quote:

This is more of a security problem. You don't have a dedicated server guy and you're running (presumably) unmaintained Windows servers for something that'd cost you $15/yr.

quote:

Email in-house is stupid for the same reason. SPF, DKIM, not being an open relay, and everything else you need to get reliable mail transport sounds like it's beyond the skillset of anyone at your company. Paying someone to deal with all the hassle is virtually free and removes a lot of headache from your very small company. There is zero reason to have email in-house.

quote:

If they want access to "their own PCs with Illustrator set up just the way they like" they should get laptops. Or hit the terminal server from inside the company as well and set up illustrator on VDI or whatever. Port forwarding to internal workstations so they can RDP in from wherever and use Illustrator "jsut the way they like" is wrong is many, many ways.

quote:

It's also your job (assuming you're the "computer guy" at this shop) to inform him of what his limitations are and what you're not willing to do. When A/B/C happens and your mail server gets on a blacklist so you can't talk to clients at all anymore until you migrate your email infrastructure somewhere else, or whatever web frontent you set up for email has a zero day and you get your email server rooted, or someone brute forces the terrible password the clothing designer's set on their account which has port-forwarded RDP with no real security and steals all your clothing designs from your NAS or whatever...

quote:

It's better to stop problems preemptively than fight fires when they spring up, and they will spring up in your environment. You don't have the in-house expertise to manage email, you probably don't need to host your website in-house, etc. It's not a bad thing, just set boundaries while you can before you're trying to rescue your infrastructure from whatever disaster befalls it.

evol262 posted:

There are a few ways to do this. Please read the stuff on xen-pciback.

eXXon posted:

If you mean Intel RAID, you should be able to use it across both, although it's probably not going to be worth the headaches if one or the other drops and you don't actually need the performance gain. If you mean an actual controller, they're pretty expensive and again not worth it unless you actually really need it.

Getting ext working in Windows is infinitely more painful than NTFS in Linux. I recalling using some flaky drivers for ext2/3 years ago. I don't think ext4 drivers even exist yet.

Feral Integral posted:

Yeah, this section is what I want I think, since I want to be able to assign dynamically. Couple questions though:

How is editing the /etc/modprobe.d folder different from editing a /etc/modprobe.conf file? I seem to have the former.

If I edit the modprobe configuration to have the pciback module load the radeon driver first like in that guide, will debian automatically fall back on the nvidia driver or do I have to specify that somewhere else?

Toasticle posted:

I maintain it. It's been fine for three years now with a single instance of someone (him) getting that FBI "You've been watching child porn" ransomware on his laptop and stupidly bringing it in and connecting to the network to try and download something to get rid of it.

Thanks for the condescending assumptions but the email server is secure, we've never been blacklisted despite having to email back and forth to half of east asia 200 times a day and some idiots trying to brute force in from china twice a month but yes I actually do enforce strong passwords for email, desktops and RDC. Yeah someone will get in someday but its not the unmanaged shitbox you're making it out to be.

Toasticle posted:

Yup. Doesn't matter. Hell it took PCAnywhere being incompatible with windows 7 for them to finally stop using that, remote desktopping is they way they've done it for a decade and its the way they'll do it when I'm gone it's not a fight worth bothering with. Its his decision to do it this way and hes not going to buy 5 $2000 laptops (Illustrator CC is a loving resource destroying monster that wont open 90% of their poo poo on a $600 laptop) and 5 more illustrator yearly licenses.

Toasticle posted:

Well I killed the webmail, its not open relay and not a single person has managed to get in since I've been here. When he did host it somewhere else they did have to deal with blacklisting because some other customer got their IP range blacklisted so he had it moved in-house. He had his reasons, it solved the problem, it hasn't happened since as I actually do stay on top of it. My only desire is to free up the drat windows server from having to process 1500 daily emails.

Toasticle posted:

Yup and again doesn't matter, this isn't a 300 person corp its a 11 man (well 2 men 9 woman) that he runs the way he wants to run and again while I agree with you completely it's not going to change anything.

Thermopyle posted:

I actually meant something like mdadm or ZFS.

My research today has led me to believe there's nothing like that that works cross platform.

I'll just use whatever the raid is on my motherboard.

Toasticle posted:

evol262 posted:

The kernel will load whatever drivers it needs for unassigned devices. If pciback has the nVidia card bound, the kernel won't try to assign anything else to it.

Feral Integral posted:

OK so I created the file /etc/modprobe.d/xen-pciback.conf :

code:

install radeon /sbin/modprobe pciback ; /sbin/modprobe --first-time --ignore-install radeon
options xen-pciback hide=(03:00.0)(03:00.1)

and I've run

code:

update-initramfs -u

and rebooted, but the radeon is still detected and taken by the domU. Also,

code:

cat /var/log/dmesg | grep seize

doesn't return anything, so pciback isn't grabbing the radeon. Any ideas what I might be doing wrong?

evol262 posted:

Do you mean detected and taken by dom0?

Do you have iommu/vt-d? Does "dmesg | grep -i 'IO Vir'" return anything?

Feral Integral posted:

Yeah I should have vt-d. My system is a Intel Core2 Duo CPU E8400 on a Gigabyte EP35-DS3L, that command doesn't return anything.

evol262 posted:

See this. I have no idea how to enable it on your particular motherboard, or even whether it supports it.

Feral Integral posted:

It's already enabled in the bios.

Misogynist posted:

VT-d was introduced in Nehalem. Core microarchitecture doesn't have it.

Feral Integral posted:

Well theres a "Hardware Virtualization" toggle in the bios and I've switched it to on

Misogynist posted:

VT-d was introduced in Nehalem. Core microarchitecture doesn't have it. You have VT-x.

evol262 posted:

ARK says the E8400 has VT-d. But the P35 does not.

sm00th posted:

As far as I remember I only used "-dpms" and "s off".
I'm not sure but you might be reenabling screensaving with "s noblank" after "s off" even though the manpage says it only sets the preference

It is not Openbox who blanks the screen, its X server.

Sounds like DPMS. If it still does that after all the xset witchery it may not be applied at all, you can check your current settings with "xset q"

fourwood posted:

As an aside, anyone know why Xbox 360 gamepad input (using the native xpad driver if it matters) doesn't interrupt the idle timeout like keyboard/mouse input do?

crazysim posted:

This is probably needless noise but I just wanted to remind people in this discussion with a PSA that the K (unlocked multiplier processors) series lack VT-D.

Feral Integral posted:

Holy crap thank you for posting this, I was just about to buy the i5-3570K without even checking.. so I won't be able to overclock if I want vt-d? Bummer

Feral Integral posted:

Holy crap thank you for posting this, I was just about to buy the i5-3570K without even checking.. so I won't be able to overclock if I want vt-d? Bummer

Bob Morales posted:

What's a good tool for doing a security audit on old UNIX boxes like HP-UX, AIX, or Solaris?

I just know it's a hundred times easier to crack passwords or accounts on some old server that hasn't been patched in 10 years and then hop on to Windows/AD from there.

What I'm getting as is trying to make a case for not using the same passwords for users on Windows, the VPN, and the crusty old Unix server.

evol262 posted:

That's not a use case for not using the same passwords, though. The "crusty old UNIX" boxes (especially HP-UX) probably don't even care about or encode any characters past the 8th, so enforcing strong passwords mitigates the risk of actually breakin git.

spankmeister posted:

It's very likely using DES so jtr can do it in no time flat.

Bob Morales posted:

I have a Athlon X2 3200+ cranking through /etc/passwd right now (212 password hashes, 196 different salts, (Traditional DES [128/128 BS SSE2-16])

Looks like pretty much everyone's password is their first name or last name, or their username with a 1 on the end of it. Root pw is a common 8-letter word with a 1 on the end of it, which of course doesn't even matter because it's the 9th character.

evol262 posted:

Red flags are going up.

Up higher. Why does he want this? NFSroot is fine for thin clients, LSTP, kiosks, and stateless servers. These won't be in the future.

The readonly root stuff will help you immensely here. Please look into it. You don't need rc.sysinit. Why do you even need /home? Why can't /var be tmpfs?

If it were me doing this for no reason, I'd partition the disks into a Ceph or Gluster node and mount filesystems off there so you get resiliency, performance, and some use out of all that wasted disk. Again though, why?


Here's where there are problems. If you need different config files in /etc, you have a few options:

Keep a copy of /etc/ on the disk somewhere and bind mount it (same readonly-root stuff).
Leave the servers stateless and provision on boot with Ansible, Puppet, Chef, or whatever. This is probably the best solution.

Illusive gently caress Man posted:

Thanks for this, I know I've got a ways to go with this stuff. I've started setting up cobbler and I'm learning to use puppet. I'm ditching the nfsroot plan for now because I didn't understand the advantages to begin with and everyone else is out of the country so I can probably get away with it.

Illusive gently caress Man posted:

I originally had /var as a tmpfs but my boss was like "what if it runs out of ram?" I have no idea what circumstances would cause /var to grow to 16gb, but I didn't say that. The servers that would have been nfsroot are basically compute nodes running a bunch of VMs in our cloud project.

Illusive gently caress Man posted:

My next upcoming problem is that we're going to be running a lot of stuff we develop ourselves, so I can't exactly tell puppet to grab it from the regular centos repositories. Would the best way to do things be to package our stuff and create a yum repo on one of our servers that they can all get things from? Is all of this overkill for a currently really small company with like four people and 10ish servers? In a year we could have a poo poo ton more, so I like to think this isn't a waste.

Illusive gently caress Man posted:

Is all of this overkill for a currently really small company with like four people and 10ish servers? In a year we could have a poo poo ton more, so I like to think this isn't a waste.

evol262 posted:

Email in-house is stupid for the same reason.

If they want access to "their own PCs with Illustrator set up just the way they like" they should get laptops. Or hit the terminal server from inside the company as well and set up illustrator on VDI or whatever. Port forwarding to internal workstations so they can RDP in from wherever and use Illustrator "jsut the way they like" is wrong is many, many ways.

It's also your job (assuming you're the "computer guy" at this shop) to inform him of what his limitations are and what you're not willing to do.

It's better to stop problems preemptively than fight fires when they spring up, and they will spring up in your environment. You don't have the in-house expertise to manage email, you probably don't need to host your website in-house, etc. It's not a bad thing, just set boundaries while you can before you're trying to rescue your infrastructure from whatever disaster befalls it.

evol262 posted:

Is this a joke? "They've always done it this way so I may as well not even try". Do you think they even know VDI is a viable solution?

This is why you move to Google Apps or another large provider, not a fly-by-night operation where the other guy on your chassis is running a spambot.

In that case I recommend Sendmail 8.11 on a C3750 you get off eBay running completely unpatched HP-UX 11.0 fronted by the oldest version of Squirrelmail you can possibly find.

My advice is that you shouldn't run your own email infrastructure. And you definitely shouldn't run your own email infrastructure on an operating system you're unfamiliar with and you haven't touched in years. And you shouldn't always do whatever your boss says, especially when it's not in his problem domain at all -- this is your job and he pays you for it. Including making decisions. But you're doing to whatever, so

My Rhythmic Crotch posted:

These kinds of replies are completely loving worthless. I know you're a smart guy, but you're a condescending, holier-than-thou rear end in a top hat.

Responses like these create a noise floor that impedes helpful discussion. The guy came here with a real need for info, and you pooped all over him for it. Thanks for that, you've done a real service.

evol262 posted:

This is more of a security problem. You don't have a dedicated server guy and you're running (presumably) unmaintained Windows servers for something that'd cost you $15/yr.

Email in-house is stupid for the same reason. SPF, DKIM, not being an open relay, and everything else you need to get reliable mail transport sounds like it's beyond the skillset of anyone at your company. Paying someone to deal with all the hassle is virtually free and removes a lot of headache from your very small company. There is zero reason to have email in-house.

If they want access to "their own PCs with Illustrator set up just the way they like" they should get laptops. Or hit the terminal server from inside the company as well and set up illustrator on VDI or whatever. Port forwarding to internal workstations so they can RDP in from wherever and use Illustrator "jsut the way they like" is wrong is many, many ways.

It's also your job (assuming you're the "computer guy" at this shop) to inform him of what his limitations are and what you're not willing to do. When A/B/C happens and your mail server gets on a blacklist so you can't talk to clients at all anymore until you migrate your email infrastructure somewhere else, or whatever web frontent you set up for email has a zero day and you get your email server rooted, or someone brute forces the terrible password the clothing designer's set on their account which has port-forwarded RDP with no real security and steals all your clothing designs from your NAS or whatever...

It's better to stop problems preemptively than fight fires when they spring up, and they will spring up in your environment. You don't have the in-house expertise to manage email, you probably don't need to host your website in-house, etc. It's not a bad thing, just set boundaries while you can before you're trying to rescue your infrastructure from whatever disaster befalls it.

evol262 posted:

It's less about being condescending and more about security being hard. It was completely unclear from your initial post that anyone was enforcing any policies whatsoever, and sounded more like you were the best guy they had with computers so you were sort of handling it because you touched Linux 5 years ago and you know how to replace a hard drive, not that you're their admin.

At any rate, the concerns with blacklisting have a lot to do with someone blacklisting an entire IP range you happen to be sitting in and other problems out of your control but within the reach of very large email providers. When your email infrastructure is (by your own admission) a POS, you have no downsides and only upsides in moving to externally-hosted email.

Is this a joke? "They've always done it this way so I may as well not even try". Do you think they even know VDI is a viable solution?

This is why you move to Google Apps or another large provider, not a fly-by-night operation where the other guy on your chassis is running a spambot.

In that case I recommend Sendmail 8.11 on a C3750 you get off eBay running completely unpatched HP-UX 11.0 fronted by the oldest version of Squirrelmail you can possibly find.

My advice is that you shouldn't run your own email infrastructure. And you definitely shouldn't run your own email infrastructure on an operating system you're unfamiliar with and you haven't touched in years. And you shouldn't always do whatever your boss says, especially when it's not in his problem domain at all -- this is your job and he pays you for it. Including making decisions. But you're doing to whatever, so

evol262 posted:

While yes, it was aggressive, it wasn't nearly as aggressive as your selective quoting made it appear.