The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1041 »

TheGopher: Sep 7, 2009

I have a few weird graphic corruption issues with the proprietary ATI driver on Fedora, if that's what you're using. It's a huge piece of poo poo and sets off SELinux like nothing else I've seen.

# ? Jan 13, 2011 01:39

Adbot: ADBOT LOVES YOU

# ? Jun 12, 2024 21:36

dolicf: Sep 12, 2010

Puck42 posted:

If you want to be an admin you need to understand SELinux, so learn how to work with it.

Depending on exactly what kind of industry you're wanting to work in, this won't be strictly necessary, but it's good to know a few things about it. If you're wanting to work in the hosting industry, for example, you can pretty much ignore selinux. I've been a sysadmin at various managed server providers for about five years now and the first and only time I've ever had to do anything other than disable selinux was on my RHCE exam.

Conversely, if you're going to be doing any kind of government work or work for government contractors, you can probably bet that selinux is going to be a good portion of your responsibilities.

# ? Jan 14, 2011 05:01

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

dolicf posted:

Depending on exactly what kind of industry you're wanting to work in, this won't be strictly necessary, but it's good to know a few things about it. If you're wanting to work in the hosting industry, for example, you can pretty much ignore selinux. I've been a sysadmin at various managed server providers for about five years now and the first and only time I've ever had to do anything other than disable selinux was on my RHCE exam.

Conversely, if you're going to be doing any kind of government work or work for government contractors, you can probably bet that selinux is going to be a good portion of your responsibilities.

Except that the SELinux capabilities model is becoming roughly equivalent to Solaris RBAC in upcoming versions of Fedora/RHEL (one of the goals of the next Fedora is to not have any suid binaries at all), so while it might not be relevant for RHEL 6, it's going to be a core part of the system in RHEL 7. Feel free to cross that bridge when you come to it, but there's really no good reason to plan on avoiding SELinux. It's probably one of the simplest pieces of any Linux system to understand once you're past this "what the hell is a system_t?" thing. It's remarkably rare that you would ever need to disable SELinux entirely as opposed to disabling protection for one particular daemon, which in and of itself is a near-last resort.

SELinux is rarely part of any government work, from my understanding. You should expect to be reading plain-jane filesystem audit logs all day.

Vulture Culture fucked around with this message at 14:05 on Jan 14, 2011

# ? Jan 14, 2011 14:01

dont skimp on the shrimp: Apr 23, 2008

three posted:

Any ideas?

These types of errors are quite common with stuff like chrome, in my experience. It might just be a glitchy driver or shady compositing messing it up.

For me, it used to happen sometimes in chromium on my laptop, which has an intel card. Hasn't happened recently, though abiword has started to behave in the same way. Really strange.

# ? Jan 14, 2011 18:00

Puck42: Oct 7, 2005

Misogynist posted:

SELinux is rarely part of any government work, from my understanding. You should expect to be reading plain-jane filesystem audit logs all day.

When I was working for the Feds we used SELinux since we based all our server security off the NSA guidelines.

But for the most part the biggest things to remember about SELinux is to use 'ls -Z' to check context on files and how to use 'restorecon' to fix any incorrect contexts.

I did spend 30 mins once trying to figure out why Apache couldn't read it's new SSL private key. It's context was wrong... so always check SELinux when running into file permission issues.

# ? Jan 14, 2011 18:05

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

Puck42 posted:

When I was working for the Feds we used SELinux since we based all our server security off the NSA guidelines.

But for the most part the biggest things to remember about SELinux is to use 'ls -Z' to check context on files and how to use 'restorecon' to fix any incorrect contexts.

I did spend 30 mins once trying to figure out why Apache couldn't read it's new SSL private key. It's context was wrong... so always check SELinux when running into file permission issues.

I phrased my post really badly. Yeah, you need to understand it, but it's not as though 60% of your workday consists of writing MAC policy in SELinux.

# ? Jan 14, 2011 21:00

Daynab: Aug 5, 2008

So I have lots of free time and curiosity and want to check out Ubuntu. Is installing it and running it off a Virtual Machine a good idea or a terribly stupid idea? I just want to mess around and see if I feel like learning it in my spare time while still keeping the familiar comfort of windows.

# ? Jan 15, 2011 08:36

Factory Factory: Mar 19, 2010; This is what
Arcane Velocity was like.

It's just fine. Go download VirtualBox and an ISO and make it so. Just be sure to do SOMETHING, especially something that brings you to the command line, otherwise you'll install it, stare at it, get bored, and never touch it again.

# ? Jan 15, 2011 08:52

Daynab: Aug 5, 2008

Factory Factory posted:

It's just fine. Go download VirtualBox and an ISO and make it so. Just be sure to do SOMETHING, especially something that brings you to the command line, otherwise you'll install it, stare at it, get bored, and never touch it again.

Haha sounds good. Thanks.

# ? Jan 15, 2011 08:56

Ziir: Nov 20, 2004; by Ozmaugh

Is it possible to share USB over a network? I have Computer A sitting on a shelf and Computer B on my desk. I want to plug say an iPod (for example) into Computer A and I want Computer B to recognize that something was plugged into "it" seamlessly.

# ? Jan 15, 2011 12:59

Prince John: Jun 20, 2006; Oh, poppycock! Female bandits?

Daynab posted:

So I have lots of free time and curiosity and want to check out Ubuntu. Is installing it and running it off a Virtual Machine a good idea or a terribly stupid idea? I just want to mess around and see if I feel like learning it in my spare time while still keeping the familiar comfort of windows.

You will get a higher quality experience than a vm by burning or mounting the ISO in Windows and using the wubi Windows installer. You can then choose ubuntu at boot without having to muck with partitions etc.

# ? Jan 15, 2011 17:05

bort: Mar 13, 2003

Wubi is great, and I love it, but the latest update of GRUB has caused some troubles for me and a couple others who use it. If you have trouble booting Linux, check the Wubi megathread. This probably won't apply on a new install; I wanted to point this out because boot loader problems for an experimental user might sour the Ubuntu/Linux experience.

# ? Jan 15, 2011 19:35

darkhand: Jan 18, 2010; This beard just won't do!

What problems with grub?

# ? Jan 16, 2011 03:30

Daynab: Aug 5, 2008

Well thanks anyways for the suggestions, for now I'll just check it with a VM and if I get used to it and take a liking then I'll dual boot it. I like my stuff neatly arranged on partitions anyways.

# ? Jan 16, 2011 08:20

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

darkhand posted:

What problems with grub?

The ones right in the post he just linked.

# ? Jan 16, 2011 20:19

Bob Morales: Aug 18, 2006; ~~Just wear the fucking mask, Bob~~

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

Ubuntu 10.10 crashes my laptop. I was running Fedora 14 for about 2 weeks, and it worked fine. I had just installed a replacement fan/heatsink, and I left it running overnight at 100% CPU and it would hold about 61-62 degrees celsius, and it wouldn't crash.

I installed Ubuntu on my brothers laptop as his HD crashed, and he didn't have his Vista disks. I figured I should install it on my machine so that if something came up, it would be easier to help him if I was using the same version. It installed fine but I never left it on for very long. Now, it runs for 10-30 minutes and locks up. Doesn't reset, CPU isn't getting hot, but it just freezes up. Reboot and it runs fine for another 10-30 minutes.

I'm going to install Fedora again and test my theory, but I figured I'd ask while I'm downloading the ISO. Could it be using some graphics features that are buggy? It doesn't load any additional drivers or have any errors I can find, but one time it happened, it wouldn't let me reconnect via wifi or ethernet. And the network manager window had artifacts for a short time.

It's an old T42 with a Pentium-M and ATI 9600 graphics.

# ? Jan 16, 2011 22:20

three: Aug 9, 2007; i fantasize about ndamukong suh licking my doodoo hole

TheGopher posted:

I have a few weird graphic corruption issues with the proprietary ATI driver on Fedora, if that's what you're using. It's a huge piece of poo poo and sets off SELinux like nothing else I've seen.

I think it's probably this. It has switchable graphics, but Compiz doesn't work with the onboard graphics, so I guess I'll just deal with it.

# ? Jan 16, 2011 23:23

Jonny 290: May 5, 2005; [ASK] me about OS/2 Warp

Trying to export a volume from Ubuntu 10.10 + iscsitarget -> Windows 7 Pro. I've determined that iscsitarget is only listening on lo; I can't directly connect but I can ssh to the server, set up a tunnel to 127.0.0.1:3260 and it will see/mount. Predicably, performance is awful. I want to sort this out. Any ideas?

I've added an entry for eth0 to etc/iscsi/iface/ but it's still not coming up, and from what I understand it should be auto-listen on all itnerfaces. Nmap confirms that 3260 is open on lo but not eth0.

Solved, had to append '-- --address BLURRED.PRIVATE.IP' to the end of the init.d script. Scrubbish, but works.

Jonny 290 fucked around with this message at 00:30 on Jan 17, 2011

# ? Jan 17, 2011 00:10

dont skimp on the shrimp: Apr 23, 2008

Bob Morales posted:

Could it be using some graphics features that are buggy?

It's an old T42 with a Pentium-M and ATI 9600 graphics.

Probably, yeah. The support for older ATI-cards is still just horrible. What driver were you using in fedora?

# ? Jan 17, 2011 07:12

Bob Morales: Aug 18, 2006; ~~Just wear the fucking mask, Bob~~

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

Zom Aur posted:

Probably, yeah. The support for older ATI-cards is still just horrible. What driver were you using in fedora?

Using whatever it installs fresh off the CD. No special drivers.

I re-installed Fedora and she ran all night. :argh:

# ? Jan 17, 2011 14:30

enotnert: Jun 10, 2005; Only women bleed

Bob Morales posted:

Using whatever it installs fresh off the CD. No special drivers.

I re-installed Fedora and she ran all night.

wish we could've gotten some of the logs around the time of lock up (and was it just X locking up, or whole system where you couldn't ssh in or ctrl-alt-fkey to switch to another terminal).

# ? Jan 17, 2011 14:31

Bob Morales: Aug 18, 2006; ~~Just wear the fucking mask, Bob~~

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

enotnert posted:

wish we could've gotten some of the logs around the time of lock up (and was it just X locking up, or whole system where you couldn't ssh in or ctrl-alt-fkey to switch to another terminal).

Whole thing. The MP3 I was playing would go da-da-da-da- then just cut out and everything was frozen.

# ? Jan 17, 2011 15:29

HolyDukeNukem: Sep 10, 2008

Bob Morales posted:

Whole thing. The MP3 I was playing would go da-da-da-da- then just cut out and everything was frozen.

theres a good chance that fedora 14 is using a newer version of the radeon driver. Don't forget that the radeon driver updates at random times, most likely there was an update between ubuntu 10.10 and fedora 14 which fedora put in.

# ? Jan 17, 2011 16:23

kyuss: Nov 6, 2004

kyuss posted:

Hi,

I recently took the final step and completely switched over from Windows to Linux on my home machines. Over time I grew quite fond of Microsoft Powershell and its object-oriented approach to things: dealing with files means dealing with objects that have properties like .size, .fullname, .extension etc.

What are my options under Linux here? I'll go back to parsing strings if I have to, but I'd rather not. On a quick look Python's 'os' module seemed quite rudimentary.

Anyone?

Apart from this, anyone using one of these?

My NSLU2+Debian home server seems to have kicked the bucket, and I'm looking for a worthy successor. A low power, preferrably silent home server that runs on linux and is powerful enough for providing SSH, OpenVPN and NFS.

# ? Jan 17, 2011 20:00

Lexicon: Jul 29, 2003; I had a beer with Stephen Harper once and now I like him.

Not sure if this is the best place for this question, but I'll try. I'm looking for a smallish (think Mac Mini or thereabouts size) desktop PC that I can use as a Ubuntu home server primarily, but also for some light development work. In this regard it should have a 3.5" drive bay, but I'm not too picky about the hardware otherwise - it just needs to be reasonably spec'ed, and run quietly ideally. If it weren't for the mandatory Windows 7 license built into the price, the Dell Nino HD seems like a good option... but I'd rather not be forced to pay for the included OS.

# ? Jan 18, 2011 05:34

waffle iron: Jan 16, 2004

In regards to the NSLU2 replacement, I'm loving my Sheevaplug. I bought the model with one USB port, network port, SD card slot, and a USB serial hookup for debuging. It comes with a weird Ubuntu installed, but the instructions on http://www.cyrius.com/debian/kirkwood/sheevaplug/ made it dead simple to get Debian set up. You can buy one for $99 on https://www.globalscaletechnologies.com/p-22-sheevaplug-dev-kit-us.aspx. I use mine as a media server with Mediatomb to stream to my PS3 and download torrents to USB hard drive with deluge.

There is also the GuruPlug but you need a separate JTAG box to get anywhere and it costs $40.

waffle iron fucked around with this message at 05:57 on Jan 18, 2011

# ? Jan 18, 2011 05:54

xPanda: Feb 6, 2003; Was that me or the door?

I'm having trouble getting a MySQL server up and running properly on a CentOS 5.5 install. I've got mysql and mysql-server installed and sort-of running, but the problem lies in getting it to run using mysqld, and consequently getting it to run on startup.

Executing /etc/init.d/mysqld start times out, and leaves this in /var/log/mysqld.log:

code:

110118 17:02:41  mysqld started
110118 17:02:41 [Warning] Can't create test file /mnt/LogVol02/db/mysql/database.lower-test
110118 17:02:41 [Warning] Can't create test file /mnt/LogVol02/db/mysql/database.lower-test
^G/usr/libexec/mysqld: Can't change dir to '/mnt/LogVol02/db/mysql/' (Errcode: 13)
110118 17:02:41 [ERROR] Aborting

110118 17:02:41 [Note] /usr/libexec/mysqld: Shutdown complete

110118 17:02:41  mysqld ended

That directory looks like this:

code:

total 20556
drwxr-xr-x 3 mysql mysql     4096 Jan 18 17:02 ./
drwxr-xr-x 3 mysql mysql     4096 Jan 18 16:05 ../
-rw-rw---- 1 mysql mysql 10485760 Jan 18 17:02 ibdata1
-rw-rw---- 1 mysql mysql  5242880 Jan 18 17:02 ib_logfile0
-rw-rw---- 1 mysql mysql  5242880 Jan 18 16:54 ib_logfile1
drwx------ 2 mysql mysql     4096 Jan 18 12:43 mysql/

and my /etc/my.cnf file looks like this:

code:

[mysqld]
# datadir=/var/lib/mysql
# socket=/var/lib/mysql/mysql.sock
datadir=/mnt/LogVol02/db/mysql
socket=/mnt/LogVol02/db/mysql/mysql.sock
user=mysql
# Default to using old password format for compatibility with mysql 3.x
# clients (those using the mysqlclient10 compatibility package).
old_passwords=1

# Disabling symbolic-links is recommended to prevent assorted security risks;
# to do so, uncomment this line:
# symbolic-links=0

[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

[client]
socket=/mnt/LogVol02/db/mysql/mysql.sock

Executing mysqld_safe from the shell does work, however. Which is odd, as it is apparently just a wrapper for mysqld. I see mentions of a mysql.server file I'm supposed to copy somewhere (no idea where that is though), but I can't find it, and I can't find any mention of it on google as it ignores the period character, making information impossible to find.

I tried putting /usr/bin/mysqld_safe & in /etc/rc.local but this apparently does nothing.

This is driving me up the wall, and I feel like I'm missing something obvious. Can anyone see something I'm obviously doing wrong?

# ? Jan 18, 2011 06:13

Puck42: Oct 7, 2005

Is SELinux on?

What does 'ls -Zl' say for /mnt/LogVol02/db/mysql/

You may need to run 'restorecon -R /mnt/LogVol02/db/mysql/' to reset the context to be correct.

# ? Jan 18, 2011 06:33

xPanda: Feb 6, 2003; Was that me or the door?

Puck42 posted:

Is SELinux on?

What does 'ls -Zl' say for /mnt/LogVol02/db/mysql/

You may need to run 'restorecon -R /mnt/LogVol02/db/mysql/' to reset the context to be correct.

Yes, SELinux is on.

ls -Zla gives:

code:

total 20556
drwxr-xr-x 3 system_u:object_r:mysqld_db_t    mysql mysql     4096 Jan 18 17:02 .
drwxr-xr-x 3 user_u:object_r:file_t           mysql mysql     4096 Jan 18 16:05 ..
-rw-rw---- 1 user_u:object_r:mysqld_db_t      mysql mysql 10485760 Jan 18 17:02 ibdata1
-rw-rw---- 1 user_u:object_r:mysqld_db_t      mysql mysql  5242880 Jan 18 17:02 ib_logfile0
-rw-rw---- 1 user_u:object_r:mysqld_db_t      mysql mysql  5242880 Jan 18 16:54 ib_logfile1
drwx------ 2 user_u:object_r:mysqld_db_t      mysql mysql     4096 Jan 18 12:43 mysql/

I executed restorecon -R /mnt/LogVol02/db/mysql but it did not change the ls -Z output from what is above.

EDIT: I just made a fresh install on a VM, and everything there works fine, and has the same security contexts and permissions. On the machine I'm having difficulty with I made a new logical volume (LogVol02) and moved the mysql directory there, and updated /etc/my.cnf to point there. Is it possible that the security contexts of the parent directories above /mnt/LogVol02/db/mysql can prevent mysqld changing directory to it?

Further edit: Setting SELinux to Permissive (setenforce permissive) made service mysqld start work. So SELinux would appear to be the culprit.

Final edit: Made it work in SELinux:enforcing mode by executing chcon --type=mysqld_db_t on the /mnt and /mnt/LogVol02 directories, if anyone was interested!

xPanda fucked around with this message at 08:08 on Jan 18, 2011

# ? Jan 18, 2011 06:52

spiritual bypass: Feb 19, 2008; Grimey Drawer

Lexicon posted:

Not sure if this is the best place for this question, but I'll try. I'm looking for a smallish (think Mac Mini or thereabouts size) desktop PC that I can use as a Ubuntu home server primarily, but also for some light development work. In this regard it should have a 3.5" drive bay, but I'm not too picky about the hardware otherwise - it just needs to be reasonably spec'ed, and run quietly ideally. If it weren't for the mandatory Windows 7 license built into the price, the Dell Nino HD seems like a good option... but I'd rather not be forced to pay for the included OS.

You can get an ITX case with a modern motherboard that has an AM3 socket and a drive bay, along with all builtin stuff you could want. You should be able to build such a computer for about $400

# ? Jan 18, 2011 14:43

NeoHentaiMaster: Jul 13, 2004; More well adjusted then you'd think.

OK so sorry if this isn't strictly a linux question but I ran into an interesting issue using screen + irssi recently that I'm betting linux guys are more familiar with than Mac guys.

When accessing it from my Mac running 10.6.5 I would have an issue when using nicklist.pl where the cursor would bounce around and end up in the middle or far left of the screen every time the nick list redrew itself. After digging through the code I realized it was because the terminal program I was using (terminal.app) does not properly support the following escape sequences that nicklist.pl uses:

- Save cursor position:
\033[s
- Restore cursor position:
\033[u

However, when I switched to using iTermn everything started working and I even confirmed manually these escape sequences did work.

Now I may turn out to like iTerm better since from what I read it has more features anyway, but is there a way to change termainal.app's emulation type? There is a setting to 'declare' the terminal type, but this doesn't seem to change its actual behavior, only the $TERM variable the server your connecting to sets.

# ? Jan 19, 2011 00:55

TheGopher: Sep 7, 2009

I'm not at my computer at home, which has OS X, but I can tell you that terminal on OS X seems to do everything the opposite of how everybody else does it. That being said, check out tset.

# ? Jan 19, 2011 02:15

kyuss: Nov 6, 2004

waffle iron posted:

Sheevaplug

Just gave in and bought the eSATA variant from their UK reseller

Didn't get a timely answer from http://www.ionicsplug.com/ so far, and their german reseller wasn't any better. Didn't fall for the Sheevaplug's successor either, as the Guruplug appears to have terrible overheating problems.

My NSLU2 box seems to be stuck in a permanent rebooting cycle despite doing every Redboot / upslug2 procedure I could find.

So its a new box then.

# ? Jan 20, 2011 01:57

waffle iron: Jan 16, 2004

kyuss posted:

Just gave in and bought the eSATA variant from their UK reseller

Didn't get a timely answer from http://www.ionicsplug.com/ so far, and their german reseller wasn't any better. Didn't fall for the Sheevaplug's successor either, as the Guruplug appears to have terrible overheating problems.

My NSLU2 box seems to be stuck in a permanent rebooting cycle despite doing every Redboot / upslug2 procedure I could find.

So its a new box then.

Yeah, I read about the Guruplug being not so great. In general I would be a little leery of any USB-powered spinning disk. It's very telling when they sell replacement embedded power supplies.

My only complaint about the SheevaPlug is that I have Debian on the SD card and it sticks out halfway because the slot isn't very deep. I would much prefer if it had been a micro SD slot. But if you're going to have an eSATA drive, you're probably going have your OS on that. The internal MMC is 512MB and too small for all the stuff I want to do.

# ? Jan 20, 2011 03:25

xPanda: Feb 6, 2003; Was that me or the door?

Now I have another problem! This time it's with iptables and libvirt.

I'm running CentOS 5.5 with KVM virtualization, and have used virt-manager (hence, libvirt) to manage it. I've set up a virtual network with internet access, which libvirt seems to do through iptables. My issue is that I'm trying to forward port 80 on the host to one of the virtual machines, and I think I have to do this with iptables.
Original iptables -L output is:

code:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:bootps 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:bootps 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:bootps 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:bootps 
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             10.0.0.0/24         state RELATED,ESTABLISHED 
ACCEPT     all  --  10.0.0.0/24          anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
ACCEPT     all  --  anywhere             192.168.122.0/24    state RELATED,ESTABLISHED 
ACCEPT     all  --  192.168.122.0/24     anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            icmp any 
ACCEPT     esp  --  anywhere             anywhere            
ACCEPT     ah   --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

10.0.0.0/24 is the internal network the VMs are on, and the webserver is at 10.0.0.218.
I want to forward port 80 to 10.0.0.218, so I executed:

code:

iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.218:80
iptables  -I FORWARD -m state -d 10.0.0.218 --state NEW,RELATED,ESTABLISHED -j ACCEPT

This allows me to access the webserver from the physical LAN, but stops a bunch of things from working on the virtual machines (such as yum/apt-get installs).

How do I go about forwarding port 80 to a VM without messing up other services? I haven't quite got my head around iptables yet.

# ? Jan 20, 2011 03:55

Dinty Moore: Apr 26, 2007

xPanda posted:

10.0.0.0/24 is the internal network the VMs are on, and the webserver is at 10.0.0.218.
I want to forward port 80 to 10.0.0.218, so I executed:
code:
iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.218:80
iptables  -I FORWARD -m state -d 10.0.0.218 --state NEW,RELATED,ESTABLISHED -j ACCEPT
This allows me to access the webserver from the physical LAN, but stops a bunch of things from working on the virtual machines (such as yum/apt-get installs).

How do I go about forwarding port 80 to a VM without messing up other services? I haven't quite got my head around iptables yet.

You should specify, in the PREROUTING rule, the IP address of your machine, otherwise it rewrites (as you are discovering) *ALL* connections to 80/tcp running through your machine. Something like this:

code:

iptables -t nat -I PREROUTING -d {your IP address here} -p tcp --dport 80 -j DNAT --to-destination 10.0.0.218:80

# ? Jan 20, 2011 04:27

xPanda: Feb 6, 2003; Was that me or the door?

Dinty Moore posted:

You should specify, in the PREROUTING rule, the IP address of your machine, otherwise it rewrites (as you are discovering) *ALL* connections to 80/tcp running through your machine. Something like this:
code:
iptables -t nat -I PREROUTING -d {your IP address here} -p tcp --dport 80 -j DNAT --to-destination 10.0.0.218:80

Ah! That did the trick, and it makes sense too. Thanks! Shouldn't this have not affected connections on the machine I was trying to route to, or does the routing change the connection to the point the machine no longer accepts them?

# ? Jan 20, 2011 04:38

Dinty Moore: Apr 26, 2007

xPanda posted:

Ah! That did the trick, and it makes sense too. Thanks! Shouldn't this have not affected connections on the machine I was trying to route to, or does the routing change the connection to the point the machine no longer accepts them?

More the latter. The VM's outgoing connections get rewritten to go to itself, so the packet goes back to itself directly, but when it tries to send responses to itself (since the initial SYN will then claim to be from a local address), the TCP session created by the caller ends up totally confused. This sort of IP rewrite wrangling gets tricky because of that.

# ? Jan 20, 2011 16:30

other people: Jun 27, 2004; Associate Christ

Ubuntu 10.10 here.

Recently when connecting usb storage I am not able to mount. dmesg says: FAT: codepage cp437 not found

Shouldn't that be built into the kernel? Did some update gently caress this up, or was it me? What do I need to do? Google just lists lots of people who built their kernels incorrectly or people doing strange things with encryption, neither of which I have done or are doing.

# ? Jan 21, 2011 23:04

Adbot: ADBOT LOVES YOU

# ? Jun 12, 2024 21:36

Dinty Moore: Apr 26, 2007

Kaluza-Klein posted:

Ubuntu 10.10 here.

Recently when connecting usb storage I am not able to mount. dmesg says: FAT: codepage cp437 not found

Shouldn't that be built into the kernel? Did some update gently caress this up, or was it me? What do I need to do? Google just lists lots of people who built their kernels incorrectly or people doing strange things with encryption, neither of which I have done or are doing.

Hm, I'm definitely not seeing this; what does:

code:

ls /lib/modules/$(uname -r)/kernel/fs/nls/

say? It's definitely a kernel module, and it's present on both the Ubuntu systems I have in front of my (my workstation and my netbook, both running 10.10).

# ? Jan 22, 2011 00:18

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1041 »