libera/#devuan/ Friday, 2024-07-12

systemdletefsmithred, gnarface,05:01
systemdleterwp,mason,fsmithred,gnarface05:01
systemdleteI finally figured it out05:02
systemdleteI had an incomplete ~/.bashrc in the D VM's home!05:02
systemdleteI totally overlooked what rwp said about bash design--that's exactly what I ran into I think05:02
systemdletethe "spec" (if you will) for non-interactive shells is SUPPOSED to inhibit setting variables in the user's .bashrc.  But, as we can see, I managed to do it anyway!05:03
systemdleteI see that as a potential security risk.  So ssh is "depending" on bash (and other shells) to follow their specs.  But since a shell like bash is allowing a (clumsy) user like me to inadvertently set variables, it could compromise ssh's scheme to limit manipulation of a remote environment.05:05
rwpDebian has a Debian specific patch that sources the ~/.bashrc over an ssh connection.  Maybe.  It's a little error prone which is one of the criticisms.05:05
systemdleteDecisions about whether to limit access to, say, variable settings should be controlled by ssh, or at very least, by bash itself05:06
systemdlete(IMO)05:06
systemdletesorry I did not carefully read your post hours ago.05:06
systemdletethen again, it probably didn't make much sense to me at that point, before poring through the various shell scripts05:06
rwpIt's the user shell and the user's login so I don't see any security ramifications out of it.  But the entire situation is a mess because Debian does it one way and Fedora does it a different way and BSDs different yet again.  It's a mess!05:07
rwpI have been wanting to write up a tutorial on the login process.  It would be useful.05:07
rwpAnd then another one on the X startup for the same reason.  It's another one of those confusing messes.05:07
systemdleteit's just that an admin might not be aware that a certain app running on their system was configured incorrectly like this.  If it runs for months or even years it might not be noticed...05:08
rwpHonestly sometimes when I don't have time to participate and I see the discussion of people trying to help but not understanding how things are supposed to work I am cringing and just have to avert my eyes and go, I don't have time to help, sorry.05:08
onefangDamn those apps that just keep running for years.05:08
* rwp snorts!05:09
systemdleteIf the admin creates a user and omits copying the user skeleton files (/etc/skel with the -s switch I think) and doesn't think too much about it05:09
rwpOne technique I often do is "echo command arg1 arg2 | ssh example.com /bin/sh" and then I know exactly what shell is going to be interpreting those commands.05:09
systemdleterwp: sorry, it is a bit of a learning curve.  I don't do an awful lot of shell programming, so I just wasn't aware of these things.  I don't think about them much.05:11
onefangI have a tendency to bash this, bash that, /bin/bash some other thing.  Not to bash the other shells.05:11
rwpIn a script I can feed the remote shell an entire script: ssh example.com /bin/sh <<\EOF and then include a here-doc with verbatim.05:11
systemdleteI tend to perl a lot myself.05:11
rwpCan't argue with that!05:11
systemdleteback in the early 80s, I was a ksh/awk maven.05:12
systemdletebut once I discovered perl, that was that.05:12
systemdleteperl made everything gobs easier.  (well, almost everything.)05:12
rwpWhat I like about perl is that they take backward compatibility very seriously.  I have perl scripts running from cron from years and many releases ago and they are still working perfectly with the currently updated perl.05:14
systemdletefor a while, php was the big thing (for web apps at least), and nowadays, it's all about python (which I hate).05:14
onefangWell off topic.  lol05:15
systemdleteyes, perl is genuine unix05:15
systemdleteright.05:15
systemdletethanks again, rwp et al for all your patience.05:15
rwpawk would be the same but though awk is a standard and perhaps I should use it more I find perl to be easier to develop in than awk by quite a bit and my awk skills have atrophied to virtually zero for programming.  I only ever use awk on the command line these days.05:15
systemdletesame here rwp!  same here05:15
rwpPatience?  I don't think I did anything!  It was the rest of the folks here who helped you as I read through the scroll back buffer.05:16
systemdleteyes, but had I taken your comment to heart much sooner it might have avoided that whole drama05:16
systemdletebesides, it is not every IRC channel that has so many helpful and willing folks.05:16
systemdleteI won't mention certain others.05:17
rwpDevuan got all of the moderates when they were pushed out of Debian.  Can't have this type of friendly discussion in Debian anymore.05:17
rwpWhen all of the moderates leave a community then only the extremists remain.05:18
systemdletewell, now both of my VMs shells, with and without ssh, are working identically.  So now I have a problem on both systems, but at least it is consistent.05:18
rwpWhat's the current issue?05:18
rwp...says me as I head up to the kitchen for a snack, but I will return in a few minutes...05:19
systemdleteOh, I have a solution actually.  It's just that those variables that were getting set on one but not the other are needed for what I am doing.  But ssh has a facility for it, so not really a problem.05:19
systemdleteI was just hoping to avoid it to limit maintenance.05:19
systemdleteIf you haven't noticed, I forget a lot of things too easily.  The fewer switches, dials, and levers, the better.05:20
systemdletefor me05:20
systemdleteand, yes, friendly and constructive convo is a blessing05:21
onefangThat's what scripting and documentation is for.  ./doThisComplexThing.sh05:21
systemdleteand why I am effusive with my gratitude.  not meaning to be sickly sweet about it, but just to acknowledge those folks who want to help05:22
systemdleteonefang, I have lots of those e-postit notes all over the place.  Trouble is, I can't remmeber where I left them.05:22
systemdleteI use a tool called elog for journaling and notes  these days.05:22
systemdleteI am also making more use of GoForIt! because it is SIMPLE to use and good enough for me05:23
onefangI'm having the same problem with the backups of the system I'm about to bring down permanently.  Gotta make sure the backups are good before I bring down that VM that has been up for 573 days.  The old backups are all over the place on my desktop, it has too much of everything.  lol05:24
systemdletebbs05:25
rwpI keep a lot of documentation files.  And then I grep for things to find the file I put that information in.05:32
XenguyI have a bunch of text files I've collected over the ages, and a bunch of examples in .bashrc (symbolic link to file 'b') that I grep when needed05:42
XenguyThe examples are commented lines that are grep'able05:43
fonkyhi all11:42
test02hello. have problem with networking on sysvinit. not startup on boot. how to fix that?15:40
cousin_luigitest02: Can you elaborate?15:49
cousin_luigitest02: If you are using ifupdown, there can be race conditions.15:50
test02cousin_luigi: yes ifupdown. how to fix that?16:00
cousin_luigitest02: I suppose one of the interfaces is coming up before a dependent one is. Can you tell us more about your setup?16:01
cousin_luigitest02: Either that or it's a sysv race condition. We need to know more.16:03
test02I using wifi connection.16:05
test02cousin_luigi: how to check that?16:05
cousin_luigitest02: How was the interface configured?16:07
buZzif you just entered wifi details during install, it'll not be managed, so wont retry when racecondition is lost16:10
buZzjust do a 'ifup wlan0' or whatever interface name you have after boot16:10
test02cousin_luigi: /etc/network/interfaces16:32
test02buZz: that working. but work make that automated?16:32
cousin_luigitest02: And do you invoke wpa_supplicant/iwd from there?16:32
asz09Hey guys, just wanted to share what happened. Not sure if anyone from yesterday is here but I had a problem with a crash on my power manager, some GUI options not working on the xfce pannel, pulseaudio not working neither, all this on a fresh daedalus install with sysvinit. I highly suspect that the cause behind all this was a change in the umask value in /etc/init.d/rc to 027. I then reinstalled devuan,18:26
asz09did all of my security/hardening tweaks as before but changed no umask values for this. It's likely that this was the root to all sort of issues I described. Probably I've  done it recklessly, and without much thinking or further configurations. But I thought it would be a good idea to share this with whoever is here, and to thank fsmithred for the help.18:26
gnarfacecheers, asz09, they'll see it18:27
asz09For further clarification, my theory is that it caused some conflict with polkit, as syslog logged a faillure in launching it.18:29
asz09oh, and thank you, gnarface! couldn't recall your nick lol18:29
gnarfacewell, good to know18:34
hightower2Are virtual consoles disabled in daedalus? I can't seem to switch to anything other than current console18:42
gnarfacei didn't think so, but i think you need ctrl+alt+FN rather than just alt+FN now18:42
hightower2according to inittab there should be 6, but go figure18:43
gnarfacetry ctrl+alt+F218:43
hightower2aah actually it's not that, but switching seems attached to a key which is not Ctrl in my case18:43
gnarfaceanother thing that changed is that X is usually on #1 now instead of #718:43
hightower2jezus..18:44
gnarfaceso if you try to ctrl+alt+F1 from a default install inside X nothing will happen18:44
hightower2linux is coming to an end, I tell you18:44
gnarfaceyea, lots of vandalism going on, though in this case it just seems to be a matter of them making something make more sense that originally didn't18:44
hightower2well I don't agree that I need to be pressing Ctrl, nor that in my case the key is not actually Ctrl but 1 key to the left of Control, nor that X is on 118:45
hightower2nor that they removed the shift+pg/up down functionality in consoles18:45
hightower2and the list goes on...18:45
HurgotronX is on F7 for me. But probably because I upgraded from Chimaera to Daedalus?18:45
gnarfaceHurgotron: i'm not sure what the variable there is, are you using NVidia drivers? i thought it was more about whether you're running X in root mode or not18:46
gnarface(as of daedalus, i think the NVidia drivers are the last ones that require it)18:46
Hurgotronno NVidia here18:46
gnarfacemine's an upgrade too, but i also switched from running xorg as root to running it as my user when i switched to AMD18:47
hightower2too many devs are paid by companies now and that's the problem18:48
gnarfaceprobably18:48
gnarfacenot just that they're paid by companies, but rather that they're literally paid by the competition18:49
gnarfaceso they have a vested interest in tearing us down to their level18:49
hightower2yeah... plus now that linux is widespread, they come to work with linux with no idea about user freedoms, and just do what they are told18:49
gnarfacethis is starting to get editorial though, we should take it to #devuan-offtopic18:49
hightower2ok, yeah, you're right, thanks for the hint on Ctrl18:50
gnarfacectrl+alt+F2 worked for you now?18:50
hightower2yes, but like I mentioned the key isn't actually Control but one to the left of it18:50
gnarfacehuh, odd18:50
Hurgotronhightower2: Thinkpad with funky key mapping?18:51
hightower2It's that Lenovo keyboard where they moved Ctrl to be 1  position to the right, and the leftmost key is Fn, yeah.... what Hurgotron says18:51
hightower2in the bios I didn't swap the keys, the Ctrl is not the leftmost key, but switching the console works with the leftmost one (Fn)18:51
HurgotronI have one here where I still have to figure aout some thinga about18:52
gnarfacehightower2: oh, i know what's happening. your F# keys are probably not enabled by default18:52
gnarfaceif you look at them there's gonna be two sets of silkscreens18:52
gnarfacethere might be a way to switch it back so the F# ones are the default mode and you don't have to use the Fn key18:53
hightower2ah yes, because I reset bios (and the Ctrl shift) and possibly other settings just minutes ago18:53
gnarfacei think i have to hold ctrl+alt because my WM captures alt+F#18:53
hightower2and I didn't recall everything that was changed18:53
hightower2good point, thanks18:53
gnarfaceno problem18:53
hightower2if that's true, then switching does still work with just alt18:53
gnarfaceyea, what happened is enlightenment now captures alt+F# for desktop switching, so i have to add another key in there to stop that18:54
gnarfacethat might have happened in other places too18:54
hightower2speaking of why I reset bios, is because I installed daedalus and uefi entry wasn't created properly for some reason. So I thought maybe it's bios settings, but then I realized the entry wasn't even created in boot menu (even though there was no error during install). So then finally I booted Finnix and manually created the boot entry with efibootmgr18:58
hightower2and I managed to boot into the new install after that18:59
rwpI have 6 vt consoles by default in Daedalus.  No problem switching between them.18:59
hightower2rwp, yes, I confirm18:59
rwpOn Thinkpad keyboards the Fn key is outboard to the left and Control is next in from it.  That's been a long standing complaint about Thinkpad keyboards.19:00
fsmithredI have to hold Func-ctrl-alt-F119:00
fsmithredon thinkpad19:01
rwpRight.  Because to activate F1 it must be Fn+F1 and to get Control-Alt-F1 that means Control-Alt-Fn+F1.19:01
fsmithredbecause the F-keys on that need the Function key. Consequently, I don't need the func key to change brightness19:01
hightower2for me on a thinkpad, with the said Fn and Control, I used bios options to switch the keys, and I enabled F* keys to be F keys rather than media keys, and at least in that combination, it works with just alt + f19:02
hightower219:02
hightower2Re. apt, I tried switching to https, but apt didn't like it because hostname didn't match. Is that because the mirror is set to deb.devuan.org which is not the real/specific hostname?19:02
fsmithredbut only on one of the thinkpads19:02
rwpHere is another point of trivia but it makes some things more convenient.  On the vt console switching vt consoles only requires the Alt key.  Alt-LeftArrow for left and Alt-RightArrow for right.  Can shift left and right without anything but the Alt and arrow keys.19:03
fsmithredif you're already in plain console, you don't need the ctrl key. Only on desktop.19:03
rwpRight!19:03
hightower2And right-Alt + f1-f12 switches consoles from 13 to 24 :-)19:03
hightower2although they are not configured in inittab by default :)19:04
fsmithred24? Yikes!19:04
rwpEvery vt console consumes a little bit of kernel memory.  Which most people don't use these days.  So a compromise default is set.  If you want 24 then you can have 24.  I normally use about 3 vt consoles when I am debugging something.19:04
hightower2and there was an Alt key to cycle between two last used consoles.. (somewhat like `cd -`). But I don't remember offhand what the key combo was for that19:05
rwpMost of my systems are headless and I have only plugged in a display and keyboard when they are not booting onto the network and then I have to get on the console to debug them.19:05
rwpThe X Desktop Managers and Window Managers mostly use Alt for window management functions so it was required to add Control to Alt-F1 in order to get control back from them.  But once on the vt the Control key is not required.  Initially it didn't even work!  But clearly muscle memory and confusion came in so they added Control to the keymap on the vt console.19:07
rwpI must have set that BIOS option here too because my multimedia keys give me Function Keys by default and I need Fn+Key to trigger the alternate function like brightness and volume control.19:09
joerg>> The  command  chvt N makes /dev/ttyN the foreground terminal.  (The corresponding screen is created if it did not exist yet.  To get rid of unused VTs, use deallocvt(1).)  The key combination (Ctrl-)LeftAlt-FN (with N in the range 1-12) usually has a similar effect.19:12
gnarfacehightower2: yes, https and the dns round-robin don't mix well19:22
systemdleteCurrently, I maintain a NFS shared where I put all the public keys I need access to.  But that is a bit clumsy and what I'd really like is what I will call (and maybe others also call) an "ssh key service"20:41
systemdleteI've been reading a lot about various solutions people have come up with, but so far none of them screams out to me "this is the solution"20:41
systemdleteand, I get it, not to make this rather simple issue into a mountain.  But if there is an existing solution, I would be open to it.20:43
systemdleteOne solution was a web site where you could copy-paste keys from its pages.  Others came up with similar approaches to mine, maybe using subdirectories on an NFS file system to publish keys.20:43
systemdleteDoes anyone have experience with something on these lines?20:44
systemdletesome people use git, bion20:47
systemdleteI've also looked at LDAP and something called LMDP (not sure if that is what I want though)20:48
systemdleteSo a user1 on systemA could "publish" their public key for some purpose to this service, and then user2 on systemB could easily retrieve it.  Pretty simple and nearly pointless need, but still...20:49
gnarfacei dunno, seems like a decent use case for a php script20:57
gnarfacemake sure you get the newlines right20:57
gnarfacethe primary issue i've had is windows fucks up the copy&paste of such things20:58
gnarface(maybe just having a download link with a forced non-text mime-type would be sufficient)20:58
gnarfacedoesn't have to be php, but it would be easy to overcomplicate too20:59
systemdletegnarface, do you (for one), see the usefulness of such an animal?20:59
systemdlete(whether web, or any other medium)20:59
fsmithredIs that so you can get your key to someone who doesn't have email?20:59
gnarfacesystemdlete: well it depends on the amount of users and their relative technical experience20:59
fsmithredand then they can set up a shell account for you on their system>?20:59
systemdleteI'm picturing the ability for a user to publish public keys to just certain others20:59
fsmithredor are you talking about gpg keys?20:59
systemdletessh keys21:00
fsmithredwhy?21:00
gnarfaceyea, usually i just used email in for ssh keys... i've even been in environments were the devs just made their email sig their public key21:00
systemdletesee above21:00
systemdletegnarface, sometimes users don't have their email set up.21:01
gnarfacecan one use a gpg keyserver for ssh keys?21:01
systemdletefor instance, if I want restic to be able to connect to a system to do backups on a schedule from some centralized server (not nec the best example, but illustrative)21:01
gnarfaceif tasked with it, i'd turn to a web script of some sort, but that's just because it's what i'm best at and i know i could secure it21:01
systemdleterestic is a non-login sort of user.  (I actualy do have logins set up for restic, but not email clients, etc)21:02
systemdleteyeah, I thought of adapting gpg server for ssh keys.  I suppose that could work.21:03
systemdleteMy hope was that someone else had already solved this with a simple, elegant solution and I could just install it and run with it.21:04
systemdleteJudging by the few hits I did get (after really drilling down a lot) it sounds like some people have already thought of this and have come up with a variety of responses, including some I mentioned above, as well as your idea of adapting gpg key server21:05
systemdleteAgain, this is not critical, and probably not much demand for such a thing.21:06
gnarfaceit wouldn't be a difficult task to make a web page for uploading and downloading these, as long as you didn't need it to be too fancy and you trusted all your users not to be trying to hack it21:07
fsmithreddropbox, google docs, something similar?21:07
systemdleteOne thing I did note is that, in many of the hits I got, there were strong recommendations of using one key pair for each client-service pair.  I think that is to avoid having to reset keys everywhere in the event of a breach or some other problem.21:07
fsmithredyes21:07
systemdletefsmithred, many people are using NFS, git, workgroups, and on and on.21:08
systemdletedropbox, mega (which I already have) and other possibilities.21:08
fsmithredI used to do a different key pair for each remote host, but then it was suggested to use a differnt key for each client machine that I use.21:08
systemdleteI might give this a go in my copious spare time (and that's not sarcasm; I really do have plenty of spare time!)21:08
systemdletefsmithred, that was def the suggestion21:09
systemdletelimit risk in all directions21:09
fsmithreddoesn't it make it easier for MTM attack?21:09
systemdletewhat does?21:10
fsmithredcan someone get the key and spoof the remote?21:10
fsmithredI guess they'd have to mess with your dns to get you there21:10
systemdletethat can happen under any circumstances, can't it?21:10
systemdletewell, yeah.21:10
fsmithredI guess. email isn't exactly secure21:10
systemdletewell, email is also kinda clumsy21:10
freemhttps://gist.github.com/mcattarinussi/834fc4b641ff4572018d0c665e5a94d3 "A setup guide to use a personal gpg key for ssh authentication"21:11
systemdleteand messages can be left in a user's inbox (or folders) where someone might happen upon them later on21:11
systemdleteooh, ooh, freem:  Just the kind of page I was looking for.  TY!21:11
freemhttps://duckduckgo.com/?kae=t&q=ssh+gpg+key&ia=web :)21:11
freemand yw21:12
freemthe interweb does have some neat stuff21:12
systemdleteI did a similar search, but I missed this one21:12
systemdletesomeone somewhere suggested something--idr now-- like "openapi" or a similar name21:13
freemyeah, the order, exact spelling and search engine are all important to get a specific result :/21:13
systemdleteI wish I had noted it carefully so I could look for it later.  I was just doing a quick search at that point and I read a few of the pages my search hit.21:15
freemtbh I was very certain ssh could use gpg keys21:16
systemdleteah, it was "freeipa" not openxxx21:23
systemdletebut21:23
freemI totally could use a free ipa beer right now21:24
freembut my router won't let me download some :/21:24
systemdletefreeipa is a project that belongs to a certain corporation which is not fond of us devuan folks, or others who undermine their profit potentials21:24
systemdletefreem:  That's because beer, being a fluid, wreaks havoc with electronics.21:24
systemdleteOr it could be that your ISP blocks IPAs21:25
freemsadly21:25
systemdletekerberos is another one that some folks prefer21:25
systemdleteno shortage of suggestions, but seems there are few bundled, ready-to-go solutions21:27
systemdleteheh.  Take a look at the list of releases at https://www.freeipa.org/page/Main_Page21:28
systemdleteI guess they don't have "sort" where they live21:28
systemdleteanyway, thanks to all who made suggestions.  I'll look into these21:28
systemdletehttps://code.google.com/archive/p/ssh-keydb/21:31
systemdletebut it is ancient (c. 2010)21:32
rwpI keep my account information and passwords in a file and simply copy-paste those from the file into web browsers as needed.  The file is encrypted when at rest.  Of course it is decrypted when live.  But if someone has remote command execution on my system that's a problem for me regardless.21:41
freemI'm thinking, systemdlete: a fossilscm might be a better choice than git21:45
freemit is dead simple to clone, it have a decent web UI in the binary, etc etc21:46
systemdleteI only mentioned git, freem, because I came across it in my searches.21:46
freemwell, I would have suggested it if you didn't :)21:46
systemdletefossilscm, huh?  OK, I'll look at it21:46
rwpIt's fun to see fossilscm gaining traction in the world.21:46
freemhttps://fossil-scm.org/home/doc/trunk/www/index.wiki21:47
freemrwp: I'd say this is because git's interface just *sucks*21:47
rwpConceptually fossilscm and git are going to be exactly the same thing in the block diagram.  And I am not convinced either are the right solution.  In fact I am convinced of the opposite.21:47
freempicking git is masochism21:47
systemdletefreem +121:48
freembut one needs git for most projects anyway, and then the force of habits kicks21:48
systemdleteyep21:48
systemdletelike devuan's arch nemesis21:48
freemI also want to try moving some personal stuff to darcs or pijul someday21:48
rwpTo fill in the lurkers fossilscm is the SQLite projects own distributed version control written to use SQLite as the storage database.21:48
freemI see many reasons for those to have a LOT LESS of false positives/negatives when cherry picking stuff21:49
systemdleteyou know what?  I apologize but I think I've taken this channel OT.  Let's continue over in offtopic21:49
freemright21:50
rwpThis would all be awesome topics to be discussing in an -offtopic channel somewhere.  Just say'n! :-)21:50
freem(but I think I said all I had to :p)21:50
rwpRight!21:50
systemdletesee you there21:50
plasma41systemdlete: That sounds like the sort of thing that would be in bgstack15's wheelhouse.22:45
systemdletewhodat?22:46
systemdleteI recall seeing that nick I think22:46
systemdleteis that one of devuan's devs or ops?22:47
plasma41systemdlete: He's often in this channel. Looks like he's already in #devuan-offtopic22:47
systemdleteok, well again, no pressing need really.  I can ask over there22:47
plasma41He's a Devuan dev and the resident expert on freeipa et al22:48
systemdleteah, ok.  I will keep that in mind!22:48
systemdletethanks22:48

Generated by irclog2html.py 2.17.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!