Re: Gentoo for many servers (was: Re: [gentoo-user] executing commands on lots of servers at once)

2009-11-15 Thread Joshua Murphy
On Sat, Nov 14, 2009 at 5:09 PM, Alex Schuster wo...@wonkology.org wrote:
 Alan McKinnon writes:

 On Saturday 14 November 2009 19:36:06 Alex Schuster wrote:
 Alan McKinnon wrote:

 clusterssh will let you log into many machines at once and run emerge
 -avuND world everywhere
 This is way cool. I just started using it on eight Fedora servers I am
 administrating. Nice, now this is an improvement over my 'for $h in
 $HOSTS; do ssh $h yum install foo; done' approach.

 I feel your pain :-)

 We used to have the same problem adding new admins to 87 machines. Now
 we have a bespoke provisioner that does it all.

 Sorry, I just do not get 'bespoke provisioner'. Some sort of software,
 like clusterssh? Or a person, one admin instead of many?


 What do you guys think about using Gentoo for servers? At the institute
 I partially work we chose Fedora. There is no special reason for that -
 we already had some Fedora machines, the setup seemed to work, the
 reputation was good, so we kept it. That was okay for me, why choose
 many different environments and learn everything again. I mentioned
 Gentoo, but did not really suggest to actually use it. Maybe I should
 have.

 I'm a huge fan of Gentoo

 Now who would have thought of that!

 and all my personal machines (except the new netbook have run it for the
 last 5 years.

 But I will never install Gentoo on a production server at work.

 Why?

 Because it is too time consuming, because no two machines are set up the
 same, because I can't trust that other admins used the flags they should
 have. So updates become a case of logging into 80+ machines individually
 and doing emerge world by hand. Gentoo allows you to customize things to
 the nth degree - that is it's strength - so people WILL use this one
 discriminating factor.

 If OTOH I had a server farm of 80+ machines, all identical, I'd put
 Gentoo on them in a flash. But I don't have that

 Of our 8 machines, 7 are essentially the same and differ only in hard
 drive space and CPU speed. The other machine is Intel, not AMD, and needs
 different IDE drivers. At the moment it has a different initrd (I set up a
 minimal fedora install to generate it after the cloned system did not
 boot), the rest is - apart from some config files - identical.

 So I would make sure that about everything is exactly the same, well,
 maybe except for hostnames, udev net-persistent-rules, ssh keys... what
 more?
 The last, a little different machine is a problem though. With optimized
 CFLAGS, this one would have to compile all stuff again, while for the
 others I could use binpkgs. Updating them all with clusterssh should not
 be much more work than updating a single one. Well, not completely true, I
 would have the double work, as I would upgrade one server first to test if
 there are problems, and then do it for the others. Maybe I could use the
 special machine to test stuff, and then update all the others.

 If they would differ, Gentoo would of course be too much work. I already
 have this problem now... there is my desktop machine, my notebook running
 a Gentoo VM, a second desktop machine at my other home, the living-room
 machine of my flat share, the machine of a fried I also administrate, the
 server of my flat share I need to set up again... and clusterssh is no
 option here.

My potentially ill informed thoughts on the above issues/ideas:

1) Pick one machine to host both your make.conf as well as your
portage tree and distfiles, potentially splitting them into separate
nfs mounts shared out for the rest of the hosts (having the portage
tree itself ro on all but its owning machine forces centralization of
syncing).

2) /etc/make.conf should simply be a symlink to the centrally located
copy. If you must use binpackages, set march to something that will
run on every machine involved, then set mcpu to whatever machine is
most common if you want to get just a bit more performance here or
there. If you don't mind compiling on every host, though, set portage
niceness to something friendly to your users and march to native (if
you plan to use distcc, this is a BAD idea, use the binpackages).

3) use a replaceable (otherwise identical to the others, and therefore
able to be brought back online by just cloning it over) system for
your testing and keep frequent scheduled backups of whichever system
plays host to your portage tree, binpackages, and distfiles.

4) build your kernel with built in drivers for every piece of
boot-time essential hardware in your systems. You'll still be on a far
cleaner setup than a mass produced distro provided kernel, you'll only
need to maintain one for all your systems, and you'll only have one
kernel to worry about building against if you need any out-of-kernel
modules as well.

5) script the changing of ssh host keys (or even redistribution of
them, if you ), removal of persistent net rules, and prompting for the
setting of host name and you'll have a nice, tiny, postinstall tool
for the rare 

Re: [gentoo-user] Blocking login attempts to sshd and vsftpd

2009-11-15 Thread Walter Dnes
On Sat, Nov 14, 2009 at 07:07:28PM -0500, Richard Marza wrote

 Thank you for the information, I did find that denyhost and fail2ban in 
 threads but there were issues with it not working properly. Some users 
 created custom scripts to get the job done correctly.

  Have you considered not allowing password-based logins at all for ssh?
Use RSA keys instead.  It's much easier, and much more secure.

-- 
Walter Dnes waltd...@waltdnes.org



Re: [gentoo-user] Block root user from login on xorg GUI

2009-11-15 Thread Dale

Stroller wrote:


On 14 Nov 2009, at 20:46, Alan McKinnon wrote:

...
You are right of course, but in this particular case the guy who pays
wants  to have root access.


And you agreed to work like that?

So when he fucks things up good royal and proper, will he gladly 
accept his
shafting and pay you more to undo it? Or will he do the usual 
customer stunt

and blame you?


My typical experience is that the customer will take it completely on 
the chin and pay me to fix the problems. That doesn't make foul-ups 
due to such unnecessary meddling any less frustrating, though.



I only work under one of two conditions:

I am root and the customer is not.
The customer is root and I am not.


This is clearly the right way to operate, however it can be 
extremely difficult to walk away from your largest-paying contract, 
just because the owner sees this particular issue differently.


One has to hope, really, that the client only wants the root password 
as insurance in case you get run over by a bus, and won't use it to 
arbitrarily mess about on the system.


Stroller.





I would do one thing and take it as often as possible, a large CYA 
pill.  I had this situation with a friend once a few years ago, trust 
me, it's a lot easier to blame someone else than yourself.  System logs 
saved me since they pointed to him instead of me. 

That pill should contain logs, notes and anything else that can be used 
to protect yourself.  When a scapegoat is needed, you're it.  That said, 
I sort of think you see this already. 


Dale

:-)  :-) 





Re: [gentoo-user] ~amd64 : X11 (?) crashing

2009-11-15 Thread Daniel Troeder
On Sun, 2009-11-15 at 01:06 +0100, Stefan G. Weichinger wrote:
 greets ...
 
 As mentioned lately in another thread I moved to amd64 unstable last week.
 
 So far OK ... but:
 
 I see X11 crashing repeatedly but I don't have a clue what component
 might be the reason.
 
 Sometimes my gnome-session (2.28) works for hours, sometimes for minutes.
 
 It crashes when starting a new program like opera, firefox, thunderbird,
 amarok, ... something 
 
 I don't have a clear way to reproduce the crash and the logs don't tell
 me anything.
 
 --
 
 I rebuilt xorg-server, xorg-drivers, xf86-input-*  opera, etc
 
 I re-emerged @system overnight, ran revdep-rebuild, lalefixer etc (yeah,
 I know, X11 isn't @system ... but just to do the basement right)
 
 I use nvidia-drivers here, so I also did eselect opengl ... again.
 
 I erased xorg.conf and redid it via nvidia-xconfig ... and changed it to
 use absolute coordinates, as the xorg-server-1.7 seems to have issues
 with LeftOf ...
 
 Additional info:
 
 I use compiz and xinerama ... two monitors ... might add some problems.
 The two monitors are the reason for still using xorg.conf with
 xorg-server-1.7.x (maybe there's a better solution? I don't know yet).
 
 bugs.gentoo.org doesn't show anything describing my issues, I hesitate
 to file a bug as long as the symptoms are that vague ...
 
 Some clues, someone?
 
 There were NO such crashes before moving to full ~amd64, I ran
 xorg-server-1.6 before (mixing stable and unstable ...).
 
 Simply going back to xorg-server-1.6 ?
 
 Thanks a lot, Stefan.
I might have a similar problem, that is definitely related to the second
monitor and power management. If you disconnect your 2nd monitor, do the
crashes still occur? But maybe this isn't related, because I have a
Radeon card... just a lucky guess...

Daniel




Re: [gentoo-user] Block root user from login on xorg GUI

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 07:15:43 Stroller wrote:
 On 14 Nov 2009, at 20:46, Alan McKinnon wrote:
  ...
  You are right of course, but in this particular case the guy who pays
  wants  to have root access.
 
  And you agreed to work like that?
 
  So when he fucks things up good royal and proper, will he gladly
  accept his
  shafting and pay you more to undo it? Or will he do the usual
  customer stunt
  and blame you?
 
 My typical experience is that the customer will take it completely on
 the chin and pay me to fix the problems. That doesn't make foul-ups
 due to such unnecessary meddling any less frustrating, though.

My experience has been completely the opposite, same with just about everyone 
else I work with. But, this is a third-world country pretending to be a first-
world country, and the cowboy attitude is very prevalent here.

 One has to hope, really, that the client only wants the root password
 as insurance in case you get run over by a bus, and won't use it to
 arbitrarily mess about on the system.

I find the root password in a sealed envelope in the safe is the ideal 
insurance for that.

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] openwatcom ebuild question

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 06:07:59 David Relson wrote:
 The lack of 64-bit buildability for openwatcom is a whole 'nother
 subject and I'm in communication with the developer about it.
 

Is this the very famous watcom compiler that's been around longer than MS-DOS 
and eventually ended up being owned by Sybase?

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] scrollback using framebuffer

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 05:19:41 Maxim Wexler wrote:
 On 11/14/09, Alan McKinnon alan.mckin...@gmail.com wrote:
  On Sunday 15 November 2009 00:12:26 Maxim Wexler wrote:
 
  Yes, use vesa. It's slow at high res, but works.
 
  The nvidia framebuffer does not work with nvidia-drivers
 
 Yeah, I found that out just after mailing the above. But now that I'm using
  vesa how do I enable scrollback? 'fbcon=scrollback:128' in the grub kernel
  line doesn't work. It's enabled in the kernel and works fine without the
  fb, if that matters.

It JustWorked for me. My relevant settings:

CONFIG_FB=y
CONFIG_FB_BOOT_VESA_SUPPORT=y
CONFIG_FB_CFB_FILLRECT=y
CONFIG_FB_CFB_COPYAREA=y
CONFIG_FB_CFB_IMAGEBLIT=y
CONFIG_FB_VESA=y
CONFIG_VGACON_SOFT_SCROLLBACK=y
CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=256

I have no settings for scrollback on the kernel command line, just this to set 
the resolution etc:

vga=0x37D ywrap mtrr:4

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] Unable to set up wireless lan - followed documentation

2009-11-15 Thread Hung Dang
I would suggest to find out which wireless card you have and configure
the correct kernel driver for it. Then you can emerge wireless toll such
as wicd and let it configure your wireless connection.

Hung


Stroller wrote:

 On 14 Nov 2009, at 17:55, Nelis Botha wrote:
 ...
 I need some help. I am trying to set up my wireless lan on gentoo. I
 have recompiled kernel. Every attempt at configuring /etc/conf.d/net
 end in faed to configure wireless for wlan0 i have folowed the advice
 given when it fails and give info/advice to resolve but nothing has
 worked thus far. My question then is : what should the /etc/conf.d/net
 look like if I want to connect to dhcp enabled adsl router that does
 not need authenticating ?


 Hi there,

 Could you start by telling us which make  model of wireless card
 you're using, please?

 Do you have the right drivers compiled into the kernel for it, or as
 modules?

 Please post the output of `lspci` / `lsusb` as appropriate, of `lsmod`
 and `iwconfig`.

 Stroller.





Re: [gentoo-user] install nvidia driver and virtualbox for two kernels

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 04:06:27 Zhang Jun wrote:
 Hi list,
 
 I want to keep two kernels in my pc, but have some problems on video
 card driver and vbox:
 
 pc ~ # cd /lib/modules/
 pc modules # ls
 2.6.28-tuxonice-r10-tuxonice  2.6.30-tuxonice-r6
 pc modules # uname -r
 2.6.28-tuxonice-r10-tuxonice
 pc modules # eix -I nvidia
 [I] x11-drivers/nvidia-drivers
  Available versions:  71.86.09!s ~71.86.11!s 96.43.13!s
 173.14.20!s ~173.14.20-r1!s 180.60!s ~185.18.36!s ~185.18.36-r1!s
 ~190.29!s ~190.42-r2!s ~190.42-r3!s {acpi custom-cflags gtk
 kernel_FreeBSD kernel_linux multilib userland_BSD}
  Installed versions:  180.60!s(21时18分12秒 2009年08月16日)(acpi
 kernel_linux -custom-cflags -gtk -multilib)
 
 ### and I want to install nv driver for another kernel by hand (not emerge)
 
 pc modules # sh
 /usr/portage/distfiles/NVIDIA-Linux-x86-180.60-pkg0.run -a -K -k
 2.6.30-tuxonice-r6
 Verifying archive integrity... OK
 Uncompressing NVIDIA Accelerated Graphics Driver for Linux-x86
 180.60.
 ...
 
  ERROR: No NVIDIA driver is currently installed; the
 '--kernel-module-only' option can only be used to install the NVIDIA
 kernel module on
   top of an existing driver installation.
 
 
 
 
 the same problem will be in virtaulbox-modules, though I have not tested.
 
 
 how can I install nv driver and vbox-modules for two kernels ?
 thanks!
 

Why are you trying to do it by hand? Just use emerge and let portage take care 
of all the housekeeping for you:

- emerge module-rebuild
- run module-rebuild populate

- point /usr/src/linux at the source for the kernel you want to build for
- run module-rebuild rebuild
- repeat for each kernel

The ebuild/driver package is smart enough to install kernel modules in the 
correct directory in /lib/modules/ when you do it this way/

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] Unable to set up wireless lan - followed documentation

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 02:29:09 Neil Bothwick wrote:
 On Sat, 14 Nov 2009 21:13:52 +0200, Alan McKinnon wrote:
  Is this a desktop machine?
 
 What difference does that make?

It might be inconvenient to run the wicd client on a headless box

  If so, dump the net.* scripts and just run wicd.
 
  Why? Because it just works.
 
 Agreed, but on laptops and netbooks too.
 
I see what you mean :-) 

I meant desktop generally as in not a server

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] Blocking login attempts to sshd and vsftpd

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 08:21:55 Walter Dnes wrote:
 On Sat, Nov 14, 2009 at 07:07:28PM -0500, Richard Marza wrote
 
  Thank you for the information, I did find that denyhost and fail2ban in
  threads but there were issues with it not working properly. Some users
  created custom scripts to get the job done correctly.
 
   Have you considered not allowing password-based logins at all for ssh?
 Use RSA keys instead.  It's much easier, and much more secure.
 
fail2ban and/or denyhosts is still very useful with key-only auth, even if 
only to get the spam out of messages and into the iptables logs


-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] openwatcom ebuild question

2009-11-15 Thread Neil Bothwick
On Sat, 14 Nov 2009 23:12:31 +0100, Daniel Pielmeier wrote:

 Do you use distcc? Try if the ebuild works with temporary disabling
 distcc. If distcc is to blame, fixing wont be that easy. You have to
 examine build.sh and fix it in order to work with distcc.

Or disable distcc in the ebuild.

Or add FEATURES=-distcc to /etc/portage/env/dev-land/openwatcom-1.7.1
Create whatever of the path is missing.


-- 
Neil Bothwick

There is so much sand in Northern Africa that if it were spread out it
would completely cover the Sahara Desert.


signature.asc
Description: PGP signature


Re: [gentoo-user] ~amd64 : X11 (?) crashing

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 02:06:19 Stefan G. Weichinger wrote:
 greets ...
 
 As mentioned lately in another thread I moved to amd64 unstable last week.
 
 So far OK ... but:
 
 I see X11 crashing repeatedly but I don't have a clue what component
 might be the reason.
 
 Sometimes my gnome-session (2.28) works for hours, sometimes for minutes.

What happens when X crashes? Does the X session go away? Is there an error 
message? Or does it just hang?

Your symptoms as described are random, I find far more often than not that is 
hardware, usually the power supply, ram and video card (in that order)

Give your hardware a thorough stress test, then only start playing with 
downgrades


-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] Block root user from login on xorg GUI

2009-11-15 Thread Neil Bothwick
On Sun, 15 Nov 2009 05:15:43 +, Stroller wrote:

  So when he fucks things up good royal and proper, will he gladly  
  accept his
  shafting and pay you more to undo it? Or will he do the usual  
  customer stunt
  and blame you?  
 
 My typical experience is that the customer will take it completely on  
 the chin and pay me to fix the problems. That doesn't make foul-ups  
 due to such unnecessary meddling any less frustrating, though.

Why not use sudo to give the customer's account almost full root access?
Not only does this allow you to restrict which damaging commands he can
run but sudo logs each command it runs, so you have CYA insurance.


-- 
Neil Bothwick

On the other hand, you have different fingers.


signature.asc
Description: PGP signature


Re: [gentoo-user] Blocking login attempts to sshd and vsftpd

2009-11-15 Thread Neil Bothwick
On Sun, 15 Nov 2009 01:21:55 -0500, Walter Dnes wrote:

   Have you considered not allowing password-based logins at all for ssh?
 Use RSA keys instead.  It's much easier, and much more secure.

That doesn't stop the attempts.


-- 
Neil Bothwick

Quantum leap: (adj.) literally, to move by the smallest amount
theoretically possible. In advertising, to move by the largest leap
imaginable (in the mind of the advertiser). There is no contradiction.


signature.asc
Description: PGP signature


Re: [gentoo-user] Re: Block root user from login on xorg GUI

2009-11-15 Thread Dirk Heinrichs
Am Samstag 14 November 2009 23:50:42 schrieb Alan McKinnon:

 On Saturday 14 November 2009 22:46:18 Dirk Heinrichs wrote:
  Am Samstag 14 November 2009 16:13:04 schrieb Nikos Chantziaras:
   Ever heard about make menuconfig?
 
  ???
 
 The account foolishly being prevented from bypassing SELinux is root.
 
 So, configure a new kernel, disable SELinux, build, install, reboot.
 
 Voila! No SELinux.
 
 Or,
 
 Edit grub.conf, reboot.
 
 Voila! No SELinux.
 
 Or, (as SELinux can be used to prevent access to grub.conf)
 
 Just hit the damn power button and edit the kernel options in the grub
  command line.

Compile in kernel options, configure the kernel not to accept additional ones. 
Damn power button rendered useless.

 Trying to prevent root from doing $STUFF on a pc is utterly and completely
 pointless and simply will not succeed, ever. There is hardware where this
  can be done, but it's not a PC, has no Intel designs in it and is often
  truly secured with armed guards.

This all implies physical access to the machine, right?

 trying to prevent root from doing $STUFF on Unix is utterly and completely
 pointless and simply will not succeed, ever. There are OSes where this can
  be done, but they are not Unix. By definition, on Unix root can do
  anything, including bypassing systems to prevent root from doing anything.

SELinux allows to spread the tasks root needs to do or can do accross several 
roles. Of course, if only one single person has root access to the system this 
doesn't make sense. But we're talking about cases where several people (incl. 
the malicious attacker) have root access. So you can very well configure a 
(SE-)Linux system so that root can't do everything.

Bye...

Dirk


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-user] scrollback using framebuffer

2009-11-15 Thread Justin
Maxim Wexler wrote:
 On 11/14/09, Alan McKinnon alan.mckin...@gmail.com wrote:
 On Sunday 15 November 2009 00:12:26 Maxim Wexler wrote:

 Yes, use vesa. It's slow at high res, but works.

 The nvidia framebuffer does not work with nvidia-drivers
 
 Yeah, I found that out just after mailing the above. But now that I'm using 
 vesa
 how do I enable scrollback? 'fbcon=scrollback:128' in the grub kernel
 line doesn't work. It's enabled in the kernel and works fine without
 the fb, if that matters.
 
 mw
 
Ty this here


│ CONFIG_VGACON_SOFT_SCROLLBACK_SIZE:


 │
  │


   │
  │ Enter the amount of System RAM to allocate for the scrollback


   │
  │ buffer.  Each 64KB will give you approximately 16 80x25


   │
  │ screenfuls of scrollback buffer


   │
  │


   │
  │ Symbol: VGACON_SOFT_SCROLLBACK_SIZE [=256]


   │
  │ Prompt: Scrollback Buffer Size (in KB)


   │
  │   Defined at drivers/video/console/Kconfig:37


   │
  │   Depends on: HAS_IOMEM  VT  VGACON_SOFT_SCROLLBACK


   │
  │   Location:


   │
  │ - Device Drivers


   │
  │   - Graphics support


   │
  │ - Console display driver support


   │
  │   - VGA text console (VGA_CONSOLE [=y])


   │
  │ - Enable Scrollback Buffer in System RAM
(VGACON_SOFT_SCROLLBACK [=y])

 │


I am using 256kb with 1050x1680 resolution.




signature.asc
Description: OpenPGP digital signature


Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Jacques Montier
Volker Armin Hemmann a gentiment tapote:
 On Samstag 14 November 2009, Jacques Montier wrote:
 Jacques Montier a gentiment tapote:
 Julien Gormotte a gentiment tapote:
 Ok, this is interesting :
 libpng12.so.0
 libQtSvg.so.4
 I suppose the icons are in png or svg format, and k3b is not able to
 load them because this lib is missing...

 Did you tried a revdep-rebuild ? maybe an update broke these libs ?

 Well, it's a possibility, but try this.

 And, just to be sure, try to do this, with the same user you use to
 launch k3b :
 file /usr/share/apps/k3b/icons/*

 If it works, then it's not a permissions problem.

 Julien Gormotte

 
 This message was sent using IMP, the Internet Messaging Program.
 $ file /usr/share/apps/k3b/icons/*
 i get :
 /usr/share/apps/k3b/icons/crystalsvg: directory
 /usr/share/apps/k3b/icons/hicolor:directory

 So i can access to those directories as user.

 Now revdep-rebuild...

 Thank you for you help !

 --
 Jacques
 Hi everybody,

 # revdep-rebuild -- All system consistent.
 I re-emerged :
 # x11-libs/qt-svg-4.5.3-r1
 # media-libs/libpng-1.2.38
 But no success, k3b doesn't load icons.
 I think k3b doesn't even read the /usr/share/k3b/icons directory as i
 deleted it without any change...

 I noticed one thing with kde games (kshisen or else ): they are unable
 to load *.svgz (background images).
 I have to move *.svgz to *.gz, then to unzip then and move to svg.
 Then the background images are loaded...
 Strange...

 --
 Jacques

 
 then you are missing something else, because it is all working fine here.
 
 maybe ldd can help you with that.
 
 

No error with ldd /usr/bin/k3b

I give up..

Thanks again,

Best regards,

--
Jacques




Re: [gentoo-user] openwatcom ebuild question

2009-11-15 Thread Daniel Pielmeier
David Relson schrieb am 15.11.2009 05:07:
 
 Daniel,
 
 A detail I meant to include in my original posting is that I'm
 attempting the build on (and for) a 32 bit machine.  So distcc _is_
 the problem.

 The lack of 64-bit buildability for openwatcom is a whole 'nother
 subject and I'm in communication with the developer about it.
 
 Regards,
 
 David
 
 

Everything correct. I was just confused as there were two problems
distcc on one hand and the 64bit problem in the other hand.

-- 
Daniel Pielmeier



signature.asc
Description: OpenPGP digital signature


Re: [gentoo-user] Unable to set up wireless lan - followed documentation

2009-11-15 Thread Neil Bothwick
On Sun, 15 Nov 2009 10:40:57 +0200, Alan McKinnon wrote:

   Is this a desktop machine?
  
  What difference does that make?
 
 It might be inconvenient to run the wicd client on a headless box

You could run the curses version over SSH, provided you could avoid
tripping over the various chickens and eggs :)

   If so, dump the net.* scripts and just run wicd.
  
   Why? Because it just works.
  
  Agreed, but on laptops and netbooks too.
  
 I see what you mean :-) 
 
 I meant desktop generally as in not a server

ISWYM2 :)


-- 
Neil Bothwick

Give a man a fish and you have fed him for a day, but give him a case of
dynamite and soon the village will be showered with mud and seaweed and
unidentifiable chunks of fish.


signature.asc
Description: PGP signature


Re: [gentoo-user] Block root user from login on xorg GUI

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 10:52:51 Neil Bothwick wrote:
 On Sun, 15 Nov 2009 05:15:43 +, Stroller wrote:
   So when he fucks things up good royal and proper, will he gladly
   accept his
   shafting and pay you more to undo it? Or will he do the usual
   customer stunt
   and blame you?
 
  My typical experience is that the customer will take it completely on
  the chin and pay me to fix the problems. That doesn't make foul-ups
  due to such unnecessary meddling any less frustrating, though.
 
 Why not use sudo to give the customer's account almost full root access?
 Not only does this allow you to restrict which damaging commands he can
 run but sudo logs each command it runs, so you have CYA insurance.

Double CYA insurance:

Send all logs to a remote syslog server. The user with sudo permissions can 
still disable logging, but you have untouchable evidence that he did :-)
 

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] Blocking login attempts to sshd and vsftpd

2009-11-15 Thread KH

Richard Marza schrieb:
I recently check my log files and discovered that there was a dictionary 
attack attempt on my daemons. sshd and vsftpd were the primary targets. 
Is there a script or tool to block the offending IP addresses using 
iptables. Something that checks to see if a minimum of attempts has 
occured and blocks them indefinitely based on that?



Regards,
 Richard M.



Hi,

I am using that script:
http://blinkeye.ch/dokuwiki/doku.php/projects/blacklist

kh



Re: [gentoo-user] strange cron messages...

2009-11-15 Thread Mick
On Saturday 14 November 2009 16:53:24 Alex Schuster wrote:
 Jarry writes:
  Hi, I'm getting strange mails from vixie-cron-4.1-r10:
  --
  SUBJECT: Cron r...@obelix test -x /usr/sbin/run-crons 
  /usr/sbin/run-crons
 
  error: kernel:9 unknown option 'compytruncate' -- ignoring line
  error: kernel:12 unknown option 'endscript' -- ignoring line
  --
 
  What does it mean???
 
 I assume you are using logrotate, and have the /etc/logrotate.d/kernel
 file? I guess the 'compytruncate' is misspelled and should be
 'copytruncate'. And 'endscript' is used after using 'prerotate' or
 'postrotate', which you probably do not have.
 
 Something like that, I never used logrotate by myself. See the man page
 for more information.

Hmm ... how do you keep your log files under control?
-- 
Regards,
Mick


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-user] install nvidia driver and virtualbox for two kernels

2009-11-15 Thread Zhang Jun
great, thanks !

2009/11/15 Alan McKinnon alan.mckin...@gmail.com:
 On Sunday 15 November 2009 04:06:27 Zhang Jun wrote:
 Hi list,

 I want to keep two kernels in my pc, but have some problems on video
 card driver and vbox:

 pc ~ # cd /lib/modules/
 pc modules # ls
 2.6.28-tuxonice-r10-tuxonice  2.6.30-tuxonice-r6
 pc modules # uname -r
 2.6.28-tuxonice-r10-tuxonice
 pc modules # eix -I nvidia
 [I] x11-drivers/nvidia-drivers
  Available versions:  71.86.09!s ~71.86.11!s 96.43.13!s
 173.14.20!s ~173.14.20-r1!s 180.60!s ~185.18.36!s ~185.18.36-r1!s
 ~190.29!s ~190.42-r2!s ~190.42-r3!s {acpi custom-cflags gtk
 kernel_FreeBSD kernel_linux multilib userland_BSD}
  Installed versions:  180.60!s(21时18分12秒 2009年08月16日)(acpi
 kernel_linux -custom-cflags -gtk -multilib)

 ### and I want to install nv driver for another kernel by hand (not emerge)

 pc modules # sh
 /usr/portage/distfiles/NVIDIA-Linux-x86-180.60-pkg0.run -a -K -k
 2.6.30-tuxonice-r6
 Verifying archive integrity... OK
 Uncompressing NVIDIA Accelerated Graphics Driver for Linux-x86
 180.60.
 ...

  ERROR: No NVIDIA driver is currently installed; the
 '--kernel-module-only' option can only be used to install the NVIDIA
 kernel module on
   top of an existing driver installation.




 the same problem will be in virtaulbox-modules, though I have not tested.


 how can I install nv driver and vbox-modules for two kernels ?
 thanks!


 Why are you trying to do it by hand? Just use emerge and let portage take care
 of all the housekeeping for you:

 - emerge module-rebuild
 - run module-rebuild populate

 - point /usr/src/linux at the source for the kernel you want to build for
 - run module-rebuild rebuild
 - repeat for each kernel

 The ebuild/driver package is smart enough to install kernel modules in the
 correct directory in /lib/modules/ when you do it this way/

 --
 alan dot mckinnon at gmail dot com





[gentoo-user] Re: Gentoo for many servers

2009-11-15 Thread Andreas Niederl
Alex Schuster wrote:
 Alan McKinnon wrote:
 
 clusterssh will let you log into many machines at once and run emerge
  -avuND world everywhere
 
 This is way cool. I just started using it on eight Fedora servers I am 
 administrating. Nice, now this is an improvement over my 'for $h in 
 $HOSTS; do ssh $h yum install foo; done' approach.

You could have a look at app-admin/puppet [1][2] which supposedly takes
car of these things.


[...]
 Now I am thinking about a Gentoo installation instead.
 
 Pros:
  - Continuous updates, no downtime for upgrading, only when I decide to 
 install a new kernel. This is really really cool. I fear the upgrade from 
 Fedora 10 to 12 which has to be done soon.

  - Some improvement in speed. Those machines do A LOT of numbercrunching, 
 which jobs often lasting for days, so even small improvements would be 
 nice.
  - Easier debugging. When things do not work, I think it's easier to dig 
 into the problem. No fancy, but sometimes buggy GUIs hiding basic 
 functionality.

These two things would probably be your best selling points for your idea.


  - Heck, Gentoo is _cooler_ than typical distributions. And emerging with 
 distcc on about 8*4 cores would be fun :)

Being 'cool' doesn't count, at least last time I looked.


  - I am probably the only one who can administrate them.

That is a huge disadvantage.


 Cons:
  - If something will not work with this not so common (meta)distribution, 
 people will say always trouble with your Gentoo Schmentoo, it works fine 
 in Fedora. Fedora is more mainstream, if something does not work there, 
 then it's okay for the people to accept it.
  - I fear that big packages like Matlab are made for and tested on the 
 typical distributions, and may have problems with the not-so-common 
 Gentoo. I think someone here just had such a problem with Mathematica 
 (which we do currently not use).
[...]

If you're using commercial software which is only supported by Redhat,
Novell, etc. then you should think twice about replacing it.

But I'm guessing that those packages don't have to be installed on every
machine.
So, I'd suggest that you use Gentoo on those boxes where you'd have the
biggest advantage using it and no or minimal disadvantages.


  - I am probably the only one who can administrate them. I think Gentoo is 
 easier to maintain in the long run, but only when you take the time to 
 learn it. With Fedora, you do not need much more than the 'yum install' 
 command. There is no need to read complicated X.org upgrade guides and 
 such.
[...]

Please do your colleagues and successors a favor and document your whole
setup really good.


Regards,
Andi

[1] http://reductivelabs.com/products/puppet/
[2] http://log.onthebrink.de/2008/05/using-puppet-on-gentoo.html



Re: [gentoo-user] Block root user from login on xorg GUI

2009-11-15 Thread Stroller


On 15 Nov 2009, at 08:26, Alan McKinnon wrote:

...
My typical experience is that the customer will take it completely on
the chin and pay me to fix the problems. That doesn't make foul-ups
due to such unnecessary meddling any less frustrating, though.


My experience has been completely the opposite, same with just about  
everyone
else I work with. But, this is a third-world country pretending to  
be a first-

world country, and the cowboy attitude is very prevalent here.


I certainly have had some customers like that, but generally they're a  
minority here. Definitely preferable is to spot them early and _follow  
your instinct_ to  ditch them. The longer you entertain this rubbish  
the more of a headache it becomes.



One has to hope, really, that the client only wants the root password
as insurance in case you get run over by a bus, and won't use it to
arbitrarily mess about on the system.


I find the root password in a sealed envelope in the safe is the ideal
insurance for that.


Totally agree.

My biggest customer, unfortunately, has taken on a large investment of  
capital recently, resulting in a new director who's really pretty  
clueless. Basically, his dad bought him a job. He has insisted on  
Domain Administrator rights because he just wants to do the simple  
stuff himself; the first program he wanted to upgrade he needed my  
help with because the installer is a piece of junk. I know that he's  
going to mess things up and cost himself more money (create more  
hassles for me) in the long term, but he won't hear it and I can't  
just walk away; this is not only because I have a great relationship  
with the other owner and also because they're currently a significant  
proportion of my annual income.


He's totally a nice bloke otherwise, he just feels that I shouldn't be  
locking him out of his own computers, and I can kinda see his point  
- as an admin it's easy for me to feel territorial because I'm  
pretty good at the job, so the chances are that anyone else isn't  
going to meet my standard. Obviously it's important for me to put that  
to one side.


So when he fucks things up good royal and proper, will he gladly  
accept his shafting and pay you more to undo it? Or will he do the  
usualcustomer stuntand blame you?


This is actually much easier for those of us who are mere  
consultants and who charge by the hour - we can simply reply it was  
working when i left, guv. If it's been working fine for months then  
there is obviously nothing wrong with our previous work. Clearly there  
is room for contention if they muck about with things right after  
you've left.


Stroller.



Re: [gentoo-user] Blocking login attempts to sshd and vsftpd

2009-11-15 Thread Richard Marza


- Original Message - 
From: KH gentoo-u...@konstantinhansen.de

To: gentoo-user@lists.gentoo.org
Sent: Sunday, November 15, 2009 6:22 AM
Subject: Re: [gentoo-user] Blocking login attempts to sshd and vsftpd



Richard Marza schrieb:

I recently check my log files and discovered that there was a dictionary
attack attempt on my daemons. sshd and vsftpd were the primary targets.
Is there a script or tool to block the offending IP addresses using
iptables. Something that checks to see if a minimum of attempts has
occured and blocks them indefinitely based on that?


Regards,
 Richard M.



Hi,

I am using that script:
http://blinkeye.ch/dokuwiki/doku.php/projects/blacklist

kh




This is perfect and more straight-forward than the alternatives. I'm 
surprised this isn't one of the most mentioned or talked about in the 
threads. Thank you all.





Re: [gentoo-user] Block root user from login on xorg GUI

2009-11-15 Thread Neil Bothwick
On Sun, 15 Nov 2009 12:52:41 +0200, Alan McKinnon wrote:

  Why not use sudo to give the customer's account almost full root
  access? Not only does this allow you to restrict which damaging
  commands he can run but sudo logs each command it runs, so you have
  CYA insurance.  
 
 Double CYA insurance:
 
 Send all logs to a remote syslog server. The user with sudo permissions
 can still disable logging, but you have untouchable evidence that he
 did :-) 

That's one approach. The other is to give sudo access only for what he
needs, which doesn't include disabling logging or many other things.


-- 
Neil Bothwick

Top Oxymorons Number 39: Almost exactly


signature.asc
Description: PGP signature


Re: [gentoo-user] openwatcom ebuild question

2009-11-15 Thread David Relson
On Sun, 15 Nov 2009 10:29:12 +0200
Alan McKinnon wrote:

 On Sunday 15 November 2009 06:07:59 David Relson wrote:
  The lack of 64-bit buildability for openwatcom is a whole 'nother
  subject and I'm in communication with the developer about it.
  
 
 Is this the very famous watcom compiler that's been around longer
 than MS-DOS and eventually ended up being owned by Sybase?

You are correct -- though lacking the Sybase released it to the open
source world detail. 



Re: [gentoo-user] ~amd64 : X11 (?) crashing

2009-11-15 Thread Stefan G. Weichinger
Daniel Troeder schrieb:

 I might have a similar problem, that is definitely related to the second
 monitor and power management. If you disconnect your 2nd monitor, do the
 crashes still occur? But maybe this isn't related, because I have a
 Radeon card... just a lucky guess...

I could try with one monitor only, yes. Thanks for the hint, I'll give
it a try asap.



Re: [gentoo-user] ~amd64 : X11 (?) crashing

2009-11-15 Thread Stefan G. Weichinger
Alan McKinnon schrieb:

 Sometimes my gnome-session (2.28) works for hours, sometimes for minutes.
 
 What happens when X crashes? Does the X session go away? Is there an error 
 message? Or does it just hang?

The whole X-session restarts, as if I do xdm restart or
ctrl-alt-backspace. I get back to the login-prompt of gdm.

No error message, I also browsed the xorg-logs, dmesg, /var/log/messages
... nothing related as far as I understand.

 Your symptoms as described are random, I find far more often than not that is 
 hardware, usually the power supply, ram and video card (in that order)
 
 Give your hardware a thorough stress test, then only start playing with 
 downgrades

Hmm, I don't know ... why should a hardware-problem only shoot X11 ... ?
It should crash then also when I dualboot windows xp for gaming (it does
not crash there even under quite high gaming load).

OK, RAM might do that, I had a customers pc which rebooted (! reboot,
not only kicking off one app) here and then because of defective RAM.

I start some memtest while having my coffee just to check that out for a
start.

But I really assume some other reason, as I only recently went up to
~amd64 ... for me it is much more likely that maybe the step up to
xorg-server 1.7.x or something related might be the reason here.
bugs.gentoo.org didn't really list such a bug, maybe I should file one.
But to me it seems a bit early as I can't reproduce it or really show
some error-messages so far.

Greets, Stefan



[gentoo-user] Re: Block root user from login on xorg GUI

2009-11-15 Thread Nikos Chantziaras

On 11/15/2009 11:22 AM, Dirk Heinrichs wrote:


SELinux allows to spread the tasks root needs to do or can do accross several
roles. Of course, if only one single person has root access to the system this
doesn't make sense. But we're talking about cases where several people (incl.
the malicious attacker) have root access. So you can very well configure a
(SE-)Linux system so that root can't do everything.


So how do you get your machine back if you forbid yourself to change its 
configuration then?





Re: [gentoo-user] ~amd64 : X11 (?) crashing

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 15:54:39 Stefan G. Weichinger wrote:
 Alan McKinnon schrieb:
  Sometimes my gnome-session (2.28) works for hours, sometimes for
  minutes.
 
  What happens when X crashes? Does the X session go away? Is there an
  error message? Or does it just hang?
 
 The whole X-session restarts, as if I do xdm restart or
 ctrl-alt-backspace. I get back to the login-prompt of gdm.
 
 No error message, I also browsed the xorg-logs, dmesg, /var/log/messages
 ... nothing related as far as I understand.
 
  Your symptoms as described are random, I find far more often than not
  that is hardware, usually the power supply, ram and video card (in that
  order)
 
  Give your hardware a thorough stress test, then only start playing with
  downgrades
 
 Hmm, I don't know ... why should a hardware-problem only shoot X11 ... ?
 It should crash then also when I dualboot windows xp for gaming (it does
 not crash there even under quite high gaming load).
 
 OK, RAM might do that, I had a customers pc which rebooted (! reboot,
 not only kicking off one app) here and then because of defective RAM.
 
 I start some memtest while having my coffee just to check that out for a
 start.
 
 But I really assume some other reason, as I only recently went up to
 ~amd64 ... for me it is much more likely that maybe the step up to
 xorg-server 1.7.x or something related might be the reason here.
 bugs.gentoo.org didn't really list such a bug, maybe I should file one.
 But to me it seems a bit early as I can't reproduce it or really show
 some error-messages so far.

I still think a hardware stress test will be useful. The least that will 
happen is you will verify your hardware is probably OK.

If it is software, then you have a long road ahead of you debugging it. With 
no error messages of any kind you will likely have to rebuild in debug mode 
and provide the devs with a backtrace. In which case it's probably easier to 
downgrade to versions you know work.

I can attest to xorg-server-1.7.1 working just fine here with latest nvidia-
drivers in the tree on amd64

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] openwatcom ebuild question

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 15:44:16 David Relson wrote:
 On Sun, 15 Nov 2009 10:29:12 +0200
 
 Alan McKinnon wrote:
  On Sunday 15 November 2009 06:07:59 David Relson wrote:
   The lack of 64-bit buildability for openwatcom is a whole 'nother
   subject and I'm in communication with the developer about it.
 
  Is this the very famous watcom compiler that's been around longer
  than MS-DOS and eventually ended up being owned by Sybase?
 
 You are correct -- though lacking the Sybase released it to the open
 source world detail.

Sybase actually release the source to something? Surely you jest?

I used to work for the local Sybase reseller. I would not have thought 
management would ever have open-sourced anything.

Well, well, whaddayaknow. Miracles do happen.

watcom was a very nice compiler back in the day. I remember it trashing the 
pants off anything else in the market (this was in the DOS-3.x era)


-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] Block root user from login on xorg GUI

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 14:47:14 Stroller wrote:
  I find the root password in a sealed envelope in the safe is the ideal
  insurance for that.
 
 Totally agree.
 
 My biggest customer, unfortunately, has taken on a large investment of  
 capital recently, resulting in a new director who's really pretty  
 clueless. Basically, his dad bought him a job. He has insisted on  
 Domain Administrator rights because he just wants to do the simple  
 stuff himself; the first program he wanted to upgrade he needed my  
 help with because the installer is a piece of junk. I know that he's  
 going to mess things up and cost himself more money (create more  
 hassles for me) in the long term, but he won't hear it and I can't  
 just walk away; this is not only because I have a great relationship  
 with the other owner and also because they're currently a significant  
 proportion of my annual income.
 

And you think being a Company Director carries any weight at all?

Tut, tut, young fellow. You have a lot to learn :-)

Tell him you will give him administrator rights if, and only if, he can 
successfully solve a problem you set up. Make it something fair ( you are not 
unreasonable after all).

If he fails at this, then you reduce his rights so that he can do the mundane 
stuff which apparently is what he wants to be doing.

The most useful skill I ever learned in all of technology was how to tell 
someone straight up and down that they don't know much, without actually 
offending them.

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] openwatcom ebuild question

2009-11-15 Thread David Relson
On Sun, 15 Nov 2009 17:06:27 +0200
Alan McKinnon wrote:

 On Sunday 15 November 2009 15:44:16 David Relson wrote:
  On Sun, 15 Nov 2009 10:29:12 +0200
  
  Alan McKinnon wrote:
   On Sunday 15 November 2009 06:07:59 David Relson wrote:
The lack of 64-bit buildability for openwatcom is a whole
'nother subject and I'm in communication with the developer
about it.
  
   Is this the very famous watcom compiler that's been around longer
   than MS-DOS and eventually ended up being owned by Sybase?
  
  You are correct -- though lacking the Sybase released it to the
  open source world detail.
 
 Sybase actually release the source to something? Surely you jest?
 
 I used to work for the local Sybase reseller. I would not have
 thought management would ever have open-sourced anything.
 
 Well, well, whaddayaknow. Miracles do happen.
 
 watcom was a very nice compiler back in the day. I remember it
 trashing the pants off anything else in the market (this was in the
 DOS-3.x era)

For more on Watcom C's history, including the Sybase release as open
source, see http://www.openwatcom.org/index.php/History

I used Watcom C quite a bit in the mid '90s to develop a bookkeepping
program for Michigan Bingo games, and even made some spending money
off of the project :-  

At that time, my host operating system was 32-bit OS/2 and the target
was 16-bit DOS.  Watcom worked like a champion for me!



Re: [gentoo-user] ~amd64 : X11 (?) crashing

2009-11-15 Thread Stefan G. Weichinger
Alan McKinnon schrieb:

 I still think a hardware stress test will be useful. The least that will 
 happen is you will verify your hardware is probably OK.

hmm, yes. What do you suggest? I ran memtest for 2 passes now without an
error. Maybe I will game a bit this evening, this should stress the
graphics, cpu, ram quite a bit as well ...

 If it is software, then you have a long road ahead of you debugging it. With 
 no error messages of any kind you will likely have to rebuild in debug mode 
 and provide the devs with a backtrace. In which case it's probably easier to 
 downgrade to versions you know work.
 
 I can attest to xorg-server-1.7.1 working just fine here with latest nvidia-
 drivers in the tree on amd64

Just to compare:

xorg-server:1.7.1
nvidia-drivers: 190.42-r3

compiz: 0.8.4
compiz-fusion:  0.8.4

(hmm, I assume I don't need them both?)

emerald:0.8.4

gnome 2.28 ... ~amd64 everything ...

Linux version 2.6.31-tuxonice (gcc version 4.4.2 (Gentoo 4.4.2 p1.0) )



hmmm.

Greets, Stefan



Re: [gentoo-user] Re: Block root user from login on xorg GUI

2009-11-15 Thread Alan McKinnon
On Sunday 15 November 2009 16:40:48 Nikos Chantziaras wrote:
 On 11/15/2009 11:22 AM, Dirk Heinrichs wrote:
  SELinux allows to spread the tasks root needs to do or can do accross
  several roles. Of course, if only one single person has root access to
  the system this doesn't make sense. But we're talking about cases where
  several people (incl. the malicious attacker) have root access. So you
  can very well configure a (SE-)Linux system so that root can't do
  everything.
 
 So how do you get your machine back if you forbid yourself to change its
 configuration then?


reboot|power down|pull power plug out|whatever and edit kernel config line to 
not laod selinux

-- 
alan dot mckinnon at gmail dot com



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Dale

Jacques Montier wrote:


No error with ldd /usr/bin/k3b

I give up..

Thanks again,

Best regards,

--
Jacques



  


See if you can emerge a different version, older or newer, and see if 
that helps.  I assume you have re-emerged the current version already as 
well.  I think I read earlier that you did.


Dale

:-) :-)



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Volker Armin Hemmann
On Sonntag 15 November 2009, Dale wrote:
 Jacques Montier wrote:
  No error with ldd /usr/bin/k3b
 
  I give up..
 
  Thanks again,
 
  Best regards,
 
  --
  Jacques
 
 See if you can emerge a different version, older or newer, and see if
 that helps.  I assume you have re-emerged the current version already as
 well.  I think I read earlier that you did.
 
 Dale
 
 :-) :-)
 

I suspect a missing useflag somewhere.



[gentoo-user] DPMI screen blanking on *TEXT CONSOLE*?

2009-11-15 Thread Walter Dnes
  There are two types of screen blanking.  One mode is fake, with the
lcd backlight being left on.  A black foreground is placed over top of
everything.  In X, there is a DPMI option to really power down the LCD
backlight.  What is the equivalant on a textmode console?

-- 
Walter Dnes waltd...@waltdnes.org



[gentoo-user] Re: Blocking login attempts to sshd and vsftpd

2009-11-15 Thread doki_pen
In gmane.linux.gentoo.user, you wrote:
 On Sunday 15 November 2009 08:21:55 Walter Dnes wrote:
 On Sat, Nov 14, 2009 at 07:07:28PM -0500, Richard Marza wrote
 
  Thank you for the information, I did find that denyhost and fail2ban in
  threads but there were issues with it not working properly. Some users
  created custom scripts to get the job done correctly.
 
   Have you considered not allowing password-based logins at all for ssh?
 Use RSA keys instead.  It's much easier, and much more secure.
  
 fail2ban and/or denyhosts is still very useful with key-only auth, even if 
 only to get the spam out of messages and into the iptables logs

I've hardened ssh by doing the following:

 * Only allow certain users to ssh
 * Not allowing passwd login, but only RSA
 * Switching ssh to a non-standard port

This has dramatically reduced the amount of attacks my box gets.  It's
down to about 2 attacks per year, which is good enough for me.  Another
trick I learned about, but haven't implemented is changing the version
string in sshd by patching the source.  Ssh vunarability attacks
actually check the version string, so if you change it to something
unique, the scripts won't even try to get into your box.



[gentoo-user] [OT] Dell XPS16 for Christmas?

2009-11-15 Thread Mick
I have been thinking of buying this laptop and was looking at the Gentoo Wiki 
which shows relatively good hardware compatibility, except for the radeon card 
which is now an older offering:

http://en.gentoo-wiki.com/wiki/Dell_Studio_XPS_16

The current spec on the UK Dell website shows 1GB ATI® Radeon™ HD 4670 (see 
below).

PROCESSOR:  Intel® Core™ i7 Processor 720QM (1.60Ghz, 6MB cache)
LCD:Black Leather back cover : 15.6 (inch) Truelife 1080p Full HD WLED 
Edge 
to Edge Display
MEMORY: 4096MB 1333MHz Dual Channel DDR3 SDRAM [2x2048]
HARD DRIVE: 500GB (7,200rpm) Free Fall Sensor Hard Drive
PRIMARY BATTERY:9-cell 85Whr Lithium Ion battery
OPTICAL DRIVE:  Internal Blu-Ray ROM (Blu-Ray read, DVD and CD read  Write) 
Optical Drive
GRAPHICS CARD:  1GB ATI® Radeon™ HD 4670 graphics card
WIRELESS CONNECTIVITY:  Dell Wireless 1397 Mini Card (802.11 b/g)
BLUETOOTH:  Dell Wireless 370 Bluetooth Module


According to these links the RadeonHD driver is experimental:
http://wiki.x.org/wiki/radeon
http://wiki.x.org/wiki/radeonhd%3Aexperimental_3D

Does anyone have experience with this driver, or better yet, this laptop?  
Shall I buy or shall I shy away from it?
-- 
Regards,
Mick


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Jacques Montier
Volker Armin Hemmann a gentiment tapote:
 On Sonntag 15 November 2009, Dale wrote:
 Jacques Montier wrote:
 No error with ldd /usr/bin/k3b

 I give up..

 Thanks again,

 Best regards,

 --
 Jacques
 See if you can emerge a different version, older or newer, and see if
 that helps.  I assume you have re-emerged the current version already as
 well.  I think I read earlier that you did.

 Dale

 :-) :-)

 
 I suspect a missing useflag somewhere.
 
 

My k3b useflag :

Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
-sndfile -sox -taglib -vcd)

 --
Jacques



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Jacques Montier
Dale a gentiment tapote:
 Jacques Montier wrote:

 No error with ldd /usr/bin/k3b

 I give up..

 Thanks again,

 Best regards,

 -- 
 Jacques



   
 
 See if you can emerge a different version, older or newer, and see if
 that helps.  I assume you have re-emerged the current version already as
 well.  I think I read earlier that you did.
 
 Dale
 
 :-) :-)
 
 

Yes i did re-emerged the current version.
I'll try the old one.

--
Jacques




Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Volker Armin Hemmann
On Sonntag 15 November 2009, Jacques Montier wrote:
 Volker Armin Hemmann a gentiment tapote:
  On Sonntag 15 November 2009, Dale wrote:
  Jacques Montier wrote:
  No error with ldd /usr/bin/k3b
 
  I give up..
 
  Thanks again,
 
  Best regards,
 
  --
  Jacques
 
  See if you can emerge a different version, older or newer, and see if
  that helps.  I assume you have re-emerged the current version already as
  well.  I think I read earlier that you did.
 
  Dale
 
  :-) :-)
 
  I suspect a missing useflag somewhere.
 
 My k3b useflag :
 
 Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
 ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
 -sndfile -sox -taglib -vcd)
 
  --
 Jacques
 

more like kdelibs useflags missing. Since games have missing icons too.



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Jacques Montier
Volker Armin Hemmann a gentiment tapote:

 I suspect a missing useflag somewhere.
 My k3b useflag :

 Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
 ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
 -sndfile -sox -taglib -vcd)

  --
 Jacques

 
 more like kdelibs useflags missing. Since games have missing icons too.
 
 

kdelibs-4.3.1-r2 useflags :

4.3.1-r2(4.3)!t(11:08:17 04/11/2009)(acl alsa bzip2 fam handbook nls
opengl semantic-desktop spell ssl -3dnow -altivec -aqua -bindist -debug
-doc -jpeg2k -kdeprefix -kerberos -mmx -openexr -sse -sse2 -test -zeroconf)

I also have kdelibs-3.5.10-r6 installed which is needed by
sci-astronomy/celestia.


--
Jacques




Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Volker Armin Hemmann
On Sonntag 15 November 2009, Jacques Montier wrote:
 Volker Armin Hemmann a gentiment tapote:
  I suspect a missing useflag somewhere.
 
  My k3b useflag :
 
  Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
  ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
  -sndfile -sox -taglib -vcd)
 
   --
  Jacques
 
  more like kdelibs useflags missing. Since games have missing icons too.
 
 kdelibs-4.3.1-r2 useflags :
 
 4.3.1-r2(4.3)!t(11:08:17 04/11/2009)(acl alsa bzip2 fam handbook nls
 opengl semantic-desktop spell ssl -3dnow -altivec -aqua -bindist -debug
 -doc -jpeg2k -kdeprefix -kerberos -mmx -openexr -sse -sse2 -test -zeroconf)
 
 I also have kdelibs-3.5.10-r6 installed which is needed by
 sci-astronomy/celestia.
 
 
 --
 Jacques
 

could you post all your useflags?



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Jacques Montier
Volker Armin Hemmann a gentiment tapote:
 On Sonntag 15 November 2009, Jacques Montier wrote:
 Volker Armin Hemmann a gentiment tapote:
 I suspect a missing useflag somewhere.
 My k3b useflag :

 Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
 ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
 -sndfile -sox -taglib -vcd)

  --
 Jacques
 more like kdelibs useflags missing. Since games have missing icons too.
 kdelibs-4.3.1-r2 useflags :

 4.3.1-r2(4.3)!t(11:08:17 04/11/2009)(acl alsa bzip2 fam handbook nls
 opengl semantic-desktop spell ssl -3dnow -altivec -aqua -bindist -debug
 -doc -jpeg2k -kdeprefix -kerberos -mmx -openexr -sse -sse2 -test -zeroconf)

 I also have kdelibs-3.5.10-r6 installed which is needed by
 sci-astronomy/celestia.


 --
 Jacques

 
 could you post all your useflags?
 
 
In /etc/make.conf : USE=gtk2 hal java oggvorbis pic qt svga tcltk -arts
-gnome -ipv6
and my profile : /usr/portage/profiles/default/linux/x86/10.0/desktop


--
Jacques



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Volker Armin Hemmann
On Sonntag 15 November 2009, Jacques Montier wrote:
 Volker Armin Hemmann a gentiment tapote:
  On Sonntag 15 November 2009, Jacques Montier wrote:
  Volker Armin Hemmann a gentiment tapote:
  I suspect a missing useflag somewhere.
 
  My k3b useflag :
 
  Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
  ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
  -sndfile -sox -taglib -vcd)
 
   --
  Jacques
 
  more like kdelibs useflags missing. Since games have missing icons too.
 
  kdelibs-4.3.1-r2 useflags :
 
  4.3.1-r2(4.3)!t(11:08:17 04/11/2009)(acl alsa bzip2 fam handbook nls
  opengl semantic-desktop spell ssl -3dnow -altivec -aqua -bindist -debug
  -doc -jpeg2k -kdeprefix -kerberos -mmx -openexr -sse -sse2 -test
  -zeroconf)
 
  I also have kdelibs-3.5.10-r6 installed which is needed by
  sci-astronomy/celestia.
 
 
  --
  Jacques
 
  could you post all your useflags?
 
 In /etc/make.conf : USE=gtk2 hal java oggvorbis pic qt svga tcltk -arts
 -gnome -ipv6
 and my profile : /usr/portage/profiles/default/linux/x86/10.0/desktop
 
 
 --
 Jacques
 

emerge --info useflag list would have been much more usefull ;)



Re: [gentoo-user] DPMI screen blanking on *TEXT CONSOLE*?

2009-11-15 Thread Johám-Luís Miguéns Vila
Walter Dnes waltd...@waltdnes.org writes:

   There are two types of screen blanking.  One mode is fake, with the
 lcd backlight being left on.  A black foreground is placed over top of
 everything.  In X, there is a DPMI option to really power down the LCD
 backlight.  What is the equivalant on a textmode console?

Hope you'll find relevant information at man setterm.

Cheers
-- 
Happiness is the greatest good.
 - This message may be digitally signed: GPG KeyID:0x9D2FD6C8 || FNMT SSL cert



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Dale

Jacques Montier wrote:

Volker Armin Hemmann a gentiment tapote:

  

I suspect a missing useflag somewhere.


My k3b useflag :

Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
-sndfile -sox -taglib -vcd)

 --
Jacques

  

more like kdelibs useflags missing. Since games have missing icons too.





kdelibs-4.3.1-r2 useflags :

4.3.1-r2(4.3)!t(11:08:17 04/11/2009)(acl alsa bzip2 fam handbook nls
opengl semantic-desktop spell ssl -3dnow -altivec -aqua -bindist -debug
-doc -jpeg2k -kdeprefix -kerberos -mmx -openexr -sse -sse2 -test -zeroconf)

I also have kdelibs-3.5.10-r6 installed which is needed by
sci-astronomy/celestia.


--
Jacques


  


Could it be jpeg2k that is missing?  Looks like the only thing image 
related to me.  Mine is enabled here.


Dale

:-)  :-) 



Re: [gentoo-user] Missing icons in K3b

2009-11-15 Thread Dale

Volker Armin Hemmann wrote:

On Sonntag 15 November 2009, Jacques Montier wrote:
  

Volker Armin Hemmann a gentiment tapote:


On Sonntag 15 November 2009, Jacques Montier wrote:
  

Volker Armin Hemmann a gentiment tapote:


I suspect a missing useflag somewhere.
  

My k3b useflag :

Installed versions:  1.68.0_alpha3(4)(02:54:09 14/11/2009)(dvd encode
ffmpeg flac mad vorbis wav -aqua -debug -emovix -lame -musicbrainz
-sndfile -sox -taglib -vcd)

 --
Jacques


more like kdelibs useflags missing. Since games have missing icons too.
  

kdelibs-4.3.1-r2 useflags :

4.3.1-r2(4.3)!t(11:08:17 04/11/2009)(acl alsa bzip2 fam handbook nls
opengl semantic-desktop spell ssl -3dnow -altivec -aqua -bindist -debug
-doc -jpeg2k -kdeprefix -kerberos -mmx -openexr -sse -sse2 -test
-zeroconf)

I also have kdelibs-3.5.10-r6 installed which is needed by
sci-astronomy/celestia.


--
Jacques


could you post all your useflags?
  

In /etc/make.conf : USE=gtk2 hal java oggvorbis pic qt svga tcltk -arts
-gnome -ipv6
and my profile : /usr/portage/profiles/default/linux/x86/10.0/desktop


--
Jacques




emerge --info useflag list would have been much more usefull ;)


  


The output of this is good too.

emerge --info | grep USE

I don't think we need the whole thing.  Then again, we may.

Dale

:-)  :-) 



Re: [gentoo-user] need sound to listen to a adobe flash video

2009-11-15 Thread Valmor de Almeida
James Ausmus wrote:
 
 
[snip]
 
 First off - do you have PulseAudio running? If so, for HW/ALSA testing
 purposes, shut it down. Second, check your mixer settings to determine

No I don't have it installed.

 if your volume levels are appropriate. A great quick CLI app for this is
 alsamixer (media-sound/alsa-utils) - first start the alsasound service
 (sudo /etc/init.d/alsasound start), then run alsamixer - set your
 volumes to about 80%, and unmute all channels (use the 'm' key to toggle
 mute), then restart the alsasound service to save your volume levels
 (sudo /etc/init.d/alsasound restart), then add the alsasound service to
 your boot runlevel (sudo rc-update add alsasound boot). This will set it
 up to restore these volume levels on every startup (it will also save
 your *current* volume levels on every shutdown, so don't mute, shutdown,
 and expect to be unmuted after starting back up).
 

Followed all steps after emerging alsa-utils

 Now, double-check that PulseAudio is not running (ps -elf | grep -i
 pulse), and kill it if it is.
 
 Then run:
 
 aplay /usr/share/sounds/alsa/Front_Center.wav

Tried this instead

-  aplay /usr/lib/mozilla-thunderbird/res/samples/test.wav
ALSA lib confmisc.c:768:(parse_card) cannot find card '0'
ALSA lib conf.c:3513:(_snd_config_evaluate) function
snd_func_card_driver returned error: No such file or directory
ALSA lib confmisc.c:392:(snd_func_concat) error evaluating strings
ALSA lib conf.c:3513:(_snd_config_evaluate) function snd_func_concat
returned error: No such file or directory
ALSA lib confmisc.c:1251:(snd_func_refer) error evaluating name
ALSA lib conf.c:3513:(_snd_config_evaluate) function snd_func_refer
returned error: No such file or directory
ALSA lib conf.c:3985:(snd_config_expand) Evaluate error: No such file or
directory
ALSA lib pcm.c:2211:(snd_pcm_open_noupdate) Unknown PCM default
aplay: main:608: audio open error: No such file or directory


 
 If you hear sound - great, ALSA and your sound HW are working, and Flash

No sound yet.

 audio will almost certainly start magically working. If not, please post
 the output of:
 
 aplay -l
 aplay -L
 

- aplay -l
 List of PLAYBACK Hardware Devices 
card 0: Intel [HDA Intel], device 0: STAC92xx Analog [STAC92xx Analog]
  Subdevices: 1/1
  Subdevice #0: subdevice #0

- aplay -L
default:CARD=Intel
HDA Intel, STAC92xx Analog
Default Audio Device
front:CARD=Intel,DEV=0
HDA Intel, STAC92xx Analog
Front speakers
surround40:CARD=Intel,DEV=0
HDA Intel, STAC92xx Analog
4.0 Surround output to Front and Rear speakers
surround41:CARD=Intel,DEV=0
HDA Intel, STAC92xx Analog
4.1 Surround output to Front, Rear and Subwoofer speakers
surround50:CARD=Intel,DEV=0
HDA Intel, STAC92xx Analog
5.0 Surround output to Front, Center and Rear speakers
surround51:CARD=Intel,DEV=0
HDA Intel, STAC92xx Analog
5.1 Surround output to Front, Center, Rear and Subwoofer speakers
surround71:CARD=Intel,DEV=0
HDA Intel, STAC92xx Analog
7.1 Surround output to Front, Center, Side, Rear and Woofer speakers
null
Discard all samples (playback) or generate zero samples (capture)


I am using hal-0.5.12_rc1-r8. Do I need to do any hal config?

Thanks for the help.

--
Valmor




Re: [gentoo-user] need sound to listen to a adobe flash video

2009-11-15 Thread Valmor de Almeida
Stroller wrote:

[snip]
 
 You haven't made it clear - in any of your subsequent posts, either -  
 if sound is working for other applications.

I have never configured sound. It has never worked.

 
 If you get a new email, does your laptop go bing!? Can you play an  
 MP3 by double clicking on it or at the command line? What if you run  
 mplayer at the command line on an AVI video?

No sound.

 
 If you have only previously used your laptop for email, surfing the  
 web or writing code, it's not clear that sound may *ever* have been  

Indeed this is the case and I am trying to get it to work since some
tutorials I need to listen to are only available on video with audio.

 working on it. IMO you need to get sound working for a basic program  
 that uses audio before worrying about Flash, which seems more  
 problematic.
 

Thanks,

--
Valmor

 Stroller.
 
 




Re: [gentoo-user] [solved] need sound to listen to a adobe flash video

2009-11-15 Thread Valmor de Almeida
Valmor de Almeida wrote:
 Stroller wrote:
 [snip]
 You haven't made it clear - in any of your subsequent posts, either -  
 if sound is working for other applications.
 
 I have never configured sound. It has never worked.
 
 If you get a new email, does your laptop go bing!? Can you play an  
 MP3 by double clicking on it or at the command line? What if you run  
 mplayer at the command line on an AVI video?
 
 No sound.
 
 If you have only previously used your laptop for email, surfing the  
 web or writing code, it's not clear that sound may *ever* have been  
 
 Indeed this is the case and I am trying to get it to work since some
 tutorials I need to listen to are only available on video with audio.
 
 working on it. IMO you need to get sound working for a basic program  
 that uses audio before worrying about Flash, which seems more  
 problematic.

 
 Thanks,
 
 --
 Valmor
 
 Stroller.


 
 
 After rebuilding the kernel with additional intel driver support and
adding users to the audio group, sound was enabled.

Thanks for the help.

--
Valmor