38[00:25:01] <hendursaga> Use SELinux to disable write and
network access?
39[00:25:04] <f8e4> best do is: open in chromium native (which
should have rensoble defualts)
40[00:25:11] <sney> afaik a lot of fancy pdf embeds are
adobe-only, and if you try to open one in something like okular
it'll give you a dialog saying the document has unsupported
features
44[00:26:24] <sney> there's also the option to convert it
to a different format, which would easily scrape off any weirdness,
(like opening it in gimp) or extract pages with pdftk
45[00:27:11] <ratrace> f8e4: selinux, apparmor, or even
firejail or similar containers
46[00:27:11] <f8e4> the convert option come to mind: but some
conveneint pipe in.pdf ... out.pdf with rebuild ensured +
bookmarkes_maybe
47[00:27:19] <mason> Something I quite like from a semi-recent
sarnold talk is using AppArmor to prohibit a process from writing to
disk or using the network. Think about what a process can do with
these two restrictions.
55[00:35:31] <f8e4> 'evince can play embedded video'
urgs
56[00:35:50] <mason> f8e4: watch that video clip
57[00:36:03] <jhutchins> f8e4: Security like that is not
something you should take from an anonymous IRC message. You should
know how it works and why you are doing what you do.
58[00:36:18] <mason> jhutchins: Did you watch the video?
59[00:36:36] <mason> jhutchins: Do you use an OS that ships
AppArmor turned on by default now? :P
60[00:36:56] <jhutchins> mason: Not into apparmor or selinux.
My skills lie elsewhere.
61[00:37:18] <mason> jhutchins: Then you should watch the
video, because it's a tailor-made solution to the issue f8e4
raised.
62[00:37:23] <jhutchins> mason: No, I don't and I
wouldn't.
63[00:37:34] <mason> jhutchins: You don't use Debian?
64[00:37:35] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
65[00:37:36] <jhutchins> mason: Yes, but I don't have that
issue.
68[00:38:15] <mason> Well, there's the water, horse. Drink
or not, as you wish!
69[00:38:40] <jhutchins> Not my first rodeo.
70[00:39:13] <mason> It's a new tool for us, it's
available now, it's compellingly neat. I can't see not
wanting to learn about it, but it's not the end of the world.
71[00:39:20] <jhutchins> Oh, and my horse is a mare from
Secretariat's bloodline.
77[00:41:53] <jhutchins> I guess since I'm at the end of a
long upgrade chain I don't have it enabled. I'm afraid
selinux discourages it's use by breaking so many things by
default. I know how to make it work, but I prefer other methods.
78[00:42:10] <f8e4> tell me tell me
79[00:42:23] <jhutchins> I've only seen problems with
apparmor - which means I don't know how it works when it works.
80[00:42:32] <ratrace> AA is not really new in Debian, just
enabled by default on Buster
81[00:42:46] <mason> SELinux wants things to be prepared and
despite working with it a fair amount, it seems way less
straightforward than it ought to be. Analyzing it is painful.
82[00:42:55] <ratrace> I wrote AA profiles for many public
facing programns. It's very valuable tool
92[00:45:22] <jhutchins> I see a lot of people with single-user
computers defending against risks that you would only have with a
large population of uncontrolled users (like college students).
93[00:45:29] <ratrace> they're equal foot-shooty. SELinux
is just more verbose with the policies
96[00:45:42] <mason> jhutchins: In this case, all you have to
do is be unlucky and download the wrong PDF.
97[00:45:44] <ratrace> jhutchins: though this is not the case
here
98[00:46:01] <ratrace> AA profiles are very valuable even on
single use computers
99[00:46:10] <jhutchins> mason: Yes, and if you're running
Adobe on Windows you have a problem.
100[00:46:31] <ratrace> for example, without an AA profile I
wrote for firefox, a rogue website could exploit FF and see if
I'm a linux admin with some nifty ssh keys in ~/.ssh
137[01:15:40] <mason> f8e4: If you use mksh, don't use this
to test, but here's an example of that set from the video
applied to /bin/mksh:
replaced-url
138[01:15:48] <mason> Note that it's a bit cargo cult as
I'm still learning.
202[02:20:21] <rr123> is there a way to bind a program/process
to an IP address, e.g. I have two NICs and I want to have chrome use
one of them while the rest of processes use another
203[02:20:57] *** Quits: kn0rki (~Kn0rki@replaced-ip) (Disconnected by services)
237[02:54:37] <GnuLinuxCat> Btw Debian has a security advisory,
DSA-4808-1, for apt.
replaced-url
238[02:54:37] <GnuLinuxCat> It is my impression that the
security advisory only applies to malformed deb files, so if you
update apt the usual way "sudo apt-get update" and
"sudo apt-get upgrade," it would be safe to fix the
security issue that way. Is this impression correct?
239[02:54:37] <GnuLinuxCat> I just want to check before I
updated apt that way.
240[02:55:07] <GnuLinuxCat> *update
241[02:55:11] <sney> yes
242[02:55:38] <Unit193> ...So I should stop adding 13 3rd party
repos!? :o
243[02:56:04] <sponix> Unit193: no ... its perfectly fine for
YOU
244[02:56:08] <sponix> ;)
245[02:56:15] <Unit193> Oh good. Whew.
246[02:56:31] <GnuLinuxCat> ok great thanks
247[02:56:54] <sney> also, see how it says "resulting in
denial of service"? on your local system that would manifest as
apt getting stuck, and you can ctrl+c it
248[02:57:27] <sney> this would be more of a practical concern
for e.g. headless vms that upgrade automatically
284[03:25:01] <zuckerbug> I was considering ubuntu for my
workstation/servers, but it seems that Debian stable might be a
better choice
285[03:27:17] <sney> dpkg: centos->debian
286[03:27:18] <dpkg> Each debian stable release is supported for
at least 5 years, see
replaced-url
287[03:29:00] <sney> for general purpose linux stuff like
hosting a website, it doesn't make a big difference what distro
you use. but if you want something with stable, frozen software
versions, security support, and doesn't need to be rebooted
more than once a year, debian is your friend
288[03:29:20] *** Quits: short-bike (~short-bik@replaced-ip) (Quit: And, on that note....)
289[03:29:36] <sney> centos used to have that market locked up.
their loss
290[03:30:14] <zuckerbug> I find that the older I get the more
stability I require.
292[03:30:21] <dvs> Well, I can't say I didn't see
that coming.
293[03:30:34] <sponix> Interesting world we live in when Red Hat
looks like the Bad Guys
294[03:32:38] <sponix> zuckerbug: actually out of the RHEL
clones Oracle's "Unbreakable Linux" is likely the
best contender, if you can get past the Oracle branding
295[03:32:41] <sney> IBM couldn't make money off CentOS
directly, and were unable/unwilling to see the bigger picture, is
what I've heard as the root cause of this. but anyway, former
centos users will find plenty to like about debian stable
296[03:32:49] <dvs> Well, not the bad guy, just greedy
297[03:32:52] <dvs> er
298[03:33:47] <sponix> I've never been a RHEL/CentOS Fan
anyway. last time I did that in a VM the install process was very
tedious
300[03:34:28] * dvs should have known it was an IBM decision
301[03:34:35] <sney> rocky linux is a bit fly-by-night and
afaict doesn't have a real relationship with their upstream,
they wouldn't be able to forward bugs with any particular
traction, etc. debian doesn't have an upstream. we'll see
how it shakes out over the next year+ anyway
302[03:34:48] <sponix> Think Debian does better in that regard
with doing just a pretty bare install, and you build from there.
Instead of trying to determine roles and stuff inside the initial
install
304[03:36:23] <wrycode> Hi, I have an issue that I have read up
on a decent amount but I'm not really sure how to proceed. From
a specific user on my Debian 10 server, any systemctl --user
commands give me the following error: Failed to read server status:
Process org.freedesktop.systemd1 exited with status 1. I had this
issue on another user but the following lines in my .bashrc fixed
it:
315[03:41:54] <wrycode> I have found several places with this
bug documented but the only fix given is the XDG_RUNTIME_DIR thing.
It is strange that it works fine on other users but not this user.
319[03:43:51] <wrycode> I just tried it with a new user and it
still does not work. I'm wondering if something about the way
I'm launching dbus only works for one user or something
366[04:43:01] <sney> packages in buster-backports are intended
to work with buster, so broadly, it's probably safe... except
you're already seeing anomalous behavior with just the buster
packages, so you might want to fix that first
367[04:44:18] <wrycode> hah yeah okay. A small part of me hopes
that it's a systemd bug that's been fixed in the next
version.
368[04:45:52] <pfred1> using systemd is a bug
369[04:46:15] *** Quits: magic_ninja (~sparkie1@replaced-ip) (Remote host closed the connection)
522[09:12:55] <shtrb> Does anyone have a clue what tool I can
use to control /disable MyAnalytics from Kmail or any sane mail
client (without using a browser) ?
525[09:20:36] <nkuttler> thunderbird works fine for me
526[09:21:27] <trui> I'd guess it's just a good
default behavior. ctrl+d sends end of file, and i think it's
often been used in that fashion, no_gravity
642[11:26:41] <unixbsd> is there a bug fix to KDE for getting
Wireless? megabug, it asks for getting root passwrd, and no wireless
is setup. you can do this endlessly, infinite.
643[11:26:42] *** Guest82824 is now known as S3xyL1nux
644[11:28:40] <mrkramps> Fromhell, which browser you're
using for accessing cockpit?
645[11:28:51] <Fromhell> chrome
646[11:29:01] <mrkramps> Fromhell, same issue with firefox?
647[11:29:28] <mrkramps> Fromhell, asking this because there
seem to be browser related issues with cockpit
648[11:29:33] <Fromhell> i never use firefox
649[11:30:26] <Fromhell> try to uze it from firefox
650[11:30:43] <shtrb> unixbsd, that sound as if the wallet or
dbus services not running
651[11:31:34] <shtrb> unixbsd, are you running a full plasma
session , or you are using just a subset of kde apps ? do you use
plasma-nm or some other widget ?
652[11:31:41] <Fromhell> shtr crom server it works
669[11:37:08] <shtrb> unixbsd, it is VERY important after kde
installation to perform sddm restart after an installation to let
the session be properly started
670[11:37:31] <shtrb> unixbsd, that is a search report on who
knows what
671[11:37:33] <unixbsd> it is everyhwere.:
replaced-url
690[11:40:20] <ratrace> unixbsd: 1) isolate what the actual bug
is, which component is actually failing and how, 2) make sure you
can reproduce under same conditions, 3) file a bug report
691[11:40:21] <shtrb> unixbsd, wallet should be configured , so
does dbus and running
692[11:40:36] <unixbsd> I have tried on suse, devuan and debian,
the settings ... thing to try as they indicated on the forums, but
it did work still.
694[11:41:02] <shtrb> I think I'm in the ignore list of
unixbsd :-(
695[11:41:56] <mrkramps> unixbsd, but your wifi is wokring
outside of kde?
696[11:42:19] <unixbsd> hi, well, I know to setup wireless
without kde. of course.
697[11:42:32] <unixbsd> interfaces is clean as kde recommends
698[11:42:43] <ratrace> unixbsd: you "know" ... but
did you actually try?
699[11:42:53] <unixbsd> the workaround to fix it would be into :
kde-standard
700[11:42:59] <ratrace> do you "know" which component
_exactly_ is failing here? there are several components working
together
701[11:43:33] <unixbsd> but this is definitely not the possible
way to fix a kde issue, it is beyond debian. I would say. it would
bring more difficulties.
702[11:43:37] <shtrb> ratrace, there is a common trope about
some users would try to disable the wallet and remove it from
running , and then be surprised that kde request a password instead
of using the existing config
703[11:43:54] <mrkramps> wallet is keyring manager in kde?
704[11:44:02] <shtrb> yes
705[11:44:02] <unixbsd> ah... which component...? let me install
kde-standard, I will check with ps aux. maybe dbus... I need to boot
the partition
708[11:44:06] <ratrace> shtrb: that's why I want them to
point point, surgical precision, WHICH component is failing
709[11:44:15] <ratrace> *pin point
710[11:44:19] <ratrace> is wpa_supplicant failing? is network
manager failing? is the wallet failing? is some UI component
failing?
711[11:44:29] <mrkramps> is firmware installed?
712[11:44:37] <shtrb> mrkramps, if wallet is not configured or
not running (because it was manually disabled) stuff will not be
working
713[11:44:38] <ratrace> even that
714[11:45:42] <ratrace> unixbsd: "let me install
kde-standard" ... then WHAT are you running there? sounds like
you have an incomplete, broken system and are complaining something
is not working right
715[11:45:50] <mrkramps> shtrb, yeah if you disable the central
service to manage authentication ... you know, not good ^^
716[11:48:46] <unixbsd> ratrace: I install on full disk or on
partition. anyhow a partition is the very same. installer debian and
put / on part2. done.
745[12:19:05] <dob1> I don't thin it's spam, but how
this channel it's different from the one on otc.net ?
746[12:19:24] <dob1> oftc.net
747[12:20:02] <mrkramps> it's on a different irc network?
748[12:20:23] <dob1> it's mentioned in topic too
749[12:20:48] <mrkramps> afaik #debian@otfc is debian's
official irc channel
750[12:21:08] <dob1> I was thinking this one is the official
751[12:22:13] <dob1> !oftc
752[12:22:13] <dpkg> OFTC is the Open and Free Technology
Community, a support/collaboration service. They have an IRC
network: irc.oftc.net. You may (or may not) be connected to
OFTC's network.
replaced-url
753[12:22:27] <dob1> !oftc move
754[12:22:28] <dpkg> irc.debian.org moved to OFTC on June 4th
2006, see
replaced-url
755[12:22:37] *** Quits: _aeris_ (~aeris@replaced-ip) (Remote host closed the connection)
756[12:23:13] <dob1> !fact sharing
757[12:23:13] <dpkg> I show the same facts on both
<freenode> and <OFTC>. If you update a fact on one
network, it will show up on the other network.
804[13:33:32] <short-bike> New to debian - how can I verify that
update/upgrade has upgraded this install from 10.6 to 10.7 ? A cat
of /etc/os-release and uname -r (or -a) are not revealing this.
881[14:35:07] <oops> yes , the usb is installer iso , i have
just installed debian on my pc , but my pc is obsolute , the gnome
can't display , so i need to re-install xfsc from usb
884[14:35:38] <dpkg> apt-zip has been removed post-wheezy (replaced-url
885[14:35:42] <abrotman> aww
886[14:35:43] <mrkramps> a) use apt-cdrom to add it to your
sources.lst
887[14:36:07] <mrkramps> b) is the firmware for your graphics
card installed?
888[14:37:21] <mrkramps> !apt-cdrom
889[14:37:22] <dpkg> somebody said apt-cdrom was used to add a
new CDROM to APT's list of available sources: man apt-cdrom.
See also <apt-cdrom_external>.
890[14:37:45] <abrotman> oops: was this for stable/buster?
891[14:37:55] <mrkramps> i hope so?!
892[14:38:30] <oops> mrkramps: i have remove the gnome desktop ,
when the desktop begin , it prompt iwiw3945 firmware missing ,
946[15:04:08] <ov3rmind> anyone use firejail and can help with
one single doubt? if setup with cfg is applyed all users runs the
same setting or it needs be per user?
947[15:05:53] <mrkramps> ov3rmind, if config is systemwide in
/etc it is applied for all users but can be overwritten by user
configuration in ~/.config
948[15:06:18] <oops> mrkramps: i still don't know how to do
, the bootable usb is like this "/dev/sdb1 3.7G 3.7G 0 100%
/run/media/oops/Debian 10.7.0 i386 1
949[15:06:20] <oops> ", but on another pc which will using
it as source like this "sdc1 3.7G 0 part",
975[15:15:56] <oops> mrkramps: my english is not good , take it
easy
976[15:16:24] <mrkramps> oops, it's all cool
977[15:16:41] <unborn> no irritation on my end - just don't
pick debian supporters to solve non debian issues - basically - you
have no issue with your debian install - what I mean its off topic.
978[15:16:50] *** ted6480 is now known as S3xyL1nux
1009[15:26:54] <oops> the pc has two os , one is ubuntu 18.0 lts
and the other is debian which are all 32 bit
1010[15:27:16] <unborn> ah i see oops so you wifi is dropping out
or whats the issue - I am sorry i just joint the channel and I did
not seen all your messages about your issue.. I guess you cannot
join to wifi - is that right?
1011[15:27:55] <unborn> oops: no luck from ubuntu? nor from
debian?
1018[15:31:01] <mrkramps> unborn, oops has installed debian on a
second offline pc and wifi firmware is missing for sure, probably
also graphics firmware
1019[15:31:03] <unborn> can you please reply - what is the
problem? cannot you connect to wifi on one or both oses? I was
ubuntu user long time ago but I know os very well.
1020[15:31:17] <short-bike> oops: run this -> 'nmcli
connection show configured' and paste results here please ->
replaced-url
1028[15:33:49] <mrkramps> unborn, that's the summary of oops
problem(s) for now
1029[15:34:19] <unborn> oops: you want xfce? as de? or you want
gnome or something else?
1030[15:34:34] <short-bike> mrkramps: so he has no DE right now -
is that correct ?
1031[15:34:42] <mrkramps> short-bike, afaik yes
1032[15:34:52] *** urban7015 is now known as S3xyL1nux
1033[15:34:58] <unborn> mrkramps: Im really really sorry for my
earlier rampage.. Im just smelly old git what else I can say :D
1034[15:35:20] <oops> the gnome only display a mouse cursor with
a black background on debian
1035[15:35:25] <unborn> short-bike: and no drivers... tooo
1036[15:35:32] <short-bike> nice !
1037[15:35:38] <unborn> yeah
1038[15:35:40] <mrkramps> short-bike, also no internet connection
on this system, as well as no reliable connection at all (daily
payed stuffed only on mobile)
1039[15:36:00] <unborn> oops: you want xfce? as de? or you want
gnome or something else?? what would you like to have?
1052[15:39:04] <short-bike> Has anyone suggested to him to simply
re-install ? Of course, that assumes he knows what a backup is.
1053[15:39:31] * unborn oh that's why I had those issues with
locales... fudas :)
1054[15:40:33] <unborn> short-bike: it was me. I was about to
ask, but he did not mention anything except dual boot so I assume it
was indeed clean install..
1055[15:40:34] <mrkramps> short-bike, nope not yet
1056[15:40:52] <unborn> it was just an suggestion***
1057[15:41:02] <mrkramps> or at least not in all emphasis
1059[15:41:16] <oops> sorry , i need to left now , it's very
late on my here , it's too hard , i communicate with you with
my small phone screen, let me think over what you said , thanks of
all
1070[15:42:42] <rupicapra> Oh I did install steam, so I did add
the I368 arch? Could it ve that?
1071[15:43:03] <rupicapra> No, I don't
1072[15:43:03] <unborn> meeeh
1073[15:43:19] <mrkramps> phew, plasma crashing with steam
install - dunno
1074[15:43:31] <unborn> that's why I have ps :D
1075[15:43:34] <freem> hi. I've read that the kernel have a
"file" name /proc/sys/kernel/hotplug (which seems to be
how udev is informed about new events), but I can't find it in
the systems I run. Is that info still true?
1096[15:50:34] <unborn> oh poops it does not detect I am running
quatro gf - possibly I put my old hdd into new machine - Im on some
kind nvidia and intel crap now.. it calls something like optimus -
worst thing you can get on linux..
1183[16:17:11] <freem> AFAIK... it's just that if X
crash/exit, then you're back the the shell which summoned
startx, but that can even be done willingfully
1184[16:17:12] <ratrace> much, much harder, or for th emost cases
impossible, with a DM
1185[16:17:16] <nevivurn> Didn't consider the screen lock
use-case
1186[16:17:17] <mrkramps> that's the wqhole point why it is
not safe in critical environment
1187[16:17:34] <freem> ratrace: but DM crashes more often XD
1188[16:17:43] <ratrace> freem: doesn't land you onto a
shell tho
1207[16:21:41] <freem> turning off is not always an option, for
example when you go toilet or brew some cofee. Restarting computer
for that is a bit... extreme
1208[16:21:52] <infosec_yo> KDE on DEBIAN is bloated.
1209[16:21:59] <freem> only on debian?
1210[16:22:06] <infosec_yo> mainly on debian
1211[16:22:11] <mrkramps> where is the friggin session log for
KDE?
1212[16:22:11] <ratrace> le sigh.... can anyone put a cork in
this one, like other chans did?
1213[16:22:51] <infosec_yo> in /var/temp
1214[16:23:04] <nevivurn> freem: yup, which is what the
"pray" mitigation is for.
1215[16:23:10] <mrkramps> !admin
1216[16:23:10] <dpkg> [admin] like a omnipresent god, or
replaced-url
1219[16:24:20] <infosec_yo> ratrace is spamming me in pm.
1220[16:25:08] <unborn> infosec_yo: i do not believe your claims
1221[16:25:13] <rupicapra> When going with the startx route, I
get the same dialog box "plasma cannot start" "all
shell packages missing. This is an I.stallation issue please contact
your distribution "
1229[16:27:25] <Emil> Hey, I have an issue with wifi and
authentication. On logging in my laptop attempts to connect to the
wifi automatically, as it should. However it seems that there's
some issue and it fails after a couple of minutes and then
successfully connects. However if I immediately select disconnect
(ie stop attempting to connect) and immediately press connect, it
successfully connects immediately. I think it might
1230[16:27:31] <Emil> have something to do with some internal
keyring/authentication service not being up fast enough to provide
the wifi keys to the daemon, but of course I don't know that
Any help? It's just your bog standard Debian with KDE
1231[16:28:02] <ratrace> 16:23 -!- infosec_yo
sid476935@gateway/web/irccloud.com/x-ezccxoibyygulirl is messaging
you, and you have umode +g.
1242[16:35:08] <mrkramps> rupicapra, I am lost here …
you'd still try reinstalling plasma-desktop including all its
dependencies, but otherwise I've no idea what's causing
this issue
1281[16:58:13] <Ede|Popede> problem is when it gets the timing
bad. freeze right before upstream is releasing a new version can
lead to unwanted effects years later when this new stable becomes
unstable
1282[16:58:57] <Ede|Popede> iirc it happened with PHP last year.
old version EOL and new version not available for stable.
1283[16:59:01] *** debhelper sets mode: +l 1172
1284[16:59:24] <infosec_yo> debian is EOL as well.
1315[17:23:55] <epitamizor> will it screw up the files if a usb
is connected, then root user mounts it in another folder location,
but then the user unplugs the usb after unmounting from /media?
1363[17:43:09] <unixbsd> Hello how to open libreoffice without
that it popups whatever, recovery ... from the linux command line?
1364[17:43:16] <hejux> see the big 'L' after root?
1365[17:43:43] <alexrelis[m]> hejux: okay. I tried to login as
root in a tty session and it looks like it is locked because it asks
for a password. Thank you.
1376[17:48:27] <unixbsd> Is there maybe something faster, than
libreoffice? I see that libreoffice does not handle odt or docx
well. it crashes with odt saving. docx format is messing up all
formating.
1392[17:55:52] <mrkramps> you can argue with me in
#debian-offtopic
1393[17:56:07] <jhutchins> unixbsd: I think you have problems
with your install. odt is libreaoffice's native format.
1394[17:56:19] <jhutchins> unixbsd: What release are you on?
1395[17:56:54] <hejux> debian i guess
1396[17:57:09] <hejux> debian always has the oldest software
1397[17:57:22] <alexrelis[m]> How do I change my username and
home directory username? I tried `sudo usermod -l newname -d newname
-m oldname` but it says I can't do it because the user session
I'm trying to change is already running.
1464[18:22:33] <Rodon> i dont get "dunstify" command
available despite dunst installed and working properly .. is there
any other package i need to install ?
1465[18:23:17] <Ede|Popede> ,file bin/dunstify
1466[18:23:22] <judd> No packages in buster/amd64 were found with
that file.
1467[18:23:25] <zaratustra> so you have xp with that I assume...
from 0 to 10 how hard would it be to do it
1468[18:23:49] <mrkramps> Rodon, dunst 1.5.0-1 in bullseye has
this command
1469[18:24:06] <mrkramps> earlier verion in buster not
1470[18:24:20] <jelly> zaratustra: read our guides, then draw
your own conclusion
1471[18:24:21] <Rodon> oh.thats why i dont find it in buster
1482[18:26:30] <zaratustra> well sorry if I'm bothering you
with this. its a legit concern I have... godspeed
1483[18:26:41] <jelly> zaratustra: if you can't even be
bothered to read NMG, then the answer is "too hard for
you"
1484[18:26:42] <mason> zaratustra: Yeah, this is a different
persona. Slightly different language patterns. Not hard to do if one
cares to make the effort. Just commenting on the possibility.
It's really somewhat in line with what you were asking about.
1485[18:27:06] <n4dir> no one knows you are a dog on the internet
1486[18:27:09] <dob1> dd if=/dev/urandon of=somefile bs=1M
count=10 -> it gives me a 9MB file
1489[18:27:43] <jelly> dob1: given that typo of urandom I'm
surprised you get anything :-)
1490[18:27:51] <mason> jelly: FWIW, if you look at the logs, the
infosec_yo account was abusive earlier, and trolls various channels.
Seems banworthy to me, but =shrug=
1492[18:28:36] <dob1> jelly, I wrote it wrong here, it's a
typo because I didn't copy the command
1493[18:29:01] *** debhelper sets mode: +l 1179
1494[18:29:18] *** Quits: blackstar (~olivier@replaced-ip) (Remote host closed the connection)
1495[18:29:31] <ratrace> jelly: that nick, btw, is already banned
in multiple channels, and annoys people via PM.
1496[18:29:46] <ratrace> pre-emptive measures are highly
adviseable.
1497[18:29:48] <mason> ratrace: Yar, it was the interaction with
you that jumped out at me.
1498[18:30:56] <dob1> it's the same if I do bs=10M count=1
1499[18:31:28] <ratrace> mason: and not me tho, he's been
pestering people in other chans. I have +g, he can't PM me
1500[18:31:31] <ratrace> tried, tho
1501[18:31:47] <jelly> dob1: that can happen if the destination
filesystem is filled up, ie. there's not enough space for a
10MiB file. Show the complete output.
1502[18:32:25] <mason> I don't end up getting enough spam
for +g. The PMs I get tend to be things I want to read.
1512[18:36:41] <alexrelis[m]> It looks like after changing the
name of my home folder, I don't have permission to remove or
edit any of my files, even though it says my user and user group
owns the files.
1513[18:36:44] <jelly> dob1: I see possible options: a) the host
system might be oversubscribed and out of space or b) bug in
filesystem
1514[18:37:20] <jelly> alexrelis[m]: your user has to also own
the folder itself
1515[18:37:57] <jelly> and it might help to log off and on again
if you haven't already
1516[18:38:27] <mrkramps> !chown
1517[18:38:27] <dpkg> methinks chown is CHange OWNer, its part of
the fileutils package, try 'man chown' at the prompt
1546[18:49:50] <jelly> I confess I power cycled or rebooted the
wrong machine only three times thus far
1547[18:49:50] <dob1> well the dir I was trying to create the
file was this one (created by me for the purpose to limit the space)
(dev/loop0 19M 8.5M 9.0M 49% /home/user/somedir
1548[18:50:10] <dob1> I forget this dir was limited in space...
1563[18:54:13] <alexrelis[m]> I'll just reboot then. There
also have been a couple of small problems, but most have to do with
the paths being set to /home/olduser/path/to/file instead of
~/path/to/file.
1586[18:58:26] <alexrelis[m]> mrkramps: the problem with doing
this is that there's a file in the ISO that's greater than
4 Gigs which cannot copy because of fat32's limitations.
1589[18:59:06] <mrkramps> sig_9, dd is not working
1590[18:59:11] <alexrelis[m]> sig_9: for some reason dd
doesn't work for Windows.
1591[18:59:13] <mrkramps> afaik at least
1592[18:59:14] <sig_9> how is it not working
1593[18:59:18] *** Quits: somazero (~somazero@replaced-ip) (Remote host closed the connection)
1594[18:59:21] <Kali_Yuga> sig_9: that didn't work for me
1595[18:59:22] <sig_9> are you in windows?
1596[18:59:22] <sney> not every windows iso is hybrid
1597[18:59:28] <mrkramps> exactly
1598[18:59:29] <alexrelis[m]> sig_9: idk but it doesn't work
for windows ISO.
1599[18:59:39] <sig_9> alexrelis[m]: of course it does
1600[18:59:59] <sig_9> I've made many windows 10 iso's
1601[19:00:11] <sig_9> what is your dd output
1602[19:00:31] <alexrelis[m]> It will run fine for me but it
won't boot.
1603[19:00:36] <Kali_Yuga> mrkramps: what did you say I just need
to copy the Windows iso onto a Fat32 formatted USB stick? is that
even bootable after that?
1604[19:00:39] <sig_9> uefi?
1605[19:00:53] <alexrelis[m]> Kali_Yuga: trust me when I say to
try ventoy.
1606[19:00:56] <sig_9> go into bios and choose usb
1636[19:11:40] <Kali_Yuga> I hate all these 3rd party software
stuff
1637[19:11:53] <unixbsd> "cal -h" does not work on
debian, but it works on BSD.
1638[19:12:36] <mrkramps> unixbsd, what is "cal -h"
supposed to do?
1639[19:12:37] <alexrelis[m]> Kali_Yuga: yes. Ventoy is basically
a custom boot loader that you install to your flash drive that will
automatically search for ISOs within it and create boot entries.
1640[19:13:10] <alexrelis[m]> It allows you to boot from multiple
ISOs from one image and use your drive for storage while also using
it as a bootable install media.
1641[19:13:29] <Kali_Yuga> alexrelis[m]: I will try
1642[19:13:38] <Kali_Yuga> alexrelis[m]: thanks for the help
1643[19:13:50] <alexrelis[m]> Kali_Yuga: no prob. If you need any
more help feel free to ask.
1644[19:14:00] <mrkramps> unixbsd, or you just want to install
the bsdutils / bsdmainutils
1645[19:14:18] <unixbsd> well manpages tells something else...
see: man cal
1661[19:22:35] <unixbsd> is there a little workaround for it?
1662[19:22:53] <hudo> is there a binary for rizin ?
1663[19:23:02] <unixbsd> ncal is another thing, and not reliable
to port on other platforms.
1664[19:23:07] <mrkramps> unixbsd, i am just guessing, but cal is
probably around for compatibility reasons while in bsd was already
replaced with ncal
1665[19:23:20] <unixbsd> cal is unmaintained since years and
ages.
1666[19:24:02] <Kali_Yuga> alexrelis[m]: okay, moment of truth
1667[19:24:18] <Kali_Yuga> alexrelis[m]: be right back
1668[19:24:42] *** Quits: Kali_Yuga (~dustin@replaced-ip) (Quit: Lost terminal)
1669[19:25:24] <mason> unixbsd: Interesting. That's a
docbug, with the -h.
1670[19:26:04] <unixbsd> there is here a bug fix that can be
helping :
replaced-url
1671[19:26:05] <mason> Ooh, ncal is a little unnatural-feeling,
but I can see what they're going for. Interesting.
1703[19:50:41] <hansol> guys, we have given the root password to
somebody to fix somethening to our site, they have fixed our case,
but they got changed the root password, we hack the root password
and changed but now they are login in into our machine and they
starting a miner. Our question is how we can find from where and how
they are starting this miners and fix
1704[19:50:42] <hansol> everything?
1705[19:51:32] <unixbsd> mount with a live cdrom, like slackware
iso for instance
1706[19:51:45] <hansol> its a deiab
1707[19:51:46] <unixbsd> mount /dev/sda1 /mnt ; vi /etc/shadow
and
1708[19:52:00] <sney> hansol: restore from backup prior to the
other person getting access
1709[19:52:03] <unixbsd> then replace root:: blabla to get :: no
pass on root.
1710[19:52:31] <hansol> we have changed password but he is login
agian and starting miner script
1711[19:52:48] <hansol> but theroot password is changed
1712[19:52:55] <sney> hansol: exactly, you'll never find
every backdoor. RESTORE FROM BACKUP.
1713[19:53:18] <hansol> you thing its a php script ?
1734[20:07:35] <alexrelis[m]> Better to just make a user account
for them, and give them sudo privileges for the specific thing that
are tasked to configured.
1738[20:09:34] *** Quits: mrbirkov (uid453780@replaced-ip) (Quit: Connection closed for inactivity)
1739[20:10:11] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
1740[20:10:22] <ratrace> hansol: as someone who has server
security as its $daily_job ..... I agree with sney. burn it. scatter
the ashes. rebuild from known good backups.
1746[20:13:01] <ratrace> and if you can isolate "external
jobs", then do it in VMs, let them build
ansible/saltstack/whatever recipes for the job, you review them and
execute
1748[20:14:10] <ratrace> hell, we have some external
"consultants" do some work for us. they're given VMs
that are purged daily, on physically separate machines... in fact,
the whole datacenter even is separate from our production
capacities.
1749[20:14:24] <ratrace> (and they're not even roots, just
unpriv user work)
1770[20:22:41] <ixil> sney: I tried making an equivs that lists a
*Provides that conflicts with the it's *Depends
1771[20:22:55] <sney> if you can't make your package
cooperate with apt, then it may be best to install it a different
way, like straight into /usr/local
1786[20:28:01] <sney> any time you override apt's dependency
resolution, you're only setting yourself up for more headaches
later. going that way isn't a solution to anything.
1787[20:28:11] <mrkramps> ixil, depackage it and rebuild proper
package?
1792[20:29:02] <ixil> I don't have too much experience with
debian/ubuntu - I am using a ubuntu vm :'(
1793[20:29:02] <mrkramps> probably even better
1794[20:29:20] <ixil> although I'm doing that through LXD so
maybe I went wrong there too
1795[20:29:24] *** Quits: Deknos (~deknos@replaced-ip) (Remote host closed the connection)
1796[20:29:44] <mrkramps> ixil, so the problem is in your ubuntu
VM then?
1797[20:29:48] <ixil> mrkamps: I was thinking about it, but then
I think I also have to repackage it from ros and it's several
'distribution'
1798[20:30:07] <ixil> mrkramps - could be, but shouldn't be
- it's a clean install
1799[20:30:19] <sney> !ubuntuirc
1800[20:30:19] <dpkg> This is not the Ubuntu help channel. Please
do /server chat.freenode.net and then /join #ubuntu. If you are
using HexChat, you can right-click the following link and choose
connect. irc://chat.freenode.net/ubuntu
1801[20:30:21] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
1802[20:30:38] *** Quits: bertbob (~bertbob@replaced-ip) (Remote host closed the connection)
1828[21:09:15] <bitdefect> I get a segfault via suricatasc -c
shutdown when using the backported version from bullseye in buster.
1829[21:09:21] <bitdefect> I wondered if someone can confirm
that.
1830[21:11:16] <drl> Is this the same kernel as Debian Buster:
Linux mx 5.6.0-2-amd64 #1 SMP Debian 5.6.14-2~mx19+1 (2020-06-14)
x86_64 GNU/Linux
1831[21:11:34] <sney> drl: no, buster has 4.19 and
buster-backports has 5.8 or 5.9
1832[21:11:37] <mrkramps> drl, nope
1833[21:12:02] <alex11> that also says 'mx'
1834[21:12:07] <alex11> which probably means mx linux
1835[21:12:52] <sney> bitdefect: I don't see any reports of
similar issues, but it looks like there were significant changes
between the buster and bpo versions, so there might be some
regression caused by older config options? I'm not familiar
with that package, but maybe start clean and see if the segv goes
away
1836[21:13:47] <bitdefect> sney: I actually did. I want to set
this up on a new firewall hardware I got recently (Protectli).
1837[21:14:19] <sney> bitdefect: in that case I would consult
with suricata upstream
1838[21:14:25] <bitdefect> sney: I only got suricata and
suricata-update from bullseye, the rest is a fresh netinstall with
only system tools installed.
1839[21:14:40] <bitdefect> sney: Will do
1840[21:15:16] <bitdefect> sney: I actually loaded the core dump
in gdb, but that's not helpful, due to missing debugging
symbols.
1842[21:15:33] <drl> I'm needing libx11.so.6 to work with
Linux mx 5.6.0-2-amd64 #1 SMP Debian 5.6.14-2~mx19+1 (2020-06-14)
x86_64 GNU/Linux. How can I get it?
1843[21:16:47] *** Quits: Gobo (~user@replaced-ip) (Remote host closed the connection)
1844[21:19:06] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
1845[21:19:19] <sney> drl: mxlinux is not supported here. ask on
their forums.
1849[21:19:44] <dpkg> antiX is a fast, lightweight and easy to
install systemd-free linux live CD distribution based on Debian
Stable for Intel-AMD x86 compatible systems (
replaced-url
1882[21:42:21] <f8e4> i tinker aa, now:
replaced-url
1883[21:43:19] <f8e4> it can read all, why it want write mask! :
apparmor="DENIED" operation="open"
profile="// many of those on syscalls i guess; why?
1884[21:44:04] <f8e4> try to confine pdf viewer that all
1915[22:02:48] <Razathorn> I'm trying to apt-get
dist-upgrade from buster to testing and I'm encountering
"Breaks" errors, but I can't figure out why it is the
case The newer version of the needed package to "not
break" is available but for some reason is not being upgraded,
so I am really just trying to determine how to figure out WHAT
depends on this old version of a package and is holding me up. Can
an APT/DPKG ninja help me?
1916[22:04:02] <freem> Razathorn: I would advise you to use
aptitude's ncurses interface, it makes it easier to debug that
sort of problems
1917[22:04:04] <sig_9> have you changed your sources.list to
testing?
1918[22:05:08] <mrkramps> apt rdepends package
1919[22:05:11] <sig_9> you've changed in sources.list
'stable' to 'testing' or bullseye
1920[22:05:19] <Razathorn> Yes, I have, to testing sig_9
1921[22:05:53] <Razathorn> What is aptitude's ncurses
interface? I have not experienced this. I'm honestly switching
back to debian from ubuntu, so I'm a bit out of practice.
1939[22:08:22] <Razathorn> Folks, let me be 100% honest in this
that I'm looking for apt/dpkg help here, but this is the beta
"raspberry pi os" 64 bit which, unlike the 32 bit, is
actually directly using buster apt sources and adding a 3rd party
raspi apt source, so this may not work AT ALL when I'm done,
but by god, I hope you can help me prove one way or the other ;)
1949[22:10:51] <Razathorn> my GOAL in the end is to run debian
testing with raspi kernel and hw support that hasn't made it
upstream yet.
1950[22:11:27] <sig_9> Razathorn: you grab your iso from here:
replaced-url
1951[22:11:29] <sig_9> ?
1952[22:11:38] <Razathorn> since raspi essentially moved to
"extending" real debian rather than repackaging and
porting it, it appears. 32bit os has raspbian sources, 64bit
literally has debian urls and the raspi stuff is extra
1953[22:12:30] <Razathorn> No sig_9, this is the raspi beta 64
that I'm going to "SEE" if I can upgrade to testing.
This is in no way expected to be supported or work. I'm just
out there I suppose.
1954[22:12:48] <sig_9> heh
1955[22:12:53] *** Quits: Jerrynicki (~niklas@replaced-ip) (Remote host closed the connection)
1956[22:13:12] <sig_9> this is my "one" line in my
rasppi 4 sources.list
1957[22:13:14] <Razathorn> The reasoning is I want to have all
the raspi custom stuff for gpio dev and all that working but still
use the newer testing userland like kde
1959[22:13:26] <mrkramps> Razathorn, i'd guess you have more
luck at #raspbian
1960[22:13:41] <Razathorn> nah you guys pointed me in the right
direction ;)
1961[22:13:46] <Razathorn> sorry, you folks.
1962[22:15:07] <bitdefect> sney: I just saw the latest old stable
for suricata is 5.0.5, while the one in Bullseye is 5.0.3. Would it
not be better to issue a bug report for Bullseye/Backports rather
than upstream?
1963[22:15:28] <freem> hum... any idea how I could have
debootstrap giving some progress information, but *not* spamming
stdout ?
1964[22:15:34] *** Quits: el (~el@replaced-ip) (Quit: q u i t)
1970[22:16:40] <bitdefect> mrkramps: I tried, at least on their
website I have a hard time for 5.0.4 and 5.0.5 while they have a
nice list for 5.0.3. Will check the tar.gz.
1971[22:16:51] <sney> bitdefect: bullseye has 6.0.1, but before
filing a bug report, you should still confer with upstream to make
sure it isn't user error on your part.
1972[22:17:09] <sney> bug reports are for when you're *sure*
it's a problem with the application itself, not for support
requests
1973[22:17:22] <bitdefect> sney: User error is impossible. Just
kidding ;)
1980[22:21:18] <bitdefect> sney: Though, I must say, a segfault
should never be a configuration issue. If it is a configuration
issue, you still have a severe bug ;)
1997[22:33:39] <Aristide> I have a small problem with incrontab
(0.5.12-1+deb10u1) on Debian Buster. I get a memory leak, and
incrontab crash. I get lot of « cannot create watch for user
root: (16) Device or resource busy » too
1998[22:33:46] <Razathorn> mrkramps / sig_9: Looks like something
is depending on the buster gcc version directly. rdepends was the
answer btw, I can walk backwards and identify.
1999[22:34:02] <Aristide> no problems when I use inotifywait in
same directory, I get all FS events
2019[22:44:06] <Razathorn> mrkramps / sig_9: Found it. It's
libgcc1. There's no new "testing" version for arm64
in testing. It's a buster package that has no arm64 version in
testing.
2021[22:45:36] <sney> Razathorn: there is a known issue upgrading
from buster to bullseye in some cases, where libc6-dev and
libgcc-8-dev get stuck due to libgcc1. if you 'apt full-upgrade
libgcc1-' it will proceed, on a debian system
2023[22:46:46] <sney> libgcc1 from gcc-8 is supposed to be
replaced by libgcc-s1 from gcc-10 but it doesn't always go as
planned. the gcc team is working on it.
2027[22:49:09] <Razathorn> sney: That seems like what is
happening here
2028[22:50:11] <sney> Razathorn: see in the channel topic, where
it says "testing/unstable: #debian-next @ irc.oftc.net"?
if you had followed that when you got here, you would have found the
answer much more quickly, because the testing channel is v familiar
with this issue
2029[22:50:53] <Razathorn> Joining now! I did not see it.
2030[22:51:23] <Razathorn> well I need an invite, doh.
2031[22:51:24] <sney> !invite only
2032[22:51:25] <dpkg> Many debian channels are on the OFTC
network (irc.oftc.net), *not* on freenode. If you try to join one
and you see "Cannot join (Channel is invite only)." it
means you did not read it's on irc.oftc.net. See also
replaced-url
2033[22:52:34] <Razathorn> I didn't realize that was a
different network, I just thought it was adovcating another freenode
server. Got it now, thx.
2053[23:07:57] <sney> I don't know what you mean by
"quick hop", but I have a znc instance that is connected
to both freenode and oftc, and I connect to znc with hexchat. (and 5
other unrelated networks too)
2054[23:08:04] <f8e4> i postponed the aa; this is serious stuff,
no idea; xdg-mime default chromium.desktop application/pdf will do i
hope
2055[23:08:24] <ratrace> f8e4: are you using aa-genprof?
2056[23:09:10] <ratrace> f8e4: problem is, you'll need some
abstractions there due to gnome ... :/ but ideally use genprof to
create the initial profile, switch it to complain mode and then run
aa-logprof as you use the program for a while.
2074[23:13:23] <mrkramps> H-var, you need to install third party
app for gui
2075[23:13:25] <ratrace> f8e4: but you easily turn it into a
blacklist.... deny first things you wanna deny, then do a blanket
allow on /** mrwxk ---- and EEreplaced-url
2076[23:13:50] <f8e4> np yo ty
2077[23:14:07] <ratrace> f8e4: with AA profiles, things that are
denied first, cannot be allowed later, thus a blanket allow on /**
2078[23:14:28] <f8e4> thats a good idea; i will give it a try
with genprof
2080[23:14:55] <ratrace> f8e4: the power (and price in time
taken) of AppArmor profiles is that you can finetune exactly what
it's allowed to do
2081[23:15:24] <ratrace> and with upcoming versions, there will
be much bigger dbus policy capabilities, and maybe even more network
capabilities like ip matches etc...
2082[23:15:39] <f8e4> yes ip:port only specific
2083[23:15:41] <ratrace> f8e4: and you can also combine with
systemd units for namespacing and seccomp filtering.
2084[23:15:49] <H-var> mrkramps razergenie? I installed it and
there's literally only one option - to enable or disable the
razer led logo :DDDDD
2085[23:15:52] <ratrace> f8e4: afaik, ip:port is not yet
available in Buster's AA
2093[23:18:05] *** Quits: con_ (~con_@replaced-ip) (Remote host closed the connection)
2094[23:18:11] <Peyam> I have problems with black screen from
resuming on my computer and I have to restart lightdm service and it
closes all of my applications
2096[23:18:25] <ratrace> Peyam: the two are different programms,
you don't replace one with another
2097[23:18:42] <c077ee> I have a debian /etc/apt/preferences file
and I want to specify a single package to come from a custom
repository:
replaced-url
2098[23:18:45] *** Quits: coot (~coot@replaced-ip) (Remote host closed the connection)
2099[23:18:52] <c077ee> I am a little confused on how the syntax
here would work.
2101[23:19:22] <ratrace> c077ee: you read that apt pinning wikis,
manpages?
2102[23:19:26] <ratrace> *the
2103[23:19:45] <c077ee> Yeah I am reading through the wiki entry
at the moment.
2104[23:19:59] <c077ee> My only concern here is I want to pin
directly to this URL and not just the domain
2105[23:20:07] <Peyam> ratrace, so light-locker should be
replaced with lightdm or lightdm+greeting with xscreensaver?
2106[23:20:08] <c077ee> Which the entries seem to specify, maybe
I need to scan further through it.
2107[23:20:57] <ratrace> Peyam: lightdm is a display manager.
xscreensaver is not. the two have similar APPARENT functionality in
that at some point they require you to input your credentials to
continue. that is all.
2156[23:29:32] <ratrace> Peyam: if it complains about specific
firmware files it fails to load, you use apt-file to find the
package that provides it, then install it, then reboot
2157[23:30:03] <c077ee> I managed to fiddle around with the
pinning using a custom Pin: origin a=obs://build/... pin
2158[23:30:07] <c077ee> That ended up working out.
2159[23:30:26] <Peyam> and you saw it because it is right below
the vgaarb right?
2160[23:30:43] <ratrace> c077ee: it's a slipper slope, apt
pinning. guys here will be quick to slap a frankendebian factoid
when someone mentions it :)
2162[23:30:56] <ratrace> Peyam: I saw it because I looked for the
phrase "firmware"
2163[23:31:06] <Peyam> aah okey.
2164[23:31:11] <ratrace> i915 firmware is related to the intel
GPU
2165[23:31:21] <Peyam> ahh
2166[23:31:24] <Peyam> awesome. thanks
2167[23:31:25] <mrkramps> c077ee, is it worth all the work?
lutris already landed in testing
2168[23:31:31] <c077ee> Yeah I have been using debian for 16
years at the moment. I ended up just fiddling with it till it worked
out. I don't come on the IRC that often because it has way too
much chatter.
2169[23:31:38] <c077ee> Lutris is broken at the moment at least
for my configuration
2170[23:31:58] <c077ee> I mentioned it directly to the lutris
devs, they aren't respecting the config file and a lot of
issues in the latest update seem to have borked things.
2171[23:32:01] <Peyam> so you use apt-file i915? I though you did
apt+cache search
2193[23:40:04] <freem> I have used line-mode, make the sed
expression easier
2194[23:40:29] <freem> pv have it's stdin block-buffered it
seems
2195[23:40:50] <freem> even with the -l option
2196[23:41:02] <ratrace> I can't picture using debootstrap
with pv ... how exactly are you doing that? and to what end? not as
if you can know total size it'll output to have a meaningful
progress bar
2197[23:41:17] <freem> but you can.
2198[23:41:40] <ratrace> what, you counted a typical deboostrap
output and are using that?
2199[23:41:43] <mrkramps> hm, --no-splice might help
2200[23:41:48] <freem> requires summoning it multiple times, of
course, and there is an initial step I have yet to avoid doing
several times
2201[23:42:35] <freem> I'm working my way to have a better
progression indicator in debootstrap yes
2219[23:48:45] <ratrace> freem: you can alter the buffer size.
the manpage says it's quite a large default if it can't
detect from the filesystem, which it can't if you pipe to it
2228[23:51:56] <ratrace> I keep auth on port 25 because it's
a server and config and clients I drag since late 2010s... back then
things were.... different.
2229[23:52:23] <ratrace> no, since _before_ 2010 ...
2230[23:52:33] <ratrace> late ... first decade ... gah...
whatsitcalled...
2231[23:53:14] <freem> millenium?
2232[23:53:18] <sig_9> what version of Plasma will debian 11
stable have?
2233[23:53:38] <ratrace> meh wrong chan for what I posted....
damned alt-#