TOoSmOotH

Members
 View Profile  See their activity

  • Posts

    42

  • Joined

  • Last visited

 Content Type 

Posts posted by TOoSmOotH

    vDisk limit at 24 disks?

    in VM Engine (KVM)

    Posted

    Is there a way to go beyond 24 vdisks? I have 44 drives in my system, 2 Parity, 8 Data, 2 RAID 1 cache, and the rest unassigned. I am passing the unassigned to a VM but I can't go past 24. Is this a limitation in the gui? Can I just add stuff to the XML and keep cruising? Or would this cause issues?

    [Solved] Docker not working from 6.6.0 rc3 to release

    in General Support

    Posted · Edited by TOoSmOotH

    Everything was fine in rc3 but since I upgraded Docker fails to start. 

     

    Seeing this error:

    time="2018-09-21T13:26:28-07:00" level=warning msg="could not use snapshotter aufs in metadata plugin" error="modprobe aufs failed: "modprobe: FATAL: Module aufs not found in directory /lib/modules/4.18.8-unRAID\n": exit status 1" 

     

    Full log attached.

    docker.txt

    X399 and Threadripper

    in General Support

    Posted

    Anyone had any luck with a threadripper build yet? I am thinking about jumping over to team red and curious what types of issues folks are having. I saw you need to run a release candidate right now. Just curious what other problems are out there?

     

     

    • Like 1

    Ethereum mining in a VM or Docker?

    in General Support

    Posted

    My kids computer has 2 Windows 10 VMs on it and I am passing through a GTX 1070 to each one. Those cards mine when the VM is idle for more than 10 minutes. I used to mine Ethereum and was able to overclock and get good speeds. I am running EBWF on them now mining Zcash and getting 400-420sol/s on each VM. I am just using PCIE passthrough and they game on it when it isn't idle. 

    Docker Icons Permission Denied

    in Docker Engine

    Posted

    Everything is mounted rw. 

      

    # cat /etc/fstab 
/dev/disk/by-label/UNRAID  /boot     vfat   auto,rw,exec,noatime,nodiratime,umask=0,shortname=mixed  0  1

# ls -la /boot/config
total 0

    Looks like there is something going on with /boot/config that I thinks is missing.

    Docker Icons Permission Denied

    in Docker Engine

    Posted

    Seeing this lately:

     

    Warning: unlink(/boot/config/plugins/dockerMan/images/linuxserver-plex-latest-icon.png): Read-only file system in /usr/local/emhttp/plugins/dynamix.docker.manager/include/DockerClient.php on line 792

     

    Any docker container that I update loses its icon due to this error.

    Is UnRaid really unsecure?

    in Security

    Posted

    24 minutes ago, limetech said:

     

    With all due respect man, this is unwarranted.  We take security very seriously.  Case in point: totally dropped development last month to incorporate CSRF protection as fast as possible and it was a hell of a lot of work.  We are team of 2 developers in unRAID OS core, and one of us can only spend half time at it because of other hats that must be worn.  Reality is 99% of CVE's do not affect unRAID directly.  Many are in components we don't use.  Many apply only to internet-facing servers.  We have always advised, unRAID OS should not be directly attached to the internet.  The day is coming when we can lift that caveat but for now VM's can certainly serve that role if you know what you are doing.

     

    If you find a truly egregious security vulnerability in unRAID we would certainly appreciate an email.  We see every one of those, whereas we don't read every single forum post.  Send to [email protected]

     

    I do security stuff for a living and I would say there are no glaring vulnz with unraid. Just some best practices that need to happen (that I listed previously) that would help with the optics of its level of security. No matter what you do if someone wants to get to you they will. Forcing people to change the root password will help save them from themselves in some cases. 

     

    30 minutes ago, Del said:

     

    Personally, I would do it the other way around - prefer a VM dedicated to VPN rather than a Docker.

    Reasoning is that if the VPN endpoint were compromised, if in a VM, there is another OS layer to get around.

     

    Probably not a lot in it for home use though.

     

    That is another option as well. If you want to go full tin foil I would stick it on another VLAN and make it pass through your firewall to access you LAN where you unraid box sits.

    Is UnRaid really unsecure?

    in Security

    Posted

    59 minutes ago, ljm42 said:

     

    I think you might want to make it clear that those are feature requests, not things that can be done today.

     

    Good idea on using non-standard ports, I'm going to add that to my list :)

     

    Yes sorry those would be feature requests not something you can do sans the key based auth.

    Is UnRaid really unsecure?

    in Security

    Posted

    Glad to hear about HTTPS support coming. 

     

    Some other suggestions:

     

    - Have a default root password vs just blank. 

    - Force password to be changed on first login.

    - ssh key support in the web interface.. more advanced users can do this today. 

    - Run docker as its own user

    - Run KVM as its own user

    - Create a separate user account for the web interface that isn't root so you are not passing root creds over the network (although ssl sorta addresses this)

     

    Even with that you should never stick an unraid box on a DMZ port. It's use case is inherently less secure than say a web server due to the attack landscape it exposes. (smb etc) Always use docker containers and only forward specific ports to it. Try and always use ports that are not default. Plex example: Use port 34121 on your router that points to 32400 on your internal plex docker. That way if some plex vuln comes out you have a little time to address it. The baddies will be scanning 32400 looking for them. YES you can still find it but that requires a full port scan on you and that is a lot slower then looking for plex by 32400. 

     

    Another pro tip: Don't open SSH to your unraid server from the internets. If you really need to be able to ssh into your house create a small VM that you can use to connect to. Or better yet install the openvpn docker and connect that way. Never have direct connectivity on any port to your unraid box from the interwebs... always use a docker 

     

    • Like 1
    • Upvote 3