Beiträge von OhMyVirtual

  • OMV SSL certificate for Syncthing

    "But nevertheless one has to add another certificate exception in Firefox. This is because the exception is bound to a specific port and the webui and Syncthing ports differ. So it's no real advantage to use one certificate."


    Sorry, but this is utter nonsense. TLS certs don't care one bit about the port they're used through, they care about the IPv4/6 addresses or DNS entries they're trusted for. If you connect through LAN, and it expects a WAN IP, you'll get a warning from Firefox. You can solve that problem by running dnsmasq somewhere on your LAN, where you let the domain name point to the LAN IP. If you resolve using that local dnsmasq, firefox doesn't require an exception.

  • To OMV 4 or not to OMV 4?

    Zitat von ryecoaaron

    Install OMV4 on Debian 9 (Stretch)

    Installing the openmediavault-keyring package fixes that and not having a key does not ruin apt. It may install a package that you don't want/like but in this case you are safe. The other solution is to use the OMV installer ISO.

    Actually, debian 9 has some issues with apt. Check this out. Thus far, the past few months, I have experienced similar issues on 2 different debian servers. Mainly the upgrade from Jessie seems to be causing failures with apt on Stretch. Something with permissions of trusted.gpg and then having to re-validate keys.

  • To OMV 4 or not to OMV 4?

    So where is the functional install script for OMV4 on an existing Debian 9.4 system? Can't seem to find it. And the one I found expects me to do package management without a valid key auth, which is not a good base to start from (and usually ruins apt entirely).

  • openmediavault-letsencrypt

    Zitat von luxflow

    for RSA key length 4096, should have to change omv-letsencrypt to support it
    but not sure when that feature is released

    Maybe just use the renewal options to change it, or a conf include for custom user config?


    /etc/letsencrypt/renewal/*.conf
    [...]
    # Options used in the renewal process
    [renewalparams]
    rsa-key-size = 4096
    [...]



    By the way, have you heard about acme.sh? It's really awesome. Use it for work all the time. Perhaps you can snag some things from it for the OMV plugin.

  • openmediavault-letsencrypt

    Zitat von luxflow

    you can change cipher for omv web gui as you want (see here)
    so you just add OMV_NGINX_SITE_WEBGUI_SSL_CIPHERS="EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH" in /etc/default/openmediavault
    not to use DH keys

    It's not about not using DH, it's about using the right ones. See a favored nginx A+ ssllabs rated config here.


    OMV_NGINX_SITE_WEBGUI_SSL_CIPHERS="ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"
    but I have it on a debian wheezy machine, with;

    nginx version: nginx/1.11.3
    built by gcc 4.7.2 (Debian 4.7.2-5)
    built with OpenSSL 1.0.1e 11 Feb 2013 (running with OpenSSL 1.0.1t 3 May 2016)
    TLS SNI support enabled
    configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_perl_module=dynamic --add-dynamic-module=debian/extra/njs-0.1.0/nginx --with-threads --with-stream --with-stream_ssl_module --with-stream_geoip_module=dynamic --with-http_slice_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_v2_module --with-cc-opt='-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,--as-needed'


    while OMV3 runs;



    nginx version: nginx/1.6.2
    TLS SNI support enabled
    configure arguments: --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2' --with-ld-opt=-Wl,-z,relro --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_addition_module --with-http_dav_module --with-http_geoip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_spdy_module --with-http_sub_module --with-http_xslt_module --with-mail --with-mail_ssl_module --add-module=/build/nginx-AGNHOe/nginx-1.6.2/debian/modules/nginx-auth-pam --add-module=/build/nginx-AGNHOe/nginx-1.6.2/debian/modules/nginx-dav-ext-module --add-module=/build/nginx-AGNHOe/nginx-1.6.2/debian/modules/nginx-echo --add-module=/build/nginx-AGNHOe/nginx-1.6.2/debian/modules/nginx-upstream-fair --add-module=/build/nginx-AGNHOe/nginx-1.6.2/debian/modules/ngx_http_substitutions_filter_module


    so I'll let you know if it works..

  • openmediavault-letsencrypt

    2 things relating to the plugin on OMV;


    - Qualys TLS check rightfully rates the cert with a B ("This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.")
    - The server Key is only 2048 bit, while I'd prefer RSA 4096 bits (e 65537), like, for example, on this test.



    Sure, I can change nginx config manually, but it gets overwritten at every OMV update, so that's a bad idea.. hence the reason I mention this here.



    Thanks in advance for improvements on this TLS implementation for OMV.

  • Syncthing

    Is there a how to for the use of syncthing through OMV 3 ? And by that I mean how it uses storage per user, how it restricts storage access to other user's dirs etc. How to best set it up for that?

  • Syncthing on OMV 3.0.26

    Is there a "syncthing how to" on the forum of some sort? I see it's the most searched for combi in the box in the upper right.. Must be missing it, but I can't find it. I'd really like not to mess the thing up again, I have syncthing on other systems and am finally ready to have the syncs active on OVM 3* as well.

  • openmediavault-letsencrypt

    For my day-job I've been installing security and certificates for years, and ever since Snowden stuff has changed. LetsEncrypt is great, but I can recommend using https://github.com/Neilpang/acme.sh instead of the certbot python monstrosity and dependency hell.


    By the way, pity we're still at nginx -v 1.6.* on OMV3. I would love to use http2 and be able to use this config:
    https://gist.githubusercontent…cb67d85e1454b10997566/TLS
    We only get a B- at qualys ssllabs test.

  • Is OMV3 (Erasmus) still in beta or is it considered stable?

    Zitat von ryecoaaron

    I hate to say it but the letsencrypt plugin has not been ported yet either. I guess I just need to start deleting repos since there is no good way to keep people from installing plugins that aren't ported.

    Just put a warning on the OMV-Extras page. And link to these posts. I would have understood and looked away. Now trying a letsencrypt plugin was way too tempting ;)


    Anyway, thanks for the hint, a simple
    apt-get purge openmediavault-letsencrypt
    solved this one for me.
    I'll stick with the ones that are supported, like syncthing ;)

  • Is OMV3 (Erasmus) still in beta or is it considered stable?

    Zitat von ryecoaaron

    It is true. I install OMV 3.x multiple times per day most days. There are harmless errors that people worry too much about. Commercial NASes just hide the errors. Whenever you install a php or nginx update, nginx and/or php5-fpm need to be restarted. This generates communication errors until the service is restarted. This is almost impossible to avoid but harmless.

    I'm sorry but I would have to disagree on that. I realize I'm using extras-testing, but I think having SSL is a major requirement for access from the outside. So I tried this 1 plugin over a new clean OMV3, and immediately fall into that same hole:


    Reading package lists...
    Building dependency tree...
    Reading state information...
    The following extra packages will be installed:
    git git-man liberror-perl
    Suggested packages:
    git-daemon-run git-daemon-sysvinit git-doc git-el git-email git-gui gitk
    gitweb git-arch git-cvs git-mediawiki git-svn
    Recommended packages:
    patch
    The following NEW packages will be installed:
    git git-man liberror-perl openmediavault-letsencrypt
    0 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
    Need to get 4563 kB of archives.
    After this operation, 23.6 MB of additional disk space will be used.
    Get:1 http://ftp.surfnet.nl/os/Linux/distr/debian/ jessie/main liberror-perl all 0.17-1.1 [22.4 kB]
    Get:2 https://dl.bintray.com/openmed…velopers/erasmus-testing/ jessie/main openmediavault-letsencrypt all 2.3 [11.2 kB]
    Get:3 http://ftp.surfnet.nl/os/Linux/distr/debian/ jessie/main git-man all 1:2.1.4-2.1+deb8u2 [1267 kB]
    Get:4 http://ftp.surfnet.nl/os/Linux/distr/debian/ jessie/main git amd64 1:2.1.4-2.1+deb8u2 [3262 kB]
    Fetched 4563 kB in 0s (9033 kB/s)
    Selecting previously unselected package liberror-perl.
    (Reading database ... (Reading database ... 5%(Reading database ... 10%(Reading database ... 15%(Reading database ... 20%(Reading database ... 25%(Reading database ... 30%(Reading database ... 35%(Reading database ... 40%(Reading database ... 45%(Reading database ... 50%(Reading database ... 55%(Reading database ... 60%(Reading database ... 65%(Reading database ... 70%(Reading database ... 75%(Reading database ... 80%(Reading database ... 85%(Reading database ... 90%(Reading database ... 95%(Reading database ... 100%(Reading database ... 32733 files and directories currently installed.)
    Preparing to unpack .../liberror-perl_0.17-1.1_all.deb ...
    Unpacking liberror-perl (0.17-1.1) ...
    Selecting previously unselected package git-man.
    Preparing to unpack .../git-man_1%3a2.1.4-2.1+deb8u2_all.deb ...
    Unpacking git-man (1:2.1.4-2.1+deb8u2) ...
    Selecting previously unselected package git.
    Preparing to unpack .../git_1%3a2.1.4-2.1+deb8u2_amd64.deb ...
    Unpacking git (1:2.1.4-2.1+deb8u2) ...
    Selecting previously unselected package openmediavault-letsencrypt.
    Preparing to unpack .../openmediavault-letsencrypt_2.3_all.deb ...
    Unpacking openmediavault-letsencrypt (2.3) ...
    Processing triggers for man-db (2.7.0.2-5) ...



    >>> *************** Error ***************
    Failed to read from socket: Connection reset by peer
    <<< *************************************



    >>> *************** Error ***************
    Failed to connect to socket: Connection refused
    <<< *************************************



    >>> *************** Error ***************
    Failed to connect to socket: Connection refused
    <<< *************************************



    Either way, I now have a weird Error dialog window I can't close, and the entire web-gui is locked up because of that. It says [Error] Communication error. So, I can have all the patience in the world, but when this keeps happening with the install of just the first crucial plugin I would like to use, it has nothing to do with patience. When I look in syslog, this might be of interest;


    Jul 23 14:58:21 sugar monit[815]: 'omv-engined' restart on user request
    Jul 23 14:58:21 sugar monit[815]: Monit daemon with PID 815 awakened
    Jul 23 14:58:21 sugar monit[815]: Awakened by User defined signal 1
    Jul 23 14:58:21 sugar monit[815]: 'omv-engined' trying to restart
    Jul 23 14:58:21 sugar monit[815]: 'omv-engined' stop: /bin/systemctl
    Jul 23 14:58:21 sugar monit[815]: 'omv-engined' start: /bin/systemctl
    Jul 23 14:58:21 sugar systemd[1]: openmediavault-engined.service: Supervising process 6433 which is not our child. We'll most likely not notice when it exits.
    Jul 23 14:58:21 sugar monit[815]: 'omv-engined' restart action done
    Jul 23 14:58:22 sugar systemd[1]: openmediavault-engined.service: main process exited, code=exited, status=255/n/a
    Jul 23 14:58:22 sugar systemd[1]: Unit openmediavault-engined.service entered failed state.
    Jul 23 14:58:27 sugar monit[815]: 'omv-engined' restart on user request
    Jul 23 14:58:27 sugar monit[815]: Monit daemon with PID 815 awakened
    Jul 23 14:58:27 sugar monit[815]: Awakened by User defined signal 1
    Jul 23 14:58:27 sugar monit[815]: 'omv-engined' trying to restart
    Jul 23 14:58:27 sugar monit[815]: 'omv-engined' start: /bin/systemctl
    Jul 23 14:58:27 sugar systemd[1]: openmediavault-engined.service: Supervising process 6815 which is not our child. We'll most likely not notice when it exits.
    Jul 23 14:58:27 sugar systemd[1]: openmediavault-engined.service: main process exited, code=exited, status=255/n/a
    Jul 23 14:58:27 sugar systemd[1]: Unit openmediavault-engined.service entered failed state.
    Jul 23 14:58:57 sugar monit[815]: 'omv-engined' failed to start (exit status 0) -- no output
    Jul 23 14:58:57 sugar monit[815]: 'omv-engined' restart action done
    Jul 23 14:59:27 sugar monit[815]: 'omv-engined' process is not running
    Jul 23 14:59:27 sugar monit[815]: 'omv-engined' trying to restart
    Jul 23 14:59:27 sugar monit[815]: 'omv-engined' start: /bin/systemctl
    Jul 23 14:59:27 sugar systemd[1]: openmediavault-engined.service: Supervising process 6853 which is not our child. We'll most likely not notice when it exits.
    Jul 23 14:59:28 sugar systemd[1]: openmediavault-engined.service: main process exited, code=exited, status=255/n/a
    Jul 23 14:59:28 sugar systemd[1]: Unit openmediavault-engined.service entered failed state.
    Jul 23 14:59:58 sugar monit[815]: 'omv-engined' failed to start (exit status 0) -- no output
    Jul 23 15:00:01 sugar CRON[6860]: (root) CMD (/usr/sbin/omv-mkgraph >/dev/null 2>&1)
    Jul 23 15:00:01 sugar rrdcached[862]: Received FLUSHALL
    Jul 23 15:00:28 sugar monit[815]: 'omv-engined' process is not running
    Jul 23 15:00:28 sugar monit[815]: 'omv-engined' trying to restart
    Jul 23 15:00:28 sugar monit[815]: 'omv-engined' start: /bin/systemctl
    Jul 23 15:00:28 sugar systemd[1]: openmediavault-engined.service: Supervising process 6925 which is not our child. We'll most likely not notice when it exits.
    Jul 23 15:00:28 sugar systemd[1]: openmediavault-engined.service: main process exited, code=exited, status=255/n/a
    Jul 23 15:00:28 sugar systemd[1]: Unit openmediavault-engined.service entered failed state.
    Jul 23 15:00:58 sugar monit[815]: 'omv-engined' failed to start (exit status 0) -- no output



    I tried searching on some of these and its possible solutions, but it's not easily solved, not even for me. And this is my job.
    After a reboot, I get this again (under the [Show details] button):


    Error #0:exception 'OMV\Rpc\Exception' with message 'Failed to connect to socket: Connection refused' in /usr/share/php/openmediavault/rpc/rpc.inc:138Stack trace:#0 /usr/share/php/openmediavault/rpc/proxy/json.inc(95): OMV\Rpc\Rpc::call('Services', 'getStatus', Array, Array, 3)#1 /var/www/openmediavault/rpc.php(45): OMV\Rpc\Proxy\Json->handle()#2 {main}