Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Megaman
May 8, 2004
I didn't read the thread BUT...

hazzlebarth posted:

Can you put your preseed file somewhere for inspection? Or did you use my example file?

#d-i base-installer/kernel/image string linux-image-3.2.0-3-686-pae
#d-i mirror/suite string testing
#d-i mirror/udeb/suite string testing
#d-i pkgsel/include string dwm xorg chromium-browser alsa-base vim
d-i clock-setup/ntp boolean true
d-i clock-setup/utc boolean true
d-i finish-install/reboot_in_progress note
d-i grub-installer/only_debian boolean true
d-i mirror/country string manual
d-i mirror/http/directory string /debian
d-i mirror/http/hostname string http.us.debian.org
d-i mirror/http/proxy string
d-i netcfg/choose_interface select wlan0
d-i netcfg/dhcp_hostname string laptop
d-i netcfg/get_domain string
d-i netcfg/get_hostname string laptop
d-i netcfg/wireless_essid string fart
d-i netcfg/wireless_essid_again manual fart
d-i netcfg/wireless_security_type select wpa
d-i netcfg/wireless_show_essids string fart
d-i netcfg/wireless_wpa string fart
d-i partman-auto/choose_recipe select atomic
d-i partman-auto/init_automatically_partition select Guided - use entire disk
d-i partman-auto/disk string /dev/sda
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_write_new_label boolean true
d-i passwd/root-password password fart
d-i passwd/root-password-again password fart
d-i passwd/user-fullname string fart
d-i passwd/user-password password fart
d-i passwd/user-password-again password fart
d-i passwd/username string fart
d-i preseed/late_command string echo -e "auto lo\niface lo inet loopback\nauto wlan0\niface wlan0 inet dhcp\nwpa-essid fart\nwpa-psk fart" > /target/var/tmp/foo
d-i time/zone string US/Eastern
popularity-contest popularity-contest/participate boolean false
tasksel tasksel/first multiselect


The only lines that don't work are the following, everything else works flawlessly:

d-i netcfg/wireless_essid string fart
d-i netcfg/wireless_essid_again manual fart
d-i netcfg/wireless_show_essids string fart

and

d-i partman-auto/disk string /dev/sda

Because these lines don't work I have to hit enter twice in the entire setup, once to select the disk, and once to select the wireless network. The wireless network IS highlight, it just doesn't select. The disk doesn't select either, but I don't know if it's not selecting or highlighting, or both since it's by default highlighting the first choice which just happens to be /dev/sda.

e - all u/p/network information has been changed to 'fart'

Adbot
ADBOT LOVES YOU

hazzlebarth
May 13, 2013

Megaman posted:

d-i partman-auto/choose_recipe select atomic
d-i partman-auto/init_automatically_partition select Guided - use entire disk
d-i partman-auto/disk string /dev/sda
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_write_new_label boolean true

You seem to be missing:

d-i partman-auto/method string regular

quote:

Because these lines don't work I have to hit enter twice in the entire setup, once to select the disk, and once to select the wireless network. The wireless network IS highlight, it just doesn't select.

The disk is automatically chosen in my tests with the added line above. I can't test the network settings (no wlan in virtualbox), but here's how you can help debugging:

On the boot screen, press ESC. It should now show

boot:

Here, add DEBCONF_DEBUG=5 and press Enter. Now, when the ESSID is asked, switch to virtual console 4 and look for a line in the output like:

Aug 19 19:08:11 debconf: --> INPUT critical THISIS/THE-IMPORTANT PART
Aug 19 19:08:11 debconf: <-- 0 question will be asked
Aug 19 19:08:11 debconf: --> GO

That is basically the key that needs to be preseeded.

Megaman
May 8, 2004
I didn't read the thread BUT...

hazzlebarth posted:

You seem to be missing:

d-i partman-auto/method string regular

Adding this fixed the disk part of the preseed!

hazzlebarth posted:

Aug 19 19:08:11 debconf: --> INPUT critical THISIS/THE-IMPORTANT PART
Aug 19 19:08:11 debconf: <-- 0 question will be asked
Aug 19 19:08:11 debconf: --> GO

That is basically the key that needs to be preseeded.

Here's roughly what comes up:

netcfg/choose_interface wlan0
0 value set
get netcfg/choose_interface
0 wlan0
apt-install blah
apt-install blah
INFO: blah
wlan0 link is not ready
debconf: --> blah
debconf: <-- blah
debconf: --> SUBST netcfg/wireless_show_essids essid_list [blah blah blah blah fart blah blah blah blah]
debconf: --> adding [essid_list] -> [blah blah blah fart blah blah blah blah]
debconf: <-- 0
debconf: --> FSET netcfg/wireless_show_essids seen false
debconf: <-- 0 false
debconf: --> INPUT high netcfg/wireless_show_essids
debconf: <-- 0 question will be asked
debconf: --> GO

This is where it stops and I have to hit enter. I have d-i netcfg/wireless_show_essids string fart for this preseed question, what would be the next step? Unpreseed the next line after I provide the answer manuallly so it catches and I can see the answer the 'enter' puts in and compare that with my preseed answer?

e - when I hit enter for the essid it prints the essid in the log but doesn't say whether it's select or string for the preseed

Megaman fucked around with this message at 21:06 on Aug 19, 2013

hazzlebarth
May 13, 2013

Megaman posted:


debconf: --> INPUT high netcfg/wireless_show_essids
debconf: <-- 0 question will be asked
debconf: --> GO

This is where it stops and I have to hit enter. I have d-i netcfg/wireless_show_essids string fart for this preseed question,

Try to set:

d-i netcfg/wireless_show_essids select manual

instead, d-i netcfg/wireless_essid should take care of the network name.

Megaman
May 8, 2004
I didn't read the thread BUT...

hazzlebarth posted:

Try to set:

d-i netcfg/wireless_show_essids select manual

instead, d-i netcfg/wireless_essid should take care of the network name.

Doing this highlights "Enter ESSID Manually", which looks to be one step in the wrong direction. Selecting manual results in rejected key exchange. Debug logs show the same result as before.

Megaman fucked around with this message at 21:39 on Aug 19, 2013

Accipiter
Jan 24, 2004

SINATRA.
Actually I think this might be solved.

Accipiter fucked around with this message at 23:03 on Aug 19, 2013

wolrah
May 8, 2006
what?
Stupid question, while it may not be a fully open relay will it relay unauthenticated for its own domain?

You may already know this, but if you were relying on third-party tools to test it's really not hard to do it the old fashioned way:

quote:

wolrah@orion:~$ telnet 192.168.10.25 25 Connect to port 25 on the target system
Trying 192.168.10.25...
Connected to 192.168.10.25.
Escape character is '^]'.
220 spamassassin.customer.com ESMTP Postfix (Ubuntu)
EHLO orion.universe Identify yourself to the server. HELO was the old way, EHLO tells the server you want the list of features that follows.
250-spamassassin.customer.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM:<user@bogusdomain.com>
250 2.1.0 Ok
RCPT TO:<my@email.com>
454 4.7.1 <my@email.com>: Relay access denied The first target domain is not allowed as a relay target on this machine.
RCPT TO:<administrator@customer.com>
250 2.1.5 Ok But this one is.
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: Test
TEST MESSAGE BODY
.
250 2.0.0 Ok: queued as 1CFF11004E5
QUIT
221 2.0.0 Bye
Connection closed by foreign host.

That was a connection to a customer's incoming mail filtering box, which accepts and forwards any mail for the customer's domain but will not relay anything outside. Bold text is my input, italics are comments.

For this test you'd want to put a valid (or at least valid-seeming, depending on config) internal email address in the MAIL FROM bit and try to send it to an external site. If it goes through, there's your problem.

Accipiter
Jan 24, 2004

SINATRA.
Nah, I test with telnet myself. But thanks for the info.

I've actually figured out what the problem is. It's not actually relaying, there's a problem with the restrictions on which IPs are allowed to send email. The server's IP recently changed and I think something got bungled in the transition. Thanks though.

priznat
Jul 7, 2009

Let's get drunk and kiss each other all night.
Hi folks,

I have a question with regards to an embedded system I'm developing on. I'm usually a hardware guy but I've been working on a Xilinx Zynq SoC (basically an ARM A9 with a smallish FPGA fabric for programmable logic). Everything is booting nicely and running a Linaro filesystem based on Ubuntu.

My question is the SD Card, one thing I have to be able to account for is users just shutting the power off at random intervals or resetting the processor whenever because they are other engineers and we're assholes. What would be the best way to guard against the Ext4 system I have mounted as root from getting corrupted?

Currently the SD Card has 2 partitions:

/dev/mmcblk0p1 - boot partition, FAT formatted, contains u-boot, first stage boot loader, xilinx fpga bitfile, Linux kernel and devicetree file
/dev/mmcblk0p2 - root partition, contains linux filesystem.

My ideas so far are boot a ramdisk which performs e2fsck on the root partition and then allows it to boot, or perhaps mount the root partition read only and have another partition or network folder for saving data.

I'd prefer keeping the root partition RW though since there will probably be heavy development on the software/scripts going forward. I'm planning on having all these libraries as CVS (I know, old) modules for revision control.

If anyone has any ideas on the best practice to keep the root file system from going all squirrelly that'd be great. Currently I'm having to pop it into a linux pc virtual machine every so often and run e2fsck on it when it starts throwing up error messages in the console.

Experto Crede
Aug 19, 2008

Keep on Truckin'
I sometimes have to open ~200mb SQL dumps but when I do so in gedit it often fails to load it at all, or crashes whilst it's open. Opening the same file in nano or even notepad++ on windows is fine however.

So can anyone recommend a good UI (for gnome ideally) based text editor that handles large files well?

FISHMANPET
Mar 3, 2007

Sweet 'N Sour
Can't
Melt
Steel Beams
Try Geany. I'm not sure how it handles large files but I find it to be better in pretty much every way compared to Gedit.

Superdawg
Jan 28, 2009
Anyone have any good processes they've followed to upgrade a system from debian 32-bit to 64-bit? I've got a server that is hitting out-of-memory issues with the nfs service, which I suspect is because of the 3GB/process limitation of the bigmem kernel.

I've seen a few docs online about it, but none of them seem to be (1)accurate on a debian squeeze host or (2)very confident that their process works correctly.

I have a test machine that I've replicated the configuration into to do some testing with, but I wanted to see if anyone here had any input on the overall process.

Salt Fish
Sep 11, 2003

Cybernetic Crumb

Experto Crede posted:

I sometimes have to open ~200mb SQL dumps but when I do so in gedit it often fails to load it at all, or crashes whilst it's open. Opening the same file in nano or even notepad++ on windows is fine however.

So can anyone recommend a good UI (for gnome ideally) based text editor that handles large files well?

Why are you directly manipulating SQL dumps instead of using a database program? Depending on your exact goal there is probably a specific solution that would work best.

Cidrick
Jun 10, 2001

Praise the siamese

Superdawg posted:

Anyone have any good processes they've followed to upgrade a system from debian 32-bit to 64-bit? I've got a server that is hitting out-of-memory issues with the nfs service, which I suspect is because of the 3GB/process limitation of the bigmem kernel.

I've (attempted) to do this once, and it's really not worth the hassle. Just do a clean installation of x64 from scratch. It'll save you a lot more time in the long run.

Bob Morales
Aug 18, 2006


Just wear the fucking mask, Bob

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

Experto Crede posted:

I sometimes have to open ~200mb SQL dumps but when I do so in gedit it often fails to load it at all, or crashes whilst it's open. Opening the same file in nano or even notepad++ on windows is fine however.

So can anyone recommend a good UI (for gnome ideally) based text editor that handles large files well?

SublimeText, Komodo, gVim

Adult Sword Owner
Jun 19, 2011

u deserve diploma for sublime comedy expertise
Has anyone here gone through the Red Hat training courses for training and/or the RHSCA? Starting to make headway into "no seriously, pay for some courses" at work and these are gigantically expensive. Are they worth it from a training point of view? Should I go with a non-official class instead?

I know it's all stuff I can learn myself by spending lots of time on the internet, but I really need the structure to drag me along and show me tips, tricks.

I work as a Linux admin but some stuff I have really no experience with, like LVM and ACL. According to their evaluation I'm terrible at anything storage-wise beyond basic editing of fstab.

Experto Crede
Aug 19, 2008

Keep on Truckin'

Salt Fish posted:

Why are you directly manipulating SQL dumps instead of using a database program? Depending on your exact goal there is probably a specific solution that would work best.

Sometimes when a website gets migrated to us, often their database contains references to old absolute paths/URLs/etc. and it's generally quicker (depending on the change needed) to do a find and replace of an SQL dump before importing it back in. I know I could use sed but I just prefer doing it in a UI find and replace window.

Superdawg
Jan 28, 2009

Dead Inside Darwin posted:

Has anyone here gone through the Red Hat training courses for training and/or the RHSCA? Starting to make headway into "no seriously, pay for some courses" at work and these are gigantically expensive. Are they worth it from a training point of view? Should I go with a non-official class instead?

I know it's all stuff I can learn myself by spending lots of time on the internet, but I really need the structure to drag me along and show me tips, tricks.

I work as a Linux admin but some stuff I have really no experience with, like LVM and ACL. According to their evaluation I'm terrible at anything storage-wise beyond basic editing of fstab.

I have this book, which seems to be fairly good.

http://www.amazon.com/gp/product/0071765654/ref=oh_details_o05_s00_i00?ie=UTF8&psc=1

Friend of mine used it to get his RHCSA. I need to get off my rear end and learn the super basic pieces of iptables, selinux and kvm (I'm just too lazy to mess with them right now). Then I can probably go in and pass it cold.

ExcessBLarg!
Sep 1, 2001

priznat posted:

What would be the best way to guard against the Ext4 system I have mounted as root from getting corrupted?
Mount /boot as read-only, make sure to use a journal on /.

So with jounaled ext4 you should not be having file-system consistency issues and having to run fsck, as the journal will replay on boot and put the file system in a consistent state. As with any journaled file system, randomly dropping power on the device is generally a bad idea as you can lose data blocks, but that's something that fsck won't/can't fix either.

As it turns out, your scenario is pretty much identical to what Android phones do. They run with ext4 partitions mounted read-write and frequently either have power dropped or only partially-clean shutdowns. Now, when Android first switched from yaffs to ext4, it shook out a number of journaling bugs in the kernel, so if you're running Linux 3.0 or newer, things should be in decent shape. If you're still seeing file system corruption, then one of two things could be going on:

First, Android doesn't use e2fsprogs mke2fs to create the file system, but it's own BSD licensed "make_ext4fs" reimplementation. The main difference is that make_ext4fs creates ext4 file systems that don't use as many fancy features as what mke2fs does, so there may still be journaling bugs in the fancy-feature code. It's easy enough to use make_ext4fs instead, and I would imagine mke2fs can be sufficiently lobotimized through switches, but I'm not certain exactly what to set.

Second, is that if you don't use good SD cards, then FTL metadata can get corrupted and you're hosed that way. Plus, your workloads are going to be painfully sensitive to cards that don't do random small I/Os quickly anyways. You want cards that do well (1 MB/s or lager) in CrystalDiskMark's 4 kB QD32 random I/O test. Recent SanDisk Ultras would be good, although there was a bad batch of them released about a year ago, so you'd want to order new ones off Amazon or something.

Beyond that the only other ext4 issues I've seen in recent kernels is that sometimes the free block/free inode counts end up short on journal replay--likely still a bug lurking somewhere. That won't really affect the filesystem itself, but you might want to fsck the cards once a year anyways.

priznat
Jul 7, 2009

Let's get drunk and kiss each other all night.
Thanks ExcessBLarg!, great post. I think you are right about the SD Cards, I'm suspecting the ones I got (fairly cheap Transcend 16GB ones) might be a large chunk of the issue. I'll look into picking up a couple SanDisks for testing, I've heard them recommended elsewhere too.

Good to know my method is basically (basically) sound though!

edit: Re SD Cards are class 10s worth the extra $ in this case? Probably fine, I just wonder if there are any extra issues going to the faster speed one vs the class 6.

priznat fucked around with this message at 19:19 on Aug 20, 2013

hazzlebarth
May 13, 2013

Megaman posted:

Doing this highlights "Enter ESSID Manually", which looks to be one step in the wrong direction. Selecting manual results in rejected key exchange. Debug logs show the same result as before.

Right, I seem to have misinterpreted the code. I was able to use an old netbook to use as a testbed and I can confirm that the preseed config available at http://www.warperbbs.de/stuff/preseed-wlan.cfg does what is expected and connects to my home wlan network without the need to press a key. Are you sure you have entered the network name correctly?

This is the netcfg/wireless part:

d-i netcfg/wireless_essid string HOMENETWORKNAME
d-i netcfg/wireless_essid_again manual HOMENETWORKNAME
d-i netcfg/wireless_security_type select wpa
d-i netcfg/wireless_show_essids string HOMENETWORKNAME
d-i netcfg/wireless_wpa string HOMENETWORKPASS

If you are really sure that you entered everything correctly, please file a bug about this issue and supply the /var/log/syslog file of the installer session and your preseed.cfg. See http://www.debian.org/Bugs/Reporting on how to file a bug report.

wolrah
May 8, 2006
what?

Cidrick posted:

I've (attempted) to do this once, and it's really not worth the hassle. Just do a clean installation of x64 from scratch. It'll save you a lot more time in the long run.

Sort of expanding on this, its almost always the right choice to reinstall an OS for any major change, even going forward a major version. You end up with less cruft that could bite you in the rear end later.

If you can't comfortably reinstall a production server and restore the data from backup you have bigger problems to deal with.

Superdawg
Jan 28, 2009

wolrah posted:

Sort of expanding on this, its almost always the right choice to reinstall an OS for any major change, even going forward a major version. You end up with less cruft that could bite you in the rear end later.

If you can't comfortably reinstall a production server and restore the data from backup you have bigger problems to deal with.

I'm definitely not arguing this point. However, the plan is to get this system into a 'stable' state where nfs doesn't crash every 8-9 days due to out-of-memory issues killing the necessary processes. I then plan to move the data off and rebuild completely from scratch. (This server houses about 12T of data that I really don't want to have to restore from backup.

I've basically made the decision that we're going to relocate the data elsewhere and then rebuild it, cutting out the 32-64bit upgrade from the process.

FISHMANPET
Mar 3, 2007

Sweet 'N Sour
Can't
Melt
Steel Beams
If you can't just detach that 12T from the system and then reattach it after the reinstall, you've got even bigger problems.

Superdawg
Jan 28, 2009

FISHMANPET posted:

If you can't just detach that 12T from the system and then reattach it after the reinstall, you've got even bigger problems.

My problems are bigger than you think. :)

I took over the infrastructure here almost a year ago at this point. I'm trying to make things consistent, stable and coherent. It's taking time.

(Who would build a 13T+ system with 6GB RAM on Debian squeeze 32-bit in the first place?)

Rusty Kettle
Apr 10, 2005
Ultima! Ahmmm-bing!

evol262 posted:

Honestly, the ACPI docs are really clear. You should use acpitool if you can (and any system managing c states should have it). If not, /proc is deprecated, and /sys/devices/system/cpu/cpuXX/cpuidle/stateXXX shows c state, /sys/devices/system/cpu/X/cpufreq/stats/time_in_state shows p state. Why are you reinventing acpitool's wheel?

My copy of SUSE11 does not have acpitool. I could go down the c-state directory mentioned, which has some well documented and easy to read files like 'usage' and 'time', but it doesn't really tell me what the instantaneous cstate is. The closest I could think of is to poll 'time', wait a few milliseconds, poll 'time' again, then subtract the various state's times to guesstimate what state the computer was in during that wait period.

I am using a precompiled binary of i7z right now, which is not an ideal solution but it'll work for now.

Paul MaudDib
May 3, 2006

TEAM NVIDIA:
FORUM POLICE
How do I blacklist a module when I'm installing Ubuntu? I need to keep piix4-smbus from loading.

Paul MaudDib fucked around with this message at 00:37 on Aug 21, 2013

ExcessBLarg!
Sep 1, 2001

priznat posted:

edit: Re SD Cards are class 10s worth the extra $ in this case? Probably fine, I just wonder if there are any extra issues going to the faster speed one vs the class 6.
Unfortunately class 6 vs. class 10 only refers to sequential write speed, which is really an irrelevant indicator for your workload. Anecdotally it seems that cheap class 10 cards perform worse for this purpose than cheap class 6 cards, but there's good class 10 cards any cheap card out of the water.

I'd probably target good class 10 or UHS-I cards if only because they're newer products with more mature FTLs. SanDisk Ultras are price competitive with most cheap cards though, so there's really no downside. Their extreme line (or whatever its called) is also good, but likely not necessary given their price.

Unfortunately the only real way to know if a card is "good" speed-wise is to perform benchmarks on them. Sometimes you can find them posted online, look for the CrystalDiskMark ones mentioned above, but otherwise you might have to buy a few cards of different brands and test them all.

xtal
Jan 9, 2011

by Fluffdaddy
Has anybody running Arch had problems with catalyst since the latest kernel upgrade? Not sure if I hosed something up or not.

On that note, somebody more experienced should make an Arch thread.

Paul MaudDib posted:

How do I blacklist a module when I'm installing Ubuntu? I need to keep piix4-smbus from loading.

A kernel module? Create a file in `/etc/modprobe.d/`, for example `blacklist.conf`, and put "blacklist piix4-smbus" in it.

Megaman
May 8, 2004
I didn't read the thread BUT...

hazzlebarth posted:

Right, I seem to have misinterpreted the code. I was able to use an old netbook to use as a testbed and I can confirm that the preseed config available at http://www.warperbbs.de/stuff/preseed-wlan.cfg does what is expected and connects to my home wlan network without the need to press a key. Are you sure you have entered the network name correctly?

This is the netcfg/wireless part:

d-i netcfg/wireless_essid string HOMENETWORKNAME
d-i netcfg/wireless_essid_again manual HOMENETWORKNAME
d-i netcfg/wireless_security_type select wpa
d-i netcfg/wireless_show_essids string HOMENETWORKNAME
d-i netcfg/wireless_wpa string HOMENETWORKPASS

If you are really sure that you entered everything correctly, please file a bug about this issue and supply the /var/log/syslog file of the installer session and your preseed.cfg. See http://www.debian.org/Bugs/Reporting on how to file a bug report.

I not only quadruple checked what I typed, but I also tried it with an exact paste of what you typed with my network information substituted in. It must be a bug, I'll file one, thanks much!

Megaman fucked around with this message at 14:54 on Aug 23, 2013

Salt Fish
Sep 11, 2003

Cybernetic Crumb

Experto Crede posted:

Sometimes when a website gets migrated to us, often their database contains references to old absolute paths/URLs/etc. and it's generally quicker (depending on the change needed) to do a find and replace of an SQL dump before importing it back in. I know I could use sed but I just prefer doing it in a UI find and replace window.

I want you to stand in front of sed. Okay, now I want you to close your eyes, cross your arms, and fall backwards into sed's arms.

hazzlebarth
May 13, 2013

Paul MaudDib posted:

How do I blacklist a module when I'm installing Ubuntu? I need to keep piix4-smbus from loading.

To disable a module temporarily from loading, add $MODULE.blacklist=yes to the kernel command line, i.e. in the installer.

Thermopyle
Jul 1, 2003

...the stupid are cocksure while the intelligent are full of doubt. —Bertrand Russell

Is there a more modern equivalent to Bach's The Design of the Unix Operating System?

Megaman
May 8, 2004
I didn't read the thread BUT...
Is there a way to tell openvpn to stop all internet connections if it's disconnected? Or in the very least reconnect immediately? I'd prefer not to have my connection exposed ever if I can.

telcoM
Mar 21, 2009
Fallen Rib

Megaman posted:

Is there a way to tell openvpn to stop all internet connections if it's disconnected? Or in the very least reconnect immediately? I'd prefer not to have my connection exposed ever if I can.

The openvpn connection will appear as a separate TUN/TAP network interface. The TUN/TAP interface is a thing that can take (and be used in) iptables rules. You could use iptables to lock down your physical network interface to accept only openvpn traffic and whatever else you need to actually use the interface and establish the openvpn connection on it (OpenVPN itself, and most likely DHCP to get your IP address and/or possibly DNS to validate the OpenVPN certificates/find the IP of the other endpoint).

Restricted that way, your physical network interface will only be useful for running OpenVPN and practically nothing else. So if your OpenVPN dies, your iptables will cause your application connections to die. You actually might use REJECT rules in the iptables OUTPUT chain to ensure any new connections attempted in that situation will die as painlessly as possible, without waiting for a timeout.


Reconnecting the VPN is usually just a matter of restarting the openvpn client process if it dies.
If necessary, find the option that tells the openvpn client to not run in the background, then run the client via a script that has an infinite loop like this:
[code]
#!/bin/sh

while true
do
# your openvpn client command line goes here

sleep 5 # to avoid pissing off your VPN server admin and/or ISP if something goes wrong
echo "$(date): VPN died, restarting..." # some simple diagnostics
done

xtal
Jan 9, 2011

by Fluffdaddy

Megaman posted:

Is there a way to tell openvpn to stop all internet connections if it's disconnected? Or in the very least reconnect immediately? I'd prefer not to have my connection exposed ever if I can.

Check out Privoxy.

Super-NintendoUser
Jan 16, 2004

COWABUNGERDER COMPADRES
Soiled Meat

3spades posted:

It suggests 644 is insecure (allowing group/other read access) so chmod 600 /swap/swap_file and put your swap entry in /etc/fstab. Then just
# swapon -a

I tried that, and no dice. I just can't seem to create any swap files.

spankmeister
Jun 15, 2008






Jerk McJerkface posted:

I tried that, and no dice. I just can't seem to create any swap files.

SELinux?

Super-NintendoUser
Jan 16, 2004

COWABUNGERDER COMPADRES
Soiled Meat

Let me look into that. I'm running Chrubuntu on my Chromebook (x86) so it's a little strange.

Adbot
ADBOT LOVES YOU

pseudorandom name
May 6, 2007

What kind of filesystem is the swap file on?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply