Re: grub2-efi / grub2-tools problem

2017-11-22 Thread Marc Blanc
Le Wed, 22 Nov 2017 16:53:03 +0100,
Frank Elsner  a écrit :


>dnf system-upgrade download --allowerase --refresh --releasever=27
>gives 
>dnf system-upgrade: error: unrecognized arguments: --allowerase

It is : --allowerasing

-- 
M.B
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: SSH_AUTH_SOCK behavior is completely insane

2017-11-22 Thread Eric Griffith
This is not just Fedora specific behavior. I ran into this a few days ago on a 
Mac after adding a bunch of keys to my agent (one per AWS region). Even if you 
specify a key with “-i” it will still go for the agent, resulting in an Auth 
failure. Not sure if specifying a key in the config will over ride it though, I 
didn’t try that. 

The fact that SSH prioritizes the agent over a manually specified key 
definitely smells like an upstream bug though. That’s not just counter 
intuitive that’s a blatant disregard of an explicit command specified by the 
user. 

Cheers!
Eric

> On Nov 22, 2017, at 19:33, Todd Zullinger  wrote:
> 
> Tom Horsley wrote:
>>> On Thu, 23 Nov 2017 00:06:11 +0100 cen wrote:
>>> 
>>> Anyone doing linux admin or dev work has more than 5 keys in their .ssh 
>>> directory, rendering the agent completely USELESS PIECE OF SHIT PROGRAM.
>> 
>> Why? I do lots of linux admin work and I only have two keys. 
> 
> I use a different key for each organization I'm working for/with.  I have a 
> personal key, one for Fedora packaging, one for github, another for 
> bitbucket, and several for different companies where I perform admin work.
> 
> You can certainly use one or two keys for all of that, but I don't think it's 
> the best practice to do so.  Not everyone feels the same, but it's far from 
> unusual to have quite a few keys.
> 
> -- 
> Todd
> ~~
> If people are good only because they fear punishment, and hope for
> reward, then we are a sorry lot indeed.
>   -- Albert Einstein
> 
> ___
> users mailing list -- users@lists.fedoraproject.org
> To unsubscribe send an email to users-le...@lists.fedoraproject.org
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: SSH_AUTH_SOCK behavior is completely insane

2017-11-22 Thread Christopher
On Wed, Nov 22, 2017 at 6:07 PM cen  wrote:

> Whose good idea in the history of Linux was to turn ssh agent on by
> default when one has more than 5 private keys available? This is what I
> just got:
>
> ssh -i mykey.pem user@myhost
> Received disconnect from ... port 22:2: Too many authentication failures
> Authentication failed.
>
>
> Then I do export SSH_AUTH_SOCK="" and surprise! I am logged in. And I am
> not even sure why this suddenly stopped working, I swear to God
> specifying the key used to override the agent.
>
> So apparently the agent even overrides my -i flag which explicitly
> specifies which key to use. Instead of taking my key as I specify, ssh
> agent will go and try every single key file in my .ssh directory and
> fail after 5 times because any sane remote ssh server will block you
> after failing so many times.
>
>
It does seem like command-line options should be used first.


> Anyone doing linux admin or dev work has more than 5 keys in their .ssh
> directory, rendering the agent completely USELESS PIECE OF SHIT PROGRAM.
>
>
I think you're being unnecessarily unfriendly. There's no need for that.

As for the number of keys, I don't know why anybody would need more than
one "identity key" to identify a single individual on a single machine. I
do tons of work with SSH, and I've never had more than 2, and the second
was only a temporary one I created for a specific test and deleted 5
minutes later. Not that this matters... if you have need for more keys,
that's up to you.


>
> Does everyone disable agent first thing after installing Fedora? How
> else do you even manage to survive with this crap running?
>
>
Do you mean Fedora? I suspect you mean GNOME. Specifically,
gnome-keyring-daemon, which runs by default in GNOME, but I'm sure it can
be disabled (never bothered to check; personally, I find it very useful,
and if I didn't... I wouldn't store identity keys in it).


> Why would agent even try with other keys if I SPECIFY the goddamn key!
> It doesn't make any sense!
>
>
Why are you putting identities in the agent at all if you're not using it?
Or, why not just just set IdentityAgent to "none" in your ~/.ssh/config
file if you don't want to use it? Or, use '-o IdentityAgent=none' on the
command-line? Or do what you already did, and override SSH_AUTH_SOCK in
your env.


> How do I turn it off in all shells for all users forever? How do I nuke
> this from system? .bash_profile export does not seem to cut it.
>
>
Set IdentityAgent to "none" in /etc/ssh/ssh_config
(Try 'man ssh_config' for more details)

It won't work in .bash_profile for terminals inside GNOME because GNOME
sets it after you log in and your session has already started.


> Not to mention the same shit happens when you open gnome files and try
> to connect to remote location, except you can't even specify the key in
> the UI. It will just try a bunch of keys until you are blocked by remote.
>
> And there are numerous other programs who do this, like Filezilla.
>
> I just don't get it apparently..
>
>
I don't see why you're getting so upset. It's not hard to avoid using the
agent if you don't want to use it. The easiest thing is to not put
identities in it in the first place if you don't want them to be used. The
next easiest is to change the ssh config to skip the agent. Neither are
hard.

But, I do agree with you on the unintuitive nature of not trying the
identity from the command-line first. I'm sure a *friendly* request or
patch (emphasis on friendly... vs. how you started this thread) to do that
to the openssh upstream would be happy to consider it as an improvement to
the user experience. Same with GNOME Files and the upstream GNOME devs.
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: pulseaudio MUST DIE!

2017-11-22 Thread Tim
Allegedly, on or about 22 November 2017, David A. De Graaf sent:
> I've fought with this miserable pulseaudio creation for several
> years, trying to get sound to work *properly*, but this is the
> last straw.

I can't say I've had any real problems with it.  I used to have lots of
problems with what was used before pulseaudio, whenever two things
wanted to make a sound at the same time, the first one prevented the
other, then they might jam each other up when the first thing had
finished playing.

I'll ask the obvious question:  Do you do fresh installs, or update
Fedora over the top of prior installations?

-- 
[tim@localhost ~]$ uname -rsvp
Linux 4.13.13-200.fc26.x86_64 #1 SMP Wed Nov 15 15:46:36 UTC 2017 x86_64

Boilerplate:  All mail to my mailbox is automatically deleted.
There is no point trying to privately email me, I only get to see
the messages posted to the mailing list.

Windows (TM) [Typhoid Mary].  They refuse to believe that there's anything
wrong with it, but everyone else knows Windows is a disease that spreads.
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: SSH_AUTH_SOCK behavior is completely insane

2017-11-22 Thread Todd Zullinger

Tom Horsley wrote:
On Thu, 23 Nov 2017 00:06:11 +0100 
cen wrote:


Anyone doing linux admin or dev work has more than 5 keys in their .ssh 
directory, rendering the agent completely USELESS PIECE OF SHIT PROGRAM.


Why? I do lots of linux admin work and I only have two keys. 


I use a different key for each organization I'm working for/with.  I 
have a personal key, one for Fedora packaging, one for github, another 
for bitbucket, and several for different companies where I perform 
admin work.


You can certainly use one or two keys for all of that, but I don't 
think it's the best practice to do so.  Not everyone feels the same, 
but it's far from unusual to have quite a few keys.


--
Todd
~~
If people are good only because they fear punishment, and hope for
reward, then we are a sorry lot indeed.
   -- Albert Einstein



signature.asc
Description: PGP signature
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: SSH_AUTH_SOCK behavior is completely insane

2017-11-22 Thread Todd Zullinger

cen wrote:
Anyone doing linux admin or dev work has more than 5 keys in their 
.ssh directory, rendering the agent completely USELESS PIECE OF SHIT 
PROGRAM.


Not at all.  It just requires some config to handle that well. :)

Does everyone disable agent first thing after installing Fedora? How 
else do you even manage to survive with this crap running?


The agent is great.  It certainly can be annoying with many keys, some 
of which is made worse by the agent being provided not by ssh but by 
gnome-keyring-daemon, I think.


Why would agent even try with other keys if I SPECIFY the goddamn key! 
It doesn't make any sense!


There is a way to avoid this though, using the IdentitiesOnly option 
in the ssh config:


Host *.example.com
   IdentityFile ~/.ssh/id_rsa_example_com

Host *.example.net
   IdentityFile ~/.ssh/id_rsa_example_net

Host *
   IdentitiesOnly yes
   IdentityFile ~/.ssh/id_rsa

Maybe that will be helpful as an alternative to disabling the agent 
entirely.


--
Todd
~~
Moral indignation is jealousy with a halo.
   -- H. G. Wells



signature.asc
Description: PGP signature
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: pulseaudio MUST DIE!

2017-11-22 Thread Doug


On 11/22/2017 05:36 PM, David A. De Graaf wrote:

pulseaudio became unusable on F26 with the upgrade to vers 11.1.2 a few
weeks ago.  It rapidly filled the log files with trash - and produced
no sound.
By using   dnf downgrade "*pulseaudio*"I was able to restore sanity.

Yesterday I freshly installed Fedora 27 Live Xfce on an Acer laptop.
Today, /var/log/messages had grown to
-rw-r--r--. 1 root root 14787172 Nov 22 15:47 messages
These 15 MB contain recurring lines like this:

Nov 22 11:22:18 datacer rtkit-daemon[4896]: Successfully made thread 
16113 of pr
ocess 16113 (/usr/bin/pulseaudio) owned by 'dad' high priority at nice 
level -11

.
Nov 22 11:22:19 datacer rtkit-daemon[4896]: Successfully made thread 
16116 of process 16113 (/usr/bin/pulseaudio) owned by 'dad' RT at 
priority 5.
Nov 22 11:22:19 datacer rtkit-daemon[4896]: Successfully made thread 
16121 of process 16113 (/usr/bin/pulseaudio) owned by 'dad' RT at 
priority 5.
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] 
socket-server.c: bind(): Address already in use
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] module.c: 
Failed to load module "module-esound-protocol-unix" (argument: ""): 
initialization failed.
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] main.c: Module 
load failed.
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] main.c: Failed 
to initialize daemon.
Nov 22 11:22:19 datacer pulseaudio[16110]: [pulseaudio] main.c: Daemon 
startup failed.


which repeat every 5 seconds, and will rapidly destroy my system.

I've fought with this miserable pulseaudio creation for several
years, trying to get sound to work *properly*, but this is the
last straw.

Today I held an exorcism and have slain the damned thing:
dnf remove pulseaudio
which, amazingly, took out 34 packages.

Sound now works perfectly - just the way it should.
I cannot discern any important loss of function from the deleted 34
packages so far.  aplay, vlc, xmms, mythfrontend and even
skypeforlinux all work fine with alsa.

pulseaudio should just go away!


Can you now play a video thru your computer and monitor and local sound 
speakers and at the same time send an htmi signal to your TV set that 
includes cideo and sound?
I don't think so. With the damned pulseaudio and sufficient messing 
around, you can do that.


--doug
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: SSH_AUTH_SOCK behavior is completely insane

2017-11-22 Thread Cameron Simpson

On 23Nov2017 00:06, cen  wrote:
Whose good idea in the history of Linux was to turn ssh agent on by 
default when one has more than 5 private keys available? This is what 
I just got:


ssh -i mykey.pem user@myhost
Received disconnect from ... port 22:2: Too many authentication failures
Authentication failed.

Then I do export SSH_AUTH_SOCK="" and surprise! I am logged in. And I 
am not even sure why this suddenly stopped working, I swear to God 
specifying the key used to override the agent.


No, as far as I recall it merely uses that key in addition to the agent. What 
gets used first might depend on the key types, too.


Have you experimented with specifying the key file in the ssh_config for 
whatever hosts require that key? Don't forget that the .ssh/config file accepts 
shell style globs in the Host clause names, quite handy for some things.  
Example from mine:


 Host *-direct
   ControlPath   none

Adjust to suit.

I keep a no-ssh-agent wrapper script around to run commands without access to 
my agent. Usage:


 no-ssh-agent some-ssh-stuff ...

So apparently the agent even overrides my -i flag which explicitly 
specifies which key to use. Instead of taking my key as I specify, ssh 
agent will go and try every single key file in my .ssh directory and 
fail after 5 times because any sane remote ssh server will block you 
after failing so many times.


Have you examined the output of "ssh -v" for this connection? Have you 
confirmed that your -i key is being offered after all your agent keys?


Anyone doing linux admin or dev work has more than 5 keys in their 
.ssh directory, rendering the agent completely USELESS PIECE OF SHIT 
PROGRAM.


Actually, no.

I've been doing that kind of work (admin and dev) for decades and I don't think 
I've ever had as many a 5 keys in my agents. I've got 4 right now, 3 being my 
personal keys (rsa, dsa, ed25519) to accomodate different key type acceptance 
and 1 special key for a third party project I'm working on right now. I could 
probably get my personal keys down to 2 if I spent a little time auditing my 
target hosts.


Does everyone disable agent first thing after installing Fedora? How else do 
you even manage to survive with this crap running?


Shrug. I live mostly on a Mac right now, which also provides a shared agent for 
your desktop. Quite handy really.


Why would agent even try with other keys if I SPECIFY the goddamn key! 
It doesn't make any sense!


I am surprised that it tries the agent keys before the -i key; have you 
verified this with an "ssh -v"?



How do I turn it off in all shells for all users forever?


Don't. Turn it off for your own shells perhaps, probably in your .bashrc.


How do I nuke this from system? .bash_profile export does not seem to cut it.


Surprising. I thought the Fedora bashrc sourced the bash_profile.

Cheers,
Cameron Simpson  (formerly c...@zip.com.au)
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: pulseaudio MUST DIE!

2017-11-22 Thread Sam Varshavchik

David A. De Graaf writes:


Today I held an exorcism and have slain the damned thing:
    dnf remove pulseaudio
which, amazingly, took out 34 packages.

Sound now works perfectly - just the way it should.
I cannot discern any important loss of function from the deleted 34
packages so far.  aplay, vlc, xmms, mythfrontend and even
skypeforlinux all work fine with alsa.

pulseaudio should just go away!


Unfortunately, Firefox requires pulseaudio for sound. Firefox is not  
packaged with a dependency on pulseaudio, but without it installed you want  
hear all the important parts of car crash videos on Youtube.





pgphPvRkY_wp0.pgp
Description: PGP signature
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: pulseaudio MUST DIE!

2017-11-22 Thread Ed Greshko
On 11/23/17 06:36, David A. De Graaf wrote:
> pulseaudio became unusable on F26 with the upgrade to vers 11.1.2 a few
> weeks ago.  It rapidly filled the log files with trash - and produced
> no sound.
> By using   dnf downgrade "*pulseaudio*"    I was able to restore sanity.
>
> Yesterday I freshly installed Fedora 27 Live Xfce on an Acer laptop.
> Today, /var/log/messages had grown to
> -rw-r--r--. 1 root root 14787172 Nov 22 15:47 messages
> These 15 MB contain recurring lines like this:
>
> Nov 22 11:22:18 datacer rtkit-daemon[4896]: Successfully made thread 16113 of 
> pr
> ocess 16113 (/usr/bin/pulseaudio) owned by 'dad' high priority at nice level 
> -11
> .
> Nov 22 11:22:19 datacer rtkit-daemon[4896]: Successfully made thread 16116 of
> process 16113 (/usr/bin/pulseaudio) owned by 'dad' RT at priority 5.
> Nov 22 11:22:19 datacer rtkit-daemon[4896]: Successfully made thread 16121 of
> process 16113 (/usr/bin/pulseaudio) owned by 'dad' RT at priority 5.
> Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] socket-server.c: 
> bind():
> Address already in use
> Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] module.c: Failed to 
> load
> module "module-esound-protocol-unix" (argument: ""): initialization failed.
> Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] main.c: Module load 
> failed.
> Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] main.c: Failed to
> initialize daemon.
> Nov 22 11:22:19 datacer pulseaudio[16110]: [pulseaudio] main.c: Daemon 
> startup failed.
>
> which repeat every 5 seconds, and will rapidly destroy my system.
>
> I've fought with this miserable pulseaudio creation for several
> years, trying to get sound to work *properly*, but this is the
> last straw.
>
> Today I held an exorcism and have slain the damned thing:
>     dnf remove pulseaudio
> which, amazingly, took out 34 packages.
>
> Sound now works perfectly - just the way it should.
> I cannot discern any important loss of function from the deleted 34
> packages so far.  aplay, vlc, xmms, mythfrontend and even
> skypeforlinux all work fine with alsa.
>
> pulseaudio should just go away!
>
>
Just a FWIW

I'm running F27 with KDE and pulseaudio-11.1-6.fc27.  The HW on one system is 
an Acer
Aspire 5920 which I think is about 8 yrs old.

The audio device is

[root@acer log]# lspci | grep -i audio
00:1b.0 Audio device: Intel Corporation 82801H (ICH8 Family) HD Audio 
Controller (rev 03)

0 problems with pulseaudio

Also 0 problems on my HP systems.

-- 
Fedora Users List - The place to go to speculate endlessly



signature.asc
Description: OpenPGP digital signature
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: SSH_AUTH_SOCK behavior is completely insane

2017-11-22 Thread Tom Horsley
On Thu, 23 Nov 2017 00:06:11 +0100
cen wrote:

> Anyone doing linux admin or dev work has more than 5 keys in their .ssh 
> directory, rendering the agent completely USELESS PIECE OF SHIT PROGRAM.

Why? I do lots of linux admin work and I only have two keys.
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


SSH_AUTH_SOCK behavior is completely insane

2017-11-22 Thread cen
Whose good idea in the history of Linux was to turn ssh agent on by 
default when one has more than 5 private keys available? This is what I 
just got:


ssh -i mykey.pem user@myhost
Received disconnect from ... port 22:2: Too many authentication failures
Authentication failed.


Then I do export SSH_AUTH_SOCK="" and surprise! I am logged in. And I am 
not even sure why this suddenly stopped working, I swear to God 
specifying the key used to override the agent.


So apparently the agent even overrides my -i flag which explicitly 
specifies which key to use. Instead of taking my key as I specify, ssh 
agent will go and try every single key file in my .ssh directory and 
fail after 5 times because any sane remote ssh server will block you 
after failing so many times.


Anyone doing linux admin or dev work has more than 5 keys in their .ssh 
directory, rendering the agent completely USELESS PIECE OF SHIT PROGRAM.



Does everyone disable agent first thing after installing Fedora? How 
else do you even manage to survive with this crap running?


Why would agent even try with other keys if I SPECIFY the goddamn key! 
It doesn't make any sense!


How do I turn it off in all shells for all users forever? How do I nuke 
this from system? .bash_profile export does not seem to cut it.


Not to mention the same shit happens when you open gnome files and try 
to connect to remote location, except you can't even specify the key in 
the UI. It will just try a bunch of keys until you are blocked by remote.


And there are numerous other programs who do this, like Filezilla.

I just don't get it apparently..

___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


pulseaudio MUST DIE!

2017-11-22 Thread David A. De Graaf

pulseaudio became unusable on F26 with the upgrade to vers 11.1.2 a few
weeks ago.  It rapidly filled the log files with trash - and produced
no sound.
By using   dnf downgrade "*pulseaudio*"    I was able to restore sanity.

Yesterday I freshly installed Fedora 27 Live Xfce on an Acer laptop.
Today, /var/log/messages had grown to
-rw-r--r--. 1 root root 14787172 Nov 22 15:47 messages
These 15 MB contain recurring lines like this:

Nov 22 11:22:18 datacer rtkit-daemon[4896]: Successfully made thread 
16113 of pr
ocess 16113 (/usr/bin/pulseaudio) owned by 'dad' high priority at nice 
level -11

.
Nov 22 11:22:19 datacer rtkit-daemon[4896]: Successfully made thread 
16116 of process 16113 (/usr/bin/pulseaudio) owned by 'dad' RT at 
priority 5.
Nov 22 11:22:19 datacer rtkit-daemon[4896]: Successfully made thread 
16121 of process 16113 (/usr/bin/pulseaudio) owned by 'dad' RT at 
priority 5.
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] socket-server.c: 
bind(): Address already in use
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] module.c: Failed 
to load module "module-esound-protocol-unix" (argument: ""): 
initialization failed.
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] main.c: Module 
load failed.
Nov 22 11:22:19 datacer pulseaudio[16113]: [pulseaudio] main.c: Failed 
to initialize daemon.
Nov 22 11:22:19 datacer pulseaudio[16110]: [pulseaudio] main.c: Daemon 
startup failed.


which repeat every 5 seconds, and will rapidly destroy my system.

I've fought with this miserable pulseaudio creation for several
years, trying to get sound to work *properly*, but this is the
last straw.

Today I held an exorcism and have slain the damned thing:
    dnf remove pulseaudio
which, amazingly, took out 34 packages.

Sound now works perfectly - just the way it should.
I cannot discern any important loss of function from the deleted 34
packages so far.  aplay, vlc, xmms, mythfrontend and even
skypeforlinux all work fine with alsa.

pulseaudio should just go away!


--
David A. De GraafDATIX, Inc.Hendersonville, NC
d...@datix.us www.datix.us
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: systemctl openvpn won't start

2017-11-22 Thread Kseniya Blashchuk
I have just moved all configs and certificates to /etc/openvpn/client/. And
I launch the client as 'systemctl start openvpn-client@myconnection'

On Thu, Nov 23, 2017, 12:02 AM Ulf Volmer  wrote:

> On 22.11.2017 20:59, Bill Shirley wrote:
>
> > What we've been talking about is the unit file
> > (openvpn@client-ibecker2.service).
>
> Since fc26 (if i remembered correctly) there were separate systemd units
> for openvpn server and client configurations.
>
> /usr/lib/systemd/system/openvpn-client@.service
> /usr/lib/systemd/system/openvpn-server@.service
>
> Based on that, you should have a config file in /etc/openvpn/client/
> (ibecker2.conf for example) and your systemd unit file should be
> openvpn-client@ibecker2.service
>
> best regards
> Ulf
> ___
> users mailing list -- users@lists.fedoraproject.org
> To unsubscribe send an email to users-le...@lists.fedoraproject.org
>
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: systemctl openvpn won't start

2017-11-22 Thread Ulf Volmer
On 22.11.2017 20:59, Bill Shirley wrote:

> What we've been talking about is the unit file
> (openvpn@client-ibecker2.service).

Since fc26 (if i remembered correctly) there were separate systemd units
for openvpn server and client configurations.

/usr/lib/systemd/system/openvpn-client@.service
/usr/lib/systemd/system/openvpn-server@.service

Based on that, you should have a config file in /etc/openvpn/client/
(ibecker2.conf for example) and your systemd unit file should be
openvpn-client@ibecker2.service

best regards
Ulf
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: systemctl openvpn won't start

2017-11-22 Thread Bill Shirley

That link is for something different.  It's automatically created by the
systemctl enable command.  I have one too:
[0:root@elmo ~]$ ls -lZ 
/etc/systemd/system/multi-user.target.wants/openvpn@server.service
lrwxrwxrwx. 1 root root system_u:object_r:systemd_unit_file_t:s0 42 Jul 17  2015 
/etc/systemd/system/multi-user.target.wants/openvpn@server.service -> /etc/systemd/system/openvpn@server.service


What we've been talking about is the unit file 
(openvpn@client-ibecker2.service).

Your original post:

sudo systemctl start openvpn@client-ibecker2
Failed to startopenvpn@client-ibecker2.service: Unit openvpn@client-
ibecker2.service not found.

says 'not found'.  There is no unit file in either /lib/systemd/system/ nor 
/etc/systemd/system/

Bill

On 11/22/2017 2:01 PM, Neal Becker wrote:

I have:
ls -lZ /etc/systemd/system/multi-user.target.wants/openvpn@client-
ibecker2.service
lrwxrwxrwx. 1 root root system_u:object_r:systemd_unit_file_t:s0 40 May 28
2015 /etc/systemd/system/multi-user.target.wants/openvpn@client-
ibecker2.service -> /usr/lib/systemd/system/openvpn@.service

My link is in /etc/systemd/system/multi-user.target.wants, not in
/etc/systemd/system.  Is this not correct?


___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: systemctl openvpn won't start

2017-11-22 Thread Neal Becker
Bill Shirley wrote:

> Is the .service file in /etc/systemd/system ?
> [0:root@elmo ~ 2]$ ls -lZ /etc/systemd/system/openvpn@server.service
> -rw-r--r--. 1 root root system_u:object_r:systemd_unit_file_t:s0 148 Aug 
> 6  2015 /etc/systemd/system/openvpn@server.service Of course yours would
> be openvpn@client-ibecker2.service
> 
> Bill
> 
> On 11/22/2017 7:02 AM, Neal Becker wrote:
>> Was working before upgrade to f27.  Now:
>>
>> sudo systemctl start openvpn@client-ibecker2
>> Failed to start openvpn@client-ibecker2.service: Unit openvpn@client-
>> ibecker2.service not found.
>>
>> According to
>> https://fedoraproject.org/wiki/Openvpn#Working_with_systemd
>>
>> I would need to have /etc/openvpn/client-ibecker2.conf, which is there
>> (as it's been since 2015).
>>
>> I don't know why this isn't working, or how to debug it (systemctl
>> doesn't seem to have any debug flags)
>> ___
>> users mailing list -- users@lists.fedoraproject.org
>> To unsubscribe send an email to users-le...@lists.fedoraproject.org
I have:
ls -lZ /etc/systemd/system/multi-user.target.wants/openvpn@client-
ibecker2.service
lrwxrwxrwx. 1 root root system_u:object_r:systemd_unit_file_t:s0 40 May 28  
2015 /etc/systemd/system/multi-user.target.wants/openvpn@client-
ibecker2.service -> /usr/lib/systemd/system/openvpn@.service

My link is in /etc/systemd/system/multi-user.target.wants, not in 
/etc/systemd/system.  Is this not correct?
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: Unable to have ~/.pam_environment processed -> having fun with SELinux

2017-11-22 Thread Gordon Messmer

On 11/21/2017 11:30 PM, Timothée Floure wrote:

~/.pam_environment is a symbolic link to ~/.dotfiles/pam_environment.



Symlinks aren't processed according to their target, so they tend to be 
problematic with SELinux.  Consider using a hard link instead.

___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: systemctl openvpn won't start

2017-11-22 Thread Bill Shirley

Putting your localized file in /lib/systemd/system is the problem. The upgrade
wiped it out.  Localizations should go in /etc/systemd/system

The Fedora 25 /lib/systemd/system/openvpn.service unit file from the rpm:
[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target

[Service]
PrivateTmp=true
Type=forking
PIDFile=/var/run/openvpn/%i.pid
ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd 
/etc/openvpn/ --config %i.conf

[Install]
WantedBy=multi-user.target
This file should not be edited.

My /etc/systemd/system/openvpn@server.service that I created:
.include /lib/systemd/system/openvpn@.service

[Unit]
After=syslog.target
After=network.target

[Service]
Environment="OPENSSL_ENABLE_MD5_VERIFY=1"

The text between the @ and the dot ('server') in the unit name becomes the %i
variable for the unit file.  In this case, it's the config file name and the 
pid file name:
[0:root@elmo ~]$ ls -lZ /etc/openvpn/server.conf /var/run/openvpn/server.pid
-rw-r-. 1 root root system_u:object_r:openvpn_etc_t:s0 11400 Jul 24 07:07 
/etc/openvpn/server.conf
-rw-r--r--. 1 root root system_u:object_r:openvpn_var_run_t:s0 5 Nov 18 
20:55 /var/run/openvpn/server.pid

HTH,
Bill

On 11/22/2017 12:13 PM, Outback Dingo wrote:

yeah somethings changed it used to be simple now we have to
create/copy files to systemd i just went through this today also

specifically in Section 5. Setting up automatic OpenVPN connection on
system start
*This step requires that you set up automatic login from the previous step.

https://hide.me/en/vpnsetup/fedora/openvpn/

On Wed, Nov 22, 2017 at 5:50 PM, Bill Shirley
 wrote:

Is the .service file in /etc/systemd/system ?
[0:root@elmo ~ 2]$ ls -lZ /etc/systemd/system/openvpn@server.service
-rw-r--r--. 1 root root system_u:object_r:systemd_unit_file_t:s0 148 Aug  6
2015 /etc/systemd/system/openvpn@server.service
Of course yours would be openvpn@client-ibecker2.service

Bill


On 11/22/2017 7:02 AM, Neal Becker wrote:

Was working before upgrade to f27.  Now:

sudo systemctl start openvpn@client-ibecker2
Failed to start openvpn@client-ibecker2.service: Unit openvpn@client-
ibecker2.service not found.

According to
https://fedoraproject.org/wiki/Openvpn#Working_with_systemd

I would need to have /etc/openvpn/client-ibecker2.conf, which is there (as
it's been since 2015).

I don't know why this isn't working, or how to debug it (systemctl doesn't
seem to have any debug flags)
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org



___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: Nextcloud upload restricted to 2MB

2017-11-22 Thread Florian Sievert
Hi there,

thanks for all your answers, it was very helpful and actually what is
going wrong. I wasn't aware of the fpm change. I switched back to
preforking as described in point 6 and everything is working again like
expected. Will have over the weekend a closer look at the mpm and try to
configure it correctly. Many thanks for the fast help!

Best regards,
Florian

> On 11/21/2017 02:59 PM, Florian Sievert wrote:
>> If I remember correctly, this was the default upload size set by PHP.
>> However, I set in F26 already in /etc/php.in the option and restarted
>> apache.
>>
>> upload_max_filesize = 16G
>
>> Any idea what this might be/? /Anyone who can confirm that nextcloud
>> is working for him on F27?
>
> This might be relevant:
> https://blog.remirepo.net/post/2017/11/17/Fedora-27-changes-in-http-and-php
>
> I don't know what changes that might have regarding configuration.
> ___
> users mailing list -- users@lists.fedoraproject.org
> To unsubscribe send an email to users-le...@lists.fedoraproject.org

___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: systemctl openvpn won't start

2017-11-22 Thread Outback Dingo
yeah somethings changed it used to be simple now we have to
create/copy files to systemd i just went through this today also

specifically in Section 5. Setting up automatic OpenVPN connection on
system start
*This step requires that you set up automatic login from the previous step.

https://hide.me/en/vpnsetup/fedora/openvpn/

On Wed, Nov 22, 2017 at 5:50 PM, Bill Shirley
 wrote:
> Is the .service file in /etc/systemd/system ?
> [0:root@elmo ~ 2]$ ls -lZ /etc/systemd/system/openvpn@server.service
> -rw-r--r--. 1 root root system_u:object_r:systemd_unit_file_t:s0 148 Aug  6
> 2015 /etc/systemd/system/openvpn@server.service
> Of course yours would be openvpn@client-ibecker2.service
>
> Bill
>
>
> On 11/22/2017 7:02 AM, Neal Becker wrote:
>
> Was working before upgrade to f27.  Now:
>
> sudo systemctl start openvpn@client-ibecker2
> Failed to start openvpn@client-ibecker2.service: Unit openvpn@client-
> ibecker2.service not found.
>
> According to
> https://fedoraproject.org/wiki/Openvpn#Working_with_systemd
>
> I would need to have /etc/openvpn/client-ibecker2.conf, which is there (as
> it's been since 2015).
>
> I don't know why this isn't working, or how to debug it (systemctl doesn't
> seem to have any debug flags)
> ___
> users mailing list -- users@lists.fedoraproject.org
> To unsubscribe send an email to users-le...@lists.fedoraproject.org
>
>
>
> ___
> users mailing list -- users@lists.fedoraproject.org
> To unsubscribe send an email to users-le...@lists.fedoraproject.org
>
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: systemctl openvpn won't start

2017-11-22 Thread Bill Shirley

Is the .service file in /etc/systemd/system ?
[0:root@elmo ~ 2]$ ls -lZ /etc/systemd/system/openvpn@server.service
-rw-r--r--. 1 root root system_u:object_r:systemd_unit_file_t:s0 148 Aug  6  
2015 /etc/systemd/system/openvpn@server.service
Of course yours would be openvpn@client-ibecker2.service

Bill

On 11/22/2017 7:02 AM, Neal Becker wrote:

Was working before upgrade to f27.  Now:

sudo systemctl start openvpn@client-ibecker2
Failed to start openvpn@client-ibecker2.service: Unit openvpn@client-
ibecker2.service not found.

According to
https://fedoraproject.org/wiki/Openvpn#Working_with_systemd

I would need to have /etc/openvpn/client-ibecker2.conf, which is there (as
it's been since 2015).

I don't know why this isn't working, or how to debug it (systemctl doesn't
seem to have any debug flags)
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: Windows 10 KVM and reboot

2017-11-22 Thread Patrick O'Callaghan
On Tue, 2017-11-21 at 20:56 -0500, Sam Varshavchik wrote:
> I do not remember if I initiated the reboot for some reason, or if it was a  
> Win10-initiated reboot. But the reboot went into some kind of a recovery  
> mode I have not seen before, in Windows. Instead of booting Windows 10, it  
> was some kind of recovery menu, giving me a few options to try. I do not  
> immediately recall which options tjeu were, but the the conclusion was the  
> same, no matter which recovery option I picked: an adamant claim that my  
> "hard drive" is fried.

I've seen that a couple of times with Win10. Always thought it was
PEBKAC so the first time I just reinstalled Windows. The second time I
tried the options (vaguely remember it was the first one) and it
worked.

OT:

What triggered the problem in the first place was my attempt to dual-
boot the Win10 system (it lives on its own disk). The VM is configured
with EFI (ovmf), that being the preferred option when doing VFIO
passthrough, but my box is configured by default to try BIOS before
trying EFI and I didn't use the magic incantation in my boot screen, so
Windows decided there was something wrong and tried to "fix" it - in
this case by downgrading the VM from EFI to BIOS. Anyway, having
managed to correct that I can now dual-boot if required by proper magic
in the (real) firmware.

What I'd really prefer is to reinstall Fedora using EFI but that seems
somewhat complicated to achieve. I asked about it here a while back and
found the answers discouraging (not impossible, just a lot of work). I
don't really need to dual-boot anyway at the moment. It was just a whim
so I could check performance of my VM.

poc
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: grub2-efi / grub2-tools problem

2017-11-22 Thread Frank Elsner
On Wed, 22 Nov 2017 16:34:54 +0100 Ger van Dijck wrote:
> On Wed, 22 Nov 2017 14:24:48 +0100, Frank Elsner  
>  wrote:
> 
> > Hello,
> >
> > known since release of Fedora 27:
> >
> > Error:
> >  Problem: package grub2-efi-1:2.02-0.40.fc26.i686 requires grub2-tools =  
> > 1:2.02-0.40.fc26, but none of the providers can be installed
> >   - grub2-tools-1:2.02-0.40.fc26.i686 does not belong to a distupgrade  
> > repository
> >   - problem with installed package grub2-efi-1:2.02-0.40.fc26.i686
> >
> > Any chance to get this problem solved?
> >
> > Upgrade otherwise not possible (at least here).
> >
> >
> > --Frank Elsner
> 
> 
> 
> > Hi Frank ,
> 
> 
> I had the same problem and put it on the Red Hat Network; But no one did  
> give any help.
> 
> I solved the problem as follows : I did a relabel on the OS ( Fedora 26 )  
> and added  in the command " dnf system-upgrade download  --refresh  
> --releasever=27 " the option --allowerase.

What do you mean by "relabel"?

dnf system-upgrade download --allowerase --refresh --releasever=27
gives 
dnf system-upgrade: error: unrecognized arguments: --allowerase

> In my case then the updrade to Fedora 27 runs fine.

Can't reproduce.

--Frank Elsner
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: grub2-efi / grub2-tools problem

2017-11-22 Thread Ger van Dijck
On Wed, 22 Nov 2017 14:24:48 +0100, Frank Elsner  
 wrote:



Hello,

known since release of Fedora 27:

Error:
 Problem: package grub2-efi-1:2.02-0.40.fc26.i686 requires grub2-tools =  
1:2.02-0.40.fc26, but none of the providers can be installed
  - grub2-tools-1:2.02-0.40.fc26.i686 does not belong to a distupgrade  
repository

  - problem with installed package grub2-efi-1:2.02-0.40.fc26.i686

Any chance to get this problem solved?

Upgrade otherwise not possible (at least here).


--Frank Elsner





Hi Frank ,



I had the same problem and put it on the Red Hat Network; But no one did  
give any help.


I solved the problem as follows : I did a relabel on the OS ( Fedora 26 )  
and added  in the command " dnf system-upgrade download  --refresh  
--releasever=27 " the option --allowerase.


In my case then the updrade to Fedora 27 runs fine.




Give it a try , saucces ,


Ger van Dijck.___

users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org



--
Using Opera's mail client: http://www.opera.com/mail/
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: Video Download Helper will not run with Firefox 57

2017-11-22 Thread Temlakos

On 11/22/2017 07:43 AM, wwp wrote:

Hello,


On Wed, 22 Nov 2017 07:34:53 -0500 Temlakos  wrote:


Everyone:

After updating Firefox I got a message to "refresh" it--that is, remove all 
add-ins. Foolishly I did so, thinking to reinstall them later using compatible versions.

But I have not been able to get Video Download Helper to work.

I followed their instructions to install a "companion application." That means 
working in a terminal version (actually, Konsole; I'm working in KDE). The messages I get 
all say the companion app is ready for use. But after repeated shutdowns and restarts, 
VDH still will not download anything.

And that's the case for all extensions that didn't move to the
webextension format. What a killer Firefox upgrade..

FYI: https://arewewebextensionsyet.com/




Thank you! That's the best resource I could have asked for. It led to 
another extension that restores the most important capability I had lost.


All that remains is whether VDH will get with the program. The resource 
above said it had three "blocking bugs." I suppose that explains the 
trouble I had.


Temlakos
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: QEMU/KVM startup error in F27

2017-11-22 Thread Ed Greshko
On 11/22/17 20:01, Patrick O'Callaghan wrote:
> I think you mean "semodule -DB" as that's what the manpage gives as an
> example (BTW the page is phenomenally hard to understand, not least
> because at one point it uses MODE, at another it says "module" and at a
> third it says KIND, and it isn't clear if these are supposed to be the
> same thing).

Yes, -DB is what I meant to type.
>
> Anyway, it had no effect. The error persists of course, but there is
> still no AVC report.
>
> Thanks all the same.


I suppose I've never encountered a situation where an AVC wasn't produced.  
Wonder
how that is then diagnosed.   Oh, well.

-- 
Fedora Users List - The place to go to speculate endlessly



signature.asc
Description: OpenPGP digital signature
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


grub2-efi / grub2-tools problem

2017-11-22 Thread Frank Elsner
Hello,

known since release of Fedora 27:

Error: 
 Problem: package grub2-efi-1:2.02-0.40.fc26.i686 requires grub2-tools = 
1:2.02-0.40.fc26, but none of the providers can be installed
  - grub2-tools-1:2.02-0.40.fc26.i686 does not belong to a distupgrade 
repository
  - problem with installed package grub2-efi-1:2.02-0.40.fc26.i686

Any chance to get this problem solved? 

Upgrade otherwise not possible (at least here).


--Frank Elsner 
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: Video Download Helper will not run with Firefox 57

2017-11-22 Thread wwp
Hello,


On Wed, 22 Nov 2017 07:34:53 -0500 Temlakos  wrote:

> Everyone:
> 
> After updating Firefox I got a message to "refresh" it--that is, remove all 
> add-ins. Foolishly I did so, thinking to reinstall them later using 
> compatible versions.
> 
> But I have not been able to get Video Download Helper to work.
> 
> I followed their instructions to install a "companion application." That 
> means working in a terminal version (actually, Konsole; I'm working in KDE). 
> The messages I get all say the companion app is ready for use. But after 
> repeated shutdowns and restarts, VDH still will not download anything.

And that's the case for all extensions that didn't move to the
webextension format. What a killer Firefox upgrade..

FYI: https://arewewebextensionsyet.com/


Regards,

-- 
wwp


pgptB3dabbLQ3.pgp
Description: OpenPGP digital signature
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Video Download Helper will not run with Firefox 57

2017-11-22 Thread Temlakos

Everyone:

After updating Firefox I got a message to "refresh" it--that is, remove 
all add-ins. Foolishly I did so, thinking to reinstall them later using 
compatible versions.


But I have not been able to get Video Download Helper to work.

I followed their instructions to install a "companion application." That 
means working in a terminal version (actually, Konsole; I'm working in 
KDE). The messages I get all say the companion app is ready for use. But 
after repeated shutdowns and restarts, VDH still will not download anything.


Temlakos
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


systemctl openvpn won't start

2017-11-22 Thread Neal Becker
Was working before upgrade to f27.  Now:

sudo systemctl start openvpn@client-ibecker2
Failed to start openvpn@client-ibecker2.service: Unit openvpn@client-
ibecker2.service not found.

According to
https://fedoraproject.org/wiki/Openvpn#Working_with_systemd

I would need to have /etc/openvpn/client-ibecker2.conf, which is there (as 
it's been since 2015).

I don't know why this isn't working, or how to debug it (systemctl doesn't 
seem to have any debug flags)
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: QEMU/KVM startup error in F27

2017-11-22 Thread Patrick O'Callaghan
On Tue, 2017-11-21 at 16:03 -0800, Samuel Sieb wrote:
> On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
> > On trying to fire up a VM using virt-manager, I get "unable to map 
> > backing store for guest RAM: Permission denied".
> > 
> > I use hugepages to lock down memory for the VM, which may be relevant 
> > for the error. This worked correctly on F26 just before the upgrade to 
> > F27. I have changed nothing in my VM configuration, nor in the config 
> > file for QEMU. However, temporarily turning off SElinux allows the 
> > startup to proceed, after which I can re-enable SElinux with no ill 
> > effects, i.e. the VM runs correctly.
> > 
> > A complete relabel of my system (touch /.autolabel and reboot) has made 
> > no difference.
> 
> 
> Possibly https://bugzilla.redhat.com/show_bug.cgi?id=1481454

Certainly looks like it might be. I'll try adding a pointer to my BZ to
see if anyone takes any notice.

poc
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: QEMU/KVM startup error in F27

2017-11-22 Thread Patrick O'Callaghan
On Wed, 2017-11-22 at 12:12 +0800, Ed Greshko wrote:
> On 11/15/17 20:20, Patrick O'Callaghan wrote:
> > On Tue, 2017-11-14 at 14:50 -0800, Rick Stevens wrote:
> > > On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
> > > > On trying to fire up a VM using virt-manager, I get "unable to map
> > > > backing store for guest RAM: Permission denied".
> > > > 
> > > > I use hugepages to lock down memory for the VM, which may be relevant
> > > > for the error. This worked correctly on F26 just before the upgrade to
> > > > F27. I have changed nothing in my VM configuration, nor in the config
> > > > file for QEMU. However, temporarily turning off SElinux allows the
> > > > startup to proceed, after which I can re-enable SElinux with no ill
> > > > effects, i.e. the VM runs correctly.
> > > > 
> > > > A complete relabel of my system (touch /.autolabel and reboot) has made
> > > > no difference.
> > > 
> > > Have you checked the AVC reports from selinux? It smells like a bad
> > > policy re: hugepages for KVMs. It's difficult to say without the actual
> > > AVC denials.
> > 
> > Not seeing anything. The only AVC reports in journalctl are about some
> > dbus stuff unrelated to libvirtd. Interestingly the libvirtd startup
> > lines in journalctl show:
> > 
> > ... error : virAuditOpen:62 : Unable to initialise audit layer: Protocol 
> > not supported
> > 
> > but it's not clear whether that has any relevance. As I say, toggling
> > setenforce lets libvirtd start and from then on everything works.
> > 
> > 
> 
> I added a comment to your BZ but thought it would be worth mentioning here as 
> well.
> 
> If you find your problem going away by disabling selinux but you're not 
> getting an
> AVC then it may be due to "donotaudit" in the policy.  So, you should have 
> selinux
> enabled and run "semodule -D" to turn off donotaudit and then run your test 
> and see
> if you get an AVC.

I think you mean "semodule -DB" as that's what the manpage gives as an
example (BTW the page is phenomenally hard to understand, not least
because at one point it uses MODE, at another it says "module" and at a
third it says KIND, and it isn't clear if these are supposed to be the
same thing).

Anyway, it had no effect. The error persists of course, but there is
still no AVC report.

Thanks all the same.

poc
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


Re: Nextcloud upload restricted to 2MB

2017-11-22 Thread James Hogarth
I'm looking at the owncloud and nextcloud packages this week to update them.

Apologies for this but it was an unexpected result of changes to httpd.

The default httpd MPM changed from prefork to event, which disabled
mod_php as it's not thread safe.

For the incoming update once I've ironed out update issues (a lot to
test) I'll be switching the recommended from mod_php to php-fpm
whether you are using nginx or httpd.

This will allow the default MPM on apache to be event for performance
and simplify my upgrade tasks by ensuring both nginx and httpd use a
common php-fpm config.

This is the config I drop in place for nginx, the same will be used for httpd:

https://src.fedoraproject.org/rpms/nextcloud/blob/master/f/nextcloud-php-fpm.conf

I'm honestly struggling on time between work and family and Fedora at
present ... anyone willing to step up and assist with testing,
checking dependencies and so on would be most appreciated.

As a work around for the time being on httpd change
/etc/httpd/conf.d/00-mpm.conf to use prefork again if you don't want
to manually install and configure php-fpm for nextcloud... that will
automatically enable mod_php again and get the correct configuration.

James


On 22 November 2017 at 03:08, Bill Shirley  wrote:
> I ran into this on Fedora 25.
> https://www.spinics.net/linux/fedora/fedora-users/msg479030.html
>
> I'm not running php-fpm.service.
>
> Bill
>
>
> On 11/21/2017 7:24 PM, Rick Stevens wrote:
>>
>> On 11/21/2017 03:27 PM, Samuel Sieb wrote:
>>>
>>> On 11/21/2017 02:59 PM, Florian Sievert wrote:

 If I remember correctly, this was the default upload size set by PHP.
 However, I set in F26 already in /etc/php.in the option and restarted
 apache.

 upload_max_filesize = 16G
 Any idea what this might be/? /Anyone who can confirm that nextcloud
 is working for him on F27?
>>>
>>> This might be relevant:
>>>
>>> https://blog.remirepo.net/post/2017/11/17/Fedora-27-changes-in-http-and-php
>>> I don't know what changes that might have regarding configuration.
>>
>> Essentially, F27 now uses Apache in event (multithreaded) mode rather
>> than prefork (single-threaded) mode. PHP itself is multithread safe, but
>> some of the libraries that may be used by it are NOT multithread-safe.
>> Since mod_php is designed for single-thread use, you can't use it with
>> Apache running in either event or worker (also multithreaded) modes.
>>
>> To get around this, PHP now runs as a separate process (called
>> "php-fpm") and Apache talks to it using a mechanism called FastCGI via
>> either a UNIX-domain socket or TCP/IP using (typically) localhost:9000.
>> Since PHP is a separate process, if you make a change to /etc/php.ini,
>> you must restart php-fpm:
>>
>> $ sudo systemctl restart php-fpm.service
>>
>> for it to take effect.
>>
>> Probably more than you wanted to know, but
>> --
>> - Rick Stevens, Systems Engineer, AllDigitalri...@alldigital.com -
>> - AIM/Skype: therps2ICQ: 226437340   Yahoo: origrps2 -
>> --
>> - The trouble with troubleshooting is that trouble sometimes -
>> - shoots back.   -
>> --
>> ___
>> users mailing list -- users@lists.fedoraproject.org
>> To unsubscribe send an email to users-le...@lists.fedoraproject.org
>
> ___
> users mailing list -- users@lists.fedoraproject.org
> To unsubscribe send an email to users-le...@lists.fedoraproject.org
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org


HEADS UP: OpenSSH 7.6p1 in Fedora 27

2017-11-22 Thread Jakub Jelen
Hello all,
The OpenSSH 7.6p1 was submitted for testing in Fedora 27 [1].

Unfortunately I didn't manage to get it out before freeze since all the
thing/bugs/upstream release somehow pilled up. On the other side, this
package was already tested quite extensively during recent months by
myself, using automated test cases and was in rawhide for last two
weeks, where we caught last issues.

If you have some "special" use case, please make sure it works for you
after the update and leave a karma.

[1] https://bodhi.fedoraproject.org/updates/FEDORA-2017-96d1995b70

Thank you,
-- 
Jakub Jelen
Software Engineer
Security Technologies
Red Hat, Inc.
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org