Is there a way to read this sequence of messages as a coherent whole in the correct order?
Run0, a systemd based alternative to sudo, announced
571–580 of 902 posts
Re: Run0, a systemd based alternative to sudo, announced
#572Earlier quoted context omitted.
It's just journalctl -u apache -f, assuming your distribution calls the unit file "apache", and the last few messages of the logfile appear with systemctl status apache And you don't need to worry about "is this service rotating logs appropriately?"
The important thing for me at least isn't he `-u apache` but rather knowing that `apache` exists as one of the installed services on this box. In the old ways, that was apparent because of the presence of the log file. Granted, this isn't the problem it used to be for us, however, it would come up because we'd have our services named things like `foo-ws` and knowing that `foo-ws` existed on a given box might be trick…
`systemctl list-unit-files` is too difficult?
Re: Run0, a systemd based alternative to sudo, announced
#573I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.
I always still split up "sysadmin" from "deploy". Ephemeral setups (amongst which k8s) remove that need but introduce a big load of other stuff. Having a VPS that is managed by sysadmins (users with sudo rights, authed with keys) and on which partly overlapping "deploy" users can write to small parts and maybe do a passwordless "sudo sysctl restart fooapp" but only that, is a nice and simple setup. I manage at least…
Yes, we are moving more and more towards a system of immutable deployments.
That's good! We don't patch executable binaries these days: we just compile a new one from source, when we made a change. Similarly, more and more we just build new systems (or their images) from source, instead of mucking around with existing systems.
Re: Run0, a systemd based alternative to sudo, announced
#574I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.
NixOS may be helping multiuser make a comeback, at least it is for me and my home servers. I no longer have to containerize my apps, i can have one baremetal server with a dozen+ services, all with their own users and permissions, and i don't have to actually think about any of the separation. Plus there’s network shares. Multiple people in my home with linux PCs, each with their own slice of the NFS pie based on use…
Containerisation (either with containers or via VMs) doesn't have to be expensive.
In principle, you can have just exactly the binary (or binaries) you need in the container or VM, without having a full Linux install.
See eg Unikernels like Mirage.
Re: Run0, a systemd based alternative to sudo, announced
#575Earlier quoted context omitted.
NixOS may be helping multiuser make a comeback, at least it is for me and my home servers. I no longer have to containerize my apps, i can have one baremetal server with a dozen+ services, all with their own users and permissions, and i don't have to actually think about any of the separation. Plus there’s network shares. Multiple people in my home with linux PCs, each with their own slice of the NFS pie based on use…
> i can have one baremetal server with a dozen+ services, all with their own users and permissions I've used nixos and I don't really see how nixos is special apart from the declarative config. The same can/should be done with any distro and any config manager. And unless you were running Podman in rootless mode, the same setup applies to containers too.
Sure i could do this on debian, but like, i wont. Some software comes packaged with nice scripts to provision new users for running systemd services, but a lot do not.
For me and my home network, if the default security mode is “manage users yourself”, i chmod -R 777 on all applicable files and call it a day. Nixos lets me be lazy, as all nixos modules (that I’ve ever used) have their own user setups with minimal permissions by default
Re: Run0, a systemd based alternative to sudo, announced
#576Earlier quoted context omitted.
How would you exclude certain units from your logs? Let's say that Auditd is spamming your logs, and you just want to exclude those? Can you filter on search? How do you prevent applications from writing to Systemd at all?
I would start with `man systemd`, or maybe `journalctl —help`. If you don’t want a service to log to systemd, then don’t run it in systemd?
I think you can also configure the journal per unit right? Don't remember how exactly, at the very least you can stream logs to a different system.
There are also services which will just use their own logging convention for some reason. Honestly it's easier just to go with journalctl for everything you can.
Re: Run0, a systemd based alternative to sudo, announced
#577Earlier quoted context omitted.
squid is a http(s) proxy and pf is a firewall. They do not do the same thing.
I assumed it wasn’t doing tls interception as simply using it to allow/disallow internet traffic from various internal hosts — pf works for that also. Relayd also does a bunch of similar things and is closely integrated with pf too..
That's fair. I assumed he was using squid to filter/block ads and dodgy websites. You can also kind of do this with pf, but not as well.
Re: Run0, a systemd based alternative to sudo, announced
#578Someday systemd will going to replace Linux entirely.
Re: Run0, a systemd based alternative to sudo, announced
#579Just a side note: sudo is largely maintained by just one dude https://github.com/sudo-project/sudo/graphs/contributors
Did you expect more?
Re: Run0, a systemd based alternative to sudo, announced
#580Earlier quoted context omitted.
Ah yes I remember back when you just put the system hostname in /etc/hostname. Now we have hostnamed!
Which is now borderline impossible to tame. Google "change hostname ubuntu" and take a look at the results and comments.
I'm still trying to figure out whether I like nftables more than iptables. Both are pretty complex to manage IIRC (I've only touched nftables a couple of times though, and not recently)