CPU Governors and security concerns on new install

[Normand_Nadon]

Hello there, I am new here and I spent the last week reading and working on my new (old) UNRAID server... First time I use this tool and I love it.

I have few questions though, and googling (ducking also!) did not yield result for me...

Please, if there is an obvious answer to my question, don't throw rocks at me, just point to it... I looked, I did not find. (99% of what I achieved was through tedious reading and tutorial watching, mostly late at night!).

 

First off, here is my setup:

UNRAID version 6.8.3

AMD 8350 on an ASUS Crosshair V Formula-Z Mobo.

16gb DDR3 RAM (4x4gb) at 1600Mhz
(2x) 4Gb NAS Hard drives (1 drive and 1 parity)

(2x) 240gb SATA SSDs in a pool for cache

And many unrelated old, but good stuff!

 

I Installed many plugins to get going (such as "Fix Common Problems" per example)

 

Here are my three major issues today, while working on building this server:

 

1- There is no governor driver... I just don't understand how to install one for my board... I added some Dynamix plugins and more, but this does not seem to be installed in the kernel... How does one achieve his goal of saving energy with cpu scaling on his server? (BTW, "Fix Common Problems" also reports a "no driver found" issue for that)

2- Share security...

• By default, all my shares are visible on the network. If I make them private, I can't find a way to log into them that works (on SMB that is) It always refuses my credentials (created users and gave them access, no luck)
• Also, my flash drive is shared on the network... I absolutely do not want that!  Just found the solution for that one !

 

3- There are plenty of guides on how to make my UNRAID server safe before I give access to some parts of it via the Internet (if that even is possible!). Those guides are often going in opposite directions and that leaves me unsure about what I should do... Can you point me to the best in the west, one pager check list to make my UNRAID server as secure as can be ?

 

Thanks for your time and devotion to this incredible project!

Edited March 30, 2020 by Normand_Nadon

[Normand_Nadon]

Is it legal to bump this thread? It got deep into the page count in just a few days!

[Squid]

On 3/29/2020 at 3:57 PM, Normand_Nadon said:

It always refuses my credentials (created users and gave them access, no luck)

Windows has a feature (more like a flaw) where it always caches credentials, so if you've accessed a share previously when it was public and then switch the share to private, Windows will keep sending the original credentials (ie: none) and be denied access.  Clear the credentials in Windows.  Also, a wealth of common problems affecting windows and all NAS systems is here 

 

 

On 3/29/2020 at 3:57 PM, Normand_Nadon said:

There is no governor driver...

Try the Tips & Tweaks plugin

 

On 3/29/2020 at 3:57 PM, Normand_Nadon said:

There are plenty of guides on how to make my UNRAID server safe before I give access to some parts of it via the Internet (if that even is possible!).

What parts of it?  If you need to access the GUI remotely, then a VPN (wireguard or openvpn) or a reverse-proxy (Let's Encrypt) is what you want.

 

If you need to access the GUI of certain applications running, then once again the above

 

If you simply want to expose the ports for Plex, then go ahead and do that on your router.  Expose the minimum required for the app to operate (ie: 32400). 

 

If you want to expose your entire server by tossing it into a DMZ on the router, then don't do that unless you know and understand and can properly secure your network 

 

On 3/29/2020 at 3:57 PM, Normand_Nadon said:

. Can you point me to the best

SpaceInvader One's youtube channel is usually pretty good.

[Normand_Nadon]

Thanks for the answers!

 

I read the bit on Windows caching credentials last week, and did clear them (a dozen times!)

 

I will follow the links you posted and report with the results. (for the SMB access and for the governor)

 

I mostly want to make my NextCloud Instance available from the Internet, but I am terrified to do so!

Some of my shares will remain in UnRAID and won't be shared with the NextCloud Instance, but the media, photos and document shares would need to be accessed at a distance from the Internet...

 

Space Invader seems to be THE reference on UNRAID! Does he work on the project?

[Squid]

3 minutes ago, Normand_Nadon said:

I mostly want to make my NextCloud Instance available from the Internet, but I am terrified to do so!

 

When I was using nextcloud, I just used NginxProxyManager and a free dns service (NO-IP) and forwarded the applicable ports

[Normand_Nadon]

Wow, I see that you speak fluent Chinese!

Seriously, I will google 80% of this answer and see if I can make it work!

 

[Squid]

NginxProxyManager is an app (available in apps) that is an easy to use replacement for Let'sEncrypt (also in apps).

 

NO-IP allows you to get an address on the internet (  xxxx.dyndns.com ) that whenever something outside the network hits that address it forwards the request to your server (in conjunction with another app "noip", and then NginxProxyManager forwards it to the appropriate app running on your server.

 

Ixxx.dyndns.com is basically a requirement for anything because your ISP (unless your paying for a static IP) will assign your modem a different IP address either whenever it boots up, or occasionally whenever they feel like it.

 

All that being said, I switched over to simply using wireguard (nice how to guide here) as it was a ton simpler to set up and have working properly in 5 minutes versus the other options (vpn / reverse proxy)

[Normand_Nadon]

On 4/4/2020 at 3:08 PM, Squid said:

Try the Tips & Tweaks plugin

I have this installed and it does nothing.

Also, I installed "Fix Common Problems" and it reports that there is no governor driver... but nothing else  

I will dig deeper

 

[Normand_Nadon]

Oh man... I found the issue, I had AMD Cool&Quiet set to auto, I forced it to "enabled" and it works  Stupid motherboard options! Each company has it's own way of saying the same things!