The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1033 »

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

How come # is used to comment code yet #! is used to tell the shell which interpreter to use?

# ? Jan 26, 2015 21:23

Adbot: ADBOT LOVES YOU

# ? May 24, 2024 07:32

Polygynous: Dec 13, 2006; welp

It's meta, or something. :v:

It's a comment, not code, but it's a meaningful comment that something (the shell) interprets and does what you'd expect.

I think.

# ? Jan 26, 2015 21:25

hooah: Feb 6, 2006; WTF?

Yeah, that's fair that there are always outliers. I was just kinda surprised I found one with not particularly uncommon hardware.

# ? Jan 26, 2015 21:26

evol262: Nov 30, 2010; #!/usr/bin/perl

Tab8715 posted:

How come # is used to comment code yet #! is used to tell the shell which interpreter to use?

The shebang is actually a magic number.

But given that // and /* */ were used to comment the code UNIX was written in anyway, with ! and ; as other comment delimiters, #! isn't super weird.

hooah posted:

Yeah, that's fair that there are always outliers. I was just kinda surprised I found one with not particularly uncommon hardware.

You found one with recent hardware and an optional kernel module. iwlwifi (or whatever wireless driver is actually used) is fine. It's just that the rfkill from ideapad_laptop is bad.

# ? Jan 26, 2015 21:26

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Tab8715 posted:

How come # is used to comment code yet #! is used to tell the shell which interpreter to use?

#! is hardcoded in the Linux kernel. That's a choice that was made a long time ago by some UNIX hackers. They probably chose it so that it would look like a comment to older versions of UNIX which didn't have the magical "#!" behavior, but on newer systems, it would be identified properly.

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/fs/binfmt_script.c#n17

# ? Jan 26, 2015 22:08

Pakistani Brad Pitt: Nov 28, 2004; Not as taciturn, but still terribly powerful...

Hopefully this is the right thread for this kind of thing -- I imagine it's possible. Basically, using a series of piped greps on a set of logs I'm working with, I'm down to a flat text file with a very consistent format. Each line consists of items like:

code:

log.txt-20150120-ID: 4043612
log.txt-20141212-ID: 1234567

What I now want to do is beyond my level of command-line wizardry. I want to basically to iterate through that file, and ultimately use each line to run another grep command to search for related log entries. The "-ID: " part is not relevant and I could probably process it out if it's going to be an obstacle here. So for example, the example lines above would generate commands like:

code:

grep 4043612 log.txt-20150120
grep 1234567 log.txt-20141212

and execute them.

Basically I'm trying to figure out if it is saner to try to process my data into some sort of a batch file that looks like the grep commands above and then execute that, or if I can do this 'on the fly' since my data is so predictable (i.e. the filename to grep is always the characters before "-ID: ", and the data to grep is always the string of numbers after it.)

# ? Jan 26, 2015 23:08

evol262: Nov 30, 2010; #!/usr/bin/perl

MrChupon posted:

Hopefully this is the right thread for this kind of thing -- I imagine it's possible. Basically, using a series of piped greps on a set of logs I'm working with, I'm down to a flat text file with a very consistent format. Each line consists of items like:
code:
log.txt-20150120-ID: 4043612
log.txt-20141212-ID: 1234567
What I now want to do is beyond my level of command-line wizardry. I want to basically to iterate through that file, and ultimately use each line to run another grep command to search for related log entries. The "-ID: " part is not relevant and I could probably process it out if it's going to be an obstacle here. So for example, the example lines above would generate commands like:
code:
grep 4043612 log.txt-20150120
grep 1234567 log.txt-20141212
and execute them.

Basically I'm trying to figure out if it is saner to try to process my data into some sort of a batch file that looks like the grep commands above and then execute that, or if I can do this 'on the fly' since my data is so predictable (i.e. the filename to grep is always the characters before "-ID: ", and the data to grep is always the string of numbers after it.)

Do you want an answer fed to you, or do you want to learn a bit? You can do this pretty trivially as a oneliner with ruby, python, perl, or awk. You can do it in a bash oneliner with a little more work, or a shell script in general. If you want to learn a bit, which one of these are you curious about?

# ? Jan 26, 2015 23:13

Pakistani Brad Pitt: Nov 28, 2004; Not as taciturn, but still terribly powerful...

evol262 posted:

Do you want an answer fed to you, or do you want to learn a bit? You can do this pretty trivially as a oneliner with ruby, python, perl, or awk. You can do it in a bash oneliner with a little more work, or a shell script in general. If you want to learn a bit, which one of these are you curious about?

I don't mind learning a bit, in fact, I would prefer it. I don't have a major preference in technology, I'm not really familiar with any of those. I suppose my requirement would be whichever of them runs on a Mac terminal without installing additional packages, since I'm actually there and not Linux.

Ideally if I could get an example of how to extract some arbitrary string from the examples above and pass it to the command line, that would probably get me rolling. But I'm grateful for any help, even if just some links a bit more directed than googling 'bash scripting'.

I think where I'm stuck is on how to say "everything before/after these characters is the string I want to extract" as opposed to "extract this string:".

Pakistani Brad Pitt fucked around with this message at 23:30 on Jan 26, 2015

# ? Jan 26, 2015 23:26

evol262: Nov 30, 2010; #!/usr/bin/perl

MrChupon posted:

I think where I'm stuck is on how to say "everything before/after these characters is the string I want to extract" as opposed to "extract this string:".

What you're looking for is "regular expressions"

In a more general sense:

code:

sed -e 's/-ID://' < somefile.txt | awk '{print $2,$1}' | while read -r value log; do grep $value $log; done

You can run it piece by piece, but it's basically "replace '-ID:' with nothing, print the second value and the first separated by a space (awk indexes the entire string as $0, and each additional value with a default field separator of whitespace from there) to reverse them, read them into multiple human-readable variables that you can address, and grep"

You don't technically need the "while read -r" because "grep 4043612 log.txt-2015012" just from swapping them actually works. It could be a plain "while read" or pipe it into xargs or whatever, but giving them reasonable names lets you play around with, and gives you the flexibility to add additional grep arguments or whatever

# ? Jan 26, 2015 23:52

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

output='cat <filename.txt>'
grep $output <filename.txt>

Though, I'd imagine you might have to do a cut if there's a space in front of the number. I'm pretty confident you could get this all on one line with some creative pipes.

# ? Jan 26, 2015 23:56

Pakistani Brad Pitt: Nov 28, 2004; Not as taciturn, but still terribly powerful...

I appreciate the responses guys, this is a great place for me to start. I'll post back with my solution later so you can laugh at it. :v:

# ? Jan 27, 2015 00:07

evol262: Nov 30, 2010; #!/usr/bin/perl

MrChupon posted:

I appreciate the responses guys, this is a great place for me to start. I'll post back with my solution later so you can laugh at it.

The bit of code my in quote will work verbatim. Just replace "somefile.txt" with whatever the actual log is

# ? Jan 27, 2015 00:12

Pakistani Brad Pitt: Nov 28, 2004; Not as taciturn, but still terribly powerful...

evol262 posted:

The bit of code my in quote will work verbatim. Just replace "somefile.txt" with whatever the actual log is

Ah, indeed it does! (after tweaking the sed command because the text that needed to be replaced with 'nothing' was actually a bit different in real life than in my example post, but obviously you wrote to the given specification).

Well, my employer appreciates you doing the homework for me but I'm going to take some time later to break down what you've written here so I can try do it with arbitrary data/commands in the future.

Again, thanks very much.

# ? Jan 27, 2015 00:25

ExcessBLarg!: Sep 1, 2001

Tab8715 posted:

How come # is used to comment code yet #! is used to tell the shell which interpreter to use?

In part because, while the #! is a useful directive to the kernel, you actually don't want it to be interpreted by an interpreter since it would be a syntax error in most, possibly all languages.

Languages which don't natively use # to denote comments have to specifically ignore #! or otherwise require explicit invocation of its interpreter.

# ? Jan 27, 2015 04:45

evol262: Nov 30, 2010; #!/usr/bin/perl

ExcessBLarg! posted:

In part because, while the #! is a useful directive to the kernel, you actually don't want it to be interpreted by an interpreter since it would be a syntax error in most, possibly all languages.

Languages which don't natively use # to denote comments have to specifically ignore #! or otherwise require explicit invocation of its interpreter.

Fortunately, with the exception of lisp (which can be compiled anyway), javascript is the only "big" language which would need to ignore it. Everything is compiled and doesn't encounter the shebang. Python, ruby, perl, shell, and even PHP use or can use #

# ? Jan 27, 2015 05:33

Cingulate: Oct 23, 2012; by Fluffdaddy

Okay, you guys have convinced me to set up a VM to deal with my root issues on our server.
It's a Debian server, and I want to run scientific computations, so performance is essential. On the other hand, I'm terrible with computers. I assume a simple Ubuntu Desktop installation should be enough - I want some X forwarding and a lot of Python on all of our 1000000000 Xeon cores and that's basically it.
What VM software should I use, and is there a recommended guide for this?

# ? Jan 27, 2015 11:32

evol262: Nov 30, 2010; #!/usr/bin/perl

Cingulate posted:

Okay, you guys have convinced me to set up a VM to deal with my root issues on our server.
It's a Debian server, and I want to run scientific computations, so performance is essential. On the other hand, I'm terrible with computers. I assume a simple Ubuntu Desktop installation should be enough - I want some X forwarding and a lot of Python on all of our 1000000000 Xeon cores and that's basically it.
What VM software should I use, and is there a recommended guide for this?

If you're serious, a VM may be utterly inappropriate.

Is your environment actually a cluster, single system image or otherwise? A VM won't scale that way (or above one machine). What's the job scheduler?

# ? Jan 27, 2015 14:39

Cingulate: Oct 23, 2012; by Fluffdaddy

evol262 posted:

If you're serious, a VM may be utterly inappropriate.

Is your environment actually a cluster, single system image or otherwise? A VM won't scale that way (or above one machine). What's the job scheduler?

I actually don't know for sure. I think it's a single physical system, with 24 6-core processors. We don't run a job scheduler on there, I treat it as a simple system.

# ? Jan 27, 2015 15:05

supermikhail: Nov 17, 2012; "It's video games, Scully."
Video games?"
"He enlists the help of strangers to make his perfect video game. When he gets bored of an idea, he murders them and moves on to the next, learning nothing in the process."
"Hmm... interesting."

For anyone out there (basically), my "pulseaudio doesn't know how to do balance" problem is going strong. I swear it just broke when I opened Chrome. :shrug:

Also, the "rampant screen blanking" issue is still open, but I'm sort of beginning to appreciate it in a "Stockholm syndrome" kind of way. I only watch Youtube before going to bed usually, and I can turn off blanking with a couple clicks using a script when I need to, whereas the rest of time this thing that I barely have any control over takes care of the monitor in case I forget to turn it off when I go away.

# ? Jan 27, 2015 15:19

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

Is this just how things are formatted or what does this indicate?

code:

       List  information  about	 the FILEs (the current directory by default).
       Sort entries alphabetically if none of -cftuvSUX nor --sort.

       Mandatory arguments to long options are	mandatory  for	short  options
       too.

       -a, --all
	      do not ignore entries starting with .

Where we have -a or --all? What do the two dashes indicate? Or this merely another way to add include some kind of option?

# ? Jan 27, 2015 16:08

spankmeister: Jun 15, 2008

-a is the short form and --all is the long form of the same option. Often with command line options there will be a short, single letter option with one dash, and another that does the exact same thing but is a longer form with two dashes

# ? Jan 27, 2015 16:20

ToxicFrog: Apr 26, 2008

Tab8715 posted:

Is this just how things are formatted or what does this indicate?

[man ls]

Where we have -a or --all? What do the two dashes indicate? Or this merely another way to add include some kind of option?

You can use either '-a' (as in 'ls -a') or '--all' (as in 'ls --all'). The latter is more readable, the former is faster to type. It's quite common for command line flags to have both "long" and "short" versions; by convention, the short versions start with "-" and can be smashed together (-abc and -a -b -c are equivalent) and the long versions start with "--" and must be separate. The two forms are equivalent.

In other words, these three commands all do the same thing:

code:

ls -l --sort=time --reverse --all --human-readable
ls -l -t -r -a -h
ls -ltrah

Note that "-l" (long format; list permissions, timestamps, ownership and file sizes) doesn't have a long version, and that the long version of "-t" is "--sort=time".

In most tools, you can also use "--" to explicitly separate flags and arguments:

code:

# List the contents of the current directory, in reverse order, including hidden files
ls --all --reverse
# List the contents of the directory "--reverse", including hidden files
ls --all -- --reverse

ToxicFrog fucked around with this message at 16:26 on Jan 27, 2015

# ? Jan 27, 2015 16:23

evol262: Nov 30, 2010; #!/usr/bin/perl

Cingulate posted:

I actually don't know for sure. I think it's a single physical system, with 24 6-core processors. We don't run a job scheduler on there, I treat it as a simple system.

A single system image cluster can also be treated as a single physical system. There are not a lot of 24 socket systems in the world. Try "cat /proc/cpuinfo" to see the actual CPU information. You won't get the topology out of it, but you can learn a lot even without that.

You can pull what it actually is with "dmesg | |grep "DMI:''" (you may have to grep DMI: out of /var/log/messages or journalctl, depending on uptime and how many messages you get)

If it is multiple systems or chassis (SGI still makes a few systems like this, among others, mostly in the supercomputing space), you'll want to try to find out what the interconnect is. If it's something that doesn't do remote DMA, following the topology is going to be very important for virt. And running a VM will take root privileges or some configuration by your admins anyway...

So you may be down to running debian in a chroot, though I have to say that I've never actually tried this. And you probably won't get your admins to change fstab on the host or give you permission to mount psuedofilesystems, so /proc and things may be weird. Plus uid0 is actually treated specially and you wouldn't be able to su to users yo don't have permissions for anyway and...

If the system recent enough to have unprivileged container support?

You may just have to talk to your admins

supermikhail posted:

For anyone out there (basically), my "pulseaudio doesn't know how to do balance" problem is going strong. I swear it just broke when I opened Chrome.

Also, the "rampant screen blanking" issue is still open, but I'm sort of beginning to appreciate it in a "Stockholm syndrome" kind of way. I only watch Youtube before going to bed usually, and I can turn off blanking with a couple clicks using a script when I need to, whereas the rest of time this thing that I barely have any control over takes care of the monitor in case I forget to turn it off when I go away.

Stop using XFCE. Or stop using Ubuntu. Or see if someone's filed a bug against XFCE's power manager in Ubuntu.

Tab8715 posted:

Is this just how things are formatted or what does this indicate?
code:
       List  information  about	 the FILEs (the current directory by default).
       Sort entries alphabetically if none of -cftuvSUX nor --sort.

       Mandatory arguments to long options are	mandatory  for	short  options
       too.

       -a, --all
	      do not ignore entries starting with .
Where we have -a or --all? What do the two dashes indicate? Or this merely another way to add include some kind of option?

It's just formatting. Some utilities (like tar, cpio, and other oldies) sometimes have more options than it's possible to use even with every character in uppercase and lowercase. Yes, it's stupid. But both work.

Take a look at getopt (and getopt_long) for a canonical implementation that's widely used.

# ? Jan 27, 2015 16:32

Cingulate: Oct 23, 2012; by Fluffdaddy

evol262 posted:

A single system image cluster can also be treated as a single physical system. There are not a lot of 24 socket systems in the world. Try "cat /proc/cpuinfo" to see the actual CPU information. You won't get the topology out of it, but you can learn a lot even without that.

http://pastebin.com/Mtt0e2zM

evol262 posted:

You can pull what it actually is with "dmesg | |grep "DMI:''" (you may have to grep DMI: out of /var/log/messages or journalctl, depending on uptime and how many messages you get)

"dmesg | grep DMI" matches nothing, cat /var/log/messages gives Permission denied, and journalctl gives command not found.

evol262 posted:

If it is multiple systems or chassis (SGI still makes a few systems like this, among others, mostly in the supercomputing space), you'll want to try to find out what the interconnect is. If it's something that doesn't do remote DMA, following the topology is going to be very important for virt. And running a VM will take root privileges or some configuration by your admins anyway...

So you may be down to running debian in a chroot, though I have to say that I've never actually tried this. And you probably won't get your admins to change fstab on the host or give you permission to mount psuedofilesystems, so /proc and things may be weird. Plus uid0 is actually treated specially and you wouldn't be able to su to users yo don't have permissions for anyway and...

If the system recent enough to have unprivileged container support?

You may just have to talk to your admins

I have never heard most of these words

I think it's really just a single physical system, one tower full of Xeons happily humming along.
I'm very skeptical about the possibility, or even, on my part, desire to get the admin to give me special permissions or change fstab.

I thought I could just install something like VirtualBox and run it like any regular application?

Cingulate fucked around with this message at 17:53 on Jan 27, 2015

# ? Jan 27, 2015 17:46

evol262: Nov 30, 2010; #!/usr/bin/perl

Cingulate posted:

http://pastebin.com/Mtt0e2zM

Ok, that makes a lot more sense. "24 6-core processors" made me think there were actually 24 processors. This looks like 2, maybe 4, depending on whether or not hyperthreading is enabled (probably 2).

Cingulate posted:

I thought I could just install something like VirtualBox and run it like any regular application?

Virtualbox uses kernel modules. You need root at least to install it.

# ? Jan 27, 2015 18:03

supermikhail: Nov 17, 2012; "It's video games, Scully."
Video games?"
"He enlists the help of strangers to make his perfect video game. When he gets bored of an idea, he murders them and moves on to the next, learning nothing in the process."
"Hmm... interesting."

evol262 posted:

Stop using XFCE. Or stop using Ubuntu. Or see if someone's filed a bug against XFCE's power manager in Ubuntu.

I had Debian a couple years ago, but for some reason went back to Ubuntu, and I wish I had recorded my grievances or reasons, because I still find Debian's release cycle... comforting, if I may. Anyway, the blanking is a minor issue, as I've said. But I've discovered something about the major problem (I think I have, at least).

I got the commands for multimedia keys... somewhere, and they were in the following form:

code:

amixer -D pulse sset Master 5%�

However, I've just discovered (while looking for bug reports, btw) that you can do it with simple

code:

amixer sset Master 5%�

It actually looks like option 2 readjusts simultaneously, while for option 1 the sliders move individually, although the difference really miniscule, and I could easily be imagining it. (And it's the GUI anyway.) Anybody have any thoughts on this?

# ? Jan 27, 2015 18:44

Cingulate: Oct 23, 2012; by Fluffdaddy

evol262 posted:

Ok, that makes a lot more sense. "24 6-core processors" made me think there were actually 24 processors. This looks like 2, maybe 4, depending on whether or not hyperthreading is enabled (probably 2).

Sorry for being confusing. This is what I meant.

evol262 posted:

Virtualbox uses kernel modules. You need root at least to install it.

So, would it make sense to ask our admin to install Virtualbox? Or any other WM?
I think it'd greatly simplify things if I had an installation I have complete control over, without running into danger of killing everyone else's stuff. I would have to make some fairly deep intrusions into our current installation to get a few rather essential packages to run - some of the stuff that's set up right now is ancient in the way only a conservative Debian installation could be.

# ? Jan 27, 2015 19:50

fletcher: Jun 27, 2003; ken park is my favorite movie; Cybernetic Crumb

I need multiple services to have access to the same SSL key, should I create a new group called 'ssl' or something for that and add the service users to it?

# ? Jan 27, 2015 19:55

evol262: Nov 30, 2010; #!/usr/bin/perl

Cingulate posted:

So, would it make sense to ask our admin to install Virtualbox? Or any other WM?
I think it'd greatly simplify things if I had an installation I have complete control over, without running into danger of killing everyone else's stuff. I would have to make some fairly deep intrusions into our current installation to get a few rather essential packages to run - some of the stuff that's set up right now is ancient in the way only a conservative Debian installation could be.

KVM has been mainline for a long time. Even Debian stable should have it in the stock kernel, but I don't know about your environment

Ask your admin to set up libvirt for user access (with sasl auth or otherwise)

# ? Jan 27, 2015 20:15

RFC2324: Jun 7, 2012; http 418

Cingulate posted:

some of the stuff that's set up right now is ancient in the way only a conservative Debian installation could be.

I have some servers under my care that haven't been rebooted in years 5+ years, and no one actually knows when they were last patched.

Production servers on a secure network don't tend to get updated unless something is actively not working, since there is no reason to fix something that ain't broke(and the fixes will commonly break other things that were written to depend on older behaviour)

# ? Jan 27, 2015 20:27

Thalagyrt: Aug 10, 2006

For those of you who haven't seen it yet, since I haven't seen it mentioned in this thread: http://www.openwall.com/lists/oss-security/2015/01/27/9

RCE vulnerability in glibc's gethostbyname() function. Apparently it was patched in May 2013 but never marked as a security patch, so a lot of distros never shipped an updated version. You'll definitely want to reboot after applying this patch, since it'd be hard to ensure that everything linking the old version of glibc was restarted otherwise.

# ? Jan 27, 2015 20:32

ExcessBLarg!: Sep 1, 2001

It's hard to tell what common, externally-facing services are actually vulnerable. Sounds like Exim with non-standard options is the big one.

# ? Jan 27, 2015 21:36

Thalagyrt: Aug 10, 2006

ExcessBLarg! posted:

It's hard to tell what common, externally-facing services are actually vulnerable. Sounds like Exim with non-standard options is the big one.

An MTA in general seems like a good candidate for potential exploitation simply due to how many DNS queries they make that are a direct result of headers in inbound emails.

# ? Jan 27, 2015 21:39

fatherdog: Feb 16, 2005

RFC2324 posted:

Production servers on a secure network don't tend to get updated unless something is actively not working, since there is no reason to fix something that ain't broke(and the fixes will commonly break other things that were written to depend on older behaviour)

No offence but this is a terrible security philosophy. No network is that secure.

# ? Jan 27, 2015 22:01

Thalagyrt: Aug 10, 2006

fatherdog posted:

No offence but this is a terrible security philosophy. No network is that secure.

Agreed 100%. I update all of my internal stuff regularly as well. I don't care that it's not directly accessible from the Internet, it's better not to risk it. What if someone gets a limited shell (say you're being terrible at security and using Wordpress or some equally exploitable garbage) on an Internet facing machine that also has some visibility into your internal network for some weird reason, then they exploit some old bug in a daemon on your internal network that would have been patched if you kept up on updates? There are far too many potential vectors out there to make it worth risking your network's security by not updating.

# ? Jan 27, 2015 22:11

RFC2324: Jun 7, 2012; http 418

fatherdog posted:

No offence but this is a terrible security philosophy. No network is that secure.

Its not my policy, its the corporation that has already lost more money due to patching breaking their fabs than they have ever lost to security compromises, and has in the past held large government contracts(people I work with talk about having training on what to do in case of a terrorist attack that included having people literally storm the building with unloaded guns)

Every last system admin in the place wants to patch these machines, but it has to be justified beyond a vague 'a thing could happen'.

We have had 2 compromises in the past year, but the loss didn't compare to the one time a fiber card with firmware newer than what is approved was plugged into a new build server.

# ? Jan 27, 2015 22:11

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

fatherdog posted:

No offence but this is a terrible security philosophy. No network is that secure.

It is but numerous corporations still continue to do so, I know of a particular one that has production servers running 5-year unsupported unix distributions. Legacy applications are tough to kill.

EDIT - When I inquired, I was basically told there's no funding and everything still works.

# ? Jan 27, 2015 22:15

fatherdog: Feb 16, 2005

RFC2324 posted:

Its not my policy, its the corporation that has already lost more money due to patching breaking their fabs than they have ever lost to security compromises, and has in the past held large government contracts(people I work with talk about having training on what to do in case of a terrorist attack that included having people literally storm the building with unloaded guns)

Every last system admin in the place wants to patch these machines, but it has to be justified beyond a vague 'a thing could happen'.

We have had 2 compromises in the past year, but the loss didn't compare to the one time a fiber card with firmware newer than what is approved was plugged into a new build server.

A company that holds large government contracts and has had 2 compromises in the past year still refusing to patch their internal servers because completely unrelated poor planning in a hardware spec cost them more money is some impressive levels of head-in-the-sand-ism from your managers. (please understand that as being stated in a tone of sympathy rather than derision)

# ? Jan 27, 2015 22:17

Cingulate: Oct 23, 2012; by Fluffdaddy

Thalagyrt posted:

For those of you who haven't seen it yet, since I haven't seen it mentioned in this thread: http://www.openwall.com/lists/oss-security/2015/01/27/9

RCE vulnerability in glibc's gethostbyname() function. Apparently it was patched in May 2013 but never marked as a security patch, so a lot of distros never shipped an updated version. You'll definitely want to reboot after applying this patch, since it'd be hard to ensure that everything linking the old version of glibc was restarted otherwise.

Our glibc is actually one of the pieces of software that's especially dated.

I am sure there are some usage scenarios where it's best policy to only fix what breaks. But that's not what would work in our case. I'm not asking for a kernel upgrade for our 2-year uptime machine because, you know, 3.16 is clearly better than 3.14 right? It's that there is exactly one package that will do a certain kind of computation, and the people who made it set it up to work with, for whatever reason, reasonably up-to-date software, and I literally cannot do the work without, for example, a libc from this century.
Now if everybody involved was competent at computers, the original programmers would be able to make it compatible with older software, and I'd be able to recompile stuff to work in our environment or maybe just reimplement it myself or whatever, instead of asking stupid questions.
But, we're not.

Generally, if you're a professional IT guy and have had the fortune to never have dealt with scientists: give it a try once. Scientists are very creative at ignoring and stubbornly working against IT best practices. My .bash_history would probably make you cry.

evol262 posted:

KVM has been mainline for a long time. Even Debian stable should have it in the stock kernel, but I don't know about your environment

Ask your admin to set up libvirt for user access (with sasl auth or otherwise)

Thanks.

# ? Jan 27, 2015 22:30

Adbot: ADBOT LOVES YOU

# ? May 24, 2024 07:32

evol262: Nov 30, 2010; #!/usr/bin/perl

Thalagyrt posted:

Agreed 100%. I update all of my internal stuff regularly as well. I don't care that it's not directly accessible from the Internet, it's better not to risk it. What if someone gets a limited shell (say you're being terrible at security and using Wordpress or some equally exploitable garbage) on an Internet facing machine that also has some visibility into your internal network for some weird reason, then they exploit some old bug in a daemon on your internal network that would have been patched if you kept up on updates? There are far too many potential vectors out there to make it worth risking your network's security by not updating.

Not that I'm defending the practice, but proper DMZs and active security scanning go a long way.

Even you can't patch the box for whatever reason (breaks CNC or fabs or scada), you can still put it in its own retard vlan which adds another layer.

Even a fully patched system can still be subject to problems from 2000 because nobody bothered to label it as security. As usual, defense in depth wins

# ? Jan 27, 2015 22:39

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1033 »