ezhik

Q: Is the 9207-8i P16 firmware still the only firmware that allows for trim with the latest mpt3sas driver in UNRAID 6.9.1? Or have they decided to allow it again in the driver? A: Have not tested it out, but you are more than welcome Q: Have you noticed any issues with the P16 firmware e.g. stability, data corruption etc? A: I am still rocking P16 firmware on 9207-8i and 9201-16i, haven't noticed any corruption, but then again - I don't open every file all the time and therefore - so far so good. Cheers.

Added 9211-8i to the list. Instructions: -- @blakeslade, please see above for 9211-8i. lsi-flash-efi-20210130.zip

Can you be more specific? What vulnerabilities are you referring to? Vulnerabilities are ranked differently based on the complexity, feasibility of the execution and impact on Confidentiality, Integrity and Availability (aka CIA) . And you measure your own risks, @limetech addresses appropriates risks in a timely fashion as we've seen in the past. I'd like to get more context around this, what are you eluding to and what risks do you need mitigated.

You should be fine, even the slow down doesn't kick in right away. They give you leeway for a bit before they enforce it.

Mostly pictures, videos and documents (filled out applications, signed documents, personal files, work files, etc). Duplicati creates a local db (index) of the files you have encrypted, sliced into smaller chunks and uploaded to the cloud. It is your responsibility to backup duplicati data, without it you'd be dead in the water. Is it reliable? I haven't had issues until I pushed over 40TB for testing of (large) bogus content. At that time I noticed that if the backup was interrupted it had difficulties restarting. Now if you want turn-key solution, backblaze is pretty good. As for me personally, I am OK with jottacloud. I have multiple unraid servers (5 to be exact) and one only gets turned on to do rsync for backups of the critical stuff. The general rule of thumb is the '3-2-1 backup'. 3 copies of the critical data, 2 physical and 1 remote (cloud). Anything that is critical, have it initially on the redundant storage array, separate copy stored on an external drive/USB/another server and one copy (encrypted) on a cloud provider just in case.

I think they drop it down to 10mbit. I have stress tested it and uploaded 30TB at some point, they can hold it alright. In either case, even if the speeds are reduced for uploads, they are still bearable for the uploads. At the end of the day, it is what you value most that you should invest in most. My backups are incremental and therefore the speed reduction hasn't really impacted my ability to backup critical data as it runs over night and the chunks are not that big.

Since we are talking about cloud backups: unRAID -> duplicati (+ AES 256 encryption) -> jottacloud (unlimited @ $99/yr)

What do your temps look like? Considering things can get pretty hot when parity check kicks in, i am curious. This definitely looks great!

No, you need to boot the EFI shell via UEFI. Format your USB to FAT32 and put the shell on the root of the device then boot the shell, there should be an option in the bios to do so. https://superuser.com/questions/1057446/how-do-i-boot-to-uefi-shell NOTE: Prior to proceeding with the firmware downgrade, please review the differences between MBR and UEFI boot mechanisms and review how you can boot an EFI shell.

lsi-flash-efi.zip This works in EFI via the attached efi shell.

-- Very Nice!

-- What is inside? I like the case. Can you break it down into parts ? Much appreciated.

https://forum.nzbget.net/viewtopic.php?t=840

Thanks, I'll give it a shot. For now I managed to get python2 to automatically re-install using the following procedure: -- 1) Create custom init.d script for the docker container: /config/custom-cont-init.d/python2.sh 2) Add content: #!/bin/bash echo "**** installing python2 ****" apk add --no-cache python2 3) chmod it: chmod +x /config/custom-cont-init.d/python2.sh -- Reference: https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ Cheers.

Are you sure? -- # apk add python2 fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/main/x86_64/APKINDEX.tar.gz fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/community/x86_64/APKINDEX.tar.gz (1/1) Installing python2 (2.7.18-r0) Executing busybox-1.31.1-r16.trigger OK: 113 MiB in 52 packages --

Please add python2 back to support legacy plugins. apk add python2 Thanks.

Ha! That literally took me back a decade, boy does the time fly fast. Running "Barton" Anthlon XP 2500+ @ 3200+ speeds and soldering that transistor on Radeon 9500 to convert it to 9700... Those were the fun days. Windows XP with Zune theme, running 1GB of ram and some Q3 and urban terror. Enjoy:

Is it running on EPoX 8RDA3+ with Corsair DDR-400 2 x 256MB Sticks with Geforce 2 MX400 AGP 8x? What a blast from the past.

I have to say, unRAID is the best value I have seen. This is literally 'best bang for the buck'. Thank you @limetech , you guys rock!

Welcome to the forum and thank you for the contribution! I no longer own H240s, however I am sure somebody else would definitely be able to leverage your advise!

Happy to see my research is helping the community! Cheers mate!

Good stuff, glad this is useful. Cheers!

I guess the concern here is in case of a really targeted attack where somebody exploits for example an externally accessible web-based docker and gets a reverse shell on a server as root and then gets access to the passphrase to decrypt master keys for disks. But even then in order to actually use it - they would need to either have physical access or leverage IPMI or iLo to actually reboot the system and boot to an ISO and access the drives for data exfiltration. We are talking about some next-level espionage right here. So this type of scenario would be really targeted. Personally, if somebody steals my drive and manages to decrypt it - they would definitely return it back to me with an apology note after seeing my nudes. It all depends on what you are protecting. There is always the right tool for the job. In this case, for somebody who is security paranoid, this may not be it. May be a standard linux raid6 (mdadm) with encrypted lvm would be a better fit then. All comes down to security vs convenience. The more functionality you add, the more security you trade.

Alright, you get the point. You found something that was raised before in the encryption discussions, but you raised it loud. However, I do say 'thank you' for reporting this. I agree, you both provided decent solutions, but do note that even salted password hashes have to be securely computed using proper sources of random data and the salt cannot be user-controlled input, something that cannot be easily guessed and derived. We all know about rainbow tables and how to generate them based on common and re-used usernames. That's great! Check out opnsense and suricata Also for Qubes, you can run Windows VM and AppVM (Seamless Apps). Check it out, if Snowden uses it, so can you - I've been running it for awhile as well! Tinfoil hats! Now this part man, why so arrogant, you are better than this - you are a professional. Ping them directly and workout a fix, you can be part of the solution. You can even test it first!

Oof, this got blown out of proportion. First of all, thanks to @limetech for even introducing encryption support, this helps us ensure our data cannot be recovered (whenever the RMA'd drives get re-purposed) and continuing to support and enhance its functionality. @BennTech Let's be mature about this. Your feedback is of course appreciated, but it needs to be constructive. I see that you have some knowledge in the infosec world and that's great, but please, don't be so condescending on the devs. I am sure you are not sitting behind a pfsense with IDS and IPS configured (such as suricata, snort or even sophos utm) and you are not writing your own snort custom rules either. Your laptop is not running Qubes OS with segregated domains for your personal emails, social media and work related access. You are not using FIDO2/U2F for MFA nor are you using GnuPG for secure communication. And if you are, hats off to you good sir. Regarding LUKS, I am sure you have seen this: https://0x00sec.org/t/breaking-encryption-hashed-passwords-luks-devices/811 (Nothing is bulletproof) Additionally before bashing on devs, they do take security very seriously. Just look at the security sub-forum. Security is a shared responsibility and you are the one who is also responsible for ensuring your system is configured in a secure way as well as your environment. Yes, your environment as well. If we are talking about security practices then there are many security controls you can implement: - Disable services you do not need, you don't have to run any dockers, just use storage - Don't expose unraid or its services externally - Implement fail2ban to prevent bruteforces - Run your vulnerability assessments and manage it (OpenVAS/Nessus) - Rotate your passwords every 30 days - Randomly generate your passwords with at least 24 characters - Use VLANs to segregate network traffic - Don't use lower versions of SMB - Don't use NFSv3 - Lock down physical access to the server - Install Video Cameras - Review access logs - Disable IPMI if you are running supermicro - Disable hyperthreading if you are running intel chips - Don't use unecrnypted connections (http), instead use nginx as a reverse proxy for encrypting all traffic (certs required) - Setup centralized logging using rsyslog to splunk or elasticsearch (ELK) - Setup appropriate auditing accessing the filesystem and triggers - And many others If you work in infosec then you should know about risk assessments and risk management as well as how convenience and security comes clashing when you need to implement BCP (Business Continuity Planning) once your BIA (Business Impact Analysis) is done. You've raised a valid point that convenience in this case should be optional and @limetech agreed to address it in the follow-up release. But are you that paranoid that you don't trust the way you setup your internal network, do you not have enough traffic filtering setup to spot a data extraction operation through an ICMP or a DNS tunnel? Judging by your comments, you are a pro at this In either case, let's improve things. Everybody can be a critic, remember that. And remember, if somebody wants to pwn you - they will, there is always a way.