Charcoal HQ

Undo

21:01

Try now, @ArtOfCode. That default_server thing might be it after all

11

A: How to define which SSL certificate nginx sends first with SNI?

The default_server setting of the listen directive should determine which certificate is sent for a request without SNI set in the handshake. Change the listen directive of the desired default: listen 443 default_server ssl;

Thomas Ward

well

there's two problems to consider:

ArtOfCode

@Undo re-enable the redirects so it's consistent?

Thomas Ward

(1) NGINX Configured SSL Certificate for that server_name / server block

(2) SNI support in the library used for SSL connectivity

Undo

@ArtOfCode Already did

ArtOfCode

cool

Undo

21:02

@ThomasWard Library doesn't support SNI, trying to set default cert.

Which I think I did

SmokeDetector

[ SmokeDetector ] SmokeDetector started in reverted mode at rev 63050bc (SmokeDetector: Auto blacklist of facebookscraper\.net by Magisch --autopull) (running on ArtOfCode/EC2)

Undo

Looks like it works

Thomas Ward

@Undo default_server won't help if server_name is captured by another block

ArtOfCode

yep

SmokeDetector

Restart: API quota is 5628.

Thomas Ward

21:02

it may work but it's probably a 'hack' to make it work

the only other way to do it is to serve the same cert for everything (multidomain)

ArtOfCode

!!/master

SmokeDetector

[ SmokeDetector ] SmokeDetector started at rev 288080b (Undo1: Temporarily remove websocket error handling) (running on ArtOfCode/EC2)

Undo

@ThomasWard Not really an option.

Thomas Ward

then you're stuck having to work with SNI

Undo

I think we got it figured out now

Thomas Ward

21:03

that's more or less a limitation of the SSL wrapper in use and that library than your nginx configs.

SmokeDetector

Restart: API quota is 5626.

Thomas Ward

cool.

Ferrybig

@Undo you can quickly check the default cert by going to the ip domain https://54.236.78.156/, and that checking what certificate is giving the problem

SmokeDetector

CI on 9dfa76f succeeded.

Thomas Ward

I'd suggest upgrading that system to a newer Python 2.7 though for SNI. (This is something I get yelled at about, lol, by 'newbies' to web sites)

wait

Undo

21:04

!!/pull

Thomas Ward

@ArtOfCode what Ubuntu are you using?

Undo

14.04

SmokeDetector

[ SmokeDetector ] SmokeDetector started at rev 9dfa76f (Undo1: Revert "Temporarily remove websocket error handling") (running on ArtOfCode/EC2)

ArtOfCode

@ThomasWard Yeah, it's an Ubuntu 14.04 system, on 2.7.6. I'd have to tamper with system Python.

SmokeDetector

Restart: API quota is 5620.

Thomas Ward

21:05

@ArtOfCode I assume upgrade to 16.04 isn't an option

or containerizing the bot within a 16.04 container (which has newer python)

ArtOfCode

Default on 16.04 is 2.7.12 by the looks

Undo

I already tried that. 16.04 is basically horrible.

Or at least it borked all my stuff.

ArtOfCode

@ThomasWard I doubt I have the resources to do that

The 16.04 upgrade... in theory, it should be fine

Thomas Ward

looks at the myriad of servers he has I might be able to loan / donate some resources from a 16.04 server if we really need that level of support

ArtOfCode

but there is the matter of breaking things

@Undo do you know exactly what it broke? If I don't use whatever thing it broke, then I should be safe to upgrade

Undo

21:06

@ArtOfCode Something with how disk writes were handled didn't sit well with MySQL.

Ferrybig

ProTip: make a backup of your server before you update, in case things go wrong

Undo

MS load times jumped about an order of magnitude because of it

ArtOfCode

I'd rather not have to explain to the university how one of their now-essential web services is down for an indefinite period because I upgraded the system to support a spam detection bot...

Undo

@ArtOfCode yeah, not worth it :P

At some point I need to fix that Pi and take it back, too

ArtOfCode

@Ferrybig I'll just scp my workspace onto local

@Undo If that's it... then I should be okay to upgrade

Ferrybig

21:08

I also have a Digital Ocean server that I'm upgrading at the moment to the latest Ubuntu, lets see if things break for my non-essential server

ArtOfCode

I don't use MySQL in... anything

@Ferrybig that would be useful

Thomas Ward

@ArtOfCode @Undo I think I have a mostly unused VPS if we need a spare 16.04 system for Smokey

if you need it

ArtOfCode

I guess I should probably notify someone before I knock the server out for any significant downtime

Undo

@ThomasWard Thanks! Will keep you in mind if we end up needing it, but right now it seems to be working

Thomas Ward

yep, let me know (even if we need third-level failover)

Ferrybig

21:09

I can remember the joy of updating my PI to the latest release, compared to Ubuntu, that gave a lot of throuble

ArtOfCode

@ThomasWard looks like it's working at the moment

Undo

SNI is a fairly small thing, and it's not like Smokey is doing anything we need great security for.

Now, if we were to have deeper integration with SE, that could change quickly.

Thomas Ward

ooh fun i forgot I had weekly security updates on this VPS...

ArtOfCode

It can be fixed without skipping security checks on my side, so I'm happy for now. I'll do the release upgrade at some point soonish so that we can actually support SNI properly

Ferrybig

@Undo Just wondering, does the SE realtime websocket also require SNI?

Thomas Ward

21:11

@Ferrybig anything that's one IP address to many hostnames would need SNI web-server side and library handling side

StackExchange certs thoug are fun, they have multidomain out the wazoo

which is the other way around SNI problems

(and has its own myriad of evils)

ArtOfCode

In theory they have certs for the main sites, though they break sometimes

Meta sites have no certs at all

Ferrybig

With IPv6 coming up, we can give every server its own IP, and migrate the problem of unsuported SNI

Jan Dvorak

Did I just hear "myriad of evils"? *ears spring up*

Yeah, IPv6 has been coming up for years. Still nothing.

Undo

@ArtOfCode meta.stackoverflow.com does

Thomas Ward

so does meta.askubuntu.com, with a *.stackexchange.com cert

Ferrybig

21:21

@JanDvorak I have a public IPv6 address already, for a very long time already

Undo

lucky

Jan Dvorak

Worst case there are IPv4 tunnels I could use

ArtOfCode

@Undo oh, the sites on their own domains do, yeah

Ferrybig

a whole public /48 block of addresses, the real deal

ArtOfCode

Think that'll get the message across? :)

Jan Dvorak

21:23

For some, nothing will :)

ArtOfCode

And those some are going to lose their work when I kill the server without warning :)

I'll push that live in the morning

Andy

@ArtOfCode Personal experience says that you shouldn't.

ArtOfCode

@Andy I am a CS student.

I really don't trust 'em :)

I know what they're capable of

That said, I do have their personal details and significant amounts of work... which might be a good deterrent to funny business :)

Andy

I was a CS student and a manager at the University's helpdesk. I saw it from both sides. :)

ArtOfCode

I believe they've already got me slated for an IT help position later in the year

Ferrybig

21:29

Rermber, if you have mysql stopped before you upgrade to the latest ubuntu, you are going to get a problem with PhpMyAdmin

ArtOfCode

I have neither of those things

well, I probably have mysql, but it's not used for anything

and I definitely don't have PHP

Jan Dvorak

Ruby or Python then?

ArtOfCode

It's a Rails app

Rails with SQLite served by Puma.

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in link text in answer: Raspberry Pi 3 Windows IoT Core by Jonathan M on raspberrypi.stackexchange.com

ArtOfCode

Which is probably fairly insecure, but... meh. Given that I can nuke the server from orbit and still be back online within 10 minutes or so...

Tim Stone

21:39

@BrockAdams I think maybe they're somehow intending to use Stack Overflow questions for some extra purpose? But it's not clear, I'll give them some time to respond first and see if they have a satisfactory explanation

Ferrybig

After upgrading Ubuntu, I see that had to reinstall mysql because conflicts in the config file that I didn't want to take time to fix, I also need to update my tmux config file because something's changed with mouse mode

Thomas Ward

@ArtOfCode FYI: BACKUPS BACKUPS BACKUPS

sysadmin 101 :P

ArtOfCode

@ThomasWard 24-hour rolling backups, yeah.

Thomas Ward

better that than none :P

SmokeDetector

fp- by DavidPostill

ArtOfCode

21:45

@ThomasWard that's what I'm doing at the moment

Thomas Ward

@Undo if you need the server, let me know, the only thing running on it has been moved to a different system, so it's free for boot-and-nuke and then setup for whatever Smokey needs, if needed.

(it was a python script lol)

ArtOfCode

Someone else is gonna need to host Smokey at some point after 2200 UTC tomorrow, while I upgrade

Thomas Ward

want me to boot and nuke it now and get you access creds?

ArtOfCode

@angussidney, will you be around from 2200 UTC, or is that still the middle of the night for you? Sounds like a chance to test your setup

@ThomasWard lemme get back to you on that one

Tim Stone

Someone sent a test comment flag, hmm. Who to blame, who to blame

Thomas Ward

21:47

cool. I'm gonna boot and nuke anyways, force of habit whenever I repurpose servers :P

!!/blame

SmokeDetector

@ThomasWard It's Andy's fault.

Thomas Ward

bleh

ArtOfCode

If angus is around, then it's a good chance for him to check his setup works

If not... I might need it, unless I can find something else to host on

Thomas Ward

well it's free for use, paid up throuh April 22nd so :P

arda

@ArtOfCode I can host it if you want

ArtOfCode

21:49

@arda thanks, but that'll probably be a last resort given that you don't have all the creds and integration keys

Oh wait, I can host it locally while I do the work. Crisis averted :)

Thomas Ward

heh

Ferrybig

@ArtOfCode While I don't have the keys, I know I can get smokey quickly up and running if its need to be (did it yesterday to implement the HB packets)

ArtOfCode

Heh. Sounds like we've got plenty of people who can run it if we need

arda

I can just spin up a VM with your ssh pub if you want, lol.

Thomas Ward

@ArtOfCode i'm nuking the server and rebuilding it right now, happy to give you access if absolutely needed, but i'll prep in the mean time

sd why

SmokeDetector

21:52

@ThomasWard [:33593982] Body - Position 1039-1047: texts.io

CaffeineAddiction

at this rate Smokey will have its own botnet

... skynet all over again

Thomas Ward

@SmokeDetector fp-

arda

@CaffeineAddiction but with less spam

Thomas Ward

@CaffeineAddiction lol

CaffeineAddiction

Smokey decides to end spam by ending all life on earth ... sounds effective

ArtOfCode

21:53

@arda I do appreciate the offer, but I'd rather run it on something I have full control over if that's possible :)

CaffeineAddiction

the birth of skynet

Thomas Ward

@ArtOfCode now that I understand

ArtOfCode

And I should be able to localhost it, so that'd work

Thomas Ward

@ArtOfCode barring that, or if you guys need another failover solution for critical evils, let me know, the server'll be there if needed :)

(currently at 99.9958% uptime the past five weeks lol, I rebooted for kernel repair 5 weeks ago and only turned it off once to unstick a process that has since been destroyed)

ArtOfCode

Will do. There's always times when Smokey breaks and goes offline entirely, at which point someone just picks it up for a few hours until whoever's hosting it can fix things

Thomas Ward

21:55

indeed.

arda

@ArtOfCode well that's pretty much what I meant (full control, except physical access). I always have spare msdn $$$ on azure.

ArtOfCode

@arda Sure, but given that it's your server, you have final control over it :)

Thomas Ward

purely curious, do you need v6 or just v4 for the sockets?

arda

Not if I create it with your ssh public key. Then I have no access over it.

ArtOfCode

Not a clue. They run on v4 at the moment, but I don't know if they would work on v6 or not...

Undo

21:56

@ThomasWard awesome, thank you! :)

ArtOfCode

@arda Aye, but you can kill it from the web console

Ferrybig

@ArtOfCode They wouldn't metasmoke is IPv4 only, Se is IPv4 only too

Thomas Ward

@Undo you're most welcome

Undo

@ThomasWard qa.sockets.stackexchange.com has no AAAA record, so just IPv4

And metasmoke is on EC2, which is v4 only

Thomas Ward

cool, IPv6 is off on this thing anyways except for the ubuntu repositories

(thoug they'll be IPv4-only once i switch it that way after install)

@Undo out of curiosity where do you pull nginx from, repos, build from source, or the PPA that I help maintain

Undo

22:01

@ThomasWard I just ran apt-get install nginx

Jan Dvorak

I would be surprised if Win10 didn't support IPv6, but my ISP still keeps saying nobody will ever need IPv6

Undo

your ISP is wrong, as ISPs tend to be

heck, no one should ever need more than 4294967296 addresses.

Thomas Ward

@Undo ah the repos then.

cool they're relatively up to date :)

Undo

Yep

Thomas Ward

Ubuntu?

Undo

22:03

14.04, yep

arda

Ugh, there is no ipv6 in general in turkey :/

Thomas Ward

wait, 14.04?

there's no 1.10.x in 14.04

i would know, my bootprints are all over that package in 14.04

Undo

@ThomasWard Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 3.13.0-91-generic x86_64)

Thomas Ward

1.10.1 in the stable PPA for 14.04, so maybe that

which reminds me i have to update that to 1.10.2

E:Slow

Undo

@ThomasWard Yeah, 1.10.1

Thomas Ward

22:05

@Undo any chance of seeing apt-cache policy nginx output?

because NOW I'm curious

:P

Undo

nginx:
  Installed: (none)
  Candidate: 1:1.10.1-8.5.0.30~trusty1
  Version table:
     1:1.10.1-8.5.0.30~trusty1 0
        500 oss-binaries.phusionpassenger.com/apt/passenger trusty/main amd64 Packages
     1:1.10.1-8.5.0.29~trusty1 0
        500 oss-binaries.phusionpassenger.com/apt/passenger trusty/main amd64 Packages
     1:1.10.0-8.5.0.28~trusty1 0
        500 oss-binaries.phusionpassenger.com/apt/passenger trusty/main amd64 Packages
     1:1.8.1-8.5.0.27~trusty1 0

Thomas Ward

ooo you're using their repository

i see.

Undo

oh, looks like the Passenger PPAs might be messing with it

Yeah, okay

Thomas Ward

@Undo yep, you'd be on 1.4.x if you were on pure Trusty

Undo

What's that Installed: (none) mean?

because it is very much installed

Thomas Ward

22:06

@Undo you probably have a specific nginx binary installed

rather than the metapackage

ArtOfCode

as opposed to "a little bit installed"?

Thomas Ward

well

Undo

@ArtOfCode Pretty sure that's Apache's state right now.

Thomas Ward

prior to Debian Unstable/Testing's 1.10.x packages

it was all nginx-{light,full,extras} contained the nginx binaries

and then nginx-common had the configs

Undo

Ah:

nginx-full:
  Installed: 1:1.10.1-8.5.0.30~trusty1
  Candidate: 1:1.10.1-8.5.0.30~trusty1

So yeah, that must be what I installed

Thomas Ward

22:07

how Passenger structures their packages I don't know, but the way Debian and Ubuntu (used to) structure it is with flavors

now, it's nginx has the core binary, and nginx-${FLAVOR} is a metapackage

pulling in dynamic module packages as needed. and the nginx-common package after that.

nasty evil merge coming up for Ubuntu with that though

with my bootprints all over it from kicking it around the systems so many times heh

Brock Adams

@TimStone Okay, thanks.

SmokeDetector

[ SmokeDetector | MS ] Link at end of answer: Jquery UI draggable not working in Wordpress by Offerya In on stackoverflow.com (@dorukayhan)

tpu- by NobodyNada

Thomas Ward

22:23

@SmokeDetector tpu-

angussidney

23:58

Morning

Transcript for