User1: How do I go about updating my openssl?
User1: I have version 1.0.1f and I should have version 1.0.1g
User2: User1 sudo apt-get update && sudo apt-get -u upgrade
User1: Hhhm, I ran update.  This is a fresh install.
User2: User1 check that the version that is installed matches the most recent release http://www.ubuntu.com/usn/usn-2385-1/
User1: Yeah, '0 upgraded'
User2: User1 you can check the version with dpkg -l openssl 'libssl*'
User1: Yeah, it says 1.0.1f
User1: Which is a January release
User1: First thing I did when I started this vps was upgrade
User2: oh I'm sorry, I forgot dpkg -l cuts off the version numbers. sigh.
User1: update then upgrade rather
User2: User1 dpkg -l openssl 'libssl*' | cat
User2: the pointless |cat means output isn't a terminal, so it won't truncate the vresion numbers. look for the 1.0.1f-1ubuntu2.7 or whatever...
User3: or just do a apt-get install openssl libssl
User3: and it will force it
User1: Right, it all says 1.0.1f
User2: User1 that's not the part that matters.
User1: oh
User2: User1 the part that matters is _after_ the hyphen
User3: but openssl website says he needs g or h :)
User1: -1ubuntu2.7
User3: your fine
User2: User1 yay :) you've got hte most recent
User1: What Patrick said.  :/
User1: So why does openssl says g
User4: User1 the OpenSSL website may say that you need g or h, but the security patches to fix those vulnerabilities have already been applied to 1.0.1f-1ubuntu2.7
User1: Ah, I see.
User4: User1 openssl upstream will always recommend to use the latest release to get all the bug fixes
User2: User1 because they think everyone downloads openssl source and recompiles it all the time, when in reality, almost no one compiles their own openssl, because that's how you get regressions :)
User4: but the security team takes the upstream patch commits and applies them to the older revisions (like 1.0.1f) and patches the vulnerabilities, in accordance with security triage procedures.
User4: and what sarnold says.
User4: User1 but rest assured, so long as the full version string (1.0.1f-1ubuntu2.7) is installed, you're fine, as it has those patches
User2: I mean, I'm glad for the folks who do run upstream openssl, because someone has to find the regressions :)
User2: .. same as I'm glad someone runs linus's -rc kernels :)
User3: the only upstream that maintains stuff, is bash :)
User2: Chet was amazing during the whole shellshocked thing.
User4: User2 indeed.
User4: User3 heheh
User3: hey, it made life easy for me to backport that crap to debian v4
User4: urgh, debian 4...
User4: makes me glad I use Ubuntu, I don't have to deal with massive version changes from one release to another, as much...
User3: well, not my fault
User3: company I contract for, bought another company
User4: heh
User3: they where working on a new product (fully deployed on 13.10? why? not lts?)
User3: and the old system that was in, self-manage mode, was left from years ago, on debian4
User4: User3 at least you aren't having to take 14.04 patches and taking them back to Hardy, or god forbid Dapper, versions
 * teward had a case where he had to do that :/
User2: User3 zounds...
User3: I took over maintance a month
User3: and hadn't even learned where everything was yet
User3: teward, I had already backported around 30 things to trusty, 2months before it was released
User4: User3 tell me about it, during the Trusty dev cycle I was already backporting entire packages to Precise just for my own needs, let alone nitpicking security patches
User3: no, I mean, to trusty, before release
User3: to precise, ya, still doing that
User3: I have dropped support for lucid though
User3: half my stuff is on trusty
User3: the other half, is likely never to upgrade, but will be replaced
User3: or run in parrallel, till precise dies
User4: User3 funny story: when i took over the nginx PPAs, it was around 12.04 that I took over almost exclusively, and the first thing I did was drop all Lucid support - that was causing headaches upon headaches for me... and I had bad experiences with the interim dev releases so I just started sticking to LTSes
User4: makes life easier on production systems, sticking to the LTSes
User4: (so long as you backport software where necessary to support the applications you have to run)
User3: why must the rhel installer be so annoying compared to ubuntu
User4: +1
User1: Any advice where I should point the 'root' path on my server?  I often hear that /var/www/ is not a good place
User3: and I always thought it was /root
User2: User3 lol
User2: User1 what's wrong with an htdocs of /var/www/?
User3: it depends on a crapload of things
User3: nothing to do with not a good place :)
User1: The great thing about the internet is that anyone can be an admin.
User3: it is as good a place as any other, depending on how you *configure* your server
User1: User2 I honestly dont know.  For django framework I hear one thing,
User1: for rails I hear another.
User1: when talking to apache its another.
User3: that is cause they all have their own defaults
User3: just adjust it, and make sure you maintain proper security
User3: though, with django/rails/...
User3: they will be working as fastcgi likely
User3: so they don't even have to even care
User3: as long as you direct the aliases for their static content, correctly
User3: they could even be on totally seperate servers, as far as apache cares
User2: User1 aha. :) there's a fair amount of cargo-culting in some of those communities. It might not hurt to ask "why?" when something seems arbitrary :)
User3: :)
User1: Right, the 'why' is where I have to remember to put on an asbestos suit
User3: normally the answer is, cause you have to change it so many times!
User2: sometimes yes :) hehe
User2: I'm a grumpy old grouch so I don't much care one way or the other, hehe :)
User1: I'm admining my own vps webserver. So honestly I dont care.  I'm going to experiment with nginx this time around and hopefully experiment with django and rails
User1: and some javascript
User1: I personally dont even care about nginx or apache for that matter, but from what I gather so far if I want to do any kind of web sockety stuff I need nginx
User1: But I thought there were some kind of genuine security concerns the way everyone makes it sound about /var/www/ or wherever.
User2: User1 I found nginx easier to configure than apache; I've never pushed either one far enough to worry about their performance
User2: User1 I really don't like the debian style of having the apache or nginx process owned by user www-data --- the name encourages people to set the owner of their web contents to www-data. But you don't want the web server to have write access to anything, beyond its log files and maybe a database / fcgi socket ...
User2: User1 I wish the web server ran with a username like www-exec or www-prog or something that didn't scream "chown all your files to me"
User4: User2 and, in the case of dynamic PHP apps like forums, the forums' cache folder, is sometimes ok to write to.
User1: Yes, thus far thats what I hear quite often.  Only thing that bothers me is I spent time on figuring out the proper settings I need for apache on one vps and somehow by magic all my settings were rolled back.  So now I'm in the process of transfering to another vps and am starting from scratch, so to speak.  At least this vps runs ubuntu 14 whereas the other one was 10.04.
User2: User4 ahh, yes, I always forget about php. (It's not like I _try_, I just don't think of it often. :)
User2: User1 yikes and yikes :)
User2: User1 that can sometimes happen when they've got some helper frontend like cpanel or whatever. blech.
User1: User2 with regards to www-data.  Isnt it user: apache if compiled from source?
User2: User1 or httpd or something, yeah
User2: User1 this is a failing in debian policy, a failing ubuntu has inherited.
User1: Ah right.
User1: The thing that bothers me mostly about nginx is its thin license.
User1: I get this sense like they can yank the public license at any time
User1: then all those big fancy lovely websites running on nginx would be the only ones who could afford nginx
User3: heh?
User3: why would that matter?
User3: the older releases would still be available
User3: and can be forked
User2: a great many projects have contributor license agreements that allow relicensing to e.g. BSD or MIT -- which amounts to much the same thing
User5: I got docmgr up and working but it will not index word documents
User6: hi, I installed ruby2.0 on my 12.04 server using the brightbox but currently those a keep back from upgrade as there seems a dep issue âruby2.0 : Depends: ruby (>= 1:91.69.162.6)â  is anyone here also using brightbox?
User7: Good morning.
User8: ubuntu saves the data in:  /var/lib/postgresql/9.3/main  what exactly happens when there comes postgres version 9.4?
User8: would then change the data directory too?
User9: morning
User7: Hey pmatulis, how are you doing?
User9: User7 tired, i need some ginseng
User7: Not coffee?
User10: coffee 1st
User11: Is there a way in apt to set an alternate mirror for a repository should the primary one be unavailable for some reason? What I'm trying to do is force clients to use our internal package repo when onsite but still be able to get updates offsite since the internal mirror will not be facing outside the firewall.
User12: User11 Yep, just have another 'deb' line for the repo in sources.list.
User12: User11 apt ignores the things it can't get to.
User11: Is there a way to set a priority on the deb entries or does it just pick the one that's listed in the file first?
User12: User11 It takes what it can.
User11: For example, could I use two different sources.list.d files with 01-internal and then 02-external as the source file names?
User13: !pinning
User14: pinning is an advanced feature that APT can use to prefer particular packages over others. See https://help.ubuntu.com/community/PinningHowto
User11: User13 thanks!
User13: User11 Yer welcome :)
User12: User11 Pinning is something different.
User12: User11 If the repos have the same packages, it doesn't matter.
User13: User12 It's usual usage is to freeze a file at a particular version or to only use one from a particular repository. But it is more flexible than people think.
User11: User12 yeah, was just reading that... it can set priority but doesn't look like you can pin priority based on repo, only per package.
User12: User11 Another thing you can do is a DNS hijack.
User11: Would have to be on the client side using dnsmasq... which sounds ugly and error pron
User12: User11 Have like; gb.archive.u.c go to an internal IP as opposed to the real one.
User12: What's wrong with dnsmasq?
User11: Having to muck with DNS resolution client side just seems like a bad idea to me
User12: Well, It Works.
User11: How would I do that anyway. I would need some sort of conditional based on their interface IP?
User15: does apt-cacher-ng help achieve your goal?
User12: apt-cacher-ng is so unreliable.
User12: squid-deb-proxy++
User11: Was looking at approx, apt-cacher-ng and apt-proxy(?) and none of them seem to do what I need the way I need to do it. They all do some part of it though
User12: User11 You tell dnsmasq: if you see a request for; archive.ubuntu.com, give it this A record -> 91.69.162.6, etc.
User12: Where that A record is your internal mirror.
User11: and when they're not on the internal network, how would it fall back to using the actual archive.ubuntu.com address?
User12: User11 Yes.
User12: User11 You set that on your LAN's DNS server.
User12: User11 Nothing special on the clients.
User11: I don't have control over the LAN DNS unfortunately :(
User11: Well... let me rephrase that
User11: It's a windows DNS server. I'm not sure if it can do that
User13: Hm. Conceivably you could just have a post-up directive  for the ethernet adapter which decides where it's connected, and sets the Dirbd6c:f4c4:4f6:c742:59d8:35db:68f6:4d5ftbd6c:f4c4:4f6:c742:59d8:35db:68f6:4d5fsourcelist "sources.list";  variable to something appropriate
User15: if only upstart had a network-changed event you could toggle between sources.list files using it.
User15: what genii said.
User15: I forgot about post-up
User11: some sort of client side resolution timeout would be all I'd need really. `if archive.ubuntu.com; then go 91.69.162.6; redirect after 30s back to archive.ubuntu.com proper`
User11: but I'll investigate all of these possibilities. They all sound good.
User13: User11 Apologies for not properly understanding your original question, had to go back up and carefully read it first :)
User12: User11 Could you do a transparent proxy on the LAN?
User11: User12 I don't think so, not easily.
User16: afternoon :)
User16: can anyone recommend a way to get a file from server1 to server2 using scp as root without hardcoding the password into the script that runs it?
User12: User16 SSH key.
User11: pubkeyauth?
User12: User16 And whatever you do, use a forced command: http://binblog.info/2008/10/20/openssh-going-flexible-with-forced-commands/
User16: jpds we use ssh keys currently .. if i use ssh key via a bash script, and it prompts for a password does that interrupt the script at all ? .. trying to scp apache configs to server2 after creating them on server 1 but dont want to use a hardcoded password in the script, or paswordless ssh keys, work will fire me for that !
User12: User16 The SSH key has a passphrase?
User16: no, not by default on AWS instances, if i enable it it enables passwords for all users right ?
User12: User16 You're talking about two different things.
User16: oh sorry see what you mean, keyphrase on the key itself
User11: User16 for that purpose I typically use Git, actually
User12: User16 If the key has no passphrase, it shouldn't prompt for one in the script.
User16: currently it doesnt no, i could add that to server 2's ubuntu user, but how do i sudo to get that file in /etc/apache2 within the script ?
User11: you can do the transfer with a non-root user and then use a git-hook to put the file from the local git repo in to the web directory using root locally on the system
User16: oh, thats something i havent heard of before
User16: i guess the other option is to put configs in a dir that doesnt require root access
 * jpds wonders why system1 should be poking with server2's apache config.
User11: Others may have a different opinion on that but that's how I manage all of my websites so that I don't have to deal with sftp or scp when I update site content
User16: jpds cluster of web servers, configs have to be kept in sync
User11: or you could configure ACLs for limited access to the directory by an unprivileged user
User12: User16 Well, use something like Puppet for that.
User11: ^^^
User16: cant have test.com exist on server1, and not server2 as theyre load balanced.
User11: puppet
User12: User16 Puppet, Chef, salt, ansible, are all built for this kind of thing.
User16: thats a bit overkill for something thats only going to happen a few times amonth at the most.
User12: Your life will be a happier place than having root run around with shell scripts.
User16: thats a fair point
User16: ideally i like the config on the nfs mount and they dont have to be copied anywhere but dammed if i can find how to tell apache to look there for them, on thomascastillo@example.org.
User11: symlink?
User12: User16 Yeah, and there's the NFS server dying.
User12: User16 And your HA cluster going along with it.
User16: i really dont want to symlink to nfs for that very reason
User11: Just HA all the things
User12: Automate all the things.
User16: so far everything but this is automated :)
User11: soooo... then we're back to puppet jpds?
User11: :P
User12: Why not.
User16: lol ok! i'll go look at puppet :)
User11: If not puppet then, personally, I'd use the git-hooks but even that's kind of iffy
User12: User16 And with puppet, you can tweak a lot more than just Apache.
User16: thats true, i will go read :) thanks for the advice
User16: while i'm here, any of you ever had a situation where your gss.d and statd logs were filling up with lines of "y" to the point where it uses 30GB in a few hours ?
User11: Is anyone here using foreman? I am working on our package management systems, since we have to re-vamp everything for RHEL7 anyway, and saw that Foreman can manage both Redhat and Ubuntu packages but some material was talking about using Katello as well, is that something that works with Ubuntu or is that soley a RHEL thing?
User11: And how do you like foreman if you are using it?
User12: I've been meaning to try it but haven't had time to do so yet.
User17: hi
User17: anyone know if  pxelinux.0  is added on the FIX?
User12: User17 FIX?
User17: it's a bug
User12: Which bug?
User17: pxelinux.0 is missing on 14.10
User12: User17 Erm, no.
User12: User17 pxelinux.0 is a file you're suppose to create for your PXE server.
User17: ok, thx, Im just trying to get PXE server working on 14.10
User17: will give it a try
User17: thx
User11: User13 Looks like post-up.d script will do what I need. I can have it try to resolve the address for our internal mirror and if successful I can set a line in /etc/hosts to re-point archive.ubuntu.com to our internal server
 * jpds really doesn't like the sound of network stuff poking files in /etc.
User11: * or set up something in dnsmasq
User12: One day you'll wake up and find your /etc/hosts file is empty.
User11: heh... yeaaahhhh
User11: PUPPET!
User11: :P
User16: Warning: Do not use this module on an existing Apache setup. It will purge any Apache configurations that are not managed by Puppet.
User16: thats not very good of puppet..lol
User12: User16 It is.
User12: User16 If it's not managing it, it shouldn't be there.
User16: but i have already set up and installed apache..
User12: It's too avoid config conflicts.
User12: User16 Last thing you want is to have "www.test.com" by hand.
User12: User16 Then add a vhost in Puppet for "www.test.com".
User12: User16 And then Apache dying as there's two configs for that domain.
User16: yup, there's that !
User11: It's fairly straight forward to tell puppet "deploy this config file". Though it is proper to use the Apache modules you can just say "put this file here"
User11: If all you're using it for is to deploy a couple of configs to two different systems, that's going to be the path of least resistence to get it working and then you can worry about migrating to the "proper" way later
User15: User16 chown the config files you want to copy to some non-root sentinel account and scp using that?
User12: User15 ...
User11: XD
User15: User16 are you using an ssh-agent?
User11: OH! You don't need a puppet server to do what you want. You could put the puppet manifest that manages the config file on an NFS share and then there is a flag for puppet-agent you can use on the client to just read from that "local" manifest file
User11: I just remembered that
User16: sorry just got back.. let me read up :)
User16: jrwren good idea, turns out this script ive been writing doesnt want to work properly anyway lol maybe thats a sign ;)
User16: anyone care to take a look and see why im getting some funky errors? http://pastebin.com/HL36G0Tp
User16: ./Test2.sh: 10: ./Test2.sh: function: not found
User16: ./Test2.sh: 13: [: =: unexpected operator
User16: ./Test2.sh: 21: [: =: unexpected operator
User16: well,it works fine without my new $restartapache commands, but theyre just a duplicate of $needdb .. so i dont get why it doesnt work
User15: User16 bash v. dash?
User16: wouldnt that cause it to not work at all in bash though?
User1: How can I find out if openssl was built with tls compression enabled?
User15: User16 no.  anyway, I think you want function createsite() {.. }
User1: Sorry if this sounds like a stupid quesiton
User16: jrwren okies, ill keep fiddling
User16: jrwren works fine i removed #!/bin/bash by mistake
User15: User16 :)
User16: but just realised that script will cause apache to fail
 * NigeyS needs more coffee
User12: User16 http://paste.ubuntu.com/9355999/
User12: User16 That was easy.
User16: jpds legend! lol
User1: Because I dont want RC4 enabled on my server.
User16: but theres a few extra things id have to get puppet to do aswell, like insert the user data to the auth database etc
User12: User16 Though, I've not tested it, and you'll probably need to load a CGI module.
User16: acmehandle try openssl version -a
User1: patdk-wk: it is similar in nature.
User16: jpds i need to chage that script quite a bit as far as the vhost settings go, we dont use cgi anymore for example, and i dont think all those options work with 2.4
User1: patdk-wk I'll admit I'm not an expert but:  https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what
User1: In the System Administrators section
User11: User12 It looks like dnsmasq, using the -y flag, can select an IP from /etc/hosts for a given hostname that is on the same subnet. That might work for what I was trying to do earlier.
User18: hi all. I have a wee problem here, not really related to ubuntu server, but I hoe it's not too offtopic. I login to this host, call it A, and I run xfreerdp from there and to a windows server on a closed-off network
User18: now, xfreerdp and xquartz aren't good friends, so it the keyboard doesn't work. I can't use rdesktop, since the windows servers require crypto not supported by rdesktop. I don't have a linux machine here atm, so wonder if it's possible to do this with some ssh tunnel magick
User18: the host A is heavily firewalled and only answers to 22/tcp. From there on, it's fairly open
User18: patdk-wk: I didn't :P
User18: patdk-wk: not many have access to this box
User18: patdk-wk: it requires both key and password, so it's a bit hard that way
User18: patdk-wk: and company policy is to require password protected keys
User15: User18 ssh -n -N -L 3389:windows-server:3389 A ; remote desktop to localhost
User5: ok soooo after i got this thing up and running and everything seems to be working right, I transfered the vm to the production server and although it seems to be up and working correctly i cant log into the web interface.
User5: ip address is differnt, is there something i need to change ...listening address or such on the alfresco server?
User19: I have never setup an email server. can someone see this tutorial and tell me how I should setup outgoing server on my Mail client? http://www.krizna.com/ubuntu/setup-mail-server-ubuntu-14-04/
User19: I used standard default setting (port 25 with password auth)
User5: ok...dont know why but it just...started working
User20: User19 USe this one: https://help.ubuntu.com/community/Postfix
User5: is it possible to connect this to an existing filer?  Whe have a samba based cifs server that already has a bunch of document on it.
User21: tyhicks, kirkland: have you seen this bug ? https://bugs.launchpad.net/ecryptfs/+bug/1328689
User22: Launchpad bug 1328689 in ecryptfs-utils "ecryptfs-utils does not work with Ubuntu 14.04.1" [Undecided,Confirmed]
User23: User21 I've seen the bug report but haven't had a chance to look into it
User19: User20 my postfix config for smpt is "submission inet n       -       -       -       -       smtpd"
User19: not sure what "chroot" is for but it is not set to "n"
User19: what is starttls in postfix? right at the end of this tutorial, there is an example conf for mail client. I have no option for "STARTTLS" on OSX Mail.
User4: User19 might be 'SSL/TLS' or just 'TLS'
User4: (at least in OSX mail)
User19: User4 I've got 'Use SSL' next to port and 'TLS (External client certificate)' in authentication.
User19: bit confused. that means I have to provide a certificate to OSX Mail?
User19: User4 also, there is an option for TLS certificate.
User19: bloody OSX Mail
User19: I guess SSL check box next to port is sort of TLS.
User19: fault might be with my server setup
User23: kirkland: re: bug #1328689> When running the adduser --encrypt-home command, it proceeds to try to mount the home directory before prompting for the user's password
User22: Launchpad bug 1328689 in ecryptfs-utils "ecryptfs-utils does not work with Ubuntu 14.04.1" [Undecided,Confirmed] https://launchpad.net/bugs/1328689
User23: kirkland: so a valid auth tok obviously isn't in the kernel keyring yet
User19: seems like my sever blocks connection from other IPs. I get this error in syslog "SSL_accept error from unknown[91.69.162.6]:"
User24: hello :)
User9: hello there
User24: guy's I have a problem with Unity desktop
User24: i can't find resolution
User9: User24 try #ubuntu , this is the channel for ubuntu server
User9: see topic â
User24: When I try to drag and drop icon from unity to desktop
User16: anyone know if i put an IncludeOptional into apache2.conf and it points to vhost configs, do i still have to run them through a2ensite?
User24: ok
User24: sory :)
User9: User24 is ok
User25: what's up all. How can I compare many text file's contents in two directories?
User25: diff -r dir1 dir2?
User25: will that compare the file's contents or just if the file exists
User26: anyone know if there's software out there that can basically let me run proccesses with the GPU instead of the onboard CPU?
User13: Probably the closest thing would be anything compiled using CUDA, but you'd also need an NVidia for that
User26: that's ok, so I'm not familiar with CUDA, is that a compiler?
User13: User26 It's a parallel-processing library from NVidia. It uses the cores of their GPUs
User13: User26 If an app is compiled from source with CUDA enabled, it will use the NVidia card to run them on.
User26: Sounds intriguing. I'll look into that. Thanks, genii
User1: Is there a difference if I install something using just apt-get versus something from ppa?
User1: I often see suggestions to install someting using PPA and I am wondering how necessary that might be
User3: it is the same thing
User3: just ppa normally means, not maintained by ubuntu
User13: Some PPA are more trusted than others, like for instance xorg-edgers
User3: I trust my ppa a lot
User27: I have a problem with Bind9.8 and Samba4(latest git) on Ubuntu Server 12.04.5LTS.  I'm trying to get DNS_DLZ working.  The DNS server was starting without the dynamic zones, and doing lookups fine, but integrated it hasn't started;  AppArmor is throwing a permissions error on /usr/local/samba/private/dns/sam.ldb (just wants r.)  I see the line for that file in /etc/apparmor.d/local/usr.sbin.named  (named is the bind user accoun
User28: how do I give a different user access to a single file
User28: I still need to allow the access to the file from the origingal group and user
User3: make a new group
User3: enable and use acl's?
User2: User27 you were cut off at "bind user accoun"
User2: User27 if you have a line /usr/local/samba/private/dns/sam.ldb r,   in your /etc/apparmor.d/local/usr.sbin.named file and your main /etc/apparmor.d/usr.sbin.named file has an #include <local/usr.sbin.named> line, then you just need to reload the profile; apparmor_parser --replace /etc/apparmor.d/usr.sbin.named   should do it
User27: thanks, sorry.
User27: was basically complete.. gonna give that a shot
User27: okay... got a little further.   "could not create /var/run/named/session.key"  I'm guessing its a permissions issue, since I'm no longer running bind as the default.  The samba wiki mentions (for the zone files) to chown named:named and chmod 640.  Does that apply here?
User2: User27 sorry, dunno there; it could be apparmor again.
User2: User27 check again for more DENIED lines in dmesg
User27: No Apparmor DENIED now, just a couple of permission errors, both in that directory.  Is it safe to add the chown and chmod 640 permission to /var/run/named/?
User2: User27 it's probably safe
User2: .. I'm not an expert on either one, but some user account has to own them, and it could either be bind or samba, depending upon how they are modified..
User27: one more thing, I guess:  how do I find the current ownership and permissions stats of a file
User2: User27 ls -l is the easiest
User2: User27 stat /path/to/filename can also show you
User29: Hrmmm, does postfix filter relay recipients only during an actual connection to the relay?
User27: many thanks for your help, btw.. sarnold.. its my second day on ubuntu
User2: User27 welcome aboard :)
 * keithzg_ is seeing a server just deferring mail to addresses that in theory should be filtered out by our relay_recipients
User2: User27 could you file a bug against apparmor (ubuntu-bug apparmor) once you've gotten it sorted? we may want to add the rules you needed to the default profile
User27: will do, thanks
User27: although I do feel a bit of a 'computer user, non-technical' so was thinking its more user error than anything ;)
User2: User27 hehe, not a bad first instinct, but it could be the others who have done this setup before you didn't report bugs either, hehe :)
User27: screw it... chmod 666 -r /
User2: hehe
User27: okay.. I've exhausted the troubleshooting steps I could guess at.  I even added (and reset) the directory to apparmor (** rwk) in case...  "Could not open '/var/run/named/named.pid',"could not create /var/run/named/session.key"  I used stat, and not entirely sure I know what I'm looking for, but its chmod is 664
User27: I changed ownership to named.  I assume the error "named[1913]" means thats the executable context (the daemon named)
User2: User27 correct, the 'named' comes from the process's "comm" field (first 16 bytes) and the 1913 is the pid of the process
User27: chown -r named /var/run/named did it.  one more error, but hey.. probably similar
ubuntu-server
Ubuntu IRC