2020-11-25T03:44:07  *** okurz_ is now known as okurz
2020-11-25T08:10:24  *** ldevulder_ is now known as ldevulder
2020-11-25T09:02:58  <lethliel_> Hi.
2020-11-25T09:03:56  <lethliel_> ns3 still reports the wrong IP for meet.opensuse.org and my freeipa account is not working anymore..
2020-11-25T09:11:41  <pjessen> yep, looks like ns3 has not cought up yet, the soa serial says 2020023072
2020-11-25T09:11:59  <pjessen> ns1 and ns2 say 2020023080
2020-11-25T09:12:09  <pjessen> I don't know who is working on this
2020-11-25T09:12:41  <lkocman> hello team, any plans to put limesurvey back online? https://survey.opensuse.org/admin
2020-11-25T09:12:51  <lkocman> we have a review meeting for survey results in about an hour
2020-11-25T09:13:24  <lkocman> https://survey.opensuse.org/admin returns 503
2020-11-25T09:25:59  <pjessen> hmm, I can't even log in to limesurvey
2020-11-25T09:26:58  <lkocman> pjessen, can you try restarting it?
2020-11-25T09:27:07  <lkocman> pjessen, I think I've seen temp. results on Thursday
2020-11-25T09:27:19  <lkocman> but I'm not sure if service was online on Friday as I had already vacation
2020-11-25T09:32:04  <pjessen> lkocman: no, I don't have access to that side.
2020-11-25T09:46:22  <klein> hello there, in our Salt we have this line in `pillar/common.sls`:
2020-11-25T09:46:31  <klein> 58  AuthorizedKeysCommand: /usr/local/bin/fetch_freeipa_ldap_sshpubkey.sh
2020-11-25T09:46:52  <klein> does that get applied to all machines? Even the ones in QSC?
2020-11-25T09:48:35  <klein> because we lost the VPN with QSC, and, we let a "safe option" that allows TCP/22 from SUSE Public IPs, the problem is that I can't login there anymore, probably due to this
2020-11-25T10:01:17  <klein> oh, and we need that access to slimhat so we can fix this DNS issue you listed above
2020-11-25T10:05:48  <pjessen> klein:  is ns3 == widehat ?
2020-11-25T10:09:08  <pjessen> I guess not, but it's in the same network range.  from widehat I get a password prompt on slimhat, but I don't have access
2020-11-25T10:22:12  <klein> I had access in the past to both, I can access widehat, but not slimhat
2020-11-25T10:22:24  <klein> and, I didn't have found any dns service on whidehat
2020-11-25T10:22:45  <klein> I was told that some virtual machines was crated on slimhat, ns3 is one of them
2020-11-25T10:23:12  <klein> but I am not sure, I was not involved in the creation of it, just found some salt code saying that slimhat is indeed a virt_cluster
2020-11-25T10:24:30  *** Martchus_ is now known as Martchus
2020-11-25T10:34:46  <pjessen> klein: ditto, access to widehat, but not to slimhat.
2020-11-25T10:47:54  <klein> and the thing is... I had access to slimhat in the past, at that timeframe when we had the disk space problems in whidehat
2020-11-25T10:48:54  <klein> not sure what happened
2020-11-25T10:50:53  <pjessen> who else was involved back then - bmwiedemann ?
2020-11-25T10:51:03  <klein> lars
2020-11-25T10:51:16  <pjessen> ah
2020-11-25T11:19:48  <darix> we are working on it
2020-11-25T11:21:21  <lkocman> darix, thank you!
2020-11-25T11:40:05  <henne> pjessen: gsoc-mentors is a spam fest
2020-11-25T11:40:31  <darix> osc ls openSUSE:infrastructure:matrix   matrix-synapse
2020-11-25T11:40:33  <henne> pjessen: anything you can do?
2020-11-25T11:40:42  <darix> lcp: you really do not want to lock the revision there
2020-11-25T11:40:49  <darix> you missed tons of CVEs so far
2020-11-25T11:41:17  <lcp> for things that aren't in factory (except for resteasy)
2020-11-25T11:41:45  <lcp> I was planning to update resteasy soon though
2020-11-25T11:42:00  <darix> lcp: but a warning you will need to linkpac some python modules to update it
2020-11-25T11:42:16  <lcp> mhm
2020-11-25T11:42:35  <lcp> oh, you mean in matrix
2020-11-25T11:42:43  <lcp> yeah, that's a nightmare to maintain >:D
2020-11-25T11:42:59  <darix> why not use the package from network:messaging:matrix?
2020-11-25T11:43:17  <darix> actually maintaining matrix-synapse is super easy
2020-11-25T11:43:26  <darix> (speaking as the someone who did it for the last few releases)
2020-11-25T11:43:43  <lcp> yeah, pulling in more deps every time the package is updated isn't
2020-11-25T11:43:59  <lcp> kinda wish we could just have microos vm for it
2020-11-25T11:44:16  <darix> lcp: if you have k8s or so
2020-11-25T11:44:26  <darix> there is container for synapse in home:darix:apps
2020-11-25T11:44:28  <darix> that you could use
2020-11-25T11:45:04  <lcp> matrix isn't locked on a revision though
2020-11-25T11:45:12  <lcp> it's just not building because of missing deps
2020-11-25T11:45:26  <darix> lcp: osc ls openSUSE:infrastructure:matrix   matrix-synapse
2020-11-25T11:45:28  <darix> says
2020-11-25T11:45:39  <bmwiedemann> meet2.opensuse.org does not respond to IPv6.
2020-11-25T11:45:40  <darix> matrix-synapse-1.10.0.obscpio
2020-11-25T11:45:53  <darix> while we are at 1.23.0
2020-11-25T11:46:08  <darix> bmwiedemann: we can fix that after you or jdsn help us to get onto slimhat
2020-11-25T11:46:11  <darix> deal?
2020-11-25T11:46:21  <lcp> darix: https://build.opensuse.org/package/show/openSUSE:infrastructure:matrix/matrix-synapse says a different story
2020-11-25T11:46:26  <lcp> so osc is drunk or something
2020-11-25T11:46:40  <darix> https://build.opensuse.org/package/show/openSUSE:infrastructure:matrix/matrix-synapse?expand=0
2020-11-25T11:46:55  <darix> maybe someone copied in old sources and then set the link?
2020-11-25T11:47:18  <lcp> eh, I will just remove it and rebranch
2020-11-25T11:48:20  <lcp> not like it matters, I believe we are on way newer version of synapse than 1.10
2020-11-25T11:48:22  <darix> jfyi for 15.2 the package builds in the devel project
2020-11-25T11:48:28  <darix> ok
2020-11-25T11:48:34  <darix> 1.23 fixed another CVE
2020-11-25T11:48:42  <darix> for which it seems they just published the details
2020-11-25T11:48:50  <bmwiedemann> darix: I can ssh to slimhat, but it does not accept the root PW
2020-11-25T11:48:59  <lcp> yeah, I will get everything updated today
2020-11-25T11:50:34  <darix> bmwiedemann: so you can not ;)
2020-11-25T11:58:50  <darix> lcp: that riot-web package in network:messaging:matrix is yours no?
2020-11-25T11:59:14  <lcp> yeah, I also didn't update that for a while
2020-11-25T12:00:17  <darix> the default.d dir for nginx is not the normal suse thing
2020-11-25T12:00:37  <lcp> yup, also aware of that
2020-11-25T12:00:47  <darix> I could just submit my riot-web package over yours :)
2020-11-25T12:00:50  <darix> that is up2date
2020-11-25T12:01:08  <darix> should I put the riot-web config into /etc/nginx/vhosts.d/ ?
2020-11-25T12:01:52  <darix> oh i need to do the config to /etc/ part too then I guess
2020-11-25T12:02:02  <darix> + updating apparmor profile for it
2020-11-25T12:02:50  <lcp> eh, I find putting default config in vhosts.d isn't ideal, but it's not like there are any other choices
2020-11-25T12:03:20  <darix> lcp: if the vhost doesnt match in server_name it doesnt really matter
2020-11-25T12:03:30  <lcp> true
2020-11-25T12:03:41  <lcp> it's also a subpackage, so it matters even less
2020-11-25T12:04:57  <darix> I will merge in the config stuff + your nginx vhost config later and then submit it to the devel project
2020-11-25T12:06:44  <lcp> thanks
2020-11-25T12:07:21  <darix> i will kill your changes though :P
2020-11-25T12:07:33  <darix> mine has more details
2020-11-25T12:09:24  <darix> FWIW: There is a working routing vpn to provo now
2020-11-25T12:10:04  <darix> the hosts which do not use 47.254 need some extra routes in their routing table now. but in general it works.
2020-11-25T12:22:39  <pjessen> henne: will check
2020-11-25T12:33:57  <pjessen> henne: none of those should have gotten through, they should all have been moderated. weird
2020-11-25T12:50:15  <henne> did you migrate spam settings?
2020-11-25T12:54:58  <darix> review@ was the only source of spam for me this morning
2020-11-25T12:55:12  <darix> I should really show you rspamd :P
2020-11-25T13:29:54  <pjessen> henne: probably wasnt really needed, we reject spam on the mail server
2020-11-25T13:42:00  <pjessen> darix: rewiew and gsoc-mentors had just about the same spam.  from non-members so it should not have gotten through.
2020-11-25T13:42:44  <henne> well gsoc-mentors is an open list. anyone can post to it
2020-11-25T13:47:25  <pjessen> not as far I can see in the mm3 settings. it was one setting that was not migrated
2020-11-25T13:48:01  <henne> alright
2020-11-25T13:48:33  <henne> there isn't any real traffic on it anymore anyway...
2020-11-25T13:49:06  <pjessen> well, looks like maybe it was in fact made open .... I dunno if lcp maybe opened it later
2020-11-25T13:49:58  <darix> review@ should also be open too
2020-11-25T13:51:13  <pjessen> darix:  yes, it is too - my test messages just went through.
2020-11-25T13:52:21  <pjessen> well, as for the spam, spamassassin didn't catch it, not enough points.
2020-11-25T13:52:51  <darix> pjessen: if you want we can do some jitsi session another day where I show you my rspamd setup
2020-11-25T13:57:21  <pjessen> darix: if your setup caught some of those spam, I'll borrow your rule set :-)
2020-11-25T13:57:30  <pjessen> lcp: are you here?
2020-11-25T13:59:21  <darix> pjessen: i do not filter things again that come to my suse address :)
2020-11-25T13:59:25  <darix> this one is my private setup
2020-11-25T14:03:32  <tangarora> is there a reason this does not work for opensuse but for other distros? sudo virt-install --install opensuse42.3 --video virtio  --network bridge:br0 --unattended --noautoconsole
2020-11-25T14:03:59  <tangarora> this works like a charm: sudo virt-install --install fedora31 --video virtio  --network bridge:br0 --unattended --noautoconsole
2020-11-25T14:04:12  <tangarora> same for ubuntu.
2020-11-25T14:04:29  <tangarora> hows is opensuse... --- so that is a bit embarrasing?
2020-11-25T14:04:45  <darix> tangarora: can you tell us the exact error?
2020-11-25T14:05:17  <tangarora> darix: ERROR    OS 'opensuse42.3' does not have a URL location
2020-11-25T14:05:37  <darix> so which distro are you running on there?
2020-11-25T14:05:44  <darix> it might depend on the libvirt version you have
2020-11-25T14:05:58  <darix> i would also like to point out that 42.3 is EOL
2020-11-25T14:06:00  <darix> do not use it
2020-11-25T14:07:23  <tangarora> seems like there is a url accoding to osinfo: opensuse42.3 | openSUSE Leap 42.3 | 42.3 | http://opensuse.org/opensuse/42.3
2020-11-25T14:08:10  <tangarora> Operating System: openSUSE Leap 15.2
2020-11-25T14:08:26  <tangarora> hostnamectl
2020-11-25T14:09:03  <tangarora> wait let me try something'
2020-11-25T14:10:20  <tangarora> ok 15 works... seems like th ehigher numbers are actually lower versions...
2020-11-25T14:10:58  <darix> yes in this case
2020-11-25T14:11:01  <darix> you want 15.2 as latest stable
2020-11-25T14:39:01  <darix> hey heroes what do you think about this? https://smallstep.com/blog/use-ssh-certificates/
2020-11-25T14:51:04  <darix> you could use id.opensuse.org to authenticate for it
2020-11-25T14:51:13  <darix> or freeipa + another ipsilon
2020-11-25T15:03:40  <tangarora> looks good... if you have bought a cert... so for or its ok
2020-11-25T15:04:54  <tangarora> how do you get an id at id.opensuse.com?
2020-11-25T15:12:06  <darix> it is your normal opensuse account
2020-11-25T15:58:22  <darix> pjessen: still there?
2020-11-25T16:07:01  <lcp> pjessen: I am here now :P
2020-11-25T16:08:09  <lcp> darix: there really are no benefits over using freeipa
2020-11-25T16:08:17  <darix> yes there are
2020-11-25T16:08:41  <darix> but no time right now to explain why
2020-11-25T16:57:36  <pjessen> i'm back now
2020-11-25T16:58:46  <darix> JFYI:
2020-11-25T16:58:57  <darix> wireguard connection also up to slimhat
2020-11-25T16:59:01  <darix> but no routing via that yet
2020-11-25T16:59:19  <pjessen> darix: tnx
2020-11-25T17:00:04  <pjessen> lcp: fyi, as a work-around, i have rerouted $list-bounces@o.o to $list-bounces@lists.o.o - hopefully that'll get the bounce processing to work.
2020-11-25T17:00:26  <lcp> yeah, I've seen it on progress
2020-11-25T17:00:38  <darix> and ns3 is up2date again
2020-11-25T17:01:10  <pjessen> lcp: ah, okay
2020-11-25T17:05:14  <darix> lcp pjessen: how much do you want to keep appending the footer and rewriting the subject?
2020-11-25T17:09:39  <jdsn> pjessen: background is that opensuse ML remove dkim signatures of mails with header From: *@suse.com and our IT wants to enforce all @suse.com mails having a dkim signature
2020-11-25T17:15:02  <darix> ok wireguard to provo now independent of openvpn
2020-11-25T17:20:51  <pjessen> jdsn: yes, I have noticed that - I think it is the mailman "dmarc mitigation".
2020-11-25T17:21:47  <darix> pjessen: can you turn off that it basically does not modify mails anymore?
2020-11-25T17:21:49  <pjessen> I would like to play with removing signature, but I have been unable to make it work, on .e.g bugs@lists and admin@lists.
2020-11-25T17:22:21  <pjessen> darix: lcp mioght have an idea
2020-11-25T17:23:08  <darix> the other option is rewriting all the from headers
2020-11-25T17:23:28  <pjessen> darix: yeah, but that is a no-go.
2020-11-25T17:23:30  <darix> to something like encoded_original_from-listname@opensuse.org
2020-11-25T17:23:39  <darix> well
2020-11-25T17:23:51  <darix> then do not modify the mails at all :P
2020-11-25T17:23:54  <pjessen> we seem to have a standard set of footers which we should be able to override per list. I have tried overriding them with <empty>, but didn work
2020-11-25T17:24:07  <pjessen> but it didnt work
2020-11-25T17:29:35  <darix> is the provo-ns VM offline?
2020-11-25T17:32:43  <lcp> <pjessen "we seem to have a standard set o"> it's specified at https://github.com/openSUSE/lists-o-o/tree/master/mailman-templates/site/en to be precise, we probably need to remove them from there and set it on every list that should have footers in postorius
2020-11-25T17:41:18  <pjessen> I tried overriding it for bugs.lists, but it doesn't work
2020-11-25T17:46:27  <pjessen> lcp: do you know if we are using the DMARC Mitigations anywhere at all?
2020-11-25T17:47:28  <lcp> not sure
2020-11-25T17:47:52  <pjessen> on e.g. factory.lists they are not enabled, yet there are no DKIM signatures when messages from suse.com are distributed.
2020-11-25T18:32:01  <lcp> I suspect it does something with dkim anyway, even when disabled
2020-11-25T18:33:42  <pjessen> thats what it looks like, yeah
2020-11-25T19:31:19  <pjessen> lcp: just tested it, my DKIM sig was stripped off a mail I sent to test.lists.
2020-11-25T21:56:55  <darix> JFYI
2020-11-25T21:56:59  <darix> quick restart for openvpn
2020-11-25T21:57:06  <darix> to help with some device naming
2020-11-25T21:58:27  <darix> done
2020-11-25T23:40:43  <Suzumi> Hi. Where can I report a problem with Brazil's mirrors for downloading the install media?
2020-11-25T23:45:07  <cboltz> either contact the admin of the mirror directly (if you know a mail address), or send a mail to admin AT opensuse.org and pjessen will check what's going on
2020-11-25T23:46:07  <Suzumi> OK, thanks