|
Bonobos posted:What exactly is wrong with BTRFS? Honest question, Synology seems to recommend it for their NASes and i was gonna roll with that when my next synology arrives. Sniep posted:same, i've got a 2/3rds full 50T synology with BTRFS+SHR - hell, that was the default even lol Err... He already answered that a couple posts after the one you quoted.
|
![]() |
|
Thanks for the help guys - Funny thing is that it actually hibernated last night, but not WoL doesn't turn it on again... Exciting times...
|
![]() |
|
Also, just to check I am not a complete fucking idiot (it has happened before). With auto power-off I should still be able to do a WoL, and not just when I do a standard shut down from the menu?
|
![]() |
|
You can't even enable auto power off without enabling WOL, so I would assume that should work.
|
![]() |
|
Check the level of hibernation and model: https://www.synology.com/en-us/know...WOL_Wake_on_LAN
|
![]() |
|
Had a disaster earlier on this week, last time we had a power cut the USB stick my xpenology boots off became unreadable. The power was going off again, so I shut it down this time. Power comes back on, USB stick dead again. Had to find a loader that works and then patch it up, but kept having problems with that too. Managed to get into 6.1.7 and it's working now. Nzbget wasn't booting at all so I gave containers a go for the first time. Went pretty ok but had problems with nzbToMedia and Sonarr, it wasn't able to access the folder it was sending even though permissions were ok, had to do a remote mount of the folder. Expecting to have to do the same with CouchPotato but might move over to a Radarr container instead Don't really understand why my USB has become unreadable and needs to be formatted just because the power goes off. Something to do with write caching on it maybe? It's a Gen8 MicroServer, maybe some bios setting somewhere?
|
![]() |
|
I know this isn't helpful for your current situation; but, if possible, look into migrating to a SSD or SATADOM boot drive.
|
![]() |
|
uhhhhahhhhohahhh posted:Don't really understand why my USB has become unreadable and needs to be formatted just because the power goes off. Something to do with write caching on it maybe? It's a Gen8 MicroServer, maybe some bios setting somewhere? It's a bad/dying USB stick - just get a new one. USB storage is so utterly cheap that the manufacturing companies (all of them, even name brand) generally use the crappiest/cheapest components that really aren't designed to be powered 24/7 so eventually fail in that role in weird ways. But when you quickly use them (eg: for passing files around), they actually seem to work. This is a lovely problem that people running clusters of servers booting off USB sticks run into all the time.
|
![]() |
|
I have Emby installed on my Synology. At present it's happily serving up Linux videos over my home network, but I'd like to be able to access these from outside the house. So, the eternal 1,000,000 question: how do I access my Emby from elsewhere, without ending up turning my server into some Chinese gangster's Bitcoin miner? I've found this relatively-recent guide that seems to answer my question: https://www.grahamleggat.com/blog/2...se-proxy-server - is this good advice?
|
![]() |
|
Synology has a few ways to allow you to connect to it remotely, but here is the jist: If you want to be secure, setup a VPN and connect the synology to it, and then connect to that externally. Have an external firewall, that at the very least only opens the ports you absolutely need too, do not use upnp. I would suggest you use a DDNS to connect to the VPN as well, so if your IP address changes it will stay the same connection. Since, there are so many routers, here are how to do all this via the synology: https://www.synology.com/en-us/know...enter/vpn_setup https://www.synology.com/en-us/know...nology_services https://www.synology.com/en-us/know...connection_ddns https://www.synology.com/en-us/know...ion_certificate I know it seems like a cluster of stuff, but pretty much you have all the jist of how to do all of that. However, you can do all of this from a router as well, it requires similiar setup, but of course, these links wouldn't be as useful.
|
![]() |
|
So I switched to the zfs-on-linux 0.8 repository on my ubuntu 18.04 box a few weeks ago, primarily around the scrub / resilver improvements. They weren't kidding - my scrubs were anywhere between 50-100 hours before. The last two have been under 20 hours each.
|
![]() |
|
unknown posted:It's a bad/dying USB stick - just get a new one. This was a different USB stick from the first time it happened. I formatted this thing like 15 times trying to get the bootloader working, it seemed fine ![]() Alzabo posted:I know this isn't helpful for your current situation; but, if possible, look into migrating to a SSD or SATADOM boot drive. Probably a good idea, the small ones so cheap these days. What I really need to do is move to using OMV so I'm not relying on this xpenology bodge, just haven't finished testing on a VM yet and really can't be bothered to janitor when I get home from work. Everything's containerised now anyway, what does it matter what where this running from. There is a spare ODD slot in the Gen8 that I can boot from. Just need to get a floppy to sata paper converter.
|
![]() |
|
Axe-man posted:Synology has a few ways to allow you to connect to it remotely, but here is the jist: What benefit does using a VPN offer? It's like, OK, that's how to install VPN Server on the thing, but I've no idea what any of the available options do, if any configuration would be best for me, or if changing them is counterproductive and likely to break anything, etc. I don't mean to sound ungrateful, far from it, but the official Synology guides assume I molest computers for a living and thus already know exactly what I need to do. I don't! Compared to the guide I found myself: quote:If you would like to reach all your services through a single secure port (443) with SSL then continue reading. If you run Sonarr, Radarr, Deluge, Sabnzbd, Plexpy etc then your will benefit greatly by securing them behind a reverse proxy and by using Let Encrypt to secure those hosts.
|
![]() |
|
spincube posted:What benefit does using a VPN offer? A VPN will only allow those with the appropriate credentials (I would recommend certificate vs username/pass) to connect to it. At that moment they became part of the internal network. The applications themselves are not exposed to the wider internet, therefore, whatever bugs they may have do not affect you as much. The VPN software is hopefully more secure. Even if it isn't, it's only one attack vector as opposed of many. And only one piece of software that you need to worry to keep updated as opposed to many. spincube posted:Compared to the guide I found myself: quote:If you run Sonarr, Radarr, Deluge, Sabnzbd, Plexpy etc then your will benefit greatly by securing them behind a reverse proxy and by using Let Encrypt to secure those hosts. LetsEncrypt doesn't secure anything, it merely encrypts the traffic between the client and the server. But will allow any client to connect (if it can get by the firewall). It's valuable to have the traffic encrypted (a VPN will do that too), but let's not confuse that with "security". spincube posted:the official Synology guides assume I molest computers for a living and thus already know exactly what I need to do. I don't! I would be wary of exposing internal home network services to the internet if I am not confident in what I'm doing. I would recommend starting to molest computers for a living or pay someone to do it for you. But, it is your network and you are completely free to do anything you want. Odds are you'll be fine though, until proven otherwise.
|
![]() |
|
spincube posted:What benefit does using a VPN offer? It's like, OK, that's how to install VPN Server on the thing, but I've no idea what any of the available options do, if any configuration would be best for me, or if changing them is counterproductive and likely to break anything, etc. I don't mean to sound ungrateful, far from it, but the official Synology guides assume I molest computers for a living and thus already know exactly what I need to do. I don't! Those are all valid questions, and the post above goes into what VPNs offer over other services. So lets go over this walkthrough of creating a VPN with synology. For setting it up: https://www.synology.com/en-us/know...enter/vpn_setup For connecting to it: https://www.synology.com/en-us/know...ndows_PC_or_Mac As was said before, VPNs are literal networks that just require credentials to join and use, they also offer encryption that is much better than normal consumer local networks. This means that if someone hacks your wireless by sitting in a car for a few hours gaining packets, they would have to do another much harder layer of encryption to get beyond that. With Synology specifically they offer multiple versions of it. OpenVpn: It is easy to use, open source and regularly updated. However, it is not the most secure. It is allow you to have a VPN for everyday use traffic and is easier to setup. PPTP VPN: It is one of the least secure VPNs but it is very fast compared to other options. It is a protocol, honestly I would go open VPN unless you are using it to just gate people. It is also the oldest and thus most likely your computer is already setup to use it. Really though, use OpenVPN instead. L2TP/IPEC: This is the highest level of VPN that synology offers. If you look up at the guide it is also the hardest to setup. It also has much more overhead than other VPNs, so it can be slower. However, it is the most secure because synology requires you to use IPEC. Once you have decided on setting it up, and which type, then you just need to know how your computer will connect to it. I suggest following the connection guide fully. At the bottom in section 4 it step by step tells you how to turn on multiple gateways so that you can have the normal internet (if you decide not to go through the VPN to get it) and also the vpn connection for it. I hope this explains things a bit better. Axe-man fucked around with this message at 20:09 on Jul 4, 2019 |
![]() |
|
As an aside, if you decide this is all way to much work. Then here are synology options for NOT doing this. Now, everyone here is going to scoff a bit, but I mean, they do work. https://www.synology.com/en-us/know...er_the_Internet
|
![]() |
|
IOwnCalculus posted:So I switched to the zfs-on-linux 0.8 repository on my ubuntu 18.04 box a few weeks ago, primarily around the scrub / resilver improvements. Wow thats great. Is it a hassle to switch?
|
![]() |
|
unknown posted:USB storage is so utterly cheap that the manufacturing companies (all of them, even name brand) generally use the crappiest/cheapest components that really aren't designed to be powered 24/7 so eventually fail in that role in weird ways. ....This is a lovely problem that people running clusters of servers booting off USB sticks run into all the time. Is there any hope, especially for those of us with OSes that require flash drives (UnRAID)? When I last looked into it the only real solution was to use SLC drives. Those are somewhat harder to find and not exactly cheap.
|
![]() |
|
Heners_UK posted:Is there any hope, especially for those of us with OSes that require flash drives (UnRAID)? When I last looked into it the only real solution was to use SLC drives. Those are somewhat harder to find and not exactly cheap. Does Unraid do any writing? I thought it just loaded read only and doesnt write any logs or anything to the drive. Add in that I personally reboot maybe once every 3 months tops it should be fine for a while. I should probably take an image of it to save settings though just to be safe.
|
![]() |
|
priznat posted:Does Unraid do any writing? I thought it just loaded read only and doesnt write any logs or anything to the drive. It minimises doing so, but does not entirely eliminate any writing. Anecdotally, they basically expect you to loose one drive per year. I use CA Backup/Restore to backup the flash drive weekly to Crashplan.
|
![]() |
|
Thermopyle posted:Wow thats great. The switch itself is pretty painless, just adding some new sources and running a few apt update / upgrade / install commands. There was one package that supposedly you would only need if you were running on 16.04, that I had to install anyway so that the ZFS upgrade would work. After that, kernel updates take longer to run since it has to compile a few things, but still worth it
|
![]() |
|
My server is still on 14.04, so I'm sure that'll make it exponentially more frustrating.
|
![]() |
|
Axe-man posted:OpenVpn: It is easy to use, open source and regularly updated. However, it is not the most secure. It is allow you to have a VPN for everyday use traffic and is easier to setup. OpenVPN: Probably fine, disable compression. They invented their own protocol which is a huge no-no in computer security land, but so far near as I can tell most of the problems with it are a Padding Oracle attack which is completely defeated by disabling compression. This is a common attack on basically all compression in encryption. Lots of eyes and open source software means it's likely they were smart enough to get it right. PPTP is broken and should not be used in greenfield scenarios. L2TP/IPSEC/IKE: Also great, thanks NSA! Brick wall style learning curve, especially if you don't have exact instructions for every device you want to use. Parts of it are built into the IP protocol as protocol 51; TCP is protocol 6. I'm actually about to work through this right now. For the novice I would suggest OpenVPN. I am a professional computer molester and I'm going to use it. There are guides online for pretty much every device. If you're using regular old computers on each end and not some awful tablet/phone/etc then just run the openvpn client on both ends and don't think too hard about it. ![]() Why? With all security you need to stop and figure out what you are trying to accomplish. You have Authentication, Authorization and Accounting ("AAA", aka logging in, being allowed to do something, and then logging what is done) and then you can provide yourself with Confidentiality and Integrity through encryption (and Authentication, but we already covered that.) At its most basic you likely want to keep the normal bad guys out, but you're not trying to keep state sponsored attackers out (Authentication), provide yourself with cheap opacity against your ISP knowing what you are doing (Confidentiality), and you should probably know if the bits got flipped along the way - you don't care but you're likely going to get it regardless (Integrity.) Here is what a sample AEAD will look like in OpenVPN logs: Thu Jul 4 22:46:24 2019 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA TLS: Protocol, previously known as SSL. version 1.2 - go no lower unless your devices don't support it. ECDHE: Elliptic Curve Diffie-Helman Exchange - More security per cpu cycle! (Cheaper! Faster!) RSA: Authentication - Certificates above, used to authentication your OpenVPN server to you. If you use client certificates then you also authenticate back to your server with one. AES256: What your Linux Videos are encrypted with, working in Galois counter mode SHA384: A SHA-2 integrity provider/hash algorithm. It's more expensive than SHA256 and not necessary. (Options: SHA256, SHA384, SHA512)
|
![]() |
|
Dunno if Synology supports it but Wireguard is a very easy to setup and use (not to mention fast) VPN option as well, though the fact that it hasn't been fully audited is a minor concern for business use. It's open source though and in use and supported by many VPN providers such as AzireVPN, Mullvad, etc. I run it at home on all my stuff since it's so low overhead that even my Ubiquiti router can run it at full speed without issue. It's making its way into the Linux kernel before long as well, which will be nice since right now you need to install the kmod separately. Sheep fucked around with this message at 02:35 on Jul 5, 2019 |
![]() |
|
Sheep posted:Dunno if Synology supports it but Wireguard is a very easy to setup and use (not to mention fast) VPN option as well, though the fact that it hasn't been fully audited is a minor concern for business use. It's open source though and in use and supported by many VPN providers such as AzireVPN, Mullvad, etc. If it's going into mainline one hopes it's good enough. Unlike that lightweight crypto Google rushed in, and the back out when it turned out to be bad.
|
![]() |
|
Let me just quote Linus Torvalds:quote:From Linus Torvalds <> I think the issue with merging it thus far is that he tried to shoehorn in a new crypto interface in the same request for the wireguard merge, which no one was really going for. I haven't really followed it much since last year (my year old build works fine so why touch it) so I'm not sure what, if anything, has changed in the interim. The real nice thing is that there's close to zero configuration to fuck up, so it's very easy for people that don't want to deep dive into IKE and such, or follow whatever random tutorial for generating a (probably insecure) OpenVPN config. If your endpoints connect with Wireguard, you're good. Sheep fucked around with this message at 04:18 on Jul 5, 2019 |
![]() |
|
Yeah I've been using Wireguard for a year or two. It's pretty great from an ease of use perspective.
|
![]() |
|
Sheep posted:Let me just quote Linus Torvalds: There's a good discussion about the kernel situation in this LWN article, circa a few months ago. The gist is that people are iffy about adding Zinc (the crypto library you mention) without cleaning up some of the duplication that results from that. But that's effectively discussion about the details of how to get it in, rather than whether people think it's worthwhile. In the meantime there's since been a gushing article about an alpha-level Windows client on Ars Technica. I haven't tried it yet as I'd still been holding out for it to hit Linux mainline, but I may just give it a shot regardless.
|
![]() |
|
IOwnCalculus posted:So I switched to the zfs-on-linux 0.8 repository on my ubuntu 18.04 box a few weeks ago, primarily around the scrub / resilver improvements. Axe-man posted:L2TP/IPEC: This is the highest level of VPN that synology offers. If you look up at the guide it is also the hardest to setup. It also has much more overhead than other VPNs, so it can be slower. However, it is the most secure because synology requires you to use IPEC. If you think it's hard to setup, use algo - it can even make one-click profiles for the most commonly used OS', if I recall correctly. Sheep posted:Dunno if Synology supports it but Wireguard is a very easy to setup and use (not to mention fast) VPN option as well, though the fact that it hasn't been fully audited is a minor concern for business use. It's open source though and in use and supported by many VPN providers such as AzireVPN, Mullvad, etc.
|
![]() |
|
Personally I think that l2tp/ipec is really easy to setup. And yeah the slow is in reference to synology and what I have seen preformance wise.compared to like open vpn where you can download an app and press a button it is more time investment to set it up. Honestly for me doing all of this is easy just dont come to me if you have nat issues with your double vpn network issues. ![]()
|
![]() |
|
I think people have a habit of over analyzing best security practices for their copied movies.
|
![]() |
|
Listen just cause I have more firewalls than I do contacts in my phone and I nicknamed it the Gibson doesn't mean I am trying to be a movie hacker.
|
![]() |
|
Sheep posted:Let me just quote Linus Torvalds: Neato! Something which modernizes / best practices VPNs for the masses is great news. Thanks! I assume when he says horrors he means code quality a-la the shit show that is OpenSSL. Duck and Cover posted:I think people have a habit of over analyzing best security practices for their copied movies. Mostly I want people to avoid implementing old broken technology and oopsing their way to becoming part of a botnet. If you're going to go through effort, might as well start with something new and actively developed.
|
![]() |
|
I recall hearing something about Wireguard reusing the nonse, which makes it less than ideal for VPN providers, but since I'd rather recommend people buy a VPS and host their own Wireguard instead of relying on a VPN provider, that doesn't seem like a downside.
|
![]() |
|
D. Ebdrup posted:I recall hearing something about Wireguard reusing the nonse, which makes it less than ideal for VPN providers, but since I'd rather recommend people buy a VPS and host their own Wireguard instead of relying on a VPN provider, that doesn't seem like a downside. https://www.wireguard.com/protocol/...-replay-attacks quote:Nonce Reuse & Replay Attacks Also Cloudflare built a Wireguard implementation in Rust which is pretty cool: https://github.com/cloudflare/boringtun Sheep fucked around with this message at 18:37 on Jul 5, 2019 |
![]() |
|
I use Mullvad as my VPN provider and this thread reminded me about Wireguard again. Everything is working very well.
|
![]() |
|
Sheep posted:https://www.wireguard.com/protocol/...-replay-attacks I'm not sure I'm very impressed by <thing reimplemented in rust> when the thing doesn't even have a stable interface yet (not that rust has stable interfaces, lol).
|
![]() |
|
Right. OK. I think I've grasped this. I have VPN Server installed on my Synology, serving up an OpenVPN network. PC and phone connect to it just fine, and can access the NAS just fine. The problem is that, when I'm not on my home network, I'm unable to connect to the VPN. I'm assuming it's something askew in my OpenVPN config. Looking at the readme spat out by VPN Server: quote:Edit VPNConfig.ovpn and replace YOUR_SERVER_IP with public IP of your DiskStation.
|
![]() |
|
spincube posted:Right. OK. I think I've grasped this. I have VPN Server installed on my Synology, serving up an OpenVPN network. PC and phone connect to it just fine, and can access the NAS just fine. The problem is that, when I'm not on my home network, I'm unable to connect to the VPN. You can most likely find on it by going to https://ifconfig.me/ or open powershell and run code:
D. Ebdrup fucked around with this message at 21:24 on Jul 5, 2019 |
![]() |
|
Hmm. Plugging in the external address, it thinks for a few seconds, and then:quote:TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) D. Ebdrup posted:Then you just have to pray that you're not on a carrier-grade NAT. No idea. It's fucked, anyway ![]()
|
![]() |