ljm42

It is here: https://wiki.unraid.net/Manual/Security#Securing_webGui_connections_.28SSL.29
 
Read down to the heading titled "How would you like to access the Unraid webGui while on your LAN?" and then "Https with Unraid.net certificate - with fallback URL if DNS is unavailable"

The webgui only responds via Let's Encrypt SSL using the LAN IP, not the tunnel IP, but "Remote access to server" only provides access to the tunnel IP. To access the LAN IP you need one of the other "peer type of access" options, such as "Remote access to LAN" or "Remote tunneled access".
 
The other option as you mentioned is to relax the "use SSL/TLS" setting to allow you to access the webgui via IP address.

What version of Unraid do you have?
 
Note that using SSL for local access does not require a port forward, so you should have been able to complete step 5 regardless of port forwarding.
 
See this for an alternate way to access the server when there is a problem with SSL:
  https://wiki.unraid.net/My_Servers#How_to_access_your_server_when_DNS_is_down
From there, read the next section titled "How to disable SSL for local access" if that is your goal.

perfect.
 
Please go to Settings -> Network Settings -> Interface rules and reassign things so that your current eth1 is recognized as eth0. Once you have an ip on eth0 you should be able to provision a cert.

1) Sign out of Unraid.net. If you can't do that, then delete this file off your flash drive:
  config/plugins/dynamix.my.servers/myservers.cfg
2) Open a web terminal and run `unraid-api restart`
3) Wait a bit, then reload the webgui. You should now be signed out with no error messages.
4) Sign in to Unraid.net. 

This indicates that something on your client computer (perhaps strict privacy settings or an ad blocker) or your network (some sort of firewall rule) are preventing you from signing in. A few things to try:
* Use Chrome Incognito mode or Firefox Private Browsing as this disables most browser extensions. 
* Access the server directly, not through a reverse proxy
 
If you still have issues:
* Are you new to My Servers or have you been using this for a while and suddenly started having problems? If it used to work but now isn't, can you think of any changes you have made to your computer or network?
* Provide your diagnostics.zip file (from Tools -> Diagnostics)
* Let me know exactly what URL you are using to access the server
* Open a web terminal and run `unraid-api report -v` and provide the output here
* On the sign in popup, right click and choose Inspect, then switch to the "Console" tab. Sign in, and take a screenshot of any error messages shown on the console.

The LE cert is only used when serving the url specified in the LE cert, i.e. https://ipaddress.hash.myunraid.net.  If you are using some other url which the LE cert is not valid for, it uses the self-signed cert.
 
If that doesn't clear things up, please provide the latest diagnostics and let me know what url you are trying to use.

Interesting. So this is another problem related to having a blank "Local TLD". Discord won't accept the submission with this bare url:
"url": "http://Tower/Dashboard",  
I strongly recommend that you go to Settings -> Management Access and change "Local TLD" from blank to "local" (without the quotes). This will solve this problem with Discord by changing the url to:
http://Tower.local/Dashboard  
I'd also recommend installing the Fix Common Problems plugin as it would have alerted you to other potential issues related to a blank Local TLD, more info here:
  https://forums.unraid.net/topic/120220-fix-common-problems-more-information/?tab=comments#comment-1099981 
 

This is the expected behavior in Unraid 6.10.x, it only displays details for certificate_bundle.pem.  The upcoming Unraid 6.11 release displays details for [servername]_unraid_bundle.pem certs too.
 
 
Custom certificates should be named [servername]_unraid_bundle.pem as per the wiki.
 
Other than not seeing cert details on the page, are you having any issues? If there are still issues please upload your diagnostics.zip (from Tools -> Diagnostics) 

Please see this: https://forums.unraid.net/topic/127114-management-ssl-cert-expired-no-ability-to-renew/#comment-1158724
 

Hi folks, 
 
I suspect that the certificate was updated but the webserver was not reloaded afterwards.
 
If you are running into this issue when using Chrome, hit the Advanced button and then the Proceed link to get into the webgui. Other browsers likely have similar features to get past certificate errors.
 
Once you are in the webgui, open a web terminal and type:
/etc/rc.d/rc.nginx reload Or another option would be to simply reboot the server.
 
Once you have run that command (or rebooted) you will need to close ALL browser tabs pointed at this server in order for your browser to see the new cert. If you have any tabs open that are still using the old cert, the browser will not try to load the new one. You might want to restart the entire browser to be sure.
 
Then try accessing the webgui. If this was the problem you will now able to access the webgui without any certificate errors.
 
If you are still having issues, try a different browser entirely. If that doesn't help, please upload your diagnostics.zip file (from Tools -> Diagnostics)

Thanks. I see now that if the router claims the external IP is 100.x.x.x then it is likely CGNAT and port forwarding isn't really possible. It is basically like being double-NATd except that you don't control the Internet-facing router.
 
Your best bet would be to see if you can upgrade your connection to one that does not use CGNAT.
 
For a rather technical work around, try a Google search for "cgnat vps". That is well out of scope for anything we could support though.

Instructions for configuring remote access are here:
  https://wiki.unraid.net/My_Servers#Configuring_Remote_Access_.28optional.29
 
There is likely an issue with your port forward in step 10. You need to configure that on your router, outside of the Unraid interface. Step 11 is how to test it.

It is hard to say exactly what state you're in, I'd recommend using the normal install/uninstall routine rather than manually renaming files.
 
The best way to get back to a fully working system is to reboot. Then you can install/uninstall as needed.

Please go to Settings -> Management Access. If you have previously provisioned a certificate you can click on the "Certificate subject" link to get the URL.
 
If you want to change what happens when you access:
  http://ipaddress 
please see:
  https://wiki.unraid.net/Manual/Security#Redirects
 
BTW, this is not related to the My Servers plugin The URL used to access the Unraid webgui is determined by Unraid itself. There were changes between 6.9 and 6.10. 

@CorvinusLucian @Koenig Thanks to you both.  Would you please run this:
/etc/rc.d/rc.unraid-api install and grab the results, then run this:
unraid-api report (note: that second command will clear the screen, so you need to grab the results before running it)
 
EDIT: please see this post: https://forums.unraid.net/topic/112073-my-servers-releases/#comment-1154449
 
 

Do you have a user starting with the name "root", like "rootshare"? If so that was the issue, it has been fixed in 6.10.2.

The "Provision" button will provision a myunraid.net certificate. There is no need to press it if you are providing your own custom certificate.
 
You can provide your own certificate if you want, but the filename is different. See https://wiki.unraid.net/Manual/Security#Custom_Certificates 
 
So have your shell script put the certificate here:
/boot/config/ssl/certs/[servername]_unraid_bundle.pem And then run:
/etc/rc.d/rc.nginx reload  

The optional Remote Access feature provides secure access to the Unraid webgui. No additional client software is needed, just a web browser.  And a good root password.
 
WireGuard is harder to setup, and requires the client to run special software, but is arguably more secure.

Just to confirm... yes all of the features of My Servers (including flash backup and remote access) work regardless of whether the array is running or not. Both My Servers Remote Access and WireGuard are options for getting remote access to the webgui to enter the encryption passphrase.

These "ALLOWED_ORIGINS" are the urls that are able to access the server without a CORS error. What url are you using?

Interesting, the issue is on the cloud server not your server. Looking into it, may take a few days though.

Licenses are tied to flash GUIDs, so even though those two flash drives were used in the same hardware, the licensing system does not know that. They are two separate licenses.
 
The Expired Trial license will be removed from your dashboard after 30 days I believe.

Unfortunately, DNS Rebinding Protection seems to be enabled on your network. Until you resolve that you won't be able to use this certificate with the proper url.
 
You can verify this by opening a command prompt on your computer and typing:
nslookup yourpersonalhash.unraid.net (use your personal url there, it was shown the in the error message you pasted)
 
If DNS Rebinding Protection is disabled, you will get a response similar to this:
Address:  192.168.1.1 Non-authoritative answer: Name:    yourpersonalhash.unraid.net Address:  192.168.1.8 But if it does NOT resolve to 192.168.1.8 then you know DNS Rebinding Protection is enabled.
 
This protection might be enabled by your DNS server, you could try configuring your router to give DHCP clients the 8.8.8.8 DNS server. Or it might be a feature of your router, in which case try Googling "disable DNS rebinding [router name]". There isn't really a whole lot more I can suggest, it depends on the specifics of your network.
 
 
 

We are seeing an issue lately with zero byte files on the flash drive. 
 
Would you please open a web terminal and run:
ls -al /boot/config/plugins/dynamix.my.servers/*.node  
If the files are valid the output will look like this:
-rw------- 1 root root 355016 Jul 12  2021 /boot/config/plugins/dynamix.my.servers/libvirt.node -rw------- 1 root root  29776 Feb 15 20:13 /boot/config/plugins/dynamix.my.servers/segfault-handler.node  
If the files are any other size (such as zero bytes) then please delete them:
rm /boot/config/plugins/dynamix.my.servers/libvirt.node rm /boot/config/plugins/dynamix.my.servers/segfault-handler.node  
Then either reboot the server or uninstall/reinstall the My Servers plugin, either way the files will be re-downloaded. Sorry for the trouble, the next version of the plugin will handle this automatically, but for now you have to manually delete the bad files as mentioned above.