kellytk: Once I went solid-state I knew I'd never go back, workstations and servers alike m0unds: mnathani_: do you happen to have an exchange acct or similar w/policy enforcement enabled configured w/the win10 mail client?
http://forums.nfoservers.com/viewtopic.php?f=1&t=12912
womp womp ***: dj_goku has joined #arpnetworks
brycec has quit IRC (*.net *.split)
d^_^b has quit IRC (*.net *.split)
d^_^b has joined #arpnetworks
d^_^b has quit IRC (Changing host)
d^_^b has joined #arpnetworks
brycec has joined #arpnetworks
carvite has quit IRC (*.net *.split)
raptelan has quit IRC (*.net *.split)
kellytk has quit IRC (*.net *.split)
tooth has quit IRC (*.net *.split)
tooth has joined #arpnetworks
raptelan has joined #arpnetworks
kellytk has joined #arpnetworks
carvite has joined #arpnetworks mnathani_: m0unds: no exchange account - or anything I can think of that would have policy enforcement enabled m0unds: mnathani_: strange mercutio: it's kind of disconcerting with the windows shift that's happened in here :) m0unds: ? mercutio: oh just cos windows 10 came out etc :) m0unds: oh, talking about it? -: mercutio has no idea how to fix most windows problems mercutio: yeah -: m0unds was a windows and unix sysadmin for 10 yrs mercutio: my windows computer randomly had a black screen today m0unds: throw it down a flight of stairs mercutio: it was still working, sound etc. m0unds: weird mercutio: turning the monitor on and off didn't fix it m0unds: display driver crash? mercutio: probably
i rebooted and it's fine so far. m0unds: was it coming out of sleep? mercutio: nope m0unds: ah mercutio: it doesn't sleep
maybe it should m0unds: there's a longstanding AMD driver issue w/sleep and black screens
dunno if they ever fixed it mercutio: well it is amd
maybe it started sleeping since upgrading. m0unds: i know, that's why i mentioned it :) mercutio: but then why'd it wait until today to crash
my linxu computer went through a period of crashing m0unds: no time like the present mercutio: i changed the motherboard and it was fine
i changed psu and case too though
but when linux crashes everyone now and then suspect hardware
when windows crashes every now and then suspect drivers :)
it did used to get ethernet brief lockups all the time from new
i never really noticed it except in dmesg
wow
@weather iran BryceBot: Multiple locations matched your query: Abadan, IR (zmw:00000.1.40831), Abadeh, IR (zmw:00000.1.40818), Abu Musa, IR (zmw:00000.1.40890), Ahar, IR (zmw:00000.1.40704), Ahwaz, IR (zmw:00000.1.40811), Ali-Goodarz, IR (zmw:00000.1.40783), Anzali, IR (zmw:00000.1.40718), Arak, IR (zmw:00000.1.40769), Ardebil, IR (zmw:00000.1.40708), Babulsar, IR (zmw:00000.1.40736), Baft, IR (zmw:00000.1.40853), Bam, IR (zmw:00000.1.40854), Bandar Lengeh, IR (zmw:0000 mercutio: @weather bandar BryceBot: Bandar, Indonesia: Mostly Cloudy ☁ 67°F (19°C), Humidity: 99%, Wind: From the West at 2 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=, or re-request this with: @weather -v bandar mercutio: grr m0unds: hahaha mercutio: @weather brandar mahshar, ir BryceBot: Error, No cities match your search query mercutio: @weather bandar mahshar, ir BryceBot: Error, No cities match your search query mercutio: i suck at this
@weather bandar, ir BryceBot: Error, No cities match your search query m0unds: @weather bandar, iran mercutio: anyway BryceBot: Bandar, Indonesia: Mostly Cloudy ☁ 67°F (19°C), Humidity: 99%, Wind: From the West at 2 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=, or re-request this with: @weather -v bandar, iran mercutio: heat weave in iran m0unds: weird mercutio: @weather abadan, ir BryceBot: Abadan, Iran: Clear 93°F (34°C), Humidity: 41%, Wind: From the NNW at 9 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=30.36666679,48.25000000 or re-request this with: @weather -v abadan, ir mercutio: @weather Bandar Lengeh, IR BryceBot: Bandar Lengeh, Iran: Haze 93°F (34°C), Humidity: 59%, Wind: Calm -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=26.53199959,54.82484818 or re-request this with: @weather -v Bandar Lengeh, IR m0unds: oh, i didn't notice the second word in the name mercutio: what that doesn't seem that hot m0unds: what time is it there now? mercutio: i dunno if that's the same city as bandar mahshahr m0unds: 0319 mercutio: but it was in that list of cities up there m0unds: pretty hot for 3 am
haha mercutio: oh wow
ok m0unds: ehh
forecasted daytime temp is 101 mercutio: that's not so bad? m0unds: it's forecasted to be 110 in phoenix, az tomorrow mercutio: http://time.com/3981478/iran-heatwave-bandar-mahsahr/ m0unds: maybe because it's on the water or something?
oh, with the heat index
because of humidity mercutio: In Iraq, air temperatures continued to exceed 120 degrees (49 Celcius) for the eighth day in a row on Sunday, according to the Weather Channel. The heat had become so scorching on Thursday that the Iraqi government mandated a four-day holiday. m0unds: yeah, that'd be why then mercutio: oh m0unds: high humidity + hot as hell
yeah, that blows -: m0unds is happy to live in an arid climate mnathani_: does unbound default to allow all source IPs for dns resolution?
turns out its only listening on localhost mercutio: nope
it allows ::1 and 127.0.0.1 and some others it hink
search for acl
oh it's not acl :") mnathani_: interface: 0.0.0.0 mercutio: it's access-control mnathani_: I put that in there, but its still listening on localhost only mercutio: access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow
oh
did you restart it? mnathani_: yup mercutio: could it bind that address?
i'm nost listening on 0.0.0.0
i listen on the real addresses
but 0.0.0.0 should work
oh, unless you have an authorative dns server on the host too mnathani_: got it to listen on 192.168.64.1 mercutio: cool mnathani_: but now I need the access control mercutio: yip
i pasted that up there
so first you refuse
then you accept
ie it's last match not first match mnathani_: ok, dns is good now mercutio: sweet mnathani_: time to try the transparent proxy using squid mercutio: oh god
i mean cool :)
you got your firewall rules down? :) mnathani_: you mean iptables nat 80 to 3128 or something like that? mercutio: also you may want to try trafficserver instead of squid these days
is that ipfw?
oh
iptables word
yeh sending 80 to 3128
i just use explicit proxy except for wireless at home
proto tcp if enp4s0 saddr 192.168.1.0/24 dport http REDIRECT to-ports 8080;
that's what i'm doing with ferm mnathani_: does trafficserver have a binary or do I need to build from source
running ubuntu mercutio: it's got old binaries in ubuntu last i knew
what version does it say?
http://packages.ubuntu.com/search?keywords=trafficserver
trusty has 3.2 that's probably fine
i think 5 is what it's up to
i compile from source myself
but i did a couple of patches etc
so yeah its' ok if you're ok behind two major versions behind
September 08, 2014: The old, legacy release of ATS, v3.2.x, is no longer supported. We have removed it from the download site, but it is available via the archives. We urge everyone to migrate to v4.2.x or 5.x as soon as possible.
July 4, 2015: The latest stable release, v5.3.1, is now available from the Downloads section. This is the LTS release for 5.x
yeah i'd go with source
trafficserver has http2 support :)
and a few other cool things
but squid maybe easier to get started with mnathani_: do you generally need to enable nat / ip forwarding for other non http traffic? mercutio: the default trafficserver config is more towards reverse proxies than forward
yes
saddr 192.168.0.0/16 outerface ppp0 SNAT to 202.49.67.22;
i do it with that
but then i have normal ip's mixed too, that i don't want to nat
proxies don't give much improvement with few users generally btw mnathani_: my proxy is already behind nat mercutio: the majority of "slow" web sites these days are https
ahh mnathani_: so perhaps I could simply enable routing mercutio: then you can just let the normal nat work it's magic
ip forwarding yes
net.ipv4.ip_forward=1
erk that doesn't seem to ber it
oh zsh just wasn't completing mnathani_: the nat gateway would need to know how to get back to my 192.168.64.0/24 segment mercutio: why?
i don't do full transparent with proxies mnathani_: its on 10.10.0.0/16 mercutio: so it's just like any other
oh
yeh the nat router should also nat 192.168.64.0/24
and have routes to reach it mnathani_: right mercutio: dsl modems can be a pita for that :/ mnathani_: do you transparent proxy https as well? mercutio: nope mnathani_: good think I have a mikrotik mercutio: you can only tcp proxy it
which i want to do again
so who here is using a ssid ending in optout_nomap?
err _optout_nomap m0unds: not me, don't care enough mnathani_: step 2 complete, Nat is working and my vm on 192.168.64.0/24 has internet access using the ubuntu gateway that has ip forwarding enabled. Now all I need to do is get the transparent proxy working brycec: FWIW I've had no such issue on my system, whether Windows 7, 8.1, or 10. And it sleeps a lot. 15:44:06 m0unds | there's a longstanding AMD driver issue w/sleep and black screens mercutio: mnathani_: just go explicit ?
ie set your proxy in your browser
or in http_proxy on command line mnathani_: my goal is transparent proxy mercutio: ok mnathani_: iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
that eth0
is that on the interface facing client? mercutio: is eth0 in? mnathani_: or towards internet
in that iptables rule mercutio: that looks fine
have you got squid setup to listen in transparent mode
that's the interface that http connections come in on mnathani_: in my case its eth1 mercutio: oh :)
well there goes the issue
in my case it's enp4s0
don't you love the naming mnathani_: I am getting connection refused mercutio: are you listening on port 3128 mnathani_: for http requests from my client mercutio: sudo netstat -tnlp | grep 3128 mnathani_: I am not
so that would be a problem mercutio: well there goes the issue
i think it's http_port in squid
yeh http_port 3128 http11 transparent
although if you just installed squid you may have to run squid -z to create the cache directories mnathani_: http_port 3128
I have that in my config mercutio: so squid isn't running then
append transparent
i dunno if you still need http11 or snot
i only see that http11 was added in 2.7, not that it was deprecated, hmm.
it seems transparent is changing to the word intercept though m0unds: brycec: i'm happy you didn't experience it
because it's horribly annoying brycec: m0unds: thanks :p m0unds: i've seen it on more machines than i haven't seen it on, so you're a lucky duck mnathani_: ok, I get access denied now
so that looks better mercutio: sweet now ip acl brycec: Wow. And yet both mine and my lady's windows desktops are just peachy.
So 100% okay in my experience, m0unds mercutio: brycec: large sample set there brycec: :D mercutio: i seem to remember some computer screwing up if it suspended and it wouldn't come back at one point
but memory is sketchy
i just remember thinking it wasn't good to plug in the sleep button m0unds: http://forums.anandtech.com/showthread.php?t=2322060 mercutio: because it can cause issues when used :) m0unds: ^ that mess brycec: Heh, then again those posts are from 2 years ago. Plenty of time for change. mercutio: heh i like it how windows includes ethernet drivers now days m0unds: right, but i was managing a site with 30 7xxx era firegl and radeon cards and most of them would die if the machine was left unattended and went to sleep overnight or whatever mercutio: that used to be my biggest gripe m0unds: to the point that i had to set a policy to prevent sleep so i didn't have to deal with it every morning brycec: That really sucks mercutio: m0unds: were you using microsoft or ati drivers? m0unds: AMD, had to
needed opencl mercutio: ahh
i used to find that the ati drivers were worse than the microsoft ones
unless you needed to play games m0unds: and as luck had it, they started replacing those boxes when my contract was ending
the bastard mercutio: intel hd seems nice and stable. m0unds: s mnathani_: Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect. mercutio: mnathani_: fix your acl :)
acl's are two step in squid
you need like acl localnet src 192.168.0.0/16
http_access allow localnet
and they're first match
so you hvae to allow before you deny mnathani_: my allows were under another deny way up in the config
its a 7000 line config
probably easier to wipe it clean and start fresh mercutio: heh
use grep
cat /etc/squid/squid.conf | grep ^http_access brycec: why not just "grep ^http_access /etc/squid/squid.conf" ? mercutio: brycec: that'd work too, but i find it easier to think that way around :) brycec: :) mercutio: i'm not a big fan of condensing -: brycec is a huge fan of optimising mercutio: on grep'ing a 7000 line file?
does it save more than a msec?
i don't even use egrep usually :) brycec: In this case, probably not. But I'm not saying that optimisation is for speed
It just makes it, whatever it is, optimal :) Could be readable, simpler, fewer system calls, etc mercutio: ahh, i find it more readable, simpler with it spread out brycec: If you were grepping multiple files, you would almost certainly prefer the "condensed" form as then grep can report *which* file matched. mercutio: but yeah there may be fewer system calls with your method. but that's not even a certainty brycec: I find mine to be more readable. But to each their own. mercutio: yeah different thinking styles and all that
i like to think of the "object i'm doing something with" then what i do with it
rather than what i'm doing with it, then what object i'm doing on it mnathani_: coredump_dir /var/spool/squid3 mercutio: also if you need to change it to something else it's much easier
like that word doesn't work.. mnathani_: do I need that in my config? mercutio: mnathani_: that's normal
yes
squid spool directory is given less space to allow some space for coredump
and for file system overheads
did you figure out your acl? :) mnathani_: I think so
trying it now
1438565621.558 115 192.168.64.100 TCP_MISS/200 114420 GET http://turnerhd-f.akamaihd.net/z/tvecnn_1@135347/tiny_6963ff495dca454b-p_Seg1-Frag239760933? - HIER_DIRECT/23.15.4.17 video/f4f
1438565623.468 18 192.168.64.100 TCP_REFRESH_MODIFIED/200 668 GET http://turnerhd-f.akamaihd.net/z/tvecnn_1@135347/tiny_6963ff495dca454b-p.bootstrap? - HIER_DIRECT/23.15.4.17 video/abst
1438565625.831 76 192.168.64.100 TCP_MISS/200 982 GET http://ar.voicefive.com/bmx3/iframe.htm? - HIER_DIRECT/205.218.48.203 text/html
appears to be working now
thanks mercutio :-) mercutio: sweet
did you set cache_dir to a big enough size?
i think it defaults to 100mb mnathani_: cache_dir rock Directory-Name Mbytes [options]
do I need to specify a directory? mercutio: oh god
i abandoned squid beforethat rock stuff
is rock stable?
anyway normally it's something like:
cache_dir ufs /var/spool/squid3 32000 16 256
for 32gb with ufs
you can do aufs too, but for light loads it's generally not necessary
i assume with rock it's something like cache_dir rock /var/spool/squid3 32000 mnathani_: do you recall slow restarts with squid
that can be speeded up with some config
http://www.squid-cache.org/Doc/config/shutdown_lifetime/
not sure if that was it mercutio: yes
also it has to rebuild the cache sometimes
like if you press the reset button and have a huge cache it'll have to go through rebuilding the cache indexes
the cache rebuild is more of an issue than the shutdown lifetime
the shutdown lifetime is for connections that are still going mnathani_: on ubuntu how do I make that iptables rule persistent? brycec: Step 1) Erase Ubuntu. :P
</generic Ubuntu and non-BSD hate> m0unds: sounds reasonable to me brycec: I've always had trouble working with Ubuntu-isms, eg upstart (or whatever it was called) mnathani_: is Debian really that much better? brycec: Nowadays, yes. Because I know systemd. mercutio: i use ferm mnathani_
ubuntu has systemd too if you use recent ersion
version mnathani_: is there a good tutorial out there to get ones self up to speed with systemd? brycec: I learned from https://wiki.archlinux.org/index.php/Systemd mnathani_: I suppose this would be useful in managing RedHat Enterprise Linux 7 / CentOS 7 as well since they moved to systemd too? I wonder if there are differences in implementation mike-burns: If you run into issues, here's a good systemd troubleshooting guide: http://www.openbsd.org/faq/faq4.html brycec: -.-
mnathani_: The fundamentals are the same. The only differences I'd expect could be the names of the unit files mnathani_: lol mike-burns mercutio: mnathani_: ubuntu hasnt' fully moved over to systemd yet last i knew
although it seems to be more so when doing new installs than updating mnathani_: so many sites using ssl - didnt realize it earlier
perhaps I am doing it wrong - too many misses not enough hits with regards to Squid
even when I load the exact same url into a different browser mercutio: 10% hit rate is common for bytes
it's only really useful for things like updating packages over multiple hosts mnathani_: perhaps I am missing something in the config: http://paste.ubuntu.com/11990871/
what happens if the different hosts choose different mirrors mercutio: then you're out of lock
luck
centos is nice like that :/
you can do complicated rewrite stuff but i wouldn't recommend mnathani_: anything more I can do with my config to get more hits? mercutio: maximum_object_size
http://www.squid-cache.org/Doc/config/maximum_object_size/ kellytk: I'm cautiously optimistic about what the FreeBSD project comes up with for a modern service manager JC_Denton: anyone here using Duo Security? mercutio: i only just found out about iotop m0unds: JC_Denton: i've used it before
it was kind of flaky JC_Denton: i'm giving it a go over Google Authenticator
seems a little slow, but it's nice to be able to approve 2fa from a wearable mnathani_: here is something really strange - I had unbound installed, but wanted to switch to bind, so I stopped the unbound service and started bind, but unbound got restarted instead mercutio: that does strange
but i have no idea sorry :) mnathani_: got it taken care of
I like the query log style of bind compared to unbound mercutio: you use query log?
i just tcpdump if i want to see queries