CVE related to self hosted UniFi controllers. Running 8.3.32 and earlier 

https://community.ui.com/releases/Security-Advisory-Bulletin-042-042/c4f68b56-cdc4-4128-b2cb-5870209d1704

14 minutes ago, bmartino1 said:

@PeteAsking

 

https://github.com/11notes/docker-unifi/issues/21

 

Not sure if testing is needed yet but latest version is supposedly updated.

Repository update:
11notes/unifi:8.4.59-unraid
?

I havent tested tag 8.4.59-unraid as it was only created 3 hours ago but you can update and test it if you want. 

1 hour ago, bmartino1 said:

As far as I can tell everything seems to be working:

 

loading a backup to test now.

Backup and working as it should.
Seems to be stable.

Check 24h with no restarts for memory leaks as this can happen in some versions. 

Hi!

 

I am running into any issue and hope someone can help. 

 

I have the container setup on br0 at x.x.4.100. My Unraid server is at x.x.4.32.

 

When I pull up the device list in Unifi, I see the Network Controller listed, but I am not seeing the UnRaid server or other containers with IPs listed (i.e. PiHole)

 

What can I do so that the Unraid server shows up as a device entry in Unifi?

 

EDIT: Nvm, figured out that I needed to switch from ipvlan to macvlan in the Docker Settings.

Edited September 6, 20241 yr by Nip

20 hours ago, Nip said:

Hi!

 

I am running into any issue and hope someone can help. 

 

I have the container setup on br0 at x.x.4.100. My Unraid server is at x.x.4.32.

 

When I pull up the device list in Unifi, I see the Network Controller listed, but I am not seeing the UnRaid server or other containers with IPs listed (i.e. PiHole)

 

What can I do so that the Unraid server shows up as a device entry in Unifi?

 

EDIT: Nvm, figured out that I needed to switch from ipvlan to macvlan in the Docker Settings.

Correct, sorry for late reply, was going to say this sounds like a duplicate mac issue caused by docker network setup. To confirm you are using macvlan. To have a individual mac address assigned to your docker containers.

 

Ubiquity auto uses a dns record for the inform IP address... so, when running a dns server, it is best practice to set a record for the inform IP.  "unifi" if using ubiquity network devices such as switches and routers... For netbios and ntlm networking, compatibility with win 95. It's best to set the domain name to localdomain. (Unfif uses this as default other operating systems and routers may use .lan or .local ...

 

Since Pihole, Be sure to alos setup a pihole with a local dns record to help direct traffic and point unifi to the x.x.4.100 and add a record for your unifi.[your dhcp advertised domain name]

Example

so a dns record should exist for  
unifi

 

and 

example...

 

unifi.localdomain

unfi.local

unifi.lan

 

 

Hello friends. I just can't seem to get unifi reborn to adopt my usw-pro-max-16-poe. 
Unraid 6.12.13. I am able to add 2 Unifi AP pros without issue but I SSH into my USW and factory rest and http://10.10.10.2:8080/inform but I never see it pop up in the UI at all. 
My unraid server is plugged directly into the switch. What could I be missing here?

Docker info: 

• All settings left to the default settings
• Repo: 11notes/unifi:8.0.7-unraid
• network type: Bridge

2 hours ago, timothychare said:

Hello friends. I just can't seem to get unifi reborn to adopt my usw-pro-max-16-poe. 
Unraid 6.12.13. I am able to add 2 Unifi AP pros without issue but I SSH into my USW and factory rest and http://10.10.10.2:8080/inform but I never see it pop up in the UI at all. 
My unraid server is plugged directly into the switch. What could I be missing here?

Docker info: 

• All settings left to the default settings
• Repo: 11notes/unifi:8.0.7-unraid
• network type: Bridge

Upgrade to a higher unifi network application version..

https://techspecs.ui.com/unifi/switching/usw-pro-max-16-poe
look at device application requirements:

Application Requirements. UniFi Network, Version 8.1.127

so make a backup

See earlier in form:
https://forums.unraid.net/topic/147455-support-unifi-controller-unifi-unraid-reborn/?do=findComment&comment=1431473

Then
stop docker and change the repo to 
 

Stable: 11notes/unifi:8.3.32-unraid

Old Stable: 11notes/unifi:8.1.127-unraid

Then try to adopt again.

Edited September 8, 20241 yr by bmartino1
update instruction

would appear that 8.4.59-unraid is now available. (11 days now)

3 hours ago, furian said:

would appear that 8.4.59-unraid is now available. (11 days now)

I’ve been running it since it was released without any issues. Also looks like 11 notes has released 8.4.62 docker, so depending on how that goes the Unraid version could be up in a few days

Is there any ETA on when we will be able to update? New controller has been out for 18 days and 11 notes uploaded the docker image 11 days ago but no Unraid image yet.

2 hours ago, fat said:

Is there any ETA on when we will be able to update? New controller has been out for 18 days and 11 notes uploaded the docker image 11 days ago but no Unraid image yet.

Because I have to support anyone with issues, you should expect there to be a lag between unifi releasing an update and it being supported here fully. Running the absolute latest is not necessary for most cases and provides little benefit over a version that had been well tested a month prior. Is the need to update simply to satisfy a need to feel current or is there some issue that can only be resolved by a later version?

 

At any rate the latest supported tag is 8.3.32-unraid (by the way some unifi users have reported having to revert to this version - ie 2 versions back to resolve issues on their forums which should indicate to you the stability of this version being solid).

 

8.4.59 Introduced a regression that would break some people upgrading to 8.4.62. For this reason I did not recommend or support upgrading to 8.4.59 despite a tag being created for it (no announcement, it is a choose your own adventure tag). 
 

There are no major features since 8.3.32 - which is extremely stable - so you would need to make a case for why we should introduce potential issues for unifi users on unraid using this docker image. Otherwise waiting 3 months for a stable update is fairly normal and of no major consequence for 99.99% of users. 
 

Rest assured this unraid docker image is being maintained. This does not mean it will have update frequencies like Fortnite Battle Royale or that every release unifi create will be deemed acceptable for the standard I expect for production and support (You will note no ‘latest’ tag exists for example. This was by design). My personal preferences have been shaped by being a Debian user for 20 years and the ethos of that project which has served well. Its ready when its ready.  

 

P

Edited September 27, 20241 yr by PeteAsking

I appreciate the work you do and have done in maintain this for stable support.

While I agree with you PeteAsking, since I have been passed the handle on UNFI for the LXC template integration, I personally prefer to stay at/on the latest version and maintain that each week more for security and potential threats. (Especially so with the recent changes from mongdb EOL also with recent CVE where unfi says to upgrade...) Nothing againt running a older release, as its more for me..., It's not about updating to the latest for features or to be on the "bleeding edge" its about security implementations and bug fixes. Most can be done and known by reading the UNIFI release notes for each network application. See improvements/bugfixes There is nothing wrong with running an older server as long as its meeting your security and safety requirements. 30% of unifi updates are more for their own hardware to upgrade there application stack, others are how they handle there webUI and some code fixes... Most network application version hops are to support newer unifi equipment for adoption. Outside of potential bug fixes there is no need to move past v8.1.127 as this is the min need for there current unifi device adoption per there websites tech data sheets.

Example of release notes.
https://community.ui.com/releases/UniFi-Network-Application-8-3-32/54f3b506-afcf-4a7c-aba6-01a884dd9003
vs
https://community.ui.com/releases/UniFi-Network-Application-8-4-62/40240312-bb43-4648-adab-5b05f3d4354e

Can you post a link on the unifi forum for people who require the absolute latest version at all times via LXC where you assist? Anyone unable to wait a couple months between versions can happily go that route. For people happy to wait they can stay here if they prefer. That way people can decide themselves what they want. 

Just asking out of curiosity, I was running the old docker for years and recently changed to this new one, I see a lot of people requiring the absolute latest updates, can I ask why? I have been running old versions without issues for years, what am I missing 😄

30 minutes ago, mbc0 said:

Just asking out of curiosity, I was running the old docker for years and recently changed to this new one, I see a lot of people requiring the absolute latest updates, can I ask why? I have been running old versions without issues for years, what am I missing 😄

Because of security patches. Just because an old version of any software is working without issues doesn't mean it's safe to run. 

 

I agree that one doesn't need to be on the absolute bleeding edge. But security patches are important. Especially those that patches vulnerabilities that can gain root access to your system. 

In my case the reason for running some of the more recent controller versions has been the improvements in IPV6 and I am looking at implementing DNS shield which is a recent feature of the controller also 

7 hours ago, bmartino1 said:

here is the lxc template per ICH777
https://github.com/bmartino1/unraid-lxc-unifi

 

^Install Steps

If anyone believes they are missing a critical security vulnerability after reading unifis release notes for the last 2 versions, or that they need updates within a day after unifi releases a new version of their controller please migrate to bmartino1’s LXC version. This solves the issue for everyone involved giving a rolling release version for those who want it and a delayed schedule for the rest. 

I’m trying to figure out how to update the ssl certificate for this docker. It doesn’t look like unifi has an option to run the webUI on http and I’m sick of the constant trust warnings in my browser so I’m trying to install a new self-signed ssl certificate but not sure how. Google gives me way too many different methods for this.

hello,

 

are there any known issues with wifi 7 pro APs? i have 3 new units and i can't seem to adopt any of them. unifi says adopting for a few minutes, then appears to fail, the AP goes offline for 15 seconds and tries to adopt again. over and over with every unit i tried. no error message is generated

 

i confirmed that the APs themselves work fine by installing the unifi software on a windows desktop, adopting them and running some tests. it's a new install. no settings or backups carried from another controller. all settings are default 

 

EDIT. turning on “Inform Host Override” solved this. never had to do that before, but that does appear to be the solution. thank you 

Edited September 28, 20241 yr by solomonshv

1 hour ago, solomonshv said:

hello,

 

are there any known issues with wifi 7 pro APs? i have 3 new units and i can't seem to adopt any of them. unifi says adopting for a few minutes, then appears to fail, the AP goes offline for 15 seconds and tries to adopt again. over and over with every unit i tried. no error message is generated

 

i confirmed that the APs themselves work fine by installing the unifi software on a windows desktop, adopting them and running some tests. it's a new install. no settings or backups carried from another controller. all settings are default 

 

thanks 

This is commonly caused by “Inform Host Override” not being set in the advanced controller settings. Set it to the IP of the docker.

 

6 minutes ago, bmartino1 said:

It's not easy. It's more to due with paid ssl certificate keys. You would have to run a separate application such as stunnel or letsencrypt to do this. Otherwise download the certificate that is slwf generated and I stall as a trusted cert on the PC.

No, I just want to add a self-signed certificate into the app. I can issue a certificate from my pfsense firewall. Just need to know how to add it to the docker.

Just now, wgstarks said:

Otherwise download the certificate that is slwf generated and I stall as a trusted cert on the PC.

The current certificate appears to be expired.

2 minutes ago, wgstarks said:

The current certificate appears to be expired.

Look at resit post for path location.

This may help you on that journey. It's been a while since I messed with ssl/https certs and unifi 

 

 

2 minutes ago, bmartino1 said:

Look at resit post for path location.

Not sure what you mean?

@wgstarks I believe a better way to handle this certificate issue is to use a reverse proxy. I know there are docker reverse proxys on unraid.  Im not 100% clear how you do this but traffic would work like request —-> reverse proxy on https —-> forwarded by reverse proxy to unraid. Cert would be handled by reverse proxy.