The Comms Room

Journeyman Geek

16:00

@Magellan: its midnight ;p

tombull89

@LucasKauffman I did find the machine chundered a bit when running more than two machines - but the models I have have dual 1.5Ghz and 250GB HDDs.

Magellan

@JourneymanGeek Sydney time.

Journeyman Geek

ahh, damned future people ;p

Dan

@JennyD Hehe

tombull89

"limited time discount" - "offer started 06-19-2012" - and I just verified the code is valid. Hard. De. Har.

Magellan

16:01

soon as we hire another aussie and train them up, I can go back to a reasonable noon to 8 local time.

Jenny D

@Dan Seriously, of course I can get upset and pissed off, and most especially by people that I care about in some way. But I don't keep grudges; I may step away to cool down but I wouldn't just disappear forever because someone upset me.

Skyhawk

@TheCleaner Compaq is dead to me. It was all over when "BBS Download Service" stopped answering my phone calls.

Dan

@JennyD That's okay then - the room was definitely missing you

RIght, I'm off to go have my arse kicked some more by c#

MDMarra

Is @pauska around?

I have an RDS question

Skyhawk

Hm. What kind of RDS question?

MDMarra

16:05

I have a customer using UAG to publish VDI desktops

But they get the "This remote connection could harm your local or remote computer" prompt

The broker and the UAG portal are both using wildcards trusted by GeoTrust so the certs are good

just not sure why they're being prompted for that

Stack Exchange

Standalone Sysadmin: Come Work With Me! We're Hiring a SysAdmin!

posted on January 28, 2014 by <a id='post_author' class='fn' itemprop='name' …

So, one of my coworkers has left, and we're currently looking for someone to take over as the primary Linux admin on the team. There are currently three of us, including David Blank-Edelman, who you might know as the author of a few Perl and SysAdmin books. Here's the job posting. Submit a resume and […]

Basil

morning

TheCleaner

@Skyhawk LOL

ewwhite

@StackExchange ooooh

TheCleaner

This guy sure wants to do EVERYTHING from his installer. (note previous question as well)

0

Q: deny local logon for a new user through command line windows server 2008

I am creating a local user account that I want to be able to connect over ftp, but not log on to the server, I believe the way to do this is to deny local logon but am unsure how to achieve this via the command line. This needs to run from an installer on windows server 2008 hence the command li...

tombull89

16:15

Ars Technica's review of the 2013 Mac Pro. "Price as reviewed: $6,499" hnng

TheCleaner

Yeah, but it ain't working for them...it's with him at his University.
So I'm assuming sucky pay? I say that because I did a year contract at a local university and made about 20k less than the average sysadmin was making at a private company. They touted the retirement system and tuition allowances, but I still thought the pay was pretty lousy.

Magellan

@TheCleaner yeah, that's why I walked away from that job offer I received 3 weeks ago.

ewwhite

@TheCleaner Oh, okay. I'll go work at StackExchange then...

2

Site Reliability Engineer, Networking

Stack Exchange

ciscohaproxyrediswindows-server-2012

Stack Exchange is growing fast, and our infrastructure needs just keep getting bigger. We’re looking for a…

Posted on Careers 2.0 on January 24, 2014

voretaq7

Dirty secret: Any time a job specifically mentions Linux (or worse, a specific distribution) I automatically move it one slot down in the list of positions to consider

ewwhite

Oh wait... StackExchange told me how woefully unqualified I was to work there...

2

Tom O'Connor

16:20

@ewwhite Really?

voretaq7

@ewwhite its OK everything you need to know you can scrape off SF :-)

TheCleaner

@ewwhite Sure but then you'd never come back to SF, except to post in Meta once a year about how you guys still like us and then go back to SO.

ewwhite

heh, yeah.

Bart, what?!?

:)

TheCleaner

-1

A: deny local logon for a new user through command line windows server 2008

The answer in this thread isn't exact, however it should start you on your way. In a nutshell, you just want to use the command line to modify the registry value of the Deny Logon Locally (or Interactive Remote or both).

Tom O'Connor

Bart who?

TheCleaner

16:21

Hopefully that guy doesn't go all "SnakeDoc" on us now.

tombull89

@ewwhite o.O

ewwhite

@tombull89 It burned a little.

Tanner

@ewwhite Not enough Windows?

ewwhite

@Tanner I was asked a bunch of BS trivia questions, and bristled at it

Tom O'Connor

I've been repeatedly sending the lyrics from Eric Carmen's "All By Myself" to syslog for the past couple days. Nobody has noticed.

Tweeted by sadserver on January 27, 2014 at 5:30 PM

tombull89

16:27

@TomO'Connor d'aww.

voretaq7

The scheduler and I have been chatting, and we've decided that web requests are the last thing we feel like doing right now

Tweeted by sadserver on January 28, 2014 at 2:30 AM

The server quits.

Magellan

@ewwhite they're a windows shop. I always find those places to be suspect.

Tom O'Connor

I want to write a bot now that'll randomly squirt song lyrics to random IP addresses, hoping to find an unfiltered UDP:514 syslog out there somewhere.

ewwhite

@Magellan Nah, Kyle told me I wasn't good enough.

3

tombull89

shit's on fire yo

Tweeted by sadserver on January 23, 2014 at 8:39 PM

ewwhite

16:28

So I took the job at Logicworks instead.

Magellan

@ewwhite Heh. That why he doesn't hang here anymore.

ewwhite

He said something about me "going back and learning fundamentals..."

Magellan

@ewwhite Cute. More confirmation of my impression that it's a company populated primarily by assholes.

ewwhite

I think I was asked the, "what happens when you type www dot blah in your browser and hit Enter?" question.

Magellan

@ewwhite standard fare in every interview I've ever done.

ewwhite

16:33

I think I replied with, "suck my ASS!!!"

Nathan C

@ewwhite "Gee, nothing?"

Jenny D

@ewwhite That's a schoolbook question, not a sysadmin question...

Mathias R. Jessen

lol, the Danish Prime Minister yesterday afternoon:

ewwhite

@JennyD Right, over time, I've grown impatient with questions like that...

Jenny D

@ewwhite If they are interviewing people for entry-level - then yes, it might be valid. Someone with your experience? It's insulting.

ewwhite

16:34

I used to have a a crib-sheet of things I'd encounter in every Linux/finance interview...

Nathan C

heh

ewwhite

hard-links/soft-links/Nagle's algorithm/CPU schedulers/rtctl/cset/taskset/common sysctl settings.

what to do if a filesystem fills up with a runaway logging application...

Jenny D

@ewwhite shoot the programmer? No wait, that's wrong.

Set programmer on fire as warning to others.

Skyhawk

@JennyD Naw. Log trucks. Lots of them.

Magellan

@JennyD I so wish that were the case.

ewwhite

16:39

@Magellan Is DevOps still the way of the World?

Magellan

@ewwhite of course it is. My Dev are too clueless to even figure out DevOps though.

really.

ewwhite

@Magellan I've heard a lot less of devops speak recently

Magellan

each of them has their own personal server hardware. and if it deploys on their own personal hardware, it's good enough to ship.

And my group gets to deal with figuring out how to do 1500 deployments.

Tom O'Connor

@ewwhite Not if this is to be believed: dave.cheney.net/2014/01/23/what-did-devops-mean

Magellan

and then they whine that we're 5 builds behind and throw hissy fits to avoid issuing hotfixes.

ewwhite

16:42

@TomO'Connor I hated the word.

Tom O'Connor

I dunno. It got me some very lucrative jobs.

ewwhite

@TomO'Connor how lucrative is lucrative?

Jenny D

@TomO'Connor That article does make sense. But the word has buzz so it's not going to die...

Tom O'Connor

@ewwhite The best paid one (which ironically was the least enjoyable) was about 100K USD equiv.

give or take

ewwhite

@TomO'Connor See, a good DevOp (singular) in Chicago or New York can get $150k-$200k.

Tom O'Connor

16:44

@ewwhite finance?

ewwhite

mainly because the finance companies are starting to embrace DevOps (automation) in that sense.

Tom O'Connor

I refuse to work in finance.

MDMarra

btw - this customer has a standard wildcard cert from a trusted CA that they feed into openssl and export "new" certificates from, except they're all untrusted. And they install them everywhere. wtf

ewwhite

but then the startups are trying to get the same talent pool....

Tom O'Connor

I turned down a job with a payday loans company which would've probably been closer to 150k

MikeyB

16:46

@MDMarra So they sign new certs with a non-signing certificates and then wonder why they don't validte?

Tom O'Connor

because of their ethics.

or lack of.

MDMarra

@MikeyB yes

voretaq7

@TomO'Connor you're a sysadmin. Ethics don't matter :P

ewwhite

@TomO'Connor heh, I did the same... plus they used Debian.

MikeyB

@MDMarra Cause it's SO HARD to just make your own CA and make your devices trust it.

Tom O'Connor

16:47

Oh, they totally do.

These are the folk who lend money to people with no credit rating, then the interest goes up daily, so the APR is like 5600%

it's just wrong

ewwhite

Usury...

Tom O'Connor

Payday loans in the United Kingdom

Payday loans in the United Kingdom are typically loans of up to £500 to be repaid over a short term, or until "payday". In the absence of restrictions on interest rates the typical annual percentage rate (APR) for payday loans can be 1,000 percent APR or more. A typical payday loan in the United Kingdom costs as much as £25 for every £100 borrowed per month The Payday loan industry in the United Kingdom has grown rapidly, with four times as many people using such loans in 2009 compared to 2006. In 2009 1.2 million people took out 4.1 million loans, with total lending amounting to £1.2 b...

TheCleaner

I almost thought @MDMarra would jump on this one with a fiendish rub of the hands and thoughts of rep gold. But I don't know...it seems like a good answer would be a book. I considered adding a few options for each but even then my head started swimming with alternatives and rabbit trails.

0

Q: What are some good reasons to create a new forest, child-domain, tree, site, OU in Active Directory?

When is it worth it to create one of the above and when is it better to keep things in the same place?

active-directory domain

MDMarra

@TheCleaner goddamn it. There goes my lunch break

voretaq7

@ewwhite Usury laws even in the US aren't necessarily that good

e.g. "H&R Block's Rapid Refund" that can wind up costing you more than your refund

ewwhite

16:52

Linux people... thoughts on this?

MikeyB

Stupid question... how do I do this properly:

ewwhite

XFS (zd16p1): Filesystem has duplicate UUID a22fbb0d-b6ad-48a7-9a86-56276d19230c - can't mount

MikeyB

@ewwhite You are using multipath?

ewwhite

@MikeyB naw, trying to take advantage of ZFS zvol snapshots of XFS volumes for a tape backup.

MikeyB

@ewwhite Trying to mount via uuid or devname?

ewwhite

16:53

dev name...

there's a duplicate UUID

mounting with nouuid

MikeyB

@ewwhite Oh.. I was going to say try '-o nouuid'

ewwhite

burn...

[root@OGC_Mirror ~]# mount -t xfs -o nouuid  /dev/zd16p1 /pprobackup
mount: block device /dev/zd16p1 is write-protected, mounting read-only
mount: cannot mount block device /dev/zd16p1 read-only

Got it...

mount -t xfs -o nouuid,norecovery  /dev/zd16p1 /pprobackup

TheCleaner

@MDMarra I retracted my close vote. Have at it...should make for a canonical possibility on AD design if it rocks.

pauska

@MDMarra it's a warning from activating resource mappings

(local printer, local disks etc)

MDMarra

@pauska We have those disabled per UAG policy

pauska

16:58

If it's published through UAG then it should be signed..

@MDMarra so no redirection at all? not even clipboard?

MDMarra

@pauska none

no clipboard, printers, or drives

the UAG policy is set to "never" for those three

TheCleaner

@MDMarra - whoa...the OP deleted the question...maybe you should create a question AND the answer if you still want to go down that path?

MDMarra

Also, who the fuck deleted that question

Can a mod undelete it?

Tom O'Connor

OP

but yes, i've undeleted it.

Stupid OP.

TheCleaner

Hey...I'll be happy to create a new one with a better question scope if it means free rep... :)

Iain

17:00

Was it a stupid question ?

MikeyB

0

Q: Workstations in remote site don't know about new AD realm

I've recently migrated a classical Windows Domain (samba3) to an Active Directory domain (samba4). Workstations in remote sites do not have a local DC so they are not aware of the transition, hence they do not automatically migrate to the Active Directory setup and I have to join them manually. ...

windows active-directory samba4

Tom O'Connor

@Iain Not really.

MikeyB

Hey! Look! A question.

MDMarra

@pauska what should be signed?

TheCleaner

It really borders over to the "book answer" @Iain -- but since Mark doesn't mind spending the time to write the book answer, I retracted my close vote.

pauska

17:01

@MDMarra the RDP file that the client gets

try exporting the RDP instead and launch it

and try to edit it.. it should be encrypted

MDMarra

Its just using the pre-defined RDP application in UAG

MikeyB

@pauska "encrypted"

pauska

@MikeyB well.. yeah

TheCleaner

@MikeyB I thought you were deploying 7,000 RODCs?

3

MDMarra

@pauska How do I do that - never used UAG

MikeyB

17:04

@TheCleaner 28000!

pauska

@MDMarra I can't remember to be honest, been years since I've touched it

MDMarra

ah ok

TheCleaner

@MikeyB well, now that's just silly.

MDMarra

@TheCleaner done

@pauska do I have to add the UAG portal's certificate's thumbprint to the trusted RDP shit?

Mathias R. Jessen

@MDMarra Same as everything else, make sure the clients trust the root CA

MDMarra

17:09

Yeah, they do. It's signed by GeoTrust (Equifax)

But I'm seeing some things about needing to configure the thumbprint in RDS policies

but I dont know how that factors in with UAG

Mathias R. Jessen

And then blogs.msdn.com/b/rds/archive/2011/04/05/…

MDMarra

there are so many moving parts to this that I've never worked with, I'm half tempted to just have them open a ticket

Mathias R. Jessen

That blog post ^ contains a walkthrough of creating a GPO with a specifically trusted thumbprint for rdp

MDMarra

@MathiasR.Jessen How does that factor in with UAG and non-domain computers

UAG is actually publishing the RDS session

So does the GPO need to apply to the UAG server...or

Mathias R. Jessen

@MDMarra That would only apply to domain joined computers

Are you trying to build some sort of FFA portal?

MDMarra

17:13

FFA?

Jenny D

Home time. I will be back at some point, not tomorrow though. waves

ewwhite

@JennyD lata

missed ya

MDMarra

@MathiasR.Jessen instead of VPN to get a VDI desktop, they go to the UAG portal, launch the published RDP application to connect to the VDI farm, then they get a VDI session

They were going to use RDWebAccess and a RD Gateway at first, but decided on publishing through UAG instead

Mathias R. Jessen

An the VDI farm is behind UAG as well?

MDMarra

yes

So they have a gateway/webaccess box that isnt really being used, and are basically connecting straight from the RDP application published in UAG to the VDI farm

the subnets of the VDI desktops and the broker, etc are all trusted in UAG

And they can connect

But they get the warning I mentioned when connecting

If they click "Continue" they're prompted for creds a second time even though UAG us configured for SSO, and then they connect

Mathias R. Jessen

17:17

@MDMarra Interesting ... I've only done RD publishing though UAG with wildcard certs

TheCleaner

@MDMarra More concise then I would have expected. Nice job.

MDMarra

@MathiasR.Jessen This is with a WC actually

TheCleaner

Oh @MDMarra - there's also this article you can use to help your post too.

MDMarra

Well there's a wildcard on the broker, etc, but the portal itself has a single name cert from the same CA

TheCleaner

"Active Directory offers five basic containers: forest, tree, domain, site and OU. These containers, used to segment and organize a network, were designed with specific uses and restrictions in mind. Thus, it is important to understand these restrictions when planning out your AD-based network.

Forests are used to create a structure with administrative independence and autonomy from any other forest. Each forest has its own unique schema. In most cases, a single organization should have a single forest. The reasons for multiple forests include merger or acquisition of an existing IT depart…

searchwindowsserver.techtarget.com/tip/…

from there ^ ... I didn't feel like quoting the whole article and editing your answer, and didn't want it to be a separate answer from yours.

Mathias R. Jessen

17:27

@MDMarra The clients are all Win7? Sounds a bit like this issue

MDMarra

@MathiasR.Jessen It's exactly that issue

JohnD

I only want some key points, didn't expect long answers. — tr3quart1sta 34 mins ago

MDMarra

But thats literally the only thing I've found that mirrors this situation so I dont know if I trust it haha

JohnD

boy, you came to the wrong neighborhood.

MDMarra

@MathiasR.Jessen But yeah they have UAG 2010, 2012 R2 Hyper-V clusters and 2012 R2 VMM, 2012 R2 RDSHs, and Windows 7 VDI guests

I may just tell them to open a case with Microsoft

:(

Too many things outside of my area of expertise, and I'm just racking up billable hours guessing at this point

ewwhite

17:29

@MDMarra Make dat money!

MDMarra

ha

I get paid the same

ewwhite

(and feed me Cheesesteaks next visit)

MDMarra

gross

Next time, we'll go to Baby Blue's BBQ. They have great pork there

ewwhite

@MDMarra Hmm, I do need a daily helping of cow, chicken and pig.

Ry Jones

yarr whitespace will be the death of me

MDMarra

17:33

@ewwhite They have a dish there that has pulled pork, a smoked sausage, and brisket with corn bread and a side of your choice (I get mashed sweet potatoes)

You basically die after eating it

Dennis Kaarsemaker

mmm, pork

ewwhite

@MDMarra Hmm

voretaq7

@ewwhite First you take the chicken, and wrap it n a pig. then you take the pig and wrap it in a cow. Then you take the cow and you slather it in mashed potatoes. Then you deep fry the whole thing.

2

...now I want that :(

Dennis Kaarsemaker

potcowporken!

ewwhite

Just running a SCSI tape backup of a snapshotted XFS filesystem on top of a compressed ZFS block volume running on an HP ProLiant Smart Array RAID 1+0 logical drive comprised of SATA disks... NBD.

The weird benefit of this is that the tape backups run 300% faster...

But is 300% 3x as fast or 4x as fast? :)

Anonymous

17:47

@ewwhite what terminal emulator is that?

ewwhite

12

Q: "X times as many as" or "X times more than"

Suppose John has 5 sweets. Is there any difference between the following two sentences? Jack has 3 times as many sweets as John. Jack has 3 times more sweets than John. I prefer the first construction and would know unambiguously that Jack has 15 sweets in this case. However in the sec...

differences

@PatoSáinz Eterm

Tanner

17:59

@voretaq7 Gonna need a bigger deep fryer...

voretaq7

@Tanner we're going to use the eerie canal locks.

the goal is to eventually get the meal wrapped in a mink whale :)

ewwhite

@voretaq7 You like security, right?

voretaq7

Also why is my development environment being an angry bitch?!

@ewwhite security is inconvenient :(

ewwhite

@voretaq7 the software vendor I deal with is pushing a solution that provides direct access to their Linux server shell/console via code.google.com/p/shellinabox

"It's okay.. it's secure... we're using SSL"

except it's a web browser link right to the shell of a production server.

voretaq7

@ewwhite Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal emulator . . .

Lock In A Sock implements a lock in a sock that can crack open the skull of anyone stupid enough to install Shell In A Box

2

ewwhite

18:04

So I asked the developer to at least add a form of Apache authentication...

just so a stupid user with test:test can't result in an a breach that I can't audit/trace

Chris S

@ewwhite I prefer to take whatever is said 100% literally. I don't believe there is any ambiguity in how either of those statements is written. There is only the question of the person who reads it being capable of interpreting it correctly, which should never be assumed.

ewwhite

@ChrisS so my backup runs at 4GB/min instead of 1GB/min...

Chris S

Where's the 300% number coming from?

ewwhite

@ChrisS some people would say "300% faster". Others would say "400%"

Ry Jones

or you could not confuse people and use the numbers directly. if you want to communicate, communicate directly.

voretaq7

18:10

@RyJones this is benchmarking! We don't "Communicate" here!

Basil

@ewwhite 4x the speed

Ry Jones

@voretaq7 true.

this is why we have basis points, btw

Like percentage points, basis points avoid the ambiguity between relative and absolute discussions about interest rates by dealing only with the absolute change in numeric value of a rate.

voretaq7

I think you should just use overwhelming force to take the sweets from Jack and John. Then, unambiguously, Jack has 0 times more sweets than John. As a bonus, you now have plenty of sweets of your own. — Ben Hocking Jun 16 '11 at 12:38

There. There's your fucking answer. And I ripped the CPU out of the benchmarking machine and threw it in the lake.

Ry Jones

So today I learned: bd.com/us/diabetes/page.aspx?cat=7001&id=7245

now I know why Lantus and all my syringes are labeled U100

Chris S

@ewwhite Yeah, both of those would mean the same to me.

Tanner

18:16

@RyJones US has bigger insulin syringes? I guess that shouldn't surprise me.

voretaq7

@Tanner same syringe, higher concentration of insulin in the solution

Ry Jones

@Tanner different concentration, 100 units per mL versus 40

Tanner

ahh

voretaq7

0.01ml = 1 unit

so theoretically easier to dose (U40 makes no sense to me. U50 would be sensible...)

pauska

@MDMarra wilcard support for RD services are a bit.. sketchy

ewwhite

18:17

@voretaq7 So ShellinaBox==bad?

pauska

last time I checked the subject name had to be an exact match - at least for RDS

voretaq7

@ewwhite anything that involves remote command execution via a web browser is bad IMHO

ewwhite

@voretaq7 would adding apache .htacces-style auth be better?

(marginally)

voretaq7

@ewwhite better than unauthenticated access certainly

and using TLS would be mandatory

ewwhite

@voretaq7 If you open right now, it gives a console login prompt.

SSL is there to protect the session flow

voretaq7

18:18

@ewwhite that's still pretty fucked because I can sit there all day and brute force your username/password pairs

they should use a web SSH client

ewwhite

but now I've lost my granular SSH auditing... logging, denyhosts, AllowUsers.

voretaq7

preferably one that authenticates with keys.

ewwhite

and my clients are buying this left and right.

voretaq7

@ewwhite you should be doing your auditing and access control through PAM

which means you just add those to the chain

MDMarra

@pauska Hm

Nathan C

18:20

@ewwhite And people will be ~~hacking~~ showing them the error of their ways

MDMarra

It's a single name on UAG (which is the gateway)

ewwhite

@voretaq7 well, the brute force issue... denyhosts is an easy thing to toss on a server with SSH open to the world

just think how long I've fought to get rid of telnet... this is a step back

Nathan C

can't brute-force a server with keys-only auth ;)

voretaq7

@NathanC sure you can. It just takes more force.

ANY system can be brute forced, given sufficient resources.

@ewwhite Make any client who wants this thing sign a big scary form saying you have no responsibility for security in the environment

and find/offer a web-based SSH/key-based login system

ewwhite

@voretaq7 I've tried web-based SSH in the past.. Mindterm...

voretaq7

18:23

or make them use Apache certificate-based authentication to connect to this thing

@ewwhite there are dozens of them, one has to not suck.

ewwhite

but getting the terminal emulation for the application just right is a problem.

I need 81x25, 16-color, extended fonts, etc.

voretaq7

@ewwhite get one that speaks VT100 or ANSI and doesn't just fucking lie about it

ewwhite

@voretaq7 We use a customized putty.

but Ansi25 works... SCOANSI works... some other shit

voretaq7

@ewwhite then you deserve the problems you have man :)

ewwhite

@voretaq7 I'm just trying to generate a cogent argument against leaving a wide-open web interface...

voretaq7

18:26

first of all 81 x 25 you're already one of those Hitler cats :)

pauska

@MDMarra maybe UAG does some voodoo tricks, but I've only published RD stuff through RD Web Access

voretaq7

@ewwhite It's a wide open web interface. that's the cogent argument. You're offering up a terminal for anyone who wants to try to break in.

ewwhite

@voretaq7 but wide-open SSH is better?

MDMarra

I think they dont have the right cert on the gateway config

Nathan C

It surprises me that in 2014 people are still using DOS-style terminals for applications...then again...

pauska

18:27

Gotta ask though - why UAG? Isn't the built-in stuff in 2012 R2 enough?

MDMarra

So they have the right cert on the UAG trunk but not the gateway role

checking now

voretaq7

@ewwhite ssh should be forcing you to use keys

ewwhite

@voretaq7 for root, yes...

voretaq7

I haven't configured a machine to allow username/password auth via SSH in years. It's either a key or OTP

ewwhite

but remember the application.

MDMarra

18:28

@pauska They use UAG to publish otehr things, so its nice to have their VDI pool available through the same portal

especially if they get SSO working

ewwhite

(warehouses, hourly employees, high turnover, salespeople)

voretaq7

@ewwhite For everyone. and root shouldn't be logging in period - you should be connecting as an authorized user and using su or sudo...

Iain

@NathanC because enterprise

pauska

make sure they have have done the portal publish thingy correct

you gotta find some template file, edit that a bit and then publish with a complete list of any kind of server or subnet involved

broker, gateway, vdi pool, subnet for the vdi etc

ewwhite

@voretaq7 That only exists in academia... root-login4lyfe!

Joel E Salas

18:29

@ewwhite lol, academia and also where I work

pauska

google "microsoft uag vdi" and you'll see

MDMarra

@pauska yeah its in the UAG config not the RDP template

voretaq7

The only way you can log in as root on my corporate machines is to be physically at the console.
The only way you can be root on my personal machines is by being physically at the console, shutting the system down, and bring it back up single user.

MDMarra

connecting works fine, its just with an extra prompt

ewwhite

@JoelESalas heh... Well, in my cloudy, financial and pr0ny experiences, root login was pretty normal.

Iain

18:30

@ewwhite I don't have any servers that root can log in to over ssh

Joel E Salas

@ewwhite The only thing that the DevOps Cloud people, the financial people and the porn people have in common is they all like rawdoggin' it

ewwhite

In fact, the most developed sudoers files I've ever made were in the produce industry.

voretaq7

@ewwhite They're Doing It Wrong

ewwhite

@JoelESalas well, I can't disagree...

itch

voretaq7

@JoelESalas and yet again "Banks should never be used as an example of how to do ANYTHING" :-)

MDMarra

18:32

@pauska they had a self-signed cert on UAG, but it was in the RDP gateway config

ewwhite

@voretaq7 heck, every server at last firm had the same root password

but without consistent out-of-band access and shaky hardware, I needed root console pretty often,

voretaq7

All of our servers here have the same root password. It's really long, you'll never remember it, and you'll have to GPG-decrypt the master password list to type it in.

ewwhite

single-user mode to repair ext3 because: Supermicro

Iain

@ewwhite and pinned kernels ?

ewwhite

:( that too

I admit, I go to all of my systems via root... but keep a sudo-enabled service account managed by Puppet.

(because I know I'm doing it wrong)

Ry Jones

18:36

@ewwhite you're wrong and you should feel bad

ewwhite

@RyJones I'll flog myself with a bag of $100 bills...

Ry Jones

also, nobody told me Lantus expires 28 days after you open the bottle, so I've been injecting my cat with non-insulin for 5 months: care.diabetesjournals.org/content/26/9/2665.full

@ewwhite if still wrapped, that could hurt

Iain

IS apache 2.4 sufficiently different from earlier versions that we should give it it's own apache2-4 ?

Ry Jones

@Iain I know there was a change in config handling, let me look

httpd.apache.org/docs/trunk/new_features_2_4.html shows a lot of churn, esp wrt mod rewrite

Iain

@RyJones There's changes throughout

voretaq7

18:40

@Iain I think so

it's pretty substantially different

Ry Jones

@Iain I think I'd lean towards a new tag, yeah

Iain

2-4 or 2.4 ?

voretaq7

@Iain dots would be preferable to dashes

Iain

done

voretaq7

apache2 should probably become apache-2.2

unless you guys see some egregious "no" cases for that?

Iain

18:42

I don't see one now

Ry Jones

here are the 2.2 changes from 2.0: httpd.apache.org/docs/trunk/new_features_2_2.html

voretaq7

@RyJones I don't care about the changes, I care about the questions

If there are a substantial number of apache 2.0 questions in there I can't just rename the tag

Ry Jones

gotcha

Chris S

@Iain I think so as well.

voretaq7

(intuitively I don't think many folks switched to Apache 2.x before 2.2)

Chris S

18:46

@voretaq7 2.2 was released almost a decade ago. 5 years before SF existed. If there's 2.0 questions around, F'em.

voretaq7

@ChrisS I'm going with that logic because sorting the tag is painful :-)

freiheit

I totally have a box with apache httpd 2.0.52 installed on it...

voretaq7

multiple renamings retaggings and rewikiings completed

@freiheit you're a filthy godless heathen :-)

Anonymous

who'd ever think that is a good idea

freiheit

18:57

@voretaq7 Nono, I definitely bathed today. More of a godless barbarian heathen...

Iain

@voretaq7 did you alias myapache2.4 - it just stopped working

freiheit

RHEL4 came with apache httpd 2.0, and I still have an RHEL4 box, because terrible terrible reasons

Iain

or rather seems to have become apache-2.4

voretaq7

@Iain yeah I aliased that to apache-2.4 (and I'm going to create apache2.2->apache-2.2 as well)

Iain

bummer - that may be a badge opportunity lot

speaking of which I figured out how I lost my Gold Linux badge - CW all the things does it :(

voretaq7

18:59

@Iain it should carry over to the new name in the merge

(if it doesn't that's a bug)

Site Reliability Engineer, Networking

Transcript for