The Comms Room

Magellan

19:01

@cole Congratulations.

cole

Thank you.

I feel so relieved

Iain

@voretaq7 I guess he forgot to run the script to start the vpn as root

dawud

why (and how) do some tags have logos?

Magellan

@dawud sponsorship

dawud

@Magellan that should do it.

voretaq7

19:10

@dawud for the low low price of some money SE lets you sponsor a tag

I think tags on SF are probably pretty cheap too

Magellan

@voretaq7 Why would anyone want to? Sysadmins aren't usually purchasing decision-makers for organizations with enough cash to make the advertising worthwhile.

voretaq7

@Magellan Neither are developers, but the sysadmin is the one who chooses the network gear and backup solution

Iain

@Magellan sysadmins are strong influencers though

Magellan

@voretaq7 Hmm. I suppose they probably are in orgs that aren't actually in the IT business.

@Iain Perhaps my time at IBM jaded me. The purchasing decisions for all our customers were made on the golf course by Executives.

voretaq7

@Magellan Orgs that are in the It business buy Cisco CRS-3s

:)

Magellan

19:19

@voretaq7 Can't Remember Shit 3s? Did they really name a product that?

voretaq7

@Magellan Nobody I know still works for a company like that (usually all of those companies have had major ($1M+) purchasing debacles.

@Magellan Don't need to remember, just need to stuff the packets into the tubes. :P

Iain

@Magellan I've almost never had a budget but I generally got what I asked for

Magellan

@voretaq7 That's how IBM sells ALL their software. On the golf course or at the bar. Including ALL the Tivoli stuff.

voretaq7

@Magellan Dunno about their software, but IBM hardware is usually purchased on standard contracts

Magellan

@Iain That absolutely drove me wild at job[-3]. I had no idea what was likely to be approved, so I spent months going back and forth with my manager trying to find something that the directors would approve.

voretaq7

19:21

If I were deploying an Oracle/PeopleSoft/SAP system it would be on IBM Power hardware, because I know that contract and I know what comes out of it will be excellent.

@Iain that's been similar to my experience: I'm generally asked to submit a capital plan, but I'm allowed to purchase whatever I want/need within the constraints of that capital plan.

Nathan C

heh, instead of using an external hard drive to back up stuff before doing a clean windows 8 install I shrunk my current drive and am throwing everything onto that partition >_>

voretaq7

@Magellan outside of huge enterprises the days of a golf course purchase agreement are pretty well dead I think -- too much emphasis on cost control and accountability

Magellan

@voretaq7 Oh, I loved working on the xSeries hardware as long as I didn't have to reboot it. The software, yeah, I ran away from that crazy bizness.

voretaq7

@Magellan I've got less enthusiasm for the X series - I think it's great hardware, but it's still "just an x86 system" (albeit with some nice bells and whistles)

Magellan

@voretaq7 So you'd think. Just means you have to go further up the food chain.

Iain

19:24

@voretaq7 snap

voretaq7

hard to justify IBM xSeries versus SuperMicro/Dell/HP at cheaper costs.

mfinni

Fired : serverfault.com/questions/547082/…

Magellan

@voretaq7 If all you need is x86_64, I don't see why I'd go with anything else.

mfinni

How can./... wtf... dammit.

"I set up websites. I don't know how DNS works. YAY"

Magellan

Aren't shared hosting questions considered OT for SF?

voretaq7

19:26

@Magellan If all I need is X86_64 I'm buying Dell or SuperMicro -- half the cost of an IBM X box and just as good. IBM's warranty and service is a little better, but 4 hour parts on site is 4 hour parts on site...

@Magellan Not if you're the admin of the shared hosting environment.

Magellan

@voretaq7 Yeah, which I doubt the OP from mfinni's post actually is.

Iain

@Magellan I've never been more than one person away from the people doing the sign off so I guess I had it easier. Like @voretaq7 I had a plan and was involved early in new projects so that the plan could be costed and adjusted accordingly

Magellan

@voretaq7 True. my boss preferred the IBM equipment, so I wasn't going to complain. For some reason he still thought of Dell as consumer-grade equipment and he didn't like HP hardware.

@Iain Yeah, it's also never fun when one of the Executive VPs 8 levels up is having a chat about your product with the CEO of AT&T Wireless on said golf course.

voretaq7

@Magellan Dell and SuperMicro play on the same field IMHO

HP - if I was going to pay the premium I'd personally buy IBM.

Magellan

@voretaq7 I wouldn't say that. The variance with SuperMicro hardware is so high that no viable comparisons can be made.

voretaq7

19:30

@Magellan Depends on where you buy your supermicro hardware from

mfinni

@Magellan Not explicitly, not per the help link.

Magellan

I've had SuperMicros that were great and ones that were awful to the point of being useless.

@mfinni Interesting. I've been hearing people say that for so long that I assumed it was documented as such.

voretaq7

Supermicro isn't a brand (even though we treat it as one because the machine starts up and says Supermicro) - they sell bulk parts to VARs

mfinni

@Magellan One could be a skilled admin on shared hosting. That's what AWS is.

Magellan

@voretaq7 Exactly. but Dell is Dell.

voretaq7

19:31

@Magellan Dell is "Whoever Dell can buy the parts from cheapest this quarter"

mfinni

@Magellan Right - he certainly fails the "in a professional capacity' by dint of not being a professional admin. herp derp DNS?

voretaq7

which has always been my problem with them - I'll get two 29xx machines - one with chipset A and one with chipset B

Magellan

@voretaq7 Yes, but you can still go straight back to Dell and buy parts for it too. Which you generally cannot with SuperMicro. BIG DIFFERENCE.

voretaq7

@Magellan Not true at all. I can call my VAR and order parts for any supported (<5 year old) machine in our rack

Magellan

@mfinni Pretty much. And shared hosting generally has a freaking GUI and support to deal with that kind of thing at the very least.

Iain

19:32

@Magellan I'd say so if the OP is someone using the shared host rather than administering it

Magellan

@voretaq7 You're quite fortunate. Mine was 2 years and they'd cancelled the contract with the on-site repair technician after 18 months and so we couldn't get our next-day onsite service anymore either.

voretaq7

it's the exact same relationship I had with Dell when I was at the ISP, it's just the box I get from Iron Systems has two serial number stickers (an ISxxxxxx number from the VAR, and some SuperMicro number that it was born with)

Magellan

@Iain Pretty much my take. Though I've been in his shoes once or twice.

voretaq7

@Magellan wow... your reseller sucks. :P

Magellan

@voretaq7 Yeah, and they sucked almost as bad as the other ones we'd tried that were local.

voretaq7

19:34

Our machines cost about $300 more than they would from the cheapest Supermicro reseller but I've never had a DoA or infant mortality problem, and I've always been able to get parts when I needed them

Iain

@Magellan I've got shared hosting for a couple of small forums - it's great if there's a problem it's a SEP :)

voretaq7

(I've never tried the 4 hour SLA - usually I have them overnight the parts to my office and bring them to the datacenter the next day - but I'm pretty confident they'd meet the 4 hour window if I asked them to)

@Magellan I have seem some GODAWFUL supermicro vendors back when I worked at the ISP

guys selling the "everything cabled in under the chassis" cases as "enterprise grade"

and using the motherboard RAID

Magellan

@voretaq7 Oh yes. And the previous boss tried them all, I swear. So many bad ones to choose from.

voretaq7

@Magellan I can heartily recommend Iron Systems. You do actually have to talk to someone when you order a machine (which is kind of annoying), but they've caught configuration errors for me (which is kind of nice when you accidentally spec a machine that isn't on the VMWare HCL and they say "For the same price we can put this motherboard in and you'll be officially supported")

"Free upgrade to a supported configuration? YES PLEASE!"

Magellan

one required pulling the motherboard and disassembling the entire chassis to get the "front-mounted" drives out. The "trays" were just drive-shaped rectangles molded into the front.

@voretaq7 Actually, that's what I did with the previous one. I'd put in a quote and then call the owner's desk number. His technicians were simply useless. And I couldn't actually get VMWare 5.0/1 HCL hardware from those folks either.

They'd swear up and down that the 3ware 9500/9600 would work just fine. Which, of course, it didn't.

voretaq7

19:42

@Magellan If they couldn't assemble a VMWare supported machine they were selling bottom of the barrel supermicro

Magellan

@voretaq7 Probably. That's non-profit orgs for ya, after all.

The fans sure were cheap crap. The fan noise permanently damaged my hearing.

voretaq7

@Magellan There are some non-profits I'd really like to work for, because I could build them good, cost-effective solutions. But I feel bad charging them what I need to charge to earn a good living :(

@Magellan fan noise from SuperMicros is worse than from Dells - even the newer cases with better fans/airflow are loud as fuck (and they default to "High speed at all times" - you have to set them to auto-speed)

but frankly I don't care about fan noise - you shouldn't be standing near the machine for more than 30-60 minutes (and if you are, OSHA requires hearing protection at typical datacenter sound levels)

Magellan

@voretaq7 Yeah. Well, they tend to stay stingy even when they get large and need to start buying good stuff. When their IT budget is less than $600K, including salaries, out of $30M+, it's time to pony up and work with something that's not crap.

0

Q: Ubuntu 13.04 to 13.10: Filesystem check or mount failed

I attempted to upgrade from Ubuntu 13.04 to 13.10 today, and mid upgrade the system started flaking out, and eventually locked up entirely. I was forced to restart the computer, and am now unable to get the computer to boot up at all. When I boot currently, it takes me to the GRUB menu, and I ca...

Feh.

Should we punt this guy to U&L?

Wesley

@Magellan gasp YOU?! Wanting to send someone to U&L?!

Magellan

@Wesley Yeah. I'm starting to change my mind about what's OT and not OT.

voretaq7

19:48

@Magellan It wouldn't be U&L, it would be Ask Ubuntu. And NO. The question is crap. We are not Stack Overflow, therefore we do not migrate crap.

Magellan

@voretaq7 Uh, AskUbuntu is to U&L like SuperUser is to SF. Does AskUbuntu actually have that level of expertise?

Wesley

@voretaq7 What is it with people named Sam lately...

Iain

@Magellan they have Canonical employees

Magellan

@Iain While that should be an argument in their favor....Nah. =)

Actually. I'm doing the Canonical folks a disservice. I'm sure they're quite good. It's just their leader that needs to be crow-barred in the balls until he passes out.

TheCleaner

Hey @ewwhite - you're an HP server expert. Do they all look like this? ;)

voretaq7

20:05

@Magellan What level of expertise? The user is so lost the answer is "Just reinstall dude, you'll never fix it without an expert on site."

@TheCleaner Did that come with the Deco Switch?

Magellan

@voretaq7 I think this needs a mod-hammer. Too crappy to go over to another .SE site: serverfault.com/review/close/96520

It's got 3 migrate votes.

Chris S

@TheCleaner lol - I'm always impressed by the way people destroy things

Magellan

My youngest cat is so ridiculous that she keeps trying to eat raw potatoes.

@voretaq7 Awww, now you've done it. Betcha a donut he runs to Meta saying we're being mean to him.

That ^^^^^ post should not be linking to previous one. I wonder if they introduced another bug into chat.

84104

Testing linking idea for @Magellan .

@Magellan Use of @ causes message to link to last message of @ .

Magellan

@84104 Ok, not just my browser then. Looks like a bug to me.

Michael Hampton

20:18

@Magellan Not a bug. You need to select a specific message if you want to refer back to it.

TheCleaner

@ChrisS well, I fixed it actually. Just grabbed it where it was bent in and pulled really hard. Then used metal snips to remove some of the metal covering the ports. Just like new!

Magellan

@MichaelHampton I'm not doing a reply and don't intend to. But it's doing the link anyway.

84104

@MichaelHampton I think he means it shouldn't link at all.

Michael Hampton

@Magellan Well, you can go to mSO and have them tell you you're on crack. :)

84104

@TheCleaner Networking, servers, body and fender all here!

Magellan

20:19

@MichaelHampton Feh. What would a bunch of Devs on mSO know about fixing bugs anyway?

With the notable exception of job[-1], most of the Devs I've ever worked with generally needed to be racked and tortured before they'd fix a bug.

voretaq7

@Magellan @anyone links to their last post

Magellan

When I was at the dot-com IBM bought, the OEM vendor told me that I was hallucinating for about 3 weeks before they acknowledged that they had a catastrophic memory leak in their Java SSH agent implementation.

voretaq7

but if you say @Magellan it doesn't

Magellan

@voretaq7 BUUUUUUUUUUG!

voretaq7

@Magellan FEATURE

TheCleaner

20:23

@84104 well, I figured I'd be the only one here that cared what it looked like once installed. Only thing that frustrated me was they bubble wrapped the crap out of it before it was shipped and the box and packaging look great. So either the 3rd party we hired to grab it from our branch office dropped the thing before shipping or it was damaged already and nobody told me.

Magellan

@voretaq7 DOES ON MINE!

voretaq7

(and they don't really "link" - they just highlight the last post when you hover)

Magellan

@voretaq7 For which linking to that post is required.

voretaq7

there's no arrow :)

Basil

ok, clearly I don't understand sed.

Magellan

20:24

@voretaq7 Which is why it's a bug.

ewwhite

@thecleaner yes.

voretaq7

@Magellan FEATURE!

Magellan

@voretaq7 Buh-Ugh. BUG.

voretaq7

@Basil what's to understand. You put things into it and something different comes out

Magellan

@voretaq7 STOP TOUCHING ME! STOP TOUCHING ME!

Basil

20:25

If I have something like grep foo /home/bar| sed "/xyz/", I get an error

voretaq7

84104

@Basil Yeah, you haven't issued a sed command.

Magellan

@voretaq7 that license plate makes me homesick. Been a long time since I last visited the Land of Lincoln.

84104

@Basil What are you trying to do?

Basil

@84104 I pipe to sed all the time- for example grep foo /home/bar| sed "s/xyz/abc/" works

TheCleaner

20:26

@ewwhite the man of few words

Joel E Salas

@TheCleaner He also types out people's handle instead of using reply

Magellan

@Basil that is a valid sed command though.

84104

@Basil Yeah, that's a command, but sed "/stuff/" isn't.

ewwhite

Sitting in Red Hat interview

Basil

ok. I want to use sed to match a regex command

Joel E Salas

20:26

@ewwhite What would you do there?

pro services?

TheCleaner

@JoelESalas noticed that...

ewwhite

Meh

Basil

I was hoping it was like perl...

voretaq7

@Basil ...why not just grep again? :)

grep foo /home/bar | grep other_regex

ewwhite

On an iPad

Basil

20:27

@voretaq7 For one, grep doesn't support all of the things I can match in regex, I think

freiheit

@Iain Yay winter riding! :) (What is 'winter' anyways?)

Basil

or... does it...?

let me check

freiheit

@Basil egrep

voretaq7

@Basil egrep?

84104

@Basil grep -E unless you're like @voretaq7 and only do POSIX.

ewwhite

20:28

I was left on a conference call.

Matt Bear

/facepalm

voretaq7

@84104 I routinely use egrep

Basil

@84104 AIX :\

voretaq7

(or pipe things to perl)

freiheit

@Basil ldd /usr/bin/sed /usr/bin/egrep?

Basil

20:29

yeah, egrep was what I used in the end

Matt Bear

one of the SQL Servers (that I don't control) has SA enabled, and ports open to the public for remote work, which is done using the SA account

on azure

and they just asked me why theres been literally millions of login attempts against SA over the past 6 months...

84104

@voretaq7 I have a couple of legacy Solaris boxes I don't get along well with. I'm just taking it out on you. It's not actually your fault.

voretaq7

@84104 You're just not treating them right. They got bought by Oracle and are depressed - you have to say nice things about them and soothe their bruised egos.

freiheit

@Basil On my systems, sed is linked against pcre, which does have some (obscure) perl-style regex options. egrep is not. If you want those things, you might need to use pcregrep to get closer to the full-on perl style regexes without the perl-style overhead.

@voretaq7 I hate Oracle and everything they touch, and since you like Solaris and Oracle bought them, it's automatically your fault via the mathematical properties of transference.

84104

uname -sivr
SunOS 5.6 Generic_105181-05 SUNW,Ultra-250

I think it's too senile to know that happened.

Iain

20:36

@freiheit the time between the end of October and the beginning of March

freiheit

@Iain Half of that is some of the best riding weather around here. Need lights for one end or the other of my commute, though.

Basil

@freiheit it's fine, I think I was just expecting sed to be something it wasn't. I still barely know unix

84104

@Basil Some versions of sed can do regex matching, but grep is better for just finding things.

freiheit

@Iain Actually, I've been working a bit on "winterizing" (rain) bikes. My girlfriend is starting a job shortly with a 13 mile country road round trip (with a bit of a climb), so really needs better fenders and lights for her touring bike. I think for her touring bike I'll steal her little removable "blade" fenders for my "summer" road bike and put proper wraparound+flap fenders on her bike.

ewwhite

Done.

Redhat4lyfe!!

Magellan

20:44

yay! the fog burned off and I can see across the street again!

Iain

@freiheit I use Crud Roadracer 2's

Magellan

stupid 0' ASL cloud decks.

MIfe

If you see a really old answer thats wrong (well, nearly right but incomplete) what would you do?

Iain

@MIfe edit it

freiheit

@Iain Friend of ours offered her a set of Planet Bike Cascadia's in the right size (didn't work on his bike). Crud isn't a brand I've ever seen around here.

ewwhite

20:52

Hmm. Portland design works fenders or bust

voretaq7

@freiheit The transitive property doesn't apply to Oracle. Oracle is Division by Zero.

Iain

@freiheit crudproducts.com

voretaq7

@Iain Oracle has a Bike Shop? :)

freiheit

@ewwhite Made for 700x23 tires? None of the 7 bikes in our household has tires that small.

Iain

@freiheit crudproducts.com/products/roadracer

Matt Bear

20:56

@freiheit thats a monster tire! I thought my 35x15's were big!

freiheit

@MattBear millimeters. we're talking millimeters here.

Matt Bear

@freiheit ohhhhhh... ok

I dont math... how bigs that

voretaq7

Why are there so many standards for sizing tires?

TheCleaner

To be honest, with the various "noob" questions lately with no research done, etc. it amazes me that this one was upvoted as much as it was:

7

Q: A "splitter" is plugged into a patch panel... how does this still work?

I found a patch panel that splits off ethernet into multiple hosts as shown below. Can anyone explain how this might work?

networking ethernet patch-panel

freiheit

@Iain ecom1.planetbike.com/7056_5.html

@voretaq7 The french

Matt Bear

20:59

@voretaq7 heh you want confusing, the metric measurements for tires with 16" plus rims...

voretaq7

@freiheit FUCK THE FRENCH AND THEIR FASCIST CRÊPE-RIDDEN LANGUAGE! :P

freiheit

@MattBear FYI, the "700" in "700x23" doesn't necessarily involve anything that's actually 700mm. Because crazy and french. ;)

Matt Bear

315/75/r16 = 315 mm wide/ (75%x315) sidewall height / 16 inch rim

Iain

@freiheit I have some similar to put on my hybrid

voretaq7

@freiheit Do I blame them for aircraft tire sizing too? (6.00x6)

Matt Bear

21:02

so equation for height is ((.75x315mm) x 2) + 16"

freiheit

@MattBear Really, with bicycles it's best to talk about the ISO standard sizing. "700x23" is really '23-622', which is 622mm bead seat diameter and 23mm wide (when inflated on a reasonable sized rim). It's also known as "700x23c" because at one point "c" was a standard width that when on a 622mm rim had an outer diameter of 700mm.

Or, more simply: experienced bicyclists all know that 700=622=29.

Iain

Help with grilled cheese please. I'm good with most of what's going on here buzzfeed.com/emofly/grilled-cheese-sandwich-recipe-gifs but there seems to be a piece of bread goes missing around picture 10 or am I missing something ?

Matt Bear

so 315/75/r16 means in reality, 34.5" X 12.5" tire on a 16 inch rim

@freiheit damn metric system screwing everything up

Wesley

@MattBear What time did you leave there last night?

Matt Bear

@Wesley around 11

Wesley

21:06

@MattBear And what time did you show up this morning?

Matt Bear

@Wesley around 11

:p

Wesley

@MattBear And you're hourly right?

freiheit

@Iain The buttered side goes out, and they're showing putting a slice of bread (butter side down) on the pan, then cheese on top of that, then the other slice on top of that (butter up).

Matt Bear

@Wesley yup

Wesley

@MattBear And do they actually pay your hours? Or do they fudge on overtime?

Matt Bear

21:07

I've got some cert renewals to take care of tonight for our o365 federation

@Wesley they pay

though it isnt worth it....

voretaq7

@Iain the strange person puts the second slice on after putting the first slice and cheese on the pan

Iain

@freiheit ah right so earlier when they put the buter sides together it's just to stop it getting messy while you do the inside ?

Wesley

@MattBear Okay, so that's good I guess?

freiheit

@Iain yes. I generally slice cheese, put between mustarded bread slices, and then butter the outsides right as I'm dropping it into the pan.

Wesley

@Iain Ohhh, now I want to make a grilled cheese sandy...

freiheit

21:09

@Iain Is a proper grilled cheese sandwich an american thing that the brits aren't really up on?

Iain

@Wesley buzzfeed.com/rachelysanders/…

Wesley

@freiheit Mustard on a grilled cheese? What kind of sick fuck are you?!

Matt Bear

@Wesley I've got a rib eye sammich sitting here next to me right now :D

freiheit

@Wesley I'm a sysadmin. What kind of sick fuck are you?

Matt Bear

@Wesley mustard period is bad.... haha

Wesley

21:10

@Iain I'm lame. I just use Velveeta.

freiheit

(no, seriously, mustard in a grilled cheese is normal)

Matt Bear

though... HAVING a mustard PERIOD is gross...

Iain

@freiheit I don't know anyone who would make a sandwich like that - we generally do them open topped. Toast the bread then butter/mustard/whatever and cover in cheese then place under a grill to melt the cheese

freiheit

@Wesley That's not cheese. That doesn't count. Also, it's gross.

Wesley

@freiheit Normal like weeping sores on your balls.

Matt Bear

21:10

@freiheit no its not, your not

84104

@freiheit Never heard of that before.

Matt Bear

I like our new DBA

freiheit

@Iain When I'm lazy I'll do one open-topped in the toaster oven, but full-on in a cast iron pan is best. With a bit more cheese than in that series of pictures, so that a tiny bit of the cheese melts out the side onto the pan right as it's done.

Matt Bear

she doesnt seem stupid!! :)

Wesley

@MattBear Don't tell your wife.

Matt Bear

21:12

she needed another drive on a SQL VM, so I attached one, and she's able to initialize it, create a partition, and format it!

freiheit

Also, @Iain suddenly I really want a grilled cheese sandwich. But I've already committed to plans involving some kind of vietnamese food for dinner. Full moon bike ride.

Matt Bear

without help!

Wesley

Brie makes good sandwiches

Matt Bear

is that sad... that I'm impressed by that little bit of knowledge..

Wesley

@Iain Those are some seriously fancy sandwiches.

84104

21:14

@MattBear Tragic and all too common.

Iain

@Wesley yes, I likes toe look of some of them

freiheit

@Iain come to think of it, you're in a better geographic place for a full moon bike ride. It's a penumbral eclipse tonight. peaks at 23:51 GMT. potentially visible 23:30 to 00:10.

Matt Bear

@84104 my hope for humanity has been restored partially... though I did have to tell her that it was possible to just add another disk... Which she should of known

damn it...

now im depressed again

Iain

@freiheit It's really overcast and wet - no moon to be seen

Matt Bear

can someone hit me in the head with something heavy to make me stupid... so I can be happy

84104

21:16

@MattBear Today is Friday.

TheCleaner

@MattBear Pack your lunch in a Wal-Mart sack and go hang out in the lobby of a 4 star hotel and eat your lunch. That should put you in your place. :)

Matt Bear

@84104 so my wife gets 2 days to yell and nag, and I cant escape... now I'm even more depressed

Wesley

Behold our patron saint grumpy cat and her latest declaration:

Matt Bear

@TheCleaner good idea

Wesley

84104

21:18

@MattBear Get a new [lw]ife.

Matt Bear

@84104 i need to start drinking....

voretaq7

@Wesley Tongues are silver, silence is golden.

freiheit

@MattBear Halfway through your second bottle of tequila, you should be stupid enough to be happy for a while...

voretaq7

@Wesley GrumpyCat is a she?

Next thing you'll tell me DIABEETUS CAT has no harbls.

MIfe

0

Q: how to config kerberos with openldap via clear passwords?

I want to use kerberos with openldap backend. but the problem is kerberos encrypt passwords before save into ldap database . how can I config kerberos to use clear mode for saving (and reading) passwords?

openldap password kerberos

WHY?

Wesley

21:27

@voretaq7 Yes.

voretaq7

@Wesley MY WORLD IS SHATTERED! YOU ARE BAD AND YOU SHOULD FEEL BAD :'(

84104

@MIfe I don't think I want to understand.

MIfe

Clearly a good example of 'knowing enough to be dangerous'.

cole

wee officially Windows 8.1

MIfe

Is it everything you ever wanted from your Microsoft experience @cole?

Matt Bear

21:33

@MIfe can that even be done? and WTF why?

MIfe

Well you can use ldap as a storage backend for kerberos rather than using its main principal database. That makes sense becuase ldap is pretty clever when it comes to its replication strategies.

cole

@MIfe not really, but meh - I just need Windows to play games.

MIfe

I actually dont think kerberos would actually save its passwords in cleartext though anyway. When it comes to people who are apparently IT professionals -- there is still a level of ignorance I have to discover.

cole

I am so less stressed out knowing I don't have to go back to that job

Dennis Kaarsemaker

how was the exit interview?

cole

21:36

@DennisKaarsemaker really lame.

voretaq7

@cole did you hold hands and sing the "I hate you - You hate me" song?

cole

LOL

He was like "so Cole, did the situation we discussed a few months back ever rectify itself?"

Dennis Kaarsemaker

►

Iain

@Wesley That's why I use the ignore so much :)

cole

Me "No, and that's why we're here."

MIfe

21:38

You should have said "yes, and thats why we're here"

Wesley

@Iain It annoys me when I can see the mini icons of people I've ignored. It's like, I know they're still there, and it's this faint background thought that I can't ignore. =) I wish the mini icons were gone and also I wish all text that @'d people I ignored would disappear too.

Nothing worse than ignoring someone, and then you see another person or two constantly talking to them.

Iain

@Wesley aye

Wesley

@cole Update yo' linkedin, gangster!

cole

@Wesley I'll wait a bit lol

Wesley

I need to do by bi-yearly resume, LinkedIn, Career 2.0, etc. update.

TheCleaner

21:40

Well...suck!!!!!!!!!!!!!!!

Dennis Kaarsemaker

@Wesley are you ignoring me, puss?

MIfe

Dont respond wesley.

Wesley

@DennisKaarsemaker I think I removed everyone from my ignore list, but there was a time when I had up to three people ignored.

@MIfe oops. =P

I suspect that @Iain has half of Serverfault on ignore. =)

MIfe

You said you have windows for games. You just lost the mind game @Wesley ;P

Dennis Kaarsemaker

ok, so I added @MIfe to the ignore list. Now how the hell do I remove him again? :)

Wesley

21:42

@DennisKaarsemaker Wee! I just ignored him too! =)

@DennisKaarsemaker Do you really want to remove him from the ignore list?

Dennis Kaarsemaker

@Wesley heh, maybe he should just stay in the list then :D

Wesley

Think about that.

MIfe

Clearly I win at mind games. Thats two schmucks I dont have to worry about anymore.

Dennis Kaarsemaker

ah, mini icon in the user list has a don't ignore thing

Iain

@Wesley nope, just 26

84104

21:44

Yes and no. OpenLDAP can be a backend for Kerberos. We do that here as syncrepl is much nicer than kprop.
Kerberos can be used to authenticate against OpenLDAP via SASL GSSAPI or simplebind -> userPassword {SASL}.
OpenLDAP can have multiple entries in userPassword, including {cleartext}. You could try to keep that in sync with your kerberos.
I think kerberos can be convinced to not user a master key to encrypt it's database, but that's a lot like having /etc/shadow unencrypted. The information is easier to get at, but it's not enough alone for an actual compromise (though if you're storing …

Wesley

Suddenly this room got a lot more tolerable:

2

cole

Iain

yay I finally managed to give away 200 rep :)

Dennis Kaarsemaker

@Iain weren't you aiming for a specific number?

Or was that someone else?

Iain

I wish this was eligible for a bounty too serverfault.com/questions/546521/… can't be long to wait

@DennisKaarsemaker I'm currently above that number

I really must get on and CW all of my old answers

MIfe

21:47

@84104 Pretty sure if you have your users password unencrypted you could trivially get a TGT from the kdc for any user.

Iain

I have 49 pages to go

freiheit

@Wesley What do the rest of us have to do to get on the ignore list?

Wesley

@freiheit LALALA I CAN'T HEAR YOU

cole

@Wesley I must have missed something.

MIfe

@Iain All forms of flattery are welcome. Even internet points.

freiheit

21:48

@cole I believe @Wesley is slowly moving towards hanging out in this room talking to himself...

Wesley

Hello @Wesley

cole

ah

Wesley

Oh hello @Wesley

How are you @Wesley

freiheit

@Wesley @Wesley once you're only talking to yourself, will you talk about which bicycle you'll never actually buy?

Wesley

I'm fine, @Wesley. How are you?

If there was a person named @freiheit who hypothetically referenced me never buying a bike, I'd tell him that I'm going to get a Surly LHT when I get the money which may be soonish.

Iain

21:50

@MIfe seriously, you should write an explanation of how SELinux works in that manner - the usual texts are too dry an difficult to understand

TheCleaner

Off for the weekend boys and girls and Wesley...se ya

Wesley

@TheCleaner Don't kill anyone.

MIfe

@Iain but in all seriousness, most people do not actually consider how many security models operate.

84104

@MIfe Yes, but (at least MIT) Kerberos doesn't store cleartext. By default it stores a salted hash, which is then encrypted with that database's MKey.

Wesley

@84104 Mmmm... salted hash...

MIfe

21:51

@84104 Not unless your trying to be that genius mentioned above.

TheCleaner

@Wesley I have family in the FBI...they should be able to make it look like an accident.

later

freiheit

@Wesley What about the Trek 520? Surly Crosscheck? Novara Randonee?

MIfe

@Iain people just take for granted the way that the security is done on unix. People tend to think its 'ok' to allow a user if they so wished to 777 all the contens in $HOME.

Wesley

@freiheit Trek 520 looked nice, but a vendor isn't close enough to me to test it and buy it. Crosscheck is still a possible contender, but I like the versatility of the LHT. Never really heard of Novara brand before a few months ago, so I'm skeptical.

84104

@MIfe I was saying I think you can get rid of the MKey, you can definitely get rid of the salt, but you can't get rid of the hash. However, DES is stupid weak by today's standards.

Iain

21:52

@MIfe I really don't have to interact with SELinux much but when I do it's a confusing maze of twisty terminology having something like your answer really does make it easier to understand and thence easier to work with and implement

freiheit

@Wesley Crosscheck is just as versatile as the LHT. Mostly just has shorter chainstays. Novara is REI's house brand, and is perfectly fine. Lots of brands you've never heard of that are perfectly fine.

MIfe

@84104 Kerberos does not store hashes of the users password. It stores the actual password.

Wesley

@freiheit Yeah, I think I'll just stick to the LHT. Novara seems fine too, but still... not kewl enough.

ewwhite

I'm a ho!!

Iain

ho ?

MIfe

21:54

@84104 Because its a challenge response mechanism it needs to know the users password to send a challenge.

ewwhite

Three interviews today...

freiheit

@Wesley Get the Surly Straggler instead.

ewwhite

Yes, who're.

Wesley

@freiheit Huh, never heard of that one.

84104

@MIfe I don't think that's right.

freiheit

21:55

@Wesley It comes in, uhm, "glitter dreams"

MIfe

I'll check. :)

Wesley

@freiheit You like disc brakes don't you. =P

ewwhite

How are we still deciding on bikes?

MIfe

Kerberos (protocol)

Kerberos is a computer network authentication protocol which works on the basis of 'tickets' to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed it primarily at a client–server model and it provides mutual authentication—both the user and the server verify each other's identity. Kerberos protocol messages are protected against eavesdropping and replay attacks. Kerberos builds on symmetric key cryptography and requires a trusted third party, and optionally may use public-key cryptography during certain pha...

"The KDC issues a Ticket Granting Ticket (TGT), which is time stamped, encrypts it using the user's password and returns the encrypted result to the user's workstation."

ewwhite

I tried to send @wesley a bike.

MIfe

21:57

If it was all just hashes there would not be a master key.

Wesley

@ewwhite Did not! =P

@ewwhite I've mostly decided. Surly LHT.

It's $1300. Add some kitsch like a helmet, maybe gloves, some fenders, blah blah, $1500 total to get me on the road.

MIfe

@Iain I agree that SELinux is sparse when it comes to documentation. Especially with regards to RBAC (which is pretty cool if you can get it working)

freiheit

@Wesley Disc brakes mean never wearing out a wheel again. Still sad about killing a rim on my LHT early this year.

MIfe

@Iain Personally, and more fundamentally than that, people should actually know what the whole point of it is.

84104

@MIfe "The client transforms the password into the key of a symmetric cipher. This either uses the built in key scheduling or a one-way hash depending on the cipher-suite used." Still not convinced that a KDC has encrypted passwords. I'll have to dig deeper.

Transcript for