danioj

I feel like I'm missing something REALLY simple You're not. I know what the issue is. Sent a PM but you haven't seen it so Ill just post it here. Switch the Container to Bridge Mode in the Docker Tab. Add an additional port (e.g. 1194 UDP), call it whatever you want. Then hit save. Then it will work. The connectivity issue has to do with the Container running in Host Mode. I am going to co-ordinate some changes to the guidance centrally. Its a bit of pain as it was originally setup to run in Bridge Mode but was changed (due to issues experienced by users) to run as Host. Now it appears it has to go back again. Yet...post 3 or so says things NEED to be HOST and PRIVILEGED I understand, we shall clear the guidance up as required. Just trust me, give it a go. I'm 99.9% sure this is the issue ....

I feel like I'm missing something REALLY simple You're not. I know what the issue is. Sent a PM but you haven't seen it so Ill just post it here. Switch the Container to Bridge Mode in the Docker Tab. Add an additional port (e.g. 1194 UDP), call it whatever you want. Then hit save. Then it will work. The connectivity issue has to do with the Container running in Host Mode. I am going to co-ordinate some changes to the guidance centrally. Its a bit of pain as it was originally setup to run in Bridge Mode but was changed (due to issues experienced by users) to run as Host. Now it appears it has to go back again.

Thanks! I have been using linux for years, but never really played with Docker. I was under the impression that it was connecting to the LDAP server in unRAID (unRAID is using LDAP, right???) Wow - what a nice quote I made I just noticed that you couldn't connect to the interfaces of the Container either. Im watching the video. Inspired by your video my friend, I am producing a small video myself which walks you through how to set this up! Standby!

Thanks! I have been using linux for years, but never really played with Docker. I was under the impression that it was connecting to the LDAP server in unRAID (unRAID is using LDAP, right???) Wow - what a nice quote I made I just noticed that you couldn't connect to the interfaces of the Container either. Im watching the video.

Hi mate and welcome to unRAID. I think you have the wrong end of the stick. The user system in unRAID has no relationship with the user system within the OpenVPN-AS Container. I am not sure how familiar you are with Docker Containers, but (as I don't have a heap of time) you can think of them as mini sandboxed linux installations. In that the Container has its own little filesystem, user control etc etc and does not communicate with unRAID OS (well thats technically wrong, but it gets my point across). This is why you map paths / network ports between unRAID and each Container. unRAID users are for user shares etc IF you enable security in unRAID. The root user is still required to log into the console or the webGUI (if you set a password). Therefore, you NEED to change the admin password and add a user [glow=red,2,300]in the container[/glow] via the command line as follows: command: docker exec -it openvpn-as passwd admin sample output: root@main:~# docker exec -it openvpn-as passwd admin Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully root@main:~# command: docker exec -it openvpn-as adduser newuser sample output: root@main:~# docker exec -it openvpn-as adduser newuser Adding user `newuser' ... Adding new group `newuser' (1004) ... Adding new user `newuser' (1004) with group `newuser' ... Creating home directory `/home/newuser' ... Copying files from `/etc/skel' ... Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully Changing the user information for newuser Enter the new value, or press ENTER for the default Full Name []: Room Number []: Work Phone []: Home Phone []: Other []: Is the information correct? [Y/n] Y root@main:~# Then you can access the OpenVPN-AS GUI's (as specified in your setup) using admin to begin with (and then as I do, specify the user you've just added as an admin user) and configure as required. Remember, it is because of the above that each time the Container is updated / re installed etc that this will have to be re-done. EDIT: if you accidentally add a user called "newuser" (rather than specifying a username of your choice) via a copy and paste of the above, use this to remove it: sample command: docker exec -it openvpn-as deluser newuser sample output: root@main:~# docker exec -it openvpn-as deluser newuser Removing user `newuser' ... Warning: group `newuser' has no more members. Done. root@main:~#

Am i off ignore? lol.. no sense in typing an actual reply if i am. @superderpbro While I appreciate your right to an opinion (however much I disagree with it - as well as your attitude to towards my friend who was just trying to help you) what I don't appreciate is you spamming the thread.. I (like many others) have this thread on "notify" so I can help those with issues (if it's in my ability to do so). Receiving that notification and taking the time to open up the thread to read / respond only to see 1 emoticon is ..... frustrating.

Point 1: I am implementing this now. Point 2: I give an option (albeit with a logging issue until now) to restart a vm after a backup. You can specify this in the options. But so I understand you want this: - if vm is started and option to restart is set then start - if vm is NOT started and option to restart is set then DONT start (because it wasn't started to begin with)? Yes, exactly: 1a - start VM after backup - yes/no 1b - if 1a is yes, only start VM if VM previously on - yes/no Thanks for looking into this NP. Easy to implement. Tested and seems to be working ok. Just working on getting the function to only keep backups of a certain age. Want to make sure I get this right as I am deleting files. For those who are keeping watch, am implementing system whereby backups of # days old are kept not # of backups. E.g.: If backup_days_to_keep = 3 then backups of 3 days and younger will be kept. Anything older will be deleted. Some restrictions: - Only works when timestamp switch is also enabled. - Only works with files which match script time stamping format. - Only executes on a successful backup. - Will ensure there is always at least 1 backup remaining. Meaning (as per example above) create as many #'s of backups and if they are younger than 3 days they will all be left alone. As soon as they are older they will all be deleted. I like this method better than just defining number of backups to keep.

Point 1: I am implementing this now. Point 2: I give an option (albeit with a logging issue until now) to restart a vm after a backup. You can specify this in the options. But so I understand you want this: - if vm is started and option to restart is set then start - if vm is NOT started and option to restart is set then DONT start (because it wasn't started to begin with)?

Captured this. This was a typo error in the logging.

I wanted to put some real thought into this reply, hence the delay. Not sure how that has worked though, given I am replying in the hotel bar I think what I have teased out here is a new requirement. I understand that access the webgui is seen as an administrative task. However, I access the webgui regularly for information only. I see this access as non administrative. As a result I don't want to store my server "root" credentials in my browser NOR do I want to type them in every time I want check some information in the webgui. I think what I am looking for is an unRAID webgui "Information View" - much like dd-wrt has (for those who are familiar) - without the raised privileges of root. I believe there is a usecase here that is not limited to just me. I have taken note of my behaviour over the last few days (which I think represents my typical behaviour) and the amount of times I access the webgui WITHOUT performing administrative tasks (i.e. for information / status only) is almost 95 (information)/5 (action)% split. This means that under the current design I am elevating myself to root when I really have no need to. Obviously this comes down to definitions of what information you consider to be "administrative only" but IMHO status of disks, reads/writes, docker status, vm status and the like etc is safe enough to expose without elevating to root OR at least give me an option to (like dd-wrt). I will think about this some more and will work on articulating this requirement (and now I read my dd-wrt comparison, I feel like I have mentioned this before - but can't remember the link) as per LT's guidance on doing so. P.S. Both replies so far have mentioned root access to shares. I am familiar with this design / restriction. This is not about shares.

Sorry for the delays guys. I've been working interstate past couple of weeks and am in Sydney now. I have a new version running on my servers at home. If they have run without error when I get back I shall upload. I think I've ironed out much of the remaining bugs.

Given the lack of search results I started to think that would be the case. Nice to have it confirmed. Guess I'll have to save the root user and password combo in Safari for quick access. Good note re root user and shares for others who stumble on the post and don't know. Thanks for the quick response, I appreciate it.

I'm sure this has been answered before but a few searches have not shown me any results. I've just had a significant security event which has led me to address my policy of "trusting" the LAN and clients on the LAN. As a result I am adding users, securing shares etc. One question I have relates to the root user. Principally I was always taught never to use root. I never bothered before because I only used it to telnet into the sever. However now I find myself typing it in to access the GUI and it just "feels" wrong. Anyway, my question is, can I grant WebGUI access to a different user account? If so, how is this achieved? Just adding that user to a group (didn't want to guess just in case I wreck something)? Thanks in advance! [emoji4] Sent from my iPhone using Tapatalk

^^^ * Bump! *

Yes, v2.0.3 is under the App Store submission process. Hopefully later today they will ready it for release Somehow I made a mistake in the initial submission, which distributed an older build, thus the issues. As soon as this release is stable, I will look into alternative update services (given the app is based on React Native) About the price, yes it seems expensive (7.99 AUD ~ 6.10 USD). The original price is 4.99 USD, which doesn't seem too unreasonable, but the App Store sets the price for other markets. I wonder if it's applying taxes ? It's 4.99 EUR as well Thanks for the quick reply. Bloody Australia! We always pay more for stuff "down under". Like I said, I've seen what you've done with developing and supporting unBalance and with that alone I was happy to pay for the app. Even now, when I haven't even been able to use it yet, I'm sure I am going to be happy!

iOS v: 9.3.5 Phone: iPhone 6 App v: 2.02 I read the thread 5 mins ago over my morning coffee and without skipping a beat I went to the App Store and purchased the app. $7.99 (AUD) is usually more than I care to pay for apps but I figure I owe you as a contribution to unBalanace anyway! Saying that, I can't get the app to work. I cannot add a server. I tried automated discovery first. It scans each IP until it gets to my first unRAID server and then hangs. See pic. Then I tried manually adding the server. Unfortunately that doesn't work either. The keyboard eventually raises (after a few taps) but then I can't enter anything in any box. All that happens is that an error comes up asking me to enter a valid IP address. Which given nothing is entering into the text box, I can't. See pic. For each issue I've tried to kill the app and restart. Even tried a fresh install. Nothing is working. I thought I had to stay on iOS v9.3.5 because of a compatibility issue with a work app but a fix is coming out today for that so I'm upgrading to iOS10 now. Don't know if that will fix it. Sent from my iPhone using Tapatalk Just re-read the post I replied to initially. v2.03 is the fix. It must not be in the AppStore yet. Will wait. Sorry for jumping the gun with a defect report. Sent from my iPhone using Tapatalk

iOS v: 9.3.5 Phone: iPhone 6 App v: 2.02 I read the thread 5 mins ago over my morning coffee and without skipping a beat I went to the App Store and purchased the app. $7.99 (AUD) is usually more than I care to pay for apps but I figure I owe you as a contribution to unBalanace anyway! Saying that, I can't get the app to work. I cannot add a server. I tried automated discovery first. It scans each IP until it gets to my first unRAID server and then hangs. See pic. Then I tried manually adding the server. Unfortunately that doesn't work either. The keyboard eventually raises (after a few taps) but then I can't enter anything in any box. All that happens is that an error comes up asking me to enter a valid IP address. Which given nothing is entering into the text box, I can't. See pic. For each issue I've tried to kill the app and restart. Even tried a fresh install. Nothing is working. I thought I had to stay on iOS v9.3.5 because of a compatibility issue with a work app but a fix is coming out today for that so I'm upgrading to iOS10 now. Don't know if that will fix it. Sent from my iPhone using Tapatalk

I hope I am not being stupid here, but I am trying to install the CalibreServer container and I cannot get it running. I am running 6.2 RC5. My other settings are: Host Port 1: Container Port: 5060 Host Path 2: Container Path: /mnt/user/nas/Books/ Host Path 3: Container Path: /mnt/user/downloads/complete/books/ Key 1: Container Variable: user Key 2: Container Variable: password I can't see what I am doing wrong. Any help would be appreciated. Here is the log snippet: *** Running /etc/my_init.d/00_regen_ssh_host_keys.sh... No SSH host key available. Generating one... Creating SSH2 RSA key; this may take some time ... Creating SSH2 DSA key; this may take some time ... Creating SSH2 ECDSA key; this may take some time ... Creating SSH2 ED25519 key; this may take some time ... invoke-rc.d: policy-rc.d denied execution of restart. *** Running /etc/my_init.d/firstrun.sh... Installing Clean - Apply any Custom Edits 2016-09-15 23:52:15 URL:https://raw.githubusercontent.com/kovidgoyal/calibre/master/setup/linux-installer.py [26007/26007] -> "-" [1] Traceback (most recent call last): File "<string>", line 1, in <module> File "<string>", line 673, in main File "<string>", line 658, in run_installer File "<string>", line 634, in download_and_extract File "/usr/lib/python2.7/shutil.py", line 256, in rmtree onerror(os.rmdir, path, sys.exc_info()) File "/usr/lib/python2.7/shutil.py", line 254, in rmtree os.rmdir(path) OSError: [Errno 16] Device or resource busy: '/opt/calibre' Installing to /opt/calibre Downloading tarball signature securely... Will download and install calibre-2.67.0-x86_64.txz Downloading calibre-2.67.0-x86_64.txz Downloaded 5.003515% Downloaded 10.007029% Downloaded 15.010544% Downloaded 20.014059% Downloaded 25.017574% Downloaded 30.021088% Downloaded 35.024603% Downloaded 40.028118% Downloaded 45.031632% Downloaded 50.035147% Downloaded 55.038662% Downloaded 60.042176% Downloaded 65.045691% Downloaded 70.049206% Downloaded 75.052721% Downloaded 80.056235% Downloaded 85.059750% Downloaded 90.063265% Downloaded 95.066779% Downloaded 62542916 bytes Checking downloaded file integrity... cp: cannot stat ‘/downloads/calibre-edits/calibre/resources/content_server’: No such file or directory /etc/my_init.d/firstrun.sh: line 12: /opt/calibre/calibre-server: No such file or directory Defining Cron job from crons.conf /opt/calibre/crons.conf: No such file or directory Launching Cron e /etc/my_init.d/firstrun.sh: line 23: /opt/calibre/calibredb: No such file or directory *** Running /etc/rc.local... *** Booting runit daemon... *** Runit started as PID 111 /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/crond.pid, otherpid may be 107: Resource temporarily unavailable /usr/sbin/cron: can't lock /var/run/cron

Thanks. Excellent suggestion. I will probably use the rsync switch.

Would you like to see only one maintained or a simple switch which allows you to choose how many you can keep?

Isn't that the switch to "enable" multi core support for certain versions of par2? Without getting too technical about it, I guess the root of my question is - if it's enabled by default in this container, what would you need that switch for? Sent from my iPhone using Tapatalk

I don't believe that this option in sabnzbd is indicative of multi-core par2 being installed. I know that sounds weird but my understanding (and I might be wrong) is that sabnzbd has no idea whether it is or not as all it can see is par2. I checked with the group and it doesn't appear you have to do anything else to enable it. The container is configured to use multicore par2 by default. If you wanted "proof" for yourself I guess downloading a large corrupt download then when repairing you could use the "top" command and if there is more than one instance I guess that would be reasonable enough proof that more than one core is being used. I guess if I'm wrong someone will correct me!! [emoji4] Sent from my iPhone using Tapatalk

That looks great!

I did some work on this yesterday. I found a number of bugs based on the comments that have been made to date. I am putting together an update.

As the description indicates, every time you update / reinstall the container you have to reset the password. As a reminder, you do this from the Cli. docker exec -it openvpn-as passwd admin Also, you will have to re-add any uses you use beyond admin too. docker exec -it openvpn-as adduser <user> Nice and quick though!! Isn't this a huge security risk? Sent from my iPhone using Tapatalk If your question is in relation to local Cli access @CHBMB is spot on. A quick forum search will show you how to enable SSH (which in itself offers more security than Telnet), use of certificate keys for logging on and even disabling Telnet via a script in your go file. SSH is standard with unRAID in v6. Here is the post I keep in my notes for this: https://lime-technology.com/forum/index.php?topic=35107.0 For disabling Telnet you have to edit your Go file: http://lime-technology.com/forum/index.php?topic=51486.0 However, if you are talking broader security with OpenVPN-AS you are right it "could" pose a slight security issue. Essentially this is due to the fact that by resetting the Admin password to default you are making accessing the Admin and Connect interfaces accessible via the default password. That being said, if you follow these simple rules then I think you are safe: 1. Do not expose the Connect or Admin interfaces to the Internet. There is literally no need to open these interfaces to the internet in the majority of cases. You're a home user (I imagine, as are the majority of those who use unRAID) and you can access these interfaces on your LAN to configure / download config files. 2. Use UDP protocol on port 1194 (or other) only for VPN access. When TCP mode is chosen for the VPN Server protocol, the VPN Server can optionally provide access to these services through its IP address and port. You don't want to do this or forget that its set. So just don't enable it. These settings are however maintained across updates. 3. Update your Container carefully. If you are really worried, before you update the Container: disable your port forwarding, have a terminal session open with the command ready to execute. If you are even more worried you could have your unRAID server (along with any configuring client) on a dedicated switch so you can isolate other local clients from being able to access the unRAID server for that period of time. I want to add that #3 is way OTT IMHO but #1 and #2 should be followed to maintain security. I don't run in an environment where LAN clients are not trusted (in that I would never expect someone on the LAN side to maliciously "hack" into the OpenVPN-AS interfaces in the short time they are open when I upgrade). Therefore #3 is not something I really thought about until your question. I would suggest that most unRAID users (without getting Philosophical about it) would consider their LAN secure. Anyway, in summary, not that much of an issue IMHO.