Blog

Blog

Create timemachine share in TrueNAS

Posted on by Bian Xi Leave a Comment on Create timemachine share in TrueNAS

Create timemachine share in TrueNAS

Note: I got issue suddenly after sometimes, and spent hours to fix it. End up, I switched back to Synology NAS as timemachine. Check Update section.

Tried many hours on setting up time machine backup in TrueNAS Scale, encountered many issues. To save time next time, record important steps and parameters for for next setup.

Create dataset

Create a dataset called timemachine under zpool pool1. Set ACL Type of dataset to POSIX.

Create user

Creating new user/group is not a good way if the NAS is also used for other user from same machine at same time. This is because the TrueNAS will use both user to login, which is hard to troubleshoot and confusing. If do not create new user, the ownership/permission of sharing dataset is also hard to decide. To use dedicated user for timemachine, following steps can be used.

Create a new named as user id tm with group tm. It will create a sub-dataset in ZFS under timemachine dataset. Change home directory of tm to the dataset created in Create dataset section.

The Auxiliary Groups have a group named as builtin_users. Beware of this group, it will appear later in this post again.

Note: If the backup folder was copied from other system, change the owner/group to tm:builtin_users, and permission to 775 to avoid permssion issue.

Set permission of dataset

Strip ACL

This is most easy way with lesser headache. Remove ACL if ACL is wong or just use traditional UNIX permission system.

Use ACL

Change owner and group to both tm.

The dataset permission set to POSIX_HOME, this will enable owner and group both have read/write/execute permission, others will be read only.

Create share

In TrueNAS, the actual implementation for time machine done by option in SMB sharing, named Multi-user time machine, so select Multi-user time machine as Purpose, otherwise, Time Machine option will not be set and it is unchangable.

Beware of option Time Machine is selected, and Path Suffix is set to %U, both are unchangable. The %U means, a sub-dataset will be created under shared dataset for each user, they will not share the same view.

The individual host to be backed up will create a folder <hostname>.sparsebundle, which will be shown as disk in MacOS.

File/Folder permission

Remove ACL

If got strange issue on permission, uncheck ACL in SMB sharing, and then restart SMB service.

Note: The error can be verified by using Windows access share drive.

Workable permission

The actual file created in sub-dataset, will be under builtin_users group with permission 770, not tm for unknown reason. Sample output is shown below.

truenas# ls -la /mnt/pool2/timemachine/tm
total 70
drwxrwx---+ 3 tm tm               4 Oct  3 22:32 .
drwxrwxr-x+ 6 tm tm               6 Oct  3 21:23 ..
-rwxrwx---+ 1 tm builtin_users 6148 Oct  3 21:32 .DS_Store
drwxrwx---+ 4 tm builtin_users   10 Oct  3 23:02 shark.sparsebundle
truenas#

Update

Suddently, timemachine on TrueNAS stopped working, error message shows macOS could not find server.

I tried to manually map SMB drive, but failed too. I could not access the timemachine shared folder, but rest of shared folders are accessible.

mDNS

During the troubleshooting, found that macOS could not see TrueNAS in Finder, the issue could be related to mDNS missing.

Finial settings

The following settings make timemachine work again.

  • Purpose: Multi-user time machine
  • Enable ACL
  • Browsable to Network Clients
  • Time Machine (Can not change)
  • Legacy AFP compatibility
  • Enable Shadow Copies
  • Enable Alternate Data Streams
  • Enable SMB2/3 Durable Handles

But the the shared folder still requires to be opened before macOS Time Machine can see it. So, mDNS issue is still there.

Enable 2FA for Ubuntu

Posted on by Bian Xi Leave a Comment on Enable 2FA for Ubuntu

Enable 2FA for Ubuntu

Steps

Note: Do not logout from system before testing completed

  • Installing the Google Authenticator PAM module
sudo apt install libpam-google-authenticator
  • Configuring SSH

Add the following line at end of /etc/pam.d/sshd file

auth required pam_google_authenticator.so
  • Enable Challenge Response Authentication

Modify /etc/ssh/sshd_config

ChallengeResponseAuthentication yes
  • Disable password authentication

Modify /etc/ssh/sshd_config

PasswordAuthentication no
  • Restart the sshd daemon
sudo systemctl restart sshd.service

Configuring authentication for user

In a terminal, run following command:

google-authenticator

Anwser using recommended configuration:

Make tokens “time-base””: yes
Update the .google_authenticator file: yes
Disallow multiple uses: yes
Increase the original generation time limit: no
Enable rate-limiting: yes

Use Authy scan QR code and save it.

Testing

  • Disable user authorized_keys using root account
cd ~user
mv .ssh/authorized_keys .ssh/authorized_
  • Connect as the user using SSH

Note: Use Authy generate Verification code.

ssh host.example.com
Password: 
Verification code: 
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-90-generic x86_64)
  • Enable authorized_keys
mv .ssh/authorized_ .ssh/authorized_keys
  • Exit
exit
  • Connect as the user again using SSH
$ ssh host.example.com
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-90-generic x86_64)
  • Test sudo
$ sudo -i
[sudo] password for user:
#

Consolution

  • Disable SSH PasswordAuthentication is not effected, password is still required.

  • Enable public key authentication using authorized_keys will disable 2FA key, this is good for service account

  • Do not configure sudo, /etc/pam.d/sudo is not modified, especially when using it for none password execution, such as running in services.

  • Console access will not using 2FA, because this confiugration is for SSH.

References

Configure SSH to use two-factor authentication
How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04
Note: This was not successful, the document is wrong at following point. I think the second publickey should not be there

AuthenticationMethods publickey,password publickey,keyboard-interactive

2FA App – Authy

Posted on by Bian Xi Leave a Comment on 2FA App – Authy

2FA App - Authy

There are many 2FA Apps, Microsoft, Google, Duo, etc. But I select Authy.

Pros

As an end user, I'm not the one looking at how secure a 2FA App is, it is only generating a code as expected. But I need to two major considerations as my experiences.

  • Backup - My phone was broken, then I lost all my codes, I don't even remember what they are. Very sad experience.

    Yes, Authy backs up data to their own server.

  • Multiple Devices - To make sure my codes won't be lost, then they should be available via multiple locations.

    Yes, Authy can be used in many devices, and can track them in devices list.

  • Offline - To make sure I got my own copy on my hand, I need it works offline.

    Yes, Authy has a local copy.

  • Acceptable by others - When you hear supported by Google Authenticator, it should work.

    Yes, it supports standard TOTP.

Cons

  • Don't know how to remove the code from iOS App
  • There is a Default device in devices list, which is quite confusing.
  • How to save backup codes? No solution given.

References

Easy, 2FA for Any Account
Download Authy
8 Best Two-Factor Authentication Plugins for WordPress
Deprecating Authy for WordPress
Authy Lists an Unknown or Unrecognized Device as "Default"

NextCloud password manager – Passwords

Posted on by Bian Xi Leave a Comment on NextCloud password manager – Passwords

Table of Contents

NextCloud password manager - Passwords

NextCloud password manager, Passwords is an add-on feature of NextCloud, it can be used to save passwords.

Support

It supports Firefox, Chrome, but not Safari. It also supports iOS and Android.

It doesn\'t support OS, such as SSH.

Interface

The interface is too complex compare with other system default password saving features, not user friendly.

Pros

Have notes for password, which allows saving more info.

References

Password managers for Nextcloud

Move Docker Directory

Posted on by Bian Xi Leave a Comment on Move Docker Directory

Move Docker Directory

Docker directory is /var/lib/docker. As /var should be a system directory, and most of the files in /var are log files, security related files, etc.

Docker is a application, which contains huge container data, move /var/lib/docker to data disk should be the good practice.

Methods

The are two methods I used to move /var/lib/docker directory.

Change Docker config

In /etc/docker/daemon.json file, add following entry.

{
   "data-root": "/path/to/your/docker" 
}

This makes the Docker implementation become non-standard, but as some other settings in this file also need to be set as well, such as Docker log file size, etc., this can be a normal practise for those system not many administrators.

Create soft link

Move /var/lib/docker to another location using mv command, then create a soft link /var/lib/docker point to new location.

This can be a simple and clear way, because system administrator can easily find the location without pre-check docker configuration, especially if predefined commands are required to be provided to others.

Drawback

For the first method, changing Docker configuration, although the non-standard configuration used, but Docker knows the location of data.

For the second method, adminstrator knows file location, but Docker doesn't know. So, if Docker likes to optimize the system, it might get wrong info.

References

How to move docker data directory to another location on Ubuntu

iMac waked up regularly

Posted on by Bian Xi Leave a Comment on iMac waked up regularly

iMac waked up regularly

My iMac keeps waking up, although this wasn't a problem for my Mac mini, it is an issue for my iMac. The difference between is, iMac got very annoying fan noise, even no activity.

Many factors

There are so many factors to wake iMac up according to Apple, but I think the may reason is Timemachine. The option of Wake for network access in Energy Saver is for the tasks to be taken during sleep, including Timemachine. But this option is related to wake up on LAN as well, then if I need WoL, I can not turn off this option.

There is also no Do not disturb option in my this iMac, it has older macOS High Sierra.

Issue

The actual issue caused annoying problem, is Timemachine has no scheduling.

Another issue

Unlike some other OS, iMac won't maintain ssh connection after sleeped. This is a huge issue to me because I use ssh heavily. Thinking to configure VPN, and use VPN to connect to other servers, maybe can maintain connection.

References

If your Mac sleeps or wakes unexpectedly

Domain Name ICP Filing in China

Posted on by Bian Xi Leave a Comment on Domain Name ICP Filing in China

Domain Name ICP Filing in China

Domain name ICP Filing in China is a process required if you want to open a web page in China, I spent more than 2 days, but still can not get it done.

Blocking if no ICP Filing

If no ICP Filing, Cloud provide will block the server access according to TCP package info, meaning they will drop the TCP packet if there is a domain name did not complete ICP Filing.

Certification Required

If you like to do ICP Filing, then you need to provide Certification of Domain Name.

I bought domain name from Geocity last time, then they changed to Yahoo, now they move to Verizon... Anyway, none of them provided such certificate... I sent request to Verizon helpdesk, no reply at all...

Buy a new one

Believe me, no point to argue with anyone in China, you will always be a loser. So, buy the new one in Cloud service provider. Then...

WARNING

Registrant Profile

According to the requirements of ICANN policies, the domain name holder's email address must be truthful and accurate. Before using a template, you must complete email address authenticity verification.Learn More

Tips:1. The common domain names(None CN domain) you bought at Alibaba Cloud can not be either ICP filinged in the mainland of China or pass the Real Name Verification(RNV).
2. The CN domain names you bought at Alibaba Cloud, request by CNNIC, please complete real name verification in time, or else you cannot use it normally. And even you have done for real name verification, it still cannot be ICP filinged.

Look carefully of the last statement...

Then what?

You buy one with CN domain name, passed real name verification, but still can not... Then why buy such domain?

References

GoChina ICP Filing Assistant

Replace Contents in NGINX

Posted on by Bian Xi Leave a Comment on Replace Contents in NGINX

Replace Contents in NGINX

The content of a webpage contains URL or other information need to be replaced, especially when domain name changed in URL.

sub_filter

Use sub_filter module in NGINX to replace content.

For example,

server {
    ```
    location / {
        sub_filter 'www.example.com' 'www.xx.example.com';
        sub_filter_once on;

        proxy_pass  http://www.example.com;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_redirect off;
        proxy_buffering off;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
   }
}

Note: Place sub_filter at beginning of the location session

If required, also need to change host to allow server decide which page requested if it is also a NGINX server and displays page depending on the host as well.

proxy_set_header        Host            www.example.com;

References

Module ngx_http_sub_module
http_sub_module / sub_filter of nginx and reverse proxy not working

Add a website to Google

Posted on by Bian Xi Leave a Comment on Add a website to Google

Add a website to Google

To allow Google search a website.

Allow search engine

In WordPress, to allow search engine indexing

  • Settings => Reading
  • Uncheck Discourage search engines from indexing this site

Allow Google discovery

Verify

  • Visit site:your_website in google.com

If indexed, then will return result.

References

WordPress Help
How to add a website to Google: All you need to know