libera/#devuan/ Wednesday, 2021-03-31

tele1234567891Hi! Link to repository? I'm looking source code of iptables.00:25
tele1234567891If you have time of course00:25
fsmithredtele1234567891, it's not one of our forked packages, so you can download it at pakcages.debian.org00:34
fsmithredbut only if you spell it right00:34
fsmithredpackages.debian.org00:34
fsmithredif you're running debian or devuan, 'apt-get source iptables'00:36
tele1234567891<fsmithred> I need devuan package because Devuan use OpenRC (init)00:36
tele1234567891I want copy file iptables.service and check where is installed00:37
fsmithredif you want to use a devuan version of iptables, you must volunteer to fork it and maintain it00:37
fsmithredand provide a reason for forking it00:37
fsmithredare you running devuan now?00:38
tele1234567891No00:38
fsmithredhang on00:38
fsmithredI probably have that file00:38
tele1234567891I need because I want only copy, thats all00:38
fsmithrednope, I don't00:38
tele1234567891Can you copy link to repository from Synaptic ?00:39
fsmithredapt-file doesn't know about it, either00:39
fsmithredwhat do you mean?00:39
fsmithredtry packages.debian.org/pool/i/iptables or something like that00:39
tele1234567891In Synaptic probably you have link to Devuan repository I will try search00:40
fsmithreddevuan files are at pkgmaster.devuan.org but you will not find iptables there00:40
fsmithredit's not there00:40
fsmithredwe pull it from debian00:41
tele1234567891have Devuan  own ISO to install system ?00:42
fsmithredyes, at files.devuan.org or any of our mirrors00:42
tele1234567891<fsmithred> Thanks I will try download and check. Because iptables should be installed by default so files should be also00:44
fsmithrediptables does not have a file with service in the name00:44
fsmithredwhy not go to the source on debian's git? salsa.debian.org00:46
tele1234567891Because Debian use systemd, I copied from plugins service for init, now I'm looking for openrc00:47
tele1234567891Can I ask what your favourite firewall is ?00:50
fsmithredas I already said, we don't have the package00:50
fsmithredyou can install iptables in devuan, but you won't find the package on our servers.00:50
ErRandirbefore systemd there is no init script that restores the iptables setting. You have to call iptables-restore yourself if you want to do that, or install another package that does it for you.00:51
fsmithredwe use the debian version, just like we do with almost all the other packages00:51
masonErRandir: There hasn't been a real need, given that doing it from ifupdown works nicely.00:51
fsmithredright. No init script, no service file.00:51
fsmithredI think my favorite firwall is my router.00:52
tele1234567891:)00:52
fsmithredI do use arno-iptables-firewall but only because there are some windows computers in the house, and I don't want them talking to my linux boxes.00:53
tele1234567891I tried build script with iptables rules, but construction takes a long time00:55
tele1234567891also I tried build install script, but some linux distro don't have service for system and also for init00:55
tele1234567891So I'm trying add by hand if user will need00:56
fsmithredinstall script to install what?00:57
tele1234567891I think loading ready-made rules is a good idea for user.00:57
tele1234567891But creating rules for a user is still a horror00:57
tele1234567891install script to install my script with ready iptables rules00:58
fsmithredare you sure your user needs a firewall?00:58
tele1234567891I need firewall, I probably made a mistake. It is not a mistake to write a script. The mistake is that it takes time and I have more important things.00:59
tele1234567891But I want to finish it.00:59
tele1234567891I think the user should have a generator to create rules. It is easier to use a generator and test the rules01:01
tele1234567891than read all docs01:01
fsmithredmight be better to use a program that applies rules written by people who know iptables very well.01:06
fsmithredand actually I do have a favorite firewall, but I haven't used it in over a decade: susefirewall01:07
masonufw is packaged - lots of folks like that01:07
fsmithredyup01:07
fsmithredshorewall is another01:08
adhoctele1234567891: each machine is subtley different, which makes automating scripting hard.01:08
fsmithredthere's also one called mason01:08
* mason blushes01:08
adhocwhich interfaces are you using and what services are they running?01:09
adhocmason the might blushing firewall ?01:09
tele1234567891I download now beowulf and I testing on Virtualbox . I see that Devuan still use /etc/init.d01:12
fsmithredtele1234567891, have you used debian in the past?01:13
fsmithredbefore jessie01:13
tele1234567891So probably if I copy from Debian iptables of source code and I unpack and I copy from plugins folder there service for iptables01:14
tele1234567891then it should work01:14
fsmithredthere is no service file01:14
fsmithredwhat are you trying to do with it?01:14
fsmithredit doesn't need an init script01:15
fsmithredtele1234567891, are you installing beowulf?01:17
tele1234567891<fsmithred> How you want load iptables rules for all linux distributions which use openrc ?01:19
XenguyBoth have already been mentioned, but my off-the-cuff advice would be: UFW if you want something simple, and Shorewall if you want something perhaps more powerful01:23
tele1234567891<fsmithred> I can't find now in which package was plugin / s folder. If I find I give you link, because I have this file01:23
tele1234567891I will try why I don't use ufw01:24
tele1234567891Because is too complicated for me01:24
tele1234567891iptables is more advanded01:25
XenguyBut it's called 'Uncomplicated Fire Wall' ; -)01:25
adhoctele1234567891: what are you actually trying to achieve?01:25
tele1234567891adhoc probably I have all now. I will test only on Devuan how howrking init script from Debian01:28
tele1234567891I copied from Debian because is more simple than from Fedora01:28
tele1234567891======01:28
tele1234567891#!/bin/sh01:28
tele1234567891# This file is part of netfilter-persistent01:28
tele1234567891# (was iptables-persistent)01:28
tele1234567891# Copyright (C) 2009, Simon Richter <sjr@debian.org>01:28
tele1234567891# Copyright (C) 2010, 2014 Jonathan Wiltshire <jmw@debian.org>01:28
tele1234567891========01:28
tele1234567891netfilter-persistent --> probably this is reason why I can not find :)01:28
golinuxYou may get kicked for copying multiple line.01:28
golinuxs01:29
adhoctele1234567891: please use pastebin for demonstraing files01:29
golinuxThis ^^^01:29
adhoctele1234567891: push the file there and send us the link01:29
adhoctele1234567891: this tells me you are doing something with a script, but not tell us why or the problem you are trying to solve... ?01:30
tele1234567891<adhoc> Because I tried before. I don't know openrc, so I tried find package in Devuan01:31
Xenguybbiab01:31
tele1234567891and copy what I need ( service of iptables )01:31
adhocso, step back a moment, why are you building the firewall ?01:35
tele1234567891I'm trying build server, iptables rules are uncomfortable01:36
adhocis this a public internet facing server?01:37
tele1234567891I seen my friend script and I tried build something similar01:37
tele1234567891is not public01:38
adhocso you know what services you will be offering on your server?01:39
tele1234567891But I need log all, easy to search  and something else, with script should be easer01:39
adhocie, which ports?01:40
adhocwhat do you need to log all of ?01:40
tele1234567891rsync port , but don't worry, i know how to do it  ;-)01:41
tele1234567891I hope I know :)01:41
djphso .... port2201:41
tele1234567891:D01:41
adhocdjph: rsync has its own server and port =)01:42
djphi know01:42
adhocjust most of us don't use it that way ;)01:42
djphI hate it, and use ssh transport01:42
adhocright.01:42
adhoctele1234567891: ok, you want to use rsync (and we assume ssh), what else is on the network that you are running this non-public server on?01:43
tele1234567891It is more difficult. I will share rsync. Maybe share computer in futere, I will need default rules to add01:43
tele1234567891For example01:43
tele1234567891https://github.com/tele1/Tmur/blob/main/rules/rules_accept_ipv4.sh01:43
djph"default" rules for an edge router should be "drop all the things"01:43
tele1234567891I don't trust the router. The configured system is the basis.01:44
tele1234567891However I can trust internet. Live is brutal :D01:45
tele1234567891* I can not trust01:45
adhocheh, looking at you script, you log all the things, your disk will fill up in no time.01:47
tele1234567891:)01:47
tele1234567891I used -m limit --limit 1/hour --limit-burst 101:48
adhocthere is a lot more in that script than being an rsync server01:48
tele1234567891this should help little.01:48
adhocif you are not on public facing internet, you should not be getting brute force attempts?01:49
tele1234567891Yes, I want put all, maybe me for the desktop, maybe it will be useful to someone01:49
tele1234567891Not if I accept only from IP01:50
tele1234567891rsync servers use static IP01:51
tele1234567891I can not, so I and my friends needs use DNS01:51
tele1234567891 * DDNS01:51
adhocso you are accepting rsync traffic from the internet?01:51
adhocotheres connect via DDNS address ?01:52
tele1234567891not, only I will ssh from my friends01:52
tele1234567891yes, I use DDNS so rsync server know where I'm and can copy files from my computer01:53
tele1234567891theoretically, it can only read files01:53
tele1234567891So I will also need to configure the output for Internet mail01:54
tele1234567891a lot of work :)01:54
adhocit appears you have done a lot of work in your existing file; rules_accept_ipv4.sh01:56
tele1234567891the computer can always be hacked and the changes can be hidden, but not alerted if it is sent01:56
adhocit shows the allows, but I did not see the block part01:56
tele1234567891https://github.com/tele1/Tmur/tree/main/rules01:57
tele1234567891some rules not working, so if you want copy, you need check01:59
adhocdo you have more than one ethernet interface?01:59
tele1234567891I'm trying check but I am not able to do everything at the same time.02:00
tele1234567891lo, but it will be nice to test the script on a laptop and try to write a generator and add interface options there02:01
tele1234567891Because laptop use also wi-fi02:01
adhocwow, there is a lot of complexity in Tmur02:05
tele1234567891Have Devuan iso default root password?02:11
gnarfaceit used to be toor02:12
adhocgnarface: you set it installation?02:12
adhocor is thar for a live CD ?02:12
tele1234567891live CD on virtualbox02:13
tele1234567891I installed iptables-persistant and I checking02:13
tele1234567891working. Thanks02:14
gnarfaceadhoc: live cd02:14
adhocah ok02:16
gnarfaceadhoc: maybe some of the pre-installed arm images too02:21
adhocah, good point02:22
adhocis there an image for rock64 ?02:22
gnarfacenot last i checked, but it would be possible to make one02:25
gnarfaceoh, no i'm wrong, there is one up there now02:25
gnarfacenot sure if it's current02:25
gnarfacehttp://arm-files.devuan.org/02:26
gnarfacemight work though02:26
adhocnot sure how close the rock64 and rockpro64 are...02:28
adhochttp://arm-files.devuan.org/README.txt says both are supported =)02:29
tele1234567891<fsmithred> It looks that service /etc/init.d/netfilter-persistent use at the same time services from /usr/share/netfilter-persistent/plugins.d/15-ip4tables and 25-ip6tables services02:53
tele1234567891So you don;t need use by hand iptables-restore02:53
tele1234567891Thanks02:58
rrq907:31
ShorTie807:42
MinceR716:09
crashoverridethat MUST be a cat.16:17
masoncat17:23
crashoverridezcat.17:28
masonzcat is stepping on zkeyboard17:28
crashoverride:D17:29
systemdleteI am running lxde on my 2in1.  The sound works from command line, but not in firefox.  I tried running firefox with apulse (I do not have avahi, and do not want to run avahi).   Strangely, sound works in chromium, without apulse.  (I do not believe this is due to my cat, since I do not have a cat.  Just wanted to be clear)17:31
systemdlete(and, no.  I do NOT want a cat, thank you.)17:31
crashoverridesystemdlete: apt-get purge pulseaudio17:32
crashoverridedone, fixed.17:32
systemdletereally?  OK, I'll try that.  thanks17:32
crashoverridealso if you need help with your /etc/asound.conf, hmu.17:32
crashoverrideI ALAWYS use alsa directly, pulseaudio is terribad.17:33
systemdleteI think my asound config is ok, because chromium works without apulse or pulseaudio.17:33
masonsystemdlete: I don't think I've set anything special to get working audio with ALSA in Firefox. I do have an .asoundrc file so I can output through my system audio and input via webcam17:33
masonsystemdlete: FWIW, this is how I do that: https://bpa.st/CZQQ17:34
systemdletepulseaudio is not installed, so purge did nothing.17:36
systemdletemason:  thanks.17:36
systemdleteany other ideas?17:36
masonsystemdlete: Beowulf? firefox-esr 78.9.0esr-1~deb10u1 ?17:37
masonsystemdlete: If so, that's what I've got and it works, so I'd consider setting up an .asoundrc and fiddling about.17:37
systemdleteascii.  firefox 78.8 (but I am upgrading it now)17:38
crashoverridemason: I am used to setting /etc/asound.conf because my systems use intel sound that sets the PCM as HW 0:1 while HDMI is HW 0:0 and I never use the HDMI sound.17:38
crashoverridesystemdlete: I believe you might have a "wrong default hardware" setting.17:39
masonsystemdlete: Ah, so very specifically, I couldn't use ASCII for anything media-related because I could never get audio to behave. This is why I started into Beowulf. Everything worked there.17:39
crashoverridejust as I was talking about with mason.17:39
systemdletekernel 4.19.017:39
crashoverridesystemdlete: when you open `alsamixer` in the shell, does it directly give you sliders to control the volume, or do you have a bunch of boxes to mute the sound, but no sliders?17:40
systemdleteif the hardware setting is wrong, then why does it work in chromium without touching it?17:40
crashoverridebecause the browsers typically probe for the hardware to use at start.17:40
systemdleteI see.17:40
systemdleteCould this be due to a missing cat?17:41
crashoverrideWhen you start alsamixer, what do you have for 'Card' and 'Chip' on the top left?17:41
crashoverridesystemdlete: no, but a missing dog, yes.17:41
systemdleteOK.  I will go to the rescue now.  See you all later.17:41
systemdlete(j/k)17:41
systemdletecard chtrt5645, chip (null)17:43
systemdleteblank17:43
systemdletethat's in F3/Playback mode17:43
systemdletebut same with F5/All17:43
systemdleteI think upgrading to beowulf might be better.  Trying to do anything on this laptop is a pain.  I bought it mainly for use as a tablet; I got this 2-in-1 so that I'd have a keyboard to do config, but honestly, the less I have to type or configure the better.  (I've never cared for laptops)17:45
systemdleteI enjoy reading long articles and pdf files using it in tablet mode because I can sit in the easy chair rather than at the desk.17:46
crashoverridesystemdlete: Chip (null) is bad :D17:47
crashoverridealso what on earth is a chtrt5745?!17:47
crashoverrideis that from realtek or what?17:47
systemdleteThis is an Intel cherry trail17:48
systemdleteso whatever that is17:48
systemdlete*has17:49
crashoverridecherry trail kinda sounds like a bad take at covering up an assassination attempt.17:49
systemdleteHey!17:50
crashoverride:D17:50
systemdleteI was NOT in the book repository, ok?17:50
crashoverrideWell, that's not where the trail started, you know...17:50
systemdletemaybe17:50
crashoverridealso normal humans call those "libraries".17:50
crashoverrideso you're spotted, Agent Smith.17:50
systemdleteUh17:50
systemdleteschool book repository, not a library, I think17:50
systemdleteI thought17:51
crashoverrideah17:51
crashoverridemy bad then17:51
crashoverrideanyway, back to your issue17:51
systemdletebut you are right, in a way17:51
systemdleteIt was Sgt Pepper, in the library, with a cat gun.17:51
crashoverridewhen you start alsamixer, and you get "Card: chtrt5645" and "Chip: (null)", can you press F6?17:51
systemdleteatually, it is "Chip:"17:52
systemdletethe field is empty17:52
crashoverrideah17:52
crashoverridenot better :D17:52
systemdletesorry17:52
crashoverridebut at least it's not the C code of alasamixer trying to printf a "string" that points to `null`...17:52
crashoverrideso, better.17:53
systemdleteYes, it gives me a choice of the chtrt5645 or the HDMI/DP LPE Audio or enter device name17:53
crashoverrideanyway, F6?17:53
crashoverrideyeah the enter-device-name is always there.17:53
systemdleteas is, default17:53
systemdleteso just 2 devices17:53
crashoverrideyeah default is always the default one.17:53
crashoverridenormal.17:53
crashoverrideyou're using the right device then.17:53
systemdleteI am not using the HDMI port17:54
crashoverrideweird that your Chip has no name tho.17:54
systemdleteI mean, I don't have a HDMI device connected to it17:54
crashoverrideyeah no, I would not have you do that either way17:54
crashoverrideI was hoping there would be another option.17:54
crashoverridehmm17:54
crashoverrideI wonder if the `chtrt5645` device requires some additional stuff17:55
crashoverrideI mean you get the sound from chrome, soo....17:55
systemdletecrashoverride:  Don't worry your pretty head over this too much, though.  I really think upgrading to beowulf might yield better results.17:55
systemdleteIt is simple enough, and this way, we would be working from the same starting place.  It is difficult to assist someone running an old OS17:56
crashoverridecould you pastebin your `aplay -L` output somewhere?17:56
systemdletewell17:56
systemdletemore difficult anyway17:56
systemdletesure hold on17:56
crashoverrideI mean, it's fun to search what's wrong :D17:56
systemdletehttp://paste.debian.net/1191817/17:57
crashoverrideLooks like chtrt5645 is from realtek tho17:57
crashoverrideI was right it seems :D17:57
systemdleteIt is a SoC17:57
crashoverrideRealTek soc17:57
systemdleteyep17:57
systemdleteall integrated.17:57
crashoverridedamn17:58
systemdletedamn?17:58
systemdletewhat is the magic to perform an OS upgrade?  I forget17:58
systemdleteThis way, I don't have to do a complete reconfig, hopefully.17:59
crashoverridedo you have sound with headphones tho?17:59
systemdletehmmm.17:59
systemdleteYes, I believe I have been able to use my headset with the 2-in-117:59
systemdletea usb though18:00
crashoverridea TRS one?18:00
systemdletewell, it's made by Logitech18:00
systemdletesoft padded ear phones that help block out outside noise.  really nice.18:00
systemdletevery helpful for my hearing impairment (APD)18:01
crashoverrideI got the Sennheiser GSP 60018:02
systemdletecomes with a mike too18:02
crashoverridekinda nice, but the foam always breaks after 3 years or so18:02
crashoverrideso I gotta buy a bunch of pads18:02
systemdleteI think that happens with all of these... I've had others and the foam always breaks.18:02
crashoverrideI'll divide my life expectancy by 3 and buy enough for a lifetime, should cut down on delivery costs.18:02
systemdleteAfter bitcoin, foam earphone replacements is a good bet to invest18:03
crashoverridebitcoin is not a good investing tip in 202118:03
crashoverrideit was in 2013 tho :D18:03
systemdleteIf outdated versions of Windows were transferrable, there would be opportunities there also...  :D18:04
systemdleteThat is, if anyone really wanted them.18:04
systemdleteBut I do know some old 2000 afficionados...18:04
systemdletewell, I am OT now.  So, how about I simplify things for you friendly support folks?18:05
systemdleteBy upgrading to beowulf.18:05
crashoverrideyep18:06
systemdletemagic, please?18:06
crashoverridethat would be a good start18:06
crashoverridemagic?18:07
systemdleteI think it can be done from apt, right?18:07
crashoverridejohnson?18:07
systemdleteI mean, the options to pass to apt18:07
systemdleteI guess I could look it up...18:07
crashoverridethe way I do it is: 1. apt-get update && apt-get upgrade && apt-get dist-upgrade && apt-get autoclean && apt-get autoremove; 2. vi /etc/apt/sources.list; 3. do 1 again.18:07
crashoverrideI'm not sure if this is the recommended way tho18:08
masoncrashoverride: That's reasonable. I'd also recommend deleting big, potentially problematic packages in advance, and freshly reinstalling them afterwards.18:08
crashoverrideyeah that's a good idea.18:09
crashoverridelike systemd.18:09
* crashoverride hides18:09
masonDesktop software is a good candidate. Strip the system back a bit towards being minimal, upgrade, re-add things.18:09
crashoverride(To be honest, I would only recommended removing it, not reinstalling it, ever)18:09
masonWell, systemd shouldn't be there in the first place on ASCII. We didn't start importing bits of it back until Beowulf.18:10
crashoverridemason: you mean I can't have libreoffice? :D18:10
crashoverridemason: right.18:10
crashoverridewhat bits btw?18:10
masonI don't know if that one is problematic. Desktop stuff can be fairly problematic. Databases can take special handling.18:10
masoncrashoverride: elogind primarily, although if you look through support scripts, there's a TON of stuff looking for systemd components.18:11
systemdletePlease guys, I haven't eaten yet.  This is making me nauseous.18:11
systemdlete:p18:12
crashoverrideyeah well, getting rid of systemd in debian is a thankless job I bet.18:12
crashoverrideand a hard one too, at that.18:12
crashoverridekinda like trash collector.18:12
systemdleteIt's like trying to clean up an oil spill.18:12
systemdleteand a giant one at that18:13
systemdletethink: Exxon Valdez18:13
systemdleteor the Gulf spill18:13
masonBut remember that we have #devuan-offtopic for value judgements about this stuff.18:13
systemdletetrue that!18:13
systemdleteOk, found the debian upgrade release page.  So I'll work on that for a bit.18:14
systemdleteThanks to everyone who assisted today.  Always appreciate the friendly help.18:14
crashoverrideno wuckers18:14
user282069hi i have an SDL2 game that i think is using software renderer. when i try to set the enviornmental variable i see /usr/lib/x86_64-linux-gnu/libGL.so.1: Permission denied21:54
user282069running game as normal user21:54
user282069doesnt seem right to mess with permissions in /usr/lib/x86_64-linux-gnu/21:55
user282069not sure what do ~~21:55
tuxd3vwhat this command says? 'ls -ld /usr/{,lib/{,x86_64-linux-gnu}}'21:59
rmuser282069, how are you setting the variable, post the full command22:00
tuxd3vuser282069, ^^22:00
user282069thank you both. tuxd3v i've got 3 directories there /usr/ /usr/lib/ /usr/lib/x86-22:01
user282069and the fullcommand is like $  env=SDL_VIDEO_GL_DRIVER /usr/lib/x86_64-linux-gnu/libGL.so.1.7.0; ./taref22:02
tuxd3vyes and what are the permissions, paste in https://paste.debian.net/ the result of that command :)22:02
user282069sorry ye22:02
tuxd3vuser282069, no problem :)22:02
rmtry like this instead:22:02
rmSDL_VIDEO_GL_DRIVER=/usr/lib/x86_64-linux-gnu/libGL.so.1.7.0 ./taref22:02
user282069https://paste.debian.net/1191862/22:03
user282069ahhhh22:03
rmworks?22:03
rmor:                             export SDL_VIDEO_GL_DRIVER=/usr/lib/x86_64-linux-gnu/libGL.so.1.7.0; ./taref22:04
user282069that's right thank you it works22:04
user282069syntax >_<22:04
rmno problem22:04
tuxd3vuser282069, what are the permissions of /usr/lib/x86_64-linux-gnu/libGL.so.1 ?22:06
user282069it still seems to be drawing in software ;; judging by the cpu %22:07
user282069sorry tuxd3v ;; thank you again. must sleep.22:07
tuxd3vno problem, go ahead :)22:08
rmtry the "export" variant later22:09
rmor maybe something else is required, or this is not the correct variable/library to use22:11
gnarfacecould be the wrong libGL23:47
gnarfacethat file conflicts between mesa and nvidia23:48
gnarface(but nvidia will usually happily load the mesa one it at a severe performance detriment)23:48

Generated by irclog2html.py 2.17.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!