- Heroes

[heroes] B.O.O. broken
by Felix Miata 03 Oct '18

03 Oct '18

What happens when I try to search: Secure Connection Failed The document contains no data. The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website owners to inform them of this problem. My saved searches work, but all fresh searches fail. -- "Wisdom is supreme; therefore get wisdom. Whatever else you get, get wisdom." Proverbs 4:7 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 1

[heroes] download.o.o down
by Christian Boltz 03 Oct '18

03 Oct '18

Hello, download.o.o is down, answers all requests with a 403 error, and dmesg indicates /srv has filesystem issues :-( See https://progress.opensuse.org/issues/41933 for details. I can imagine you now quickly checked and everything looks good. No, I'm not drunk, and I'm not inventing issues ;-) What you see is a workaround - I changed download.o.o to redirect everything to provo-mirror and started apache (instead of nginx) there. As a workaround, I changed the apache config so that *** everything gets redirected to provo-mirror *** I also stopped nginx and instead started apache on provo-mirror, which means the mirrorbrain setup there is active now Obviously the redirect to provo-mirror comes with some problems. The mirrorbrain database in Provo is outdated (I'd guess last update was the NBG power outage) - it doesn't know about Leap 15, which means provo- mirror will have to handle lots of load and traffic itsself. We'll see how good it will survive under the load. I know this solution is far from perfect, but it's still better than serving a 403 error for all of download.o.o. The original apache config is in /etc/apache2---before-workaround-2018-10-03 I copied it there before adding the redirect + doing some other changes needed to let apache load the updated config - for example, apache doesn't like a /srv/whatever DocumentRoot if /srv/ isn't available. After fixing the /srv partition, you can move the backed up apache config back to production, and everything should work again as if nothing had happened ;-) Regards, Christian Boltz -- These are the requirements for granted correct behavior. If you are not interested in that, I am happy to provide you with a list of data that could be removed from a general Suse installation to let Suse Linux behave similar and to permit booting from time to time only. [Jörg Schiling in https://bugzilla.novell.com/550021#c32] -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 1

[heroes] DETAIL: Could not write to file "pg_subtrans/166A" at offset 131072: No space left on device.
by Per Jessen 01 Oct '18

01 Oct '18

Looks like we've run out of space on mirrordb3 ? -- Per Jessen, Zürich (11.2°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 1

[heroes] Reminder: Heroes meeting tomorrow (2018-09-04)
by Christian Boltz 05 Sep '18

05 Sep '18

Hello, the next Heroes meeting will be tomorrow (2018-09-04) 18:00 UTC / 20:00 CEST in the #opensuse-admin IRC channel. The planned topics are on https://progress.opensuse.org/issues/39290 - if you have other topics to discuss, please add them ;-) Regards, Christian Boltz PS: I can't promise to join the meeting on time because I have to help tearing down a wine festival - and that follows the typical release schedule of open source projects: "it's done when it's done" ;-) -- Wenn das Teil unter Windows CE oder Pocket PC 2000 läuft, ist Synce Dein Fall. Zu finden auf Sourceforge, wenn ich mich nicht irre, und ich irre mich nie wenn ich mich nicht irre. [Michael Karges in suse-linux] -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

3 2

[heroes] where to file bug for en.opensuse.org (mediawiki CSS)???
by Felix Miata 03 Sep '18

03 Sep '18

Load https://en.opensuse.org/SDB:Linuxrc & login. Either narrow the window width or zoom sufficiently, and right side of main content (including edit buttons) disappears: http://fm.no-ip.com/SS/Suse/cssBad201809.gif -- "Wisdom is supreme; therefore get wisdom. Whatever else you get, get wisdom." Proverbs 4:7 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 6

[heroes] api for status.opensuse.org?
by Ludwig Nussel 30 Aug '18

30 Aug '18

Hi, Looking at the upstream cachet documentation there seems to be api support to automate updating the status of services. What needs to be done to get a token there and hook up services? cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

4 6

[heroes] paste.opensuse.org
by Knurpht-openSUSE 28 Aug '18

28 Aug '18

Hi, Could you please have a look at, or contact the right persons to look at paste.opensuse.org ? We're using it to let forums users post output etc, but the page only shows 'Disallowed Key Characters'. -- Gertjan Lettink a.k.a. Knurpht openSUSE Board Member openSUSE Forums Team -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

4 4

[heroes] mirrordb3 ?
by Per Jessen 08 Aug '18

08 Aug '18

I'm getting some weird results when trying to initiate a mirror scan for mirror.umd.edu : # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: /update/leap/*-test Completed in 2 seconds # mb scan mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: /SL-OSS-factory-debug/ Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: update/openSUSE-stable/repodata Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: update/openSUSE-stable/src Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: distribution/openSUSE-stable/iso Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: update/openSUSE-current/nosrc Completed in 2 seconds Those 'serverid's are weird, any chance we have some corrupted data? -- Per Jessen, Zürich (20.8°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 0

[heroes] Proposal: Use Æ-DIR instead of FreeIPA
by Michael Ströder 07 Aug '18

07 Aug '18

HI! Watching the heroes talk videos at OSC I realized that your FreeIPA installation still runs on Fedora. Hmm... TL;DR: This is a proposal to replace FreeIPA with Æ-DIR (augmented by PowerDNS with LDAP back-end). I know that you're quite happy with your FreeIPA setup and thus this proposal likely seems rather disruptive. Be assured that I won't be upset if you just consider this to be a too crazy to even think about it. ldapwhoami: I'm a (open)SUSE user since 20 years or so. Because I like to stay near upstream code I'm running my own stuff with Tumbleweed and update openSUSE packages here and there. I work with OpenLDAP since quite a while. First of all: Æ-DIR is not a hobby project. It's seriously used. I'm committed to fix every bug in there ASAP. Æ-DIR is an integrated solution for all kinds of logins based on pure OpenLDAP. It differs from FreeIPA because its design strictly follows need to know and least privilege principles. Furthermore it allows to have fine-grained delegation of data maintenance. There are some introductive presentations available each with different focus (despite the German web page, some talks are in English): https://www.stroeder.com/publications.html#lectures I won't repeat the web site here, so please glance over it: https://www.ae-dir.com/ I've already talked to Christian about it and he said that you're using the DNS integration of FreeIPA. Well, Æ-DIR itself does not provide such a direct integration, but I'm running a setup based on PowerDNS with LDAP back-end myself. The authentication and authorization is integrated with Æ-DIR as shortly described here: https://www.ae-dir.com/apps.html#slapd-ldap (Note that as of PowerDNS 4.0+ LDAP backend is fully supported again.) Æ-DIR has integrated 2-factor authentication based on OATH-LDAP which allows to enable OATH-based MFA with e.g. password and Yubikey for every simple LDAP enabled application. For NSS and PAM you can use the usual suspects like sssd and nss-pam-ldapd. Note that every integrated system, no exception(!), needs a aeHost or aeService entry with password to get appropriate read access to Æ-DIR. This can be a challenge if you're integrating lots of systems. So this one of the reasons why I've developed a custom component for Æ-DIR, called aehostd: https://www.ae-dir.com/aehostd.html Æ-DIR is installed with the help of an ansible role. I know that you use SaltStack. IMHO this is not an issue because the ansible role stays away from base configuration of the OS. So you can use your normal salt states for base setup and after that play this ansible role. In opposite to FreeIPA Æ-DIR deliberately does not support Kerberos. For SSH logins I strongly prefer temporary OpenSSH certs (not X.509) and for web-based logins there are already too many decent WebSSO systems out there. BTW: I've read your "openSUSE:Infrastructure policy" page. AppArmor is supported out-of-the-box. So here's the deal how to support openSUSE project: 1. You provide installation prequisites. (see https://www.ae-dir.com/install.html#prereq) 2. I will install Æ-DIR providers and consumers with initial data. 3. You play with it. I will help migrating systems to use Æ-DIR. 4. You provide a couple of PowerDNS servers which I will setup with LDAP backend. 5. I will assist developing a SaltStack state for client integration (up to now I only have ansible roles) Well, that's all for now. Let me know if you have further questions. Looking forward to your feedback. Ciao, Michael.

3 3

[heroes] publishing of distros from OBS to pontifex
by Ludwig Nussel 07 Aug '18

07 Aug '18

Hi, As most of you know, a reoccurring annoyance related to publishing the distro is the way we move the isos and repo from OBS to download.o.o (aka pontifex). In contrast to regular build service projects, products like TW and Leap are not pushed directly to pontfex. There's some script running on the obs backend that mangles the results, then pushes to pontifex upload-factory, upload-15.0 etc That script needs to match file names. So any change in product naming, new medias, new releases etc require modifying it. On pontifex files end up below /srv/ftp-stage. Again some script is running there to add the -Current symlinks and create the changes file. To simplify that process I'd like to suggest to drop the script on obs backend side and do all potentially necessary mangling on pontifex. For that we should not push to /srv/ftp-stage directly as mirrors pull from that right away. Any suggestions for a location? I guess /srv/bs is used for something else there already. What kind of information is needed for OBS to drop the script? Just a name for an rsync module on pontifex side? cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 1