IRC chat logs for #ltsp on irc.libera.chat (webchat)
Channel log from 29 November 2022 (all times are UTC)
| 00:49 | vagrantc has left IRC (vagrantc!~vagrant@2600:3c01:e000:21:7:77:0:40, Quit: leaving) | |
| 04:55 | eu^ip-178-46-130 has joined IRC (eu^ip-178-46-130!~eu^ip-178@178.46.130.6) | |
| 04:57 | <eu^ip-178-46-130> Good morning. Help with brainstorming, the server is on 172.20.0.210, you need to set up a connection on 3 subnets, Mikrotik is responsible for 172.20.0.0/24, there are also 2 more networks 192.168.110.0/24 and 192.168.111.0/24 for which dhcp is responsible on windows server , /ltsp/images/x86_64.img and server 172.20.0.210 were registered on
| |
| 04:57 | Mikrotik, now dhcp works from Mikrotik, as it should be, on windows server in dhcp settings the same path was registered /ltsp/images/x86_64.img and server 172.20 .0.210, but when connecting from PC 192.168.110.* via pxe there is no connection, maybe the path is not correct?
| |
| 04:57 | M_i_k_a_ela[m] has joined IRC (M_i_k_a_ela[m]!~mikaelama@2001:470:69fc:105::2:cc84) | |
| 04:59 | eu^ip-178-46-130 is now known as M_i_k_a_ela | |
| 04:59 | * M_i_k_a_ela[m] uploaded an image: (93KiB) < https://libera.ems.host/_matrix/media/v3/download/matrix.org/sjaRaPysDLIAtAXKHlPuSYIn/%D0%B8%D0%B7%D0%BE%D0%B1%D1%80%D0%B0%D0%B6%D0%B5%D0%BD%D0%B8%D0%B5_2022-11-29_095947744.png > | |
| 06:34 | <alkisg1> eu^ip-178-46-130: 3 different paths are needed, undionly.kpxe for bios, snponly.efi for uefi, and ltsp.ipxe after ipxe is loaded
| |
| 06:34 | Many DHCP servers don't have an "if" command like isc-dhcp and dnsmasq do
| |
| 06:35 | So it's usually easier to NOT provide any boot filenames, and configure the LTSP server in its default proxyDHCP mode, where it sends the boot filename WITHOUT sending an IP
| |
| 06:36 | woernie has joined IRC (woernie!~werner@p5b2962ea.dip0.t-ipconnect.de) | |
| 07:05 | ricotz has joined IRC (ricotz!~ricotz@ubuntu/member/ricotz) | |
| 07:21 | * M_i_k_a_ela[m] uploaded an image: (5KiB) < https://libera.ems.host/_matrix/media/v3/download/matrix.org/dCjNWiZbUrpdZykbZmpoAWlP/%D0%B8%D0%B7%D0%BE%D0%B1%D1%80%D0%B0%D0%B6%D0%B5%D0%BD%D0%B8%D0%B5_2022-11-29_122143781.png > | |
| 07:21 | <M_i_k_a_ela[m]> I did it, but the PC with another gateway does not connect, maybe
| |
| 07:22 | /etc/dnsmasq.d/ltsp-dnsmasq.conf
| |
| 08:14 | <alkisg1> You may use pxelinux if you wish, which requires only a single file although it doesn't support UEFI: https://ltsp.org/guides/pxelinux/
| |
| 08:14 | Or you can build undionly.kpxe/snponly.efi locally, and include an ipxe script inside it; that way ipxe can also do a single filename
| |
| 08:15 | M_i_k_a_ela: see https://github.com/ltsp/ltsp/discussions/760#discussioncomment-3858807 about the last option ^
| |
| 08:17 | jgee118 has left IRC (jgee118!~jgee@186.80.49.20, Quit: Ping timeout (120 seconds)) | |
| 08:28 | <alkisg1> I filed https://github.com/ltsp/ltsp/issues/773 regarding this issue ^
| |
| 08:50 | alkisg_irc has joined IRC (alkisg_irc!~Thunderbi@srv1-dide.ioa.sch.gr) | |
| 08:52 | alkisg has left IRC (alkisg!~Thunderbi@2a02:587:744e:8500:c24a:ff:fe02:bc1e, Ping timeout: 264 seconds) | |
| 08:52 | alkisg_irc is now known as alkisg | |
| 09:17 | jgee118 has joined IRC (jgee118!~jgee@186.80.49.20) | |
| 09:48 | vagrantc has joined IRC (vagrantc!~vagrant@2600:3c01:e000:21:7:77:0:20) | |
| 10:42 | vagrantc has left IRC (vagrantc!~vagrant@2600:3c01:e000:21:7:77:0:20, Quit: leaving) | |
| 11:27 | M_i_k_a_ela has left IRC (M_i_k_a_ela!~eu^ip-178@178.46.130.6, Quit: Client closed) | |
| 14:58 | vagrantc has joined IRC (vagrantc!~vagrant@2600:3c01:e000:21:7:77:0:20) | |
| 17:54 | woernie has left IRC (woernie!~werner@p5b2962ea.dip0.t-ipconnect.de, Remote host closed the connection) | |
| 17:55 | <MUHWALT> Hi, anyone have a suggestion for marking a .desktop file as trusted for all users of an LTSP server? I have a folder structure in /opt that I'm symlinking to particular user's desktops, with some .desktop files in it
| |
| 17:55 | I know this isn't strictly ltsp specific, but likely encountered on ltsp servers frequently
| |
| 17:55 | I don't want the users to have write access to the files
| |
| 17:57 | the .desktop files are owned by root, and the user is a member of the file's group with rwx permissions
| |
| 17:59 | (it exists within the ltsp image, so obviously thye can't *actually* write to it)
| |
| 18:01 | vagrantc has left IRC (vagrantc!~vagrant@2600:3c01:e000:21:7:77:0:20, Quit: leaving) | |
| 19:04 | woernie has joined IRC (woernie!~werner@p5b2962ea.dip0.t-ipconnect.de) | |
| 19:07 | bluejaypop has left IRC (bluejaypop!~7f000001@user/josefig) | |
| 19:10 | <alkisg1> MUHWALT: not sure what the blocker is there; if the files are already +x when they're in /opt, why would you need to +x them again?
| |
| 19:12 | <MUHWALT> The blocker is the scary popup in mate that says the .desktop file is untrusted. With the perms how they are, the user has no option of "mark as trusted", only "Launch anyways"
| |
| 19:13 | I gave up on symlinking to the files in /opt and now I'm just checking group membership in .profile and copying the .desktop files to the user's Desktop ;)
| |
| 19:14 | seems like a lot of work to get this working, though 🤣
| |
| 19:15 | <alkisg1> Why don't you put them in the menu (/usr/share/applications), the users can't find them there?
| |
| 19:16 | <MUHWALT> There's sensitive info in the .desktop files and I only want certain ones to be available to users based on their group
| |
| 19:16 | I know that's *not* ideal, but that's where I'm at :D
| |
| 19:16 | (it involves IP cameras and RTSP)
| |
| 19:16 | <alkisg1> Btw, symlinking e.g. /opt/firefox.desktop (with mode=755) to /home/alkisg/Desktop allows me to run it without any popups
| |
| 19:16 | <MUHWALT> more specifically i had like...
| |
| 19:17 | /opt/cameras/office1 <-- root:office1 740
| |
| 19:17 | /opt/cameras/office2 <-- root:office2 740
| |
| 19:17 | with .desktop files under each "office" dir
| |
| 19:17 | and I was symlinking to /opt/cameras
| |
| 19:17 | not the .desktop files themselves
| |
| 19:17 | <alkisg1> But /opt/cameras/office1/launcher.desktop was 755?
| |
| 19:18 | <MUHWALT> 740 all the way through
| |
| 19:18 | everyone should not be able to access, the group should be able to read and not edit
| |
| 19:19 | ultimately this *should* be done with proper authentication/authorization with our cameras... but we're a social services non-profit 🤣
| |
| 19:19 | the .desktop files have the viewer username/password for our cams... e.g., Exec=xdg-open rtsp://user:pass@camera
| |
| 19:19 | <alkisg1> Make the desktop file 755; you can restrict access further up from the directory permissions and owner
| |
| 19:19 | Also I guess you probably mean that the sensitive info is in "Exec=program params"; this will show up in `ps`, so it shouldn't really be done like thais if you want security
| |
| 19:20 | A person running `while true; do ps > file` will capture all the passwords
| |
| 19:20 | <MUHWALT> Only if they have access to the workstation already
| |
| 19:20 | at that point...
| |
| 19:20 | well, you know :D
| |
| 19:22 | But yeah, ideally we'd have some web-based NVR thing with usernames and access control that way... but holy crap have you looked at how complicated zone minder is? :D
| |
| 19:22 | this lets them launch the stream w/ vlc and record if they want
| |
| 19:23 | <alkisg1> Nah I haven't used any IP cameras yet, no idea about the related software
| |
| 19:23 | <MUHWALT> it's a *mess*
| |
| 19:23 | <alkisg1> What does xdg-open rtsp actually open, vlc, firefox?
| |
| 19:23 | <MUHWALT> vlc
| |
| 19:23 | or celluloid if that's what's on there
| |
| 19:24 | The debian vlc package actually excludes rtsp support, if you ever go down that route :<
| |
| 19:24 | the ubuntu snap package has it in there...
| |
| 19:24 | but we remove snap :D
| |
| 19:24 | <alkisg1> And you put /opt into the image?
| |
| 19:24 | <MUHWALT> yeah
| |
| 19:24 | it was just that "trust" thing that was causing issues
| |
| 19:25 | <alkisg1> I mean, if you put your passwords in /srv/ltsp/images/x86_64.img, they can be seen by almost anyone on the network
| |
| 19:26 | <MUHWALT> sure, but you'd need to know what you're looking for
| |
| 19:26 | we are playing the obscurity game, but trying to balance out doing what we need to do, and not advertising access to those cameras
| |
| 19:27 | <alkisg1> It would probably be better to create an /etc/xdg/autostart/create-symlinks.desktop entry, that will run ltsp remoteapps /srv/private/create-symlinks, that will create the appropriate .desktop entry for them
| |
| 19:28 | As that will run on the server, the passwords won't need to reside in the image; and making it post-login ensures the user has already authenticated
| |
| 19:28 | <MUHWALT> that makes sense
| |
| 19:29 | ltsp image / excludes /srv?
| |
| 19:29 | is what I'm taking away from this
| |
| 19:29 | :D
| |
| 19:29 | or rather wouldn't include /srv/<some dir I create>
| |
| 19:30 | thanks for the tip!
| |
| 19:31 | <alkisg1> Yes, of course you can also configure it to exclude other locations
| |
| 19:32 | # grep srv /usr/share/ltsp/server/image/image.excludes
| |
| 19:32 | srv/*
| |
| 19:34 | <MUHWALT> it looks like remoteapps will automatically generate an ssh key for the user?
| |
| 19:34 | cool stuff!
| |
| 19:34 | <alkisg1> Yup :)
| |
| 21:03 | woernie has left IRC (woernie!~werner@p5b2962ea.dip0.t-ipconnect.de, Remote host closed the connection) | |
| 21:06 | <MUHWALT> I couldn't get the desktop file in /etc/xdg/autorun to work, so I ended up just dropping the `ltsp remoteapps ...` in ~/.profile, which does work
| |
| 21:07 | I just seem to have a ton of problems with .desktop files 🤣
| |
| 21:07 | made it on my own desktop... it worked from there... sudo cp to /etc/xdg/autorun/ and it blows up
| |
| 21:07 | no idea
| |
| 21:43 | ricotz has left IRC (ricotz!~ricotz@ubuntu/member/ricotz, Quit: Leaving) | |