xjumper84

Sure, but I never enabled them. So why did they appear?

I formated my unraid USB, reinstalled a fresh copy and booted up. I noticed a few new shares appeared - domain, iso, system - i never created these. I had docker disabled and vm's disabled, but found a file created on my cache drive that I never put there, it was in the system folder called libvirt.img Once I removed the cache drive, all the issues i've been having have gone away. The latest diagnostics file is here: nas-diagnostics-20230425-1111.zip

I'll get the most recent diagnostic of the server in the next boot and write another post there. I was going to erase the drive running the docker and recreate the thumbstick with my key for that drive. 🤞 That should stop these problems, if as you say, they're docker related. Thank you for your insight.

What do you make of the drives/array disappearing? I wasn't doing anything with the machine to warrant such a display of action. Or samba going up and down with network configs changing constantly. It all seems weird and not normal. I've been an Unraid user for more than a decade and have NEVER seen Unraid act this way. Just because I don't post in the forums doesn't make me a noob to the software.

When it last happened I couldn't create a diagnostics.zip file. The system wouldn't let me. It all wigged out with the webpage being unavailable. Examples below. At the same time the syslog filled up with errors. Also attached below. The copy of the system log that I included pictures for is included as a text file called "nas hacked.txt". Eventually, after the system became stable again, I was able to pull the diagnostic file. I only later saw the added logins/passwords after the fact when I had pulled internet from the unraid box. I'll have to copy those off another computer as they're not on here. Interested on your thoughts about what I experienced. Thank you for the help. nas-diagnostics-20230411-1513.zip nas hacked.txt

Did some more research this afternoon. It seems to attach to dockers' network bridging to allow it to run hidden (using containers not visible in the webgui) disabling docker makes the script go crazy. It also utilizes miniupnpd in Linux based routers (such as Asus) which has been proven to have a known exploit for versions under 2.0.

I was able to boot into safe mode with gui no plugins on a router with no internet access. I copied the data I really cared about and then watched the system log. It then loads a ton of users in passed, shadow and smbpasswd. Then it starts ssh, SFTP and samba and routes everything through a docker. I've disabled docker and the system goes crazy with errors. I'm at the point of erasing my USB drive (savings my key) and trying to reload Unraid fresh from there. Maybe I'll have time to do that on Thursday. I feel the best thing that's happened this week is to turn it all off.

I've got this same issue. I currently have the machine running in safemode no plugin's with webgui on an router with zero internet connection. Docker has been set to not auto start. My passwd, shadow and ntp.conf files in the /etc/ folder all have a hyphen '-' attached at the end of the name. They were created today on server boot-up. When comparing the files there are a TON of new users added that are not in my passwd and shadow files in the boot/config/ folder on my usb drive. I have noticed that the data activity that people have been posting about the avahi-daemon is not there because this machine has zero web access. I am currently backing up the data I care the most about and will completely rebuild the array as I can't figure out what is causing these very STRANGE issues, including the webgui freezing and the system log filling with these very strange connections on ipv6.

Apr 11 15:05:35 NAS kernel: IPv6: ADDRCONF(NETDEV_CHANGE): veth918626d: link becomes ready Apr 11 15:05:35 NAS kernel: docker0: port 1(veth918626d) entered blocking state Apr 11 15:05:35 NAS kernel: docker0: port 1(veth918626d) entered forwarding state Apr 11 15:05:35 NAS kernel: IPv6: ADDRCONF(NETDEV_CHANGE): docker0: link becomes ready Apr 11 15:05:35 NAS rc.docker: sabnzbd: started succesfully! Apr 11 15:05:35 NAS kernel: docker0: port 2(vethc3e9ea1) entered blocking state Apr 11 15:05:35 NAS kernel: docker0: port 2(vethc3e9ea1) entered disabled state Apr 11 15:05:35 NAS kernel: device vethc3e9ea1 entered promiscuous mode Apr 11 15:05:35 NAS kernel: docker0: port 2(vethc3e9ea1) entered blocking state Apr 11 15:05:35 NAS kernel: docker0: port 2(vethc3e9ea1) entered forwarding state Apr 11 15:05:36 NAS kernel: docker0: port 2(vethc3e9ea1) entered disabled state Apr 11 15:05:36 NAS kernel: eth0: renamed from veth0cea1bc Apr 11 15:05:36 NAS kernel: IPv6: ADDRCONF(NETDEV_CHANGE): vethc3e9ea1: link becomes ready Apr 11 15:05:36 NAS kernel: docker0: port 2(vethc3e9ea1) entered blocking state Apr 11 15:05:36 NAS kernel: docker0: port 2(vethc3e9ea1) entered forwarding state Apr 11 15:05:36 NAS rc.docker: tdarr: started succesfully! Apr 11 15:05:36 NAS kernel: docker0: port 3(veth1883d53) entered blocking state Apr 11 15:05:36 NAS kernel: docker0: port 3(veth1883d53) entered disabled state Apr 11 15:05:36 NAS kernel: device veth1883d53 entered promiscuous mode Apr 11 15:05:36 NAS kernel: docker0: port 3(veth1883d53) entered blocking state Apr 11 15:05:36 NAS kernel: docker0: port 3(veth1883d53) entered forwarding state Apr 11 15:05:36 NAS kernel: eth0: renamed from veth0c057d1 Apr 11 15:05:36 NAS kernel: IPv6: ADDRCONF(NETDEV_CHANGE): veth1883d53: link becomes ready Apr 11 15:05:37 NAS avahi-daemon[2822]: Joining mDNS multicast group on interface veth918626d.IPv6 with address fe80::c054:e2ff:fe55:e4a. Apr 11 15:05:37 NAS avahi-daemon[2822]: New relevant interface veth918626d.IPv6 for mDNS. Apr 11 15:05:37 NAS avahi-daemon[2822]: Registering new address record for fe80::c054:e2ff:fe55:e4a on veth918626d.*. Apr 11 15:05:37 NAS avahi-daemon[2822]: Joining mDNS multicast group on interface docker0.IPv6 with address fe80::42:dbff:fe85:788e. Apr 11 15:05:37 NAS avahi-daemon[2822]: New relevant interface docker0.IPv6 for mDNS. Apr 11 15:05:37 NAS avahi-daemon[2822]: Registering new address record for fe80::42:dbff:fe85:788e on docker0.*. Apr 11 15:05:38 NAS rc.docker: tdarr_node: started succesfully! Apr 11 15:05:38 NAS avahi-daemon[2822]: Joining mDNS multicast group on interface vethc3e9ea1.IPv6 with address fe80::e8f5:14ff:fe6c:a779. Apr 11 15:05:38 NAS avahi-daemon[2822]: New relevant interface vethc3e9ea1.IPv6 for mDNS. Apr 11 15:05:38 NAS avahi-daemon[2822]: Registering new address record for fe80::e8f5:14ff:fe6c:a779 on vethc3e9ea1.*. Apr 11 15:05:38 NAS avahi-daemon[2822]: Joining mDNS multicast group on interface veth1883d53.IPv6 with address fe80::f0e7:9aff:feb5:6d16. Apr 11 15:05:38 NAS avahi-daemon[2822]: New relevant interface veth1883d53.IPv6 for mDNS. Apr 11 15:05:38 NAS avahi-daemon[2822]: Registering new address record for fe80::f0e7:9aff:feb5:6d16 on veth1883d53.*. Apr 11 15:05:50 NAS nmbd[2792]: [2023/04/11 15:05:50.603129, 0] ../../source3/nmbd/nmbd_become_lmb.c:398(become_local_master_stage2) Apr 11 15:05:50 NAS nmbd[2792]: ***** Apr 11 15:05:50 NAS nmbd[2792]: Apr 11 15:05:50 NAS nmbd[2792]: Samba name server NAS is now a local master browser for workgroup WORKGROUP on subnet 192.168.0.80 Apr 11 15:05:50 NAS nmbd[2792]: Apr 11 15:05:50 NAS nmbd[2792]: ***** Apr 11 15:07:28 NAS kernel: docker0: port 1(veth918626d) entered disabled state Apr 11 15:07:28 NAS kernel: veth0651c7f: renamed from eth0 Apr 11 15:07:28 NAS avahi-daemon[2822]: Interface veth918626d.IPv6 no longer relevant for mDNS. Apr 11 15:07:28 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface veth918626d.IPv6 with address fe80::c054:e2ff:fe55:e4a. Apr 11 15:07:28 NAS kernel: docker0: port 1(veth918626d) entered disabled state Apr 11 15:07:28 NAS kernel: device veth918626d left promiscuous mode Apr 11 15:07:28 NAS kernel: docker0: port 1(veth918626d) entered disabled state Apr 11 15:07:28 NAS avahi-daemon[2822]: Withdrawing address record for fe80::c054:e2ff:fe55:e4a on veth918626d. Apr 11 15:07:30 NAS kernel: docker0: port 2(vethc3e9ea1) entered disabled state Apr 11 15:07:30 NAS kernel: veth0cea1bc: renamed from eth0 Apr 11 15:07:30 NAS avahi-daemon[2822]: Interface vethc3e9ea1.IPv6 no longer relevant for mDNS. Apr 11 15:07:30 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface vethc3e9ea1.IPv6 with address fe80::e8f5:14ff:fe6c:a779. Apr 11 15:07:30 NAS kernel: docker0: port 2(vethc3e9ea1) entered disabled state Apr 11 15:07:30 NAS kernel: device vethc3e9ea1 left promiscuous mode Apr 11 15:07:30 NAS kernel: docker0: port 2(vethc3e9ea1) entered disabled state Apr 11 15:07:30 NAS avahi-daemon[2822]: Withdrawing address record for fe80::e8f5:14ff:fe6c:a779 on vethc3e9ea1. Apr 11 15:07:31 NAS kernel: docker0: port 3(veth1883d53) entered disabled state Apr 11 15:07:31 NAS kernel: veth0c057d1: renamed from eth0 Apr 11 15:07:31 NAS avahi-daemon[2822]: Interface veth1883d53.IPv6 no longer relevant for mDNS. Apr 11 15:07:31 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface veth1883d53.IPv6 with address fe80::f0e7:9aff:feb5:6d16. Apr 11 15:07:31 NAS kernel: docker0: port 3(veth1883d53) entered disabled state Apr 11 15:07:31 NAS kernel: device veth1883d53 left promiscuous mode Apr 11 15:07:31 NAS kernel: docker0: port 3(veth1883d53) entered disabled state Apr 11 15:07:31 NAS avahi-daemon[2822]: Withdrawing address record for fe80::f0e7:9aff:feb5:6d16 on veth1883d53. Apr 11 15:10:46 NAS ntpd[1328]: kernel reports TIME_ERROR: 0x41: Clock Unsynchronized Apr 11 15:11:03 NAS nmbd[2792]: [2023/04/11 15:11:03.573821, 0] ../../source3/nmbd/nmbd_become_lmb.c:398(become_local_master_stage2) Apr 11 15:11:03 NAS nmbd[2792]: ***** Apr 11 15:11:03 NAS nmbd[2792]: Apr 11 15:11:03 NAS nmbd[2792]: Samba name server NAS is now a local master browser for workgroup WORKGROUP on subnet 172.17.0.1 Apr 11 15:11:03 NAS nmbd[2792]: Apr 11 15:11:03 NAS nmbd[2792]: ***** Apr 11 15:11:59 NAS root: ACPI action kpenter is not defined Apr 11 15:12:03 NAS root: ACPI action up is not defined Apr 11 15:12:04 NAS root: ACPI action down is not defined Apr 11 15:12:04 NAS root: ACPI action right is not defined Apr 11 15:12:04 NAS root: ACPI action up is not defined Apr 11 15:14:58 NAS emhttpd: shcmd (101): /usr/local/emhttp/webGui/scripts/update_access Apr 11 15:14:58 NAS sshd[2328]: Received signal 15; terminating. Apr 11 15:14:59 NAS emhttpd: shcmd (102): /etc/rc.d/rc.nginx reload Apr 11 15:14:59 NAS root: Checking configuration for correct syntax and Apr 11 15:14:59 NAS root: then trying to open files referenced in configuration... Apr 11 15:14:59 NAS root: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok Apr 11 15:14:59 NAS root: nginx: configuration file /etc/nginx/nginx.conf test is successful Apr 11 15:14:59 NAS root: Reloading Nginx configuration... Apr 11 15:15:00 NAS root: Fix Common Problems Version 2023.03.22 Apr 11 15:15:07 NAS webGUI: Successful login user root from 192.168.0.57 Apr 11 15:15:12 NAS root: Fix Common Problems: Warning: Docker Application Plex-Media-Server has an update available for it Apr 11 15:15:12 NAS root: Fix Common Problems: Warning: Docker Application sabnzbd has an update available for it Apr 11 15:32:34 NAS root: ACPI action kpenter is not defined Apr 11 15:38:29 NAS emhttpd: shcmd (151): smbpasswd -x temp Apr 11 15:38:29 NAS root: Failed to find entry for user temp. Apr 11 15:38:29 NAS emhttpd: shcmd (151): exit status: 1 Apr 11 15:38:29 NAS emhttpd: shcmd (152): userdel temp Apr 11 15:38:29 NAS userdel[21604]: delete user 'temp' Apr 11 15:38:29 NAS emhttpd: Starting services... Apr 11 15:38:29 NAS emhttpd: shcmd (154): /etc/rc.d/rc.samba restart Apr 11 15:38:29 NAS wsdd2[2802]: 'Terminated' signal received. Apr 11 15:38:29 NAS nmbd[2792]: [2023/04/11 15:38:29.578783, 0] ../../source3/nmbd/nmbd.c:59(terminate) Apr 11 15:38:29 NAS nmbd[2792]: Got SIGTERM: going down... Apr 11 15:38:29 NAS winbindd[2805]: [2023/04/11 15:38:29.578812, 0] ../../source3/winbindd/winbindd_dual.c:1957(winbindd_sig_term_handler) Apr 11 15:38:29 NAS winbindd[2808]: [2023/04/11 15:38:29.578829, 0] ../../source3/winbindd/winbindd_dual.c:1957(winbindd_sig_term_handler) Apr 11 15:38:29 NAS winbindd[2805]: Got sig[15] terminate (is_parent=1) Apr 11 15:38:29 NAS winbindd[2808]: Got sig[15] terminate (is_parent=0) Apr 11 15:38:29 NAS wsdd2[2802]: terminating. Apr 11 15:38:29 NAS winbindd[6121]: [2023/04/11 15:38:29.579012, 0] ../../source3/winbindd/winbindd_dual.c:1957(winbindd_sig_term_handler) Apr 11 15:38:29 NAS winbindd[6121]: Got sig[15] terminate (is_parent=0) Apr 11 15:38:31 NAS root: Starting Samba: /usr/sbin/smbd -D Apr 11 15:38:31 NAS smbd[21713]: [2023/04/11 15:38:31.794522, 0] ../../source3/smbd/server.c:1741(main) Apr 11 15:38:31 NAS smbd[21713]: smbd version 4.17.3 started. Apr 11 15:38:31 NAS smbd[21713]: Copyright Andrew Tridgell and the Samba Team 1992-2022 Apr 11 15:38:31 NAS root: /usr/sbin/nmbd -D Apr 11 15:38:31 NAS nmbd[21715]: [2023/04/11 15:38:31.811631, 0] ../../source3/nmbd/nmbd.c:901(main) Apr 11 15:38:31 NAS nmbd[21715]: nmbd version 4.17.3 started. Apr 11 15:38:31 NAS nmbd[21715]: Copyright Andrew Tridgell and the Samba Team 1992-2022 Apr 11 15:38:31 NAS root: /usr/sbin/wsdd2 -d Apr 11 15:38:31 NAS wsdd2[21729]: starting. Apr 11 15:38:31 NAS root: /usr/sbin/winbindd -D Apr 11 15:38:31 NAS winbindd[21730]: [2023/04/11 15:38:31.885357, 0] ../../source3/winbindd/winbindd.c:1440(main) Apr 11 15:38:31 NAS winbindd[21730]: winbindd version 4.17.3 started. Apr 11 15:38:31 NAS winbindd[21730]: Copyright Andrew Tridgell and the Samba Team 1992-2022 Apr 11 15:38:31 NAS winbindd[21732]: [2023/04/11 15:38:31.890641, 0] ../../source3/winbindd/winbindd_cache.c:3116(initialize_winbindd_cache) Apr 11 15:38:31 NAS winbindd[21732]: initialize_winbindd_cache: clearing cache and re-creating with version number 2 Apr 11 15:38:31 NAS emhttpd: shcmd (158): /etc/rc.d/rc.avahidaemon restart Apr 11 15:38:31 NAS root: Stopping Avahi mDNS/DNS-SD Daemon: stopped Apr 11 15:38:31 NAS avahi-daemon[2822]: Got SIGTERM, quitting. Apr 11 15:38:31 NAS avahi-dnsconfd[2831]: read(): EOF Apr 11 15:38:31 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface docker0.IPv6 with address fe80::42:dbff:fe85:788e. Apr 11 15:38:31 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface docker0.IPv4 with address 172.17.0.1. Apr 11 15:38:31 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface br0.IPv4 with address 192.168.0.80. Apr 11 15:38:31 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface lo.IPv6 with address ::1. Apr 11 15:38:31 NAS avahi-daemon[2822]: Leaving mDNS multicast group on interface lo.IPv4 with address 127.0.0.1. Apr 11 15:38:31 NAS avahi-daemon[2822]: avahi-daemon 0.8 exiting. Apr 11 15:38:32 NAS root: Starting Avahi mDNS/DNS-SD Daemon: /usr/sbin/avahi-daemon -D Apr 11 15:38:32 NAS avahi-daemon[21751]: Found user 'avahi' (UID 61) and group 'avahi' (GID 214). Apr 11 15:38:32 NAS avahi-daemon[21751]: Successfully dropped root privileges. Apr 11 15:38:32 NAS avahi-daemon[21751]: avahi-daemon 0.8 starting up. Apr 11 15:38:32 NAS avahi-daemon[21751]: Successfully called chroot(). Apr 11 15:38:32 NAS avahi-daemon[21751]: Successfully dropped remaining capabilities. Apr 11 15:38:32 NAS avahi-daemon[21751]: Loading service file /services/sftp-ssh.service. Apr 11 15:38:32 NAS avahi-daemon[21751]: Loading service file /services/smb.service. Apr 11 15:38:32 NAS avahi-daemon[21751]: Loading service file /services/ssh.service. Apr 11 15:38:32 NAS avahi-daemon[21751]: Joining mDNS multicast group on interface docker0.IPv6 with address fe80::42:dbff:fe85:788e. Apr 11 15:38:32 NAS avahi-daemon[21751]: New relevant interface docker0.IPv6 for mDNS. Apr 11 15:38:32 NAS avahi-daemon[21751]: Joining mDNS multicast group on interface docker0.IPv4 with address 172.17.0.1. Apr 11 15:38:32 NAS avahi-daemon[21751]: New relevant interface docker0.IPv4 for mDNS. Apr 11 15:38:32 NAS avahi-daemon[21751]: Joining mDNS multicast group on interface br0.IPv4 with address 192.168.0.80. Apr 11 15:38:32 NAS avahi-daemon[21751]: New relevant interface br0.IPv4 for mDNS. Apr 11 15:38:32 NAS avahi-daemon[21751]: Joining mDNS multicast group on interface lo.IPv6 with address ::1. Apr 11 15:38:32 NAS avahi-daemon[21751]: New relevant interface lo.IPv6 for mDNS. Apr 11 15:38:32 NAS avahi-daemon[21751]: Joining mDNS multicast group on interface lo.IPv4 with address 127.0.0.1. Apr 11 15:38:32 NAS avahi-daemon[21751]: New relevant interface lo.IPv4 for mDNS. Apr 11 15:38:32 NAS avahi-daemon[21751]: Network interface enumeration completed. Apr 11 15:38:32 NAS avahi-daemon[21751]: Registering new address record for fe80::42:dbff:fe85:788e on docker0.*. Apr 11 15:38:32 NAS avahi-daemon[21751]: Registering new address record for 172.17.0.1 on docker0.IPv4. Apr 11 15:38:32 NAS avahi-daemon[21751]: Registering new address record for 192.168.0.80 on br0.IPv4. Apr 11 15:38:32 NAS avahi-daemon[21751]: Registering new address record for ::1 on lo.*. Apr 11 15:38:32 NAS avahi-daemon[21751]: Registering new address record for 127.0.0.1 on lo.IPv4. Apr 11 15:38:32 NAS emhttpd: shcmd (159): /etc/rc.d/rc.avahidnsconfd restart Apr 11 15:38:32 NAS root: Stopping Avahi mDNS/DNS-SD DNS Server Configuration Daemon: stopped Apr 11 15:38:32 NAS root: Starting Avahi mDNS/DNS-SD DNS Server Configuration Daemon: /usr/sbin/avahi-dnsconfd -D Apr 11 15:38:32 NAS avahi-dnsconfd[21762]: Successfully connected to Avahi daemon. Apr 11 15:38:32 NAS emhttpd: shcmd (164): cp /etc/passwd /etc/shadow /var/lib/samba/private/smbpasswd /boot/config Apr 11 15:38:32 NAS avahi-daemon[21751]: Server startup complete. Host name is NAS.local. Local service cookie is 1342057464. Apr 11 15:38:33 NAS avahi-daemon[21751]: Service "NAS" (/services/ssh.service) successfully established. Apr 11 15:38:33 NAS avahi-daemon[21751]: Service "NAS" (/services/smb.service) successfully established. Apr 11 15:38:33 NAS avahi-daemon[21751]: Service "NAS" (/services/sftp-ssh.service) successfully established. Apr 11 15:38:54 NAS nmbd[21719]: [2023/04/11 15:38:54.853843, 0] ../../source3/nmbd/nmbd_become_lmb.c:398(become_local_master_stage2) Apr 11 15:38:54 NAS nmbd[21719]: ***** Apr 11 15:38:54 NAS nmbd[21719]: Apr 11 15:38:54 NAS nmbd[21719]: Samba name server NAS is now a local master browser for workgroup WORKGROUP on subnet 172.17.0.1 Apr 11 15:38:54 NAS nmbd[21719]: Apr 11 15:38:54 NAS nmbd[21719]: ***** Apr 11 15:38:54 NAS nmbd[21719]: [2023/04/11 15:38:54.853947, 0] ../../source3/nmbd/nmbd_become_lmb.c:398(become_local_master_stage2) Apr 11 15:38:54 NAS nmbd[21719]: ***** Apr 11 15:38:54 NAS nmbd[21719]: Apr 11 15:38:54 NAS nmbd[21719]: Samba name server NAS is now a local master browser for workgroup WORKGROUP on subnet 192.168.0.80 Apr 11 15:38:54 NAS nmbd[21719]: Apr 11 15:38:54 NAS nmbd[21719]: ***** Here is one of the log dumps where it kept changing the eth0 adapter to ipv6 and then hitting up mDNS and learning it needed a new name. Then it would reboot samba and reload the ssh, smb and sftp services.

My logs are having this problem. Found my memory use at 70% (it usually rides around 20%). Also today I observed the webgui flying through screens in main and dashboard that showed the array, then it would flip to zero drives, then some drives unmounted, then no drives, then the network name changed and the system log just kept filling up with the avahi-daemon. Ended up unplugging the network cable while I plan my next steps. Reading the system log shows the avahi-daemon starts ssh, ftp and samba, puts fix common problems on hold for 10 minutes and then sets up it's eth0 bridges across docker's and then goes to work silently doing whatever it wants. It creates a user0 share with access to all my internal shares. What have I done lately? I installed Plex media server - totally scanned all my media and no problems there. Installed tdarr and it's node and no issues there. Installed radarr and didn't complete setup. Since these issues started i have since deleted Radarr. Installed sabnzbd and it ran fine, but it needed permissions for docker to be reset, which I did. I noticed today I could only get 5mb/s down instead of the usual 200mb/s. That's when I saw the memory usage high and the syslog issues. I went into global settings and disabled ssh and ftp and that stopped the script momentarily. There was a temp account in my user account fields that I deleted, but after reboot it was back. I've got full system logs and screen caps of the weird browser functionality. As of right now, the machine is off, pulled the network cable and unplugged the USB boot drive. I looked in diagnostic logs from Feb 20 and it has the avahi-daemon there but not nearly as much activity as today. 🤔