[Support] binhex - General

[JonathanM]

1 minute ago, GingaRanga said:

xxxxxxxxxxx is not my username and password. I figured the logs masked that

No, I removed it. Your username and password were exposed in plaintext for almost 24 hours. You need to change your password. No idea if that will fix your problem, probably not, but if you don't change your password I can almost guarantee someone will start using your account.

[GingaRanga]

1 minute ago, JonathanM said:

No, I removed it. Your username and password were exposed in plaintext for almost 24 hours. You need to change your password. No idea if that will fix your problem, probably not, but if you don't change your password I can almost guarantee someone will start using your account.

 

Oh crap that was a rookie mistake. Thanks for catching that.

[binhex]

Hi all a quick note, i am moving house and therefore will have VERY limited internet connectivity (smart phone) for a couple of weeks so support directly from me will be quite limited, i'm sure the community will keep things ticking along just fine :-).

 

binhex.

 

P.S. Please do not worry about updates, this is all running in the cloud and therefore will carry on seamlessly.

[Moepsindi]

Hope I am in the correct place.  

 

Just wanted to ask if there is a way to filter or block unwanted extension from a download?  Once it has been moved to the complete folder?

[Mr. M]

@binhex Do you have an official way to request containers?

Edited December 23, 2022 by Mr. M

[Codex]

Seconding container requests, would be great to see a binhex container for https://github.com/aetaric/checkrr

 

🙏

[paperblankets]

Container request for a vpn version of tubesync of https://github.com/meeb/tubesync/blob/main/Dockerfile

[MarianKoniuszko]

Hello, today I noticed I have 100% full docker image on unraid. I Reboot to see if this will help. Then I change docker image size and now looks ok. All containers start to work but deluge-vpn don't. I see error in log that default.ovpn don't have remote line. I want to check that file and it is empty. How this is possible?

[admsteck]

I recently switched to the binhex versions of several apps (sonarr, radarr, etc) since I'm already using a binhex vpn image. I would have thought that would also save some space since they should all be based on the same base image, but that doesn't seem to be the case. 
When I installed the new apps, they downloaded all the layers, and I would have thought some of them should have already existed.  

Also, I noticed that the binhex images are significantly larger than the linuxserver versions.  Radarr is 1.17 GB vs linuxserver at only 196 MB for example. And all the binhex images that I use are over 1 GB.

I'll see if I can do some digging to figure out why they don't appear to be using base images correctly and why they are so large, but just wanted to see if anyone else had noticed this or had any explanation.

[nraygun]

Are the BinHex containers affected by this?

CVE-2024-3094

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

[binhex]

21 hours ago, nraygun said:

Are the BinHex containers affected by this?

CVE-2024-3094

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

Some of the image i have built MAY have the affected versions installed, i am currently running a build of the base image to perform the 'Resolution' (see link) and i will then kick off builds of subsequent images.

 

For reference here is the ASA for Arch Linux (base os), pay attention to the 'Impact', also keep in mind unless there is code calling xz then xz will not be running and therefore the risk is reduced, however i am keen to get all images updated:-
https://security.archlinux.org/ASA-202403-1

 

EDIT - Further investigation into the way xz interacts with the system, it looks like in order for the exploit to be used you would need to have systemd operational (not the case with any of my images) and OpenSSH installed (not the case with any of my images), so in my opinion the risk is low here, but as I mentioned above I am keen to get all images updated, so please be patient as this can take a while and its Easter time so my time is restricted.

[nraygun]

Thanks @binhex!

Do you have an announcement site for users to stay current on stuff like this or is this thread it!

[binhex]

9 hours ago, nraygun said:

Thanks @binhex!

Do you have an announcement site for users to stay current on stuff like this or is this thread it!

This is probably as good as any place, so lets keep correspondence about the issue here.

[nraygun]

@binhex

Any updates? I have my Minecraft server down in the meantime.

[binhex]

21 hours ago, nraygun said:

@binhex

Any updates? I have my Minecraft server down in the meantime.

OK all images are now up to date, please perform a 'check for updates' and pull down any out of date images.

 

Note:- I do not know what image you are using for your minecraft server but mineos-node has now been archived, so if you are using this image i would encourage you to switch to a maintained image such as crafty4 as this will NOT include the updated xz package.

 

Be aware version 5.6.1-2 is the patched version, so if the version of xz is still showing v5.6.1 then this will be the patched release - see link for more details:- https://security.archlinux.org/ASA-202403-1

[nraygun]

20 hours ago, binhex said:

OK all images are now up to date, please perform a 'check for updates' and pull down any out of date images.

 

Note:- I do not know what image you are using for your minecraft server but mineos-node has now been archived, so if you are using this image i would encourage you to switch to a maintained image such as crafty4 as this will NOT include the updated xz package.

 

Be aware version 5.6.1-2 is the patched version, so if the version of xz is still showing v5.6.1 then this will be the patched release - see link for more details:- https://security.archlinux.org/ASA-202403-1

Awesome! Thanks for taking care of this.

 

I'm using the binhex/arch-minecraftserver container. I think it's this one: https://github.com/binhex/arch-minecraftserver/pkgs/container/arch-minecraftserver

 

I see it's using xz 5.6.1.

 

[binhex]

OK hopefully the last comment from me on xz as i believe we are sorted, if you want to confirm the package version installed to ensure its the patched version '5.6.1-2' (see https://security.archlinux.org/ASA-202403-1), then do the following:-

1. open unraid webui and left click container and select 'Console'
2. copy and paste the following command:-

   pacman -Q | grep 'xz'

3. confirm the returned value is 'xz 5.6.1-2', if not please post here the image name so i can investigate.

Note:- If you are using an archived image then this will not be patched, also if you are using a tagged image then again this will not be patched.

[nraygun]

3 hours ago, binhex said:

OK hopefully the last comment from me on xz as i believe we are sorted, if you want to confirm the package version installed to ensure its the patched version '5.6.1-2' (see https://security.archlinux.org/ASA-202403-1), then do the following:-

1. open unraid webui and left click container and select 'Console'
2. copy and paste the following command:-

   pacman -Q | grep 'xz'

3. confirm the returned value is 'xz 5.6.1-2', if not please post here the image name so i can investigate.

Note:- If you are using an archived image then this will not be patched, also if you are using a tagged image then again this will not be patched.

Pacman returned this so I think it's OK:

sh-5.2# pacman -Q | grep 'xz'
xz 5.6.1-2

 

What are "archived" and "tagged" images? I just put "binhex/arch-minecraftserver" in the repository field for the container.

 

[binhex]

8 hours ago, nraygun said:

What are "archived"

this is a github repository that has been put into read only mode, basically its not not supported or maintained.

 

8 hours ago, nraygun said:

and "tagged" images?

a tagged image refers to somebody specifying the version they want via the docker tag, read Q5 for how this works:- https://github.com/binhex/documentation/blob/master/docker/faq/unraid.md

 

[nraygun]

7 hours ago, binhex said:

this is a github repository that has been put into read only mode, basically its not not supported or maintained.

 

a tagged image refers to somebody specifying the version they want via the docker tag, read Q5 for how this works:- https://github.com/binhex/documentation/blob/master/docker/faq/unraid.md

 

For "binhex/arch-minecraftserver", I don't see it's in read-only mode and I don't use a specific tagged version.

Specifying "binhex/arch-minecraftserver" pulls down the latest, right?

[Getting Goin]

Hello All,

 

I am unsure if this is the correct thread for my question, i apologize if it is not and hope it can be moved if incorrect. 

 

I am currently experiencing issues with a few binhex docker apps that i believe could be related to the supervisor, which is common amongst binhex apps hence the reason for the general thread post.   

 

The problem:

----------------------------

When i install an binhex docker app everything seems to complete and install properly.  But when i start it is appears to try and start and even shows "started" from the unraid dashboard, however when i try to connect to webgui or refresh the dashboard it shows shutdown.  This happens on multiple binhex apps except for the rtorrent, which has errors in the log but appears to start and work as it should.     Apps having difficulties at this point are krusader, radarr and sonarr.

 

How we got here.

----------------------------

I have ran all of the above listed docker app without issue for sometime. All above listed where previously installed and running as they should.  But my docker image became corrupt and i needed to reinstall.  So i followed spaceinvaders tutorial on on removing and reinstalling the containers.  Each one seem to install fine, until i got to binhex.  Only rtorrent seems to work.  So i thought it maybe permission errors and ran the new safe docker permission file tool.  This may have made things worse, unsure yet.   But none the less i cannot get binhex apps to load. 

 

What could be the issue?

------------------------------------

Well clicking on each app log file from the dashboard only gives one error and that is related to the supervisor.  Below being the error

 

Error: could not find config file /etc/supervisor.conf
For help, use /usr/bin/supervisord -h

 

So it appears as if it cannot connect to the supervisor.conf .   I know i did not delete that file, so i am thinking it may be a permission error.  But when i list (ls) the contents of the /etc folder i do not see the supervisor.conf file.   Is it hidden or could it have deleted by itself when deleted the docker image? I am unsure what happened with it and how to properly recovery it, also if that file is missing how is the supervisord.log getting updated? Doesn't it need the supervisor.conf to work properly?  I am at a lost and over my head for sure, if anybody can help shed some light to help fix or point me in right direction, that would be great!

 

Thanks

---------------------

 

Many thanks to any and all who help, appreciate you taking your time to reply and your advise.  Have a good day, evening or night!  Cheers!