IRC chat logs for #ltsp on irc.libera.chat (webchat)
Channel log from 17 November 2022 (all times are UTC)
| 02:16 | we6jbo has joined IRC (we6jbo!~we6jbo@2603-8001-5b43-4000-f9ea-d63d-7185-7fb6.res6.spectrum.com) | |
| 02:34 | we6jbo has left IRC (we6jbo!~we6jbo@2603-8001-5b43-4000-f9ea-d63d-7185-7fb6.res6.spectrum.com, Ping timeout: 256 seconds) | |
| 02:47 | we6jbo has joined IRC (we6jbo!~we6jbo@2603-8001-5b43-4000-be3f-802b-64a7-5df2.res6.spectrum.com) | |
| 05:16 | vagrantc has left IRC (vagrantc!~vagrant@2600:3c01:e000:21:7:77:0:20, Quit: leaving) | |
| 05:53 | alkisg_irc1 has joined IRC (alkisg_irc1!~Thunderbi@srv1-dide.ioa.sch.gr) | |
| 05:55 | alkisg_irc has left IRC (alkisg_irc!~Thunderbi@2a02:587:744e:8500:c24a:ff:fe02:bc1e, Ping timeout: 240 seconds) | |
| 05:55 | alkisg_irc1 is now known as alkisg_irc | |
| 06:11 | Vercas6 has left IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas, Quit: Ping timeout (120 seconds)) | |
| 06:47 | <alkisg> Try to convince people there to use shared folders, not shared accounts :)
| |
| 06:55 | eu^broadband-46- has joined IRC (eu^broadband-46-!~eu^broadb@193.232.108.161) | |
| 06:58 | alkisg_irc has left IRC (alkisg_irc!~Thunderbi@srv1-dide.ioa.sch.gr, Read error: Connection reset by peer) | |
| 07:00 | eu^broadband-46- has left IRC (eu^broadband-46-!~eu^broadb@193.232.108.161, Ping timeout: 260 seconds) | |
| 07:01 | alkisg_irc has joined IRC (alkisg_irc!~Thunderbi@2a02:587:744e:8500:c24a:ff:fe02:bc1e) | |
| 07:08 | <NickolayZaytsev[> <alkisg> "Try to convince people there..." <- No way. We can't do anything with the existing users. Can only add some extra steps while login process
| |
| 07:09 | <alkisg> If you want to explain that, we might be able to help, otherwise sure, go for insecurity :)
| |
| 07:11 | <NickolayZaytsev[> Is just a quick workaround for the decreasing insecure hole
| |
| 07:12 | After that will come more complex solution.
| |
| 07:13 | ricotz has joined IRC (ricotz!~ricotz@ubuntu/member/ricotz) | |
| 07:13 | <alkisg> Developing a pam module is certainly not a quick task
| |
| 07:21 | <NickolayZaytsev[> If i have x32 intel based thin client, am I able to use "ltsp image i386" or I need "ltsp image x86_64" instead? It's just about chroot folders only or it's depend or architecture too?
| |
| 07:21 | s/x86_64/x86\_64/, s/or/on/
| |
| 07:22 | <alkisg> What's the exact cpu model and how much RAM does the client have?
| |
| 07:22 | <NickolayZaytsev[> <alkisg> "Developing a pam module is..." <- I guess I haven't any better solutions. Maybe fix somehow old LTSP version without PAM. But it doesn't seems like faster solution
| |
| 07:23 | <alkisg> If you care to explain the restrictions, it's possible that we may propose a better solution. If you can't do that, no point in discussing it more, you can select whatever you feel is faster even if it's not
| |
| 07:27 | <NickolayZaytsev[> <alkisg> "What's the exact cpu model and..." <- 4gb with G1820 Intel (x64). But I'm not sure about all ours hardware are the same
| |
| 07:28 | <alkisg> You said x32, that's x64...
| |
| 07:28 | For such clients, you don't need a 32bit chroot, you can use 64bit chrootless
| |
| 07:28 | <NickolayZaytsev[> alkisg: We can try.
| |
| 07:28 | The main restriction - we can't drop shared accounts. But we need to personalize them somehow
| |
| 07:29 | <alkisg> Sorry I don't have enough time to play hide and seek. If you can explain, OK, otherwise let me get back to coding, I have a family to feed :D
| |
| 07:30 | <NickolayZaytsev[> alkisg: This is test suite configuration. I'm not quite sure about target real hardware. They might be only x32
| |
| 07:31 | alkisg: Sorry to taking your time.
| |
| 07:31 | But I don't understand, what I need to explain more? You mean why we have that strange restriction?
| |
| 07:32 | <alkisg> Yes, usually such cases are called a XY problem, https://xyproblem.info/
| |
| 07:32 | So we spent a lot of time regarding pam, but you had ltsp5 which doesn't even use pam,
| |
| 07:33 | while if you explain the actual restrictions it might turn out you don't need a pam module at all
| |
| 07:33 | Then, me wasting e.g. 1 hour will help you avoid 100 hours of development. That's a good investment
| |
| 07:34 | ...while wasting 1 hour discussing pam and turning out that you don't need pam would be a very bad investment of time
| |
| 07:39 | <NickolayZaytsev[> That's fair.
| |
| 07:39 | So we have a typical system installation, that consists of headless unix server and a couple thin clients. We also have users. Users amount > thin clients: say 10 against 2.
| |
| 07:39 | On the server we have fixed login/pass pairs for 5 users. That login/pass pairs are known for all of that users.
| |
| 07:39 | We need to know, which user is logged
| |
| 07:40 | <alkisg> "Yes, usually such cases are..." <- Good point
| |
| 07:40 | <alkisg> OK, try to explain the exact reason why you can't move to "one account per user". It will be difficult for them to learn a new username, when they'll have all their data there?
| |
| 07:41 | <NickolayZaytsev[> alkisg: Yeah. They can't learn a new username with password
| |
| 07:41 | <alkisg> Why?
| |
| 07:42 | You're going to teach them authenticator devices, but they can't remember "user1"?
| |
| 07:43 | <NickolayZaytsev[> Because they had bad education, I guess
| |
| 07:43 | <alkisg> Then they won't be able to learn about authenticator devices either
| |
| 07:43 | So there's no solutio
| |
| 07:43 | <NickolayZaytsev[> I cant explain it in detail, cause I haven't the better picture
| |
| 07:43 | <alkisg> OK. Then sorry, that's all the time I could spend on this
| |
| 07:44 | Wishing you the best of luck, /me goes back to coding :)
| |
| 07:45 | <NickolayZaytsev[> Ok. Thank you anyway.
| |
| 07:45 | I'll post it here, then the story will end
| |
| 08:00 | woernie has joined IRC (woernie!~werner@p200300cf07430c007d39ba0105dbca3e.dip0.t-ipconnect.de) | |
| 08:00 | Vercas6 has joined IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas) | |
| 08:36 | Vercas6 has left IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas, Ping timeout: 255 seconds) | |
| 08:55 | Vercas6 has joined IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas) | |
| 09:00 | MaradelCarmenCar has left IRC (MaradelCarmenCar!~maricarme@2001:470:69fc:105::2:a292, Quit: You have been kicked for being idle) | |
| 10:19 | <NickolayZaytsev[> alkisg: Feeling bad about our last conversation, cause I spended your time. I didn't want to. You was right it's defenetly XY Problem.... (full message at <https://libera.ems.host/_matrix/media/v3/download/libera.chat/88bef084f0c08775f5c293a832c99f0e101aef3e>)
| |
| 10:22 | <alkisg> 2FA is to increase security. You just want to separate users. Just use a simple session script; it will even show a nice dialog for them.
| |
| 10:23 | In your case security is non existent because any user can steal all the passwords etc of any user, they can get their bank accounts and everything
| |
| 10:23 | john has joined IRC (john!~john@46-162-67-128.cust.bredband2.com) | |
| 10:24 | john is now known as Guest9347 | |
| 10:25 | <NickolayZaytsev[> alkisg: What does it mean "simple session script"? Can you give an example?
| |
| 10:25 | <Guest9347> Hello everyone! I was here yesterday and got very far in my understanding on how to configure LTSP.
| |
| 10:25 | I just have one question in order for me to gauge the possibility of using LTSP with netboot, and that is how common is it for laptops to support PXE over IPv4? Or rather, is the risk significant that varied laptops with Windows 7 and newer on them are missing this capability.
| |
| 10:26 | <alkisg> Guest9347: all laptops that have ethernet cards support netbooting
| |
| 10:27 | <Guest9347> Great, that's a relief. Thanks!
| |
| 10:27 | <alkisg> Nickolay Zaytsev: google for 'lightdm custom session script', it'll give you some hints, not time to discuss more about this issue
| |
| 10:27 | And creating a common template for many users does NOT mean they'll need to share the same account
| |
| 10:27 | <NickolayZaytsev[> alkisg: No quite right, I gues.
| |
| 10:27 | Our OTP is personal. So before you can get your own OTP, you need to login in mobile app with the separate personal accout. Like LDAP or something. It need to be done only one time, before the app usage.
| |
| 10:28 | <alkisg> Authentication is NOT the same as home directory. You can have multiple users with the same directory
| |
| 10:28 | Or you can clone a template directory to multiple users
| |
| 10:29 | The OTP is personal, but any user can install a keylogger in their own account, and record all keystrokes of all future users
| |
| 10:29 | So they'll be able to steal anything, even from private mode browsers
| |
| 10:29 | It's like leaving your front door wide open and then securely locking the chimney. Really worthless...
| |
| 10:33 | <Guest9347> That seems like a big risk. How can you prevent users from installing keyloggers in their home dirs?
| |
| 10:41 | Vercas6 has left IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas, Quit: Ping timeout (120 seconds)) | |
| 10:43 | <alkisg> Guest9347: I wasn't talking to you. You should just make sure that each user has their own account.
| |
| 10:58 | Vercas6 has joined IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas) | |
| 11:00 | <NickolayZaytsev[> <alkisg> "The OTP is personal, but any..." <- That's true.
| |
| 11:00 | But at this point we need just workarond that will make live of foreign users harder: you need an employee smartphone to login.
| |
| 11:00 | Users home folders doesn't contain any private information at all. Only software for work
| |
| 11:01 | <alkisg> Just create a session script, it's more than enough
| |
| 11:02 | <NickolayZaytsev[> Sounds great. I'll take it. Thank you again, mr. Alkis. Thank you for your work!
| |
| 12:07 | Vercas6 has left IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas, Quit: Ping timeout (120 seconds)) | |
| 12:11 | Vercas6 has joined IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas) | |
| 12:18 | Guest9347 has left IRC (Guest9347!~john@46-162-67-128.cust.bredband2.com, Quit: Client closed) | |
| 12:50 | woernie_ has joined IRC (woernie_!~werner@p200300cf07430c00e132ab5532afc1c0.dip0.t-ipconnect.de) | |
| 12:51 | woernie has left IRC (woernie!~werner@p200300cf07430c007d39ba0105dbca3e.dip0.t-ipconnect.de, Ping timeout: 256 seconds) | |
| 13:06 | Vercas6 has left IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas, Quit: Ping timeout (120 seconds)) | |
| 13:15 | Vercas6 has joined IRC (Vercas6!~Vercas@gateway/tor-sasl/vercas) | |
| 13:49 | woernie_ has left IRC (woernie_!~werner@p200300cf07430c00e132ab5532afc1c0.dip0.t-ipconnect.de, Remote host closed the connection) | |
| 15:11 | we6jbo has left IRC (we6jbo!~we6jbo@2603-8001-5b43-4000-be3f-802b-64a7-5df2.res6.spectrum.com, Remote host closed the connection) | |
| 15:59 | woernie has joined IRC (woernie!~werner@p5b2962ea.dip0.t-ipconnect.de) | |
| 16:41 | woernie has left IRC (woernie!~werner@p5b2962ea.dip0.t-ipconnect.de, Remote host closed the connection) | |
| 16:49 | vagrantc has joined IRC (vagrantc!~vagrant@2600:3c01:e000:21:7:77:0:20) | |
| 17:43 | SunilThomasThoni has joined IRC (SunilThomasThoni!~vu2swmatr@2001:470:69fc:105::2:bf12) | |
| 17:44 | <SunilThomasThoni> I am not sure whether this is the right forum to ask.
| |
| 17:44 | I am trying to create an image from vmdk
| |
| 17:44 | as follows
| |
| 17:45 | ln -rs /home/cea/VirtualBox\ VMs/deb/deb_1.vmdk /srv/ltsp/debian.img
| |
| 17:45 | (base) root@cea-OptiPlex-9010:/# ltsp image debian
| |
| 17:45 | LTSP command failed: blkid -po export /srv/ltsp/debian.img
| |
| 17:45 | Aborting ltsp
| |
| 17:45 | I don't know how to mount /srv/ltsp/debian.img
| |
| 17:45 | <vagrantc> right forum, not sure i have an answer though
| |
| 17:45 | wait around a while, someone might come along
| |
| 17:45 | <SunilThomasThoni> I created a bare minimum vmdk and followed the install guide
| |
| 17:56 | <alkisg> Sunil Thomas Thonikuzhiyil: you want the deb_1-flat.vmdk, not the plain vmdk
| |
| 17:59 | <SunilThomasThoni> i am new to virtualbox how to create a flat.vmdk
| |
| 17:59 | <alkisg> What do you have now, a .vdi?
| |
| 17:59 | ls -l "/home/cea/VirtualBox\ VMs/deb/"
| |
| 18:00 | -rw------- 1 alkisg alkisg 10737418240 Nov 7 09:26 bullseye-kde-flat.vmdk
| |
| 18:00 | -rw------- 1 alkisg alkisg 2958 Nov 11 17:01 bullseye-kde.vbox
| |
| 18:00 | -rw------- 1 alkisg alkisg 647 Nov 7 09:26 bullseye-kde.vmdk
| |
| 18:00 | vbox => VM description, plain vmdk => disk description, flat.vmdk => raw disk data
| |
| 18:01 | <SunilThomasThoni> yes I can find a flat.vmdk
| |
| 18:01 | let me check again
| |
| 18:02 | Thanks it worked
| |
| 18:03 | <alkisg> 👍️
| |
| 18:04 | <SunilThomasThoni> One more question. Some sites allow me to download a vdi or vmdk. How d i make a flat.vmdk out of it
| |
| 18:05 | <alkisg> You should ask this in #vbox, not in #ltsp. E.g. something like: VBoxManage clonehd /vboxdata/old.vdi /vmwaredata/new.vmdk -format VMDK
| |
| 18:05 | Do not run that command, it's just an example, I haven't checked the exact syntax
| |
| 18:06 | <SunilThomasThoni> Thanks
| |
| 18:08 | <alkisg> Ah you don't even need a command, they have a dialog to do it via GUI, e.g. https://superuser.com/questions/73470/how-do-i-convert-a-virtualbox-vdi-file-to-a-vmware-vdmk
| |
| 18:53 | vagrantc: they allow this now?! /usr/share/doc/libphp-phpmailer/README.md.gz
| |
| 18:53 | No more man pages! Markdown ftw!
| |
| 18:53 | * alkisg googles for a compressed markdown reader... | |
| 19:15 | <vagrantc> alkisg: debian doesn't forbid markdown in the doc directory, but that doesn't mean no manpages
| |
| 19:16 | <alkisg> Eh, baby steps...
| |
| 19:19 | * vagrantc just uses emacs to read most files :) | |
| 20:52 | ricotz has left IRC (ricotz!~ricotz@ubuntu/member/ricotz, Quit: Leaving) | |
| 21:02 | bcg has left IRC (bcg!~b@dg4ybwyyyyyyyyyyyyyyt-3.rev.dnainternet.fi, Ping timeout: 240 seconds) | |
| 21:04 | bcg has joined IRC (bcg!~b@213-216-205-19.co.dnainternet.fi) | |