IRC chat logs for #ltsp on irc.libera.chat (webchat)


Channel log from 22 December 2016   (all times are UTC)

00:21JerryT has left IRC (JerryT!~jerry@2600:8804:1f80:100d:b46e:9eae:cb92:a2aa, Remote host closed the connection)
00:24BuddyButterfly has left IRC (BuddyButterfly!~BuddyButt@h1359005.stratoserver.net, Ping timeout: 268 seconds)
00:43zama_ has joined IRC (zama_!~zama@81.4.123.134)
00:45zama has left IRC (zama!~zama@unaffiliated/stryx/x-3871776, Ping timeout: 240 seconds)
00:50zama_ has left IRC (zama_!~zama@81.4.123.134, Changing host)
00:50zama_ has joined IRC (zama_!~zama@unaffiliated/stryx/x-3871776)
00:50zama_ is now known as zama
01:24MarkH has joined IRC (MarkH!4068f929@gateway/web/freenode/ip.64.104.249.41)
01:25
<MarkH>
Hello - we're trying to save files to our LTSP guest instances (specifically RDP links) so they will persist between reboots. We had this working in a lab environment, however we're now running on our production hardware, and files saved to client desktops are not surviving reboots. Can anyone please point me at the doco that covers enabling this ?
01:31MarkH has left IRC (MarkH!4068f929@gateway/web/freenode/ip.64.104.249.41, Quit: Page closed)
03:46GodFather has left IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com, Quit: Ex-Chat)
03:46GodFather has joined IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com)
03:55GodFather has left IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com, Ping timeout: 268 seconds)
05:00sutula has left IRC (sutula!~sutula@207-118-145-89.dyn.centurytel.net, Ping timeout: 248 seconds)
05:05sutula has joined IRC (sutula!~sutula@207-118-145-89.dyn.centurytel.net)
06:02sutula has left IRC (sutula!~sutula@207-118-145-89.dyn.centurytel.net, Ping timeout: 250 seconds)
06:03sutula has joined IRC (sutula!~sutula@207-118-145-89.dyn.centurytel.net)
06:38adrianor1 has joined IRC (adrianor1!~adrianorg@177.18.97.106)
06:42adrianorg has left IRC (adrianorg!~adrianorg@179.177.209.101.dynamic.adsl.gvt.net.br, Ping timeout: 268 seconds)
07:29riddle has joined IRC (riddle!~decadance@us.yunix.net)
07:37riddle has left IRC (riddle!~decadance@us.yunix.net, Ping timeout: 245 seconds)
07:38riddle has joined IRC (riddle!~decadance@us.yunix.net)
07:42mikkel has joined IRC (mikkel!~mikkel@mail.dlvs.dk)
07:46riddle has left IRC (riddle!~decadance@us.yunix.net, Ping timeout: 245 seconds)
07:54ricotz has joined IRC (ricotz!~ricotz@ubuntu/member/ricotz)
09:54Statler has joined IRC (Statler!~Georg@mail.lohn24.de)
09:56markus_e92 has left IRC (markus_e92!~markus_e9@62-46-26-21.adsl.highway.telekom.at, Ping timeout: 258 seconds)
09:58markus_e92 has joined IRC (markus_e92!~markus_e9@91-115-23-4.adsl.highway.telekom.at)
10:28adrianorg has joined IRC (adrianorg!~adrianorg@177.18.176.144)
10:31adrianor1 has left IRC (adrianor1!~adrianorg@177.18.97.106, Ping timeout: 250 seconds)
11:04GodFather has joined IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com)
11:05GodFather has left IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com, Remote host closed the connection)
11:09GodFather has joined IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com)
11:37markus_e92 has left IRC (markus_e92!~markus_e9@91-115-23-4.adsl.highway.telekom.at, Ping timeout: 245 seconds)
11:39markus_e92 has joined IRC (markus_e92!~markus_e9@62-46-31-114.adsl.highway.telekom.at)
11:43gvy has joined IRC (gvy!~mike@altlinux/developer/mike)
11:59lucas__ has joined IRC (lucas__!~lucas@201.57.40.146)
12:54butz has joined IRC (butz!5093c94c@gateway/web/freenode/ip.80.147.201.76)
13:01lucas__ has left IRC (lucas__!~lucas@201.57.40.146, Quit: Leaving)
13:11GodFather has left IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com, Ping timeout: 250 seconds)
13:16riddle has joined IRC (riddle!~decadance@us.yunix.net)
13:17BuddyButterfly has joined IRC (BuddyButterfly!~BuddyButt@h1359005.stratoserver.net)
13:17
<BuddyButterfly>
alkisg: hi
13:18
alkisg: I have placed the cups server setting not under default section, yesterday.
13:18
trying now agn.
13:21
<butz>
hi again at @
13:21
@all
13:25riddle has left IRC (riddle!~decadance@us.yunix.net, Ping timeout: 245 seconds)
13:28mikkel has left IRC (mikkel!~mikkel@mail.dlvs.dk, Quit: Leaving)
13:54
<BuddyButterfly>
alkisg: is there a similar setting for saned? Or will the image take it from /etc/sane.d/net.conf
14:04lucas__ has joined IRC (lucas__!~lucas@201.57.40.146)
14:06riddle has joined IRC (riddle!~decadance@us.yunix.net)
14:10lucas__ has left IRC (lucas__!~lucas@201.57.40.146, Ping timeout: 245 seconds)
14:11lucas__ has joined IRC (lucas__!~lucas@186.227.185.10)
14:12
<sbalneav>
Morning all
14:15riddle has left IRC (riddle!~decadance@us.yunix.net, Ping timeout: 245 seconds)
14:19Freejack has left IRC (Freejack!~Freejack@unaffiliated/freejack, Read error: Connection reset by peer)
14:26butz has left IRC (butz!5093c94c@gateway/web/freenode/ip.80.147.201.76, Quit: Page closed)
14:30Freejack has joined IRC (Freejack!~Freejack@unaffiliated/freejack)
14:37
<BuddyButterfly>
alkisg: Cups printing works now fine! Tnx! saned also.
14:48
<alkisg>
BuddyButterfly: np
14:48
BuddyButterfly: there's no option for saned, but yeah you can do it from net.conf
14:48
Hey sbalneav :)
14:49
<sbalneav>
Morning alkisg
14:50
<BuddyButterfly>
alkisg: yep, tested it. works fine from net.conf.
14:50
alkisg: also saw that printer config should be done from user dir as to not have to generate a new image when changing printers. Anyway, they do not change very often ;-)
14:51
and when using printer server it is 1 time config globally.
14:51
<alkisg>
BuddyButterfly: I'm not sure what you mean there
14:51
Typically, you configure the printer on the server only, not on the image
14:51
And it's only 1 time config globally
14:52
In your case you have a separate printer server? Then you only configure them there 1 time
14:52
And point the client cups to that server
14:52
<BuddyButterfly>
alkisg: exactly! That is what I also prefer.
14:53
https://help.ubuntu.com/community/UbuntuLTSP/localprinter
14:53
<alkisg>
BuddyButterfly: you don't need to re-generate the image for that
14:53
At all
14:53
No, that's the wrong way to do it
14:53
You don't want local printers, but global printers
14:53
<BuddyButterfly>
alkisg: ah, was not aware of this. But now, where you mention it, true, it comes via tftp....
14:54
<alkisg>
It's also much easier if the ltsp server is also the printer server
14:54
<BuddyButterfly>
so I can leave this step away also ;-)
14:54
<alkisg>
But you can put printers to the clients and redirect them to the server via jetpipe
14:54
(included with ltsp)
14:55
<BuddyButterfly>
jetpipe, interesting. will also look into it.
14:55
will be afk for some minutes. cu.
14:55
tnx a lot!
14:55
<alkisg>
np
15:08vagrantc has joined IRC (vagrantc!~vagrant@unaffiliated/vagrantc)
15:11
<alkisg>
vagrantc: Sprechen Sie Deutsch? Or back to the US?
15:12adrianor1 has joined IRC (adrianor1!~adrianorg@177.18.175.166)
15:13
<vagrantc>
alkisg: milas anglika?
15:13
<alkisg>
Hahaha
15:14
<vagrantc>
back home, yeah
15:15adrianorg has left IRC (adrianorg!~adrianorg@177.18.176.144, Ping timeout: 264 seconds)
15:16
<sbalneav>
vagrantc: welcome back
15:16
<vagrantc>
sbalneav: heya!
15:17
<sbalneav>
vagrantc: Couple of commits to the tree since we last spoke, and alkisg's gonna get me some of the ltspd stuff, and I'll work on that next
15:17
<vagrantc>
nice!
15:20
whoah, 0.1
15:57gvy has left IRC (gvy!~mike@altlinux/developer/mike, Quit: Leaving)
16:11adrianorg has joined IRC (adrianorg!~adrianorg@187.113.251.104)
16:14adrianor1 has left IRC (adrianor1!~adrianorg@177.18.175.166, Ping timeout: 245 seconds)
16:15
<vagrantc>
sbalneav: hrm. latest ltsp-pam git doesn't seem to work for me... maybe i needed to change something in the packaging?
16:17
yup, getting python tracebacks in auth.log
16:18
sbalneav: loosely copied: ioerror, no such file or directory, /var/lib/extrausers/passwd
16:20* vagrantc dives in and debugs
16:26
<vagrantc>
touching the /var/lib/extrausers/passwd,group,shadow files seems to partially work around the issue
16:27
but it's not creating a socket
16:27
does look like multi-user support has somewhat been added, though
16:34
sbalneav: do you remember what permissions the /var/lib/extrausers/* should have?
16:36
yup, permissions issues
16:37
so at least passwd and group need to be world-readable
16:37
in general, shadow shouldn't be
16:37
though i suspect this implementation doesn't write anything dangerous in /etc/shadow ... but better to be cautious than reckless
16:38
<sbalneav>
Yeah, should be world readable.
16:39
I suppose we should have a chmod in there to ensure the perms.
16:39
Shadow shouldn't be, tho' 600 perms
16:43
<vagrantc>
so, it seems like the old code created the file as needed, and for some reason this code doesn't
16:45
<sbalneav>
hm
16:45
<vagrantc>
working around that bug, it seems to be working nice
16:45
multiple concurrent users work, on console and lightdm ...
16:45
although if you have a user on console and lightdm, whichever logs out first unmounts the homedir
16:45
<sbalneav>
Hmm
16:45
<vagrantc>
fairly minor issue, though
16:46
<sbalneav>
I suspect it's failing when it tries to open the file for read.
16:46
<vagrantc>
unlocking screen locker works
16:46
probably just test if it exists and create it if not
16:46
even i could probably come up with a patch for that
16:47
<sbalneav>
one sec
16:48
vagrantc: Try that push
16:50* vagrantc monkey-patched in an "if os.path.exists(fname):" that seemed to work, although shadow is a bit too permissive with permissions
16:51
<vagrantc>
try/except should work too :)
16:51
<sbalneav>
Either-or
16:52
yeah, I'll add in some code to chmod things appropriately.
16:52
I just want to see if that fixes the failure.
16:54
<vagrantc>
works for me, just needs some chmod
16:54
<sbalneav>
ok
16:55
644 for passwd and group, 600 for shadow
17:00
<vagrantc>
sounds about right
17:04
hah! i can even su from one pam-sshauth authenticated user to another as long as they've logged in at least once
17:04
<sbalneav>
vagrantc: try that push
17:05
<vagrantc>
don't see it yet
17:05
<sbalneav>
derp
17:05
<vagrantc>
might be some propegation delay on launchpad
17:05
<sbalneav>
git commit and git push are different, REMEMBER that sbalneav
17:05
<vagrantc>
oh
17:05
<sbalneav>
try now
17:07
<vagrantc>
sbalneav: works for me
17:08
<sbalneav>
Sets the right perms on shadow?
17:08
<vagrantc>
yup
17:08
although it does technically do that after the data ha been written...
17:09
there's a window in which the file is probably world-readable
17:09
small though it may be
17:09
i wonder if it would be better to create the file, chown the file, write data...
17:12
<sbalneav>
Well, in our case, since we're not writing anything to it other than "userid:*::::::::"...
17:12
I'd say the added complication isn't worth it.
17:12
If we actually, for some unknown reason, DO end up *actually* storing a password, then I'd say yes.
17:12
<vagrantc>
we're not doing that today, but we might want to protect our future forgetful selves :)
17:13
<sbalneav>
You can't actually authenticate from extrausers anyway, so...
17:13
There's no pam-extrausers
17:13
<vagrantc>
but the file needs to exist, somehow?
17:13
<sbalneav>
pam_unix specifically only gets it's info from /etc/{passwd,group,shadow}
17:14
Yeah, lightdm checks to see if it can do a getent shadow user, for some unknown reason.
17:14
And then won't log the user in since they're not a "real" user.
17:15
I'd prefer not to create a shadow entry at *all*.
17:15
<vagrantc>
right
17:16
<sbalneav>
Let me try again, just to be certain.
17:16
measure twice, cut once.
17:21
yeah
17:21
If you comment out the line where it adds the shadow, lightdm just won't log in
17:22
:(
17:22
You get an "authentication succeeded" message in the auth log, and lightdm just... sits there like a goof.
17:24
Soon as you put the line back in, everything works.
17:31
hmmm
17:31
I wonder....
17:31
epicurus was smart
17:32
whoops
17:40ricotz has left IRC (ricotz!~ricotz@ubuntu/member/ricotz, Quit: Leaving)
17:42robb_nl has joined IRC (robb_nl!~robb_nl@ip-213-49-238-3.dsl.scarlet.be)
17:49
<sbalneav>
Yeah, I can't find it in the code, but somewhere, if that shadow line isn't there, it just won't work.
17:50
wait
17:52
got it.
17:54
<vagrantc>
though fixing lightdm (and possibly other DMs) everywhere would be the ideal long-term, probably need to keep the workaround for now
18:26lucas__ has left IRC (lucas__!~lucas@186.227.185.10, Ping timeout: 252 seconds)
18:27lucas__ has joined IRC (lucas__!~lucas@201.57.40.146)
18:53TatankaT has left IRC (TatankaT!~tim@193.190.253.114, Remote host closed the connection)
18:55forum has joined IRC (forum!~Icedove@81-5-204-198.hdsl.highway.telekom.at)
18:59lucas__ has left IRC (lucas__!~lucas@201.57.40.146, Ping timeout: 250 seconds)
19:00lucas__ has joined IRC (lucas__!~lucas@186.227.185.10)
19:10forum has left IRC (forum!~Icedove@81-5-204-198.hdsl.highway.telekom.at, Quit: forum)
19:10forum has joined IRC (forum!~Icedove@81-5-204-198.hdsl.highway.telekom.at)
19:23url has joined IRC (url!~paul@36-225-17-113.dynamic-ip.hinet.net)
19:25fnurl has left IRC (fnurl!~paul@36-227-15-65.dynamic-ip.hinet.net, Ping timeout: 250 seconds)
19:33
<sbalneav>
vagrantc: fixed
19:33
Try the latest push
19:39GodFather has joined IRC (GodFather!~rcc@96-35-101-212.dhcp.bycy.mi.charter.com)
19:43forum1 has joined IRC (forum1!~Icedove@81-5-204-198.hdsl.highway.telekom.at)
19:43forum has left IRC (forum!~Icedove@81-5-204-198.hdsl.highway.telekom.at, Read error: Connection reset by peer)
19:43forum1 is now known as forum
19:55vagrantc has left IRC (vagrantc!~vagrant@unaffiliated/vagrantc, Ping timeout: 265 seconds)
19:59
<sbalneav>
Oh, sure, I finally figure something out, and everyone abandons me :D
19:59
I get no respect
19:59vagrantc has joined IRC (vagrantc!~vagrant@unaffiliated/vagrantc)
19:59* sbalneav adjusts tie
19:59* gehidore abandons sbalneav
19:59
<sbalneav>
vagrantc: he
20:00
vagrantc: try the lastest commit
20:00
We weren't including pam-sshauth.py in the pam_acct_mgmt step
20:01
I've completely removed the shadow handling code as unnecessary
20:01
kek, gehidore
20:02
<vagrantc>
sbalneav: yay for code removal!
20:04
<sbalneav>
I was never happy with writing a bogus shadow entry. I feel much better.
20:04forum has left IRC (forum!~Icedove@81-5-204-198.hdsl.highway.telekom.at, Quit: forum)
20:06* gehidore feels better too
20:11
<sbalneav>
vagrantc: repull, yanked 3 more lines.
20:18
<vagrantc>
sbalneav: need a bot to do some autobuilding :)
20:19* vagrantc can't keep up with sbalneav on a roll
20:20
<sbalneav>
That seem to work for you?
20:21
<vagrantc>
haven't had a chance to try yet
20:22* vagrantc is in the middle of reconfiguring the office after being away for a bit
20:23
<sbalneav>
Pish tosh, forget that humdrum workaday stuff that pays the bills and puts food on the table, concentrate on this free stuff which nets us absolutely nothing except the pride in a job well done!
20:23Statler has left IRC (Statler!~Georg@mail.lohn24.de, Remote host closed the connection)
20:23
<sbalneav>
PRIORITIES, man!
20:24robb_nl has left IRC (robb_nl!~robb_nl@ip-213-49-238-3.dsl.scarlet.be, Ping timeout: 268 seconds)
20:28* vagrantc smiles
20:29
<vagrantc>
fire your boss, take back your life! :)
20:29
<sbalneav>
I have to say, I'm kinda excited.
20:29* vagrantc too
20:29
<sbalneav>
This is actually working kinda good.
20:30
<vagrantc>
suspiciously
20:30
<sbalneav>
Waiting for that other shoe.
20:30
<vagrantc>
like someone is taunting us
20:30
<sbalneav>
Console logins work fine too, now.
20:30
You even get your home dir.
20:31
<vagrantc>
should i just release this as libpam-sshauth 1.0 ? :)
20:31
<sbalneav>
Logging in multiple times doesn't work; I could make that work by just coming up with a random socket name.
20:31
What do you think?
20:31
<vagrantc>
the socket name can be passed around some way?
20:32
<sbalneav>
It *should* be in the PAM_SSHAUTH_SOCKET environment variable.
20:32
let me play with it for another day.
20:32
<vagrantc>
so it's already done ... nice
20:33
a predictible socket name has some potential exploits anyways, so if it's not too hard, a variable name would be helpful
20:33
<sbalneav>
Let me play.
20:33
It may be simple.
20:33
<vagrantc>
first i'll test what you've done so far :)
20:51TatankaT has joined IRC (TatankaT!~tim@193.190.253.114)
20:58lucas__ has left IRC (lucas__!~lucas@186.227.185.10, Quit: Leaving)
21:03Freejack has left IRC (Freejack!~Freejack@unaffiliated/freejack, Ping timeout: 245 seconds)
21:10
<vagrantc>
sbalneav: works for me, tested: 471430845aab31eeb2eea2f5e08447b149b73fcb Slight amount of code simplification
21:11
<sbalneav>
cool
21:23
vagrantc: Multiple same-user login code added; socket is now a tempdir.
21:25
This isn't perfect, and we'll need to figure something out in the session script.
21:25
Here's the problem:
21:26
If you log in once, and your sshfs homedir is mounted, you now have a .ssh dir
21:26
Then the second tunnel, ssh balks, because now the server has a real name, per your .ssh directory, instead of the "server" default one set up by the ltsp ssh host keys.
21:27
so we have to now start the ssh tunnel -O StrictHostKeyChecking=no
21:27
as well
21:27
we need to do something about handling the naive "just mount the sshfs homedir"
21:27
if you log in a second time, you shouldn't re-mount
21:28
but you ALSO can't just execute the fusermount on logout too, since then you'll yank the homedir out from under the other session.
21:29
Logging in multiple times on the same box like this will be... difficult to plumb. And, I'd expect, a very small edge case.
21:29
Not sure if we even want to try solving it.
21:34
<vagrantc>
disabling stricthostkeychecking doesn't seem like a good idea
21:34
<sbalneav>
No
21:34
It doesn't, does it?
21:34
<vagrantc>
yeah, i'd rather not add more insecurities in order to support an edge case
21:34
<sbalneav>
ok
21:34
So I'll yank that bit.
21:35
But now, at least, your socket dir is a random string.
21:35
<alkisg>
sbalneav, vagrantc, so switching to vt1 and logging in to troubleshot something wrong in xorg, won't be supported?
21:35
I don't think that's an edge case...
21:36
<vagrantc>
oh, stricthostkeychecking isn't as bad as i thought
21:36* vagrantc also tends to set checkhostip=no
21:37Freejack has joined IRC (Freejack!~Freejack@unaffiliated/freejack)
21:37
<sbalneav>
Well, leave it as is, for the moment, which means the ssh tunnel gets plumbed correctly.
21:38
Then we just need to figure out a good way to not mount and unmount an already mounted homedir
21:38
<alkisg>
To not mount ==> easy part, if it's already mounted
21:38
<sbalneav>
right
21:38
but how do we know not to UNmount
21:38
<alkisg>
To not unmount ==> will need some `loginctl` or `w` magic...
21:38
<sbalneav>
lsof, maybe?
21:40
<alkisg>
One way would be with pids
21:41
But personally i'm fine with relying on systemd for that... :)
21:42
`loginctl list-sessions` seems fine...
21:43
...better yet, loginctl user-status alkisg
21:43
It has a "sessions" variable there
21:47
<sbalneav>
ah, so if sessions > 1, don't fusermount?
21:48
seems.... logical :D
21:48
<vagrantc>
might be a tiny chance of race conditions if both were logging out at the same time...
21:49
<alkisg>
loginctl show-user alkisg | awk '/^Sessions=/ { print NF }'
21:49
This should return the number of sessions
21:49
<sbalneav>
Would you quit poking holes in this, geez :D
21:50
<vagrantc>
but the worst that happens is the homedir stays mounted, no?
21:50
<sbalneav>
it may not even be a problem, hold on.
21:51
<alkisg>
...we could also just keep a counter...
21:51
<vagrantc>
i'm more worried about the counter getting out of sync than about loginctl showing the wrong output
21:51
or, the right output at the wrong time :)
21:51
really, it's a minor risk, i think
21:51
<sbalneav>
hahahaha
21:51
it's not a problem
21:52
log in on console
21:52
get homedir
21:52
log in on X
21:52
get homedir
21:52
log out on X
21:52
homedir still exists in console
21:52
log out of console
21:52
all homedirs gone
21:52
<alkisg>
is this because of double mounts?
21:52
<sbalneav>
Not sure why it works
21:53
<vagrantc>
i've definitely seen it fail
21:53
<sbalneav>
Intuition tells me it shouldn't
21:53
<alkisg>
I think it'll be error-prone if it's double mounts
21:53
<vagrantc>
e.g. unmount the homedir
21:53
<alkisg>
I.e. if it fusermounts over the existing fusermount
21:53
<sbalneav>
Try it and see, with what's in there.
21:53
I'm thinking that's what's happening.
21:53
ohh, wonder if I mix them ip
21:53
up
21:53
<alkisg>
Try removing the allow_non_empty or whatever it's called
21:55
<sbalneav>
I gotta go soon, but yeah, we should have some logic in there
21:55
I like the loginctl idea
21:55
we could use that for both login and logout.
21:57
<vagrantc>
i've definitely got double-mounts
21:58
and it unmounted the homedir ...
21:59
but because we're doing a lazy unmount, it left it open or soemthing?
22:04
<sbalneav>
Yeah, maybe
22:04
It's sub-optimal, as it is now, and "works" by accident, and not design :D
22:04
<vagrantc>
sbalneav: that said, your multi-login code for a single user seems to work :)
22:05* vagrantc relocates for lunch
22:05
<sbalneav>
I'd relocate to italy. They have some nice lunches there.
22:06
<vagrantc>
no experience with italy, but you should totally try greece!
22:08epoptes_user3 has joined IRC (epoptes_user3!4e0d771d@gateway/web/freenode/ip.78.13.119.29)
22:20
<alkisg>
We don't have lobsters, but we do have some gourmet dishes with frog legs :P
23:57BuddyButterfly has left IRC (BuddyButterfly!~BuddyButt@h1359005.stratoserver.net, Quit: Leaving.)