NAS4Free 11.0.0.4.4303 released (FreeBSD 11.0-RELEASE-P10)

[zoon01]

The NAS4Free Team is pleased to announce the release of version 11.0.0.4.4303 - Sayyadina

Please upgrade asap!, it fixes CVE-2017-7494.
All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability,
allowing a malicious client to upload a shared library to a writable share, and then cause the server to load
and execute it.

Download build 11.0.0.4.4303
Read the readme_11.0

Major Change!

cifs/smb note:
==============
From Samba 4.5.0 and up the default value for the "ntlm auth" option is changed from "yes" to "no".
This may have impact on very old clients which doesn't support NTLMv2 yet.
Only if you really need NTLMv1 Authentication you can set in Additional Parameters: "ntlm auth = yes".

BUILD 11.0.0.4.4303

Changes after release 11.0.0.4.4282
===============================
- Update translations.
- Enable import volume block size.
- Add primarycache and secondarycache configuration option to zfs volumes.
- Add SHA-512 and Skein option for ZFS volume deduplication.
- Rewrite code parts on diag_infos_raid.php.
- Rewrite code parts on diag_infos_smart.php.
- Upgrade nano to 2.8.4.
- Upgrade sudo to 1.8.20.
- Upgrade samba to 4.6.4, FIX CVE-2017-7494.
- Fix WebGUI access via IPv6 HTTPS.

Note:
Clear your browser's cache to avoid display issues after upgrade.
Make a new backup of your system configuration and store this on safe location.

Enjoy!

Regards,
The NAS4Free Team

[zoon01]

Important Release,

Do not wait to upgrade your system(s) before it might be to late!

[provels]

Thanks for the crazy fast update to 10.x and 11.x. You guys are something else!

[JoseMR]

Upgraded my server trough the WebGUI and so far so good, kudos to the NAS4Free Team for such great work and product attention.

[slaycock]

Updating 4249 to 4282 went fine.

Updating 4282 to 4303 failed


Executing: Mounting /cf in read-write mode
Mount: dev/asa0p2: Device busy
Error: Mounting /cf in read-write mode
Executing: Mounting /cf in forced read-write mode
mount: /dev/ada0p2: Device busy
Error: Mounting /cf in forced read-write mode

Nas4free is an embedded install on a 32GB SSD

[Felix Riesterer]

Can I "simply" flash my USB memory stick (containing 9.1.0.1.531) with "NAS4Free-x64-embedded-11.0.0.4.4303.img.xz" and import the old config XML file? Details posted here: viewtopic.php?f=16&t=11986#p78045

[JoseMR]

Can I "simply" flash my USB memory stick (containing 9.1.0.1.531) with "NAS4Free-x64-embedded-11.0.0.4.4303.img.xz" and import the old config XML file? Details posted here: viewtopic.php?f=16&t=11986#p78045

Fresh install is required for the latest NAS4Free 11.x release and import configuration after install, bear in mind that NAS4Free 11.x series is 64-Bit only and modest hardware requirements.

Please read the release "Readme" files for hardware information and requirements.

Regards

[nasser]

Does the upgrade via the webGui on a full install overwrite the contents of /root/ ?

[Felix Riesterer]

Fresh install is required for the latest NAS4Free 11.x release and import configuration after install

So I need to flash my memory stick with an extracted "NAS4Free-x64-LiveUSB-11.0.0.4.4303.img.gz" rather than upload "NAS4Free-x64-embedded-11.0.0.4.4303.img.xz" via the web GUI? Or what do you mean by "fresh install"?

bear in mind that NAS4Free 11.x series is 64-Bit only and modest hardware requirements.

My current setup is 64bit with 8GB RAM and a decent CPU.

I just cannot lose all my data on XFS so I'm hesitant to uprade - even though SambaCry is lurking (mostly Ubuntu on my LAN so there's that).

How are my chances that after this fresh install and re-importing my previous config my data is still accessible on my XFS volumes? I have two HDDs with both 3TB as an XFS RAID so you see why I'm not willing to upgrade without making sure that the thing will still work after this upgrade. And yes, I understand that a fix for the 9.1-version of Nas4Free is out of the question.

[raulfg3]

XFS RAID have no sense for me , can you provide more info?

[Felix Riesterer]

Hi raulfg3,

XFS RAID have no sense for me , can you provide more info?

NAS4free calls it ZFS pool devices. And since ZFS basically does a software RAID I simply called it an XFS RAID. I'm not familiar with the inner workings of a ZFS storage system. I just want to make sure that after my upgrade the data on my HDDs can still be accessed. That's all.

[raulfg3]

So I need to flash my memory stick with an extracted "NAS4Free-x64-LiveUSB-11.0.0.4.4303.img.gz" rather than upload "NAS4Free-x64-embedded-11.0.0.4.4303.img.xz" via the web GUI? Or what do you mean by "fresh install"?

you need to boot from liveUSB or liveCD and do a new fresh install.

after this you need to import yout disk and your pool (no data lost here), and configure services by hand.

PD: Previosly is a good work to save screen capture of how you have your actual N4F configured, and save config.xml in non encrypt form to use as reference for config.

is a pity , but you only need to do on great upgrades because boot and swap partitions grow in size and normal webGUI update do not work.

[JoseMR]

Does the upgrade via the webGui on a full install overwrite the contents of /root/ ?

Full WebGUI upgrade(RootOnZFS Only) will create a separate Boot Environment then will overwrite latest files on that BE and activates it, this will leave the previous install/BE intact so you can revert(ZFS rollback) easily with the "beadm" utility in case something goes wrong or if a recent pkg install damage some files, though if the system is non bootable, a LiveMedia is required to manually rollback for now, this may be later supported with GRUB eventually.

Full upgrade through the LiveMedia(Legacy) will directly overwrites the installed system, but will create a snapshot before proceed with such upgrade for security purposes, so you will also be able to rollback as well.

Additionally, the upgrade will keep newer files(user modified files) during the overwrite, and manual replacement for such files may be required, this may be changed in future but as everyone know, "Full Installs" are targeted for developers and advanced users.

Regards

[Felix Riesterer]

you need to boot from liveUSB or liveCD and do a new fresh install.

OK, I can do that.

after this you need to import yout disk and your pool (no data lost here), and configure services by hand.

You mean my users and my samba shares won't come back by loading my saved config file?

PD: Previosly is a good work to save screen capture of how you have your actual N4F configured, and save config.xml in non encrypt form to use as reference for config.

I'm not sure I understand you here. Do you mean to advise me to make and store a screenshot of my configuration displayed in the web GUI as well as the XML file itself?

is a pity , but you only need to do on great upgrades because boot and swap partitions grow in size and normal webGUI update do not work.

OK, I understand that a simple upload of a new image into the web GUI won't work for $reasons. All I really worry about is data loss on my HDDs since I've never done a major version upgrade with NAS4free so far - nor made any experiences with XFS besides running a really cool FOSS NAS system. But if I understand you correctly I don't need to worry since this part is retrievable by loading my config XML file.

[riki]

Thanks for the terrificly good and quick jobs you constantly deliver!

A small glitch: since I updated to 11, I haven't been able to upgrade via the UI. The system won't boot. I have to reinstall each time. A minor issue, of course. Just for your information. I properly reinstalled when I passed from 10 to 11.

Thanks again!

[nasser]

Hi Jose, thanks for reply. So I have to save the contents auf /root/ (some custom scripts) to another location?

Does the upgrade via the webGui on a full install overwrite the contents of /root/ ?

Full WebGUI upgrade(RootOnZFS Only) will create a separate Boot Environment then will overwrite latest files on that BE and activates it, this will leave the previous install/BE intact so you can revert(ZFS rollback) easily with the "beadm" utility in case something goes wrong or if a recent pkg install damage some files, though if the system is non bootable, a LiveMedia is required to manually rollback for now, this may be later supported with GRUB eventually.
...
Additionally, the upgrade will keep newer files(user modified files) during the overwrite, and manual replacement for such files may be required, this may be changed in future but as everyone know, "Full Installs" are targeted for developers and advanced users.

Regards

[JoseMR]

Hi Jose, thanks for reply. So I have to save the contents auf /root/ (some custom scripts) to another location?

Hello, you don't have to save custom scripts or installed packages, since the upgrade will overwrite system files only, however there are some packages who may modify certain core files and could either alter system and/or package functionality, though this is where the advanced/experienced users are aware off, so be careful when customizing.

Regards

[CrashDavis]

My CIFS is now broke with this upgrade. #1 I have a 2003 Windows server for Domain/DNS (why...I know) but I haven't had time to upgrade. I have it set for SMBv2 now no drives will map from my Win10 machines to the NAS. Primarily seeing the below error:

Jun 1 18:42:48 smbd[80003]: [2017/06/01 18:42:48.903509, 1] ../source3/librpc/crypto/gse_krb5.c:607(gse_krb5_get_server_keytab)
Jun 1 18:42:48 smbd[80003]: ../source3/librpc/crypto/gse_krb5.c:607: Error! Unable to set mem keytab - -1765328254
Jun 1 18:42:48 smbd[80003]: [2017/06/01 18:42:48.903526, 1] ../auth/gensec/gensec_start.c:698(gensec_start_mech)
Jun 1 18:42:48 smbd[80003]: Failed to start GENSEC server mech gse_krb5: NT_STATUS_INTERNAL_ERROR

[ms49434]

My CIFS is now broke with this upgrade. #1 I have a 2003 Windows server for Domain/DNS (why...I know) but I haven't had time to upgrade. I have it set for SMBv2 now no drives will map from my Win10 machines to the NAS. Primarily seeing the below error:

Jun 1 18:42:48 smbd[80003]: [2017/06/01 18:42:48.903509, 1] ../source3/librpc/crypto/gse_krb5.c:607(gse_krb5_get_server_keytab)
Jun 1 18:42:48 smbd[80003]: ../source3/librpc/crypto/gse_krb5.c:607: Error! Unable to set mem keytab - -1765328254
Jun 1 18:42:48 smbd[80003]: [2017/06/01 18:42:48.903526, 1] ../auth/gensec/gensec_start.c:698(gensec_start_mech)
Jun 1 18:42:48 smbd[80003]: Failed to start GENSEC server mech gse_krb5: NT_STATUS_INTERNAL_ERROR

Windows Server 2003 (incl. R2) supports SMB v1.0

[CrashDavis]

My CIFS is now broke with this upgrade. #1 I have a 2003 Windows server for Domain/DNS (why...I know) but I haven't had time to upgrade. I have it set for SMBv2 now no drives will map from my Win10 machines to the NAS. Primarily seeing the below error:

Jun 1 18:42:48 smbd[80003]: [2017/06/01 18:42:48.903509, 1] ../source3/librpc/crypto/gse_krb5.c:607(gse_krb5_get_server_keytab)
Jun 1 18:42:48 smbd[80003]: ../source3/librpc/crypto/gse_krb5.c:607: Error! Unable to set mem keytab - -1765328254
Jun 1 18:42:48 smbd[80003]: [2017/06/01 18:42:48.903526, 1] ../auth/gensec/gensec_start.c:698(gensec_start_mech)
Jun 1 18:42:48 smbd[80003]: Failed to start GENSEC server mech gse_krb5: NT_STATUS_INTERNAL_ERROR

Windows Server 2003 (incl. R2) supports SMB v1.0

BAHHH Totally false alarm on my side. Sorry. Absolutely nothing wrong with the release. The problem was just coincidence in that the time (NTP) was off from my Domain Controller on the NAS. Was throwing errors. Seems time sync is fairly important. LOL

[ernie]

Hello
The update is fine and works. Thanks to developers for this new release.
But on iPad or iPhone I cannot scroll vertically only on the view System/status

Édit: same behavior with Diagnostic/information/disk view and status/monitoring/system load.

BR

[jamaroney]

Below is a post from the 4249 release, but I have the same issue with this release (although my samba seems to be working fine):

I'm reading the following lines after update to this release, I think it's related to new samba version. Version .4195 was running fine.

Code: Select all

smbd[28971]: reply_sesssetup_and_X: Rejecting attempt at 'normal' session setup after negotiating spnego.
smbd[28971]: [2017/05/05 23:15:43.660413, 0] ../source3/smbd/sesssetup.c:863(reply_sesssetup_and_X)

[alexey123]

Hi
I inspect services order

Code: Select all

service -r
/etc/rc.d/system_init
/etc/rc.d/SYSTEMINIT
/etc/rc.d/rcconf
/etc/rc.d/execcmd_preinit
/etc/rc.d/timezone
/etc/rc.d/userdb
/etc/rc.d/CONFIG
/etc/rc.d/geom
/etc/rc.d/geli
/etc/rc.d/swap
/etc/rc.d/fsck
/etc/rc.d/root
/etc/rc.d/sysctl
/etc/rc.d/fusefs
/etc/rc.d/mountcritlocal
/etc/rc.d/var
/etc/rc.d/cleanvar
/etc/rc.d/FILESYSTEMS
/etc/rc.d/adjkerntz
/etc/rc.d/hostname
/etc/rc.d/ip6addrctl
/etc/rc.d/netoptions
/etc/rc.d/random
/etc/rc.d/vmsetup
/etc/rc.d/ipfilter
/etc/rc.d/hostid
/etc/rc.d/netif
/etc/rc.d/devd
/etc/rc.d/pfsync
/etc/rc.d/pflog
/etc/rc.d/pf
/etc/rc.d/routing
/etc/rc.d/ipfw
/etc/rc.d/netwait
/etc/rc.d/hosts
/etc/rc.d/ldap
/etc/rc.d/netfix
/etc/rc.d/nsswitch
/etc/rc.d/pam
/usr/local/etc/rc.d/vboxnet
/etc/rc.d/resolv
/etc/rc.d/NETWORKING
/etc/rc.d/iscsi_initiator
/etc/rc.d/mountcritremote
/etc/rc.d/dmesg
/etc/rc.d/devfs
/etc/rc.d/clog
/etc/rc.d/syslogd
/etc/rc.d/SERVERS
/etc/rc.d/dnsmasq
/etc/rc.d/hastd
/etc/rc.d/iscsid
/etc/rc.d/ntpdate
/etc/rc.d/rpcbind
/etc/rc.d/nfsuserd
/etc/rc.d/mountd
/etc/rc.d/nfsd
/etc/rc.d/statd
/etc/rc.d/lockd
/etc/rc.d/msmtp
/etc/rc.d/DAEMON
/etc/rc.d/ataidle
/etc/rc.d/iscsi_target
/etc/rc.d/local
/etc/rc.d/motd
/etc/rc.d/nut
/etc/rc.d/nut_upslog
/etc/rc.d/nut_upsmon
/etc/rc.d/powerd
/etc/rc.d/proftpd
/etc/rc.d/proxy
/etc/rc.d/samba
/etc/rc.d/smartd
/etc/rc.d/vmguestd
/etc/rc.d/LOGIN
/usr/local/etc/rc.d/vboxwebsrv
/usr/local/etc/rc.d/vboxwatchdog
/usr/local/etc/rc.d/vboxheadless
/etc/rc.d/zfs
/etc/rc.d/zfsd
/etc/rc.d/websrv_htpasswd
/etc/rc.d/websrv
/etc/rc.d/vbox
/etc/rc.d/unison
/etc/rc.d/transmission
/etc/rc.d/execcmd_postinit
/etc/rc.d/thebrig
/etc/rc.d/tftpd
/etc/rc.d/syscons
/etc/rc.d/syncthing
/etc/rc.d/swaplate
/etc/rc.d/sshd
/etc/rc.d/rsync_client
/etc/rc.d/rsync_local
/etc/rc.d/cron
/etc/rc.d/jail
/etc/rc.d/securelevel
/etc/rc.d/rsyncd
/etc/rc.d/ppp
/etc/rc.d/nfscbd
/etc/rc.d/netatalk
/etc/rc.d/mt-daapd
/etc/rc.d/moused
/etc/rc.d/minidlna
/etc/rc.d/mdnsresponder
/etc/rc.d/htpasswd
/etc/rc.d/lighttpd
/etc/rc.d/LCDd
/etc/rc.d/lcdproc
/etc/rc.d/inadyn
/etc/rc.d/hostapd
/etc/rc.d/fuppes
/etc/rc.d/fmperm
/etc/rc.d/bsnmpd
/etc/rc.d/bgfsck
/etc/rc.d/beep
/etc/rc.d/autosnapshot

I see on place of /etc/rc.d/execcmd_postinit and I think it have wrong place - it must be after /etc/rc.d/bsnmpd
Isn't it ?

[Parkcomm]

I upgraded to this release in May and have since face stability issues in the form of kernel panics.

A little history - before the upgrade the machine had not rebooted for more than a year an was rock solid. However after the upgrade the LAN card seemed faulty (lots of interrupts) they could have been valid I guess but I was suspicious. I swapped the (EM) card out for a dual (IGB) card - which I have configured as a single lagg.

The system rebooted and operated reliably and I was happy. However what I have noticed is that while it is solid after boot if the config is not changed, some fairly simple operations can create a kernel panic (page not present error). This can happen immediately after rebooting with lot of free memory and no load. I've done Memtest86 with no problem found and have observed similar behaviour with two different network cards. I have also reinstalled the embedded image on new USB stick.

I have swap configured.

What I'd like to do now i have a look at a back trace - is there an easy way to configure this, I have captured a crash dump but I do not have a debug kernal for nas4free to use with a debugger (I don't even know is this works the same as freebsd)? Any help would be appreciated.

btw: I am not panicked about this state of affairs, once I reboot if I make no config changes the NAS operates as solid as a rock!

[raulfg3]

I see in your signature that you use embeded install.

My suggest is.

1 - save your actual config
2 - shutdown
3 - save your actual USB boot device in a safe place, buy a new one and do a new fresh embeded install
4 - restore your config
5 - test stability.

perhaps you think that none changes, but in my experinece with N4F some stability issues are because the use of and old install/USB, so a new fresh install on a NEW USB, solve the problem.


If not, you only need to revert to old USB and actual stability issues.

[spy0r]

I have also reinstalled the embedded image on new USB stick.

[raulfg3]

I have also reinstalled the embedded image on new USB stick.

Sorry , I do not see it when read the post.

[Parkcomm]

I see in your signature that you use embeded install.

My suggest is ...


If not, you only need to revert to old USB and actual stability issues.

Maybe I was not clear but I did exactly this and the problem remains - thanks. Any other suggestions?