Russell Fulton's questions

I have docker 20.10.21 installed from apt. The machine is not directly connected to the internet so we rely on our squid proxy.

I have set up a daemon.json file:

rful011@secphires01:~$ cat /etc/docker/daemon.json
{
     "http-proxy": "http://squid.auckland.ac.nz:3128",
     "https-proxy": "http://squid.auckland.ac.nz:3128",
     "no-proxy": "*.auckland.ac.nz"
}

as described here.

starting dockerd gives:

rful011@secphires01:~$ sudo /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
unable to configure the Docker daemon with file /etc/docker/daemon.json: the following directives don't match any configuration option: no-proxy, http-proxy, https-proxy

Clearly I am missing something.

Migrating from rssh to rush...

I can't figure out what it means by not an absolute directory name. see logs below:

Aug 31 14:07:24 secmgrprd04 systemd: pam_unix(systemd-user:session): session opened for user upload by (uid=0)
Aug 31 14:07:24 secmgrprd04 rush[3904968]: debug level set to 3
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:5: 
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:6: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:7: # Default settings
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:8: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:9: 
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:10: rule default
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:11: acct on
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:12: limits t10r20
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:13: umask 002
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:14: env - USER LOGNAME HOME PATH
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:15: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:16: # Uncomment this to activate the notification subsystem:
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:17: # (Also install 'rush-notifier' or a similar script.)
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:18: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:19: #post-socket inet://localhost
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:20: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:21: fall-through
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:22: 
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:23: ######################
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:24: # File moving services
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:25: ######################
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:26: 
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:27: # Scp requests: only putting, no fetching.
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:28: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:29: # The server host needs the paths
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:30: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:31: #   /srv/rush/srv/incoming/{alpha,ftp}
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:32: #
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:33: # and that they be writable! A specific
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:34: # group can be assigned to all users
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:35: # expected to gain access via GNU rush.
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:36: 
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:37: rule scp-to
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:38: command ^scp (-v )?-t( --)?
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:39: set[0] /usr/bin/scp
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:40: chroot "/data/upload"
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:40: not an absolute directory name
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:41: chdir "/"
Aug 31 14:07:24 secmgrprd04 rush[3904968]: /etc/rush.rc:41: not an absolute directory name
Aug 31 14:07:24 secmgrprd04 rush[3904968]: Finished parsing /etc/rush.rc
Aug 31 14:07:24 secmgrprd04 rush[3904968]: errors parsing config file

I actually copied the example from the documentation which had chroot "~" and I changed it to an absolute path and still got the same error.

Ubuntu 20.04, installed by apt, Version: 1.8+dfsg-1.1

baffled!

I am stuck with rsyslog running in a corporate straight jacket. The config is completely set.

I need to run a service to relay logs from a variety of sources and I use syslog-ng for this.

I have this running on an older ubuntu system using a locally compiled and packaged version of syslog-ng. I would much rather not have to compile things when I don't have to.

The problem(s):

Firstly the standard ubuntu packages are mutually exclusive. You install rsyslog and that removes syslog-ng. I got around this by using a third party repository and installing syslog-ng from that.

Secondly there appears to be something in systemd/systemctl which ensures that rsyslog and syslog-ng service are not both running.

I suspect that they are fighting over a resource, possibly /run/systemd/journal/syslog

Suggestion on how to work around this welcome!

We have just upgraded our Infoblox appliance and now the log shipment which occurs via scp is failing with auth issues.

Since this is an appliance and we have no access to the a shell on the box we are having trouble figuring out what is wrong. On the infoblox end all we have in the configuration is hostname, port, username and password. (no option for key :( )

I can invoke scp fine from another host with the credentials.

Any suggestions on finding out what the issue is? (short of putting up a hacked sshd ;)

I have two Dell servers in a lights out data centre that I am trying to upgrade to ubuntu 20.04. I am accessing the servers via idrac and mounting CD virtually from my laptop at home. ISO is ubuntu-20.04.2-live-server-amd64 (I originally tried 20.04.01 which I have used successfully previously).

I am working remotely via VPN (fortigate) and again I have done this before and been surprised how well it works.

From idrac I mount the virtual media and reboot, select boot menu at the appropriate time and then select virtual CD. A second or two later the console clears and there are two icons at the bottom as expected.

quite what the coloured bars are in aid of I don't know but they keep getting deeper with time. They display the same in two different browsers (firefox and safari) I wondered if they were rendering problem with html5.

The display stays like this for some time ( around half an hour) and then displayed "decoding failed -- system halted" or fills with screeds of error messages ending in a kernel panic.

Any idea what the root cause is likely to be and how I might work around it?

I am guessing that the ISO image is getting corrupted somehow but it is weird that it takes over half an hour to decide this.

It is also weird that it happens on two different servers.

I have a dell server (PowerEdge R330) and I have just tried to liven up the second on board NIC. idrac says it is connected as does poking into the lifecycle setup on boot but ethtool says it isn't and eno2 (this is ubuntu 16.04) does not appear in ifconfig in spite of being set up in network/interfaces.

auto eno2
iface eno1 inet static
        address 130.216.30.231
    netmask 255.255.255.224
    broadcast 130.216.30.255
    gateway 130.216.30.254

Ethtool show link as down.

the one thing that I can see different is that idrac shows the second (problematic) NIC as

OS Driver State : Non Operational

the other says Operational

any thoughts on what to try next?

Background:

when run on a unix box Tenable.io (nessus) will try to create a tag file in /etc/ with a unique string. Presumably so it can identify the machine if the hostname or IP changes.

It does this by

"sh -c \"echo 35374e09cc444b058c65267613804fa4 > /etc/tenable_tag && echo OK\""

The problem is that it needs root privilege to do this. The standard way of allowing tenable to elevate privilege is to use sudo and add the handful of commands that it needs to an sudoer file. Whitelisting sh is equivalent to whitelisting everything something we would rather not do!

So I am trying to figure out some simple way of dumping text into a file that does not involve a shell "builtin"

The crucial thing is that the whole command will be executed with sudo so things that pipe something to sudo won't work.

in this post someone suggested

sudo ex +'$put =\"some string\"' -cwq foo.txt

which works but prepends a blank line (at least on my ubuntu box)

One of my Ubuntu servers always loses its default route when restarted. I have a second server which has an almost identical set up which works fine. I am not sure when the problem started but it first became an issue when we started auto patching so the servers get rebooted every month.

rful011@secesprd02:~$ ifconfig
bond0     Link encap:Ethernet  HWaddr f4:e9:d4:a0:6f:50  
          UP BROADCAST RUNNING MASTER MULTICAST  MTU:1500  Metric:1
          RX packets:27405882 errors:0 dropped:127 overruns:0 frame:0
          TX packets:11898380 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:38129519206 (38.1 GB)  TX bytes:14527843371 (14.5 GB)

bond0.1060 Link encap:Ethernet  HWaddr f4:e9:d4:a0:6f:50  
          inet addr:10.6.0.68  Bcast:10.6.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4349473 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2832180 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:36350288670 (36.3 GB)  TX bytes:13842264977 (13.8 GB)

and in /etc/networks/interfaces:

auto bond0
iface bond0 inet manual
    post-up ifenslave bond0 enp2s0f0 enp2s0f1
    pre-down ifenslave -d bond0 enp2s0f0 enp2s0f1
    bond-slaves none
    bond-mode 4
    bond-miimon 100
    bond-lacp_rate 0

auto enp2s0f0
iface enp2s0f0 inet manual

auto enp2s0f1
iface enp2s0f1 inet manual

auto bond0.1060
iface bond0.1060 inet static
    address 10.6.0.68
    netmask 255.255.255.0
    network 10.6.0.0
    broadcast 10.6.0.255
    gateway 10.6.0.254

These files are identical (except for the IP address) to the setup on the machine that works.

This is an important production server so I really don't want to go bouncing it often to test stuff ! Does anyone have any ideas on how to diagnose what is going on.

We have a requirement to export logs from several appliances. (Actually Infoblox DNS servers). The appliances can be configured to export using scp (but only using password).

So we have no alternative to having the passwords in the appliance configs. To reduce the risk of this I have set up the upload account on an ubuntu server and locked it down using rssh to scp only. I have set the umask to write only and denied read access to on the directory to the upload account.

That works nicely -- one can upload files but not copy them out again. What I can not see how to do is stop that account from accessing any world readable file on the system without using chroot -- which has its own problems!

I suspect that there isn't a way but thought I would ask.

I have a remote ubuntu server that I just tried to upgrade inplace and failed. So I fired up iDRAC to rebuild it from scratch but I can not attach a virtual ISO. I get a popup saying "virtual media is connecting..." which sits there for ever.

I have verified this works fine with other more or less identical servers running the same version of iDRAC. I have also verified that some other things on that machine that iDRAC pops up a file window for also work.

Under normal circumstances I would go down stairs with the ISO on a UBS stick and ask one of the datacenter team to pop it into the server when they next visit the datacenter but (as of today) we are in a national (NZ) lockdown so that option isn't available.

Oh yes, I have also cycled the power via iDRAC and looked for some way to reset IDRAC itself to no avail.

Does anyone have any ideas what might cause iDRAC to behave like this? Or any other way of getting this thing going without physical access to the machine?

Ununtu 16.04 and 18.04 (same problem on both)

I am trying to use sshfs to mount a directory on another system, it works fine from the command line but when I execute the same command from a puppet "exec" it appears to succeed but the mount point is not usable:

rful011@secmonprd10:~$ ls -l ~sensors/Rules/
ls: cannot access '/home/sensors/Rules/source': Permission denied
total 4
drwxr-xr-x 2 sensors sensors 4096 Jun  5 13:03 raw
lrwxrwxrwx 1 sensors sensors   33 Aug 21 12:32 sensor -> /usr/local/var/lib/suricata/rules
d????????? ? ?       ?          ?            ? source

where "source" is the directory in question

The command used to mount it is: sshfs -o idmap=user sensors@<host>:Rules/raw /home/sensors/Rules/source

Puppet says the exec succeeded and I can't find anything in the logs to contradict this.

I wonder if sshfs is exepecting some environment vars set?

puppet code:

exec{"rule-source-share":
 command => "sshfs -o idmap=user sensors@<host>:Rules/raw  /home/sensors/Rules/source",
 user => "sensors",
  path        => "/usr/bin:/bin:/usr/local/bin",
  unless => "test -f /home/sensors/Rules/source/updated"
}

The 'unless' is supposed to check if the mount is in place but does not work

Is there a better way to do ensure that the directory is mounted?

Notes: 1. by lower priority I mean that the priority number is lower. 2. Distro is RHE

I want to start a daemon with lower than normal priority (ie. say 18 rather than 20) so it will get cpu first in the case of contention.

nice runs commands at increased priority, renice can raise or lower but works for processes that are already running.

I would rather not have to dig the pid out of the process list and then call renice in the start script if I can avoid it since the program does not conveniently produce a pid file.

I just built a new 12.04 ubuntu box and tried to install puppet package. This failed because it could not load ruby1.8. After some fiddling around I tracked the issue down to the fact that the libreadline5 package is no longer available. libreadline installs version six but libruby1.8 is looking for a package called libreadline5.

For various boring reasons I am stuck with 12.04 and puppet 2.7 (don't ask ;)

Not sure how to proceed from here?