Root Access

allquixotic

21:00

traditionally, when RHEL blends two Fedora releases, they take a newer kernel for the updated device drivers, but the user applications are older

billmalarky

eh fuck it, I guess it's dev...

allquixotic

@billmalarky sure! unless you have some really odd hardware, it should work ;)

billmalarky

Oops looks like digital ocean doesn't support it. I'll just grab 19 64 bit

Fedora 19 x64 Fedora 19 x32 Fedora 17 x64 Desktop Fedora 17 x64 Fedora 17 x32 Desktop Fedora 17 x32

Is what they support

allquixotic

well if they officially support Fedora 19 then just go for that

Bob

@allquixotic Would it be safer to use their testing version rather than a different distro altogether? :\

allquixotic

21:02

@Bob CentOS doesn't do RHEL betas AFAIK, and I don't know if you have to be a RHEL paying customer to use their beta

but honestly if my target production system were CentOS 7 / RHEL 7, I'd definitely want to at least test my software against the beta of it and fix any bugs encountered ASAP, instead of being surprised by "whoa, I had no idea" when the final is released

@billmalarky it may help you to know that both Fedora 19 and Fedora 20 currently ship PHP 5.5.7

so either way, CentOS 7 is going to have PHP 5.5.7 or later, but probably won't have 5.6 out of the box

if digital ocean mainly depends on php and not many other packages, the chances of it working on CentOS 7, assuming that it works on Fedora 19, are exceedingly high

barring any extremely specific, unforeseeable bugs

from a package version compatibility perspective, you should be golden

billmalarky

Excellent!

I can't imagine needing php 5.6 at this time but who knows.

I mainly want 5.5 for their new password api

Bob

> CentOS-Testing - This repository is a proving ground for packages on their way to CentOSPlus and CentOS Extras. They may or may not replace core CentOS packages and are not guaranteed to function properly.

> These packages install but are waiting for feedback from testers as to their functionality and stability. Packages in this repository will come and go during the development period, so it should not be left enabled or used on production systems. This repository is intentionally not shipped with CentOS by default

allquixotic

very useful: http://distrowatch.com/table.php?distribution=redhat
http://distrowatch.com/table.php?distribution=fedora

whoops

I was reading the wrong damn thing... the one in parentheses is the latest upstream version; the one in the table is the version in the distro

yeah, this is fairly annoying (clicky linky)

Bob

> New major and minor releases are available about 2 to 6 weeks after upstream (Red Hat) publishes the SRPMs (source packages) of their product. This time is needed to rebuild, validate, test (QA), translate and integrate new artwork. Please see The CentOS Rebuild and Release Process for further details. Although we understand that some of our users are excited about a new upcoming release, we ask you to be patient or help out in the release process.

so... they have limited testing repos but no full beta

allquixotic

@Bob CentOS releases have historically lagged behind RHEL by months, depending on the build complexity

the testing repos are for security updates within a distro cycle, I think

well. security and bugfixes

billmalarky

21:12

@allquixotic Well ya get what you pay for ;-)

hey guys

Bob

billmalarky

After spinning up a new server what are the paretos principal things I should be doing.

I made my new user and I'm adding him to sudo right now

and I'm going to be installing LAMP with postgres instead of mysql

and I'm setting up my SSH key

Hennes

postgress++

allquixotic

wow, where to begin.... well, the first thing to do is to hope and pray that packages installed out of the box are "secure by default", rather than doing something stupid like listening on 0.0.0.0 and having a no-password admin user

I believe that should generally be respected by the major distros

but to be sure you could become root and netstat -pan and look for listening connections on 0.0.0.0 or a public IP

and if there are any, make sure those things are secure

55

Q: Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what steps do people always take when setting up a new server, that are not application specific. Such as...

fairly good question with links to other good questions, that should get you started down the path of securing your server

be sure to click on the ones for ssh, apache, etc and read those too

or maybe even flip through a dozen or so of upvoted questions with accepted answers from this list

billmalarky

okay opening new tabs now :-P

So adding people to sudo I just use visudo command as root and then add the line under the root user like so:

## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
billmalarkyexampleuser ALL=(ALL) ALL

allquixotic

21:24

yea, although you generally don't need sudo; it's not especially more secure than just using su

Bob

@allquixotic apparently, better logging of commands

allquixotic

sudo vs. su is more of a "6 of 1, half dozen of the other" kind of thing... Debian/Ubuntu and Fedora have debated it til the cows come home, but meh

I just use su on Fedora-based systems

billmalarky

I jus tlike sudo because I tend to forget I've switched to root

allquixotic

I tend to read my shell prompt every time before I type a command to be sure whether I'm root or not :P

Bob

recent question:

9

Q: Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has is to host one or more websites, possibly with SSL properly configured and enabled. My initial lo...

web-application network linux webserver ssh

allquixotic

21:26

and then there's sudo bash which acts almost like su but not quite because it takes some env vars from your user

Bob

@billmalarky Don't forget to disable password login

allquixotic

in ssh you mean. yes, absolutely

billmalarky

I used to be overly paranoid but I'm actually training myself not to be just because my fear of fucking up is actually what led me to fail in my last project due to not moving fast enough.

Bob

I've personally been very guilty of just logging in directly as root :P

allquixotic

@billmalarky I'm afraid of messing up when I'm working on a car, because if I do something wrong, I have to buy a new part

if you break software, you get to keep both pieces, but replacing it just costs time, not money

Bob

21:27

@billmalarky Never try to move fast... be sure of what you're doing

from personal experience, and even then I still fuck up by trying to move fast

allquixotic

software: better to break it and learn than to sit worrying and never learn

billmalarky

No doubt, but I had some crippling anxieties.

@allquixotic exactly

allquixotic

hardware / cars: better to be 100% sure instead of buying a replacement part for $250

Bob

@allquixotic you'll still want to make sure you don't break things too badly

I've overwritten a few newly-written source files with mistyped commands :\

allquixotic

i started working on software at a very young age so i learned how to properly cordon off my experiments to minimize their impact on other things i do, and i'm very comfortable with taking risks with software that make older people go "but what if you break it??????"

Bob

21:28

sure, you can redo things - but it's tedious and a waste of time

allquixotic

me: "if i break it, i reinstall, or boot a live CD and un-break it, silly :)"

billmalarky

@allquixotic This is EXACTLY what I am learning to do with this new project

allquixotic

@Bob I'm more careful with source code, but I mean, like, trying weird combinations of package versions and such

billmalarky

digital ocean makes things easier by allowing you to make images of servers etc

so I can try stuff quickly and if it explodes it will only explode the new server I made from a copy of my main server

allquixotic

@billmalarky if I know I'm going to be breaking things very often, I'll stick it in a VM and take snapshots using VMware Workstation -- that feature figuratively (note: not literally) saved my life hundreds of times when developing my Rhythmbox plugin

billmalarky

21:30

Also what with the versioning software and backups. I feel much more confident to experiment quickly.

Bob

heh

I've moved mostly off VMs onto cheap VPSes

if only latency was lower, but meh

allquixotic

saveSnapshotOfWorkingSystem(); while(broken) { attemptFix(); checkIntoVersionControl(); broken = test(); if(broken) { restoreWorkingSystemSnapshot(); } }

Bob

it's a 2 min job to reinstall a system, another 5 mins to restore a backup

but it's also more fluid than a VM

hm. even faster more recently, actually - it's so easy to backup/restore a vserver machine :D

allquixotic

IIRC, when I broke my plugin badly, often I'd have to spend way too much time restoring the proper state of the system (gconftool, then later dconf, etc) so I'd just go ahead and restore snapshot, then pull down the latest source and hack hack hack, commit to launchpad, test, if still broken, repeat

@Bob vserver good. vserver yummy. vserver yummy AND good!!!! </ogrespeak>

Bob

@allquixotic copy folder, done! :D

allquixotic

21:38

@Bob I've been using various cloud providers for my code hosting ever since I discovered how wonderful git, github, launchpad, etc. (mostly github now lol) are. I remember how horrifying it was in the past to write code and have the only copy being on my hard drive, even if I was using git, or maybe the other copy was on my dedicated Hetzner box

somehow it feels safer on github than on my hetzner box :P

'course, if github ever has any kind of catastrophe, a ton of people are going to lose the only copy of their code that they still have around, and are going to be very upset

Bob

@allquixotic I'm talking about the working copy, though

Vim is great.

Though sometimes I just want NP++

also, you remember that progress thing?

...they released a new IDE

allquixotic

what progress thing?

Bob

it's based on Eclipse

with all the performance issues of Eclipse, naturally

billmalarky

Should I bother with vim-enhanced or just vim-common. I have very little experience with vim, only basic editing experience.

Bob

@allquixotic the language

allquixotic

21:46

progress? the language is called progress?

Bob

@allquixotic renamed to openedge abl now, I think

allquixotic

@billmalarky vim-common isn't actually any vim program, it's just common files to all vim programs... vim package is regular old vim command

or should be anyway

Bob

OpenEdge Advanced Business Language

OpenEdge Advanced Business Language, or OpenEdge ABL for short, is a business application development language created and maintained by Progress Software Corporation (PSC). The language, typically classified as a fourth-generation programming language, uses an English-like syntax to simplify software development. The name was changed in 2006 to OpenEdge Advanced Business Language (OpenEdge ABL), by PSC, from PROGRESS, also known as Progress 4GL, in order to overcome a presumed industry perception that 4GLs were less capable than other languages. The language was called PROGRESS or Progre...

allquixotic

@Bob looks horribly enterprisey and bloated

Bob

@allquixotic Bingo!

billmalarky

21:47

So just "sudo yum install vim"

Bob

Remember NO-UNDO? :P

billmalarky

A site I'm reading says "yum install vim-X11 vim-common vim-enhanced vim-minimal"

for fedora

but wth? that seems like a mouthful.

Bob

...I'll leave you to your RPM-ness, I just do apt-get install vim

Or zypper in vim (my netbook is running OpenSUSE)

allquixotic

@Bob oh dear god, not on Christmas ~~Eve~~ (struck through for Australian-friendly communications)

billmalarky

wat do?

allquixotic

21:50

Yoda writing Progress: TRY NOT. DO OR UNDO. THERE IS NO TRY.

billmalarky

can I just yum install vim?

allquixotic

@billmalarky the package probably doesn't exist if they've split it up into vim-minimal and vim-enhanced

you can try yum search vim to see what packages are available

when in doubt, just install vim-enhanced and be done with it

the enhancements are just add-ons that you'll never use if you're just going in in insert mode

billmalarky

That's the answer I was looking for!

so just "yum install vim-enhanced"

allquixotic

that should pull in vim-minimal and vim-common as dependencies

vim-X11 is a separate thing entirely

billmalarky

aha

allquixotic

21:52

you run vim-X11 as its own standalone window in your desktop environment; if you're headless or at a SSH prompt or CLI, you don't need/want that

billmalarky

what does headless mean? You've used it twice now

no output?

Canadian Luke

@billmalarky Means no keyboard/monitor/mouse are hooked up

billmalarky

so only connecting via ssh

or something else

Canadian Luke

Via a terminal of some sort

billmalarky

okee dokee

Canadian Luke

21:54

Could be a COM port, could be over ethernet...

But the input and output are being directed to a remote system, even though they are being processed on the host system

As an example, all the servers at my work are headless. They have keyboards and monitors hooked up to them (all Linux anyways), but are only ever accessed via SSH. The monitors are there for emergencies only, and hardly ever get connected

billmalarky

got it

Bob

@CanadianLuke I always thought it was more 'no graphical environment'

Canadian Luke

@Bob Nope, just that nothing is connected to it for input/output

I had a Windows 7 Ultimate box at home that I would just remote into. Had no graphics card in it. It was headless

!!wiki headless

Bob

uhm.

!!undo

Canadian Luke

Wow... That was creepy

allquixotic

21:57

wtf

Canadian Luke

!!wiki headless server

ChatBot John Cavil

Headless computer

A headless system is a computer system or device that has been configured to operate without a monitor (the missing "head"), keyboard, and mouse. A headless system is typically controlled via a network connection, although some headless system devices require a connection to be made via RS232 for administration of the device. PC BIOS limitations related to headless operation During bootup, some (especially older) PC BIOS versions will wait indefinitely for a user to press a key before proceeding if some basic devices, such as a video card or keyboard, are not installed or connected, ef...

Canadian Luke

There we go!

Thanks @Bob

allquixotic

"headless" in the context of modern GNU/Linux is usually used in the sense of "are you currently running an X11 based graphical desktop environment, or not?"

Bob

@allquixotic that was the one I was thinking of

allquixotic

21:58

you could have a computer with a graphics card, connected to a keyboard, mouse and monitor, but if you're accessing it over SSH, your logged-in session is headless

...even if someone else on the same system isn't on a headless session

Canadian Luke

Never heard it like that before

But I also don't know everything :P

allquixotic

basically, for all intents and purposes, on GNU/Linux, if the DISPLAY environment variable is set to point to a running Xorg server, you're not headless; otherwise, you are

well by "Xorg server" I mean "anything implementing the server side of the libX11 wire protocol"

getting into specifics of X.Org architecture here

Canadian Luke

So we can define it as such:

bool isHeadless(bool xorgRunningOnSession) {
return !xorgRunningOnSession;
}

allquixotic

for instance, on the superuser container that runs Cavil, $DISPLAY is set to point to an instance of Xrdp, which is a virtual framebuffer that we can RDP into to see the Firefox instance within. is the server headless? NO -- that specific user account is not headless

@CanadianLuke on systems where the graphical environment is xorg, yes

on Windows it's completely different because you can't really have a Windows system with no GUI environment

although you can have certain situations where programs don't have access to it

Bob

damn, we really need some way to invite these guys into chat: superuser.com/questions/692771/portable-linux-environment

Canadian Luke

22:01

@allquixotic Only cause I know of some exceptions, but I understand what you mean

allquixotic

for instance, on Windows, you can run Windows Services as the Local System account, and opt whether to grant them access to the display environment; if they don't have access, Java for instance will say that it's headless

Bob

it's also amusingly related to our current discussion

Canadian Luke

@Bob he has StackOverflow rep. Would you like me to ask if he wants to join us?

Bob

@CanadianLuke but not enough for assoc bonus, and their chat is separate, no?

Canadian Luke

It's global.

Bob

22:02

o.O ok, that'd be great

thanks @CanadianLuke

Canadian Luke

No problem

I'm not gonna superping, but I at least left him a comment to join us

allquixotic

yeah, as long as he has 20 rep on any SE site, he should be fine in here

oh wait

Chris Ochsenreither

Hi, I have a question.

allquixotic

chat.SE and chat.SO are separate, ~~aren't they~~ lol and there he is

The Amazon micro tier AMI sounds like the method I'd prefer, because any machine that has an internet connection should in theory be able to get into your environment. You could host something like GateOne over HTTPS to provide a web browser based (WebSockets based, actually) SSH wrapper, in case you go to a public library or something where you can't run an SSH client on port 22 outbound. — allquixotic 1 min ago

Canadian Luke

Just ask @Chris, and welcome to Chat

allquixotic

22:04

there's my answer :P (well, the most I could come up with in a few seconds)

Bob

ya, if you're close enough to the server to not have any significant latency, I'd say go with the VPS

Chris Ochsenreither

@Chris Thanks. Any other alternatives to Amazon AMI that are free/cheap?

Bob

@ChrisOchsenreither lowendbox.com

:P

allquixotic

:D

Bob

don't trust them to stay up, in general, but for dev it's usually fine

if you want something a little more trustworthy, buyvm.net is an established "low end" provider

Canadian Luke

22:06

SDF ?

Bob

ramnode.com is another one

allquixotic

yeah, actually, Amazon tends to be super expensive relative to the alternatives if you want a 24/7 box that's up and don't need very high specs

Bob

you're in luck; the Christmas deals are coming out today if you want a cheap one :P

Canadian Luke

buyvm looks... different... then expected

Bob

@allquixotic Amazon EC2 is great if you want something versatile and easy to expand for production

but for dev? I'd say overpriced in most cases

allquixotic

22:07

and once you set up GateOne on it, it comes down to this: if you have a web browser with WebSockets support, you have access to the VPS/CLI/compilers (note that you can also still access it over regular SSH if your ISP lets you)

Bob

usually I don't care if my dev server is down for a few hours

allquixotic

!! s/today/tomorrow in the US, or today in Aussieland aka Bobland/

ChatBot John Cavil

@allquixotic you're in luck; the Christmas deals are coming out tomorrow in the US, or today in Aussieland aka Bobland if you want a cheap one :P (source)

Chris Ochsenreither

@Bob This is just for comp sci classes. I would probably rent another AMI for doing a real website.

Bob

sorry, it was buyvm.net

@ChrisOchsenreither hey hey :P

allquixotic

22:08

lol comp sci classes :D so you might actually be doing this on a library machine then :D

Bob

I'm actually using a cheapie VPS for my compsci course :D

allquixotic

library -> your-site.me/gateone

Bob

though I usually just ssh into the uni servers, actually

allquixotic

type password, hack hack

and this is all assuming that uni doesnt provide you with any servers

Bob

1 min ago, by Bob

sorry, it was http://buyvm.net

Chris Ochsenreither

22:09

@allquixotic, no I have 2 laptops from a computer thrift store, one Macbook from my employer - don't anticipate not having a computer at all times

allquixotic

so why do you need a server then?

> for working on my programs / scripts / applications so that I can switch clients

got it

Chris Ochsenreither

Because I have to switch computers

allquixotic

yeah, grab a BuyVM or something and ssh away then

Chris Ochsenreither

Plus I might change jobs and give back the Macbook

Bob

you could just stick them on a central repository, like github, and push/pull

allquixotic

22:11

he wants his toolchain to be remote as well bobby tables

compiler whatever etc

Bob

in any case, avoid trying to sync a whole virtual hard drive :P

Chris Ochsenreither

@Bob I use github but I need a configured environment

allquixotic

ya, fo sho

Chris Ochsenreither

BuyVM looks good. I will try it.

Thanks

allquixotic

That's kinda crazy. How do you "opt to delete them manually"? I'm assuming this also prevents people that aren't logged in to see them, and search engines from showing them? — Aki 25 mins ago

oh boy, another person who wants to delete the internet

Canadian Luke

22:26

YAY, I learned recursion in C++!

Bob

0

Q: Make the ToS more prominent on registration

Currently, we have a little line at the very bottom when asking a new question as an unregistered user: By posting your question, you agree to the privacy policy and terms of service. There is a similar line in small text when registering an account, almost hidden away. These messages are ...

feature-request legal licensing unregistered-users registration

Braiam

22:39

@CanadianLuke FANFARE

allquixotic

@Bob nice :D

Braiam

> Why were there raining monopoles?

O_O

Bob

@allquixotic Maybe for once they'll listen to their own UX site :P

7

A: Automatic agreement to terms of service

It is legal to do that, but you will gain no legal protection if the default state is to agree. Unless a user explicitly agrees (which means actively doing something rather than not doing something), any legal agreement that you have will be unenforceable in court. This has been tried and teste...

Canadian Luke

@Bob nice find!

Bob

And another:

9

Q: "By posting this, you agree to our terms and conditions"

Is it okay to have a "By posting this, you agree to our terms and conditions" (i.e. like 4chan) as opposed to a "I agree to the terms and conditions" checkbox? I read about automatic agreement to terms of service here on UX and how autochecking these checkboxes makes them void in court. On the o...

social-media checkboxes forum legal privacy

allquixotic

22:50

@Bob nah, adding more text to the bottom of the Q/A form would hurt performance. status-declined

2

Braiam

H-B-Day @Oliver

allquixotic

i should send lemon cookies from germany to oliver for his bday :D

out of the letters in "Jesus Christ", the only ones in "Oliver Salzburg" are "esur" o_O

"esur" is just a typo for "sure" -- so it's sure that Oliver Salzburg is Jesus Christ because he was born on the same day! O_O

whodathunkit, the Christian demigod is bald, German, and always sarcastic

Braiam

@allquixotic HERRESAY

Bob

@allquixotic Nah, they're spending all their time on this:

20

Q: What should we consider for next year's Winter Bash?

At this point, I am relatively confident that Winter Bash will become an annual event. The event is oodles of fun for our communities, and almost everything we do as employees in putting the event together is done with an eye toward repeatability and automation. With that in mind, I see a lot o...

discussion winterbash-2014

Braiam

@Bob hahahahaha

Bob

22:54

@allquixotic They pretty much agreed that christmas wasn't the actual birthdate :P

just a date chosen to replace the winter solstice or something

allquixotic

@Bob meh, just trying to re-find the wit of this (:

Braiam

@allquixotic you were left witless with that?

allquixotic

@Braiam wit is like the mana pool in Diablo 1 for me

spend some and you have to find potions to renew it

unfortunately I can't cast Wit Shield and protect myself from attacks with sheer wit :P

and I think I cast as slowly as the warrior

Transcript for