended and went to sleep overnight or whatever [18:19]
mercutiothat used to be my biggest gripe [18:19]
m0undsto the point that i had to set a policy to prevent sleep so i didn't have to deal with it every morning [18:19]
brycecThat really sucks [18:19]
mercutiom0unds: were you using microsoft or ati drivers? [18:19]
m0undsAMD, had to
needed opencl 		[18:19]
mercutioahh
i used to find that the ati drivers were worse than the microsoft ones
unless you needed to play games 		[18:20]
m0undsand as luck had it, they started replacing those boxes when my contract was ending
the bastard 		[18:20]
mercutiointel hd seems nice and stable. [18:20]
m0undss [18:20]
mnathani_Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect. [18:21]
mercutiomnathani_: fix your acl :)
acl's are two step in squid
you need like acl localnet src 192.168.0.0/16
http_access allow localnet
and they're first match
so you hvae to allow before you deny 		[18:21]
mnathani_my allows were under another deny way up in the config
its a 7000 line config
probably easier to wipe it clean and start fresh 		[18:24]
mercutioheh
use grep
cat /etc/squid/squid.conf | grep ^http_access 		[18:25]
brycecwhy not just "grep ^http_access /etc/squid/squid.conf" ? [18:26]
mercutiobrycec: that'd work too, but i find it easier to think that way around :) [18:26]
brycec:) [18:26]
mercutioi'm not a big fan of condensing [18:27]
brycecbrycec is a huge fan of optimising [18:27]
mercutioon grep'ing a 7000 line file?
does it save more than a msec?
i don't even use egrep usually :) 		[18:28]
brycecIn this case, probably not. But I'm not saying that optimisation is for speed
It just makes it, whatever it is, optimal :) Could be readable, simpler, fewer system calls, etc 		[18:29]
mercutioahh, i find it more readable, simpler with it spread out [18:30]
brycecIf you were grepping multiple files, you would almost certainly prefer the "condensed" form as then grep can report *which* file matched. [18:30]
mercutiobut yeah there may be fewer system calls with your method. but that's not even a certainty [18:30]
brycecI find mine to be more readable. But to each their own. [18:31]
mercutioyeah different thinking styles and all that
i like to think of the "object i'm doing something with" then what i do with it
rather than what i'm doing with it, then what object i'm doing on it 		[18:31]
mnathani_coredump_dir /var/spool/squid3 [18:32]
mercutioalso if you need to change it to something else it's much easier
like that word doesn't work.. 		[18:32]
mnathani_do I need that in my config? [18:32]
mercutiomnathani_: that's normal
yes
squid spool directory is given less space to allow some space for coredump
and for file system overheads
did you figure out your acl? :) 		[18:32]
mnathani_I think so
trying it now
1438565621.558 115 192.168.64.100 TCP_MISS/200 114420 GET http://turnerhd-f.akamaihd.net/z/tvecnn_1@135347/tiny_6963ff495dca454b-p_Seg1-Frag239760933? - HIER_DIRECT/23.15.4.17 video/f4f
1438565623.468 18 192.168.64.100 TCP_REFRESH_MODIFIED/200 668 GET http://turnerhd-f.akamaihd.net/z/tvecnn_1@135347/tiny_6963ff495dca454b-p.bootstrap? - HIER_DIRECT/23.15.4.17 video/abst
1438565625.831 76 192.168.64.100 TCP_MISS/200 982 GET http://ar.voicefive.com/bmx3/iframe.htm? - HIER_DIRECT/205.218.48.203 text/html
appears to be working now
thanks mercutio :-) 		[18:34]
mercutiosweet
did you set cache_dir to a big enough size?
i think it defaults to 100mb 		[18:36]
mnathani_cache_dir rock Directory-Name Mbytes [options]
do I need to specify a directory? 		[18:38]
mercutiooh god
i abandoned squid beforethat rock stuff
is rock stable?
anyway normally it's something like:
cache_dir ufs /var/spool/squid3 32000 16 256
for 32gb with ufs
you can do aufs too, but for light loads it's generally not necessary
i assume with rock it's something like cache_dir rock /var/spool/squid3 32000 		[18:38]
mnathani_do you recall slow restarts with squid
that can be speeded up with some config
http://www.squid-cache.org/Doc/config/shutdown_lifetime/
not sure if that was it 		[18:47]
mercutioyes
also it has to rebuild the cache sometimes
like if you press the reset button and have a huge cache it'll have to go through rebuilding the cache indexes
the cache rebuild is more of an issue than the shutdown lifetime
the shutdown lifetime is for connections that are still going 		[18:53]
mnathani_on ubuntu how do I make that iptables rule persistent? [18:57]
brycecStep 1) Erase Ubuntu. :P
</generic Ubuntu and non-BSD hate> 		[18:58]
m0undssounds reasonable to me [19:00]
brycecI've always had trouble working with Ubuntu-isms, eg upstart (or whatever it was called) [19:00]
mnathani_is Debian really that much better? [19:01]
brycecNowadays, yes. Because I know systemd. [19:02]
mercutioi use ferm mnathani_
ubuntu has systemd too if you use recent ersion
version 		[19:16]
........ (idle for 38mn)
mnathani_is there a good tutorial out there to get ones self up to speed with systemd? [19:55]
brycecI learned from https://wiki.archlinux.org/index.php/Systemd [19:56]
mnathani_I suppose this would be useful in managing RedHat Enterprise Linux 7 / CentOS 7 as well since they moved to systemd too? I wonder if there are differences in implementation [19:59]
mike-burnsIf you run into issues, here's a good systemd troubleshooting guide: http://www.openbsd.org/faq/faq4.html [19:59]
brycec-.-
mnathani_: The fundamentals are the same. The only differences I'd expect could be the names of the unit files 		[20:00]
mnathani_lol mike-burns [20:01]
.......... (idle for 46mn)
mercutiomnathani_: ubuntu hasnt' fully moved over to systemd yet last i knew
although it seems to be more so when doing new installs than updating 		[20:47]
mnathani_so many sites using ssl - didnt realize it earlier
perhaps I am doing it wrong - too many misses not enough hits with regards to Squid
even when I load the exact same url into a different browser 		[20:55]
mercutio10% hit rate is common for bytes
it's only really useful for things like updating packages over multiple hosts 		[21:06]
mnathani_perhaps I am missing something in the config: http://paste.ubuntu.com/11990871/
what happens if the different hosts choose different mirrors 		[21:07]
mercutiothen you're out of lock
luck
centos is nice like that :/
you can do complicated rewrite stuff but i wouldn't recommend 		[21:10]
mnathani_anything more I can do with my config to get more hits? [21:12]
........... (idle for 52mn)
mercutiomaximum_object_size
http://www.squid-cache.org/Doc/config/maximum_object_size/
[22:04]
kellytkI'm cautiously optimistic about what the FreeBSD project comes up with for a modern service manager [22:05]
JC_Dentonanyone here using Duo Security? [22:15]
mercutioi only just found out about iotop [22:21]
m0undsJC_Denton: i've used it before
it was kind of flaky 		[22:22]
JC_Dentoni'm giving it a go over Google Authenticator
seems a little slow, but it's nice to be able to approve 2fa from a wearable 		[22:22]
mnathani_here is something really strange - I had unbound installed, but wanted to switch to bind, so I stopped the unbound service and started bind, but unbound got restarted instead [22:23]
mercutiothat does strange
but i have no idea sorry :) 		[22:36]
mnathani_got it taken care of
I like the query log style of bind compared to unbound 		[22:47]
............... (idle for 1h11mn)
mercutioyou use query log?
i just tcpdump if i want to see queries 		[23:58]
↑back Search ←Prev date Next date→ Show only urls(Click on time to select a line by its url)