Posts by kitru870

Hi so I added in sssd.conf:

ldap_search_base = my domain
ldap_user_search_base = my user OU

ldap_group_search_base = my group OU

ldap_search_timeout = 120

ldap_enumeration_search_timeout =180

and in login.defs:

UID_MAX 999999999
GID_MAX 999999999

then getent passwd returns the local users and the 200 AD users remaining after filtering.

Though OMV GUI still doesn't show the users and return the error (communication failure) after 60 seconds.
Do you know what OMV is checking the users against and how ?

does it need a cache, and if so how should I check it ?

Hi,
the domain level is WS2008R2

DCs are probably WS2012.
Is there a way to narrow user account discovery to a specific OU which will reduce a lot the number of users ?

Hi donh ,
I have followed the instructions in the thread guide-to-omv-4-active-directory-integration

you participated in.

I use OMV 5.6.23.1.
my AD domain is more than 50K users.
I tried:

id first.last
it takes a long time but I get the user information.

getent passwd first.last
doesn't return anything

Then

getent passwd first.last@domain.tld

does return information

then running:

getent passwd

shows the local users and the only AD user: first.last

but I don't see the 50K users...

Then in the OMV GUI, Users... Loading it takes time and shows communication failure

Any idea on this ?
By the way where can I find the script you mentionned ?

Thanks

no it's not facing the internet. But it's not a reason not to protect.
I also tried to allow other ports as given in the plex documentation but it didn't help.

Again docker dynamically opens the required ports for the containers it's running.

The firewall settings only allow http and ssh.
Well actually that's what in the GUI.
Because I also have smb and nfs access which don't show here.

Also port 32400alllwed by docker for the plex container don't show either.

Of course on the internet a firewall is a requirement, but security always matters and I want to be able to select what can be reached or blocked.

Here is the iptables rules:

root@vopenmediavault:~# sudo iptables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -s XXXXXXXX -d XXXXXXXX -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s XXXXXXXX -d XXXXXXXX -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -j LOG
-A INPUT -d 127.0.0.1/32 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9000 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN

Here I can see docker related rules and the GUI rules. But no smb nor nfs which make sense since filtering is made in the conf files of these 2 protocols. Just surprised not to see the ports open for any in iptables then filtered by the conf files.
On the other way docker rules must be dynamic to allow 32400.

The firewall settings only allow http and ssh.
Well actually that's what in the GUI.
Because I also have smb and nfs access which don't show here.

Also port 32400alllwed by docker for the plex container don't show either.

Of course on the internet a firewall is a requirement, but security always matters and I want to be able to select what can be reached or blocked.

Here is the iptables rules:

root@vopenmediavault:~# sudo iptables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -s XXXXXXXX -d XXXXXXXX -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s XXXXXXXX -d XXXXXXXX -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -j LOG
-A INPUT -d 127.0.0.1/32 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9000 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN

Here I can see docker related rules and the GUI rules. But no smb nor nfs which make sense since filtering is made in the conf files of these 2 protocols. Just surprised not to see the ports open for any in iptables then filtered by the conf files.
On the other way docker rules must be dynamic to allow 32400.

Please find the logs attached.

When enabling the firewall I start to get messages like this one :

kernel: [2593411.461625] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=283 TOS=0x00 PREC=0x00 TTL=64 ID=5211 DF PROTO=UDP SPT=32414 DPT=35595 LEN=263

If I disable the firewall it stops printing these messages.

Hello,

I have installed the docker package linuxserver/plex for a plex server on my OMV 5.3.4-1.

I noticed that if the OMV firewall is running I can still access the plex server portal on port 32400, but I get "Server settings are unavailable." when trying to reach any of the settings pages.

Also the behaviour is altered on the client, missing covers, cannot start playing.

I have checked with wireshark and no other port than 32400 is used from the client.

So I'm expecting some kind of traffic between the container and the OMV host being blocked by the firewall.

Have you noticed this kind of issue when using a host firewall ?

How can I get it fixed ?

Thank you for your help

Quote from gderf

What are you copying over? Your existing data drives should be usable as is. Any existing users on the system should survive the upgrade too.
Some configuration migration feature was rumored for OMV 5. But I have no idea if it exists yet, and if if it does exist what it is and how to use it.

I move to a full different hardware: new drives, new motherboard...

Quote from gderf

There is no way to backup an OMV 4.x configuration (network, plugins, services, users...) and use it on another fresh install, regardless of the version of the new installation.

What you can do is use an unofficial method to upgrade your OMV 4.x installation to OMV 5. See:

Code

https://forum.openmediavault.org/index.php/Thread/27909-ETA-for-OMV-5-0-weeks-months-quarters-2020/?postID=219830#post219830

Caveats:

You must uninstall all plugins on the OMV 4.x install that do not have a corresponding OMV 5.x plugin. It's possible to identify which ones to remove, but it is easier to just uninstall all of them, making a list of all installed plugins first, along with any notes you feel necessary to have when you install the plugins in your new OMV 5.x. Some OMV 4.x plugins have no ported to OMV 5 version, so you will need to find other ways to do the same things or use forum provided suggestions / workarounds.

You only get one shot at an in-place upgrade. If it fails for any reason and you do not have a verified to work method to restore an OMV 4.x full system backup (so you can try the upgrade again).........so much toast.

I did an in place upgrade of OMV 4.x to 5.x by first uninstalling all plugins from OMV 4.x, performing the cited upgrade, and then installing all the plugins into OMV 5. It worked without any major problems. DNS resolution breaks from time to time, but it's easy to fix when it does. No idea why this is happening but it never happened until I upgraded to OMV 5.

Display More

Thank you for your feedback.
I suppose I also need to reapply owner/rights/shares/permissions... once everything is copied over.
Not complicated but still take some time.
Maybe OMV 5 comes with this migration configuration backup feature

Hi,
I'm planning to move my OMV install (4.1.22-1) to a new hardware (new motherboard, new larger disks...).

I was considering OMV 4 as it's the current stable release, but OMV 5 seems stable enough from what I read.
It looks like there is no way to back up configuration (network, plugins, services, users...). Do I need to do it manually (not difficult but better if a couple of clicks)
Then data. I can do a rsync between both. But I'm wondering how to migrate permissions/owners simply.
I don't feel the available plugins can do this.

But it seems OMV 5 supports configuration backups. When is it expected to be released as stable ?
Or I could upgrade to OMV 5 and use the config backup feature.

How would you do it simply ?
Thank you for your advices.