limetech
Administrators
-
Joined
-
Last visited
Everything posted by limetech
-
New in Unraid OS 6.8 release: The unRAIDServer.plg file (update OS) still downloads the new release zip file to RAM but then extracts directly to USB flash boot device. You will probably notice a slight difference in speed of extract messages. There is still a 'sync' command at the end, which causes each device to spin up serially as Linux kernel syncs each device (why does kernel do this serially? I have no idea). I am tempted to remove this because a Reboot of course spins everything up in parallel, but I'm concerned about users out there who might just hit Reset button and USB flash write data is not fully written. Forms based authentication If you have set a root password for your server, upon boot you'll now see a nice login form. There still is only one user for Unraid so for username enter root. This form should be compatible with all major password managers out there. We always recommend using a strong password. We have auto-logout set to 1 hour. Linux kernel 5.3 default scheduler now 'mq-deadline' enabled Huge Page support, though no UI control yet binfmt_misc support added "Vega 10 Reset bug" patch more device drivers Some out-of-tree (oot) drivers are currently omitted either because the source code doesn't compile or driver doesn't work with the 5.3 kernel: Intel ixgbe [does not build] (using in-tree driver) Highpoint r750 [does not work] Highpoint rr3740a [does not build] This is always the risk with including vendor-supplied drivers. Until the vendor fixes their code we must omit their driver. md/unraid driver Introduced "multi-stream" support: Reads on devices which are not being written should run at full speed. In addition, if you have set the md_write_method tunable to "reconstruct write", then while writing, if any read streams are detected, the write method is switched to "read/modifywrite". Parity sync/check should run at full speed by default. Parity sync/check can be throttled back in presence of other active streams. The "stripe pool" resource is automatically shared evenly between all active streams. As a result got rid of some Tunables: md_sync_window md_sync_thresh and added some tunables: md_queue_limit md_sync_limit Please refer to Settings/Disk Settings help text for description of these settings. Remaining issue: some users have reported slower parity sync/check rates for very wide arrays (20+ devices) vs. 6.7 and earlier releases - we are still studying this problem. WireGuard support - available as a plugin via Community Apps. Our WireGuard implementation and UI is still a work-in-process; for this reason we have made this available as a plugin, though the latest WireGuard module is included in our Linux kernel. Full WireGuard implementation will be merged into Unraid OS itself in a future release. I want to give special thanks to @bonienl who wrote the plugin with lots of guidance from @ljm42 - thank you! I also should give a shout out to @NAS who got us rolling on this. If you don't know about WireGuard it's something to look into! Guide here: WS-Discovery support - Finally you can get rid of SMBv1 and get reliable Windows network discovery. This feature is configured on the Settings/SMB Settings page and enabled by default. Also on same settings page is Enable NetBIOS setting. This is enabled by default, however if you no longer have need for NetBIOS discovery you can turn it off. When turned off, Samba is configured to accept only SMBv2 protocol and higher. Added mDNS client support in Unraid OS. This means, for example, from an Unraid OS terminal session to ping another Unraid OS server on your network you can use (e.g., 'tower'): ping tower.local instead of ping tower Note the latter will still work if you have NetBIOS enabled. User Share File System (shfs) changes: Integrated FUSE-3 - This should increase performance of User Share File System somewhat. Fixed bug with hard link support. Previously a 'stat' on two directory entries referring to same file would return different i-node numbers, thus making it look like two independent files. This has been fixed however there is a config setting on Settings/Global Share Settings called "Tunable (support hard links)". The default is Yes, but with certain very old media and DVD players which access shares via NFS, you may need to set this to No. Note: if you have custom config/extra.cfg file, get rid of it. Other improvements/bug fixes: Format - during Format any running parity sync/check is automatically Paused and then resumed upon Format completion. Encryption - an entered passphrase is not saved to any file. Also included an API for Unassigned devices plugin to open encrypted volumes. Fixed bug where multi-device btrfs pool was leaving metadata set to dup instead of raid1. Several other small bug fixes and improvements. Numerous base package updates. Finally - please note that AFP is now deprecated and we plan to remove in Unraid 6.9 release. Version 6.8.0-rc1 2019-10-11 Base distro: aaa_elflibs: version 15.0 build 11 acpid: version 2.0.32 at-spi2-atk: version 2.34.0 at-spi2-core: version 2.34.0 atk: version 2.34.1 bash: version 5.0.011 btrfs-progs: version 5.2.2 bzip2: version 1.0.8 ca-certificates: version 20190826 cifs-utils: version 6.9 cryptsetup: version 2.2.1 curl: version 7.66.0 dbus: version 1.12.16 dbus-glib: version 0.110 dhcpcd: version 8.0.6 docker: version 19.03.3 e2fsprogs: version 1.45.4 encodings: version 1.0.5 etc: version 15.0 ethtool: version 5.3 expat: version 2.2.9 file: version 5.37 findutils: version 4.7.0 freetype: version 2.10.1 fuse3: version 3.6.2 gdbm: version 1.18.1 gdk-pixbuf2: version 2.38.2 git: version 2.23.0 glib2: version 2.62.0 glibc-solibs: version 2.30 glibc-zoneinfo: version 2019c glibc: version 2.30 glu: version 9.0.1 gnutls: version 3.6.10 gtk+3: version 3.24.10 harfbuzz: version 2.6.0 haveged: version 1.9.8 hostname: version 3.22 hwloc: version 1.11.13 icu4c: version 64.2 intel-microcode: version 20190918 iproute2: version 5.3.0 iptables: version 1.8.3 iputils: version 20190709 irqbalance: version 1.6.0 less: version 551 libICE: version 1.0.10 libX11: version 1.6.8 libXi: version 1.7.10 libXt: version 1.2.0 libarchive: version 3.4.0 libcap-ng: version 0.7.10 libcroco: version 0.6.13 libdrm: version 2.4.99 libedit: version 20190324_3.1 libevdev: version 1.7.0 libevent: version 2.1.11 libgcrypt: version 1.8.5 libgudev: version 233 libjpeg-turbo: version 2.0.3 libnftnl: version 1.1.4 libnl3: version 3.5.0 libpcap: version 1.9.1 libpciaccess: version 0.16 libpng: version 1.6.37 libpsl: version 0.21.0 librsvg: version 2.44.14 libseccomp: version 2.4.1 libssh2: version 1.9.0 libtasn1: version 4.14 libusb: version 1.0.23 libvirt-php: version 0.5.5 libvirt: version 5.7.0 (CVE-2019-10161, CVE-2019-10166, CVE-2019-10167, CVE-2019-10168) libwebp: version 1.0.3 libzip: version 1.5.2 logrotate: version 3.15.1 lsof: version 4.93.2 lsscsi: version 0.30 lvm2: version 2.03.05 lz4: version 1.9.1 mkfontscale: version 1.2.1 mozilla-firefox: version 68.0.2 (CVE-2019-11751, CVE-2019-11746, CVE-2019-11744, CVE-2019-11742, CVE-2019-11736, CVE-2019-11753, CVE-2019-11752, CVE-2019-9812, CVE-2019-11741, CVE-2019-11743, CVE-2019-11748, CVE-2019-11749, CVE-2019-5849, CVE-2019-11750, CVE-2019-11737, CVE-2019-11738, CVE-2019-11747, CVE-2019-11734, CVE-2019-11735, CVE-2019-11740, CVE-2019-11754, CVE-2019-9811, CVE-2019-11711, CVE-2019-11712, CVE-2019-11713, CVE-2019-11714, CVE-2019-11729, CVE-2019-11715, CVE-2019-11716, CVE-2019-11717, CVE-2019-1 1718, CVE-2019-11719, CVE-2019-11720, CVE-2019-11721, CVE-2019-11730, CVE-2019-11723, CVE-2019-11724, CVE-2019-11725, CVE-2019-11727, CVE-2019-11728, CVE-2019-11710, CVE-2019-11709) nano: version 4.5 ncurses: version 6.1_20190720 net-tools: version 20181103_0eebece nettle: version 3.5.1 nghttp2: version 1.39.2 nginx: version 1.16.1 (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516) nodejs: version 10.16.3 nss-mdns: version 0.14.1 ntp: version 4.2.8p13 openldap-client: version 2.4.48 openssh: version 8.0p1 openssl-solibs: version 1.1.1d openssl: version 1.1.1d p11-kit: version 0.23.18.1 pcre2: version 10.33 php: version 7.2.23 (CVE-2019-11042, CVE-2019-11041) pixman: version 0.38.4 pkgtools: version 15.0 procps-ng: version 3.3.15 qemu: version 4.1.0 (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091) qrencode: version 4.0.2 rpcbind: version 1.2.5 rsyslog: version 8.1908.0 samba: version 4.10.8 (CVE-2019-10197) sdparm: version 1.10 sessreg: version 1.1.2 setxkbmap: version 1.3.2 sg3_utils: version 1.44 shadow: version 4.7 shared-mime-info: version 1.12 sqlite: version 3.29.0 sysvinit-scripts: version 2.1 sysvinit: version 2.96 talloc: version 2.3.0 tdb: version 1.4.2 tevent: version 0.10.1 ttyd: version 1.5.2 usbutils: version 012 util-linux: version 2.34 wget: version 1.20.3 wireguard: version 0.0.20190913 wsdd: version 20180618 build 2 xauth: version 1.1 xclock: version 1.0.9 xfsprogs: version 5.2.1 xkeyboard-config: version 2.27 xorg-server: version 1.20.5 xrandr: version 1.5.1 xterm: version 348 xwininfo: version 1.1.5 zstd: version 1.4.3 Linux kernel: version 5.3.6 default scheduler now mq-deadline CONFIG_BINFMT_MISC: Kernel support for MISC binaries CONFIG_DEBUG_FS: Debug Filesystem CONFIG_HUGETLBFS: HugeTLB file system support CONFIG_ICE: Intel(R) Ethernet Connection E800 Series Support CONFIG_IGC: Intel(R) Ethernet Controller I225-LM/I225-V support CONFIG_MLX5_CORE_IPOIB: Mellanox 5th generation network adapters (connectX series) IPoIB offloads support CONFIG_SCSI_SMARTPQI: Microsemi PQI Driver CONFIG_WIREGUARD: IP: WireGuard secure network tunnel patch: fix_vega_reset (user request) patch: increase BLK_MAX_REQUEST_COUNT from 16 to 32 oot: LimeTech md/unraid: version 2.9.10 (multi-stream support) oot: Highpoint rsnvme: version v1.2.16_19_05_06 oot: Tehuti tn40xx: version 0.3.6.17.2 oot: omitted: Intel ixgbe [does not build] (using in-tree driver) oot: omitted: Highpoint r750 [does not work] oot: omitted: Highpoint rr3740a [does not build] Management: fix btrfs bug where converting from single to multiple pool did not balance metadata to raid1, and converting from multiple to single did not balance metadata back to single. auto-mount hugetlbfs to support kernel huge pages emhttpd: do not write /root/keyfile if encryption passphrase provided via webGUI fstab: mount USB flash boot device with root-only access nginx.conf: configure all nginx worker threads to run as 'root'. start/stop WireGuard upon server start/shutdown support forms-based authentication shfs: support FUSE3 API changes; hard links report same st_ino; hard link support configurable support disabling NetBIOS, and set Samba 'min server procotol' and 'min client protocol' to SMB2 if disabled support WS-Discovery method support mDNS local name resolution via avahi extract OS upgrade directly to USB flash webgui: Revamp Banner Warning System webgui: Fix custom case png not surviving reboot webgui: Enhanced display of network settings webgui: Open banner system to 3rd party apps webgui: Modified notify script to allow overriding email recipients in notification settings webgui: Allow Safari to use websockets webgui: Select case correction + replace MD1510 for AVS-10/4 webgui: Font, Icon and image cleanup webgui: Added AFP deprecated notice webgui: Changed config folder of TELEGRAM webgui: Add share access to user edit webgui: Added cache and disk type to shares page webgui: Aligned management page layout webgui: Added conditional UPnP setting on Management page webgui: Support wireguard plugin in download.php webgui: Added UPnP to access script (to support WireGuard plugin) webgui: Made notify script compatible with 6.8 new security scheme webgui: Fixed misalignment of absent disk on Main page webgui: Update ArrayDevices.page help text webgui: show warning on login page when browser cookies are disabled webgui: Fixed docker container update state webgui: Added VM XML files to diagnostics webgui: Telegram notification agent: enable group chat IDs, update helper description webgui: Integrate CAs Plugin Helper webgui: Switch download routine to be PHP Curl webgui: Change PluginHelpers download to be PHP Curl webgui: dockerMan - Deprecate TemplateURL webgui: Fixed: footer always on foreground webgui: Plugin Helpers: Follow redirects on downloads webgui: dockerMan: Redownload Icon if URL changes webgui: If a page is loaded via https, prevent it from loading resources via http (ie, block mixed content) webgui: Ensure spinner always ontop webgui: Allow outside click to close popups webgui: Use complete HTML documents in popups webgui: Standardize on lang="en" webgui: Added 'F1' key to toggle help text webgui: Main page: consolidate spin up/down action and device status into one webgui: support changed tunables on Disk Settings page
-
It's not written to any permanent storage, it's written to a file in the root file system which is in RAM. Your "secret password" is only to decrypt the drives - even if the password were leaked somehow they still need the physical drives to make use of it. You'll first have to teach her to hack your root login password in order to get into your server. As @bonienl mentioned in above post we have made some changes so that casual user doesn't accidentally leave a keyfile laying around. These will appear in Unraid OS 6.8 release. In meantime, click that 'Delete' button after Starting array and, I'm done talking with you.
-
You think I don't know that? That handles passphrases but not actual key-files. Besides the plaintext is sitting around in RAM in other places too, eg, in network stack buffers.
-
First a great deal of thought, design, and effort went into the Unraid OS encryption feature. However we do think there are improvements we should make in the interest of securing the server as much as possible. To clear some things up: If you use a passphrase, whatever you type is written to /root/keyfile If you upload a key file, the contents of that file are written to /root/keyfile Hence we always pass "--key-file=/root/keyfile" to cryptsetup when opening encrypted volumes. The Delete button action is to delete /root/keyfile. I can see where this leads to confusion in the UI. /root/keyfile is definitely not automatically recreated up system boot, but it is needed every time you Start the array if there are encrypted volumes. You only see the passphrase/keyfile entry fields if /root/keyfile does not exist, which is the case upon reboot. The default action, after luksOpen'ing all the encrypted volumes is to leave /root/keyfile present. This is because often, especially during initial configuration, one might Start/Stop array several times and it's a pain in the neck to have to type that passphrase each time. At present unlike traditional Linux distros, Unraid OS is essentially a single-user system (root) on a trusted LAN (your home). Thus we didn't think there was much risk in leaving /root/keyfile present, and besides there is a way to delete it, though granted you have to remember to do so. The primary purpose of encryption is to safeguard against physical theft of the storage devices. Someone who does this is not going to know to first snoop in a webGUI and find an encryption key - they are going to grab the case and run. Each storage device has its own unique volume (master) key. The keyfile is used to decrypt this master key, and its the master key that is actually used to encrypt/decrypt the data. Unraid uses only one of possible 8 slots. We intend to add the ability to assign additional passphrases, for example to change your passphrase, or to add another one if you want to give someone else a storage device and not reveal your unique passphrase. But of course this is very easily done with a simple command. Having read through the topic, we will make these changes: Change the default action of array Start to shred /root/keyfile after opening all the encrypted volumes. Add an additional configuration variable, probably under Settings/Disk Settings to change this default action if someone wants to, with clearer help text that explains what's happening (though the current Help text does explain it). Add the ability to change the passphrase.
-
Locking this topic until I can finish reading through it.
-
Thanks for the 'heads up'. "Catalina" not released yet right? Could be it works upon release or could be we'll need to make a change.
-
9/17/2019 Update: may have got to the bottom of this. Please try 6.7.3-rc3 available on the next branch. 9/18/2019 Update: 6.7.3-rc4 is available to address Very Slow Array Concurrent Performance. re: Trying to get to the bottom of this... First we have not been able to reproduce, which is odd because it implies there may be some kind of hardware/driver dependency with this issue. Nevertheless I want to start a series of tests, which I know will be painful for some since every time DB corruption occurs, you have to go through lengthy rebuild process. That said, we would really appreciate anyone's input during this time. The idea is that we are only going to change one thing at a time. We can either start with 6.6.7 and start updating stuff until it breaks, or we can start with 6.7.2 and revert stuff until it's fixed. Since my best guess at this point is that the issue is either with Linux kernel, docker, or something we have misconfigured (not one of a hundred other packages we updated), we are going to start with 6.7.2 code base and see if we can make it work. But actually, the first stab at this is not reverting anything, but rather first updating the Linux kernel to the latest 4.19 patch release which is 4.19.60 (6.7.2 uses kernel 4.19.55). In skimming the kernel change logs, nothing jumps out as a possible fix, however I want to first try the easiest and least impactful change: update to latest 4.19 kernel. If this does not solve the problem (which I expect it won't), then we have two choices: 1) update to latest Linux stable kernel (5.2.2) - we are using 5.2 kernel in Unraid 6.8-beta and so far no one has reported any sqlite DB corruption, though the sample set is pretty small. The downside with this is, not all out-of-tree drivers yet build with 5.2 kernel and so some functionality would be lost. 2) downgrade docker from 18.09.06 (version in 6.7.2) to 18.06.03-ce (version in 6.6.7). [BTW the latest Docker release 19.03.00 was just published today - people gripe about our release numbers, try making sense of Docker release numbers haha] If neither of those steps succeed then ... well let's hope one of them does succeed. To get started, first make a backup of your flash via Main/Flash/Flash Backup, and then switch to the 'next' branch via Tools/Upgrade OS page. There you should see version 6.7.3-rc1 As soon as a couple people report corruption I'll publish an -rc2, probably with reverted Docker.
-
Thank you for your order. You key was sent immediately following order. We also received "Delivery status notification (failure) - Address not found". Please send request via email using a different email address to [email protected] (do not post email address here on forum).
-
There may be some movement on finding a solution: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1832383/comments/16 The way bug fixes work in Linux is that they always 'patch' the latest/current development release. Then if fix is verified to work, the various Linux maintainers back-port the patch to earlier supported kernels. We'll keep an eye on this.
-
Yes, sorry my mistake. Those on 'next' should now see the update.
-
Tools/Diagnostics
-
Please post diagnostics.zip from Tools/Diagnostics.
-
It's easy to miss nuance of mood in forum posts, both in people "complaining" and in people responding to "complaints". Everyone should try and keep that in mind. The fix will be available soon, let's just give this a rest please.
-
That's expected if running in 'safe mode'. This is a browser cache issue. Not sure why clearing your browser cache didn't fix it.
-
Try clearing your browser cache.
-
The world's not perfect and we try not to break things but sometimes it happens, eg when I broke the Disk Location plugin - who would've thought a plugin out there used sqlite? Anyway this particular issue (nvidia driver) is probably not related to any code that got updated.
-
The only change from 6.7.1 to 6.7.2 that could affect this is kernel patch release from 4.19.55 to 4.19.56, and it doesn't appear like anything in that change log would account for suddenly nvidia driver not working. A possibility is usb boot flash corruption. Edit: sorry should've realized what the plugin was doing. Yes that has to be separately updated. Nothing can be diagnosed unless you post diagnostics (Tools/Diagnostics) captured at the time the issue presents itself. Edit: above still applies (needing diags) to troubleshoot other issues.
-
Sounds like a config file got corrupted (probably config/ident.cfg). Did you make a backup of your USB flash boot device before upgrading? Main/Flash/Flash Backup
-
No, sqlite package was added back to 'bzroot' and php rebuilt to include sqlite support. Kernel was updated because this new patch release was published today.
-
@olehj should be happy Added link in OP to SQLite DB Corruption bug report.
-
6.6.7 is available on our Download page
-
This is continuation of this original issue report. There is some conflicting information in that topic and, therefore, with your help, we want to try and get to the bottom of this. We have several test servers running trying to reproduce this problem, so far hasn't happened. The first thing we want to definitively establish is whether the problem is isolated to only those cases where /config inside the container is mapped to: /mnt/user/appdata vs. /mnt/cache/appdata or /mnt/diskN/appdata Note: it does not matter what the "Default appdata storage location" is set to on Settings/Docker page. Of interest is the actual path used by an individual container. What I'd like to ask is this: For those of you who have seen this DB corruption occur after updating from Unraid 6.6.x to 6.7.x, please note the placement of your 'appdata' folder and how it's mapped to your problematic container. Then update to 6.7.2 and run normally until you see corruption. At that point, please capture diagnostics and report how appdata is being mapped. If this is a huge PITA for you, then bow out of this testing - we are not trying to cause big disruptions for you. Finally I want to make clear: we are not "blaming" this issue on any other component, h/w or s/w, and also not "admitting" this is our problem. We have not changed any code we're responsible for that would account for this, which doesn't mean we don't have a bug somewhere - probably we do, and a change in the kernel or some other component might simply be exposing some long hidden issue. We are only interested in identifying and fixing the problem.
-
To upgrade: If you are running any 6.4 or later release, click 'Check for Updates' on the Tools/Update OS page. If you are running a pre-6.4 release, click 'Check for Updates' on the Plugins page. If the above doesn't work, navigate to Plugins/Install Plugin, select/copy/paste this plugin URL and click Install: https://s3.amazonaws.com/dnld.lime-technology.com/stable/unRAIDServer.plg Refer also to @ljm42 excellent 6.4 Update Notes which are helpful especially if you are upgrading from a pre-6.4 release. Bugs: If you discover a bug or other issue in this release, please open a Stable Releases Bug Report. We restored PHP/SQLite support and updated the kernel-firmware package. We are also still trying to track down the source of SQLite Database corruption. It will also be very helpful for those affected by this issue to also upgrade to this release. If you have issues with SQLite DB corruption, please post in this separate Bug Report. Version 6.7.2 2019-06-25 Base distro: kernel-firmware: version 20190620_7ae3a09 php version: 7.2.19 (restore sqlite support) sqlite version: 3.28.0 Linux kernel: version: 4.19.56
-
You can try adding this to your selected syslinux boot line (add to end of 'append'): intel_iommu=pt For example, append initrd=/bzroot,/bzroot-gui intel_iommu=pt
-
You guys please settle down. The fact that sqlite support was in php in the first place was an oversight. We never intended that a plugin would utilize a database application and honestly, I didn't know about this one. Seems to me using sqlite for something like this is a bit overkill ... but oh well, we'll add it back once we figure out wtf is wrong with plex/sqlite db corruption. This is correct. Also correct it should have nothing to do with the issue. But seems like it's more than just "a few users" though which is why we're tying what we can, as fast as we can, to get to the bottom of it. Please no more beating. Sure in an ideal world it maybe should have been a beta/rc/whatever but there are other significant security patches which need to be distributed to the user base. As for breaking this plugin, all I can say is "oops".
