Agreed all-around Once I went solid-state I knew I'd never go back, workstations and servers alike mnathani_: do you happen to have an exchange acct or similar w/policy enforcement enabled configured w/the win10 mail client? http://forums.nfoservers.com/viewtopic.php?f=1&t=12912 womp womp m0unds: no exchange account - or anything I can think of that would have policy enforcement enabled mnathani_: strange it's kind of disconcerting with the windows shift that's happened in here :) ? oh just cos windows 10 came out etc :) oh, talking about it? yeah my windows computer randomly had a black screen today throw it down a flight of stairs it was still working, sound etc. weird turning the monitor on and off didn't fix it display driver crash? probably i rebooted and it's fine so far. was it coming out of sleep? nope ah it doesn't sleep maybe it should there's a longstanding AMD driver issue w/sleep and black screens dunno if they ever fixed it well it is amd maybe it started sleeping since upgrading. i know, that's why i mentioned it :) but then why'd it wait until today to crash my linxu computer went through a period of crashing no time like the present i changed the motherboard and it was fine i changed psu and case too though but when linux crashes everyone now and then suspect hardware when windows crashes every now and then suspect drivers :) it did used to get ethernet brief lockups all the time from new i never really noticed it except in dmesg wow @weather iran Multiple locations matched your query: Abadan, IR (zmw:00000.1.40831), Abadeh, IR (zmw:00000.1.40818), Abu Musa, IR (zmw:00000.1.40890), Ahar, IR (zmw:00000.1.40704), Ahwaz, IR (zmw:00000.1.40811), Ali-Goodarz, IR (zmw:00000.1.40783), Anzali, IR (zmw:00000.1.40718), Arak, IR (zmw:00000.1.40769), Ardebil, IR (zmw:00000.1.40708), Babulsar, IR (zmw:00000.1.40736), Baft, IR (zmw:00000.1.40853), Bam, IR (zmw:00000.1.40854), Bandar Lengeh, IR (zmw:0000 @weather bandar Bandar, Indonesia: Mostly Cloudy ☁ 67°F (19°C), Humidity: 99%, Wind: From the West at 2 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=, or re-request this with: @weather -v bandar grr hahaha @weather brandar mahshar, ir Error, No cities match your search query @weather bandar mahshar, ir Error, No cities match your search query i suck at this @weather bandar, ir Error, No cities match your search query @weather bandar, iran anyway Bandar, Indonesia: Mostly Cloudy ☁ 67°F (19°C), Humidity: 99%, Wind: From the West at 2 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=, or re-request this with: @weather -v bandar, iran heat weave in iran weird @weather abadan, ir Abadan, Iran: Clear 93°F (34°C), Humidity: 41%, Wind: From the NNW at 9 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=30.36666679,48.25000000 or re-request this with: @weather -v abadan, ir @weather Bandar Lengeh, IR Bandar Lengeh, Iran: Haze 93°F (34°C), Humidity: 59%, Wind: Calm -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=26.53199959,54.82484818 or re-request this with: @weather -v Bandar Lengeh, IR oh, i didn't notice the second word in the name what that doesn't seem that hot what time is it there now? i dunno if that's the same city as bandar mahshahr 0319 but it was in that list of cities up there pretty hot for 3 am haha oh wow ok ehh forecasted daytime temp is 101 that's not so bad? it's forecasted to be 110 in phoenix, az tomorrow http://time.com/3981478/iran-heatwave-bandar-mahsahr/ maybe because it's on the water or something? oh, with the heat index because of humidity In Iraq, air temperatures continued to exceed 120 degrees (49 Celcius) for the eighth day in a row on Sunday, according to the Weather Channel. The heat had become so scorching on Thursday that the Iraqi government mandated a four-day holiday. yeah, that'd be why then oh high humidity + hot as hell yeah, that blows does unbound default to allow all source IPs for dns resolution? turns out its only listening on localhost nope it allows ::1 and 127.0.0.1 and some others it hink search for acl oh it's not acl :") interface: 0.0.0.0 it's access-control I put that in there, but its still listening on localhost only access-control: 0.0.0.0/0 refuse access-control: 127.0.0.0/8 allow oh did you restart it? yup could it bind that address? i'm nost listening on 0.0.0.0 i listen on the real addresses but 0.0.0.0 should work oh, unless you have an authorative dns server on the host too got it to listen on 192.168.64.1 cool but now I need the access control yip i pasted that up there so first you refuse then you accept ie it's last match not first match ok, dns is good now sweet time to try the transparent proxy using squid oh god i mean cool :) you got your firewall rules down? :) you mean iptables nat 80 to 3128 or something like that? also you may want to try trafficserver instead of squid these days is that ipfw? oh iptables word yeh sending 80 to 3128 i just use explicit proxy except for wireless at home proto tcp if enp4s0 saddr 192.168.1.0/24 dport http REDIRECT to-ports 8080; that's what i'm doing with ferm does trafficserver have a binary or do I need to build from source running ubuntu it's got old binaries in ubuntu last i knew what version does it say? http://packages.ubuntu.com/search?keywords=trafficserver trusty has 3.2 that's probably fine i think 5 is what it's up to i compile from source myself but i did a couple of patches etc so yeah its' ok if you're ok behind two major versions behind September 08, 2014: The old, legacy release of ATS, v3.2.x, is no longer supported. We have removed it from the download site, but it is available via the archives. We urge everyone to migrate to v4.2.x or 5.x as soon as possible. July 4, 2015: The latest stable release, v5.3.1, is now available from the Downloads section. This is the LTS release for 5.x yeah i'd go with source trafficserver has http2 support :) and a few other cool things but squid maybe easier to get started with do you generally need to enable nat / ip forwarding for other non http traffic? the default trafficserver config is more towards reverse proxies than forward yes saddr 192.168.0.0/16 outerface ppp0 SNAT to 202.49.67.22; i do it with that but then i have normal ip's mixed too, that i don't want to nat proxies don't give much improvement with few users generally btw my proxy is already behind nat the majority of "slow" web sites these days are https ahh so perhaps I could simply enable routing then you can just let the normal nat work it's magic ip forwarding yes net.ipv4.ip_forward=1 erk that doesn't seem to ber it oh zsh just wasn't completing the nat gateway would need to know how to get back to my 192.168.64.0/24 segment why? i don't do full transparent with proxies its on 10.10.0.0/16 so it's just like any other oh yeh the nat router should also nat 192.168.64.0/24 and have routes to reach it right dsl modems can be a pita for that :/ do you transparent proxy https as well? nope good think I have a mikrotik you can only tcp proxy it which i want to do again so who here is using a ssid ending in optout_nomap? err _optout_nomap not me, don't care enough step 2 complete, Nat is working and my vm on 192.168.64.0/24 has internet access using the ubuntu gateway that has ip forwarding enabled. Now all I need to do is get the transparent proxy working FWIW I've had no such issue on my system, whether Windows 7, 8.1, or 10. And it sleeps a lot. 15:44:06 m0unds | there's a longstanding AMD driver issue w/sleep and black screens mnathani_: just go explicit ? ie set your proxy in your browser or in http_proxy on command line my goal is transparent proxy ok iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 that eth0 is that on the interface facing client? is eth0 in? or towards internet in that iptables rule that looks fine have you got squid setup to listen in transparent mode that's the interface that http connections come in on in my case its eth1 oh :) well there goes the issue in my case it's enp4s0 don't you love the naming I am getting connection refused are you listening on port 3128 for http requests from my client sudo netstat -tnlp | grep 3128 I am not so that would be a problem well there goes the issue i think it's http_port in squid yeh http_port 3128 http11 transparent although if you just installed squid you may have to run squid -z to create the cache directories http_port 3128 I have that in my config so squid isn't running then append transparent i dunno if you still need http11 or snot i only see that http11 was added in 2.7, not that it was deprecated, hmm. it seems transparent is changing to the word intercept though brycec: i'm happy you didn't experience it because it's horribly annoying m0unds: thanks :p i've seen it on more machines than i haven't seen it on, so you're a lucky duck ok, I get access denied now so that looks better sweet now ip acl Wow. And yet both mine and my lady's windows desktops are just peachy. So 100% okay in my experience, m0unds brycec: large sample set there :D i seem to remember some computer screwing up if it suspended and it wouldn't come back at one point but memory is sketchy i just remember thinking it wasn't good to plug in the sleep button http://forums.anandtech.com/showthread.php?t=2322060 because it can cause issues when used :) ^ that mess Heh, then again those posts are from 2 years ago. Plenty of time for change. heh i like it how windows includes ethernet drivers now days right, but i was managing a site with 30 7xxx era firegl and radeon cards and most of them would die if the machine was left unattended and went to sleep overnight or whatever that used to be my biggest gripe to the point that i had to set a policy to prevent sleep so i didn't have to deal with it every morning That really sucks m0unds: were you using microsoft or ati drivers? AMD, had to needed opencl ahh i used to find that the ati drivers were worse than the microsoft ones unless you needed to play games and as luck had it, they started replacing those boxes when my contract was ending the bastard intel hd seems nice and stable. s Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect. mnathani_: fix your acl :) acl's are two step in squid you need like acl localnet src 192.168.0.0/16 http_access allow localnet and they're first match so you hvae to allow before you deny my allows were under another deny way up in the config its a 7000 line config probably easier to wipe it clean and start fresh heh use grep cat /etc/squid/squid.conf | grep ^http_access why not just "grep ^http_access /etc/squid/squid.conf" ? brycec: that'd work too, but i find it easier to think that way around :) :) i'm not a big fan of condensing on grep'ing a 7000 line file? does it save more than a msec? i don't even use egrep usually :) In this case, probably not. But I'm not saying that optimisation is for speed It just makes it, whatever it is, optimal :) Could be readable, simpler, fewer system calls, etc ahh, i find it more readable, simpler with it spread out If you were grepping multiple files, you would almost certainly prefer the "condensed" form as then grep can report *which* file matched. but yeah there may be fewer system calls with your method. but that's not even a certainty I find mine to be more readable. But to each their own. yeah different thinking styles and all that i like to think of the "object i'm doing something with" then what i do with it rather than what i'm doing with it, then what object i'm doing on it coredump_dir /var/spool/squid3 also if you need to change it to something else it's much easier like that word doesn't work.. do I need that in my config? mnathani_: that's normal yes squid spool directory is given less space to allow some space for coredump and for file system overheads did you figure out your acl? :) I think so trying it now 1438565621.558 115 192.168.64.100 TCP_MISS/200 114420 GET http://turnerhd-f.akamaihd.net/z/tvecnn_1@135347/tiny_6963ff495dca454b-p_Seg1-Frag239760933? - HIER_DIRECT/23.15.4.17 video/f4f 1438565623.468 18 192.168.64.100 TCP_REFRESH_MODIFIED/200 668 GET http://turnerhd-f.akamaihd.net/z/tvecnn_1@135347/tiny_6963ff495dca454b-p.bootstrap? - HIER_DIRECT/23.15.4.17 video/abst 1438565625.831 76 192.168.64.100 TCP_MISS/200 982 GET http://ar.voicefive.com/bmx3/iframe.htm? - HIER_DIRECT/205.218.48.203 text/html appears to be working now thanks mercutio :-) sweet did you set cache_dir to a big enough size? i think it defaults to 100mb cache_dir rock Directory-Name Mbytes [options] do I need to specify a directory? oh god i abandoned squid beforethat rock stuff is rock stable? anyway normally it's something like: cache_dir ufs /var/spool/squid3 32000 16 256 for 32gb with ufs you can do aufs too, but for light loads it's generally not necessary i assume with rock it's something like cache_dir rock /var/spool/squid3 32000 do you recall slow restarts with squid that can be speeded up with some config http://www.squid-cache.org/Doc/config/shutdown_lifetime/ not sure if that was it yes also it has to rebuild the cache sometimes like if you press the reset button and have a huge cache it'll have to go through rebuilding the cache indexes the cache rebuild is more of an issue than the shutdown lifetime the shutdown lifetime is for connections that are still going on ubuntu how do I make that iptables rule persistent? Step 1) Erase Ubuntu. :P sounds reasonable to me I've always had trouble working with Ubuntu-isms, eg upstart (or whatever it was called) is Debian really that much better? Nowadays, yes. Because I know systemd. i use ferm mnathani_ ubuntu has systemd too if you use recent ersion version is there a good tutorial out there to get ones self up to speed with systemd? I learned from https://wiki.archlinux.org/index.php/Systemd I suppose this would be useful in managing RedHat Enterprise Linux 7 / CentOS 7 as well since they moved to systemd too? I wonder if there are differences in implementation If you run into issues, here's a good systemd troubleshooting guide: http://www.openbsd.org/faq/faq4.html -.- mnathani_: The fundamentals are the same. The only differences I'd expect could be the names of the unit files lol mike-burns mnathani_: ubuntu hasnt' fully moved over to systemd yet last i knew although it seems to be more so when doing new installs than updating so many sites using ssl - didnt realize it earlier perhaps I am doing it wrong - too many misses not enough hits with regards to Squid even when I load the exact same url into a different browser 10% hit rate is common for bytes it's only really useful for things like updating packages over multiple hosts perhaps I am missing something in the config: http://paste.ubuntu.com/11990871/ what happens if the different hosts choose different mirrors then you're out of lock luck centos is nice like that :/ you can do complicated rewrite stuff but i wouldn't recommend anything more I can do with my config to get more hits? maximum_object_size http://www.squid-cache.org/Doc/config/maximum_object_size/ I'm cautiously optimistic about what the FreeBSD project comes up with for a modern service manager anyone here using Duo Security? i only just found out about iotop JC_Denton: i've used it before it was kind of flaky i'm giving it a go over Google Authenticator seems a little slow, but it's nice to be able to approve 2fa from a wearable here is something really strange - I had unbound installed, but wanted to switch to bind, so I stopped the unbound service and started bind, but unbound got restarted instead that does strange but i have no idea sorry :) got it taken care of I like the query log style of bind compared to unbound you use query log? i just tcpdump if i want to see queries