0xC0000022L's questions

I wanted to upgrade a production system (through staging, first) to 20.04. Backups and recovery options were in place. All went smoothly as expected. I did do-release-upgrade -d, because I didn't want to wait until the first point release (20.04.1).

However, reviewing all the configuration changes (a combination of looking at diffs from etckeeper and matching with debsums -ce), I noticed /etc/apt/apt.conf.d/50unattended-upgrades now has this line:

Unattended-Upgrade::DevRelease "auto";

This was previously set to:

Unattended-Upgrade::DevRelease "false";

And so I was wondering if this in line with my desired configuration. I'd like to be able to use unattended-upgrades as before, but I definitely don't want anything other than LTS releases.

I looked at the manual pages for apt.conf, apt_preferences, apt-config and unattended-upgrade, but could not find a description of that configuration option. This community help page also didn't list the option. This question here on AskUbuntu was the only one referencing this particular option, but doesn't answer my question either.

Q: So what does Unattended-Upgrade::DevRelease do when set to "auto" and where can I find more information about the settings and their respective effect?

I am setting up a number of VMs and containers and I am partitioning some private network ranges accordingly.

Suppose I have guests separated into a "frontend" (192.168.100.0/24) and "backend" (192.168.200.0/24) network (some may have access to both). The "frontend" network uses NAT and so guests do have access to the internet through that. However, some of the VMs are supposed to be as much separated and so the "backend" network only allows access between the guests on that network and the host. DNS lookups will also be strictly limited as well as outgoing traffic from these guests.

Let's now say I have an apt-cacher-ng instance running on 192.168.200.1 (backend), which happens to be the host. The name apt-cacher.backend.local resolves to that IP address and there are no other access restrictions.

If I would adjust all my sources.list snippets in /etc/apt of the VMs from:

deb http://us.archive.ubuntu.com/ubuntu/ focal main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ focal main restricted

... to (the hacky way):

deb http://apt-cacher.backend.local:3142/us.archive.ubuntu.com/ubuntu/ focal main restricted
deb-src http://apt-cacher.backend.local:3142/us.archive.ubuntu.com/ubuntu/ focal main restricted

... or choose the somewhat cleaner configuration stanza for APT:

Acquire::http { Proxy "http://apt-cacher.backend.local:3142"; };

So summarizing the facts:

• apt-cacher.backend.local (= 192.168.200.1) and any names that may be needed by the "backend" VM will resolve fine, anything else won't
• apt-cacher-ng will run listening on 192.168.200.1:3142
• access from "backend" VM is limited to the backend network (192.168.200.1/24) entirely and netfilter rules will ensure only the services the VM offers will be available and only the apt-cacher-ng instance can be accessed

Will my system be able to update all its packages this way? (Nope, no other software will be used, or I'll package it myself.)

Bonus questions:

• Suppose the updates would work this way, is there anything else to watch out for in such a configuration?
• Is there a sensible way to deal with package repos that use https://? E.g. would it be viable to "simply" mirror the respective packages to a local repo which doesn't use https://?

As far as I understand the kernel facility nftables exists in the kernel that comes with Ubuntu 14.04. As is proven by the following two commands:

# grep -E '(NF_TABLES|NFT_)' /boot/config-$(uname -r)
CONFIG_NF_TABLES=m
CONFIG_NFT_EXTHDR=m
CONFIG_NFT_META=m
CONFIG_NFT_CT=m
CONFIG_NFT_RBTREE=m
CONFIG_NFT_HASH=m
CONFIG_NFT_COUNTER=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_NAT=m
CONFIG_NFT_COMPAT=m
CONFIG_NF_TABLES_IPV4=m
CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_CHAIN_ROUTE_IPV4=m
CONFIG_NFT_CHAIN_NAT_IPV4=m
CONFIG_NF_TABLES_ARP=m
CONFIG_NF_TABLES_IPV6=m
CONFIG_NFT_CHAIN_ROUTE_IPV6=m
CONFIG_NFT_CHAIN_NAT_IPV6=m
CONFIG_NF_TABLES_BRIDGE=m
# lsmod |grep nf
nf_conntrack_ipv4      15012  1
nf_defrag_ipv4         12758  1 nf_conntrack_ipv4
nf_nat_ipv4            13263  1 iptable_nat
nf_nat                 21798  3 ipt_MASQUERADE,nf_nat_ipv4,iptable_nat
nf_conntrack           96976  5 ipt_MASQUERADE,nf_nat,nf_nat_ipv4,iptable_nat,nf_conntrack_ipv4

However, apt-file search nftables does not yield any results, nor does apt-cache search nftables.

So where can I get the new frontend for nftables, i.e. the nftables program matching the kernel modules?

In relation to a previous question I posed (Make apt-get (or aptitude) run with -y but not prompt for replacement of configuration files?) I came across a somewhat peculiar and hard to explain behavior. Perhaps someone can explain it still.

When I execute the following right after a debootstap inside the target chroot, package mercurial appears to require a lot more than seems logical:

apt-get -s -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold install mercurial
Reading package lists...
Building dependency tree...
The following extra packages will be installed:
  ca-certificates fontconfig-config fonts-dejavu-core libdrm-intel1
  libdrm-nouveau2 libdrm-radeon1 libelf1 libfontconfig1 libfontenc1
  libfreetype6 libgl1-mesa-dri libgl1-mesa-glx libglapi-mesa libice6
  libllvm3.4 libpciaccess0 libsm6 libtcl8.6 libtk8.6 libtxc-dxtn-s2tc0
  libutempter0 libx11-6 libx11-data libx11-xcb1 libxau6 libxaw7 libxcb-dri2-0
  libxcb-dri3-0 libxcb-glx0 libxcb-present0 libxcb-shape0 libxcb-sync1 libxcb1
  libxcomposite1 libxdamage1 libxdmcp6 libxext6 libxfixes3 libxft2 libxi6
  libxinerama1 libxmu6 libxmuu1 libxpm4 libxrandr2 libxrender1 libxshmfence1
  libxss1 libxt6 libxtst6 libxv1 libxxf86dga1 libxxf86vm1 mercurial-common
  openssl tcl tcl8.6 tk tk8.6 x11-common x11-utils xbitmaps xterm
Suggested packages:
  libglide3 qct vim emacs kdiff3 kdiff3-qt kompare meld tkcvs mgdiff
  python-mysqldb python-pygments python-openssl tcl-tclreadline mesa-utils
  xfonts-cyrillic
Recommended packages:
  wish
The following NEW packages will be installed:
  ca-certificates fontconfig-config fonts-dejavu-core libdrm-intel1
  libdrm-nouveau2 libdrm-radeon1 libelf1 libfontconfig1 libfontenc1
  libfreetype6 libgl1-mesa-dri libgl1-mesa-glx libglapi-mesa libice6
  libllvm3.4 libpciaccess0 libsm6 libtcl8.6 libtk8.6 libtxc-dxtn-s2tc0
  libutempter0 libx11-6 libx11-data libx11-xcb1 libxau6 libxaw7 libxcb-dri2-0
  libxcb-dri3-0 libxcb-glx0 libxcb-present0 libxcb-shape0 libxcb-sync1 libxcb1
  libxcomposite1 libxdamage1 libxdmcp6 libxext6 libxfixes3 libxft2 libxi6
  libxinerama1 libxmu6 libxmuu1 libxpm4 libxrandr2 libxrender1 libxshmfence1
  libxss1 libxt6 libxtst6 libxv1 libxxf86dga1 libxxf86vm1 mercurial
  mercurial-common openssl tcl tcl8.6 tk tk8.6 x11-common x11-utils xbitmaps
  xterm
0 upgraded, 64 newly installed, 0 to remove and 3 not upgraded.

Looking at the output from apt-cache depends it's beyond me why apt-get decides that these dependencies have to be installed.

As you can see I am passing Dpkg options as described in the above linked question. The main intention behind it is to prevent apt-get and ultimately dpkg from prompting during what is supposed to be an automated installation.

However, I have tried running the same without passing those options and the result is the same.

Problem: ntpd, when installed on a virtual machine running Ubuntu (I've had this on hosts with a variety of hypervisors such as KVM and VMware ESX) seem to be prone to severe clock drift. I haven't found any good method and not everyone seems to experience this.

Question: How can I prevent this? Are there any settings in /etc/ntp.conf to force ntpd to be more aggressive in synchronizing the time inside the VM or should I use ntpdate -b timeserver instead inside a cron job running every so often?

Which method is recommended to avoid leaps when using ntpdate -b or clock drift in general inside a Ubuntu virtual machine?

Side-note: I've seen similar effects on vios (IBM hypervisor) slaves running AIX as well as on Solaris. So the problem is very real and appears to be related to hypervisors in general.

I'm sure that I'm not the first and/or only one to notice that 12.04.2, released earlier this year, installs by default a backported 3.5 kernel from the Quantal (12.10) release.

I'm surprised to see this in an LTS version, so I was wondering what's the reason for this?

It's the first time I noticed it on an LTS release.

Also: is there a method to upgrade to that or will I have to select manually that package (linux-image-generic-lts-quantal)?

Comparing two fully updated systems

Originally installed with 12.04.1 installation CD

$ lsb_release -d && dpkg -l|grep linux-image|grep ^ii
Description:    Ubuntu 12.04.2 LTS
ii  linux-image-3.2.0-39-generic         3.2.0-39.62                             Linux kernel image for version 3.2.0 on 64 bit x86 SMP
ii  linux-image-3.2.0-40-generic         3.2.0-40.64                             Linux kernel image for version 3.2.0 on 64 bit x86 SMP
ii  linux-image-generic                  3.2.0.40.48                             Generic Linux kernel image

Originally installed with 12.04.2 installation CD

$ lsb_release -d && dpkg -l|grep linux-image|grep ^ii
Description:    Ubuntu 12.04.2 LTS
ii  linux-image-3.5.0-23-generic      3.5.0-23.35~precise1         Linux kernel image for version 3.5.0 on 64 bit x86 SMP
ii  linux-image-3.5.0-27-generic      3.5.0-27.46~precise1         Linux kernel image for version 3.5.0 on 64 bit x86 SMP
ii  linux-image-generic-lts-quantal   3.5.0.27.34                  Generic Linux kernel image

$ apt-cache show linux-image-generic-lts-quantal
Package: linux-image-generic-lts-quantal
Priority: optional
Section: metapackages
Installed-Size: 27
Maintainer: Ubuntu Kernel Team <[email protected]>
Architecture: amd64
Source: linux-meta-lts-quantal
Version: 3.5.0.27.34
Depends: linux-image-3.5.0-27-generic, linux-firmware
Filename: pool/main/l/linux-meta-lts-quantal/linux-image-generic-lts-quantal_3.5.0.27.34_amd64.deb
Size: 2520
MD5sum: c9ad82fa12aacbd14324283cb9344ea9
SHA1: a2f9a758f605c116865b7c7fa6971bf77364bf62
SHA256: 08133998d027b5af18e2e3374e0723b4cf22baab28850cc89ca327a34b3094df
Description-en: Generic Linux kernel image
 This package will always depend on the latest generic 12.10 kernel image
 available.
Description-md5: c7e4fbc023632f2e538ff93b600ef34c
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Origin: Ubuntu
Supported: 18m

At the moment I am trying to migrate data from a software RAID5 (6 disks) over to a software RAID1. The command of choice was:

rsync -avxHACPX /mnt/old/ /mnt/new/

However, after the first few files the machine locks up completely. First I thought that this was because the disks were connected using a USB3 extension card, but even when directly connecting them using SATA the situation won't change.

At the moment I am running a long SMART test using smartctl, but that will take a long time to finish. And in the meantime I'd like to find out how to diagnose such an issue.

Several years ago one used to be able to follow the kernel log on one of the terminals, but it seems Ubuntu doesn't provide that anymore. Since the log files don't contain anything useful whatsoever (likely because they don't get written once the error condition occurs) I'm left wondering how to diagnose such an issue?

My question is also more of a general question about diagnosing such an issue when I come across it. Right now the only chance I seem to have is to note down the files that contain errors and then skip those when copying. But that's the actual task. On a more abstract level I'd like to learn about strategies like what I could do in the past by watching the kernel console.

NB: I prefixed my invocation of rsync with ionice -c 3 nice first, but then after this gave the error, removed it. The error occurs independent of this.

Further information: source volume is XFS, target disk is ext4. I am always mount -o ro,remounting the source volume before starting the copy operation. The source volume also happens to be an LVM2 volume layered on top of the software RAID5 (md).

smartctl -a output (filtered):

# for i in $(blkid |grep '/sd'|cut -b 1-8|sort|uniq); do echo $i;  smartctl -a $i|grep -A 1 '^SMART Error Log Version'; done
/dev/sda
SMART Error Log Version: 1
No Errors Logged
/dev/sdb
SMART Error Log Version: 1
ATA Error Count: 1
/dev/sdc
SMART Error Log Version: 1
No Errors Logged
/dev/sdd
SMART Error Log Version: 1
No Errors Logged
/dev/sde
SMART Error Log Version: 1
No Errors Logged
/dev/sdf
SMART Error Log Version: 1
No Errors Logged
/dev/sdg
SMART Error Log Version: 1
No Errors Logged
/dev/sdh
SMART Error Log Version: 1
No Errors Logged

/dev/sdb is one of the physical disks that comprise the source volume's physical volume.

The iostat output you asked for:

sdc               0.00     3.50    0.00    2.00     0.00    22.00    22.00     0.45  226.00    0.00  226.00  78.00  15.60
sdd              38.50     0.00   86.00    0.00  6982.00     0.00   162.37     0.27    3.14    3.14    0.00   2.95  25.40
sde              39.50     0.00   88.00    0.00  7064.00     0.00   160.55     0.43    4.95    4.95    0.00   4.30  37.80
md1               0.00     0.00  625.00    0.00 34984.00     0.00   111.95     0.00    0.00    0.00    0.00   0.00   0.00
sdf              40.00     0.00   84.50    0.00  6994.00     0.00   165.54     0.40    4.73    4.73    0.00   4.43  37.40
sdg               0.00   107.00    0.00  250.00     0.00 18018.00   144.14     1.29    5.06    0.00    5.06   0.61  15.20
sdh               0.00   107.00  251.00    6.50 16034.00  2434.00   143.44     2.54    9.69    9.74    7.69   0.60  15.40
md6               0.00     0.00    0.50  113.50     2.00  2434.00    42.74     0.00    0.00    0.00    0.00   0.00   0.00
md5               0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00
BIGDISK           0.00     0.00  625.00    0.00 34984.00     0.00   111.95     2.59    4.19    4.19    0.00   0.92  57.80

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s avgrq-sz avgqu-sz   await r_await w_await  svctm  %util
sda              38.50     0.00   86.50    0.00  6982.00     0.00   161.43     0.40    4.58    4.58    0.00   4.09  35.40
sdb              39.00     0.00   87.00    0.00  6898.00     0.00   158.57     0.38    4.37    4.37    0.00   3.91  34.00
sdc               0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00
sdd              40.50     0.00   86.00    0.00  7028.00     0.00   163.44     0.30    3.51    3.51    0.00   3.16  27.20
sde              37.50     0.00   86.50    0.00  6972.00     0.00   161.20     0.39    4.51    4.51    0.00   4.05  35.00
md1               0.00     0.00  626.50    0.00 34772.00     0.00   111.00     0.00    0.00    0.00    0.00   0.00   0.00
sdf              38.50     0.00   86.50    0.00  7002.00     0.00   161.90     0.42    4.86    4.86    0.00   4.23  36.60
sdg               0.00   470.00    0.00  277.50     0.00 80506.00   580.22    68.39  246.57    0.00  246.57   2.54  70.40
sdh               0.00   459.50  128.50  152.00  8224.00 71834.00   570.82    72.01  256.88    6.66  468.42   2.52  70.80
md6               0.00     0.00    0.00  612.50     0.00 71834.00   234.56     0.00    0.00    0.00    0.00   0.00   0.00
md5               0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00
BIGDISK           0.00     0.00  626.50    0.00 34772.00     0.00   111.00     2.69    4.30    4.30    0.00   0.93  58.20

/dev/sdb is the device smartctl reports with errors.

How can I colorize hardlinks myself? Turns out on an old Ubuntu 10.04 I have, this happens by default (same .bashrc and .profile in use), whereas on the newer Ubuntu 12.04 it doesn't.

This is the output on Ubuntu 10.04 (the one I desire):

And this is the output on Ubuntu 12.04:

The relevant file is .vimrc, however, .viminfo is an ordinary file with link count 1, in contrast to the hardlinked .vimrc.

Of course the fact that GNU coreutils uses texinfo pages instead of man pages doesn't make things easier. I found this here, but it doesn't refer to the case I am looking for.

TL;DR: how to achieve coloring hardlinked (as in: link count > 1) files the way I like in various Ubuntu versions.

How can I use a disk with GPT partition table on a system with a BIOS but no (U)EFI?

I have a system with a 3 TB drive (no other drives and since this is a remote machine I have no choices here) and with a GPT for obvious reasons. Ubuntu 12.04 is being bootstrapped onto the system and this worked so far. Now after bind-mounting /dev, /proc and /sys from the host into the target system and chrooting into it, I installed linux-image-server which worked fine (after linking /sbin/initctl as /bin/true). Because this is a remote machine I have to do all of this via SSH and have no bootable CD or anything. I can boot into a rescue system if it fails, though (PXE).

Now I know that grub2 is supposed to support the scenario, but for the life of me I cannot figure out how to install it.

The boot (and root) device is to be /dev/md0, composed of /dev/sda1 and /dev/sdb1 in RAID mode 0. With /dev/md0 mounted under /target I am running:

grub-install --root-directory=/target --no-floppy /dev/sda

which fails with:

/usr/sbin/grub-setup: warn: This GPT partition label has no BIOS Boot Partition; embedding won't be possible!.
/usr/sbin/grub-setup: error: embedding is not possible, but this is required when the root device is on a RAID array or LVM volume.

So how can I get grub2 installed in order to have this BIOS-based system boot properly?

Note: it doesn't matter whether I run this inside or outside the chroot environment. The error and output are identical. Likely because I bind-mounted /dev etc into place. Of course appropriate adjustments to the command line (no --root-directory=) have been made.

In general what is the approach to switch the desktop environment or window manager on Ubuntu? The main difference between stock Ubuntu, Kubuntu and Lubuntu is supposedly the use of Unity vs. KDE vs. LXDE.

However, in order to try various desktop environments and window managers I don't want to have to reinstall the respective flavor from scratch just to get a particular desktop environments or window manager. There probably is an easier method than that.

The question: How can I easily test different desktop environments and respective compatible window managers (say KDE, LXDE, Unity, GNOME, XFCE and StumpWM)?

I'm trying to connect from a 10.04 system to a 12.04 system via SSH. Strangely enough the rules in resolv.conf seem to take effect only selectively, which leaves me puzzled. Observe:

[2] user@mach:~$ ssh pangolin
ssh: Could not resolve hostname pangolin: Name or service not known
[2] user@mach:~$ host pangolin
pangolin.subdomain.domain.tld has address 172.16.7.12

subdomain.domain.tld is on the search line in /etc/resolv.conf and using host the name is properly searched given those rules. However, with the SSH client ssh I receive the error reproduced above. How can this be? I was always of the impression that the name resolution rules in resolv.conf apply system-global.

Note: /etc/hosts doesn't declare the name pangolin at all. The package openssh-server is configured on the target machine. The question is purely about why name resolution isn't consistent between those two programs.

Another note: the command works fine when I enter the fully-qualified domain name, i.e. pangolin.subdomain.domain.tld.

Meanwhile I rebooted the client machine (10.04) and the problem still exists. A DNS caching daemon isn't installed, so I reckon that shouldn't have been a problem anyway.

The information asked for in the comment:

$ grep host /etc/nsswitch.conf
hosts:          files dns

/etc/resolv.conf, I transformed the domain names consistently:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 172.16.1.1
nameserver 172.16.1.5
search subdomain.domain1.com domain1.com domain2 domain3.com domain2.ccTLD domain3.net dev.domain1.com sdk.dev.domain1.com

... and the full /etc/nsswitch.conf:

$ cat /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat
group:          compat
shadow:         compat

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

... and /etc/network/interfaces, which is the source for resolv.conf in 12.04:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 172.16.1.234
        netmask 255.255.0.0
        gateway 172.16.255.254
        dns-nameservers 172.16.1.1 172.16.1.5
        dns-search domain1.com. domain2. domain3.com. domain2.ccTLD. domain3.net. dev.domain1.com. sdk.dev.domain1.com. subdomain.domain1.com.
        dns-domain subdomain.domain1.com.

Note: the transformation of the domain names was done with sed, so it's consistent between the various reproduced files.

There is no ~/.ssh/config, but here's the global one (/etc/ssh/ssh_config), shrunk for the sake of brevity:

$ grep -v '^#' /etc/ssh/ssh_config |grep -v '^[[:space:]]*$'
Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no

$ mtr pangolin
Name or service not known: Success

When running update-grub on the newly installed Ubuntu 12.04 with an older software RAID (md), I get:

error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
Generating grub.cfg ...
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
Found linux image: /boot/vmlinuz-3.2.0-24-generic
Found initrd image: /boot/initrd.img-3.2.0-24-generic
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
Found linux image: /boot/vmlinuz-3.2.0-23-generic
Found initrd image: /boot/initrd.img-3.2.0-23-generic
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
Found memtest86+ image: /boot/memtest86+.bin
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
error: superfluous RAID member (5 found).
Found Debian GNU/Linux (5.0.9) on /dev/sdb1
Found Debian GNU/Linux (5.0.9) on /dev/sdc1
done

I would be less worried if the message would say warning: ..., but since it says error: ... I'm wondering what the problem is.

# cat /proc/mdstat
Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] [raid10]
md2 : active raid1 sdc1[1] sdb1[0]
      48829440 blocks [2/2] [UU]

md3 : active raid1 sdc2[1] sdb2[0]
      263739008 blocks [2/2] [UU]

md1 : active raid5 sdg1[3] sdf1[2] sde1[1] sdh1[0] sdi1[4] sdd1[5](S)
      1250274304 blocks level 5, 64k chunk, algorithm 2 [5/5] [UUUUU]

unused devices: <none>

Do I have to worry or is this harmless?

btw: disregard the mentioning of Debian 5.0.9, that was the previously installed system and is going to be overwritten. It's on /dev/md2 actually.

How can I prevent users from encrypting their home folder on a server inside our company without removing the respective packages?

Are there any policies I can enable to prevent this?

Edit: the reason is that employees leaving should not leave data behind in encrypted form on this machine. They have the opportunity to use encryption on their personal workstation to some extent. Those users do not have super user powers.

This is certainly related to this question, but I feel it doesn't overlap, so here we go. How can I get the functionality of the following command on Ubuntu (and/or Debian as bonus):

yum whatprovides 'perl(Foo::Bar)'

Obviously I can attempt to rely on the package somehow ending up in a folder structure that resembles the namespaces in Perl, but I'm looking for something equivalent, i.e. equally brief and trivial. However, if it doesn't work as briefly on Ubuntu, I can do with a longer path and create my own function.

Please consider 10.04 or newer for this question.

On older Debian machines one could issue something like:

echo '<username>:*'|chpasswd -e

in order to change the password field of the user (<username>) to *.

Now I am aware of

passwd -d <username> && passwd -l <username>

to achieve a similar effect and set the password field to !. However, on some newer vanilla Ubuntu configurations (in particular 10.04 LTS) this leads to the user not being able to log into the machine anymore (for example via SSH and key) - with: Your account has expired; please contact your system administrator. - even though passwd(1) "warns" that this is possible.

Now that's exactly what I want to achieve, though. Manually changing the field in the /etc/shadow file from ! to * fixes the issue, but there seems to be no scriptable way to achieve the same without directly fiddling with the shadow file (e.g. with sed). chpasswd -e used to be a convenient alternative, but that has been obviously removed.

So what I am looking for is either a variation of passwd -l that lets me choose the token that gets written into the file or any other kind of replacement for the exact functionality that chpasswd -e offered.

NB: * is already used for system accounts alright, and there seems to be a semantic difference to PAM or whatever between ! and * in the password field.

Also note: on Debian 5 and 6 chpasswd -e works. So the functionality must have gotten stripped deliberately in Ubuntu. I tested Ubuntu 9.10, 10.04 (they don't have it), 11.04 and 11.10 have chpasswd -e.

When running apt-get -y install <packages ...> on Ubuntu 10.04 I would like apt-get (or aptitude if that makes it easier) to not prompt me when installing additional dependencies (behavior of -y as I understand it) and but not prompt me about overwriting configuration files, instead assume to keep the existing ones always (which is usually the default). Unfortunately --trivial-only seems to be the inverse of -y and not affect the prompt that is shown, according to the man page.

In particular packages auch as samba, nullmailer, localepurge and lighttpd have forced me to interact with the terminal, even though the whole procedure was scripted and meant to be non-interactive.

So I can run on one machine:

dpkg --get-selections '*' > selection.txt

On another machine:

dpkg --set-selections < selection.txt

... followed by either of the following:

aptitude install
apt-get -u dselect-upgrade

... to install the packages that.

However, it appears that some information gets lost in the process, such as whether a package (say xyz) got installed automatically as dependency of another package (abc). You can see that whenever you do something like apt-get --purge remove abc. On the original machine you would be notified that package xyz was installed as dependency of abc and that you may use apt-get autoremove to get rid of it.

Now I am aware of deborphan and debfoster, but they're cumbersome to use given the (simple) task at hand.

It seems saving and restoring the selections as shown above is not sufficient to restore the subtle dependencies of installed packages.

Is there a way to back up the complete set of metadata for package management and restore it then in its entirety?

When one starts byobu by saying:

byobu -c myconfig

unfortunately the whole session looks like a bare bone screen session. How can I get the full-fledged byobu interface with the status bar and "tabs" for the windows in the session, while at the same time starting byobu with a custom configuration file?

Please note: this is not about configuring what's in $HOME/.byobu because the contents of that are independent from what I want to achieve - which is special purpose (thus the extra configuration file).

Edit: the only "crutch" I've found so far is to interactively enter the screen command:

:source /full/path/to/myconfig

... in order to "source" (similar to how it's done in Bash and other shells) the configuration.

Is there a way to set the OOM killer adjustment value right when a daemon process (Apache in my case) starts? I would like to give the Apache processes a higher likelihood of being killed and make it virtually impossible for some more vital services to be killed by the OOM killer.

Now, it's the first time I encountered a kernel panic on a system that I can only access remotely (i.e. not physical access). The kernel panic I encountered is basically the one described here, only that the kernel version was:

Pid: 15483, comm: kvm Not tainted 2.6.32-30-server #59-Ubuntu MS-7522

The system is an Ubuntu 10.04 and I've been using ksplice in order to keep it secure without reboots.

The whole panic obviously resulted effectively in an unresponsive system. Since it runs VMs, this is not acceptable. Now, my question is this: is there a way to configure the system (e.g. via sysctl.conf) to reboot automatically when it encounters a kernel panic? If there is such an option, but it is not recommended to use it, please provide pointers or information as to why it is not recommended so I can male a well-informed decision whether to use it or refrain from using it.

For your reference, below the excerpt from syslog:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffa0339e6a>] gfn_to_rmap+0x2a/0x80 [kvm]
PGD 182eff067 PUD 2103cd067 PMD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq
CPU 2 
Modules linked in: btrfs zlib_deflate crc32c libcrc32c ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs exportfs reiserfs ksplice_a2zjpxfc ksplice_aeduoyr1 ksplice_ocpqubki ksplice_koav9q4r_vmlinux_new ksplice_koav9q4r ksplice_6rzac0n3_vmlinux_new ksplice_6rzac0n3 ksplice_sqv65gpe ksplice_74bgebjk ksplice_l13a9izo_vmlinux_new ksplice_l13a9izo ksplice_51l2thd5_vmlinux_new ksplice_51l2thd5 ksplice_mzqhwd6a ksplice_0k98nifa_vmlinux_new ksplice_0k98nifa ksplice_c0g8d8te_vmlinux_new ksplice_c0g8d8te ksplice_6jvv7tl8_vmlinux_new ksplice_6jvv7tl8 ksplice_o2xegqal ksplice_r7xdx1no ksplice_ly8vh9y3_vmlinux_new ksplice_ly8vh9y3 nls_cp437 ip6table_filter ip6_tables kvm_intel kvm bridge stp nls_utf8 cifs ipt_LOG ipt_MASQUERADE ipt_REJECT xt_recent xt_state xt_tcpudp iptable_filter iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nf_defrag_ipv4 xt_multiport ip_tables x_tables fbcon tileblit font bitblit softcursor snd_hda_intel vga16fb vgastate snd_hda_codec snd_hwdep nouveau snd_pcm ttm snd_timer snd drm_kms_helper soundcore snd_page_alloc drm lp i2c_algo_bit parport multipath linear aacraid 3w_9xxx 3w_xxxx raid10 raid456 async_pq async_xor xor async_memcpy async_raid6_recov raid6_pq async_tx raid1 raid0 ahci r8169 mii sata_nv sata_sil sata_via [last unloaded: ksplice_a2zjpxfc_ocfs2_new]
Pid: 15483, comm: kvm Not tainted 2.6.32-30-server #59-Ubuntu MS-7522
RIP: 0010:[<ffffffffa0339e6a>]  [<ffffffffa0339e6a>] gfn_to_rmap+0x2a/0x80 [kvm]
RSP: 0018:ffff88014ee4d828  EFLAGS: 00010246
RAX: 0000000000000000 RBX: 400000000001ec15 RCX: ffff8801d5e28990
RDX: 0000000000000023 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88014ee4d838 R08: 0000000000000023 R09: 0000000000000100
R10: 0000000000000000 R11: 0000000000000007 R12: 0000000000000001
R13: 00000000000ba08a R14: ffff880032c0dbb0 R15: ffff88014ee4d928
FS:  00007f1b0d201700(0000) GS:ffff880008e40000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000158378000 CR4: 00000000000026f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process kvm (pid: 15483, threadinfo ffff88014ee4c000, task ffff88000d274500)
Stack:
 ffff8800b418d0a8 ffff8801d5e28000 ffff88014ee4d868 ffffffffa0339f5f
<0> ffff8801d5e28000 ffffc90016afa8a8 fff0000000000fff 000000018849a000
<0> ffff88014ee4d8b8 ffffffffa033a4cf 0000000000000001 ffff8800b418d0a8
Call Trace:
 [<ffffffffa0339f5f>] rmap_remove+0x9f/0x1c0 [kvm]
 [<ffffffffa033a4cf>] kvm_set_pte_rmapp+0xff/0x170 [kvm]
 [<ffffffffa033653d>] kvm_handle_hva+0x9d/0x120 [kvm]
 [<ffffffffa033a3d0>] ? kvm_set_pte_rmapp+0x0/0x170 [kvm]
 [<ffffffffa0336601>] kvm_set_spte_hva+0x21/0x30 [kvm]
 [<ffffffff8155e2ce>] ? _spin_lock+0xe/0x20
 [<ffffffffa0322aa4>] kvm_mmu_notifier_change_pte+0x44/0x60 [kvm]
 [<ffffffff81130e3e>] __mmu_notifier_change_pte+0x3e/0x90
 [<ffffffff811172a4>] do_wp_page+0x674/0x850
 [<ffffffff81095228>] ? tick_dev_program_event+0x68/0xd0
 [<ffffffff8108a059>] ? __hrtimer_start_range_ns+0x189/0x400
 [<ffffffff81117c2c>] handle_mm_fault+0x2ec/0x3c0
 [<ffffffff81113846>] ? follow_page+0x2d6/0x350
 [<ffffffff81117e39>] __get_user_pages+0x139/0x480
 [<ffffffffa033de1e>] ? T.1169+0x1fe/0x2e0 [kvm]
 [<ffffffff81118219>] get_user_pages+0x49/0x50
 [<ffffffff81045b27>] get_user_pages_fast+0x157/0x1c0
 [<ffffffffa0323af1>] gfn_to_pfn+0x41/0x150 [kvm]
 [<ffffffffa034026d>] tdp_page_fault+0x9d/0x140 [kvm]
 [<ffffffff81195177>] ? mb_cache_entry_insert+0xb7/0x1d0
 [<ffffffffa033cc2f>] kvm_mmu_page_fault+0x1f/0xa0 [kvm]
 [<ffffffffa037dbf8>] handle_ept_violation+0x68/0x130 [kvm_intel]
 [<ffffffffa0380a8a>] vmx_handle_exit+0xca/0x250 [kvm_intel]
 [<ffffffffa032f997>] vcpu_enter_guest+0x227/0x4c0 [kvm]
 [<ffffffffa032fcac>] __vcpu_run+0x7c/0x350 [kvm]
 [<ffffffffa033621d>] kvm_arch_vcpu_ioctl_run+0x8d/0x1d0 [kvm]
 [<ffffffffa03252e3>] kvm_vcpu_ioctl+0x473/0x5c0 [kvm]
 [<ffffffff811567b2>] vfs_ioctl+0x22/0xa0
 [<ffffffff81084fa6>] ? common_timer_set+0x116/0x1a0
 [<ffffffff81156951>] do_vfs_ioctl+0x81/0x410
 [<ffffffff81156d61>] sys_ioctl+0x81/0xa0
 [<ffffffff810131b2>] system_call_fastpath+0x16/0x1b
Code: 00 55 48 89 e5 48 83 ec 10 48 89 1c 24 4c 89 64 24 08 0f 1f 44 00 00 41 89 d4 48 89 f3 e8 3f 9b fe ff 41 83 fc 01 48 89 c6 75 19 <48> 2b 18 48 c1 e3 03 48 03 58 18 48 89 d8 4c 8b 64 24 08 48 8b 
RIP  [<ffffffffa0339e6a>] gfn_to_rmap+0x2a/0x80 [kvm]
 RSP <ffff88014ee4d828>
CR2: 0000000000000000
---[ end trace 18481f74af4eef67 ]---