Ask Ubuntu General Room

of restricting what can actually access the port, at the router, or at the firewall, and you ahve to know the IPs offsite you want to have access to the port

Kaz Wolfe

@Zacharee1 Okay.... What exactly are you trying to do?

Zacharee1

u ok

Thomas W.

@KazWolfe want me to summarize better?

Kaz Wolfe

12:30 AM

@ThomasW. Please. I'm curious now.

Zacharee1

he might be better at it :p

knows more about my situation than I do

Thomas W.

Zacharee is trying to expose multiple web services to the 'net via one 'web gateway' box which will handle routing of traffic from outside -> in for web requestsw

one of the things he wants to serve securely is an IP Phone's management interface

which resides inside the network

Zacharee1

and that's proving to be a very fun (read: ANNOYING) project

Thomas W.

he's tried PHP proxying which doesn't work right, and is almost out of options

Kaz Wolfe

okay.

why is he using nginx at all?

Why not just have a VPN coming in or something?

Zacharee1

12:32 AM

I do

Thomas W.

you are impatient

Zacharee1

This is something I want to do

Thomas W.

i wasn't done :)

Kaz Wolfe

sorry. continue please

Thomas W.

he's trying to remove VPN from the equation, to make it work so he doesn't have to work with poor-quality VPN systems which are set up and available on his network already

Zacharee1

12:32 AM

plx

Thomas W.

^ as i said, poor-quality

Zacharee1

@ThomasW. not trying to remove, just being superfluous

Thomas W.

@KazWolfe similar to how I run my gitlab instance at home - a gateway box at nginx handles incoming web requests, proxy_pass's as a reverse proxy to the internal box

that way those boxes aren't directly exposed to the 'net

Kaz Wolfe

ah k i getchu now.

so what's considered "secure"?

Thomas W.

@Zacharee1 well, if the reverse proxy doesn't work, and the PHP proxy doesn't work, the only options left to you are use the VPN only, or try and lock down access to known off-site IPs and port-forward right to the thing.

but that's got its own host of problems if the remote IPs are dynamic IP ranges, or unknown

Zacharee1

12:34 AM

eww

@KazWolfe not having a JS login script exposed to the web

Kaz Wolfe

js... login... script?

Zacharee1

It does block source viewing

@KazWolfe take it up with Yealink

CHEAP IP Phone

CHEAPEST

Kaz Wolfe

um.... and how would you consider doing authentication on the reverse proxy?

Thomas W.

@KazWolfe he wants the JS to be hidden and not exposed

because the JS has hardcoded creds

Zacharee1

yesh

Thomas W.

12:36 AM

the problem is

that's not able to be done without really complex coding that you'd pay a developer for

Kaz Wolfe

why not just set the server to use HTTP Basic, then? I think that works with proxy_pass

Zacharee1

There's gotta be a way to do some sort of reverse proxy

Seth

Target is selling the DJI Phantom 3 now.

Zacharee1

@KazWolfe wat

Thomas W.

@Zacharee1 HTTP Basic Auth at NGINX with the reverse proxy, but the JS is still exposed if people can get past the passcodes

Zacharee1

12:37 AM

The problem with reverse proxy is that if the remote site uses relative links...

Kaz Wolfe

it will work just fine with relative links.

Thomas W.

^ that

Kaz Wolfe

Absolute links may give you trouble, but I think you can rewrite

Zacharee1

then why doesn't it

Thomas W.

@Zacharee1 PHP, JS, evilness, things we can't really elaborate on

Zacharee1

12:38 AM

You mean like PHP and JS?

Kaz Wolfe

I see HTTP Basic Auth as being the easiest way to at least hide it.

Thomas W.

@Zacharee1 i knwo this is a little 'fun project' but I'd be giving up at this point because unless you're an experienced developer you're not going to really be able to solve this

Zacharee1

I can hide it?

Kaz Wolfe

Find some way to rate limit (fail2ban?)

Zacharee1

blegh

Kaz Wolfe

12:39 AM

Yeah. If HTTP-Basic doesn't solve your problem, just use a good VPN.

Thomas W.

@Zacharee1 this is the type of thing that falls under "Should only be accessible internally or over a VPN"

like half my network lol

Kaz Wolfe

^^^^^^^^^^^^^^^^^^^^^^^^^^

Zacharee1

sigh-eth

hmm

Kaz Wolfe

What's wrong with OpenVPN?

Thomas W.

don't think he wants to configure an openvpn server by hand heh

Zacharee1

12:41 AM

I use L2TP

Can never figure out OpenVPN

Thomas W.

eww L2TP+IPSec

that's Cisco tech

Kaz Wolfe

^

Zacharee1

OpenVPN just doesn't work

@ThomasW. at least it isn't Belkin/Linksys

Kaz Wolfe

I've tried L2TP and I've given up. OpenVPN is buttery smooth compared to the pain that is otherwise.

Zacharee1

Smart WiFi

Kaz Wolfe

12:42 AM

Whenever IPSec gets involved, things get far too complicated for the needs of what I'm doing.

Thomas W.

@Zacharee1 parents ahve a linksys router here

Zacharee1

@KazWolfe I can never get OpenVPN to bridge to my network or anything

Thomas W.

it's going to get replaced with a pfSense firewall + Wifi AP once i replace the ones at my apartment :P

Kaz Wolfe

Wait hang on.

Zacharee1

it just isolates every client no matter what I change

Kaz Wolfe

12:43 AM

@Zacharee1 Are you sure the password is in a JS file validated client-side?

Zacharee1

I have no idea

I can't even view the source until I've logged in

Kaz Wolfe

wireshark that puppy

Zacharee1

ew+

Kaz Wolfe

hey, i give solutions.

openvpn.net/index.php/open-source/documentation/miscellaneous/…

if you guess at security, you deserve whatever happens to you

Zacharee1

I've looked at that

nu worky

Kaz Wolfe

12:46 AM

It needs its own dedicated card, IIRC.

Zacharee1

oh, well

can't do that

Kaz Wolfe

but i digress. If I read a thing properly, the password isn't stored in a JS file.

It's stored in some XML file on the server.

Zacharee1

for IP phones?

Kaz Wolfe

If that's validated server-side, you can just deny all for that XML file.

yeah. your PBX server that hosts the ACP

Zacharee1

wat

Thomas W.

12:49 AM

@KazWolfe some IP phones can operate in standalone

and run everything on its firmware

which he won't have access to

Zacharee1

yep

Thomas W.

the more I think about it, the project is unachieveable

Kaz Wolfe

Wait, there isn't a central PBX server?

Thomas W.

@KazWolfe you're thinking the corporate version of IP phones

they make consumer-grade IP phones that don't require the central PBX

Zacharee1

It can read files from a server, but it's only getting some config files for forwarding

Kaz Wolfe

12:50 AM

ohhhhh.

Zacharee1

@ThomasW. this is below consumer-grade :p

Kaz Wolfe

So there's an ACP on each individual phone?

again, i'd check that the password is actually validated server-side.

Because if it is, you just need to deny access to the file that contains it, then.

Well, no. He can Wireshark that info out

@ThomasW. I mean the proxy.

Thomas W.

is still tired

ah OK

tiredness begets confusion, my apologies

Kaz Wolfe

Because if that is the case, then the problem is more-or-less solved.

But a VPN is still the best solution to this problem.

Thomas W.

it is

and if that's not a satisfactory solution, then you're out of options

Kaz Wolfe

12:54 AM

And the least convoluted/likely to break/whatever

Thomas W.

god, I seriously love having two hypervisors, now I can do distributed services on different IPs, and truly have fine-grained control on access-to-services ^.^

still needs the third BEHEMOTH hypervisor he has planned

Kaz Wolfe

Yeah. If you're reverse proxying to access internal resources, you're doing something very wrong.

Plus you're opening up a MASSIVE security hole.

Thomas W.

@KazWolfe Happy to argue with you on this in a civilized way on anoyher day

complete with data flow diagrams

network diagrams, configuration diagrams

the whole 9 yards :p

but not tonight

Kaz Wolfe

taking about Zach's problem.

Thomas W.

i know :)

but only in very rare circumstances should you be exposing anything to the Web, via reverse proxy or not

an IP phone should never be internet-facing :p

i need a drink... (brb, coffee run)

Zacharee1

1:02 AM

This one's example actually worked: benalman.com/code/projects/php-simple-proxy/docs/files/…

Kaz Wolfe

WTF.

reddit.com/r/aww/comments/4posra/… (language, NSFL)

Zacharee1

L?

Kaz Wolfe

Life

Zacharee1

ohh

lol

Intel got Jim Parsons to be in one of its ads

Edity

1:25 AM

lucky

Zacharee1

are you like the semi-relevant to completely irrelevant image bot or something?

Severus Tux

Hello everyone :D

Mateo

Wow, they are really blazing on the snap front: blog.dustinkirkland.com/2016/06/… < make your own snap store!

2

edwinksl

@NathanOsman forums.comodo.com/…

Severus Tux

does anyone know how to set depth is HTTracker (Website copier) ? I started to download Arch-Wiki , I left it for whole night and its still not finished ! ,

Edity

1:48 AM

Intestines Inside

TheXed

OH!!! Someone make a t-shirt!

Zacharee1

EXTREME noob alert: askubuntu.com/questions/791157/…

Journeyman Geek

or troll

Zacharee1

You'd better not mean me :p

TheXed

wait are you saying that the person that answered the question is a extreme noob? that @Zacharee1 guy...

Zacharee1

1:57 AM

@TheXed click it again, smart*ss

well that was a fail censor

TheXed

lol

Journeyman Geek

yeah, problem.

@Zacharee1 I get reminded of the great and glorious I accidentally rm -rfed my company question

Zacharee1

WAT

oh

I thought you meant you!

TheXed

Anyone trying for ubuntu membership?

Zacharee1

quotes, quotes are important

Journeyman Geek

2:00 AM

122

Q: What to do with the "rm -rf" hoax question

It turns out the the recent question regarding the misuse of rm -rf in Ansible was actually just a hoax (English) in some kind of viral marketing effort. It become quite famous on various media and gathered a large number of views. Since I don't think we should allow ServerFault to be abused in...

discussion

Zacharee1

@TheXed meh bc am trusted membr uv unbootu

Journeyman Geek

u boot who?

TheXed

@Zacharee1 is that English?

Zacharee1

Unbootu

@TheXed iz derp lengwej

TheXed

@Zacharee1 I digress...

Zacharee1

2:02 AM

yesh?

would you rather egress?

TheXed

you are creating a mental vacuum.

Zacharee1

shooop

Since the almighty Kaz isn't currently here, I need to fill in

TheXed

what video game should I play tonight? Civ V, Super Smash Brothers Wii U, Legend of Zelda: Twilight Princess HD, or Super Mario 3D World?

edwinksl

none of the above

play slither.io instead

Anonymous

evening all.

Anonymous

2:17 AM

So, I love Chromium after using it for just one day

Anonymous

- The extensions/app store is much more active and nicer looking than Firefox's
- One process per tab, app, etc
- The web just looks nicer now.. because webkit.

edwinksl

the one process one tab thing is coming to firefox too right?

last i heard you can get it in firefox beta if you are curious to try

Anonymous

Yes, so FF48

Anonymous

However, FF will liekly not move to webkit, which powers every other main browser -- chrom*, opera, safari.

Journeyman Geek

@onebree having more than one renderer is a good thing ._.

Anonymous

2:21 AM

Mozilla is working on Servo, a webkit browser, but I read from a project maintainer that it is strictly research, and will likely not go anywhere in production. And that Mozilla is focusing so much on FF browser, since that's all they have left

Journeyman Geek

and I don't just mean edge

Anonymous

I mean, two engines are great and all, but if a site has prefixed attributes, it is likely JUST -webkit*, and not also -moz*.

Anonymous

@Zacharee1 mentioned that bootstrap has both; however, sites like Bootswatch, which supply bootstrap-based themes, only have webkit support.

edwinksl

@JourneymanGeek btw any idea how to get MRU tabs that actually use ctrl+tab as shortcut in chrome?

Journeyman Geek

I don't run chrome

edwinksl

2:23 AM

:(

Journeyman Geek

No oneliner ;p

Anonymous

@edwinksl what are mru tabs?

edwinksl

Most Recently Used tabs

Journeyman Geek

there seems to be a plugin for it?

edwinksl

in chrome? most are broken last time i tried...

Anonymous

2:26 AM

what is it you want? A list of recent tabs?

Journeyman Geek

Beats me. I don't run chrome

Anonymous

@JourneymanGeek you're a ff guy?

Journeyman Geek

He wants ctrl tab to go by which was most recent rather than the order the tabs are in

yup

Anonymous

@JourneymanGeek why

edwinksl

@JourneymanGeek there is a long history behind people asking chrome for built-in MRU tabs but it was never delivered. so i was hoping maybe you had a trick or two that few know about ;)

Journeyman Geek

2:29 AM

@edwinksl alas, no

Anonymous

@edwinksl updated three months ago: chrome.google.com/webstore/detail/ctrl%2Btab-mru/…

Journeyman Geek

@onebree addons.mozilla.org/en-US/firefox/addon/prospector-oneLiner this

Anonymous

@edwinksl updated two days ago: chrome.google.com/webstore/detail/recent-tabs/…

Anonymous

@JourneymanGeek that's the reason you use FF?

Journeyman Geek

@onebree yup

Anonymous

2:31 AM

I mean, I have a 22in screen, so I can't complain about space

Journeyman Geek

I have a a pair of 27 inch UHD screens....

Anonymous

then why do you need more space?

Journeyman Geek

Why would I want to waste space?

edwinksl

@JourneymanGeek that explains the ridiculous tiling of SE chats you showed once

Journeyman Geek

@edwinksl oh, that is handy

Anonymous

2:33 AM

I miss the firefox groups feature, I will say

Journeyman Geek

I was dealing with people being dumb in two different channels

Anonymous

one window and 4 groups, each with 50+ tabs... amazing

Anonymous

And I am sure there is an add-on for one-liner nav in chrome.

Journeyman Geek

so, here, the other channel, seekrit mod room...

@onebree if you can find it, I can try it.

Before oneliner I used a similar addon called mongoose, which seems gone.

Anonymous

@JourneymanGeek let me just reqrite the mozilla add-on to work with chrome....

Anonymous

2:35 AM

IDK what to google for even, so I cxannot help. Maybe try the chrome irc channel or reddit?

Journeyman Geek

looool

There's even a SR.se question I think

3

Q: Oneliner style addon for chrome

I'm a massive fan of Oneliner - its an addon for firefox that compacts all the controls into one line. I use it with a few tweaks (with the current Australis theme - there's no firefox button so I've moved over the download and bookmark buttons to the left. I basically need a theme, addon or som...

chrome

tbh a australis oneliner addon would be nice too

Anonymous

I think you should ask on reddit or irc...

edwinksl

reddit didn't like it reddit.com/r/chrome/comments/4o0hdk/…

Journeyman Geek

bleh.

Anonymous

okay, night all! Just wanted to say hi for the day!

Anonymous

2:40 AM

i got a test on a saturday morning (not the SATs), so I need sleep!

edwinksl

see you :D

@Zacharee1 i feel you are getting trolled by the OP about the GRUB question

Seth

this is...

Authoritarianism: The political science that explains Trump

►

disgusting, I guess.

Intrus

2:56 AM

Hello, I am pretty sure that my Ubuntu just got hacked

Journeyman Geek

back up, nuke, rebuild, forensicate ._.

Intrus

Ahhh, how could that happen :(

Processes run by whoopsie, avahi, nobody, rtkit... awesome.

Journeyman Geek

3:18 AM

@Intrus do you have a root account?

Intrus

@JourneymanGeek I don't think so.

Journeyman Geek

ah

that rules out someone brute forcing your root account. (Other accounts? I donno)

Intrus

It must have happened very recently, I looked at auth.log and there were weird things from this night :(

Journeyman Geek

ah, check which account

and key based auth for SSH is always a great idea

Intrus

Well, I did not change anything I have user account and I am only root when I use sudo...

Default cinfiguration of ubuntu

Of course I have user account but I don't log in as root

I do have root account *

I am just shocked and confused right now, sorry :D

Journeyman Geek

3:25 AM

Its natural ;p

I had that happen myself

Intrus

Is it safe for me right now to use live usb??

Journeyman Geek

yeah, probably

Intrus

I will just change my important passwords

Well, I think that they are still trying to connect

@JourneymanGeek Oh no, they run processes even if I am in live usb, I am screwed.

Journeyman Geek

@Intrus that's... wierd

Intrus

As soon as I connect to internet

@Yes, it os

Seth

3:39 AM

what kind of processes?

Intrus

Avahi.daemon:running

whoopsie

Seth

sigh

those are system processes.

Journeyman Geek

lol

Seth

252

Q: What is the 'whoopsie' process and how can I remove it?

On one of my machines I have a process running called "whoopsie". I'm running 12.04 server and never specifically installed anything with this name. Google seems to imply that it has something to with error logs but I'm not finding too much information. The fact that I didn't manually install it...

apport error-handling whoopsie

Journeyman Geek

avahi is fine.

Seth

3:43 AM

19

Q: How can I disable avahi-daemon?

How can I disable avahi-daemon and can you explain to me how it runs if it appears as a service but it itsn't in rcN.d? You can stop reading here. In fact, please do unless you want to TEACH a noob some Ubuntu. The question above should be clear enough to be answered. The rest is just me calli...

services upstart

Intrus

Oh God...

:D

I have never seen it before, so I just assumed, that must be an attack...

Seth

@Intrus I'm not sure any of your examples were malicious..

56

Q: What is the purpose of the 'nobody' user?

After I read List all human users I noticed that there is a user account named 'nobody' in my Ubuntu system. Also I noticed that I can login in this account from terminal using the following command and my password: sudo su nobody It doesn't mind me at all, but I want to know what is the p...

users username switch-user

launchpad.net/ubuntu/+source/rtkit

Of course they could be malicious processes masquerading as good ones, but without some other kind of evidence there is no reason to believe so. (what's the ubuntu equiv. of sfc?)

Intrus

@Seth @JourneymanGeek thanks, I was just too shocked to google by now :D :D

Seth

@Intrus Always Google :)

it can save you quite a scare hehe.

Intrus

@JourneymanGeek They appeared just too often

Journeyman Geek

3:50 AM

@Intrus clearly I didn't ask the right questions.

I did think it was odd when you got suprised by avahi

It lets you do hostname.local hostnames in your lan

Intrus

@Seth Yes, I know, I was about to do it... Just the schock and it's 6 am here :D

Seth

Aha! debsums.

Intrus

@JourneymanGeek what's the ubuntu equiv. of sfc? What do you mean?

@JourneymanGeek The processes stopped almost entirely, they just appeared too much before, the fact that one update failed recently might be the cause, I rebooted and it looks fine more or less.

Journeyman Geek

there isn't one

I think

Seth

@JourneymanGeek friend of mine says debsums

Intrus

4:04 AM

@JourneymanGeek Ok, debsums are running.

Intrus

4:28 AM

@JourneymanGeek It looks fine, but I still think that it was really weird...

Seth

heh, weather.com says my Chromium 50 is outdated and no longer supported.

edwinksl

53 here ;)

Seth

4:44 AM

okay so that's weird. Some people I know have an email.com email address, but that is just a parked page... however I know the email (used) to work. Weeeird.

edwinksl

who needs that when i can get this startrekemail.com

Seth

5:00 AM

hey, that's neat.

Edity

5:23 AM

samsung kies is pretty neat

but my usb is the oppisite of neat= weak

Seth

5:45 AM

New Rick Astley song

Rick Astley - Angels On My Side

►

edwinksl

risky click

Seth

loving his return with soul.

@edwinksl it's legit.

edwinksl

i was thinking it might be an elaborate rickroll

Seth

nope :)

edwinksl

Trypticon86 days ago
HE DIDN'T GIVE UP. A MAN OF HIS WORD
Reply123

true, i suppose

Seth

5:50 AM

He hit #1 in the UK again just a few days ago.

@edwinksl hehe

Ubuntu Questions on U&L

6:39 AM

0

Q: How to serve multiple ASP.NET applications on multiple mod-mono-server4 Linux process domains?

I would like to know how to serve multiple ASP.NET applications on multiple mod-mono-server4 Linux process domains. I am running Ubuntu 16.04 on a Lenovo ThinkStation desktop. Here is how I plan to serve multiple ASP.NET applications on multiple mod-mono-server4 Linux process domains Put the ...

ubuntu systemd apache mono

Transcript for