« first day (901 days earlier)      last day (4366 days later) » 

14:01
@ewwhite tried them all to no avail, this system is now freshly reinstalled. On co5 we also don't use any of that.
Finally. I have a build system.
-279.11 kernel didn't help, trying -279.1 now
no difference in kernels older than that.
do you have a tuned-adm profile set?
if not, you may not be testing the same thing.
and are you impacted at all by the XFS preallocation issue?
yup, see allocsize=1m
and no on tuned-adm at the moment
well, you should...
the CFQ scheduler changed substantially...
14:04
for optimizing, yes. But not for comparing.
if it's a scheduling problem, it should appear with ext3 as well, and result in crappy performance. Not an increase in IO
CFQ on EL5 is not comparable to CFQ on EL6
And I tried deadline and noop, no change
@RobM do you guys block facebook from school-owned pc's?
@ewwhite the XFS reporting bug is scheduled for fix in rhel 6.5 btw....
@pauska I was expecting 6.4... and it didn't show.
14:11
@pauska Yes. 6th formers get YouTube and twitter (16-18) but Facebook is blocked for everyone. We have a staff proxy if we need to access it in case of Cyber bullying, etc.
yeah I've blocked every video/stream site I could find
We block FB by default. There is a "filter bypass" group that staff may apply for membership. These are appoved/denied by the building administrators.
@tombull89 why is twitter ok but fb isnt?
the thing is.. our daughter company isn't a school per say
they get hired by the norwegian unemployed system to educate unemployed (and immigrants) in how to be better at finding new jobs
unemployed people are usually not very enthusiastic about doing anything smart with their life, so they spend ALL their time on the net doing non-productive stuff
@MDMarra Don't know. Thats what we were told they could have, so that's what they got. Also I think Twitter is less of a time black hole than Facebook.
14:13
Like chatting?
what I'm worried about is that they might battle me on this, saying that some companies recruit via facebook/twitter..
@pauska So let them stay unemployed?
@MDMarra they are using up all our bandwith
you might say, "facebook doesnt take alot of bandwith"
Get a Packeteer
No, it does
but 700 people playing farmville at the same time does..
14:14
At $Lastjob facebook.com was the 3rd highest use of bandwidth in the dorms
youtube, netflix, facebook, then everything else
yeh
@pauska that's such a small % though.
But I mean, get a packetshaper
I guess I'll just block all social sites then, and just whitelist the ones they need
like linkedin
@MDMarra is it free?
this is low, low, low budget.. its the same daughter company that buys used laptops with XP on them
right now im using squid and dansguardian.. working fine actually
Online TV streaming/catch up took out a fair chunk of our bandwidth as well.
14:16
yeah, and that one is not so easy to kill
I can't block flash, cause they use it for some educational stuff
I can't block every site that has a video clip on it either
Dan
Dan
@RobM @tombull89 @anyoneelse - do you guys know how to specify the Adobe CS6 install directory when doing a packages install?
@pauska of course not
@Dan Nope, sorry, we've not got CS6 here.
Dan
Dan
@tombull89 :( Or any of the Version 6 products would do! It's actually Master Collection I think
@pauska Granted. In a previous job we had e-mail reporting for the top 20-odd domains by bandwidth. At the end of the week go though the domains and block the most popular ones, then repeat each week. List soon goes down though.
Dan
Dan
14:22
It would help if there was the occasional bit of classroom discipline instead of looking to technology to solve all of their ills
@Dan In the payload XMLs there is [AdobeProgramFiles] for windows installs. We have not ever tried changing this.
For example: AdobeDesignWebPremium6-mul.proxy.xml
Dan
Dan
@jscott I used the Enterprise Deployment tool and there is an option that says "Specify the path durign the deployment" which is ideal for this scenario as some need to be installed to D:\
BUT, nowhere does it say how :(
It looks like the individual payload (e.g. Photoshop 13) can use <Property name="KeyFolder">[INSTALLDIR]/Adobe Photoshop CS6</Property>
Sorry, can't be any help, I've not made any tweaks to that.
Dan
Dan
You're not missing out
Although, right in the install-en_US.xml (in the deploy folder) there's this:
<Property name="INSTALLDIR">C:\Program Files\Adobe</Property></Properties>
You may need the install-en_GB.xml, but that appears to specify the [INSTALLDIR] value.
14:27
/me head hurts
One sec, (I mean 45 minutes) I'll try modifying it.
Dan
Dan
I don't think should be editing the XML
I'm sure it'll be command line, maybe INSTALLDIR= will work with msiexec
Nope :(
@pauska yes we block facebook for students, not staff, on college computers. We did experiment with having it open for all for a little while though.
@Dan Can it follow environment variables?
We use Smoothwall, internally. They have a component which can be installed on staff machines that go off-site and will copy the block list locally and block sites when off-site which is quite frankly a) brilliant and b) evil but we don't hate our staff enough to do that to them.
Dan
Dan
14:33
@SmallClanger I see where you're going with it, but that's messy
@tombull89 Haha, I've not seen that.
@Dan Can't use the built-in ones, then? (%PROGRAMFILES% etc.)
Dan
Dan
@SmallClanger ProgramFiles still goes to C,it's just a manual setting
It's not how I'd do it, but I wouldn't create multiple partitions for these machines, anyway
Ah, right. Yeah, that would get messy, then.
0
Q: Operating System not found when loading DD image in VMware

EdNdeeI provide much details below to hopefully make my issue as clear as possible. Using dd if=/dev/ps3da2 of=/mnt/edexhdd/EDPS3LINUX.iso bs=16384 I copied a fairly huge partition from a physical Linux non-Xwindow installation on a PPC64 architecture (actually the PS3) to an external HDD. The partiti...

@Dan Adobe usually puts out a pretty comprehensive enterprise admin guide for the CS suite
Did they skimp on CS6?
Dan
Dan
14:38
@MDMarra Yeah, I've got it open but it just doesn't detail what to do at deployment
It's irritating me now
thats a bummer
CS5 was pretty thorough
anyone here friends with regexp/pcre?
Dan
Dan
It's installing now
But to the wrong location sniff :(
FOUND IT!
ADOBEINSTALLDIR=D:\Whatever

Thanks for using standard command lines, Adobe. And thanks again for hiding that deep in your SCCM specific docs
14:55
That's why I just fire up orca and look at the properties table
usually educated guessing based on the property name is faster
although adobe cs is a minefield of installers
Dan
Dan
@MDMarra Yeah, I opened InstEd but I like say, INSTALLDIR didn't work and there a few others which are similar so I was getting into guesswork territory and I didn't want to break the installer.
BREAK EVERYTHING
Dan
Dan
It would - this is a Gold image :D
Hey @MarkHenderson, is this where you live? i.imgur.com/tnBrytn.jpg
@MDMarra LOL
We're having intermittent logon/authentication issues - FML
15:11
Google just sent this to our entire company:
Yay for Google Apps! Anyone else think that's a little... less than classy?
Dan
Dan
Well, I think advertising in anything corporate is less than classy, but the advert itself doesn't fuss me?
@Tanner sent it? how? they e-mailed all your corporate accounts with spam?
@pauska Yup.
wow
Dan
Dan
Oooh
15:18
Because they're hosting our email. :|
Dan
Dan
Sorry, I thought it was the gmail ads you get
I wonder in 10 years time
if everyone will say "remember that "Cloud" fad? Where everyone let external companies have full access to all our files and email?"
2
@Dan Oh, that would be no problem. I don't sign up for stuff using my work email... but I don't like that they've opted in all our staff just because we use Google Apps.
"yeah, haha, that was stupid."
Dan
Dan
@pauska I'm not anti everything cloud, but we've had the conversation at work numerous times that it's only going to take one or two serious failures or security breaches to really send this thing back home
15:22
@Dan I'm not either.. we do have our MX'es out there at Microsoft for relay+antispam purposes..
Dan
Dan
The first time somebody hacks Google (And let's face it, they must be targeted 24/7 now) and posts a dump of 500 companies e-mail or something will be interesting
other than that - fuck the cloud
2
Remember when these service were just called "ASPs"
Dan
Dan
I spent £35 on earphones this lunch time, they better be fucking good
@SmallClanger I remember when there were "local" solutions and "hosted" solutions.
::gets out megaphone:: "THEY'RE STILL JUST SERVERS!" at the world in general...
Dan
Dan
15:26
I overhead someone say "Yeah, I think we should move our hosted Exchange solution to the cloud"
in The Bridge, 2 mins ago, by kalina
when the "Messenger service" was still enabled by default and NAT wasn't as widespread
in The Bridge, 2 mins ago, by kalina
I would set my PC name to Microsoft and then net send people on IRC messages about how I knew who they were and the software piracy agency were on their way
@Dan Do it! Ask for two weeks to make sure you get it right, then fuck off to barbados. :)
in The Bridge, 2 mins ago, by kalina
@fredley I think it was something like 1 in 10 people would format
@Dan from what I know - going the office 365 route can save some type of clients a lot of money as you pay per user per month (instead of doing traditional per-year lease of cal's)
Dan
Dan
@pauska Yeah, but think about the statement for a second...
15:28
ye I know.. :)
Dan
Dan
:D
But yeah ,O365 is cool
ON PREMISES BITCH
Dan
Dan
@tombull89 Netsend was the best
yeah, it kinda is.. fits like hell for schools
Dan
Dan
Did anyone else have a lot of fun with Back Orifice and such
15:28
o365+intune
@pauska We're using 365 to pay for office licenses already. £8/user/month isn't bad for office pro.
I used netbus @dan
was fun to open/close cd-roms
@SmallClanger wish i was going to barbados
had a massive loop in the network caused big "$"!up!
Fun aren't they?
Dan
Dan
@pauska I miss those days
15:37
@Dan Google for something called PJLTalk. It lets you send message to be displayed on HP printer control panels - messages such as "Insert Coin" or "Replace User"
Anyone have this happen on their Domain Controllers before? System EventID: 3 (0xd KDC_ERR_BADOPTION)
Dan
Dan
@tombull89 Yep, remember that :D
@Cole No, I make good choices.
:(
@Cole Never seen it on a DC
I've seen it on things that you register SPNs for so that they can use Kerberos for SSO
@MDMarra getting hammered by it
Well we do have SSO in place..
with Centrify
15:39
it basically means that you didn't configure the SPN computer object for delegation
I'd start looking at Centrify first
I thought so, it popped up on 2/10
unless the logs point you elsewhere
We ran the Tivoli Directory Integrator on 2/10... at 2PM - 10:30PM started seeing this issues.
@mdmarra what do you recommend for password aging?
@mdmarra I'm making GPO changes to domain policy to get OWA to work...
Now users are having issues with mapped drives/can't connect to the File server - only way to resolve is to bounce the box.
Leads me to believe we're having authentication issues
15:41
(have to reduce minimum password age to allow people to change their passwords)
but do you guys have password expiry?
and recommend it?
always expire
@MDMarra when?
For your group, every 365 days
We do 180 here, last job was 90
15:44
is 180 reasonable?
yeah
last job didnt expire student passwords at all
how about complexity?
for staff, every 90 days. For students, never.
just faculty/staff
yes to complexity, yes to length requirement
for staff, enabled. For students, disabled.
15:45
really?
disabled for students?
you can have different password policies for different sets of users with win2012
You can in 2008 and 2008 R2 as well
@MDMarra We also disable expiration for students
@jscott I meant complexity
I know, horse staple battery...
15:45
We disabled expiration for students too
no but there is one thing you can't differentiate on 2008/2008r2
Dan
Dan
@MDMarra Students forget their own names. Asking them to rotate passwords is just begging for a queue of idiots outside your door
2
@Dan Not talking about expiration
Dan
Dan
@MDMarra Same with complexity
I agree with disabling expiration for students. I was talking about disabling complexity
15:46
Complexity disabled for all :( The complaints from staff was worse than the students.
I disagree with that unless you bump up the minimum length to like 12 char
can you have different complexity policies on 2008/2008r2?
length, yes. complexity no
@jscott this is true... how do you combat it?
Dan
Dan
I've only seen one school do it, but they disabled password changes and then provided passwords to students. Great solution I thought
15:47
then I STAND CORREECTEEEEEEED
@pauska afaik, you can't do that in 2012 either, since it's a password filter dll
no, you can
Dan
Dan
@pauska 2008 R2 only I think
Or maybe not, I forget
@ewwhite I didn't combat it. Our director said "Disable complexity requirement".
15:47
haha
@pauska So you can say "upper and lower is sufficiently complex for students but faculty/stall need upper, lower and a character"
?
Dan
Dan
@pauska Ooh, fancy
@MDMarra Yeah, you have to do it in ADSI edit though
Also, at the start of this school year, he said "bump expiration to 1 year"
@MDMarra ok, that I'm not sure of
It had been 90 days for staff
15:48
@Dan no you can't
it's a password filter on the dc
Dan
Dan
@MDMarra Oh, I see what you mean now
@pauska that's what I'm talking about when you say different complexities
Dan
Dan
@MDMarra Look, I'm clearly half arsed reading this while working. :D
complexity is just what combination of upper, lower, characters, and numbers are required. length and aging are different
afaik, you can use a FGPP do modify everything except the definition of what "complex" is, because that's a password filter .dll that's registered on your DCs
Dan
Dan
Yeah, you're right
15:50
if you want to change what your DCs consider complex, you need to write your own pw filter and replace your existing default filter on all of your DCs
which is why no one does it :)
Dan
Dan
But when people ask me about password complexity, they tend to mean length and things too
Oh, definitely. But from Microsoft (and GPO's) prespective, complexity refers to what combination of upper, lower, and num/char are needed
fuck
Dan
Dan
Yeah, you're right
I clearly remember microsoft saying that they were going to include different complexity requirements aswell
at teched
guess they jumped over that
15:51
it might be in 2012 still
I was just ranting about 2008 and 2008 R2
no, it's not
the on/off toggle for complexity is one big checkmark, nothing else
while we're at it
@MDMarra Linux has pretty granular PAM authentication settings that can help fine-tune complexity...
I'm strongly considering setting password age to 180 days at $job
but I have complexity OFF at Valley... but should probably need it ON for a new installation.
what the fuck is the point of having 50 days if it just creates a pile of notes on workers desks with passwords...
15:53
@ewwhite agreed. I'd do complexity on, 180 or 365 day age limit, 7 char minimum
K. 180 days.
true... it's like 42 days at my job
yeah, maybe even 365 days is good
and I'm pissed...
I am so tired of workers coming in and asking how to set a new password on their phones..
because I need my AD password AND a two-factor auth.
15:55
42 days WITH two-factor is kind of bullshit
you could have 99999999999 days with two-factor honestly
for every Linux terminal I open, I have to enter 15 characters and refer to a one-time password on my iPhone
I swear to god if IBM fucked up our shit
I'm going to be pissed.
@pauska is that true?
@ewwhite we had a recent audit here, 180days was the recommended password age
@ColdT Perfect...
(watching the Pope leave...)
15:58
@ewwhite yeah, why not? if you have a RSA chip AND a password - why should you need to change the password?
@ewwhite they were happy with 6 chars password length, upper lower cases and number
We had a student ask what their Date of Birth was, when we told him we'd used it for their password. Not what format we used, or did we use the right date but what is a date of birth >_>
2
Annoying, it's saying we have a duplicate SPN but setspn -X doesn't show a duplicate SPN for the server it's saying it has one for.
and yes, we too had idiots queuing up cause they don't know there username even though it is on their stupid ID card
@ColdT I'll do 6 char... @mdmarra - do you disapprove?
15:59
@RobM I hope you told him "The same date as when Jesus cried"
@ewwhite i'd personally go for 13 chars + if i had it my way :)
we do 6 char + complex here
I just looked at him. I couldn't think of anything to say that would adequately express my feelings at the time without also getting me fired
@ewwhite meeeeeeeeeeeeh
but sure
why isn't 802.11k a well-used standard by now?
16:03
Updating policy....
it would make wireless roaming so much easier and better
@ewwhite don't touch too much in the default domain policy :)
just the password settings
I know.. it needs to be modular...
#1 tip for that policy is to ALWAYS remember that it's the only place where you set security policies
you can not have more than one policy with them
and like mark said, god kills kittens when you put like adobe reader .msi installs in the default domain policy
2
@pauska That made me dry heave.
16:06
@pauska ooops, I'll remove it.
Hate downvotes!
Dan
Dan
@pauska Nothing should be in the Default Domain Policy
(Except stuff that has to be of course)
@Dan Except my Outlook Junk Mail rules, right?
hey @ewwhite just wanted to drop in and tell you I completed my app. It runs awesomely on a load balanced set of linux containers, blocked from the internet and running limited user accounts. Details of my implementation are here :
1
A: evaluating perl code securely in a virtual machine online

gideonAfter 13 days of hard work, I finally did it!! I explored FreeBSD Jails, my lack of networking experience and the fact that I had to rebuild the OS many times drove me away. FreeBSD is really cool though!! I'll get back to it soon. I looked bleakly at OpenVZ and then thanks to @ewwhite I revisi...

@ewwhite appreciate your help with the whole thing :)
@gideon excellent!
So LXC has been good and stable?
yea. I even fork bombed myself by mistake (while running as root) and I was able to get back up in 1 hour (I blew my whole server down)
16:12
No, you know you can set limits on the containers, too...
I'm curious about how a fork-bomb would run inside of an LXC instance.
It took my ec2 instance down! :(
This didn't seem to work lxc.cgroup.memory.limit_in_bytes = 256M
Hmm... not sure. I need to explore that more.
If you find some relavent stuff just give me a shout about it
Generally itself I'm a linux newbie and barely knew what bash was 4 months ago, but this was mostly a ridiculous personal challenge to myself : build a cloud ide for a language you don't know on a platform you've never used :D
@gideon that's a good challenge
So I may be missing some basic stuff sometimes :P I'm going to try and look at ptrace next, seems it's what codepad does. : codepad.org/about
thanks @ewwhite I have an ulterior motive too, I hope to impress a potential employer ;)
16:19
makes sense
@gideon I see that you're experienced in C#/.NET - just curious, why the sudden interest in cloud linux hacking?
Yep. I mostly only played with Windows/C# since I was a kid, but this was mostly a personal challenge and I hope to switch my job to being a perl/linux developer :D says a short prayer
@pauska Any suggestions for more stuff I should learn for a perl/linux web dev job?
well.. if you're aiming for DevOps then imprint the word automation in your head
cfengine, puppet and so on
it's key knowledge to scale-out
funny to hear about C# developers wanting to switch over to perl and linux.. finding senior C# staff these days are next to impossible
@voretaq7 Want...., but will it work on double-stuff? http://bit.ly/15hGO2x #OREO
@pauska ah thanks. I shall be studying tonight :D Really? Sometimes I think there is no dearth of C# developers around, but then I have nightmares running my team. We so bloody slow that I spent several weeks living at my office (took my sleep gear there ofc) and wrote large chunks of the app myself.
16:29
oreo separator machine. Could only be cooler if it was made of Lego
@pauska I guess that the ease of becoming a C# dev makes for a lot of crappy .NET freshers out there. The Linux crowd seems so much more ... idk.. cleaner, awesom-er
@voretaq7 He used a hatchet though. Good enough.
@Tanner the hatchet bit is rather brilliant
I wonder how long the floss lasts though
@gideon well.. DevOps is the hipster job..
@pauska I'm not necessarily looking at DevOps but a couple of companies that do large scale web cloud apps on linux.
16:54
Um
We have two computer accounts in our Domain Admins group
So glad I'm out of here at the end of next week
@MDMarra lol
@MDMarra Shodan + Skynet?
negative
they're both exchange servers
That makes perfect sense.
right
16:57
No, wait, it's entirely batshit, I mean.
ah that's better
ok lunch time
byebye
hahahahaha - the auto-flagger flagged Evan Anderson
Trying to debug a password change problem... (getting heap corruption error on lsass.exe now and then) How quickly do you think I can change a password without screwing something up else up? Once a second? Faster?
@Tanner On Unix? "As fast as you want to"
oh, sorry, Windows
17:01
(or more accurately: "As fast as the locks on the shadow file will let you")
on Windows theoretically "As fast as the AD locks and Kerberos tokens can update"
If you're getting heap corruption changing passwords I say beat the ever-loving shit out of it until it happens again and get a bug report to MS
Do you think it's related to the size of the domain / AD database?
@voretaq7 I'm thinking it's Google's fault... happens now that we've installed the password sync tool
@Tanner distinctly possible
Currently we're under their minimum password requirement, though I swear it's happened to 8 character passwords. So... time to hammer it and find out.
have you guys tried to understand the VDI licensing for Windows?
that is just the FAQ. 6 pages long. brainmelt.....
It's like they don't want you to use VDI..
It's really one line long: "Hire a licensing consultant"
17:10
Hm, it can go pretty fast.
@MDMarra hiring a consultant is not always the answer mate.. you could end up in a situation where you have to find out whether it's economically viable to run VDI for - let's say - 20 users. Hiring a consultant would quickly make that not economical.
@pauska right I wasn't saying you should
I'm saying that's what a 6 page FAQ is saying
in otherwords, Microsoft licensing is a bummer
17:26
@pauska It's always easier to beg for forgiveness then to ask for permission.
Linux client-smtp1 2.4.21-9.ELsmp #1 SMP Thu Jan 8 17:08:56 EST 2004 i686 i686 i386 GNU/Linux
[root@client-smtp1 root]# cat /etc/issue
Red Hat Enterprise Linux ES release 3 (Taroon Update 1)
Kernel \r on an \m
lookie here...
whoever here that linked to f.lux : i love you
@pauska does it makes sense to use on a laptop only?
what about when I'm connected to two additional monitors?
I don't think it cares about number of screens
@pauska I just don't notice it anymore
17:35
it just gives you a much more pleasant gamma when you're (probably) in a darker room
I used to get sore eyes after working late shifts, but not anymore.. :)
17:51
@pauska I think it's not so much gamma as slowly dropping out the blue, because blue light seems to be what the human sleep cycle responds to
Anyone put brought in server 2012 into their 2008R2 domain? Any gotchas?
Did some light scavenging on the web, but haven't found anything yet.
Nothing really
It's just another member server
Sry. As a DC.
I think @pauska has. I've done it in a test environement
Forgot to add that. ;-)
17:59
Pretty straight forward stuff. No more need to do adprep anymore
and dcpromo is dead

« first day (901 days earlier)      last day (4366 days later) »