libera/#devuan/ Monday, 2020-06-01

OksanaTi-red. How do I get/set date, time, timezone? Beowulf, Devuan, Xfce.03:51
bgstack15Xfce panel whisker menu, select the "Settings" icon. Or in the Alt+F2 run screen, run "xfce4-settings-manager"03:55
bgstack15and of course my xfce setup doesn't have a timezone chooser.03:55
bgstack15Are you comfortable with command line? `sudo dpkg-reconfigure tzdata`03:56
bgstack15will get you the Devuan canonical way to set timezone.03:56
bgstack15and then to set time, are you interested in using ntp/chrony (points to a network time server) or just manually telling your computer what time it is?03:57
Oksanabgstack15: Sounds good, thank you. It says Current default time zone: 'Australia/Sydney' Local time is now:      Mon Jun  1 12:57:13 AEST 2020. https://www.timeanddate.com/ says 11:57.03:58
bgstack15date -s "2020-06-01 01:58 UTC"03:58
OksanaSo, the problem is still there03:58
* Oksana doesn't want to set it manually, with DST and everything - wants it to just work.03:58
bgstack15The trickery begins with getting your BIOS (or motherboard) to store the time that your OS is using.03:59
bgstack15Particularly on VMware... but I digress.03:59
bgstack15so to fix that pesky hour off thing:03:59
bgstack15sudo service chrony restart03:59
OksanaIt is possible that Microsoft Teams doesn't work because of wrong time. https://github.com/IsmaelMartinez/teams-for-linux/issues/286 Not my choice of conferencing software, but still, would be nice to not have to deduct 1 hour every time I glance at laptop clock.03:59
Oksanachrony: unrecognized service04:00
bgstack15Yes, I expect Teams to struggle due to the clock being off. Some things (certs? kerberos? SAML in particular for sure) only tolerate <5 minutes off.04:00
bgstack15try "sudo service ntpd restart" or ntp04:00
bgstack15Dratted chrony replacing ntp...04:01
Oksanabgstack15: Would be nice if they told me what the problem was! I tried three different web browsers, incognito mode, and empties my/etc/hosts file in vain.04:01
bgstack15so the command line, "date -u" should show you UTC time of Monday at 02:01 right now.04:01
OksanaNot ntpd, not ntp04:02
bgstack15If that's good, then we just need to solve your DST display issue.04:02
Oksanadate -u Mon  1 Jun 03:02:08 UTC 202004:02
bgstack15OK, so definitely off. Make sure ntpdate is installed. We're going to run ntpdate manually for now.04:03
bgstack15sudo apt-get install ntpdate04:03
Oksanantpdate is installed, already.04:04
bgstack15then: ntpdate 0.centos.pool.ntp.org04:04
bgstack15that's the one I use... even though I also use Devuan Linux.04:04
OksanaRunning ps aux | grep ntp | grep -v firefox, I get/usr/sbin/ntpd -f /etc/openntpd/ntpd.conf AND ntpd: ntp engine AND ntpd: dns engine AND grep ntp04:04
bgstack15maybe the service goes by another name on Beowulf. Maybe do a ls -l /etc/init.d/*ntp*04:05
bgstack15Sorry, I'm all Ceres over here.04:05
bgstack15so the manual ntpdate command will take a few seconds, as you should have observed. But your date should be good now.04:06
Oksanadate -u Mon  1 Jun 02:06:41 UTC 202004:07
bgstack15I've actually never had good luck with chrony (or ntpd for that matter) actually pulling time from a time server. So whenever my VMware host screwed up the date, my VMs would too and never fix themselves because I suck at ntp.conf.04:07
bgstack15Good, so correct date now. So the probable cause of this is your system boots up with the hardware clock time which is probably off by an hour.04:08
bgstack15I have this problem twice a year...04:08
bgstack15So run: sudo hwclock -ru04:08
bgstack15So for some reason my hwclock is showing me my real time in my timezone even though I gave it the -u flag.04:09
bgstack15if this hwclock output is off by the one hour, then that means the hardware clock is off. So you can change the hardware clock time to use the system time now that you corrected it.04:10
bgstack15sudo hwclock --systohc04:10
Oksanasudo hwclock -ru 2020-06-01 22:10:11.342550+10:0004:10
* Oksana doesn't know what that means04:11
bgstack15Wow, for me it shows: 2020-05-31 22:08:29.925546-04:0004:11
bgstack15And it is actually Sun, May 31 at 22;11 right now here.04:12
bgstack15So unless you're a full 24-hours ahead of me, and it's 10pm in your timezone right now, your system clock is off. (But by way more than an hour)04:12
bgstack15I think. I'm getting a little lost too.04:12
bgstack15My recommendation is make sure your system time is good, and then just do the hwclock --systohc04:12
Oksanasudo hwclock --systohc doesn't change anything04:15
bgstack15As in, doesn't show anything when you run that one command?04:15
OksanaAs in, after I run sudo hwclock --systohc, sudo hwclock -ru says 2020-06-01 22:14:52.264761+10:0004:15
bgstack15maybe my limited understand of the -l and -u (local versus UTC) flags is confounding the issue. How about hwclock -rl04:18
bgstack15g2g. I hope I helped! Please continue asking here if you still need help; maybe somebody else can rescue us from my lack of knowledge.04:20
gnarfaceOksana: dpkg-reconfigure tzdata04:22
gnarfaceOksana: if the install shares a machine with a windows box, it could be corrupting it in the bios though04:23
gnarfaceOksana: (less likely the timezone but definitely the time itself)04:23
OksanaThere are ruins of an old Windows XP on the same laptop, but not booting into it at all.04:25
Oksanasudo hwclock -rl gives 2020-06-01 12:26:20.967229+10:00. Looks better, but still suspect.04:26
gnarfaceOksana: well after you set the timezone you can use the ntpdate program to do a one-time sync of the system clock to the network time pool, then run that "hwclock --systohc" command again to flush the update into the bios.  then it should be fine04:36
gnarfaceOksana: as long as you're never booting into windows again, it is preferable to tell tzdata to store the bios in UTC, just in case you didn't know04:38
gnarfaceOksana: bios time*04:38
XenguyThere is 'ntpdate-debian' also, for occasional one-offs04:44
mischixGood evening ..05:18
gnarfacemischix: if you have questions, just ask, don't wait for permission.  someone usually answers if you're patient enough05:20
mischixgnarface: ah. I just didn't want to appear .. emm .. pushy :)05:20
mischixI migrated from 10+ years Debian. All works quite well. But I can't install Google Chrome (which I need for development). It misses two pages of libraries :(05:21
gnarfaceyou probably need to enable non-free in your sources.list05:22
gnarfacethat part shouldn't have changed from debian05:22
gnarfacealternately i could recommend chromium mabye05:22
gnarfacemaybe05:22
gnarfacealso note that devuan ascii corresponds to debian stretch, not buster, so maybe you just have version conflicts05:24
gnarfacedevuan beowulf is the one that corresponds to current debian stable05:24
mischixChromium is *ages* behind Google Chrome. And I have non-free activated. But you are right - Google-Chrome usually wants a current Debian version.05:25
gnarfacewhat you need could be in ascii-backports too, i'm not sure05:26
mischixOn the other hand ... I have Chrome on my stretch desktop. Weird ...05:26
mischixIt looks like this:05:29
mischix google-chrome-stable:amd64 : Depends: libappindicator3-1:amd64 but it is not installable05:29
mischixAbout 30 or so libs missing and not installable.05:29
mischixHowever: libappindicator3-1 is already the newest version (0.4.92-4).05:31
mischixCrap. Just found out that I installed 686-pae. That explains a lot. This is awkward ...05:34
* mischix blushes05:34
frabbitis there a way to blacklist all connections from devuan accept the ones on a whitelist?05:49
Oksanahosts.allow ?05:52
Oksanahttps://unix.stackexchange.com/questions/304021/how-can-i-implement-a-whitelist-on-a-specific-port-using-iptables05:57
frabbitOksana: oh i see! =o06:23
frabbitso i can simply enable "ALL:PARANOID" in hosts.deny and then whitelists the ones i want?06:24
frabbitand this works for all network traffic, firefox, apt, wget, mumble etc:?06:24
frabbithm nah.. ALL: ALL in hosts.deny and its only for acces to the machine where that file can be found08:03
frabbitso for blocking acces through website and so on i need to config these iptables then08:03
tomtasticI thought hosts.allow / hosts.deny (known as TCP wrappers?) only worked for inetd services ?10:22
tomtasticI think iptables is a much better approach10:24
frabbittomtastic: im totally new to all this network stuff..10:37
tomtasticyou sound like you're on the right track10:37
frabbitthe hosts.deny file with "ALL: ALL" should now block all access to my computer from other computers correct?10:38
frabbitatm im reading about iptables, apparmor, firejail....10:39
frabbit... bombs on telefonica... -.-10:41
tomtasticI would suggest you use iptables instead. You can have a default 'DROP' rule for all incoming traffic, and then whitelist certain connections10:41
frabbittomtastic: instead of what?10:42
tomtasticinstead of using the /etc/hosts.* files10:42
frabbitbut that entry was pretty easy.. does it not work?10:43
frabbitiptables seems heavy...10:43
frabbitis it wrong what i think that entry is doing now?10:45
tomtasticTCP wrappers only block services compiled with TCP wrapper support.10:51
tomtasticiptables will catch everything10:51
frabbitok10:52
frabbitnow i need to read what TCP wrappers are...10:52
frabbitname reminds me of tcpdump10:53
frabbitthat program has probably something to do with it?10:53
tomtasticThey aren't related other than both working on network traffic. :)10:54
tomtastictcpdump works at the network level, whereas tcpwrappers work at the application level.10:54
frabbitphew.. tahts to much sorry =(10:55
tomtasticBe very careful with iptables if you're accessing this server remotely, it's easy to deny yourself access.10:55
frabbitbut i read atm that DenyHosts is or was vulnerable for "Remote Log Injection"10:55
frabbitso its probably not good to use anyway10:56
frabbittomtastic: this server?10:56
frabbityou mean the freenode server? what do you mean by remotely?10:56
tomtasticwhichever system you're trying to limit incoming traffic to10:56
frabbitim on my laptop10:57
tomtasticLike, the system you're running devuan on10:57
frabbiti want that for my but in first place for the laptop of a child10:57
frabbit*me10:57
frabbiti want to whitelist pages and connects that this child could visit / use10:58
frabbit*connections10:58
frabbitthis is possible with iptables right?10:58
tomtasticAhh, OK, iptables will only get you so far then. You'll be able to limit HTTP traffic to certain websites, but you wont be able to use it to limit access to particular pages on those weebsites.10:59
frabbitoh! =(10:59
frabbitbut how to do that then?11:00
frabbitthere are firefox addons, but they are shitty or u must pay for them... and thats for forefox alone...11:00
frabbit*firefox11:00
tomtasticIf this is for a child, I'd probably be looking at using some kind of portal mode application, where they can't escape from the app.11:02
frabbitif the cild is using a differen tbrwoser or join the wrong channel in mumble..11:02
frabbitnah the kid should have acces to several programs, just as an adult, but be protected from shit form the web11:03
frabbit*access11:03
frabbiti dont want a kiosk mode or something11:03
tomtasticI think what you're trying to achieve on Linux will be complex.11:03
frabbit=(11:03
frabbitthats bad... then it is not respecting children rights...11:04
frabbitisnt there any children distro?11:04
tomtasticRestricting access on the web is very complicated.11:04
* frabbit lokks for that now?11:04
xinomilonot much complicated11:04
frabbittomtastic: but thats a problem... 80% of the web is porn or violence or both...11:05
tomtasticxinomilo really, even when HTTPS is considered?11:05
xinomilolocal dns + local zones, parental controls in ISP/router, fixed confs and then limiting permissions to change..11:05
xinomilodepends on what you want to do11:05
tomtasticdomain blocking will get you 80% of the way there11:05
frabbiti dont understand what all that means...11:06
frabbitdomain blocking as blacklist?11:06
tomtasticBut if you want to block based on other URL components, you'll have to MITM the SSL11:06
tomtasticfrabbit yes11:06
frabbiti want to block everything except urls / ips on a whitelist11:06
tomtasticeg. blacklist : porn.com, etc.11:06
frabbitblacklists are useless11:07
xinomiloanother example, web proxy(squid)11:07
frabbittomtastic: wont work everyday there are new site spreading up...11:07
tomtasticxinomilo ; yes, thats the MITM aspect though isn't it ?11:07
tomtasticfrabbit : A Whitelist might be more appropriate.11:08
frabbitwhitelisting is always the best way, for protection, no matter what.11:08
frabbityes i know11:08
frabbiti mean whats better: 1. giving everyone in the world the keys to ur flat except some specif ones, or 2. giving the keys only to a few people or even no one? ;)11:09
frabbit*specific11:09
tomtasticPersonally, I'd just setup an old ipad with a configuration profile applied.11:09
xinomilotomtastic, if you're running squid locally, it's not.11:09
frabbittomtastic: o_011:09
frabbiterr... im talking about security and u offer me apple? thats a joke, is it?11:10
frabbitapple collects everything and sells everything...11:10
frabbitjust as google, microsoft, amazon...11:10
tomtastichttps://www.linux.com/news/parents-guide-linux-web-filtering-0/11:11
frabbitto me acces to their "services" is a security issue11:11
tomtastichttps://www.maketecheasier.com/configure-linux-for-children/11:11
tomtastichttps://www.instructables.com/id/Set-up-web-content-filtering-in-4-steps-with-Ubunt/11:11
* frabbit visit links11:11
tomtastichttps://mintguide.org/other/227-nanny-a-parental-control-in-linux-mint.html11:11
frabbitthese distros in that one link arent useful imho, they are child-user-friendly but nor secure11:14
frabbittha child is already using the terminal a bit, so it isnt necessary to have big colorful icons or something =)11:15
frabbit*the11:15
tomtasticfrabbit : Afraid I disagree with the comment about Apple collecting everything, they dont rely on advertising revenue unlike Google/Amazon.11:15
frabbitDanguardian is just a blacklist11:16
frabbitas it seems11:16
frabbithttps://en.wikipedia.org/wiki/Dansguardian11:16
frabbittomtastic: oh please...11:16
tomtasticfrabbit : the DansGuardian is more than just blacklist.11:17
frabbitthey do and they are part of PRISM11:17
tomtasticyou can easily add a whitelist too11:17
frabbitApple sucks11:17
tomtasticPRISM isnt a collective of orgs that spy on people, it was the NSA programme to hack into large orgs to sniff their traffic.11:18
frabbitits ot11:18
frabbitbut whats the different between sniff traffic and spy? xD11:19
frabbitand "was" is not correct they still do11:19
tomtasticyes, very OT. Anyway, as xinomilo suggested, a combination of iptables/DansGuardian,squid will probably achieve roughly what you want11:19
frabbitbut no ot here11:19
frabbityeah probably its the only way...11:19
frabbitthere should be a distro for children that runs out of the box that way. only thing to do should be add entrys in the whitelist and done...11:20
frabbithttps://en.wikipedia.org/wiki/Children's_rights - it lacks there massively...11:22
frabbitok thank u for now tomtastic and xinomilo11:22
tomtasticgood luck frabbit, let us know how you get on11:28
frabbittomtastic: thx =) but this will take some time i think... and i need a lot of other stuff to do "nearby" x)11:33
frabbitin debian buster iptables as default was replaced by nftables: https://wiki.debian.org/nftables#Current_status13:56
frabbitso i better should learn nftables as it seems right?13:57
frabbitseems even much easier and better14:02
frabbitso nftables is default in Beowulf too?14:03
gnarfacei'm sure you can still use either one14:03
gnarfaceand for what you're doing it will probably matter very little which you choose14:04
gnarfaceiptables has been around longer, which makes a good case for itself14:05
frabbityeah but nfstables looks quite easier, only one command, several actions in a single rule...: https://wiki.debian.org/nftables#What_are_the_major_differences.3F14:06
frabbitnfstable started in 2008, i think 12 years is enough to proof a program =)14:07
frabbit*nftables14:09
frabbitgnarface: so is it also default in Beowulf?14:09
gnarfacei don't actually know, but that sounds like something that wouldn't be different14:10
frabbitok =)14:10
gnarfacethey wouldn't have changed anything not dependent on systemd14:10
gnarfaceand the kernel packages are all the same on i386 and amd6414:11
gnarfacesame as debian i mean, not same as each other14:11
gnarfaceobviously14:11
frabbityeah14:14
frabbitive never missed since i chnaged to devuan, but i never really used big bloated program that depneds on systemd i think...14:14
frabbit*missed anything14:14
frabbitgnarface: can u give me a suggestion what better to use for permission management of programs? AppArmor or Firejail?14:17
frabbitFirejail seems very beginenr friendly, but is it as powerful as AppArmor?14:17
frabbit*beginner14:17
gnarfacei can not give you a suggestion14:21
frabbitgnarface: oh why? =o14:23
gnarfacenever touched either one14:28
gnarfacecan't tell you14:29
frabbitoh ok what do u use to control permissions of programs then?14:29
gnarfacemy bare hands14:32
frabbitgnarface: how to do that?14:32
frabbiti mean i know chmod but tahts not the same14:33
gnarfaceisn't it?14:33
gnarfacethere's also chgrp14:33
gnarfaceand chown14:33
frabbithmm.. my non root user has acces to all files in /home/USER14:34
frabbitso do the programs that this users starts14:34
gnarfaceit's read-only access, but yea that is the default14:34
gnarfaceit's easy to change though14:34
gnarfaceso easy14:34
gnarfacei have no idea how apparmor or firejail could be related to this task14:34
frabbitwhen i start firefox in a firejail with the default firejail profile, firefox has only acces to Download, .mozilla, .cache and config14:35
gnarfacewell, sure14:35
frabbiti cant do that with chwon or chmod14:35
frabbit*chown14:35
gnarfacesure you can14:35
frabbitwith multiple users u mean?14:35
gnarfaceideally14:36
gnarfaceor groups14:36
gnarfaceor both14:36
djphisn't firejail a mix of different users and also chroots for them?14:36
frabbitthats hard work though...14:36
djphor am I thinking of something else?14:36
frabbitdjph: cant say ive just found it =)14:37
gnarfaceand you'll note that you only have read access to the files in /home/ that aren't yours14:37
gnarfaceunless you fucked something up14:37
frabbitwith firejail firefox havent even read access, only to the dirs i listed above14:37
frabbitfj grants only the bare stuff14:38
frabbitand thats just the default profile that comes with the installation, u can edit it14:39
frabbitgnarface: do u use scripts for that work or do u do it everytime manually u set up an installation?14:40
gnarfacei mean it's like one command14:41
gnarfacechmod 0700 /home14:42
frabbitwith one command u set up different users, groups, attach these groups and users to specific programms and grant them specific permissions depending on all the files on your computer?14:43
frabbithuh? o_014:43
frabbitthats read write execute for the owner14:44
gnarfaceoh, no14:44
gnarfaceno obviously i write scripts if i have to set up a lot of identical computers at once14:44
gnarfaceotherwise there's little point14:44
frabbitok give me an example please how do u manually sandboxing firefox.14:45
frabbitcreating user and group firefox in the first place?14:45
frabbitand then grant that user/group rights for nothing except, three home folders, etc and bin or something?14:46
frabbitand in productive work u switch between this and all the other users (one user per program?) to use the system efficent?14:48
frabbit"Qubes OS" does an interesting job: https://en.wikipedia.org/wiki/Qubes_OS15:08
gnarfaceyou should look into qemu15:12
gnarfaceif you want containers15:12
frabbityeah ive reading atm about chroot, LXC, qemu and qube os15:14
frabbit*im15:14
gnarfacebut otherwise, the answer is basically yes15:14
gnarfaceif you're not going to use containers, then you just make extra users and groups, and manage your filesystem permissions carefully15:14
gnarfaceit's not as hard as it seems15:15
gnarfaceyou'll find the overall amount of learning needed to pull something like this off tends to even out15:15
frabbitbut isnt this virtualizing more secure? i mean why do projects like QubeOS exists, when the same is possible with gnu linux base programs?15:19
gnarfaceof course virtualizing is more secure in theory15:20
frabbitin theory?15:21
gnarfaceeven monkeys fall out of trees15:21
frabbitgnarface: what does that mean? =D15:21
gnarfaceanyone can have a bad day15:21
gnarfacemistakes can be made15:21
frabbitxD15:21
frabbitok ok15:21
specinginstead of one $1500 powerful VM host you can buy 15 $100 used laptops :P15:21
specingand DMZ each of them15:22
gnarfaceyea, that's actually more secure^15:22
frabbitor 30 50€15:22
frabbitwhats DMZ?15:22
gnarfacelike a network quarantine15:23
gnarfacehttps://en.wikipedia.org/wiki/DMZ_(computing)15:23
frabbitlol15:23
frabbiti just wanted to post that link15:23
tomtasticUhh, no announcement for Beowulf reaching stable ?16:57
fsmithredannouncement is in the ether and will land soon16:59
tomtasticwaiting for mirrors to sync up ?17:12
fsmithredwaiting to make sure we're really finished writing it.17:15
dacencoraWhich release is beowulf forked from?21:04
dacencoraIs it buster?21:05
Hurgotronyes.21:07
dacencoraBest way to force X to use a xorg.conf?21:29
dacencoraIf I put one in /etc/X11/ will it be used by default?21:30
fsmithreddacencora, yes. I think there's also xorg.conf.d where you can put files21:33
fsmithredand you can just put the xorg.conf sections you need. Not necessarily everything.21:34
dacencoraOK I will try that. For some reason, Gentoo is the only distro where I can get brightness control working with my NVIDIA card on my laptop. I am now testing it on Devuan21:40

Generated by irclog2html.py 2.17.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!