Thomas-Krenn-Wiki - New pages [en]

Windows Server Core Licensing

2026-07-23T11:36:39Z

Aranzinger: /* Windows Server Access Licenses(CAL) */

Since '''[[Windows Server 2016 Editionsunterschiede|Windows Server 2016]]''', '''Microsoft''' relies on '''core licensing'''.

In this article, all important information, that is required for the '''licensing of Windows Server''', is included.

It is possible to test the latest server version up to 180 days for free.

A corresponding download can be found in [https://www.microsoft.com/de-de/evalcenter Microsoft Evaluation Center]. {{#widget:Imagebox-left|link={{#tklink:type=sitex|id=18135|linkonly=1}}|image=/de/wikiDE/images/9/99/WindowsServer2025-shoplink.png|text=Click here for our Microsoft software in the Thomas-Krenn online shop|campaign=Windows Server 2025 edition differences}} {{#widget:SitexBox|link={{#tklink:type=sitex|id=18135|linkonly=1}}|text=Click here for our Microsoft software in the Thomas-Krenn online shop|campaign=Windows Server 2025 edition differences}}

==Windows Server licensing==
Since Windows server 2016, it must be distinguished between Essentials and Standard/Datacenter . Every system running a Windows Server instance must be licensed, whether it is physical or virtualized.

===Windows Server Essentials===
For the Essentials Edition, the licensing model remains "per CPU / per server".

Essentials still has the limitation that a maximum of two CPUs may be installed.

An Essentials license includes two CPUs. Therefore, only one Essentials license needs to be assigned per server.

===Windows Server Standard and Datacenter===
For the Standard and Datacenter Edition, a '''core licensing''' is required. It must be noted how much active, physical kernels possesses a CPU.

To obtain two virtual licenses for the Standard Edition and unlimited licenses for the Datacenter Edition, the following three rules must be observed:

:'''Rule #1:''' Every physical '''processor''' is scored based on '''at least 8 cores'''
:'''Rule #2:''' Every physical '''server''' is scored based on '''at least 16 cores'''
:'''Rule #3:''' '''All physical and active cores''' must be licensed in accordance with Rule #1 and Rule #2

If you want to increase virtualization rights for the Standard Edition, you must double the number of licenses for 4 VMs, triple them for 6 VMs, quadruple them for 8 VMs, and so on.

==== Basis and additional licenses ====
There are so-called basis licenses and additional licenses. The basis licenses are available with 16 or 24 cores. Additional licenses are available with 2, 4 or 16 cores.

The following chart shows that additional licenses are required only when there are 4 or more CPUs or more than 8 cores.

[[file:Windows Server 2016 Core-Lizenzierung.png |900px]]

'''You are still unsure? No problem!'''

In the [https://www.thomas-krenn.com/de/index.html Thomas-Krenn online shop], you do not need to worry about the core licensing yourself.

Our online configurator automatically calculates the correct number of licenses, so that your new Windows server system is licensed correctly.

If you have questions on the licensing, do not hesitate to contact us.

==Software assurance==
Of course, you can also purchase software assurance for the new server operating system.

:'''Did you know? Software assurance for OEM!'''
: Within 90 days, you can buy a software assurance for your OEM Windows Server license
: An OEM license becomes a volume license when combined with software assurance. You have the same advantages as a volume license customer.
: Even after the SA expires, the OEM license remains a volume license, so you will continue to benefit from it.

Benefits you can enjoy through software assurance:
*'''License mobility''' - all 90 days right of reassignment of the license
*'''free upgrade to a new version of Windows Server'''
*Windows Virtual Desktop access licenses (VDA)
*and more...<ref>[https://download.microsoft.com/download/0/0/3/0039f316-45cf-4083-aa6e-c35da9d25c1b/sa_interactivebenefitschart.pdf Software Assurance] (www.microsoft.com)</ref>

==Windows Server Access Licenses(CAL)==
Windows Server Access Licenses - '''CAL'''s ('''C'''lient '''A'''ccess '''L'''icence) - are required for the access on systems with Windows Server operating system:

For every user '''or''' every device, you require a CAL. If the user or the device accesses a Windows Server via remote desktop, a RDS-CAL is '''required''' additionally.

CAL is tied to the '''latest version''' of Windows Server, which means that to license a user's access to a Windows Server 2025, you need a Windows Server 2025 User CAL for that user.

In this scenario, you must not use an older Windows Server CAL!

All important information about the topic access licenses/CALs, can be found directly at Microsoft<ref>[https://www.microsoft.com/de-de/Licensing/produktlizenzierung/client-access-license.aspx Server-Access-License – Client Access License, CAL] (www.microsoft.com)</ref>.

:'''Did you know? There are OEM-CALs!''' Every OEM-CAL (Windows-Server-CAL and RDS-CAL) allows the access on every Windows server, regardless of the manufacturer, regardless of whether the Windows Server was licensed through OEM or volume licensing.

You can purchase additional OEM CALs at any time in the Thomas-Krenn online shop: <tklink type=sitex id=18135/>.

==Downgrade right==
Every Windows Server license includes an '''unlimited downgrade right''', whether OEM or volume licenses.

With your Windows Server license, you have the right to install all underlying Windows Server versions and editions.

With a Windows Server 2025 Standard license, for example, you may install Windows Server 2016 Standard or Windows Server 2019 Essentials, but not, for example, Windows Server 2019 Datacenter.

To exercise this downgrade right, all you need is an installation medium as well as an installation product key (Windows key) of the operating system that should be installed.

There are so-called '''downgrade kits''' that include these installation mediums as well as product keys. You can also purchase these directly from Thomas-Krenn.

All important information on the downgrade topic can be found at Microsoft<ref>
[https://www.microsoft.com/OEM/de/licensing/sblicensing/Pages/downgrade_rights.aspx#fbid=APiJYEBPjyu Information on downgrade rights] (www.microsoft.com)</ref>.

== References ==
<references />

== More information ==
*[https://www.microsoft.com/licensing/guidance/Windows-Server-2025 Microsoft Licence Guide] (www.microsoft.com)
*[https://www.microsoft.com/en-us/cloud-platform/windows-server Windows Server] (EN) (www.microsoft.com)
*<tklink type="sitex" id="18135">Windows Server 2025 Pricing Information
</tklink> (www.thomas-krenn.com)
*[[Windows Server 2025 Editionsunterschiede|Windows Server 2025 Differences Between Editions]] (www.wiki.thomas-krenn.com)
*[https://www.thomas-krenn.com/de/tkmag/webinare/windows-server-2025-lizenzierung-und-editionen/ Thomas-Krenn Webinar on Windows Server 2025 Licensing]] (www.thomas-krenn.com)

{{aoberneder}}
{{Aranzinger}}
[[pl:Model licencjonowania w oparciu o rdzenie w Windows Server 2016]]
[[de:Windows Server Core-Lizenzierung]]

[[Category:Windows Server 2019]]
[[Category:Windows Server 2022]]
[[Category:Windows Server 2025]]

Administration of RAID with MDADM

2026-07-23T07:14:17Z

Aranzinger: Created page with "'''This article includes the general procedure of creating and administrating an array with MDADM.''' MDAMD (multiple disk administration) is a program that helps with the administration of a Software RAID in Linux. With this program, RAID-arrays can be created, configured, monitored and deleted. MDADM is released as free software under the GNU General Public License (GPL). MDADM creates so-called multiple devices (short MD) from different block devices (such as an ent..."

'''This article includes the general procedure of creating and administrating an array with MDADM.'''

MDAMD (multiple disk administration) is a program that helps with the administration of a Software RAID in Linux.
With this program, RAID-arrays can be created, configured, monitored and deleted.
MDADM is released as free software under the GNU General Public License (GPL).

MDADM creates so-called multiple devices (short MD) from different block devices (such as an entire hard drive, a single partition, or a USB flash drive)

MDADM is a practical software RAID solution that can be actively developed.
It allows simultaneous, parallel access to all disks.
In addition, the arrays created are hardware-independent, which significantly enhances data security.

== Possible RAID levels ==

*Linear: Chaining of multiple parities
*Multipath: No RAID, but mapping of a file on two different paths on the same partition (mirroring).
*Faulty: Emulates a faulty RAID system for test cases.
*Level 0 (Block Level Striping): Chaining multiple small block devices together to form one large one.
*Level 1 (Mirror): Mirroring of a disk
*Level 4: Like level 0, but with an additional device for parity bit (increased reliability).
*Level 5: Like level 4, the parity bits are distributed across all devices.
*Level 6: However, like level 5, it uses two independent parity bits per segment (increased reliability).
*Level 10: Combination of level 0 and 1.

== Installation of mdadm ==

If RAID was not set up during the Linux installation, you must install the mdadm package from the repositories.
<pre>:~$ sudo aptitude install mdadm</pre>
After the installation, there are no further steps required for the configuration and the tool can be used.

== Commands for configuration and administration ==

=== Basic syntax ===
<pre>
mdadm [mode] <raiddevice> [options] <component-devices>
</pre>

=== Create array ===
<pre>
mdadm --create /dev/md/<Label> --level=<RAID-Level> --raid-devices=<number of physical partitions in the array> /dev/sdX1 /dev/sdY1
</pre>
Parameter:
* <code>--create</code> An optional parameter can be specified to set a label for the RAID. For example: <code>/dev/md/md_1</code>
* <code>--level=</code>: Specifies the desired RAID level. Valid entries are <code>linear, raid0, 0, stripe, raid1, 1, mirror, raid4, 4, raid5, 5, raid6, 6, raid10, 10, multipath, mp, faulty, container</code>
* <code>--raid-devices=</code>: Specifies the number of physical partitions in the software RAID. In addition, the individual partitions must be stated. For example: <code>--raid-devices=2 /dev/sda2 /dev/sdb3</code>

==== RAID 0 with MDADM ====
To create a RAID 0 (Block Level Striping) array, at least 2 partitions are required. They should be the same size and located on different physical hard drives.
The RAID 0 array can be initialized with the following command: <code>mdadm --create /dev/md/<Label> --level=0 --raid-devices=<Anzahl> /dev/sdX1 /dev/sdY1</code>

Example (2 physical hard drives):
<pre>
root@swraid:~# mdadm --create /dev/md/md_test --level=0 --raid-devices=2 /dev/sdb1 /dev/sdc1
mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md/md_test started.
</pre>

==== RAID 1 with MDADM ====
To create a RAID 1 (Block Level Mirroring) array, at least two physical partitions are required. They should be the same size and located on different physical hard drives.
The RAID 1 array can be initialized with the following command: <code>mdadm --create /dev/md/<Label> --level=1 --raid-devices=<number> /dev/sdX1 /dev/sdY1</code>

Example (2 physical hard drives):
<pre>
root@swraid:/dev# mdadm --create /dev/md/md_test --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1
mdadm: Note: this array has metadata at the start and
may not be suitable as a boot device. If you plan to
store '/boot' on this device please ensure that
your boot-loader understands md/v1.x metadata, or use
--metadata=0.90
Continue creating array? yes
mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md/md_test started.
</pre>

=== Delete array ===
To remove a RAID array, the array must be unmounted (<code>umount</code>) and the command <code> mdadm --stop /dev/md/<name of RAID></code> must be called up. Although this unmounts the array from the system, the RAID array remains physically in place.

To remove the array, the superblock of every hard drive, which determines the hard drive/partition as RAID-device, must be set to 0. This can be performed with the command <code> mdadm --zero-superblock /dev/<physical partition></code>.

Example:
<pre>
root@swraid:/dev# umount -l /mnt/test
root@swraid:/dev# mdadm --stop /dev/md/md_test
mdadm: stopped /dev/md/md_test
root@swraid:/dev# mdadm --zero-superblock /dev/sdb1
root@swraid:/dev# mdadm --zero-superblock /dev/sdc1
</pre>

=== Listing arrays/partitions ===
RAID-arrays can be listed with two kinds of commands. <code>--detail</code> refers to a completely active array, while <code>--examine</code> refers to the individual physical devices in a RAID array.
<pre>
root@swraid:/mnt/test# mdadm --examine --brief --scan --config=partitions
ARRAY /dev/md/md_test metadata=1.2 UUID=81c1d8e5:27f6f8b9:9cdc99e6:9d92a1cf name=swraid:md_test
</pre>
This command can also be abbreviated with <code>-Ebsc partitions</code>.

<pre>
root@swraid:/dev/md# mdadm --detail /dev/md/md_test
/dev/md/md_test:
Version : 1.2
Creation Time : Fri Jul 5 09:14:36 2013
Raid Level : raid0
Array Size : 16776192 (16.00 GiB 17.18 GB)
Raid Devices : 2
Total Devices : 2
Persistence : Superblock is persistent

Update Time : Fri Jul 5 09:14:36 2013
State : clean
Active Devices : 2
Working Devices : 2
Failed Devices : 0
Spare Devices : 0

Chunk Size : 512K

Name : swraid:md_test (local to host swraid)
UUID : 81c1d8e5:27f6f8b9:9cdc99e6:9d92a1cf
Events : 0

Number Major Minor RaidDevice State
0 8 17 0 active sync /dev/sdb1
1 8 33 1 active sync /dev/sdc1
</pre>

=== Hotspare ===
Hotspare hard drives/partitions are hard drives/partitions that are not normally used. These are used when one of the active hard drives or partitions in the RAID array has an error or is defective. If no hot spare disk is defined in a software RAID, the rebuild of a failed RAID array must be started manually. If a Hotspare is available, it is automatically started with the rebuild. A Hotspare hard drive can be added with the command <code> mdadm --add /dev/md/<RAID-name> /dev/sdX1</code>, where the first parameter is the name of the RAID array and the second is the name of the hard drive to be added. If a Hotspare hard drive should be removed from the RAID array, the command <code>mdadm --remove /dev/md/<RAID-name> /dev/sdX1</code> must be called up. Here, the first parameter is the name of the RAID array, and the second is the name of the hot spare hard drive.

=== Rebuild ===
If a partition or hard drive has a defect (software or hardware), the RAID array must be rebuilt. To do this, the defect device must be removed from the RAID. The command <code>mdadm --manage /dev/md/<RAID-name> -r /dev/sdX1</code> is required for this. The first parameter refers to the RAID array. The second to the defect device. If there is no Hotspare hard drive available, a new hard drive must be partitioned. It is important that the new hard drive has the same partition as the defect one. The tools <code>fdisk /dev/sdX</code>, <code>cfdisk /dev/sdX1</code> as well as <code>parted /dev/sdX1</code> help with the partition of a hard drive.
If the new hard drive is partitioned correctly, it can be added to the RAID array. This can be made with <code>mdadm --manage /dev/md/<RAID-Name> -a /dev/sdX1</code>. If no errors occurred during this process, you can begin the actual rebuild. For this, the new partition must be set to "faulty" in the RAID array: <code>mdadm --manage --set-faulty /dev/md/<RAID-name> /dev/sdX1</code>. This triggers the rebuild of the RAID array.
With <code>watch cat /proc/mdstat</code>, the progress of the rebuild can be tracked.

<pre>
Every 2.0s: cat /proc/mdstat Fri Jul 5 09:59:16 2013

root@swraid:/dev# watch cat /proc/mdstat
Personalities : [raid0] [raid1]
md127 : active raid1 sdc1[1] sdb1[0]
8384448 blocks super 1.2 [2/2] [UU]
[==============>......] check = 74.7% (6267520/8384448) finish=0.1min speed=202178K/sec

unused devices: <none>
</pre>
As soon as the rebuild of the RAID compound has been completed, the partition must be removed from the RAID array and added again to remove the status "faulty". <code> mdadm --manage /dev/md/<RAID-name> -r /dev/sdX1</code> for removing and <code>mdadm --manage /dev/md/<RAID-name> -a /dev/sdX1</code> for adding.
With the command <code>mdadm --detail /dev/md/<RAID-name> </code>, the status of the RAID array can be verified again. This should now have the '''State: clean''' status.

=== Set up email address for array monitoring ===

To receive an email notification in the event of a failure, you can enter the desired email address in the mdadm configuration file (<code>/etc/mdadm/mdadm.conf</code>) under <code>MAILADDR root</code> instead of ''root''.
For this, an email service (<code>postfix, exim, ...</code>) must be configured on the system.
Open '''/etc/mdadm/mdadm.conf''' with an editor and edit the following line:

Instead of <code>MAILADDR root</code>, enter an email address such as <code>MAILADDR email@example.com</code> and save it.

=== Verify array ===
The tool <code>checkarray</code> is required to conduct continuous monitoring. This can be added to the list of Cronjobs with <code>crontab -e</code>.
<pre>
/usr/share/mdadm/checkarray --cron --all --quiet
</pre>

{{Sstrassner}}
{{Aranzinger}}
[[Category:Linux Software RAID]]
[[de:Software RAID mit MDADM verwalten]]

IPMI configuration for Supermicro servers with ipmicfg

2026-07-22T12:18:28Z

Aranzinger:

This article describes the tool ipmicfg for Supermicro systems. Alternatively, when the server is operated on Linux, the ipmitool (see article [[Configuring IPMI under Linux using ipmitool|Configuring IPMI on Linux using ipmitool]]) or [[FreeIPMI]] can also be used. Older systems could be also interesting for the tools IPnMAC and XGICFG. Information can be found in the article [[IPMI_Konfiguration_f%C3%BCr_Supermicro_Systeme|IPMI Configuration for Supermicro Systems]]

If there are problems with the configuration, it may be because the required modules have not been loaded. Please take the following article into consideration: [[IPMI Init Script für Debian|IPMI Init Script for Debian]]

== Basic configuration ==
[[file:Supermicro-IPMICFG-Windows-version-1.03-Build-110420.png|thumb|right|250px|Screenshot ipmicfg.exe on Windows]]
IPMICFG version 1.02 (Build 120820) provides the following options:
<pre>
root@test:~# ./ipmicfg-linux.x86_64.static

IPMICFG Version 1.14.3 (Build 130725)
Copyright 2013 Super Micro Computer, Inc.
Usage: IPMICFG params (Example: IPMICFG -m 192.168.1.123)
-m Show IP and MAC.
-m IP Set IP (format: ###.###.###.###).
-a MAC Set MAC (format: ##:##:##:##:##:##).
-k Show Subnet Mask.
-k Mask Set Subnet Mask (format: ###.###.###.###).
-dhcp Get the DHCP status.
-dhcp on Enable the DHCP.
-dhcp off Disable the DHCP.
-g Show Gateway IP.
-g IP Set Gateway IP (format: ###.###.###.###).
-r BMC cold reset.
option: -d | Detected IPMI device for BMC reset.
-garp on Enable the Gratuitous ARP.
-garp off Disable the Gratuitous ARP.
-fd Reset to the factory default.
option: -d | Detected IPMI device for BMC reset.
-fdl Reset to the factory default. (Clean LAN)
option: -d | Detected IPMI device for BMC reset.
-fde Reset to the factory default. (Clean FRU & LAN)
option: -d | Detected IPMI device for BMC reset.
-ver Get Firmware revision.
-vlan Get VLAN status.
-vlan on <VLANtag> Enable the VLAN and set the VLAN tag.
If VLANtag is not given it uses previously saved value.
-vlan off Disable the VLAN.
-selftest Checking and reporting on the basic health of BMC.
-raw Send a RAW IPMI request and print response.
Format: NetFn Cmd [Data1 ... DataN]
-fru info Show FRU inventory area Info.
-fru list Show all FRU values.
-fru cthelp Show chassis type code.
-fru help Show help of FRU Write.
-fru <Field> Show FRU field value.
-fru <Field> <Value> Write FRU.
-fru 1m Update FRU Product Manufacturer from DMITable.
-fru 1p Update FRU Product Prodcut Name from DMITable.
-fru 1s Update FRU Product S/N from DMITable.
-fru 2m Update FRU Board Manufacturer from DMITable.
-fru 2p Update FRU Board Product Name from DMITable.
-fru 2s Update FRU Board S/N from DMITable.
-fru 3s Update FRU Chassis S/N from DMITable.
-fru backup <file> Backup FRU to file <Binary format>.
-fru restore <file> Restore FRU from file <Binary format>.
-fru tbackup <file> Backup FRU to file <Text format>.
-fru trestore <file> Restore FRU from file <Text format>.
-fru ver <V1> <V2> Get/Set FRU version. (V1 V2 are BCD format)
-sel info Show SEL info.
-sel list Show SEL records.
-sel del Delete all SEL records.
-sel raw Show SEL raw data.
-sdr Show SDR records and reading.
-sdr del <SDR ID> Delete SDR record.
-sdr ver <V1> <V2> Get/Set SDR version. (V1 V2 are BCD format)
-nm nmsdr Display NM SDR.
-nm seltime Get SEL time.
-nm deviceid Get ME Device ID.
-nm reset Reboots ME.
-nm reset2default Force ME reset to Default.
-nm updatemode Force ME to Update Mode.
-nm selftest Get Self Test Results.
-nm listimagesinfo List ME Images information.
-nm oemgetpower OEM Power command for ME.
-nm oemgettemp OEM Temp. command for ME.
-nm pstate Get Max allowed CPU P-State.
-nm tstate Get Max allowed CPU T-State.
-nm cpumemtemp Get CPU/Memory temperature.
-nm hostcpudata Get host CPU data.
-fan Get Fan Mode.
-fan <mode> Set Fan Mode.
-pminfo Power supply PMBus health.
-psfruinfo Power supply FRU health.
-psbbpinfo Battery backup power status.
-autodischarge <module> <day> Set auto discharge by days.
-discharge <module> Manually discharge battery.
-user list List user privilege information.
-user help Show user privilege code.
-user add <user id> <user name> <password> <privilege>
Add user.
-user del <user id> Delete user.
-user level <user id> <privilege> Update user privilege.
-user setpwd <user id> <password> Update user password.
-conf upload <file> <option> Upload IPMI configuration form binary file.
option: -p | Bypass warning message.
-conf download <file> Download IPMI configuration to binary file.
-conf tupload <file> <option> Upload IPMI configuration from text file.
option: -p | Bypass warning message.
-conf tdownload <file> Download IPMI configuration to text file.
-clrint Clear chassis intrusion.
root@test:~#
</pre>

To configure the IPMI module for the first time, it is necessary to state the IP address through which the IPMI module should be accessible.
<pre>
ipmicfg -m ###.###.###.###
</pre>

After that, the IPMI module is available via web interface.

== Factory default settings ==
To set the IPMI module on the default settings, please enter
<pre>
ipmicfg -fd
</pre>

Please note that all settings, including all users, are deleted. Furthermore, the DHCP server is switched on after reset.

== Problems with Offset Sensor Readings ==
Under certain circumstances, some sensor readings may be incorrect or may not be read at all.
To solve the issue, the following steps must be performed:

[[Correcting Faulty IPMI Sensors by Fully Initializing the IPMI Module]]

== Command reference ==
=== Display IP and MAC address ===
<pre>
ipmicfg -m
</pre>

=== Set IP address ===
<pre>
ipmicfg -m ###.###.###.###
</pre>

=== Set MAC address ===
<pre>
ipmicfg -a ##:##:##:##:##:##
</pre>

=== Display Subnet mask ===
<pre>
ipmicfg -k
</pre>

=== Set Subnet mask ===
<pre>
ipmicfg -k ###.###.###.###
</pre>

=== Switch on DHCP ===
<pre>
ipmicfg -dhcp on
</pre>

=== Switch off DHCP ===
<pre>
ipmicfg -dhcp off
</pre>

=== Display Gateway IP address ===
<pre>
ipmicfg -g
</pre>

=== Set Gateway IP address ===
<pre>
ipmicfg -g ###.###.###.###
</pre>

=== BMC Cold Reset ===
<pre>
ipmicfg -r
</pre>

=== Recreate default settings ===
<pre>
ipmicfg -fd
</pre>

=== Enable the Gratuitous ARP ===
<pre>
ipmicfg -garp on
</pre>

=== Disable the Gratuitous ARP ===
<pre>
ipmicfg -garp off
</pre>

== Download ipmicfg ==

If the ipmicfg is not yet installed on the system, it can be downloaded via [https://www.thomas-krenn.com/de/download.html Thomas-Krenn download area]. For this, select the specific mainboard.

At Supermicro, it is available here:
* ftp://ftp.supermicro.com/utility/IPMICFG/

{{Bbayer}}
{{Aranzinger}}
[[Category:IPMI]]
[[de:IPMI Konfiguration für Supermicro Server mittels ipmicfg]]
[[pl:Konfiguracja IPMI w serwerach Supermicro za pomocą ipmicfg]]

ZFS basics

2026-07-22T09:28:13Z

Aranzinger: Created page with "'''ZFS''' (''Pseudo-acronym'', short for ''Zettabyte File System'') is a '''file system''' that has been originally developed by Sun Microsystems for the operating system Solaris. The OpenZFS project develops an Open-Source variant<ref name=":0">[https://openzfs.github.io/openzfs-docs/index.html OpenZFS Documentation] (openzfs.github.io, 2026)</ref>. ZFS distinguishes itself from other file systems through its focus on data integrity, storage capacity, and the management..."

'''ZFS''' (''Pseudo-acronym'', short for ''Zettabyte File System'') is a '''file system''' that has been originally developed by Sun Microsystems for the operating system Solaris. The OpenZFS project develops an Open-Source variant<ref name=":0">[https://openzfs.github.io/openzfs-docs/index.html OpenZFS Documentation] (openzfs.github.io, 2026)</ref>. ZFS distinguishes itself from other file systems through its focus on data integrity, storage capacity, and the management of physical drives within a logical device pool.

== Basic function ==
The main focus of ZFS is on '''data integrity'''. To ensure this data integrity, ZFS relies on a '''transactional''' approach. This means that writing processes are always completely performed or never<ref>[https://docs.oracle.com/cd/E19120-01/open.solaris/817-2271/gaypi/index.html Transactional Semantics] (docs.oracle.com, 2026)</ref>.

A simple, asynchron writing process collects or buffers data for a determined period in a so-called '''transaction group (TXG)''' in the RAM of the system. After this period, the changes are transferred to permanent storage. This completes the transaction.

To ensure data consistency when following this procedure, ZFS uses a '''[[Copy-on-Write (COW)|Copy-on-Write (CoW)]]''' strategy. During a write operation, no blocks are overwritten. Instead, the blocks, with the corresponding changes, are copied to a different location. The old blocks remain intact, but the file system points to the new blocks. If the old blocks are not referenced anymore (for example from [[ZFS Snapshots|Snapshots]]), they may be overwritten during future write operations.

== Setup ==
[[File:Zfs-storage_stack.png|alt=Abb. 1: A simplified, illustrative representation of the ZFS storage stack|thumb|Image 1: A simplified, illustrative representation of the ZFS storage stack.]]
To understand the function of ZFS, its building blocks must be understood.

Three levels form the structure of the ZFS storage stack<ref>[https://openzfs.org/wiki/System_Administration "System Administration" in openzfs Wiki] (openzfs.org, 2026)</ref> (see image 1): The lowest level are the '''physical data carriers'''. These are grouped together in logical units within a storage pool called '''<code>zpool</code>'''. Logical objects are provided for the operating system via <code>zpool</code>. In addition to the '''datasets''', that correspond to classic file systems, there are also '''metadata''' such as snapshots and bookmarks.

{| {{Prettytable}} cellspacing="0" style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #a0a0a0 solid; border-collapse: collapse; " rules="all"
|The hardware level is not further explained in this article. If you require consulting on an efficient and performant design of a ZFS infrastructure, do not hesitate to contact us: [https://www.thomas-krenn.com/de/unternehmen/kontakt-tk/thomas-krenn-ansprechpartner/slide.presales Contact persons]
|-
|}
Furthermore, the ''Adaptive Replacement Cache (ARC)'' and the ''ZFS Intent Log (ZIL)'' are also important elements for the function of ZFS.

=== zpool ===
The <code>zpool</code> is a virtual storage pool that is formed by so-called <code>vdevs</code> (''Virtual Devices'' in brief). ZFS can administrate multiple <code>zpools</code>. The individual <code>zpools</code> are independent from each other and must be administrated separately.

==== vdev ====
A <code>vdev</code> is a logical data carrier within a <code>zpools</code> that is created by a physical data carrier or a fusion of multiple physical data carriers. It can be formed by the following entities:

* physical data carrier
* data carrier arrays (for example RAID)
* partitions

In productive environments, a <code>vdev</code> is usually created by individual physical data carriers.

It is also possible to form a <code>vdev</code> out of files. This is an exceptional case and is only recommended for testing purposes.

'''Storage''' <code>vdevs</code> are provided for data storage. ZFS provides different redundancy levels for storage <code>vdevs</code><ref name=":1">[https://openzfs.github.io/openzfs-docs/man/master/7/zfsconcepts.7.html zfsconcepts.7] (openzfs.github.io, 2026)</ref>:

* Single (simple data carrier)
* Mirror (mirrored data carrier)
* RAIDZ-1/2/3 (data storage network with 1/2/3 parities)
* [[ZFS dRAID Grundlagen und Einrichtung|dRAID]]

In addition, there are further <code>vdevs</code> for special use:

* '''Spare''': Is used for the failure of a physical data carrier from a storage <code>vdev</code> used for recovery (resilvering)<ref name=":1" />
* '''Cache''': The read buffer, also known as L2ARC ''(Level 2 Adaptive Replacement Cache),'' is an extension of the ''[[Benutzer:Sbohn/Spielwiese5#ARC|ARC]]''<ref name=":1" />
* '''Log''': The so-called ''SLOG'' ''(Separate Intent Log)'' <code>vdev</code> is responsible for caching during synchronous write operations. It is the relocation of ''[[Benutzer:Sbohn/Spielwiese5#ZIL|ZIL]] (ZFS Intent Log)''<ref name=":1" />
* '''Dedup''': This <code>vdev</code> is used for storing the ''Deduplication Table (DDT)'' for deduplicate in the <code>zpool</code>
* '''Special''': A<code>vdev</code> is used for storing metadata and optionally small data blocks. <ref name=":1" />It also stores the DDT if there is no dedicated <code>vdev</code> for it.

=== Datasets ===
A dataset forms the upper level of the ZFS Storage Stack. The following datasets can be formed with ZFS:

* '''ZVOL:''' The ''ZFS Volume'' is a virtual block device
* '''File system:''' ZFS-native file systems can be set up
* '''Clone:''' A standalone, writable copy of a ZFS snapshot<ref name=":1" />

ZVOLs can be used to insert regular file systems on operating system layers.

=== Meta data ===
In addition to data sets, there are further logical objects in ZFS:

* '''Snapshot:''' A snapshot is a momentary representation of a system's state. The blocks described at the time of the snapshot are immutable (''immutable'') and remain in place at least until the snapshot and its references are deleted<ref name=":1" />
* '''Bookmark:''' A bookmark is a read-only copy of the filesystem or a volume. They are tied to snapshots and are retained even if the snapshot is deleted<ref name=":1" />

== ARC and ZIL ==
In addition to the storage stack, there are two other important modules for using ZFS efficiently.

=== ARC ===

The ''Adaptive Replacement Cache'' ''(ARC)'' is the reading buffer of ZFS. It is formed in the RAM of the host system<ref name=":2">[https://openzfs.github.io/openzfs-docs/Performance%20and%20Tuning/Workload%20Tuning.html#adaptive-replacement-cache Adaptive Replacement Cache] (openzfs.github.io, 2026)</ref>.

The general task of the ARC is to provide blocks for fast reading processes. For this, the ARC builds lists about buffered entries<ref name=":2" />. The ARC distinguishes from ''most recent'' (''MRU - Most Recently Used'') blocks and ''frequently'' (''MFU - Most Frequently Used'') used blocks. Therefore, the ARC is faster as commonly used read buffers that only keep MRU in the buffer<ref>[https://github.com/openzfs/zfs/blob/master/module/zfs/arc.c OpenZFS ARC Source Code] (github.com/openzfs, 2026)</ref>.

==== L2ARC ====
The ''Level 2 ARC (L2ARC)'' is formed in the permanent storage (NVMe preferred)<ref name=":2" />. If data is evicted from the ARC, ZFS can store it in the L2ARC and access it during subsequent read operations.

=== ZIL ===
The ''ZFS Intent Log (ZIL)'' is a temporary cache that is used for synchron writing processes.

The ZIL is not a cache in the strict sense: During a synchronous write operation, the data is written simultaneously to a transaction group (in RAM) and to the ZIL (on physical storage media)<ref>[https://github.com/openzfs/zfs/blob/master/module/zfs/zil.c OpenZFS ZIL Source Code] (github.com/openzfs, 2026)</ref>. As soon as the data from the transaction group has been fully written to the <code>vdev</code>, the data is rejected in the ZIL. The ZIL is responsible for data integrity even in the event of system failures. Because data must be written to permanent storage, which is slow compared to RAM, synchronous write operations are less efficient.

==== SLOG ====
The ''Separate Intent Log (SLOG)'' outsources ''ZIL''-blocks to a separate <code>vdev</code><ref>[https://openzfs.github.io/openzfs-docs/Performance%20and%20Tuning/Workload%20Tuning.html#synchronous-i-o OpenZFS - Synchron Writing Process] (openzfs.github.io, 2026)</ref>. This is useful, when the data carriers used for the SLOG have a higher writing performance.

== More information ==
Official documentation: [https://openzfs.github.io/openzfs-docs/index.html OpenZFS Documentation]

Basic article: [https://arstechnica.com/information-technology/2020/05/zfs-101-understanding-zfs-storage-and-performance/ ZFS 101—Understanding ZFS storage and performance]

Synchron/Asynchron writing processes: [https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/ ZFS sync/async + ZIL/SLOG, explained]

TrueNAS article on ZIL and SLOG: [https://www.truenas.com/blog/zfs-zil-and-slog-demystified/ The ZFS ZIL and SLOG Demystified]

ZFS on Linux: https://zfsonlinux.org/

Aaron Toponce about ZFS: [https://web.archive.org/web/20230904234829/https://pthree.org/2012/04/17/install-zfs-on-debian-gnulinux/ ZFS Administration]

== References ==
<references />

{{Sbohn}}
{{Aranzinger}}
[[Category:Storage]]
[[Category:Review 2027 Q3]]
[[de:ZFS Grundlagen]]

OPNsense network card driver

2026-07-21T11:26:59Z

Aranzinger: Created page with "OPNsense contains drivers for numerous network cards. This Wiki article shows, '''which drivers are used for which network card'''. Some drivers must be activated manually. Information on this topic can be found in the article Activation of OPNsense Chelsio Mellanox Broadcom network card driver. == Driver versions == {| class="wikitable" |+ ! rowspan="2" |Driver !Supported network chips/cards !Driver version in OPNsense 26.7 !Driver version in OPNsense 26.1 !Dr..."

[[OPNsense]] contains drivers for numerous network cards. This Wiki article shows, '''which drivers are used for which network card'''. Some drivers must be activated manually. Information on this topic can be found in the article [[Activation of OPNsense Chelsio Mellanox Broadcom network card driver]].

== Driver versions ==
{| class="wikitable"
|+
! rowspan="2" |Driver
!Supported network chips/cards
!Driver version
in OPNsense 26.7
!Driver version
in OPNsense 26.1
!Driver version
in OPNsense 25.7
!Driver version
in OPNsense 25.1
!Driver version
in OPNsense 24.7
!Driver version
in OPNsense 24.1
!Driver version
in OPNsense 23.7
!Driver version
in OPNsense 23.1
!Driver version
in OPNsense 22.7
!Driver version
in OPNsense 22.1
!Driver version
in OPNsense 21.7
!Driver version
in OPNsense 21.1
!Driver version
in OPNsense 20.7
!Driver version
in [[OPNsense]] 20.1
|-
!Kernel version
!FreeBSD 15.1-RELEASE
! colspan="2" |FreeBSD 14.3-RELEASE
!FreeBSD 14.2-RELEASE
!FreeBSD 14.1-RELEASE
! colspan="2" |FreeBSD 13.2-RELEASE
! colspan="2" |FreeBSD 13.1-RELEASE
!FreeBSD 13.0-STABLE
! colspan="3" |FreeBSD 12.1
![[FreeBSD]] 11.2
|-
|[https://www.freebsd.org/cgi/man.cgi?query=bge&sektion=4&format=html bge]
|
* Broadcom 1Gbit, for example:
** H12SSL-i - BCM5720
** H12SSW-iN - BCM5720
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=bnxt&sektion=4&format=html bnxt]
|
* Broadcom 10GBit, for example:
** H12SSL-NT/CT - BCM57416
** H12SSW-NT - BCM57416
** P210TP - BCM57416
*Broadcom 25GBit,for example:
** X12SPZ-SPLN6F - BCM57414
** P225P - BCM57414
| colspan="4" |230.0.133.0 (via iflib, driver is activated automatically)<ref>[Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> for a system with a built-in Broadcom P225P network card:
<pre>
dev.bnxt.0.iflib.driver_version: 230.0.133.0
dev.bnxt.0.%iommu: rid=0x8100
dev.bnxt.0.%parent: pci6
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d7 subvendor=0x14e4 subdevice=0x1402 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:129:0:0
dev.bnxt.0.%driver: bnxt
</pre>
</ref>
|
|2.20.0.1 (via iflib, '''driver is now activated automatically''')<ref>[Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> for a system with a built-in Broadcom P225P network card:
<pre>
dev.bnxt.0.iflib.driver_version: 2.20.0.1
dev.bnxt.0.%domain: 0
dev.bnxt.0.%parent: pci6
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d7 subvendor=0x14e4 subdevice=0x1402 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:24:0:0 handle=\_SB_.PC01.BR1A.H000
dev.bnxt.0.%driver: bnxt
dev.bnxt.0.%desc: Broadcom BCM57414 NetXtreme-E 10Gb/25Gb Ethernet
</pre>
</ref>
|
|2.20.0.1 (via iflib)<ref name=":5">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a system with a Supermicro H13SSL-NT motherboard:
<pre>
dev.bnxt.0.iflib.driver_version: 2.20.0.1
dev.bnxt.0.%domain: 0
dev.bnxt.0.%parent: pci1
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d8 subvendor=0x15d9 subdevice=0x16d8 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:195:0:0
dev.bnxt.0.%driver: bnxt
</pre>
</ref>
| colspan="3" |1.0.0.2 (via iflib)<ref name=":2">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code>
<pre>
dev.bnxt.0.iflib.driver_version: 1.0.0.2
dev.bnxt.0.%parent: pci2
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d7 subvendor=0x14e4 subdevice=0x1402 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:194:0:0
dev.bnxt.0.%driver: bnxt
dev.bnxt.0.%desc: Broadcom BCM57414 NetXtreme-E 10Gb/25Gb Ethernet
</pre>
</ref>
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=cxgbe&sektion=4&format=html cxgbe]
|
* Chelsio T4/T5/T6
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=em&sektion=4&format=html em]
|
* Intel I219
|
|
|
|
|
|
|
|
|
|
|
| colspan="2" rowspan="2" |7.6.1-k (via iflib)<ref name=":0">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a LES compact 4L with I210:
<pre>
dev.igb.0.iflib.driver_version: 7.6.1-k
dev.igb.0.%parent: pci1
dev.igb.0.%pnpinfo: vendor=0x8086 device=0x157b subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igb.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP01.PXSX
dev.igb.0.%driver: igb
dev.igb.0.%desc: Intel(R) PRO/1000 PCI-Express Network Driver
</pre>
</ref>
|7.6.1-k
|-
|igb
|
* Intel I210
* Intel I211
* Intel I350
| colspan="4" |2.5.28-fbsd (via iflib)<ref name=":7">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a LES compact 4L:
<pre>
dev.igb.0.iflib.driver_version: 2.5.28-fbsd
dev.igb.0.%iommu: rid=0x100
dev.igb.0.%parent: pci1
dev.igb.0.%pnpinfo: vendor=0x8086 device=0x157b subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igb.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP01.PXSX
dev.igb.0.%driver: igb
</pre>
</ref>
| colspan="3" |2.5.19-fbsd (via iflib)<ref name=":6">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on an <tklink type="sitex" id="20785">Edge 4L</tklink>:
<pre>
dev.igb.0.iflib.driver_version: 2.5.19-fbsd
dev.igb.0.%parent: pci1
dev.igb.0.%pnpinfo: vendor=0x8086 device=0x1533 subvendor=0xffff subdevice=0x0000 class=0x020000
dev.igb.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP03.PXSX
dev.igb.0.%driver: igb
dev.igb.0.%desc: Intel(R) I210 (Copper)
</pre>
</ref>
|
| colspan="3" |7.6.1-k (via iflib)<ref name=":0" />
|2.5.3-k
|-
|igc
|
* Intel I225-V
* Intel I225-LM
* Intel I226-V
| colspan="5" |1 (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.igc.0.iflib.driver_version' -A 6</code> on a <tklink type="sitex" id="20700">LES v4</tklink>:
<pre>
dev.igc.0.iflib.driver_version: 1
dev.igc.0.%parent: pci1
dev.igc.0.%pnpinfo: vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igc.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PC00.RP01.PXSX
dev.igc.0.%driver: igc
dev.igc.0.%desc: Intel(R) Ethernet Controller I225-V
dev.igc.%parent:
</pre>
</ref>
<ref>Read out via <code>sysctl -a | grep -E 'dev.igc.0.iflib.driver_version' -A 6</code> on a <tklink type="sitex" id="21011">LES plus v4</tklink>:
<pre>
dev.igc.0.iflib.driver_version: 1
dev.igc.0.%parent: pci2
dev.igc.0.%pnpinfo: vendor=0x8086 device=0x125c subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igc.0.%location: slot=0 function=0 dbsf=pci0:2:0:0 handle=\_SB_.PC00.RP05.PXSX
dev.igc.0.%driver: igc
dev.igc.0.%desc: Intel(R) Ethernet Controller I226-V
dev.igc.%parent:
</pre>
</ref>
| colspan="5" |1 (via iflib)<ref name=":1">Read out via <code>sysctl -a | grep -E 'dev.igc.0.iflib.driver_version' -A 6</code> on a <tklink type="sitex" id="20159">LES network 6L</tklink>:
<pre>
dev.igc.0.iflib.driver_version: 1
dev.igc.0.%parent: pci1
dev.igc.0.%pnpinfo: vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igc.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP05.PXSX
dev.igc.0.%driver: igc
dev.igc.0.%desc: Intel(R) Ethernet Controller I225-V
dev.igc.%parent:
</pre>
</ref>
| colspan="4" |(not supported)
|-
|ix
|
* Intel X520
* Intel X550
* Intel E610
| colspan="2" |5.0.1-k(via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with a Kontron K3881-C motherboard and E610 interfaces:
<pre>
dev.ix.0.iflib.driver_version: 5.0.1-k
dev.ix.0.%iommu: rid=0x700
dev.ix.0.%parent: pci6
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x57b0 subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:7:0:0 handle=\_SB_.PC00.RP09.PXSX
dev.ix.0.%driver: ix
dev.ix.0.%desc: Intel(R) E610 (10 GbE)
</pre>
</ref>
|5.0.1-k(via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with X520 (82599ES) interfaces:
<pre>
dev.ix.0.iflib.driver_version: 5.0.1-k
dev.ix.0.%iommu: rid=0x200
dev.ix.0.%parent: pci2
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x10fb subvendor=0xffff subdevice=0xffff class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:2:0:0 handle=\_SB_.PC00.RP01.PXSX
dev.ix.0.%driver: ix
dev.ix.0.%desc: Intel(R) X520 82599ES (SFI/SFP+)
</pre>
</ref>
|
|4.0.1-k (via iflib)<ref name=":4">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with Supermicro X12SPi-TF motherboard:
<pre>
dev.ix.0.iflib.driver_version: 4.0.1-k
dev.ix.0.%domain: 0
dev.ix.0.%parent: pci1
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x1563 subvendor=0x15d9 subdevice=0x1563 class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PC00.RP01.D033
dev.ix.0.%driver: ix
</pre>
</ref>
|
|4.0.1-k (via iflib)<ref name=":4" />
|
|4.0.1-k (via iflib)<ref name=":3">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with Supermicro X10SDV-TP8F motherboard:
<pre>
dev.ix.0.iflib.driver_version: 4.0.1-k
dev.ix.0.%parent: pci5
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x15ac subvendor=0x15d9 subdevice=0x15ac class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:4:0:0 handle=\_SB_.PCI0.BR2C.H000
dev.ix.0.%driver: ix
dev.ix.0.%desc: Intel(R) X552 (SFP+)
</pre>
</ref>
|
|
|
|
|3.2.12-k ? (was on OPNsense 18.7)
|-
|[https://www.freebsd.org/cgi/man.cgi?query=ixl&sektion=4&format=html ixl]
|
* Intel X700 Series
| colspan="3" |2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with Advantech FWA-3034:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%iommu: rid=0x200
dev.ixl.0.%parent: pci2
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x1572 subvendor=0x13fe subdevice=0x303d class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:2:0:0 handle=\_SB_.PC00.PEG0.PEGP
dev.ixl.0.%driver: ixl
</pre>
</ref>
|2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a system with Asus P13R-M/10G-2T motherboard:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%iommu: rid=0x300
dev.ixl.0.%parent: pci3
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x15ff subvendor=0x1043 subdevice=0x0000 class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:3:0:0 handle=\_SB_.PC00.RP13.PXSX
dev.ixl.0.%driver: ixl
</pre>
</ref>
|2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a system that has a built-in Intel X710-T4 network card:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%domain: 0
dev.ixl.0.%parent: pci8
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x15ff subvendor=0x8086 subdevice=0x0001 class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:81:0:0 handle=\_SB_.PC02.BR2A.H000
dev.ixl.0.%driver: ixl
dev.ixl.0.%desc: Intel(R) Ethernet Controller X710 for 10GBASE-T - 2.3.3-k
</pre>
</ref>
|
|2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a system featuring an Asus P12R-M/10G-2T motherboard:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%parent: pci3
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x15ff subvendor=0x1043 subdevice=0x0000 class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:3:0:0 handle=\_SB_.PC00.RP09.D073
dev.ixl.0.%driver: ixl
dev.ixl.0.%desc: Intel(R) Ethernet Controller X710 for 10GBASE-T - 2.3.3-k
</pre>
</ref>
|
|2.3.1-k (via iflib)
|
|
| colspan="2" |2.1.0-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a Supermicro AOC-STG-i4S network card:
<pre>
dev.ixl.0.iflib.driver_version: 2.1.0-k
dev.ixl.0.%parent: pci20
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x1572 subvendor=0x15d9 subdevice=0x087e class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:65:0:0
dev.ixl.0.%driver: ixl
dev.ixl.0.%desc: Intel(R) Ethernet Controller X710 for 10GbE SFP+ - 2.1.0-k
</pre>
</ref>
|1.9.9-k ?
|-
|ice
|
* Intel E800 Series
| colspan="3" |1.43.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with Advantech FWA-3034:
<pre>
dev.ice.0.iflib.driver_version: 1.43.3-k
dev.ice.0.%iommu: rid=0x100
dev.ice.0.%parent: pci1
dev.ice.0.%pnpinfo: vendor=0x8086 device=0x1593 subvendor=0x13fe subdevice=0x2060 class=0x020000
dev.ice.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PC00.PEG1.PEGP
dev.ice.0.%driver: ice
</pre>
</ref>
|
|1.39.13-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a system that has a built-in Intel E810-XXVDA2 network card:
<pre>
dev.ice.0.iflib.driver_version: 1.39.13-k
dev.ice.0.%domain: 0
dev.ice.0.%parent: pci10
dev.ice.0.%pnpinfo: vendor=0x8086 device=0x159b subvendor=0x8086 subdevice=0x0003 class=0x020000
dev.ice.0.%location: slot=0 function=0 dbsf=pci0:138:0:0 handle=\_SB_.PC04.BR4A.H000
dev.ice.0.%driver: ice
dev.ice.0.%desc: Intel(R) Ethernet Network Adapter E810-XXV-2 - 1.39.13-k
</pre>
</ref>
|
|1.37.11-k (via iflib)<ref>Read out via <code>root@OPNsense:~ # sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code>on a system with Supermicro X12SDV-4C-SP6F motherboard:
<pre>
dev.ice.0.iflib.driver_version: 1.37.11-k
dev.ice.0.%domain: 0
dev.ice.0.%parent: pci8
dev.ice.0.%pnpinfo: vendor=0x8086 device=0x124d subvendor=0x15d9 subdevice=0x124d class=0x020000
dev.ice.0.%location: slot=0 function=0 dbsf=pci0:244:0:0 handle=\_SB_.PC02.VP2A.CPM0
dev.ice.0.%driver: ice
</pre>
</ref>
|
|1.34.2-k (via iflib)<ref>Read out via <code>root@OPNsense:~ # sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a system with Supermicro X12SDV-4C-SP6F motherboard:
<pre>
dev.ice.1.iflib.driver_version: 1.34.2-k
dev.ice.1.%domain: 0
dev.ice.1.%parent: pci8
dev.ice.1.%pnpinfo: vendor=0x8086 device=0x124d subvendor=0x15d9 subdevice=0x124d class=0x020000
dev.ice.1.%location: slot=0 function=2 dbsf=pci0:244:0:2 handle=\_SB_.PC02.VP2A.D077
dev.ice.1.%driver: ice
</pre>
</ref>
|
| colspan="4" |(not supported)
|-
|[https://www.freebsd.org/cgi/man.cgi?query=mlx4en&sektion=4&format=html mlx4en]
|
* Mellanox ConnectX-4
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=mlx5en&sektion=4&format=html mlx5en]
|
* Mellanox ConnectX-5
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|re
|
* Realtek
| colspan="14" |See [[Realtek NICs in OPNsense]]
|}

== iflib ==
Iflib is a framework for network interface drivers for FreeBSD. It has been developed to remove standard codeblocks (boilerplates) that are often required for modern network interface devices. This should allow driver developers to focus on the specific code required for their hardware.<ref>[https://www.freebsd.org/cgi/man.cgi?query=iflib&sektion=4&apropos=0&manpath=FreeBSD+12.2-RELEASE+and+Ports iflib Manpage] (www.freebsd.org)</ref>

Iflib was launched in the fall of 2017 and provides a standardized set of functions for implementing network drivers. iflib currently supports most Intel drivers and cards from Broadcom NetExtreme family.<ref>[https://www.youtube.com/watch?v=FuNgy8Ag4DE Sam Gwydir: Improving netdump hardware support and performance with iflib - BSDCan 2018] (youtube.com)</ref>

The idea behind iflib was to reduce the redundant code in different NIC drivers to standardize certain kernel interface functions. Most, but not all, NIC drivers have been rewritten by the manufacturers to support the iflib API. The new library handles tasks such as connecting Netmap devices to relieve the manufacturers' driver developers of this burden.

The use of iflib in FreeBSD means that the driver versions have changed. The version that can be seen in the current FreeBSD kernels is the iflib version of the driver and this version number usually does not match the latest version of the driver listed on the manufacturer's website. Some manufacturers provide an iflib version of their FreeBSD driver for newer kernel versions and an older, non-iflib version for older kernels. And the real catch is that, for some NIC drivers, the version number that appears to be newer and higher is actually older code than what might be included in a non-iflib version.<ref>[https://forum.netgate.com/topic/155324/any-one-know-which-intel-ix-driver-for-x520-card-is-in-the-actual-kernel/4?_=1620296660376&lang=de Any one know which Intel ix driver for x520 card is in the actual kernel?] (forum.netgate.com)</ref>

== IPS support ==
An overview, which drivers are supported by IPS, is shown in the following spreadsheet:
* [https://docs.google.com/spreadsheets/d/1RVj8K3XOzWi-Bkjq6hUxWudu7Cxd8FFTqjLiBMzZWEM/edit#gid=0 netmap(4) on OPNsense] (docs.google.com/spreadsheets)

Information on ixl driver netmap support:
* [https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=230465#c30 ixl: not working in netmap mode (Comment #30)] (bugs.freebsd.org) <cite>I'm not surprised this works, because ixl in FreeBSD 12.x is implemented through iflib, and netmap in this case uses iflib to access the hw (and iflib must work, otherwise you would not be able to use an ixl NIC using the traditional networking tools and applications).</cite>

More information:
* [https://www.thomas-krenn.com/de/tkmag/allgemein/opnsense-webinar-intrusion-detection-pro-und-contra/ OPNsense Webinar: Intrusion Detection – Pro and Contra] (TKmag, 16.06.2020)

== References ==
<references />

{{Wfischer}}
{{Tniedermeier}}
{{Aranzinger}}
[[Category:OPNsense]]
[[de:OPNsense Netzwerkkarten-Treiber]]

Installation of Open WebUI with Ollama

2026-07-20T12:37:05Z

Aranzinger: Created page with "'''Open WebUI''' provides a browser-based user interface for local KI-models. In connection with Ollama, user can select models and use them via webbrowser. This article shows the installation of Open WebUI as docker container. Ollama is operated natively on the same Ubuntu server.  == Requirements == These instructions are..."

'''Open WebUI''' provides a browser-based user interface for local KI-models. In connection with Ollama, user can select models and use them via webbrowser.

This article shows the installation of Open WebUI as docker container. Ollama is operated natively on the same Ubuntu server.



== Requirements ==

These instructions are designed for Ubuntu server 24.04 LTS. The following components must already be installed:

* Ollama in accordance with the article [[Installation of Ollama]]
* Docker in accordance with the article [[Docker Installation under Ubuntu 24.04]]
* At least one locally installed Ollama model
* User with <code>sudo</code>-rights
* Free TCP-Port <code>8080</code>

Check the Ollama service:

<syntaxhighlight lang="bash">sudo systemctl status ollama</syntaxhighlight>

If the connection is successful, a JSON response containing the installed models is returned.

If no model is available, download, for example, <code>gemma3:4b</code>:

<syntaxhighlight lang="bash">ollama pull gemma3:4b</syntaxhighlight>

Check the docker installation:

<syntaxhighlight lang="bash">sudo docker version</syntaxhighlight>

== Install WebUI ==

Open WebUI runs in a docker container. As Ollama is natively installed on the same server, the container with the host network is started.

Start WebUI:

<syntaxhighlight lang="bash" line="1">sudo docker run -d \
--network=host \
-v open-webui:/app/backend/data \
-e OLLAMA_BASE_URL=http://127.0.0.1:11434 \
--name open-webui \
--restart always \
ghcr.io/open-webui/open-webui:main</syntaxhighlight>

The Docker volume <code>open-webui</code> stores user accounts, settings and chat histories permanently.

The <code>main</code> tag refers to the current version. For the productive operation, a fixed version number should be used after the test has been successful.



Check the container status:

<syntaxhighlight lang="bash">sudo docker ps --filter name=open-webui</syntaxhighlight>

If necessary, view the startup logs:

<syntaxhighlight lang="bash">sudo docker logs --tail=100 open-webui</syntaxhighlight>

== Open web interface ==

Open the following address in a browser:

<code>http://<IP-DES-SERVERS>:8080</code>

The first user account created on a new installation is granted administrator privileges.




Log in and select <code>gemma3:4b</code> from the model selection.

Send, for example, the following request:

:Explain the difference between RAID 5 und RAID 6.

If the model responds, the connection between Open WebUI and Ollama functions.



== Check Ollama connection ==

If no models are displayed, open the following in Open WebUI:

<code>Admin Panel > Settings > Connections</code>

The Ollama address should point to the following URL:

<code>http://127.0.0.1:11434</code>

In addition, check the Ubuntu server:

<syntaxhighlight lang="bash">curl http://127.0.0.1:11434/api/tags</syntaxhighlight>

As Open WebUI is started with <code>--network=host</code>, the container can use the local Ollama address directly.

== Update Open WebUI ==

Load the current container image:

<syntaxhighlight lang="bash">sudo docker pull ghcr.io/open-webui/open-webui:main</syntaxhighlight>

Stop and remove the previous container:

<syntaxhighlight lang="bash" line="1">sudo docker stop open-webui
sudo docker rm open-webui</syntaxhighlight>

After that, restart Open WebUI:

<syntaxhighlight lang="bash" line="1">sudo docker run -d \
--network=host \
-v open-webui:/app/backend/data \
-e OLLAMA_BASE_URL=http://127.0.0.1:11434 \
--name open-webui \
--restart always \
ghcr.io/open-webui/open-webui:main</syntaxhighlight>

The data in the docker volume <code>open-webui</code> is retained.

== Secure access ==

Open WebUI uses user accounts. Nevertheless, port <code>8080</code> should not be accessible from the Internet without protection.

A VPN or a reverse proxy with HTTPS is recommended for the access from the Internet. For a reverse proxy, WebSockets support must be enabled.

For purely internal use, access can be restricted to the local network using UFW:

<syntaxhighlight lang="bash">sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp</syntaxhighlight>

Adapt the subnet to your own environment:

== Troubleshooting ==

=== Websurface is not available ===

Check the container status:

<syntaxhighlight lang="bash">sudo docker ps -a --filter name=open-webui</syntaxhighlight>

View the logs:

<syntaxhighlight lang="bash">sudo docker logs open-webui</syntaxhighlight>

Verify, if port <code>8080</code> is already used:

<syntaxhighlight lang="bash">sudo ss -tulpn | grep 8080</syntaxhighlight>

=== No models are displayed ===

Check the installed Ollama models:

<syntaxhighlight lang="bash">ollama ls</syntaxhighlight>

Check Ollama API:

<syntaxhighlight lang="bash">curl http://127.0.0.1:11434/api/tags</syntaxhighlight>

Restart both services if necessary:

<syntaxhighlight lang="bash" line="1">sudo systemctl restart ollama
sudo docker restart open-webui</syntaxhighlight>

=== Page is not displayed correctly after an update ===

Open the web interface in a private browser window to test it. If it works there, delete the cache and the website data for the Open-WebUI-address.

== Deinstallation ==

Stop and remove the container:

<syntaxhighlight lang="bash" line="1">sudo docker stop open-webui
sudo docker rm open-webui</syntaxhighlight>

The stored data remains in the Docker volume for the time being.

Remove the volume to delete all Open-WebUI-data completely:

<syntaxhighlight lang="bash">sudo docker volume rm open-webui</syntaxhighlight>

'''Attention:''' User accounts, settings and chat histories are completely deleted.

== Sources ==

* [https://docs.openwebui.com/getting-started/quick-start/ Open WebUI Documentation – Quick Start] (en)
* [https://docs.openwebui.com/getting-started/quick-start/connect-a-provider/starting-with-ollama/ Open WebUI Documentation – Ollama] (en)
* [https://docs.openwebui.com/troubleshooting/connection-error/ Open WebUI Documentation – Connection Errors] (en)
* [https://www.thomas-krenn.com/de/wiki/Docker_Installation_unter_Ubuntu_24.04 Docker Installation on Ubuntu 24.04]
* [https://docs.ollama.com/api/introduction Ollama Documentation – API Introduction] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Artificial Intelligence]]
[[Category:Linux]]
[[Category:Ubuntu]]
[[Category:Docker]]

Activation of NVIDIA vGPU for RDS Sessions on Windows Server

2026-07-20T10:28:32Z

Aranzinger: Created page with "On Windows Server, applications within an RDS session may not use the assigned NVIDIA vGPU. Instead, Windows uses Microsoft Basic Render Driver by default. As a result, DirectX-based 3D applications, in particular, cannot access the GPU. This article shows how to activate NVIDIA vGPU for RDS-sessions.  == Requirements == The NVIDIA vGPU must be assigned to the vi..."

On Windows Server, applications within an RDS session may not use the assigned NVIDIA vGPU. Instead, Windows uses Microsoft Basic Render Driver by default. As a result, DirectX-based 3D applications, in particular, cannot access the GPU.

This article shows how to activate NVIDIA vGPU for RDS-sessions.



== Requirements ==
The NVIDIA vGPU must be assigned to the virtual machine and the suitable guest driver must be installed.

Check first if Windows recognizes the vGPU:

<syntaxhighlight lang="powershell">nvidia-smi</syntaxhighlight>

The command should display the assigned GPU and the graphics memory available.



== Enable Group Policy ==

Open the dialogue <code>Execute</code> via <code>Windows-Key+ R</code> and start:

<code>gpedit.msc</code>

Navigate to:

<code>Computer-Configuration > Administrative Templates> Windows-Components> Remotedesktopservices > Remotedesktop-Session-Host > Remote-Session-Environment</code>



Activate the guideline:

<code>Hardware graphics adapter for all remotedesktopservices-sessions</code>

The English name is:

<code>Use the hardware default graphics adapter for all Remote Desktop Services Sessions</code>



After that, restart Windows-Server-VM.

== Check GPU-use ==

Re-establish an RDS connection and launch an application that uses GPU acceleration.

Check the utilization in the Task-Manager:

<code>Performance > GPU</code>

Alternatively, you can execute the following command:

<syntaxhighlight lang="powershell">nvidia-smi</syntaxhighlight>

If a GPU still does not appear, check the NVIDIA vGPU guest driver, the assigned vGPU profile, and the licensing.

== Background ==

NVIDIA describes this behaviour for all supported Windows Server guest operating systems. The default settings uses Microsoft Basic Render Driver, as Software Rendering can be more efficient for simple 2D-applications.
DirectX-based 3D-applications cannot, however, access the GPU.

== Sources ==

* [https://docs.nvidia.com/vgpu/19.0/known-issues/bug-no-id-no-gpu-utilization-windows-server-guests.html NVIDIA vGPU Documentation – RDS sessions do not use the GPU with Microsoft Windows Server as guest OS] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Windows]]
[[Category:Virtual Desktop Infrastructure (VDI)]]
[[de:NVIDIA vGPU für RDS-Sitzungen unter Windows Server aktivieren]]

Supermicro BMC Security Advisories July 2026

2026-07-20T05:49:48Z

Aranzinger:

In '''July 2026''', Supermicro published security advisories regarding the BMC-firmware of its mainboards. This security vulnerability requires a '''firmware update'''.

In this article, you will find information on this security advisory and where to find updates on Thomas-Krenn products.

== Security advisories ==
{| class="wikitable"
|- style="background-color: #EFEFEF; font-weight: bold;"
! align="center" |CVE
! align="center" |Risk potential
! align="center" |Description
|-
|align="center" | CVE-2026-3821
| align="center" | High 8.8
| align="left" | '''Execution of arbitrary code''' (The SMASH-services of Supermicro (SMC) show a security vulnerability that allows the execution of an arbitrary code. An authorized attacker can exploit SMASH input functions to compromise data integrity or launch a denial-of-service (DoS) attack against the BMC.)
|-
|}

== Updates for Thomas-Krenn products ==
Updates on the corresponding system can be found in the <tklink type="sitex" id="440">download area of Thomas-Krenn</tklink>.
The updates in the download area have been tested by us to guarantee the stability and compatibility of our systems.

If you require the latest version for your system and it is not yet available in our download area, you can get it at [https://www.asus.com/de/support/download-center/ Asus] or [https://www.supermicro.com/en/support/resources/downloadcenter/swdownload Supermicro].

== More information ==
* [https://www.supermicro.com/en/support/security_BMC_IPMI_Jul_2026 Vulnerabilities in Supermicro BMC Firmware, July 2026]
{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category:Server Hardware]]
[[de:Supermicro BMC Sicherheitshinweise Juli 2026]]

Installation of Ollama

2026-07-17T07:38:13Z

Aranzinger:

'''Ollama''' allows the local operation of Large Language Models (LLMs) on a Linux server. The models run on the own hardware and can be used via command line or HTTP-API.

This article presents the native installation of Ollama on an Ubuntu server. As an example, a small model is downloaded and tested by using the local command line as well as the local API.



== Requirements ==

These instructions are designed for Ubuntu Server 24.04 LTS. The installation normally functions on an Ubuntu Server LTS and 22.04 LTS, too. For GPU-systems should be verified if a suitable driver is available for the used Ubuntu version in advance.

The following resources are recommended for initial testing:

* user with <code>sudo</code>-rights
* at least 8 GB RAM
* at least 20 GB storage available
* Internet access for installation and model download
* optional for a supported NVIDIA or AMD-GPU

Verify the intalled Ubuntu version:

<syntaxhighlight lang="bash">cat /etc/os-release</syntaxhighlight>

Install <code>curl</code>:

<syntaxhighlight lang="bash">sudo apt install -y curl</syntaxhighlight>

== Install Ollama ==
Execute the official installation script:

<syntaxhighlight lang="bash">curl -fsSL https://ollama.com/install.sh | sh</syntaxhighlight>



Next, verify the installed version:

<syntaxhighlight lang="bash">ollama -v</syntaxhighlight>

The installation script sets up a systemd-service. Check its status:

<syntaxhighlight lang="bash">sudo systemctl status ollama</syntaxhighlight>

The service should be displayed with the <code>active (running)</code> state.

If the service is not started, it can be activated manually:

<syntaxhighlight lang="bash">sudo systemctl enable --now ollama</syntaxhighlight>

== Start initial model ==

In this example, <code>gemma3:4b</code> is used. The model requires approximately 2.2 GB storage for the download and is suitable for the initial function test.

Start the model:

<syntaxhighlight lang="bash">ollama run gemma3:4b</syntaxhighlight>

Ollama automatically downloads the model the first time it is runned. It may take a few minutes depending on the Internet connection.



Next, enter the following query, for example:

:Explain the difference between RAID 5 and RAID 6.

Finish the session with:

<syntaxhighlight lang="bash">/bye</syntaxhighlight>

Display the installed models:

<syntaxhighlight lang="bash">ollama ls</syntaxhighlight>

== Verify GPU-usage ==

Ollama automatically uses a supported GPU if the required driver is installed.

Start the model and open the second SSH-session:

<syntaxhighlight lang="bash">ollama run gemma3:4b</syntaxhighlight>

Check the current version there:

<syntaxhighlight lang="bash">ollama ps</syntaxhighlight>

The column <code>PROCESSOR</code> displays if the model is executed on the CPU, GPU or on both.

With an NVIDIA GPU, you can also check the utilization:

<syntaxhighlight lang="bash">nvidia-smi</syntaxhighlight>

If there is no supported GPU available, Ollama executes the model via CPU and RAM. Response times are generally longer in such cases.



== Check Ollama-API ==

Ollama provides a local HTTP-API on port <code>11434</code> by default.

Display the models available via API:

<syntaxhighlight lang="bash">curl http://127.0.0.1:11434/api/tags</syntaxhighlight>

If the connection is successful, a JSON response containing the installed models is returned.

The local API is, for example, used by Open WebUI, n8n and own applications.

== Optional: Acces from the local network ==

By default, Ollama only listens on <code>127.0.0.1</code>. If another system should access the API in the local network, the Bind address must be adjusted.

Open the systemd extension:

<syntaxhighlight lang="bash">sudo systemctl edit ollama.service</syntaxhighlight>

Add the following content:

<syntaxhighlight lang="ini" line="1">[Service]
Environment="OLLAMA_HOST=0.0.0.0:11434"</syntaxhighlight>

Apply changes:

<syntaxhighlight lang="bash" line="1">sudo systemctl daemon-reload
sudo systemctl restart ollama</syntaxhighlight>

Next, verify the port:

<syntaxhighlight lang="bash">sudo ss -tulpn | grep 11434</syntaxhighlight>

By default, the Ollama API does not have its own user authentication for locally run models. Port <code>11434</code> should therefore only be released for reuqired systems and should not be directly available from the Internet.

Here is an example for the release of an internal subnet with UFW:

<syntaxhighlight lang="bash">sudo ufw allow from 192.168.1.0/24 to any port 11434 proto tcp</syntaxhighlight>

Customize the subnet to suit your own environment.

Further Ollama environment variables can be added in the same systemd-extension. All <code>Environment="..."</code> lines are entered together under a <code>[Service]</code> block.

== Update Ollama ==

On Linux, Ollama is updated by running the installation script again:

<syntaxhighlight lang="bash">curl -fsSL https://ollama.com/install.sh | sh</syntaxhighlight>

Models that have already been downloaded will remain.

After that, check the version:

<syntaxhighlight lang="bash">ollama -v</syntaxhighlight>

== Troubleshooting ==

=== Ollama-service does not run ===

Verify the service status:

<syntaxhighlight lang="bash">sudo systemctl status ollama</syntaxhighlight>

Display the most recent log entries:

<syntaxhighlight lang="bash">sudo journalctl -e -u ollama</syntaxhighlight>

=== Model does not start ===

Check the available storage space:

<syntaxhighlight lang="bash">df -h</syntaxhighlight>

Display the installed models:

<syntaxhighlight lang="bash">ollama ls</syntaxhighlight>

If necessary, download the model again:

<syntaxhighlight lang="bash">ollama pull gemma3:4b</syntaxhighlight>

=== Port 11434 is not available ===

Check if Ollama listens on the port:

<syntaxhighlight lang="bash">sudo ss -tulpn | grep 11434</syntaxhighlight>

Restart the service:

<syntaxhighlight lang="bash">sudo systemctl restart ollama</syntaxhighlight>

== Sources ==

* [https://docs.ollama.com/linux Ollama Documentation – Linux] (en)
* [https://docs.ollama.com/quickstart Ollama Documentation – Quickstart] (en)
* [https://docs.ollama.com/api/introduction Ollama Documentation – API Introduction] (en)
* [https://docs.ollama.com/faq Ollama Documentation – FAQ] (en)
* [https://ollama.com/library/gemma3:4b Ollama Model Library – Gemma 3 4B] (en)
* [https://ubuntu.com/about/release-cycle Ubuntu Release Cycle] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Artificial Intelligence]]
[[Category:Linux]]
[[Category:Ubuntu]]
[[de: Ollama installieren]]

Failed to fetch enterprise.proxmox.com 401 Unauthorized

2026-07-16T12:53:03Z

Aranzinger: Created page with "Proxmox Server Solutions GmbH from Vienna provides two package repositories for Proxmox VE: '''Proxmox VE Enterprise Repository''' (subject to a fee, recommended for productive use) and '''Proxmox VE No-Subscription Repository''' (free of charge, recommended for testing purposes). After Installation of Proxmox VE, the following error message appears when trying to install updates: '''<nowiki>Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/buster/I..."

Proxmox Server Solutions GmbH from Vienna provides two package repositories for [[Proxmox VE]]: '''Proxmox VE Enterprise Repository''' (subject to a fee, recommended for productive use) and '''Proxmox VE No-Subscription Repository''' (free of charge, recommended for testing purposes). After [[Installation of Proxmox VE]], the following error message appears when trying to install updates: '''<nowiki>Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/buster/InRelease 401 Unauthorized</nowiki>'''. This article shows how to solve this error by either setting up a paid subscription to the Enterprise Repository or, alternatively, using the free No-Subscription Repository.

== Troubleshooting ==
[[File:Proxmox_8_Updates_Refresh_Error.png|thumb|right|After the installation, Proxmox VE displays the following error message when trying to install the updates. The access to '''Proxmox VE Enterprise Repository''' can be unlocked with a subscription key. Alternatively, the '''Proxmox VE No-Subscription Repository''' is available for testing purposes.]] After the installation of Proxmox VE, the following message appears without further configuration when trying to install updates:
<pre>
Header
Proxmox
Virtual Environment 8.1.3
Node 'pve'
Show details
Logs
()
starting apt-get update
Get:1 http://security.debian.org bookworm-security InRelease [48.0 kB]
[...]
Get:9 http://ftp.at.debian.org/debian bookworm/main Translation-en [6109 kB]
Err:10 https://enterprise.proxmox.com/debian/ceph-quincy bookworm InRelease
401 Unauthorized [IP: 212.224.123.70 443]
Err:11 https://enterprise.proxmox.com/debian/pve bookworm InRelease
401 Unauthorized [IP: 212.224.123.70 443]
Get:12 http://ftp.at.debian.org/debian bookworm/contrib amd64 Packages [54.1 kB]
Get:13 http://ftp.at.debian.org/debian bookworm/contrib Translation-en [48.7 kB]
Get:14 http://ftp.at.debian.org/debian bookworm-updates/main amd64 Packages [12.7 kB]
Get:15 http://ftp.at.debian.org/debian bookworm-updates/main Translation-en [13.8 kB]
Reading package lists...
E: Failed to fetch https://enterprise.proxmox.com/debian/ceph-quincy/dists/bookworm/InRelease 401 Unauthorized [IP: 212.224.123.70 443]
E: The repository 'https://enterprise.proxmox.com/debian/ceph-quincy bookworm InRelease' is not signed.
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bookworm/InRelease 401 Unauthorized [IP: 212.224.123.70 443]
E: The repository 'https://enterprise.proxmox.com/debian/pve bookworm InRelease' is not signed.
TASK ERROR: command 'apt-get update' failed: exit code 100
</pre>

== Solution 1: Proxmox VE Enterprise Repository ==
This is the default, stable and recommended repository that is available for all users of Proxmox VE subcriptions. It contains the most stable packages and is suitable for production use. The pve-enterprise Repository is activated by default (/etc/apt/sources.list.d/pve-enterprise.list).

Information on the subscriptions available can be found in the article [[Proxmox VE Support-Subscriptions]].

== Solution 2: Proxmox VE No-Subscription Repository ==
This is the repository that is recommended for testing and non-production purposes. The included packages are not as intensively tested and validated as those from the Proxmox VE Enterprise Repository. There is no subscription key required for the access on the pve-no-subscription Repository.

The following settings must be selected in /etc/apt/sources.list for using the No-Subscription Repository:
<pre>
deb http://ftp.at.debian.org/debian bookworm main contrib
deb http://ftp.at.debian.org/debian bookworm-updates main contrib

# PVE pve-no-subscription repository provided by proxmox.com,
# NOT recommended for production use
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

# security updates
deb http://security.debian.org bookworm-security main contrib
</pre>

Note: So that the message "failed to fetch" disappears permanently, you must comment out the respective repository listed in each file by adding a "#" before it in the following two files:
* /etc/apt/sources.list.d/pve-enterprise.list:
*: <pre># deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterprise</pre>
* /etc/apt/sources.list.d/ceph.list:
*: <pre># deb https://enterprise.proxmox.com/debian/ceph-quincy bookworm enterprise</pre>

== More information ==
* [https://pve.proxmox.com/wiki/Package_Repositories Package Repositories] (pve.proxmox.com/wiki)

{{Wfischer}}
{{Aranzinger}}
[[Category:Proxmox Troubleshooting]]
[[de:Failed to fetch enterprise.proxmox.com 401 Unauthorized]]

Synology UC3400 Metadata-Overflow

2026-07-15T12:03:11Z

Aranzinger: Created page with "right On the Synology UC3400, a very high number of metadata objects (>10 million) leads to a critical condition in combination with migrations and snapshot load that may cause CPU and RAM overloads and cause migrations to fail. This article describes symptoms and provides possible solutions. == Initial situation == The UC3400 administrates SAN and LUN structures with the help of a internal metadata database. When there is..."

[[file:UC3400_Front.png|frameless|322x322px|right]]
On the Synology UC3400, a very high number of metadata objects (>10 million) leads to a critical condition in combination with migrations and snapshot load that may cause CPU and RAM overloads and cause migrations to fail.

This article describes symptoms and provides possible solutions.

== Initial situation ==
The UC3400 administrates SAN and LUN structures with the help of a internal metadata database. When there is a very large number of objects, the metadata can grow significantly. In addition, long snapshot chains, numerous copy-on-write operations, and the simultaneous processing of I/O and metadata accesses lead to increased system load.

The situation becomes particularly critical when there is a high number of snapshots, long operation hours without reorganisation, the migration of more extensive LUNs or the high rates of changes within a short time.

== Problem description ==
When there are more than '''approximately 10 million metadata objects''', a significant system overload occurs on the UC3400. This condition is often referred to as '''Metadata overflow'''.

Possible symptoms are:

* CPU-/RAM-load permanently close to 100%
* migrations are canceled or "timeouted"
* system reacts very slowly
* storage and snapshot operations block each other
* SAN-services fail temporarily
* risk for inconsistent LUN conditions increases

'''The following applies to the Synology UC3400:'''

* < 5 million objects → stable
* 5–10 million objects → marginal
* 10 million objects → critical (overflow risk)
* 50 milion objects → can only be operated effectively with significant optimization

== '''Immediate measures''' ==
The following measures can be implemented to restore operational capability quickly:

'''Note:''' These measures are intended solely as temporary workarounds and do not constitute a long-term solution for production operations.
* stop migration
* reduce snapshot load
* restart services (only in maintenance window)

== '''Recommended solution strategy''' ==
The most sustainable solution is a reorganization of the LUN-structure and a migration into smaller, clearly separated units.

=== Create new LUN ===
The most stable method is:

# create new LUN
# transmit data via storage migration or backup restore
# delete old LUN

As a result, all old metadata will be deleted completely.

=== Alternative: Metadata-Rebuild ===
{| {{Prettytable}} cellspacing="0" style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #a0a0a0 solid; border-collapse: collapse; " rules="all"
|'''Note: A Metadata-Rebuild should be only performed if there is a current and functional backup of all relevant data!'''
|-
|}

This risky procedure is intended solely as a last resort for recovery after all other diagnostic and repair measures have been proven unsuccessful.

Only with complete backup:

* metadata structure is deleted and recreated
* risk of iSCSI-Mapping losses
* only recommended for emergencies
== Prevention ==
To avoid the above mentioned problems, the following measures can be implemented:
* limit snapshot number
* LUN-recreation for long durations on a regular basis
* unload metadata regularly
* divide migrations in smaller sessions
* monitoring of CPU / RAM and SAN metadata load

'''Recommendation:''' When migrating large amounts of data, you should involve Synology Support early on. This way, they can assist with the data migration if needed, and you will receive recommendations on best practices to minimize risks.

{{Wsuess}}
{{Aranzinger}}
[[Category:Storage]]
[[de:Synology UC3400 Metadaten-Overflow]]

IPMI BMC reset for IPMI problems

2026-07-09T11:34:27Z

Aranzinger:

If there are any problems with IPMI or Remote Management Webinterface, the BMC (Baseboard Management Controller) can be '''restartet''' using the '''IPMItool'''. In this example, it is explained how to restart the BMC in Linux with ipmitool.

== IPMI BMC reset via ipmitool (remote) ==
If the server does not run on Linux, ipmitool can be executed on a Linux computer to restart the BMC of another server by using its IPMI IP address.

The command for the reset of the module on the server 10.0.0.1 (default user and pw) is as follows:
ipmitool mc reset cold -I lan -H 10.0.0.1 -U admin -P password

The last parameter is optional. It is prompted for the password if it has not been entered yet. Communication between the ipmitool on the Linux system and the IPMI BMC of the server takes place via UDP port 623.

== IPMI BMC reset via ipmitool (local) ==
If Linux is installed on the server itself, BMC can be reset locally (with root rights):
ipmitool mc reset cold

== Alternative: Turn off server ==
If the described procedure does not function with a reset via IPMI command, there is always the possibility to shut down the server and to turn off the power for 30 seconds then. To do this, the server must be disconnected completely from the power supply. This procedure also leads to a reset of the BMC.

== Recreate default settings ==
If you also want to recreate default settings, you can use the ipmicfg tool for Supermicro-based systems (see also [[IPMICFG#Recreation of default settings]]).

{{Aranzinger}}
[[Category:Remote Management]]
[[de:IPMI BMC reset bei IPMI Problemen]]

Windows Server 2025: Differences between editions

2026-07-09T07:41:43Z

Aranzinger: Created page with "Microsoft Windows Server 2025 is an operating system of the Windows series and the successor of Windows Server 2022. This article presents the differences between Windows Server 2025 editions. Pricing information on Windows Server 2025 can be found in the Thomas-Krenn online shop at <tklink type=sitex id=18135/>. For Windows Server 2025, Microsoft is now adopting the same approach it used for Window..."

Microsoft [[:Category:Windows Server 2025 | Windows Server 2025]] is an operating system of the Windows series and the successor of [[:Category:Windows Server 2022 | Windows Server 2022]].

This article presents the differences between Windows Server 2025 editions. Pricing information on Windows Server 2025 can be found in the Thomas-Krenn online shop at <tklink type=sitex id=18135/>. For Windows Server 2025, Microsoft is now adopting the same approach it used for Windows Server 2019 and Windows Server 2022, which is a '''Core Licensing'''. Information on this new licensing model can be found in the article [[Windows Server Core-Lizenzierung|Windows Server Core Licensing]].

== Editions ==
Microsoft Windows Server 2025 is available in four different editions:
* Essentials
* Standard
* Datacenter
*Datacenter Azure Edition

These four editions are suitable for the following application areas:
{| {{Prettytable}} width="1000px"
|- style="background-color: #EFEFEF; font-weight: bold;"
! Edition|| Suitable for... || Virtualization rights || Access licenses || CPU limit
|-
|'''Essentials'''
|align="center"| small companies with basic IT needs; very small IT department or no IT department of their own
|align="center"| Installation: 1 physical '''or''' 1 virtual *
|align="center"| no CALs required (limited to 25 users / 50 devices)
|align="center"| max. 1 CPU, max. 10 cores
|-
|'''Standard'''
|align="center"| for all companies that require extended features and virtualize to a lesser extent
|align="center"| 2 virtual Windows Server machines**
| rowspan="3" align="center" | CALs required***
|align="center" rowspan="2"| unlimited cores
|-
|'''Datacenter'''
|align="center"| for all companies with high IT workload needs and with a high number of virtual systems
| rowspan="2" align="center" | An unlimited number of virtual Windows Server machines
|-
|'''Datacenter Azure Edition'''
|align="center"| small companies with basic IT needs; very small IT department or no IT department on their own
|align="center"| 2,048 logical processors
|-
|}

:(*) The Windows Server Essentials license allows an installation of a physical and virtual Essentials Server if the physical server only provides the Hyper-V role for the virtualization of the Essentials Server.<ref>[https://www.microsoft.com/licensing/terms/productoffering/WindowsServerStandardDatacenterEssentials/OL#UseRights Windows Server Standard, Datacenter, and Essentials] (EN) (www.microsoft.com/licensing/terms)</ref>
:(**) The Windows Server Standard Edition License allows 2 OSEs (operating system environments) if all physical cores are licensed.
:(***) CALs are required for every user or for every device, which accesses a server directly or indirectly. Detailed information on this topic can be found on the Microsoft website. <ref>[https://www.microsoft.com/en-us/licensing/product-licensing/client-access-license Client Access Licenses and Management Licenses] (EN) (www.microsoft.com)</ref>

== Minimum hardware requirements for Windows Server 2025 ==
The following table presents the official minimum requirements for Windows Server 2025.<ref>[https://learn.microsoft.com/de-de/windows-server/get-started/hardware-requirements?tabs=cpu&pivots=windows-server-2025 Windows Server 2025 - Hardware Requirements] (DE) (www.learn.microsoft.com)</ref> The actual requirements are dependent on the system configuration and on the installed applications and features.

{| style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #a0a0a0 solid; border-collapse: collapse; " rules="all" width="650px" cellspacing="0" {{Prettytable}}
|- |- style="background-color: #EFEFEF; font-weight: bold;"
! Description || Minimum requirements
|-
|Processor architecture || x64
|-
|Processor speed || 1,4 GHz
|-
|Storage (RAM) || 512 MB* (recommended: ECC or similar technologies)
|-
|Hard drive storage space || 32 GB**
|-
|Network card || 1x Ethernet with a minimum throughput in the 1 GBit/s-range
|-
|}
:(*) 2GB for server with "desktop view".
:(**) Computer with more than 16 GB RAM require larger storage space for paging, hibernation, and backup files.

== What is new in Windows Server 2025 ==
In Windows Server 2022, the list of the new features is relatively short. Microsoft focuses on the new operating system Azure Stack HCI with new features.

We can look forward to the following new features in Windows Server 2025:<ref>[https://learn.microsoft.com/de-de/windows-server/get-started/whats-new-windows-server-2025 Windows Server 2025 - News] (DE) (www.learn.microsoft.com)</ref>

* Hotpatching
* TLS 1.3
* Improved Active Directory
* Optimized and improved performance for virtual machines and containers
* Improved administration

== Removed or not further developed features in Windows Server 2025 ==
In Windows Server 2025, there are few features that were not further developed or that were removed from Windows Server 2025.

The following features will no longer be included in Windows Server 2025:<ref>[https://learn.microsoft.com/de-de/windows-server/get-started/removed-deprecated-features-windows-server-2025 Windows Server 2025 - Removed Features] (DE) (www.learn.microsoft.com)</ref>

* IIS 6 administration console(Web-Lgcy-Mgmt-Console)
* NTLMv1
* WordPad
* SMTP-Server
* Windows PowerShell 2.0 Engine

== References ==
<references />

{{bbayer}}
{{Aranzinger}}
[[Category:Windows Server 2025]]
[[de:Windows Server 2025 Editionsunterschiede]]

How to: Install Nextcloud with an NFS data directory

2026-07-09T07:09:37Z

Smueller:

This article describes how to install Nextcloud Server on Ubuntu 26.04 LTS. Apache with PHP-FPM is used as the web server, while MariaDB provides the required database.

The actual Nextcloud user data is stored on an NFS-mounted storage system. The NFS storage is used as the primary Nextcloud data directory and is not integrated through the Nextcloud “External Storage” app.

This guide uses the following example values:

* Nextcloud address: <code>cloud.example.com</code>
* NFS server: <code>nfs.example.com</code>
* NFS export: <code>/nextcloud</code>
* Local NFS mount point: <code>/srv/nextcloud-data</code>
* Nextcloud directory: <code>/var/www/nextcloud</code>
* Database name: <code>nextcloud</code>
* Database user: <code>nextcloud</code>

Adjust these values to match your environment.

'''Note:''' In this setup, the NFS storage is part of the primary Nextcloud storage. If the NFS server is unavailable, the Nextcloud data directory will also be unavailable.

== Requirements ==

The following components are required for this guide:

* Ubuntu Server 26.04 LTS, 64-bit
* Apache 2.4
* PHP 8.5 with PHP-FPM
* MariaDB 11.8
* Redis
* An accessible NFSv4 export
* A DNS record for the Nextcloud domain
* TCP ports 80 and 443 must be reachable

For a small installation, the following resources can be used as an example:

* 4 vCPUs
* 4 GiB RAM
* At least 20 GiB of local storage for the operating system, Nextcloud application, database and logs
* Separate storage for the Nextcloud data directory

The actual resource requirements depend on factors such as the number of users, installed apps, number of files and concurrent access.

'''Important:''' NFS storage does not replace a backup. A complete backup must include at least the Nextcloud data directory, the MariaDB database and the Nextcloud configuration.

== Preparing the system ==

The following commands are executed as the <code>root</code> user.

First update the operating system:

<pre>
apt update
apt full-upgrade -y
</pre>

If a new kernel was installed, restart the system:

<pre>
reboot
</pre>

Then verify the installed Ubuntu version:

<pre>
cat /etc/os-release
</pre>

The output should contain the following information, among other values:

<pre>
VERSION_ID="26.04"
VERSION_CODENAME=resolute
</pre>

== Installing the required packages ==

Install Apache, MariaDB, PHP 8.5, Redis and the required PHP extensions:

<pre>
apt install -y \
apache2 \
mariadb-server \
php8.5-fpm \
php8.5-cli \
php8.5-common \
php8.5-curl \
php8.5-gd \
php8.5-gmp \
php8.5-imagick \
php8.5-intl \
php8.5-mbstring \
php8.5-mysql \
php8.5-xml \
php8.5-zip \
php8.5-bcmath \
php8.5-bz2 \
php8.5-apcu \
php8.5-redis \
redis-server \
nfs-common \
cron \
bzip2 \
wget
</pre>

Enable and start the required services:

<pre>
systemctl enable --now \
apache2 \
mariadb \
php8.5-fpm \
redis-server \
cron
</pre>

Verify the installed PHP version:

<pre>
php8.5 --version
</pre>

The output should begin with <code>PHP 8.5</code>.

The loaded PHP modules can be checked with the following command:

<pre>
php8.5 -m
</pre>

The following modules should be present, among others:

<pre>
apcu
curl
dom
fileinfo
gd
gmp
imagick
intl
mbstring
mysqli
openssl
pdo_mysql
redis
SimpleXML
xml
xmlreader
xmlwriter
zip
</pre>

== Configuring PHP 8.5 ==

Nextcloud requires suitable PHP settings for both PHP-FPM and command-line PHP calls.

=== Configuring PHP-FPM ===

Create a dedicated PHP configuration file for Nextcloud:

<pre>
nano /etc/php/8.5/fpm/conf.d/99-nextcloud.ini
</pre>

Add the following configuration:

<pre>
memory_limit = 512M
upload_max_filesize = 10G
post_max_size = 10G
max_execution_time = 3600
max_input_time = 3600
output_buffering = 0
</pre>

The values for <code>upload_max_filesize</code> and <code>post_max_size</code> determine the maximum file size that can be uploaded through the web interface. Adjust these values to suit your environment if required.

=== Configuring PHP CLI ===

The PHP command-line interface is used for cron jobs, maintenance tasks and the Nextcloud updater.

Create the following configuration file:

<pre>
nano /etc/php/8.5/cli/conf.d/99-nextcloud.ini
</pre>

Add the following content:

<pre>
memory_limit = 512M
apc.enable_cli = 1
</pre>

Verify the configuration:

<pre>
php8.5 --ini
php8.5 -i | grep -E 'memory_limit|apc.enable_cli'
</pre>

Restart PHP-FPM:

<pre>
systemctl restart php8.5-fpm
</pre>

Check the service status:

<pre>
systemctl status php8.5-fpm
</pre>

== Setting up the NFS data directory ==

=== Creating the mount point ===

Create the local mount point:

<pre>
mkdir -p /srv/nextcloud-data
</pre>

=== Configuring the NFS mount ===

Add the following line to <code>/etc/fstab</code>:

<pre>
nfs.example.com:/nextcloud /srv/nextcloud-data nfs4 rw,hard,_netdev,x-systemd.automount 0 0
</pre>

Adjust the NFS server and export path to match your environment.

Reload the systemd configuration:

<pre>
systemctl daemon-reload
</pre>

Access the mount point to trigger the automatic mount:

<pre>
ls -la /srv/nextcloud-data
</pre>

Alternatively, the mount can be triggered manually:

<pre>
mount /srv/nextcloud-data
</pre>

Verify that the NFS file system has been mounted:

<pre>
findmnt /srv/nextcloud-data
</pre>

Example:

<pre>
TARGET SOURCE FSTYPE OPTIONS
/srv/nextcloud-data nfs.example.com:/nextcloud nfs4 rw,relatime,...
</pre>

Only continue with the installation if <code>/srv/nextcloud-data</code> is actually mounted as an NFS file system.

=== Setting permissions ===

Apache and PHP-FPM run as the <code>www-data</code> user by default on Ubuntu.

Check its UID and GID:

<pre>
id www-data
</pre>

By default, Ubuntu uses UID and GID <code>33</code> for <code>www-data</code>.

The NFS directory must allow the <code>www-data</code> user to write to it. If NFS <code>root_squash</code> is enabled, ownership usually cannot be changed from the Nextcloud server. In this case, set the permissions directly on the NFS server.

Example on the NFS server:

<pre>
chown -R 33:33 /path/to/export/nextcloud
chmod 0750 /path/to/export/nextcloud
</pre>

Then perform a write test on the Nextcloud server as the <code>www-data</code> user:

<pre>
sudo -u www-data touch /srv/nextcloud-data/.write-test
sudo -u www-data rm /srv/nextcloud-data/.write-test
</pre>

If this test fails, correct the NFS export settings, UID/GID mapping or file system permissions before continuing.

'''Note:''' The data directory should be used exclusively by Nextcloud. Files should not be modified directly on the NFS share in parallel.

=== Making Apache and PHP-FPM depend on the NFS mount ===

To prevent the relevant services from starting without the data directory being available, systemd dependencies can be configured.

First create a dependency for Apache:

<pre>
systemctl edit apache2
</pre>

Add the following configuration:

<pre>
[Unit]
RequiresMountsFor=/srv/nextcloud-data
Wants=network-online.target
After=network-online.target
</pre>

Then create the corresponding dependency for PHP-FPM:

<pre>
systemctl edit php8.5-fpm
</pre>

Add the following configuration there as well:

<pre>
[Unit]
RequiresMountsFor=/srv/nextcloud-data
Wants=network-online.target
After=network-online.target
</pre>

Reload the systemd configuration:

<pre>
systemctl daemon-reload
</pre>

Check the configured dependencies:

<pre>
systemctl cat apache2
systemctl cat php8.5-fpm
</pre>

== Configuring MariaDB ==

=== Setting the transaction isolation level ===

Nextcloud requires the <code>READ-COMMITTED</code> transaction isolation level for MySQL or MariaDB.

Create the following configuration file:

<pre>
nano /etc/mysql/mariadb.conf.d/99-nextcloud.cnf
</pre>

Add the following content:

<pre>
[mysqld]
transaction-isolation = READ-COMMITTED
</pre>

If MariaDB binary logging is enabled, the <code>ROW</code> format must also be used:

<pre>
[mysqld]
transaction-isolation = READ-COMMITTED
binlog_format = ROW
</pre>

Restart MariaDB:

<pre>
systemctl restart mariadb
</pre>

Verify the configured transaction isolation level:

<pre>
mariadb -e "SHOW VARIABLES LIKE 'transaction_isolation';"
</pre>

The output should contain the following value:

<pre>
READ-COMMITTED
</pre>

=== Creating the database and user ===

Open the MariaDB console:

<pre>
mariadb
</pre>

Create the database and a database user that can only connect locally:

<pre>
CREATE DATABASE nextcloud
CHARACTER SET utf8mb4
COLLATE utf8mb4_general_ci;

CREATE USER 'nextcloud'@'localhost'
IDENTIFIED BY 'SECURE-DATABASE-PASSWORD';

GRANT ALL PRIVILEGES
ON nextcloud.*
TO 'nextcloud'@'localhost';

FLUSH PRIVILEGES;
EXIT;
</pre>

Replace <code>SECURE-DATABASE-PASSWORD</code> with a long, random password used exclusively for this database.

Because MariaDB and Nextcloud are installed on the same server, the user is deliberately restricted to <code>localhost</code>.

Test the login:

<pre>
mariadb -u nextcloud -p -h localhost nextcloud
</pre>

Exit the MariaDB console afterwards:

<pre>
EXIT;
</pre>

== Installing Nextcloud ==

At the time this article was created, Nextcloud <code>34.0.1</code> was the current stable version.

Before performing a later installation, check whether a newer version is available within the supported Nextcloud release branch.

Download the Nextcloud archive and the corresponding SHA-256 checksum:

<pre>
cd /tmp

NEXTCLOUD_VERSION="34.0.1"

wget https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2
wget https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.sha256
</pre>

Verify the integrity of the archive:

<pre>
sha256sum -c nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.sha256
</pre>

The output must contain <code>OK</code>:

<pre>
nextcloud-34.0.1.tar.bz2: OK
</pre>

Extract Nextcloud:

<pre>
tar -xjf nextcloud-${NEXTCLOUD_VERSION}.tar.bz2
mv nextcloud /var/www/nextcloud
</pre>

Set the owner:

<pre>
chown -R www-data:www-data /var/www/nextcloud
</pre>

Check the permissions:

<pre>
ls -ld /var/www/nextcloud
</pre>

After a successful installation, the downloaded archive files can optionally be removed:

<pre>
rm -f /tmp/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2
rm -f /tmp/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.sha256
</pre>

== Configuring Apache with PHP-FPM ==

This guide uses a dedicated subdomain for Nextcloud:

<pre>
cloud.example.com
</pre>

Enable the required Apache modules:

<pre>
a2enmod \
proxy_fcgi \
setenvif \
rewrite \
headers \
env \
dir \
mime \
ssl \
http2
</pre>

Enable the PHP 8.5 FPM configuration:

<pre>
a2enconf php8.5-fpm
</pre>

Create the Apache configuration:

<pre>
nano /etc/apache2/sites-available/nextcloud.conf
</pre>

Add the following configuration:

<pre>
<VirtualHost *:80>
ServerName cloud.example.com
DocumentRoot /var/www/nextcloud

<Directory /var/www/nextcloud/>
Require all granted
AllowOverride All
Options FollowSymLinks

<IfModule mod_dav.c>
Dav off
</IfModule>

SetEnv HOME /var/www/nextcloud
SetEnv HTTP_HOME /var/www/nextcloud
</Directory>

ErrorLog ${APACHE_LOG_DIR}/nextcloud-error.log
CustomLog ${APACHE_LOG_DIR}/nextcloud-access.log combined
</VirtualHost>
</pre>

Replace <code>cloud.example.com</code> with the actual DNS name of the Nextcloud installation.

Enable the Nextcloud site:

<pre>
a2ensite nextcloud.conf
</pre>

If the default Apache site is no longer required, it can be disabled:

<pre>
a2dissite 000-default.conf
</pre>

Check the Apache configuration:

<pre>
apache2ctl configtest
</pre>

If the configuration is valid, the following output is displayed:

<pre>
Syntax OK
</pre>

Restart Apache and PHP-FPM:

<pre>
systemctl restart php8.5-fpm
systemctl restart apache2
</pre>

Check both services:

<pre>
systemctl status php8.5-fpm
systemctl status apache2
</pre>

== Configuring the firewall ==

This step is only required if UFW is used on the server.

Before making changes, ensure that SSH remains allowed:

<pre>
ufw allow OpenSSH
</pre>

Allow HTTP and HTTPS:

<pre>
ufw allow 'Apache Full'
</pre>

Check the rules:

<pre>
ufw status
</pre>

Example:

<pre>
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Apache Full ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
</pre>

== Setting up HTTPS ==

Nextcloud should only be accessible over HTTPS on production systems.

The following requirements apply for a publicly trusted certificate:

* The domain points to the Nextcloud server.
* TCP port 80 is reachable for certificate validation.
* TCP port 443 is reachable for subsequent HTTPS access.

Install Certbot and the Apache plugin:

<pre>
apt install -y certbot python3-certbot-apache
</pre>

Request the certificate:

<pre>
certbot --apache --redirect -d cloud.example.com
</pre>

Certbot configures the certificate and redirects HTTP requests to HTTPS.

Test automatic certificate renewal:

<pre>
certbot renew --dry-run
</pre>

Check the Certbot timer:

<pre>
systemctl status certbot.timer
</pre>

If a reverse proxy or load balancer is already placed in front of Nextcloud, TLS termination can alternatively take place there. In that case, the Nextcloud settings for trusted proxies and forwarded headers must also be configured correctly.

Self-signed certificates should only be used in isolated internal environments where the certificate can be added as trusted on all clients.

== Completing the installation in the browser ==

Open the Nextcloud domain in a browser:

<pre>
https://cloud.example.com/
</pre>

Enter the following information in the installation dialog.

=== Administrator account ===

Create an administrator account with a secure password used exclusively for Nextcloud.

=== Data directory ===

Use the following path as the data directory:

<pre>
/srv/nextcloud-data
</pre>

=== Database ===

Select MariaDB or MySQL and use the following values:

* Database user: <code>nextcloud</code>
* Database password: the password defined previously
* Database name: <code>nextcloud</code>
* Database host: <code>localhost</code>

Then start the installation.

<gallery>
File:003-Admin-Erstellen.png|Create an administrator account with a secure password.
File:004-Speicherort-Festlegen.png|Use the previously mounted NFS share as the data directory.
File:Datenbank-hinzufügen.png|Enter the credentials for the local MariaDB database.
File:006-Finish.png|After a successful installation, the Nextcloud dashboard is displayed.
</gallery>

== Configuring background jobs ==

Nextcloud requires background jobs to be executed regularly. Cron should be used for server installations.

Create the following cron file:

<pre>
nano /etc/cron.d/nextcloud
</pre>

Add the following content:

<pre>
*/5 * * * * www-data /usr/bin/php8.5 -f /var/www/nextcloud/cron.php
</pre>

Set the correct file permissions:

<pre>
chmod 0644 /etc/cron.d/nextcloud
</pre>

Enable cron mode in Nextcloud:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ background:cron
</pre>

Restart the cron service:

<pre>
systemctl restart cron
</pre>

Check the entry:

<pre>
cat /etc/cron.d/nextcloud
</pre>

Test the cron job manually once:

<pre>
sudo -u www-data php8.5 -f /var/www/nextcloud/cron.php
</pre>

The status of the background jobs can later be checked in Nextcloud under “Administration settings” → “Basic settings”.

== Configuring APCu and Redis ==

APCu is used for the local application cache. Redis handles transactional file locking and can also be used as a distributed cache.

Open the Nextcloud configuration:

<pre>
nano /var/www/nextcloud/config/config.php
</pre>

Add the following entries inside the <code>$CONFIG</code> array:

<pre>
'memcache.local' => '\OC\Memcache\APCu',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',

'redis' => [
'host' => '127.0.0.1',
'port' => 6379,
'timeout' => 0.0,
],
</pre>

Ensure that all entries are placed inside the existing <code>$CONFIG</code> array and that preceding entries are separated correctly with commas.

Restart PHP-FPM and Apache:

<pre>
systemctl restart php8.5-fpm
systemctl restart apache2
</pre>

Check the Redis service:

<pre>
systemctl status redis-server
</pre>

Test the connection:

<pre>
redis-cli ping
</pre>

The expected response is:

<pre>
PONG
</pre>

== Enabling pretty URLs ==

Pretty URLs remove the <code>index.php</code> component from Nextcloud URLs.

First set the complete Nextcloud URL:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set overwrite.cli.url \
--value="https://cloud.example.com"
</pre>

Then set the rewrite base:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set htaccess.RewriteBase \
--value="/"
</pre>

Update the Nextcloud <code>.htaccess</code> file:

<pre>
sudo -u www-data php8.5 \
/var/www/nextcloud/occ maintenance:update:htaccess
</pre>

Reload Apache:

<pre>
systemctl reload apache2
</pre>

Nextcloud URLs should now be displayed without <code>index.php</code>.

== Verifying the installation ==

First check the Nextcloud status:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ status
</pre>

A successful installation returns information similar to the following:

<pre>
installed: true
maintenance: false
needsDbUpgrade: false
version: 34.0.1.0
versionstring: 34.0.1
</pre>

Also check the relevant services:

<pre>
systemctl status apache2
systemctl status php8.5-fpm
systemctl status mariadb
systemctl status redis-server
systemctl status cron
</pre>

Check the NFS mount again:

<pre>
findmnt /srv/nextcloud-data
</pre>

Verify that Nextcloud can still write to the data directory:

<pre>
sudo -u www-data touch /srv/nextcloud-data/.write-test
sudo -u www-data rm /srv/nextcloud-data/.write-test
</pre>

Check the Nextcloud configuration:

<pre>
sudo -u www-data php8.5 \
/var/www/nextcloud/occ config:list system
</pre>

Finally, open “Administration settings” → “Overview” in Nextcloud. Missing PHP modules, cache issues, failed background jobs and other configuration problems are displayed there.

== Optional configurations ==

=== Setting the default phone region ===

If phone numbers without an international country code are used in Nextcloud, a default region can be configured.

For Germany, use:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set default_phone_region \
--value="DE"
</pre>

=== Configuring the maintenance window ===

Nextcloud can run resource-intensive daily background jobs preferentially during a maintenance window.

The following example sets the start of the maintenance window to 01:00 UTC:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set maintenance_window_start \
--type=integer \
--value=1
</pre>

=== Running available repairs ===

After updates or configuration changes, the Nextcloud repair routines can be executed:

<pre>
sudo -u www-data php8.5 \
/var/www/nextcloud/occ maintenance:repair
</pre>

== Operational notes ==

At least the following points should be considered for ongoing operation:

* Install security updates regularly
* Update Nextcloud and installed apps regularly
* Back up the MariaDB database
* Back up the NFS data directory
* Back up <code>/var/www/nextcloud/config</code>
* Monitor NFS availability
* Monitor local disk space
* Monitor Apache, PHP-FPM, MariaDB and Redis
* Check the Nextcloud administration overview regularly
* Check background jobs regularly
* Test restoring from existing backups

Relevant log files include:

<pre>
/var/log/apache2/nextcloud-error.log
/var/log/apache2/nextcloud-access.log
/var/log/php8.5-fpm.log
/srv/nextcloud-data/nextcloud.log
</pre>

The systemd logs can also be displayed with the following commands:

<pre>
journalctl -u apache2
journalctl -u php8.5-fpm
journalctl -u mariadb
journalctl -u redis-server
</pre>

=== Displaying the Nextcloud version ===

The currently installed Nextcloud version can be checked at any time:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ status
</pre>

=== Displaying the PHP version ===

The command-line PHP version can be checked as follows:

<pre>
php8.5 --version
</pre>

The PHP-FPM version used by Apache can be checked through the service:

<pre>
systemctl status php8.5-fpm
</pre>

{{Smueller}}
[[Category:Server Software]]
[[Category:Ubuntu]]
[[de:Nextcloud Installation mit NFS-Mount (HowTo)]]

Linux network analysis with traceroute

2026-07-08T11:45:40Z

Aranzinger:

The Linux tool '''traceroute''' provides a lot of possibilities to trace the path of network packets through a network or the Internet to a specific host. This article provides an overview of the function of [http://de.wikipedia.org/wiki/Traceroute traceroute]. Furthermore, we present interesting option parameters for traceroute. In addition to traceroute, [[Linux Netzwerk Analyse mit mtr|mtr]] is also interesting. It combines the functionality of traceroute and ping.

== Function ==

Traceroute traces the path of network packets to a specific host. To do this, traceroute modifies the time-to-live (TTL) field of the IP protocol. By using small TTL values, traceroute attempts to elicit ICMP TIME_EXCEEDED responses from the individual routers. The only required parameter for traceroute is the host to which the path is to be traced.

To identify the individual hops (routers) along the path from the current computer to the desired host, traceroute proceeds as follows:
# First, it sends an IP packet with TTL=1. As a result, the first router (the default gateway) discards the packet and sends back an ICMP TIME_EXCEEDED response.
# Now traceroute sends additional packets, incrementing the TTL by 1 each time. With the second packet (TTL=2), the packet first passes through the default gateway to the next router on the path to the host. Since the default gateway decrements the TTL by 1 when forwarding the packet, the packet arrives at the second router with a TTL of 1. This router discards the packet and sends an ICMP TIME_EXCEEDED response back to the original computer. The process works similarly with TTL=3 at the third router, TTL=4 at the fourth router, and so on.
# If an IP packet with a sufficiently high TTL eventually reaches the destination host, the host responds with an ICMP "port unreachable" message.

== Methods of testing packets ==

For the IP test packets sent, different protocols can be used. These options allow you to send test packets even with restrictive firewall configurations. In addition, this method lets you track the exact path used by a specific protocol (in case packets are routed differently depending on the protocol at some point along the path).

=== UDP (default) ===

In the default configuration, UDP datagrams are used as IP test packets. An 'unlikely' port is used for this purpose. The starting port is set to 33434 and is incremented by 1 for each subsequent test packet.

This method can be used by any user and does not require root rights.

Example (the first three hops were anonymized):
<pre>
[root@tpw ~]# traceroute www.google.com
traceroute to www.google.com (209.85.129.147), 30 hops max, 60 byte packets
1 XXX (XXX) 1.929 ms 1.982 ms 2.141 ms
2 XXX (XXX) 3.795 ms 3.769 ms 3.751 ms
3 XXX (XXX) 5.673 ms 5.650 ms 5.634 ms
4 iix12-aux11.highway.telekom.at (195.3.70.206) 21.027 ms 195.3.118.50 (195.3.118.50) 21.025 ms 21.328 ms
5 72.14.198.241 (72.14.198.241) 21.436 ms 21.406 ms 21.401 ms
6 209.85.255.176 (209.85.255.176) 21.497 ms 209.85.255.178 (209.85.255.178) 23.380 ms 23.300 ms
7 72.14.232.165 (72.14.232.165) 23.301 ms 21.613 ms 72.14.232.201 (72.14.232.201) 21.661 ms
8 72.14.239.170 (72.14.239.170) 21.678 ms 72.14.233.210 (72.14.233.210) 34.381 ms 34.365 ms
9 fk-in-f147.1e100.net (209.85.129.147) 19.659 ms 19.280 ms 19.291 ms
[root@tpw ~]#

</pre>

=== ICMP (-I) ===

This method uses ICMP echo requests ('Ping') for testing.

This method requires superuser-rights.

Example (the first three hops were anonymized):
<pre>
[root@tpw ~]# traceroute -I www.google.com
traceroute to www.google.com (209.85.129.147), 30 hops max, 60 byte packets
1 XXX (XXX) 1.948 ms 2.022 ms 2.202 ms
2 XXX (XXX) 3.915 ms 3.918 ms 3.929 ms
3 XXX (XXX) 5.870 ms 5.876 ms 5.889 ms
4 iix12-aux11.highway.telekom.at (195.3.70.206) 17.967 ms 19.781 ms 19.784 ms
5 72.14.198.241 (72.14.198.241) 19.869 ms 19.867 ms 19.915 ms
6 209.85.255.178 (209.85.255.178) 20.044 ms 19.502 ms 19.470 ms
7 72.14.232.201 (72.14.232.201) 19.529 ms 19.523 ms 72.14.232.203 (72.14.232.203) 19.532 ms
8 72.14.233.210 (72.14.233.210) 27.065 ms 34.198 ms 34.165 ms
9 fk-in-f147.1e100.net (209.85.129.147) 18.249 ms 19.352 ms 17.936 ms
[root@tpw ~]#
</pre>

=== TCP (-T) ===

This method uses a fix TCP port (port 80 is default). With the option -p, another destination port can be also selected (for example -p 25 to check the path to a mail server). This also allows you to get past firewalls that do not let through UDP datagrams or ICMP messages, for example.

This method uses the "half-open technique". This means that the target applications (for example a web server if the test packets are sent to port 80) do not see the test packets. Normally, a TCP SYN packet is simply sent. If no application is listening on that port on the target host, a TCP RESET is simply returned. However, if an application is listening on that port on the destination host, the destination host sends back a TCP SYN+ACK. Traceroute then responds with a TCP RESET (instead of accepting the connection with a TCP ACK). In this way, the TCP session is discarded without the application on the destination host noticing anything.

This method requires superuser-rights.

Example (the first three hops were anonymized):
<pre>
[root@tpw ~]# traceroute -T -p 80 www.google.com
traceroute to www.google.com (209.85.129.147), 30 hops max, 60 byte packets
1 XXX (XXX) 3.187 ms 3.165 ms 3.142 ms
2 XXX (XXX) 4.502 ms 4.486 ms 4.478 ms
3 XXX (XXX) 6.409 ms 6.394 ms 6.365 ms
4 195.3.118.50 (195.3.118.50) 22.834 ms 22.828 ms iix12-aux11.highway.telekom.at (195.3.70.206) 22.822 ms
5 72.14.198.241 (72.14.198.241) 22.848 ms 22.827 ms 22.803 ms
6 209.85.255.178 (209.85.255.178) 22.822 ms 209.85.255.176 (209.85.255.176) 20.884 ms 209.85.255.178 (209.85.255.178) 20.880 ms
7 72.14.232.165 (72.14.232.165) 20.916 ms 19.753 ms 72.14.232.203 (72.14.232.203) 19.744 ms
8 72.14.233.210 (72.14.233.210) 33.508 ms 72.14.233.206 (72.14.233.206) 21.713 ms 21.655 ms
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 fk-in-f147.1e100.net (209.85.129.147) 19.678 ms 19.715 ms 19.728 ms
[root@tpw ~]#
</pre>

=== UDP (-U) ===

This method uses a fix UDP port (port 53 is default). It is also used to bypass firewalls.

Unlike the TCP method, an application on the destination host receives these UDP datagrams if it is listening on the corresponding port. This can confuse the application in question. In most cases, the application will not send a response (so traceroute does not see a final hop in the trace).

This method can be used by any user and does not require root rights).

== More information ==
* Manpage of traceroute

{{Wfischer}}
{{Aranzinger}}
[[Category:Linux Networking]][[Category:Linux Performance]]
[[pl:Analiza sieci w Linuksie z traceroute]]
[[de:Linux Netzwerk Analyse mit traceroute]]

How to set up VLAN in OPNsense

2026-07-08T08:03:12Z

Aranzinger: Created page with "'''Virtual Local Area Networks''' - VLANs - are an important tool for the network infrastructure, particularly in environments with firewall solutions such as OPNsense. They allow to divide a physical network into multiple logical networks, which improves security and organization. This article describes how to set up VLANs in OPNsense 25.1. == Assign VLAN == First, a '''VLAN-ID between 1 and 4094''' is assigned to an interface. The ID 4095 is reser..."

'''Virtual Local Area Networks''' - [[VLAN Basics|VLANs]] - are an important tool for the network infrastructure, particularly in environments with firewall solutions such as [[OPNsense]]. They allow to divide a physical network into multiple logical networks, which improves security and organization. This article describes how to set up VLANs in OPNsense 25.1.

== Assign VLAN ==
First, a '''VLAN-ID between 1 and 4094''' is assigned to an interface. The ID 4095 is reserved, as in all VLAN networks.<ref name=IEEE802.1Q>[http://www.microhowto.info/tutorials/802.1q.html#idp28880 IEEE 802.1Q VLAN] <cite>"Each 802.1Q VLAN is identified by a 12-bit integer called a VID (VLAN Identifier) in the range 1 to 4094 inclusive. The values 0 and 4095 are reserved and should not be used."</cite></ref>.

<gallery>
File:OPNsense-25.1-vlan-configuration-001.png|Go to '''Interfaces ‣ Devices ‣ VLAN'''.
File:OPNsense-25.1-vlan-configuration-002.png|Here, click on the '''+'''.
File:OPNsense-25.1-vlan-configuration-003.png|Assign the desired '''Interface''' as well as the '''VLAN-ID''', in this example '''10'''.
File:OPNsense-25.1-vlan-configuration-004.png|Click on '''Apply'''.
</gallery>

It is also possible to use an interface as [[VLAN#Tagged VLANs|Trunk]] by simply assigning a second VLAN with a different ID to the same interface.

== Create interface ==
The following screenshots demonstrate the process of adding a network interface:

<gallery>
File:OPNsense-25.1-vlan-configuration-005.png|In the webinterface, navigate to '''Interfaces''' ‣ '''Assignments''' and select the new VLAN in the section '''Assign a new interface.'''
File:OPNsense-25.1-vlan-configuration-006.png|State a description and click on '''Add'''.
File:OPNsense-25.1-vlan-configuration-007.png|The new VLAN was added as new interface '''Lab''' in this example. Click on '''Save'''.
</gallery>

In Thomas-Krenn-Wiki, you will find information on how to [[OPNsense add interface|add an OPNsense interface]].

== Assign IP address ==
Here, an IP address is assigned to the added interface. There are several options available, such as automatic address assignment using DHCP or manual configuration of a static IP address (Static IPv4). In this example, a static address assignment with the IP-address '''192.168.10.1/24''' is used.

<gallery>
File:OPNsense-25.1-vlan-configuration-008.png|Click on the menu item '''Assignments''' ‣ '''Interfaces''' on the previously created VLAN interface.
File:OPNsense-25.1-vlan-configuration-009.png|Activate it with the help of the option '''Enable Interface'''.
File:OPNsense-25.1-vlan-configuration-010.png|Go to the menu item '''IPv4 Configuration Type''' after activation of the interface and select one of the '''options''' described earlier.
File:OPNsense-25.1-vlan-configuration-011.png|If you selected the '''Static IPv4''' option, scroll down to the '''Static IPv4 configuration''' section. State the static IPv4 address as well as the subnet. After that, click on '''Save'''.
File:OPNsense-25.1-vlan-configuration-012.png|Store the configuration with '''Apply changes.'''
</gallery>

== Firewall rules ==
'''Note:''' By default, all incoming connections on this interface are blocked. To change this, you must create rules to control and secure data traffic for the VLAN you created.

<gallery>
File:OPNsense-25.1-vlan-configuration-013.png|Go to the '''Firewall''' menu and click on '''Rules''' to create rules here.
</gallery>

== References ==
<references />

{{ederr}}
{{Aranzinger}}
[[Category:OPNsense]]
[[de:VLAN einrichten unter OPNsense]]

Network configuration Ubuntu - Netplan

2026-07-08T06:07:19Z

Aranzinger: Aranzinger moved page Network configuration - Netplan to Network configuration Ubuntu - Netplan

In the current version of [[Ubuntu]] Server, Ubuntu 18.04 (Bionic Beaver), the network configuration can no longer be set in the file <code>/etc/network/interfaces</code> in a default installation. Since Ubuntu 17.10, there is [http://manpages.ubuntu.com/manpages/bionic/man5/netplan.5.html Netplan], which is a new option to configure network interfaces. The network configuration is stored in .yaml-files. In addition to changes to the configuration of the network interfaces, there are also new configurations regarding the hostname.

== Network configuration (static) ==

<pre>
sudo rm /etc/netplan/50-cloud-init.yaml
sudo touch /etc/netplan/01-ens160.yaml
</pre>
The content of the file in a static network configuration should look as follows:
<pre>
network:
version: 2
renderer: networkd
ethernets:
ens160:
dhcp4: no
dhcp6: no
addresses: [10.2.2.123/24]
gateway4: 10.2.2.1
nameservers:
addresses: [192.168.110.50]
</pre>

Next, the network configuration can be activated:

<pre> sudo netplan apply</pre>

'''Note:''' Please use spaces for indentation in this file and do not use tabs.

== Change hostname ==
In Ubuntu 18.04, it is no longer enough to set the hostname via <code>/etc/hostname</code> or <code>hostnamectl</code>. After a reboot of the server, the hostname would be lost again, as it has not been stored. In the following, it is explained how to permanently set the host name:

<code>nano /etc/cloud/cloud.cfg</code>

<pre>
# This will cause the set+update hostname module to not operate (if true)
preserve_hostname: false
</pre>

Here, the value preserve_hostname must be set from false to true.

<pre>
# This will cause the set+update hostname module to not operate (if true)
preserve_hostname: true
</pre>

After that, the hostname can be set permanently using the following commands:

<pre>
sudo nano /etc/hostname
sudo hostnamectl set-hostname web-01
</pre>

== Network configuration (other) ==
For other network configurations, such as DHCP, Bonds, WLAN etc., you will find corresponding notes on the [https://netplan.io/examples netplan.io] website.

{{Jsterr}}
{{Aranzinger}}
[[Category:Ubuntu]]
[[de:Netzwerk-Konfiguration Ubuntu - Netplan]]

NVMe-CLI

2026-07-07T11:07:10Z

Aranzinger: Created page with "The '''NVMe Command Line Interface''' ('''NVMe-CLI''') provides multiple '''functions on querying and configuring NVMe SSDs''' on Linux and FreeBSD. In this article, we explain how to install NVMe-CLI and which funtions NVMe-CLI offers. == Version information == In the Linux distributions, the following versions of NVMe-CLI are included: {| class="wikitable" |+ ! colspan="2" |Linux distribution !NVMe-CLI version |- | rowspan="3" |Debian GNU/Linux |1..."

The '''NVMe Command Line Interface''' ('''NVMe-CLI''') provides multiple '''functions on querying and configuring [[NVMe]] [[SSD]]s''' on [[Linux]] and [[FreeBSD]]. In this article, we explain how to install NVMe-CLI and which funtions NVMe-CLI offers.

== Version information ==
In the Linux distributions, the following versions of NVMe-CLI are included:
{| class="wikitable"
|+
! colspan="2" |Linux distribution
!NVMe-CLI version
|-
| rowspan="3" |[[Debian GNU/Linux]]
|12.0 (Bookworm)
|nvme-cli [https://packages.debian.org/bookworm/nvme-cli 2.3]
|-
|11.0 (Bullseye)
|nvme-cli [https://packages.debian.org/bullseye/nvme-cli 1.12]
|-
|10.0 (Buster)
|nvme-cli [https://packages.debian.org/buster/nvme-cli 1.7]
|-
| rowspan="2" |[[Ubuntu]]
|22.04 LTS
|nvme-cli [https://packages.ubuntu.com/jammy/nvme-cli 1.16]
|-
|20.04 LTS
|nvme-cli [https://packages.ubuntu.com/focal/nvme-cli 1.9]
|-
|[[Proxmox VE]]
|7.x
|nvme-cli 1.12
|}
Changelog (in part):
{| class="wikitable"
|+
!NVMe-CLI version
!Release date
!Changes
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.1-rc0 v2.1-rc0]
|14.07.2022
|new solidigm plugin
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0 v2.0]
|08.04.2022
|first release of nvme-cli 2
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc7 v2.0-rc7]
|18.03.2022
|add transcend, virtium plugin commands
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc6 v2.0-rc6]
|11.03.2022
|cmds-main: Add intel plugin commands
cmds-plugins: Add huawei plugin commands
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc4 v2.0-rc4]
|22.02.2022
|Micron and NetApp plugin got a few fixes
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc3 v2.0-rc3]
|11.02.2022
|update wdc plugin version to 1.16.3
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc0 v2.0-rc0]
|14.01.2022
|code base of nvme-cli has been splitted into a nvme-cli and libnvme
a lot's of cleanups and refactoring
|}

== NVMe-CLI installation ==
NVMe-CLI is installed via apt on [[Debian]] and [[Ubuntu]]:
apt install nvme-cli

On [[FreeBSD]], the installation works as follows:
pkg install nvme-cli

== NVMe-CLI function overview ==

=== nvme help ===
<pre>
test@ubuntu-22-04:~$ nvme help
nvme-1.16
usage: nvme <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

The following are all implemented sub-commands:
list List all NVMe devices and namespaces on machine
list-subsys List nvme subsystems
id-ctrl Send NVMe Identify Controller
id-ns Send NVMe Identify Namespace, display structure
id-ns-granularity Send NVMe Identify Namespace Granularity List, display structure
list-ns Send NVMe Identify List, display structure
list-ctrl Send NVMe Identify Controller List, display structure
nvm-id-ctrl Send NVMe Identify Controller NVM Command Set, display structure
primary-ctrl-caps Send NVMe Identify Primary Controller Capabilities
list-secondary List Secondary Controllers associated with a Primary Controller
cmdset-ind-id-ns I/O Command Set Independent Identify Namespace
ns-descs Send NVMe Namespace Descriptor List, display structure
id-nvmset Send NVMe Identify NVM Set List, display structure
id-uuid Send NVMe Identify UUID List, display structure
id-iocs Send NVMe Identify I/O Command Set, display structure
id-domain Send NVMe Identify Domain List, display structure
list-endgrp Send NVMe Identify Endurance Group List, display structure
create-ns Creates a namespace with the provided parameters
delete-ns Deletes a namespace from the controller
attach-ns Attaches a namespace to requested controller(s)
detach-ns Detaches a namespace from requested controller(s)
get-ns-id Retrieve the namespace ID of opened block device
get-log Generic NVMe get log, returns log in raw format
telemetry-log Retrieve FW Telemetry log write to file
fw-log Retrieve FW Log, show it
changed-ns-list-log Retrieve Changed Namespace List, show it
smart-log Retrieve SMART Log, show it
ana-log Retrieve ANA Log, show it
error-log Retrieve Error Log, show it
effects-log Retrieve Command Effects Log, show it
endurance-log Retrieve Endurance Group Log, show it
predictable-lat-log Retrieve Predictable Latency per Nvmset Log, show it
pred-lat-event-agg-log Retrieve Predictable Latency Event Aggregate Log, show it
persistent-event-log Retrieve Presistent Event Log, show it
endurance-event-agg-log Retrieve Endurance Group Event Aggregate Log, show it
lba-status-log Retrieve LBA Status Information Log, show it
resv-notif-log Retrieve Reservation Notification Log, show it
boot-part-log Retrieve Boot Partition Log, show it
get-feature Get feature and show the resulting value
device-self-test Perform the necessary tests to observe the performance
self-test-log Retrieve the SELF-TEST Log, show it
supported-log-pages Retrieve the Supported Log pages details, show it
set-feature Set a feature and show the resulting value
set-property Set a property and show the resulting value
get-property Get a property and show the resulting value
format Format namespace with new block format
fw-commit Verify and commit firmware to a specific slot (fw-activate in old version < 1.2)
fw-download Download new firmware
admin-passthru Submit an arbitrary admin command, return results
io-passthru Submit an arbitrary IO command, return results
security-send Submit a Security Send command, return results
security-recv Submit a Security Receive command, return results
get-lba-status Submit a Get LBA Status command, return results
capacity-mgmt Submit Capacity Management Command, return results
resv-acquire Submit a Reservation Acquire, return results
resv-register Submit a Reservation Register, return results
resv-release Submit a Reservation Release, return results
resv-report Submit a Reservation Report, return results
dsm Submit a Data Set Management command, return results
copy Submit a Simple Copy command, return results
flush Submit a Flush command, return results
compare Submit a Compare command, return results
read Submit a read command, return results
write Submit a write command, return results
write-zeroes Submit a write zeroes command, return results
write-uncor Submit a write uncorrectable command, return results
verify Submit a verify command, return results
sanitize Submit a sanitize command
sanitize-log Retrieve sanitize log, show it
reset Resets the controller
subsystem-reset Resets the subsystem
ns-rescan Rescans the NVME namespaces
show-regs Shows the controller registers or properties. Requires character device
discover Discover NVMeoF subsystems
connect-all Discover and Connect to NVMeoF subsystems
connect Connect to NVMeoF subsystem
disconnect Disconnect from NVMeoF subsystem
disconnect-all Disconnect from all connected NVMeoF subsystems
gen-hostnqn Generate NVMeoF host NQN
show-hostnqn Show NVMeoF host NQN
dir-receive Submit a Directive Receive command, return results
dir-send Submit a Directive Send command, return results
virt-mgmt Manage Flexible Resources between Primary and Secondary Controller
rpmb Replay Protection Memory Block commands
fid-support-effects-log Submit Feature ID Support and Effects Log, Return result
lockdown Submit a Lockdown command,return result
version Shows the program version
help Display this help

See 'nvme help <command>' for more information on a specific command

The following are all installed plugin extensions:
ymtc Ymtc vendor specific extensions
nvidia NVIDIA vendor specific extensions
zns Zoned Namespace Command Set
transcend Transcend vendor specific extensions
sfx ScaleFlux vendor specific extensions
dera Dera vendor specific extensions
shannon Shannon vendor specific extensions
virtium Virtium vendor specific extensions
seagate Seagate vendor specific extensions
micron Micron vendor specific extensions
toshiba Toshiba NVME plugin
netapp NetApp vendor specific extensions
huawei Huawei vendor specific extensions
wdc Western Digital vendor specific extensions
memblaze Memblaze vendor specific extensions
lnvm LightNVM specific extensions
amzn Amazon vendor specific extensions
intel Intel vendor specific extensions

See 'nvme <plugin> help' for more information on a plugin
</pre>

=== nvme micron help ===
<pre>
test@ubuntu-22-04:~$ nvme micron help
nvme-1.16
usage: nvme micron <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Micron vendor specific extensions

The following are all implemented sub-commands:
select-download Selective Firmware Download
vs-temperature-stats Retrieve Micron temperature statistics
vs-pcie-stats Retrieve Micron PCIe error stats
clear-pcie-correctable-errors Clear correctable PCIe errors
vs-internal-log Retrieve Micron logs
vs-telemetry-controller-option Enable/Disable controller telemetry log generation
vs-nand-stats Retrieve NAND Stats
vs-drive-info Retrieve Drive information
plugin-version Display plugin version info
cloud-SSD-plugin-version Display plugin version info
log-page-directory Retrieve log page directory
vs-fw-activate-history Display FW activation history
vs-error-reason-identifier Retrieve Error reason
vs-smart-add-log Retrieve extended SMART data
clear-fw-activate-history Clear FW activation history
vs-smbus-option Enable/Disable SMBUS on the drive
version Shows the program version
help Display this help

See 'nvme micron help <command>' for more information on a specific command
</pre>

=== nvme toshiba help ===
<pre>
test@ubuntu-22-04:~$ nvme toshiba help
nvme-1.16
usage: nvme toshiba <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Toshiba NVME plugin

The following are all implemented sub-commands:
vs-smart-add-log Extended SMART information
vs-internal-log Get Internal Log
clear-pcie-correctable-errors Clear PCIe correctable error count
version Shows the program version
help Display this help

See 'nvme toshiba help <command>' for more information on a specific command
</pre>

=== nvme wdc help ===
The following commands are provided for WDC SSDs (details on 'drive-resize' can be found in [[Drive-Resize von Western Digital NVME SSDs|Drive-Resize of Western Digital NVME SSDs]]):
<pre>
test@ubuntu-22-04:~$ nvme wdc help
nvme-1.16
usage: nvme wdc <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Western Digital vendor specific extensions

The following are all implemented sub-commands:
cap-diag WDC Capture-Diagnostics
drive-log WDC Drive Log
get-crash-dump WDC Crash Dump
get-pfail-dump WDC Pfail Dump
id-ctrl WDC identify controller
purge WDC Purge
purge-monitor WDC Purge Monitor
vs-internal-log WDC Internal Firmware Log
vs-nand-stats WDC NAND Statistics
vs-smart-add-log WDC Additional Smart Log
clear-pcie-correctable-errors WDC Clear PCIe Correctable Error Count
drive-essentials WDC Drive Essentials
get-drive-status WDC Get Drive Status
clear-assert-dump WDC Clear Assert Dump
drive-resize WDC Drive Resize
vs-fw-activate-history WDC Get FW Activate History
clear-fw-activate-history WDC Clear FW Activate History
enc-get-log WDC Get Enclosure Log
vs-telemetry-controller-option WDC Enable/Disable Controller Initiated Telemetry Log
vs-error-reason-identifier WDC Telemetry Reason Identifier
log-page-directory WDC Get Log Page Directory
namespace-resize WDC NamespaceDrive Resize
vs-drive-info WDC Get Drive Info
vs-temperature-stats WDC Get Temperature Stats
capabilities WDC Device Capabilities
cloud-SSD-plugin-version WDC Cloud SSD Plugin Version
vs-pcie-stats WDC VS PCIE Statistics
get-latency-monitor-log WDC Get Latency Monitor Log Page
version Shows the program version
help Display this help

See 'nvme wdc help <command>' for more information on a specific command
</pre>

=== nvme intel help ===
<pre>
test@ubuntu-22-04:~$ nvme intel help
nvme-1.16
usage: nvme intel <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Intel vendor specific extensions

The following are all implemented sub-commands:
id-ctrl Send NVMe Identify Controller
internal-log Retrieve Intel internal firmware log, save it
lat-stats Retrieve Intel IO Latency Statistics log, show it
set-bucket-thresholds Set Latency Stats Bucket Values, save it
lat-stats-tracking Enable and disable Latency Statistics logging.
market-name Retrieve Intel Marketing Name log, show it
smart-log-add Retrieve Intel SMART Log, show it
temp-stats Retrieve Intel Temperature Statistics log, show it
version Shows the program version
help Display this help

See 'nvme intel help <command>' for more information on a specific command
</pre>

== NVMe-CLI examples ==
The following examples were collected on an Ubuntu 22.04 system with an ATP M.2 NVMe SSD.

=== nvme list ===
<pre>
test@ubuntu-22-04:~$ sudo nvme list
Node SN Model Namespace Usage Format FW Rev
--------------------- -------------------- ---------------------------------------- --------- -------------------------- ---------------- --------
/dev/nvme0n1 20040089-000002 ATP NVMe M.2 2280 SSD 1 5,08 GB / 120,03 GB 512 B + 0 B 42A0S79A
</pre>

=== nvme list-subsys ===
<pre>
test@ubuntu-22-04:~$ sudo nvme list-subsys
nvme-subsys0 - NQN=nqn.2014.08.org.nvmexpress:1db21db220040089-000002 ATP NVMe M.2 2280 SSD
\
+- nvme0 pcie 0000:01:00.0 live
</pre>

In the following, you will find the output of a [[Proxmox VE]] 7.x system with four [[Western Digital SN640 TCG U.2 NVMe SSDs]]:
root@pmx01:~# nvme list-subsys
nvme-subsys0 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B7800000000000000000
\
+- nvme0 pcie 0000:84:00.0 live
nvme-subsys1 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B0000000000000000000
\
+- nvme1 pcie 0000:85:00.0 live
nvme-subsys2 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B7000000000000000000
\
+- nvme2 pcie 0000:86:00.0 live
nvme-subsys3 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B4000000000000000000
\
+- nvme3 pcie 0000:87:00.0 live
</pre>

=== nvme smart-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme smart-log /dev/nvme0n1
Smart Log for NVME device:nvme0n1 namespace-id:ffffffff
critical_warning : 0
temperature : 38 C (311 Kelvin)
available_spare : 100%
available_spare_threshold : 10%
percentage_used : 0%
endurance group critical warning summary: 0
data_units_read : 314.978
data_units_written : 197.916
host_read_commands : 1.739.034
host_write_commands : 2.384.025
controller_busy_time : 46
power_cycles : 106
power_on_hours : 68
unsafe_shutdowns : 59
media_errors : 0
num_err_log_entries : 0
Warning Temperature Time : 0
Critical Composite Temperature Time : 0
Temperature Sensor 1 : 27 C (300 Kelvin)
Temperature Sensor 2 : 38 C (311 Kelvin)
Thermal Management T1 Trans Count : 0
Thermal Management T2 Trans Count : 0
Thermal Management T1 Total Time : 0
Thermal Management T2 Total Time : 0
</pre>

=== nvme fw-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme fw-log /dev/nvme0n1
Firmware Log for device:nvme0n1
afi : 0x11
frs1 : 42A0S79A
frs2 : 42A0S79A
</pre>

=== nvme error-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme error-log /dev/nvme0n1
Error Log Entries for device:nvme0n1 entries:64
.................
Entry[ 0]
.................
error_count : 0
sqid : 0
cmdid : 0
status_field : 0(SUCCESS: The command completed successfully)
phase_tag : 0
parm_err_loc : 0
lba : 0
nsid : 0
vs : 0
trtype : The transport type is not indicated or the error is not transport related.
cs : 0
trtype_spec_info: 0
[...]
.................
Entry[63]
.................
error_count : 0
sqid : 0
cmdid : 0
status_field : 0(SUCCESS: The command completed successfully)
phase_tag : 0
parm_err_loc : 0
lba : 0
nsid : 0
vs : 0
trtype : The transport type is not indicated or the error is not transport related.
cs : 0
trtype_spec_info: 0
.................
</pre>

=== nvme effects-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme effects-log /dev/nvme0n1
Admin Command Set
ACS0 [Delete I/O Submission Queue ] 00000001
ACS1 [Create I/O Submission Queue ] 00000001
ACS2 [Get Log Page ] 00000001
ACS4 [Delete I/O Completion Queue ] 00000001
ACS5 [Create I/O Completion Queue ] 00000001
ACS6 [Identify ] 00000001
ACS8 [Abort ] 00000001
ACS9 [Set Features ] 00000001
ACS10 [Get Features ] 00000001
ACS12 [Asynchronous Event Request ] 00000001
ACS16 [Firmware Commit ] 00000011
ACS17 [Firmware Image Download ] 00000001
ACS20 [Device Self-test ] 00000001
ACS128 [Format NVM ] 00010003
ACS129 [Security Send ] 00000003
ACS130 [Security Receive ] 00000001
ACS132 [Sanitize ] 00010003
ACS192 [Unknown ] 00000017
ACS193 [Unknown ] 00000017
ACS194 [Unknown ] 00000001
ACS224 [Unknown ] 00000001
ACS228 [Unknown ] 00000001
ACS229 [Unknown ] 00000001
ACS230 [Unknown ] 00000001

NVM Command Set
IOCS0 [Flush ] 00000003
IOCS1 [Write ] 00000003
IOCS2 [Read ] 00000001
IOCS4 [Write Uncorrectable ] 00000003
IOCS5 [Compare ] 00000001
IOCS8 [Write Zeroes ] 00000003
IOCS9 [Dataset Management ] 00000003
</pre>

== More information ==
* [https://github.com/linux-nvme/nvme-cli nvme-cli] (github.com/linux-nvme)
* [https://nvmexpress.org/open-source-nvme-management-utility-nvme-command-line-interface-nvme-cli/ Open Source NVMe™ Management Utility – NVMe Command Line Interface (NVMe-CLI)] (nvmexpress.org, 25.02.2020)

{{Wfischer}}
{{Aranzinger}}
[[Category:SSDs]]
[[de:NVMe-CLI]]

EFI shell USB drive

2026-07-03T05:28:16Z

Aranzinger: Created page with "The '''EFI shell''' allows to run EFI applications, such as tools for updating the BIOS or the firmware of network cards or RAID controllers. In a lot of systems, an EFI shell is already included in the BIOS. If an integrated EFI shell is missing, an USB drive with EFI shell can be used as an alternative. == Create USB stick with EFI shell == The following steps must be performed, to create an USB drive with EFI shell: # Format USB stick with '''FAT32''' # Create '''/..."

The '''EFI shell''' allows to run EFI applications, such as tools for updating the BIOS or the firmware of network cards or RAID controllers. In a lot of systems, an EFI shell is already included in the BIOS. If an integrated EFI shell is missing, an USB drive with EFI shell can be used as an alternative.

== Create USB stick with EFI shell ==
The following steps must be performed, to create an USB drive with EFI shell:
# Format USB stick with '''FAT32'''
# Create '''/efi/boot''' directory on USB drive
# Download UEFI shell ('''Shell.efi''') and store it in the /efi/boot/ directory on the USB drive:
#*https://github.com/tianocore/edk2/blob/edk2-stable201903/ShellBinPkg/UefiShell/X64/Shell.efi (includes UEFI interactive shell v2.2)
# Rename Shell.efi to '''Bootx64.efi'''

== Test UEFI shell ==
Next, you can boot from this USB stick and use the EFI shell:
<gallery>
File:BIOS-Boot-Override-USB-Pen-Drive.jpg|Boot into the BIOS and, under '''Save & Exit''' in the '''Boot Override''' section''',''' select the UEFI entry for the USB drive you created. ('''UEFI: Lexar USB Flash Drive ...''' in this example).
File:EFI-Shell-v2.2.jpg|The EFI shell is started.
</gallery>

{{Wfischer}}
{{Aranzinger}}

[[Category:UEFI]]
[[de:EFI Shell USB Stick]]

Grafana installation and configuration on Ubuntu server 18.04 LTS

2026-07-01T09:27:26Z

Aranzinger: Created page with "'''Grafana''' is a webbased open source frontend for virtualizing metrics and for alerting when thresholds are exceeded. Grafana '''supports numerous data sources''', for example Time Series databases such as InfluxDB, Graphite or Prometheus, log files via Elasticsearch and SQL data bases. Pre-defined dashboards are available through a marketplace.<ref>[https://grafana.com/grafana/dashboards Grafana Dashboards] (grafana.com)</ref> This aticle explains the '''installa..."

'''Grafana''' is a webbased open source frontend for virtualizing metrics and for alerting when thresholds are exceeded. Grafana '''supports numerous data sources''', for example Time Series databases such as [[InfluxDB]], Graphite or Prometheus, log files via Elasticsearch and SQL data bases. Pre-defined dashboards are available through a marketplace.<ref>[https://grafana.com/grafana/dashboards Grafana Dashboards] (grafana.com)</ref> This aticle explains the '''installation of Grafana''' in version 6.6.2 on '''[[Ubuntu]] 18.04 LTS''' as well as the '''connection of a InfluxDB database as a data source'''.

[[File:OPNsense-Grafana-Dashboard.png|thumb|right|Grafana dashboard with InfluxDB as datasource for monitoring a [[OPNsense]] firewall]]

== Installation ==
Grafana can be easily installed using Ubuntu's built-in package manager.<ref>[https://grafana.com/docs/grafana/latest/installation/debian/ Install on Debian or Ubuntu] (grafana.com)</ref> The following paragraphs show how to install Grafana on Ubuntu. Information about the installation on Windows, MAC and other Linux distributions can be found in the Grafana download area.<ref>[https://grafana.com/grafana/download Download Grafana] (grafana.com)</ref>

=== Add package sources ===
Since Grafana is not included in the official package repositories, the Grafana repository can be added as follows:
<pre>
tk@monitoringlesv2:~$ sudo apt install -y apt-transport-https
tk@monitoringlesv2:~$ sudo apt install -y software-properties-common wget
tk@monitoringlesv2:~$ wget -q -O - https://packages.grafana.com/gpg.key | sudo apt-key add -
tk@monitoringlesv2:~$ sudo add-apt-repository "deb https://packages.grafana.com/oss/deb stable main"
tk@monitoringlesv2:~$ sudo apt update
</pre>

=== Install Grafana and activate Systemd daemon ===
After the package sources have been added, Grafana can be installed and the SystemD-service can be started and activated for Grafana:
<pre>
tk@monitoringlesv2:~$ sudo apt install grafana
tk@monitoringlesv2:~$ sudo systemctl daemon-reload
tk@monitoringlesv2:~$ sudo systemctl enable grafana-server
tk@monitoringlesv2:~$ sudo systemctl start grafana-server
tk@monitoringlesv2:~$ sudo systemctl status grafana-server
</pre>

== Configure Grafana ==
The configuration is made via Grafana webinterface.<ref>[https://grafana.com/docs/grafana/latest/guides/getting_started/ Getting started] (grafana.com)</ref>
To proceed with the remaining configuration steps, launch a browser of your choice.

* Webinterface: http://<IP-des-Grafana-Servers>:3000
* Username: admin
* Password: admin

=== Login to webinterface ===
Log in with the username "admin" and the password "admin":
<gallery>
File:Ubuntu-Server-18.04-Grafana-001.png|Grafana login
File:Ubuntu-Server-18.04-Grafana-002.png|Log in to the web interface using the username "admin" and password "admin".
File:Ubuntu-Server-18.04-Grafana-003.png|A prompt to change your password appears.
</gallery>

=== Add datasource ===
This paragraph shows how to connect an InfluxDB as datasource to Grafana:
<gallery>
File:Ubuntu-Server-18.04-Grafana-004.png|After logging in to the web interface, you will see the following screen. Click on ''Add data source''.
File:Ubuntu-Server-18.04-Grafana-005.png|Click ''Select'' in the InfluxDB row.
File:Ubuntu-Server-18.04-Grafana-006.png|Assign a name to the data source, specify the path to InfluxDB, and select the database you want to connect to. Click ''Save & Test''.
File:Ubuntu-Server-18.04-Grafana-007.png|If the message '''Data source is working''' appears, the connection from InfluxDB to Grafana was successful.
File:Ubuntu-Server-18.04-Grafana-008.png|Click ''Back''.
</gallery>

=== Import dashboard ===
Pre-defined Grafana dashboards can be easily imported:
<gallery>
File:Ubuntu-Server-18.04-Grafana-009.png|Switch to the menu option Dashboards → Home.
File:Ubuntu-Server-18.04-Grafana-010.png|Go to Create → Import, to import a dashboard.
File:Ubuntu-Server-18.04-Grafana-011.png|Search for a suitable dashboard on Grafana and enter the URL or dashboard ID here.
File:Ubuntu-Server-18.04-Grafana-012.png|Depending on the dashboard, adjust a few more variables and then click ''Import''.
</gallery>

== References ==
<references />

{{Tniedermeier}}
{{Aranzinger}}
[[Category:Ubuntu]]
[[Category:Monitoring]]
[[pl:Instalacja i konfiguracja oprogramowania Grafana w Ubuntu Server 18.04 LTS]]
[[de:Grafana Installation und Konfiguration unter Ubuntu Server 18.04 LTS]]

Upload own Ubuntu packages to reprepro repository

2026-07-01T05:30:30Z

Aranzinger: Created page with "In the following article, it is explained '''how to upload''' your own Ubuntu packages to a '''reprepro''' repository. The packages are transferred in a folder on the repository server with '''dupload''' via scp and processed there via an inoticoming job from reprepro. In the examples shown, the client is running Ubuntu 12.10, and the server is running '''Ubuntu 12.04.2''' with kernel 3.2.0-38-generic. In the article Create Own apt repository using reprepro on Ubuntu..."

In the following article, it is explained '''how to upload''' your own Ubuntu packages to a '''reprepro''' repository. The packages are transferred in a folder on the repository server with '''dupload''' via scp and processed there via an inoticoming job from reprepro. In the examples shown, the client is running Ubuntu 12.10, and the server is running '''Ubuntu 12.04.2''' with kernel 3.2.0-38-generic.

In the article [[Create Own apt repository using reprepro on Ubuntu]], it is explained how to generate an own reprepro repository.

== Installation ==
=== On the repository server ===
<code>inoticoming</code><ref>[http://manpages.ubuntu.com/manpages/lucid/man1/inoticoming.1.html inoticoming Ubuntu-package] (packages.ubuntu.com)</ref> triggered actions, when files are added to a folder.
<pre>
:~$ sudo apt-get install inoticoming
</pre>

=== On the client ===
<code>dupload</code><ref>[http://packages.ubuntu.com/precise/dupload dupload Ubuntu-package] (packages.ubuntu.com)</ref> loads the Ubuntu packages from the repository server that is monitored by inoticoming.
<pre>
:~$ sudo apt-get install dupload
</pre>

== Configuration ==
=== On the server ===
The configuration file <code>incoming</code> sets the rules and folders for uploads of new packages into the reprepro repository. The configuration file <code>incoming</code> is located in the <code>/conf</code> folder of the used reprepro repos.
<pre>
:~$ vi packages/conf/incoming
Name: incoming
IncomingDir: /home/repository/incoming
Allow: precise
Cleanup: on_deny on_error
Tempdir: /home/repository/incoming_tmp
LogDir: /home/repository/incoming_log
</pre>
The <code>incoming</code> rule is called by <code>inoticoming</code> via <code>inoticoming</code>:
<pre>
:~$ inoticoming --logfile /home/repository/incoming_log/upload.log /home/repository/incoming/ \
> --stderr-to-log --stdout-to-log --suffix '.changes' \
> reprepro --waitforlock 100 processincoming incoming {} \;
</pre>
Make sure that <code>inoticoming</code> runs under the same user account that manages the repository and uploads the packages. This ensures that the files and folders can be created and have the correct permissions.
<pre>
:~$ ps -u repository
PID TTY TIME CMD
[...]
3098 ? 00:00:00 inoticoming
</pre>

=== On the client ===
First, an SSH key is transmitted to the server for authentication:
<pre>
:~$ ssh-copy-id -i .ssh/key_rsa.pub repository@192.168.56.102
</pre>
The dupload-configuration specifies how the packages are loaded into the rep:
<pre>
:~$ vi .dupload.conf
package config;
$default_host = "tkpack";
$cfg{'tkpack'} = {
fqdn => "192.168.56.102",
method => "scp",
login => "repository",
incoming => "/home/repository/incoming/",
# files pass on to dinstall which sends emails itself
dinstall_runs => 1,
};
</pre>

== Upload packages to repository ==
You can then use <code>dupload</code> to upload a package to the repo '''from the client''' (in this case, without sending notification emails):
<pre>
:~$ dupload -f --nomail -t tkpack tkmon_0.0.1-1_amd64.changes
dupload warning: mail options disabled, can't run `/usr/sbin/sendmail': No such file or directory
dupload note: no announcement will be sent.
Uploading (scp) to 192.168.56.102:/home/repository/incoming/
[ job tkmon_0.0.1-1_amd64 from tkmon_0.0.1-1_amd64.changes
tkmon_0.0.1-1.dsc, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1-1.debian.tar.gz, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1.orig.tar.gz, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1-1_all.deb, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1-1_amd64.changes ok ]
Uploading (scp) to tkpack (192.168.56.102)
[ Uploading job tkmon_0.0.1-1_amd64
tkmon_0.0.1-1.dsc 0.8 kB, ok (0 s, 0.81 kB/s)
tkmon_0.0.1-1.debian.tar.gz 6.1 kB, ok (0 s, 6.07 kB/s)
tkmon_0.0.1.orig.tar.gz 720.0 kB, ok (1 s, 720.00 kB/s)
tkmon_0.0.1-1_all.deb 701.7 kB, ok (1 s, 701.66 kB/s)
tkmon_0.0.1-1_amd64.changes 1.4 kB, ok (0 s, 1.43 kB/s) ]
</pre>

'''On the server''', <code>inoticoming</code> loads the packages with reprepro into the repository:
<pre>
:~/incoming_log$ cat upload.log
Will call action reprepro for: tkmon_0.0.1-1_amd64.changes
Exporting indices...
:~/incoming_log$ reprepro list precise
precise|main|i386: tkmon 0.0.1-1
precise|main|amd64: tkmon 0.0.1-1
precise|main|source: tkmon 0.0.1-1
</pre>

== Troubleshooting ==
The following error occurs when using the upload method <code>scpb</code>, which is actually recommended in the dupload man page:
<pre>
[...]
chmod: cannot access `tkmon_0.0.1-1.dsc': No such file or directory
chmod: cannot access `tkmon_0.0.1-1.debian.tar.gz': No such file or directory
chmod: cannot access `tkmon_0.0.1.orig.tar.gz': No such file or directory
chmod: cannot access `tkmon_0.0.1-1_all.deb': No such file or directory
chmod: cannot access `tkmon_0.0.1-1_amd64.changes': No such file or directory
dupload fatal error: ssh -x -l repository 192.168.56.102 'cd /home/repository/incoming/;chmod 0644 tkmon_0.0.1-1.dsc tkmon_0.0.1-1.debian.tar.gz tkmon_0.0.1.orig.tar.gz tkmon_0.0.1-1_all.deb tkmon_0.0.1-1_amd64.changes ;' failed
at /usr/bin/dupload line 662
</pre>
This error occurs because <code>inoticoming</code> is processing the uploaded packages too quickly. The packages have already been moved to the repository by <code>reprepro</code>, so <code>dupload</code> can no longer perform a <code>chmod</code>.

=== Workaround ===
The right permissions can be set with preupload-hook before the upload. This also allows you to upload using <code>scpb</code>.
<pre>
[...]
$preupload{'file'} = 'chmod 644 %1',
$preupload{'deb'} = 'chmod 644 %1',
$cfg{'tkpack'} = {
fqdn => "192.168.56.102",
method => "scpb",
login => "repository",
[...]
</pre>

== References ==
<references />

{{Gschoenberger}}
{{Aranzinger}}
[[Category:Ubuntu]]
[[de:Eigene Ubuntu-Pakete in reprepro Repository hochladen]]

Linux file systems

2026-06-30T10:37:36Z

Aranzinger: Created page with "There are numerous '''file systems''' for different application purposes. This article includes excerpts highlighting particularly relevant file systems that are also included in the Linux Storage Stack Diagram. Further file systems are mentioned in the documentation of the Linux kernel.<ref>[https://www.kernel.org/doc/html/latest/filesystems/ Filesystems in the Linux kernel] (www.kernel.org)</ref> == File systems for storing data == ==..."

There are numerous '''file systems''' for different application purposes. This article includes excerpts highlighting particularly relevant file systems that are also included in the [[Linux Storage Stack Diagram|Linux Storage Stack Diagram]].
Further file systems are mentioned in the documentation of the Linux kernel.<ref>[https://www.kernel.org/doc/html/latest/filesystems/ Filesystems in the Linux kernel] (www.kernel.org)</ref>

== File systems for storing data ==

=== Block-based file systems ===
The following list displays block-based file systems:
* [https://docs.kernel.org/filesystems/btrfs.html btrfs] - Copy-on-write file system.
* [https://docs.kernel.org/filesystems/ext2.html ext2] - New version of extended file system.
* [https://docs.kernel.org/admin-guide/ext4.html ext4] - An enhanced version of the journal-based ext3 file system with support for large file systems (64-bit).
* [https://www.kernel.org/doc/html/latest/filesystems/f2fs.html f2fs] - A file system that uses NAND flash storage devices and is based on a log-structured file system (LFS).
* [https://docs.kernel.org/filesystems/gfs2.html gfs2] - Cluster file system.
* [https://docs.kernel.org/filesystems/isofs.html iso9660] - Read-only file system for optical data carrier (CD-ROM, DVD-ROM, Blu-ray Disc etc.).
* [https://docs.kernel.org/filesystems/ntfs3.html ntfs3] - A fully functional read/write driver for NTFS up to version 3.1.
* [https://docs.kernel.org/filesystems/ocfs2-online-filecheck.html ocfs2] - (Oracle Cluster File System 2) cluster file system from Oracle.
* [https://docs.kernel.org/filesystems/squashfs.html squashfs] - Comprimized, read-only file system.
* [https://docs.kernel.org/filesystems/vfat.html vfat] - File system for Microsoft operating systems.
* [https://docs.kernel.org/admin-guide/xfs.html xfs] - Journaling file system for Unix-like operating systems developed by Silicon Graphics (SGI)

More details can be found in the article [[Block-based Linux file systems]].

=== Network FS ===
* ceph
* coda
* nfs
* smbfs

=== Stackable FS ===
* [https://docs.kernel.org/filesystems/ecryptfs.html ecryptfs] - (Enterprise Cryptographic Filesystem) POSIX-compliant cryptographic stacked file system.
* [https://docs.kernel.org/filesystems/overlayfs.html overlayfs] - An overlay file system that provides a writable file system on top of another (usually read-only) file system (often used for live CDs).

=== Raw Flash FS ===
* jffs2
* ubifs

== More file systems ==

=== Pseudo FS ===
* futexfs
* pipefs
* [https://docs.kernel.org/filesystems/proc.html proc] - (process filesystem) serves as an interface to internal data structures in the kernel. It can be used to obtain information about the system and to change certain kernel parameters at runtime (sysctl).
* [https://docs.kernel.org/filesystems/sysfs.html sysfs] - RAM-based file system that was originally based on ramfs. It provides the ability to export kernel data structures, their attributes, and the relationships between them to user space.
* usbfs

=== Special Purpose FS ===
* devtmpfs
* ramfs
* tmpfs

== Einzelnachweise ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category: Linux Basics]]
[[de:Linux Dateisysteme]]

FSCK Best Practices

2026-06-30T08:14:53Z

Aranzinger:

File system checks (FSCK) verify the consistency of '''file systems'''. Generally, a check of journaling file systems such as Ext3, [[Ext4]], or [[XFS]] is performed quickly, since the metadata journal ensures consistency. Nevertheless, there may be situations in which a file system becomes corrupted and must be '''fixed'''. A '''regular FSCK''' is '''recommended''' on server systems to prevent file system problems.

== Periodic check on Ubuntu ==
Ubuntu has deactivated the periodical file system check (FSCK) with the release of [[Ubuntu]] 12.04 Precise.<ref name="e2fsprogs">[https://bugs.launchpad.net/ubuntu/+source/e2fsprogs/+bug/1083985 fsck routine checks on boot are disabled] (launchpad.net)</ref>
* Up through Ubuntu 12.04, FSCK was run at regular intervals during system boot. For this, <code>max-mount-counts</code> and <code>interval-between-checks</code> were set on certain values when generating the file system:
<pre>
$ sudo tune2fs -l /dev/sda1 | egrep -i "mount count|Check interval|Last|Next"
Mount count: 2
Maximum mount count: 39
Last checked: Mon Jun 29 20:23:44 2015
Check interval: 15552000 (6 months)
Next check after: Sat Dec 26 19:23:44 2015
</pre>
* Starting on April 12, you will see the following output: a value of -1 for <code>max-mount-counts</code> and a value of 0 for <code>interval-between-checks</code> disable periodic FSCK:
<pre>
$ sudo tune2fs -l /dev/sda1 | egrep -i "mount count|Check interval|Last|Next"
Last mounted on: /
Mount count: 80
Maximum mount count: -1
Last checked: Fri Jul 18 21:27:32 2014
Check interval: 0 (<none>)
</pre>

'''Hint:''' In server environments, it is generally recommended to verify file systems on a regular basis. Further information can be also found in:
* [https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-fsck.html#fsck-best-practices FSCK Best Practices] (redhat.com)
* [https://access.redhat.com/solutions/39682 Is it advisable to disable filesystem checks?] (redhat.com)

== Enable periodic FSCK ==
'''Attention:''' In some cases, it may be advisable to perform an FSCK manually rather than on a scheduled basis on server systems. For larger file systems, an FSCK can take quite a while. If a reboot causes the mount count to reach its limit or if you exceed the interval between checks, an FSCK will be performed during boot, during which the server will be unavailable! When performing the FSCK manually, you determine when it runs.

The use of [[LVM basics|LVM]] also allows to dismiss the FSCK on a snapshot. The downtime of the productive file system can be limited to a minimum with that. See also [[#Filesystem check with LVM Snapshot]].

=== Requirement fstab ===
In fstab, the ''pass'', or ''fs_passno'', field must be set right for the periodic check.<ref>[http://linux.die.net/man/5/fstab fstab man Page]</ref>
The default value for the root filesystem is 1. It is best to set other filesystems to 2:
<pre>
$ sudo vi /etc/fstab
# / was on /dev/sda1 during installation
UUID=410ffeb7-f200-4d44-9517-d1b0926bd574 / ext4 errors=remount-ro 0 1
# /home was on /dev/sda2 during installation
UUID=30995b90-3348-4de3-905b-593f7e2de487 /home ext4 defaults 0 2
</pre>

=== Configure settings ===
To enable periodic FSCK at boot time, adjust the values <code>max-mount-counts</code> and <code>interval-between-checks</code> with tune2fs:
# <code>max-mount-counts</code>: Number of mount-processes on which the file system is verified automatically.
# <code>interval-between-checks</code>: Maximum time elapsed between two checks.
<pre>
$ sudo tune2fs -c 60 /dev/sda1
tune2fs 1.42.9 (4-Feb-2014)
Setting maximal mount count to 60
$ sudo tune2fs -i 30d /dev/sda1
tune2fs 1.42.9 (4-Feb-2014)
Setting interval between checks to 2592000 seconds
</pre>

== Force FSCK when booting ==
'''Hint:''' The settings of the ''pass'', or also ''fs_passno'', field ( see [[#Requirement fstab]]) are ignored during a forced FSCK! All file systems listed in fstab are verified.

Up through Ubuntu version 15.10, it was possible to force an FSCK on the next reboot by creating the file /forcefsck. The next boot would then run an FSCK:
<pre>
$ sudo touch /forcefsck
</pre>

From Ubuntu 16.04, this is possible via the following kernel boot parameter (that can be set in the Grub configuration):<ref>[https://ubuntuforums.org/showthread.php?t=2326230&p=13496775#post13496775 forcefsck not working] (ubuntuforums.org, 30.05.2016)</ref>
fsck.mode=force

=== Auto repair ===
'''Attention:''' The following option triggers an auto-repair when errors occur. Automatic error correction is not always desirable or practical in every situation!
<pre>
$ sudo vi /etc/default/rcS
[...]
# automatically repair filesystems with inconsistencies during boot
FSCKFIX=yes
</pre>

== Standard settings for new file systems ==
The standard settings for new created file systems can be made in the ''mke2fs.conf'' file. The periodical check of file systems is deactivated via default. To activate it, set ''enable_periodic_fsck'' to 1:
<pre>
$ sudo vi /etc/mke2fs.conf
[defaults]
base_features = sparse_super,filetype,resize_inode,dir_index,ext_attr
default_mntopts = acl,user_xattr
enable_periodic_fsck = 1
[...]
</pre>
As a result, the FSCK is set up automatically for new file systems:
<pre>
$ sudo mkfs.ext4 /dev/loop0
[...]
This filesystem will be automatically checked every 23 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
</pre>

== Manual file system check ==
A manual file system check for ext4 can be started with fsck.ext4 from the e2fsprogs package.<ref>[http://packages.ubuntu.com/trusty/e2fsprogs Package e2fsprogs] (packages.ubuntu.com)</ref> The name of the other tools, for example for XFS, can be found in the article [[Linux file systems]].

Ideally, a FSCK is not only started on mounted file systems. The following is located in the manpage:<ref>[http://linux.die.net/man/8/e2fsck e2fsck man Page] (linux.die.net)</ref>
<blockquote>
Note that, in general, it is not safe to run e2fsck on mounted filesystems. The only exception is if the -n option is specified, and -c, -l, or -L options are not specified. However, even if it is safe to do so, the results printed by e2fsck are not valid if the filesystem is mounted.
</blockquote>

If the file system is currently in a ''clean'' state, the FSCK must be started with ''-f'':
<pre>
$ sudo fsck.ext4 /dev/loop0
e2fsck 1.42.9 (4-Feb-2014)
/dev/loop0: clean, 11/7680 files, 2370/30720 blocks
$ sudo fsck.ext4 -f /dev/loop0
e2fsck 1.42.9 (4-Feb-2014)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/loop0: 11/7680 files (9.1% non-contiguous), 2370/30720 blocks
</pre>

=== Not interactive filesystem check ===
The option ''-n'' performs a FSCK in read-only mode and assumes ''No'' as the answer to any question that may arise. The option is therefore suitable for not starting an FSCK interactively, for example regularly and automatized via cron job. Please note that the file system must not be mounted in this case.

== Filesystem check with LVM snapshot ==
Using LVM allows you to perform file system checks using a snapshot. This means the device being checked does not need to be unmounted for the duration of the check. It is sufficient to unmount the file system being checked in order to create the snapshot. Theoretically, an LVM snapshot of a mounted file system would also be possible. However, the snapshot is only clean and truly consistent if the logical volume is not mounted.

This method for a FSCK using an LVM snapshot is also recommended by Theodore Ts'o in Mailing List Posts.<ref name="e2fsprogs" /><ref name="periodicfsck">[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773267 Provide a means to query fsck whether it would run a routine check] (debian.org)</ref>

'''Note:''' The ''lazy'' option can be helpful if users are currently working with the file system. With a lazy unmount, file system resources are released when they are no longer in use by users. You can also use ''lsof'' beforehand to check whether a file system is currently still in use. In the following example, unmounting is not possible because a user is still in the directory:
<pre>
# lsof | grep -i mnt
bash 6963 root cwd DIR 252,0 1024 2 /mnt
lsof 14456 root cwd DIR 252,0 1024 2 /mnt
grep 14457 root cwd DIR 252,0 1024 2 /mnt
lsof 14458 root cwd DIR 252,0 1024 2 /mnt
# umount /mnt
umount: /mnt: device is busy.
(In some cases useful info about processes that use
the device is found by lsof(8) or fuser(1))
</pre>

'''Attention:''' The snapshot must not fill up during the FSCK. Therefore, when creating the snapshot, make sure to choose an appropriate size! In this case, a snapshot size of 20 gigabytes was selected.

The following commands must be used for creating the snapshot and for starting the FSCK:
<pre>
# umount -l /dev/vg00/data
# lvcreate -s -n data_snap -L 20G /dev/vg00/data
# mount /dev/vg00/data /mnt/
# fsck.ext4 -f /dev/vg00/data_snap
# lvremove -f /dev/vg00/data_snap
</pre>
The advantage of LVM is that the file system can be remounted immediately after the snapshot is created.

== References ==
<references />

{{Cmitasch}}
{{Gschoenberger}}
{{Aranzinger}}
[[Category:Linux Basics]]
[[de:FSCK Best Practices]]

VMware Contract ID

2026-06-30T05:37:18Z

Aranzinger: Created page with "For the renewal of an existing or soon-to-expire VMware support & subscription contract, the '''Support Contract ID''' of the product is required. This information can be found in your [https://support.broadcom.com/ Broadcom Support Portal] in '''MyEntitlements.''' <gallery width="1024" height="820" showcarousel="false" slideinfozoneopacity="0.95"> file:Vmware support id 1.png|Select '''My Entitlements''' file:Vmware support id 2.png|Select your '''Site ID''' , then ''..."

For the renewal of an existing or soon-to-expire VMware support & subscription contract, the '''Support Contract ID''' of the product is required.

This information can be found in your [https://support.broadcom.com/ Broadcom Support Portal] in '''MyEntitlements.'''

<gallery width="1024" height="820" showcarousel="false" slideinfozoneopacity="0.95">
file:Vmware support id 1.png|Select '''My Entitlements'''
file:Vmware support id 2.png|Select your '''Site ID''' , then '''Entitlement Details''' and '''Contract Details'''.
file:Vmware support id 3.png|You will find the required '''Contract Number''' in the left column.
</gallery>

{{Npauli}}
{{Aranzinger}}
[[Category:VMware vSphere 8.0]]
[[de:VMware Contract ID]]
[[pl:Przedłużenie wsparcia producenta oraz subskrypcji produktów VMware - VMware Contract ID]]

Upgrade Linux Mint Debian Edition

2026-06-29T11:52:39Z

Aranzinger: Created page with "An installation of '''Linux Mint Debian Edition''' (LMDE) can be updated to a newer version once it is released. In this example, we present the upgrade from LMDE 6 to LMDE 7. == Preparation == To prepare, the updatetool mintupgrade must be installed:<ref>[https://blog.linuxmint.com/?p=4923 How to upgrade to LMDE 7] (blog.linuxmint.com, 14.10.2025)</ref> apt update apt install mintupgrade '''Important note - create backup:''' Before you continue, we recommend t..."

An installation of '''[[Linux]] Mint Debian Edition''' (LMDE) can be updated to a newer version once it is released. In this example, we present the upgrade from LMDE 6 to LMDE 7.

== Preparation ==
To prepare, the updatetool mintupgrade must be installed:<ref>[https://blog.linuxmint.com/?p=4923 How to upgrade to LMDE 7] (blog.linuxmint.com, 14.10.2025)</ref>
apt update
apt install mintupgrade

'''Important note - create backup:''' Before you continue, we recommend to create a recent backup of your data.

== Perform update ==
Next, start the updatetool:
sudo mintupgrade

The following screenshots display the individual steps of the upgrade process:
<gallery>
File:LMDE-7-Upgrade-01.png
File:LMDE-7-Upgrade-02.png
File:LMDE-7-Upgrade-03.png
File:LMDE-7-Upgrade-08.png
File:LMDE-7-Upgrade-09.png
File:LMDE-7-Upgrade-10.png
File:LMDE-7-Upgrade-11.png
File:LMDE-7-Upgrade-12.png
File:LMDE-7-Upgrade-13.png
File:LMDE-7-Upgrade-14.png
</gallery>

== Cancel and restart upgrade ==
After this, remove the updatetool and restart the system:

apt remove mintupgrade
sudo reboot

== References ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category:Linux Mint]]
[[de:Upgrade Linux Mint Debian Edition]]

Installation of N8n

2026-06-19T06:10:54Z

Aranzinger:

'''n8n''' is a performant open-source platform for automatizing workflows. In contrast to cloud services such as Zapier or Make.com, n8n enables self-hostet operation, which allows you to maintain full control over your data, workflows, and costs.

This article describes four different self-contained methods ("paths") to install n8n on a local Linux server. Select the path that fits best to your use case and follow the steps from beginning to end.

== Requirements ==
=== General requirements (for all methods) ===
*'''Server:''' A physical server or a virtual machine.
*'''Resources:''' At least 1 vCPU and 2 GB RAM. 2+ vCPUs and 4+ GB RAM are recommended for productive use.
*'''User rights:''' You will require a user with <code>sudo</code>-rights.
*'''System updates:''' It is recommended to update the system in advance:
<pre>
sudo apt update && sudo apt upgrade -y
</pre>

=== Specific software (depending on the path) ===
*'''For path 1 & 2 (Docker / Docker Compose):''' Install the docker engine and the compose plugin via the '''official docker repositories'''.
<pre>
sudo apt-get remove docker docker-engine docker.io containerd runc && sudo apt-get autoremove -y
# 2. Set up Repository and install docker
sudo apt-get update && sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
# 3. Set permissions (crucial!)
sudo usermod -aG docker $USER
</pre>
'''Important:''' So that docker permissions work, you have to '''log out and log in''' or execute the command <code>newgrp docker</code> in your current shell.

*'''For path 3 (npm):''' Install Node.js (v18+) and the package manager npm.
<pre>
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt-get install -y nodejs
</pre>

*'''For path 4 (Proxmox):''' A functional Proxmox VE installation is required.

== Installation paths ==

=== Path 1: Docker (fast & simple for tests) ===
This method is ideal to test n8n fast and uncomplicated.

'''Step 1: Create data directory''' This steps avoids permission issues in the container.
<pre>
mkdir -p ~/.n8n
sudo chown -R $USER:$USER ~/.n8n
</pre>

'''Step 2: Start container'''
<pre>
docker run -d --rm --name n8n -p 5678:5678 -v ~/.n8n:/home/node/.n8n n8nio/n8n:latest
</pre>
n8n is available on <code>http://<Ihre-Server-IP>:5678</code>. You will see a security warning about "secure cookie".

'''Step 3: Resolve access issue''' You have two possibilities:
*'''A) Fast workaround (unsafe):''' Stop the old container (<code>docker stop n8n</code>) and restart it with additional environment variable.
This is only suitable for localhost testing!
<pre>
docker run -d --rm --name n8n -p 5678:5678 -v ~/.n8n:/home/node/.n8n -e "N8N_SECURE_COOKIE=false" n8nio/n8n:latest
</pre>

*'''B) Secure approach using Reverse Proxy (recommended):''' Set up a reverse proxy to run n8n over HTTPS using a domain.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

---

=== Path 2: Docker Compose (recommended for productive use) ===
This method is a robust method and ideal for long-term use, as it clearly divides the data base and n8n.

'''Step 1: Create project directory and configuration file'''
<pre>
mkdir -p ~/n8n-produktiv
cd ~/n8n-produktiv
nano docker-compose.yml
</pre>

'''Step 2: Add content for <code>docker-compose.yml</code>'''
Replace the placeholders for the passwords.
<pre>
services:
n8n:
image: n8nio/n8n:latest
ports:
- "5678:5678"
restart: always
environment:
- DB_TYPE=postgresdb
- DB_POSTGRESDB_HOST=postgres
- DB_POSTGRESDB_PORT=5432
- DB_POSTGRESDB_DATABASE=n8n
- DB_POSTGRESDB_USER=n8n
- DB_POSTGRESDB_PASSWORD=IHR_N8N_DB_PASSWORT
- GENERIC_TIMEZONE=Europe/Berlin
volumes:
- n8n_data:/home/node/.n8n
depends_on:
- postgres
postgres:
image: postgres:14
restart: always
environment:
- POSTGRES_USER=n8n
- POSTGRES_PASSWORD=IHR_N8N_DB_PASSWORT
- POSTGRES_DB=n8n
volumes:
- postgres_data:/var/lib/postgresql/data
volumes:
n8n_data:
postgres_data:
</pre>

'''Step 3: Start container'''
<pre>
docker compose up -d
</pre>
As the port is only connected to 127.0.0.1, n8n is not directly accessible from outside. This is intentional.

'''Step 4: Enable access'''
You have two possibilities:
*'''A) Fast workaround (unsafe):''' Change the port assignment in the <code>docker-compose.yml</code> to <code>"5678:5678"</code> and add to the <code>environment</code>-block in n8n the line <code>- N8N_SECURE_COOKIE=false</code>. Restart with <code>docker compose up -d</code>.
This is only suitable for LAN-only test without external accessibility!

*'''B) Secure approach using Reverse Proxy (recommended): '''Set up a Reverse Proxy, that forwards the traffic to <code>127.0.0.1:5678</code>.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

---

=== Path 3: npm (for developers) ===
This method installs n8n directly on the host system.

'''Step 1: Install n8n globally'''
The global installation requires administrator rights.
<pre>
sudo npm install -g n8n
</pre>

'''Step 2: Start n8n'''
Execute the command as normal user.
<pre>
n8n
</pre>
n8n is now available on <code>http://<Your<nowiki/>-Server-IP>:5678</code> and displays a safety warning. Terminate the process with <code>Strg+C</code>.

'''Step 3: Resolve access issue'''
You have two possibilities:
*'''A) Fast workaround (unsafe):''' Start n8n with a preceding environment variable.
Please note that this is only suitable for localhost tests!
<pre>
N8N_SECURE_COOKIE=false n8n
</pre>

*'''B) Secure approach with Reverse Proxy (recommended): '''Let n8n run in the background (for example with <code>pm2</code> oder <code>systemd</code>) and set up a Reverse Proxy in front of it.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

---

=== Path 4: Proxmox Helper Scripts (LXC) ===
This method creates a dedicated, lean Linux container for n8n.

Attention: We do not recommend this for productive use!

'''Step 1: Execute installation script'''
Execute this command on the '''Proxmox-Host''' shell and follow the interactive dialogue.
<pre>
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/n8n.sh)"
</pre>

'''Step 2: Test access'''
After the installation, the script outputs the IP address of the container. n8n is available on <code>http://<IP-des-LXC-Containers>:5678</code> and displays the safety warning.

'''Step 3: Resolve access issue'''
You have two possibilities:
*'''A) Fast workaround (unsafe):''' The environment variable must be configured directly in the container.
This is only suitable for LAN-tests without external availability!
<pre>
# 1. Verbinden Sie sich mit der Shell des n8n-Containers
ssh root@<IP-des-LXC-Containers>
# 2. Öffnen Sie die systemd-Service-Datei
nano /etc/systemd/system/n8n.service
# 3. Fügen Sie unter dem Abschnitt [Service] folgende Zeile hinzu:
Environment="N8N_SECURE_COOKIE=false"
# 4. Speichern, schließen und die Dienste neu laden/starten
systemctl daemon-reload && systemctl restart n8n
</pre>

*'''B) Secure approach with Reverse Proxy (recommended):''' Set up a Reverse Proxy on another server or in another container that forwards the traffic to <code>http://<IP-des-LXC-Containers>:5678</code>.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

== Sources ==
* [https://docs.n8n.io/hosting/self-hosted/ n8n Documentation – Self‑Hosted] (en)
* [https://github.com/n8n-io/n8n n8n auf GitHub] (en)
* [https://tteck.github.io/Proxmox/ Proxmox VE Helper-Scripts von tteck] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Automation]]
[[Category:Artificial Intelligence]]
[[Category:Docker]]
[[Category:VMs/Containers]]
[[de:N8n installieren]]

Creation of Proxmox HA cluster

2026-06-18T10:12:06Z

Aranzinger: Created page with "This article describes the configuration of a '''High Availability Cluster''' or '''HA Cluster''' using three servers with '''Proxmox''' '''VE''' 8.2.2. In this example, Ceph is configured within the cluster as the data storage. ==Requirements for High Availability== Before configuring the HA cluster, it must be verified if all requirements are fulfilled: *3 server systems identical in design * all nodes must be located in the same system * date and time must be sy..."

This article describes the configuration of a '''High Availability Cluster''' or '''HA Cluster''' using three servers with '''Proxmox''' '''VE''' 8.2.2. In this example, [[Ceph]] is configured within the cluster as the data storage.

==Requirements for High Availability==
Before configuring the HA cluster, it must be verified if all requirements are fulfilled:
*3 server systems identical in design
* all nodes must be located in the same system
* date and time must be synchronized (NTP)
* SSH must be released for SSH on port 22

==Installation and configuration==
First, Proxmox must be installed on all 3 nodes. Please make sure that you have entered the correct host name and IP configuration.

=== Network configuration ===
After that, the network configuration of all nodes must be made. The following steps must be executed after the installation has been successful:<gallery>
file:Initiale Netzwerkkonfiguration.png|First, select the host name and click on '''[Network]'''. Next, you will see the initial network configuration, which can be adjusted according to your requirements.
file:Netzwerkkonfiguration PVE.png|After that, the changes are applied by clicking on '''[Apply]'''. This process must be repeated on the remaining nodes.
</gallery>

Now, the network configuration can be verified with a ping test. You can also test the ping with jumbo frames, if configured. The following command would test this with an MTU configured to 9000 bytes:<pre>
ping -M do -s 8972 [IP-Adresse]
</pre>

===Create Proxmox VE cluster===
The following steps must be executed to create the cluster:
<gallery>
file:Create PVE Cluster.png|Go to '''[Datacenter]''' '''[Cluster]''' and click on '''[Create Cluster]'''. Now, a pop-up appears where a '''Clustername''' and the '''Network''' are entered for the PVE-cluster. By clicking on '''[Create]''' , the cluster is created.
file:PVE Cluster Join Information .png|Now you can copy the join information by selecting the '''[Join Information]''' option and clicking '''[Copy Information]'''. This step is required for adding the remaining nodes.
file:PVE Cluster Join.png|To add the remaining nodes to the cluster, connect to their GUI and under '''[Datacenter]''' '''[Cluster]''', click '''[Join Cluster]'''. After that, the join information, the password and the network can be entered. By clicking on '''[Join 'Clustername'],''' the host is added. Repeat this process for the remaining servers.
file:PVE Cluster Final.png|The overview should look similar to this.
</gallery>

'''Hint for a cluster with a lot of nodes:''' For clusters with a large number of nodes (25 or more), enter all nodes in the local hosts file on each cluster node. Otherwise, it may come to high network traffic and stability problems.

===Add Ceph storage===
To create a Ceph storage for storing all data, the following steps must be performed:<gallery>
file:1 Ceph Installation.png|Select a node here and click on '''[Ceph]''' and '''[Install Ceph]''' to start the installation.
file:Ceph Network.png|After the installation has been completed, the '''Ceph-Network''' can be stated. In addition, you can also set the number of '''replicates''' here. Click on '''[Next]''' to complete the configuration. This process is repeated for all nodes.
file:Ceph MON MGR.png|Next, some services must be configured for Ceph. The first are the monitoring and management services. For this, click '''[Ceph],''' then '''[Monitor]''' and then '''[Create]''' in Monitor and Manager. In this example, one service is created per host.
file:Ceph MON MGR done.png|The result should look similar to this image.
file:Disk Wipe GPT.png|The HDDs/SSDs/NVMes must be prepared for the creation of the OSDs. To do this, delete them under '''[Disks]''' '''[Wipe Disk]''' and initialize them with GPT '''[Initialize Disk with GPT]'''. Repeat this with all data carriers.
file:Ceph OSD.png|Now, you can create the OSDs under '''[Ceph]''' '''[OSD]''' by clicking on '''[Create: OSD].''' Select the disk and a device class and confirm it by clicking on '''[Create]'''. This must be repeated for all data carriers.
file:MDS Erstellung.png|After creating the OSD, a Meta Data server can be created under '''[CephFS].''' These are required for CephFS. For this, click on '''[Create].''' In this example, a MDS host is created per host'''.'''
file:CephFS.png|You can now create CephFS by clicking '''[Create CephFS]'''. You can use the default values here.
file:Ceph Pool erstellen.png|Finally, a pool must be created to store all data from the VMs/CTs. For this, switch to '''[Pools]''' and click '''[Create]'''. Next, you must assign a pool name; you can also set a '''target ratio''' of '''0.9'''.
file:Ceph Health Status.png|Finally, you can check the Ceph dashboard, and everything should be showing as Healthy.
</gallery>

===Configuration High Availability ===
Now you can create the required virtual machines and containers on the cluster. To take advantage of the cluster's high availability, it is essential that the configured VMs/CTs are added to the HA. To set this up, follow the steps below:
<gallery>
file:Add VM to HA.png|Go to '''[Datacenter]''' and click on '''[HA]'''. You can now add the VM to HA by clicking '''[Add]'''. To do so, enter the VM ID and a request state, then confirm by clicking '''[Add]'''.
</gallery>

After all steps have been executed, the cluster is functional and your virtual instance is highly available.

{{Npauli}}
{{Tlindinger}}
{{Aranzinger}}
[[Category:Proxmox Administration]]
[[de:Proxmox HA Cluster erstellen]]

LVM basic configuration

2026-06-18T07:09:52Z

Aranzinger:

In the following article, the '''basic configuration''' of LVs is explained. The used system is a '''Ubuntu Server 10.4''' with the 2.6.32-24 kernel and the LVM-version 2.02.54(1) (2009-10-26). In the following, it is explained how to create '''partitions''' of '''''Physical Volumes''''' (PVs), a '''''Volume Group''''' (VG) and the '''''Logical Volumes''''' (LVs) built on top of them.

==Creating partitions==
First, the partitions for the PVs are created. The following points must be taken into account:

*[[Partition Alignment]]
**Switch display to sectors (Switch "-u")
**switch off DOS-compatible mode (Switch "-c")
*for later LVM management
**switch system ID of partition to "8e" (Switch "-t" bei fdisk)
After the changes, the partition table looks as follows:
<pre>
root@ubuntu:/home/tktest# fdisk -lu

Disk /dev/sda: 5368 MB, 5368709120 bytes
255 heads, 63 sectors/track, 652 cylinders, total 10485760 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00051afd

Device Boot Start End Blocks Id System
/dev/sda1 * 2048 9920511 4959232 83 Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2 9922558 10483711 280577 5 Extended
Partition 2 does not end on cylinder boundary.
/dev/sda5 9922560 10483711 280576 82 Linux swap / Solaris

Disk /dev/sdb: 2147 MB, 2147483648 bytes
22 heads, 16 sectors/track, 11915 cylinders, total 4194304 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x1673663d

Device Boot Start End Blocks Id System
/dev/sdb1 2048 4194303 2096128 8e Linux LVM

Disk /dev/sdc: 2147 MB, 2147483648 bytes
22 heads, 16 sectors/track, 11915 cylinders, total 4194304 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xbd277faf

Device Boot Start End Blocks Id System
/dev/sdc1 2048 4194303 2096128 8e Linux LVM
</pre>
==Preparation of PVs==
PVs also include meta data for the administration of volumes (see also [[LVM basics]]). 255 sectors (á 512 byte) are created for the meta data by default. Among other things, a meta data area that is too small can result in, for example, the inability to create snapshots anymore: [[Fix LVM VG vgname metadata too large for circular buffer]]. Therefore, it will make sense to configure a larger meta data area. If you want to enlargen your meta data area, the parameter "--metadatasize" must be added to the command "pvcreate" and then select the desired size at:
<pre>
--metadatasize size
</pre>
After that, the partitions are initialized as PV.

<pre>
root@ubuntu:~# pvcreate /dev/sdb1
Physical volume "/dev/sdb1" successfully created
root@ubuntu:~# pvcreate /dev/sdc1
Physical volume "/dev/sdc1" successfully created
</pre>
The commands "pvs" and "pvdisplay" offer a variety of possibilities to display the current status of the PVs.
<pre>
root@ubuntu:~# pvs
PV VG Fmt Attr PSize PFree
/dev/sdb1 lvm2 -- 2.00g 2.00g
/dev/sdc1 lvm2 -- 2.00g 2.00g
</pre>

==Creating a VG==
The PVs, that have been created before, are now summarized to a VG.
<pre>
root@ubuntu:~# vgcreate vg00 /dev/sdb1 /dev/sdc1
Volume group "vg00" successfully created
</pre>
The "pvdisplay" now shows that a VG was created with the PVs:
<pre>
root@ubuntu:~# pvdisplay
--- Physical volume ---
PV Name /dev/sdb1
VG Name vg00
PV Size 2.00 GiB / not usable 3.00 MiB
Allocatable yes
PE Size 4.00 MiB
Total PE 511
Free PE 511
Allocated PE 0
PV UUID fl9ipM-bhhQ-V46G-2iH3-R3yZ-9DsN-JbRmY9

--- Physical volume ---
PV Name /dev/sdc1
VG Name vg00
PV Size 2.00 GiB / not usable 3.00 MiB
Allocatable yes
PE Size 4.00 MiB
Total PE 511
Free PE 511
Allocated PE 0
PV UUID d1iY5L-ac3F-W5Sz-zyaE-uaT3-f66r-I3831o
</pre>
vgdisplay also shows information on VG:
<pre>
root@ubuntu:~# vgdisplay
--- Volume group ---
VG Name vg00
System ID
Format lvm2
Metadata Areas 2
Metadata Sequence No 1
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 0
Open LV 0
Max PV 0
Cur PV 2
Act PV 2
VG Size 3.99 GiB
PE Size 4.00 MiB
Total PE 1022
Alloc PE / Size 0 / 0
Free PE / Size 1022 / 3.99 GiB
VG UUID YTEj9f-9LCT-EOP5-JBEA-YHSz-c0R1-TMzVmy
</pre>
What stands out here is, that the PE size is 4.00 MiB. Since the lvm2-format, the number of PEs is not limited anymore. According to the Man page of vgcreate, a high number of PEs can slow down the tools. However, the number of pEs does not have influence on the I/O-performance of the Logical Volumes. If you want to change the PE-size, add the parameter to "vgcreate"
<pre>
-s, --physicalextentsize PhysicalExtentSize
</pre>
==Creating LVs==

There are different possibilities to specify the size of the LV to be created. However, all LVs require the parameter "-l" or "-L".
*size specification in, for example, Gigabyte:
<pre>
lvcreate -n data -L1G vg00
</pre>
*Percentage of available storage in the VG:
<pre>
lvcreate -n data -l100%VG vg00
</pre>
*Percentage of free storage in the VG:
<pre>
lvcreate -n data -l100%FREE vg00
</pre>
The example in progress is continued by dividing the VG into two equally sized LVs:
<pre>
root@ubuntu:~# lvcreate -n data -l50%VG vg00
Logical volume "data" created
root@ubuntu:~# lvcreate -n data1 -l100%FREE vg00
Logical volume "data1" created
</pre>
Now, the status of the Logical Volume can be taken into consideration:
<pre>
root@ubuntu:~# lvdisplay
--- Logical volume ---
LV Name /dev/vg00/data
VG Name vg00
LV UUID S1btrq-zQZQ-h9oU-2VE6-UNoT-hkqB-Fpv7pG
LV Write Access read/write
LV Status available
# open 0
LV Size 2.00 GiB
Current LE 511
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 252:0

--- Logical volume ---
LV Name /dev/vg00/data1
VG Name vg00
LV UUID Syaml9-d1Ax-RYTs-tSZy-vEyq-yzqW-VoOddZ
LV Write Access read/write
LV Status available
# open 0
LV Size 2.00 GiB
Current LE 511
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 252:1
</pre>
==Creating file system==
Now, the LVs can be formatted with a file system and mounted afterwards:
<pre>
mkfs.ext4 /dev/vg00/data
mkdir data
mount /dev/vg00/data data
</pre>
==Removing LV==
If a LV should be removed, it can be removed via lvremove command:
<pre>
root@ubuntu:~# lvremove /dev/vg00/data_snap
Do you really want to remove active logical volume data_snap? [y/n]: y
Logical volume "data_snap" successfully removed
</pre>
The LV data_snap does no longer appear as an LV. However, the underlying partition is still listed as a PV:
<pre>
--- Physical volume ---
PV Name /dev/sde1
VG Name vg00
PV Size 2.00 GiB / not usable 3.00 MiB
Allocatable yes
PE Size 4.00 MiB
Total PE 511
Free PE 511
Allocated PE 0
PV UUID lKEW15-1YHu-dikC-S0Pm-72UJ-UMPg-fgiW0Y
</pre>
If the partition should be released completely, the PV must be removed from the VG first:
<pre>
root@ubuntu:~# vgreduce vg00 /dev/sde1
Removed "/dev/sde1" from volume group "vg00"
root@ubuntu:~# pvdisplay
"/dev/sde1" is a new physical volume of "2.00 GiB"
--- NEW Physical volume ---
PV Name /dev/sde1
VG Name
PV Size 2.00 GiB
Allocatable NO
PE Size 0
Total PE 0
Free PE 0
Allocated PE 0
PV UUID lKEW15-1YHu-dikC-S0Pm-72UJ-UMPg-fgiW0Y
</pre>
Now, the PV can be also deleted completely to reformat, for example, the hard drive:
<pre>
root@ubuntu:~# pvremove /dev/sde1
Labels on physical volume "/dev/sde1" successfully wiped
</pre>

{{Gschoenberger}}
{{Aranzinger}}
[[Category:LVM]]
[[de:LVM Grundkonfiguration]]

Linux performance analysis in 60 seconds

2026-06-17T13:17:30Z

Aranzinger:

When a critical '''performance issue''' arises on a [[Linux]] server, there is often little time to analyze the problem in detail. Brendan Gregg, computer performance analyst and kernel engineer, describes in a blog posting and in a video, '''which Linux commands he uses for the performance analysis in the first 60 seconds'''.

== Commands for performance analysis ==
The following commands are recommended by Brendan Gregg:<ref>[http://techblog.netflix.com/2015/11/linux-performance-analysis-in-60s.html Linux Performance Analysis in 60,000 Milliseconds] (techblog.netflix.com, 30.11.2015)</ref>
<pre>
uptime
dmesg | tail
vmstat 1
mpstat -P ALL 1
pidstat 1
iostat -xz 1
free -m
sar -n DEV 1
sar -n TCP,ETCP 1
top
</pre>

More information on these commands can be found in the following articles:
* vmstat: [[Linux Performance Measurements using vmstat]]
* mpstat: [[Linux CPU performance measurements with mpstat]]
* iostat: [[Linux I/O Performance measurements with iostat]]
* free: [[Linux Page Cache Basics]]
* sar: [[Collect and report Linux System Activity Information with sar]]
* top: [[Linux-tool top]]

== Video ==
In this video, Brendan Gregg shows how to execute these commands in 60 seconds:<ref>[http://www.brendangregg.com/blog/2015-12-03/linux-perf-60s-video.html Linux Performance Analysis in 60s (video)] (www.brendangregg.com/blog, 03.12.2015)</ref>

{{#widget:YouTube|id=ZdVpKx6Wmc8}}

== References ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category:Linux Performance]]
[[de:Linux Performance Analyse in 60 Sekunden]]

Docker basics - the most important terms

2026-06-17T12:17:57Z

Aranzinger: Created page with "This article provides an introduction in Docker and shows useful terms, which can be useful when using Docker and Docker containers: <pre> # Start container docker container run <IMAGENAME> starts a container based on an image (Example: checkmk/check-mk-raw:2.2.0-latest) # List containers (active) docker ps displays a list of all containers that are currently active # List containers (all) docker ps -all displays all containers on the system including those that ha..."

This article provides an introduction in Docker and shows useful terms, which can be useful when using Docker and Docker containers:

<pre>
# Start container
docker container run <IMAGENAME> starts a container based on an image (Example: checkmk/check-mk-raw:2.2.0-latest)

# List containers (active)
docker ps displays a list of all containers that are currently active

# List containers (all)
docker ps -all displays all containers on the system including those that have been stopped.

# Stop container
docker stop <CONTAINER-NAME> stops a container

# Reboot container
docker restart <CONTAINER-NAME> restarts a Docker container

# Delete container
docker remove <CONTAINER-NAME> deletes a container

# Display container volume
docker volume ls displays all created container volumes

# Delete container volume
docker volume rm <VOLUME-NAME> - deletes a named volume

# Execute container shell command in container
docker exec <CONTAINER-NAME> <COMMAND> executes the command and displays the output on its own terminal (locally)

# Open the interactive full shell in the container (interactive terminal)
docker exec -it <CONTAINER-NAME> bash

# Display container logs:
docker container logs <CONTAINER-NAME>
</pre>

{{jsterr}}
{{Aranzinger}}
[[Category:Docker]]
[[de:Docker Grundlagen - die wichtigsten Befehle]]

Measuring TCP and UDP Network Performance with iperf

2026-06-17T08:44:44Z

Aranzinger:

'''iperf''', the open-source tool, allows to measure the maximum TCP and UDP network bandwidth. It is an alternative for netperf<ref>[http://www.netperf.org/ Netperf] (www.netperf.org)</ref>.

== Installation ==
Iperf is already included in the Debian and Ubuntu repository, which means that an installation is easy possible via <code>apt-get install iperf</code>.

For RHEL and CentOS, the package is available in the EPEL<ref>[http://dl.fedoraproject.org/pub/epel/6/x86_64/repoview/iperf.html IPerf Paket aus EPEL Repository] (download.fedora.redhat.com)</ref> repository.

Alternatively, the source code can be downloaded from the IPerf website <ref>[http://sourceforge.net/projects/iperf/files/ IPerf] (sourceforge.net)</ref>.

== Use ==
Iperf works according to the client-sever model, which means that the iperf daemon must be started first on a server and then connects to the iperf client. Client and server are included in the same binary. When entering the IP address for the client, be sure to select the one associated with the network interface you want to test.

=== Measure TCP performance ===
In this case, the TCP performance of a 1 GBit network card is measured.

Server1:
<pre>
[root@server1 ~]# iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
[ 4] local 192.168.255.1 port 5001 connected with 192.168.255.2 port 39838
[ ID] Interval Transfer Bandwidth
[ 4] 0.0-10.0 sec 1.10 GBytes 941 Mbits/sec
</pre>

Server2:
<pre>
[root@server2 ~]# iperf -c 192.168.255.1
------------------------------------------------------------
Client connecting to 192.168.255.1, TCP port 5001
TCP window size: 16.0 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.255.2 port 39838 connected with 192.168.255.1 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 1.10 GBytes 944 Mbits/sec
</pre>

=== Measure UDP performance ===
The UDP performance is measured on the same system. In this case, the used bandwidth (-b) must be stated. The default here is only 1 MBit per second.

Server1:
<pre>
[root@server1 ~]# iperf -s -u
------------------------------------------------------------
Server listening on UDP port 5001
Receiving 1470 byte datagrams
UDP buffer size: 126 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.255.1 port 5001 connected with 192.168.255.2 port 40612
[ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams
[ 3] 0.0-10.0 sec 889 MBytes 746 Mbits/sec 0.065 ms 621/634707 (0.098%)
[ 3] 0.0-10.0 sec 1 datagrams received out-of-order
</pre>

Server2:
<pre>
[root@server2 ~]# iperf -c 192.168.255.1 -u -b 1000M
------------------------------------------------------------
Client connecting to 192.168.255.1, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 126 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.255.2 port 40612 connected with 192.168.255.1 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 890 MBytes 746 Mbits/sec
[ 3] Sent 634708 datagrams
[ 3] Server Report:
[ 3] 0.0-10.0 sec 889 MBytes 746 Mbits/sec 0.065 ms 621/634707 (0.098%)
[ 3] 0.0-10.0 sec 1 datagrams received out-of-order
</pre>

== Hints for 10G/40G tests ==
When testing 40 Gbit/s connections, it is possible that an individual CPU-core can become a bottleneck. In this case, it is recommended that several parallel tests are operated on different ports.

More information on this topic can be found, for example, on the following pages:
* [https://fasterdata.es.net/host-tuning/linux/100g-tuning/ 40G/100G Tuning] (fasterdata.es.net)
* [https://fasterdata.es.net/performance-testing/network-troubleshooting-tools/iperf/multi-stream-iperf3/ iperf3 at 40Gbps and above] (fasterdata.es.net)
* [https://calomel.org/network_performance.html Network Tuning and Performance: a simple guide to enhancing network speeds] (calomel.org)

== References ==
<references/>

{{Cmitasch}}
{{Aranzinger}}
[[Category:Linux Networking]]
[[Category:Linux Performance]]
[[de:TCP und UDP Netzwerk Performance mit iperf messen]]

Permanently Change the Root Data Directory in Docker

2026-06-17T05:40:20Z

Aranzinger: Created page with "This article explains how to permanently switch the default root data directory <code>/var/lib/docker/</code> to a different directory. == Background information == The <code>/var/lib/docker</code> directory stores all images, volumes from Docker and can grow significantly depending on how many containers are used. The directory is structured as follows:<pre> root@js-checkmk-02:/var/lib/docker# ls buildkit containers engine-id image network overlay2 plugins runt..."

This article explains how to permanently switch the default root data directory <code>/var/lib/docker/</code> to a different directory.

== Background information ==
The <code>/var/lib/docker</code> directory stores all images, volumes from Docker and can grow significantly depending on how many containers are used. The directory is structured as follows:<pre>
root@js-checkmk-02:/var/lib/docker# ls
buildkit containers engine-id image network overlay2 plugins runtimes swarm tmp volumes</pre> You can see that it is used if you, for example, verify the status with df -h:

<pre>root@js-checkmk-02:/var/lib/docker# df -h
Filesystem Size Used Avail Use% Mounted on
udev 3.9G 0 3.9G 0% /dev
tmpfs 794M 684K 794M 1% /run
/dev/sda1 47G 3.8G 41G 9% /
tmpfs 3.9G 0 3.9G 0% /dev/shm
tmpfs 5.0M 0 5.0M 0% /run/lock
/dev/sda15 124M 12M 113M 10% /boot/efi
tmpfs 794M 0 794M 0% /run/user/0
tmpfs 794M 0 794M 0% /run/user/1000
overlay 47G 3.8G 41G 9% /var/lib/docker/overlay2/a6a4203cef42815c7187f584436e5eb9dff385e3ca9c92d597a38806b9dc255d/merged
</pre>

== Configuration ==
First, <code>docker</code> must be stopped, which has immediately influence on all active containers. In addition, we install the tool <code>rsync</code>.<pre>
root@js-checkmk-02:/# systemctl stop docker && apt install rsync
</pre>After this, it must be communicated to Docker where to find the new data root:

<pre># Create directory if it has not been created yet
root@js-checkmk-02:/# mkdir -p /root/docker/root

# Daemon-Datei anlegen in /etc/docker
root@js-checkmk-02:/# nano /etc/docker/daemon.json

# Please add the following into the file, then adjust your path and store it. In this example, we change it to /root/docker/root

{
"data-root": "/root/docker/root"

}
</pre>Next, the whole content of the old docker-root-directory is copied into the new data-root-directory and then the old <code>/var/lib/docker</code> directory is renamed to <code>/var/lib/docker.old</code>.

<pre>rsync -aP /var/lib/docker/ "/root/docker/root"
cp -rp /var/lib/docker/* "/root/docker/root"
mv /var/lib/docker /var/lib/docker.old
</pre>
After that, Docker can be restarted and it should be verified if all containers still function:<pre>
systemctl start docker
</pre>If everything functions, the old data-root-directory can be deleted:<pre>
rm -rf /var/lib/docker.old</pre>

{{jsterr}}
{{Aranzinger}}
[[Category:Docker]]
[[de:Root Data Directory in Docker dauerhaft ändern]]

Checkmk RAW Edition - Docker Container Installation

2026-06-16T11:51:57Z

Aranzinger: Created page with "These instructions show how to install and start the free RAW-edition on a Debian server. == Installation == The installation of Docker on a server is a requirement (see Docker installation on Debian 12). == Container (custom parameter) == Please note: We will provide the default password shortly so that you can log in right away. Otherwise, you may have trouble logging in. Please note that you have to change the following parameters: * <code>-p 8006:5000</cod..."

These instructions show how to install and start the free RAW-edition on a [[Debian]] server.

== Installation ==
The installation of Docker on a server is a requirement (see [[Docker installation on Debian 12]]).

== Container (custom parameter) ==
Please note: We will provide the default password shortly so that you can log in right away. Otherwise, you may have trouble logging in. Please note that you have to change the following parameters:

* <code>-p 8006:5000</code> (This is the port for accessing the Web-UI, default is usually 8080:5000)
* <code>-p 8007:8000</code> (This is the port for the agent communication, default is usually 8000:8000)
* <code>-e CMK_PASSWORD='relation'</code> (The password for the Web-UI user cmkadmin is set here)
* <code>-e MAIL_RELAY_HOST='mail.thomas-krenn.com'</code> (Please state your mail server if it can be used as relay host)
<pre>

root@js-checkmk-02:/home/tk# docker container run -dit -p 8006:5000 -p 8007:8000 --tmpfs /opt/omd/sites/cmk/tmp:uid=1000,gid=1000 -v monitoring:/omd/sites --name monitoring -v /etc/localtime:/etc/localtime:ro -e CMK_PASSWORD='relation' -e MAIL_RELAY_HOST='mail.thomas-krenn.com' --restart always checkmk/check-mk-raw:2.2.0-latest

Unable to find image 'checkmk/check-mk-raw:2.2.0-latest' locally
2.2.0-latest: Pulling from checkmk/check-mk-raw
125a6e411906: Pull complete
1a8b24f9c661: Pull complete
e005a80d7504: Pull complete
727db143e9a5: Pull complete
1c9d1984857d: Pull complete
6261e32c9473: Pull complete
Digest: sha256:c75927b694b02fbd748c48f1aa9469964f3c003757ebbd01c17e21daaeb08b20
Status: Downloaded newer image for checkmk/check-mk-raw:2.2.0-latest
23a12948f6b3d3a8bb0ed1808a9e4aef6f4183509c14b34de8b84175e7a12a00

</pre>

It is searched for the container image online, which will be downloaded. After that, the container will start immediately. You can verify with <code>docker ps</code> if everything has functioned:

<pre>
root@js-checkmk-01:~# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
756a5156e143 checkmk/check-mk-raw:2.2.0-latest "/docker-entrypoint.…" 29 seconds ago Up 28 seconds (health: starting) 6557/tcp, 0.0.0.0:8000->8000/tcp, :::8000->8000/tcp, 0.0.0.0:8080->5000/tcp, :::8080->5000/tcp monitoring
</pre>

== Webinterface ==
You can test the Web-UI with <code>http://IP-DES-DOCKER-SERVERS:8006</code>. Here, we used custom port 8006.

== Login data ==
You can log in using the following data in the login screen. Please note that the password is the one you set when you first started the container!

* User: cmkadmin
* Password: relation

{{jsterr}}
{{Aranzinger}}
[[Category:Docker]]
[[Category:Monitoring]]
[[de:Checkmk RAW Edition - Docker Container Installation]]

Proxmox Backup Server No Subscription Update Repository

2026-06-16T09:08:21Z

Smueller:

The [[Proxmox Backup Server]] provides different package repositories for installing updates. For production systems, Thomas-Krenn.AG recommends using a [[Proxmox Backup Server Support Subscriptions|Proxmox Backup Server Subscription]].

A valid subscription provides access to the extensively tested Enterprise Repository. Depending on the selected subscription level, technical support from Proxmox is also included. Purchasing a subscription also supports the continuous development of Proxmox Backup Server.

For test and development environments, the publicly available No-Subscription Repository can be used instead. It contains newer packages that have not yet undergone the same extensive testing and validation process as the packages in the Enterprise Repository. Therefore, the No-Subscription Repository is not recommended for production systems.

== Error message without a valid subscription ==

After a default installation, the Enterprise Repository is enabled. If no valid subscription is configured, updating the package lists may result in an error similar to the following:

<pre>
apt update
</pre>

<pre>
Err: https://enterprise.proxmox.com/debian/pbs trixie InRelease
401 Unauthorized
E: Failed to fetch https://enterprise.proxmox.com/debian/pbs/dists/trixie/InRelease
E: The repository 'https://enterprise.proxmox.com/debian/pbs trixie InRelease' is not signed.
</pre>

In this case, the Enterprise Repository must be disabled and the No-Subscription Repository must be configured.

The following configuration applies to Proxmox Backup Server 4.x based on Debian 13 “Trixie”.

== Disable the Enterprise Repository ==

By default, the Enterprise Repository is configured in the following file:

<pre>
/etc/apt/sources.list.d/pbs-enterprise.sources
</pre>

The file can be opened using an editor such as <code>nano</code>:

<pre>
nano /etc/apt/sources.list.d/pbs-enterprise.sources
</pre>

The default repository configuration looks similar to the following:

<pre>
Types: deb
URIs: https://enterprise.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
</pre>

To disable the Enterprise Repository, add the following line:

<pre>
Enabled: false
</pre>

The complete file should then look as follows:

<pre>
Types: deb
URIs: https://enterprise.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
Enabled: false
</pre>

Alternatively, the repository file can be removed:

<pre>
rm /etc/apt/sources.list.d/pbs-enterprise.sources
</pre>

Disabling the repository configuration is generally preferable, as it can easily be enabled again later.

== Configure the No-Subscription Repository ==

Create or edit the following file:

<pre>
nano /etc/apt/sources.list.d/proxmox.sources
</pre>

Add the following content:

<pre>
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
</pre>

Alternatively, the file can be created directly from the command line:

<pre>
cat > /etc/apt/sources.list.d/proxmox.sources << 'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF
</pre>

== Verify the repository configuration ==

Update the package lists:

<pre>
apt update
</pre>

The configured package repositories can be checked using the following command:

<pre>
apt policy
</pre>

The output should include the No-Subscription Repository for Debian 13 “Trixie”. The Enterprise Repository should no longer be queried.

The system can then be updated:

<pre>
apt update
apt full-upgrade
</pre>

After kernel updates or other system-level updates, the Proxmox Backup Server should be restarted:

<pre>
reboot
</pre>

== Check for outdated repository files ==

After upgrading from Proxmox Backup Server 3 to Proxmox Backup Server 4, repository entries for Debian 12 “Bookworm” may still be present.

All configured repository files can be checked using the following command:

<pre>
grep -R --line-number --extended-regexp \
'bookworm|trixie|enterprise\.proxmox|download\.proxmox' \
/etc/apt/sources.list \
/etc/apt/sources.list.d/ 2>/dev/null
</pre>

Outdated entries containing <code>bookworm</code> must be removed or disabled. Repository entries for different Debian releases must not be mixed.

{{Smueller}}
[[Category:Proxmox Backupserver]]
[[de:Proxmox Backup Server No Subscription Update Repository]]

Secure SSH login with 2 factor authentication

2026-06-11T10:08:07Z

Aranzinger: /* Configuration */

A SSH shell belongs to the essential management tools on Linux based servers. This shell is already well covered by using certificate based login methods only and by deactivating root logins.
Furthermore, an additional registration step can be added, for example a one-time password, with a second factor. This further enhances security, as a successful login now relies on something you have (the certificate) and something you know (the one-time password). This article shows how to secure '''the SSH login with Google Authenticator as second factor''' on an '''Ubuntu Server 18.04 LTS'''.

== Preparatory measures ==
First, configure certificate-based authentication on your Ubuntu Server 18.04 LTS system using a [[OpenSSH Public Key Authentifizierung unter Ubuntu|OpenSSH Public Key]].

== libpam-google-authenticator ==
The following paragraph provides an insight into the Google Authenticator PAM-module and shows the installation and configuration.

=== Integration ===
The two-factor authentication is connected as PAM module ((Pluggable Authentication Module) to the operating system.

=== Installation ===
The installation of the PAM module from Google Authenticator can be made on Debian and Ubuntu via apt. It is contained in the official package sources.

<code>$ sudo apt install libpam-google-authenticator</code>

=== Compatibility ===
The authentication via PAM module is compatible with a variety of system services. A lot of steps can therefore be further secured using Google Authenticator. The list command applied to the /etc/pam.d/ directory returns the services and tools currently supported in a base installation of Ubuntu 18.04 LTS Server.

<pre>
$ ls -m /etc/pam.d/
atd, chfn, chpasswd, chsh, common-account, common-auth, common-password,
common-session, common-session-noninteractive, cron, login, newusers, other,
passwd, polkit-1, runuser, runuser-l, sshd, su, sudo, systemd-user, vmtoolsd
</pre>

=== Configuration ===
After the PAM module has been installed, it can be presented, initialized and configured as follows:

# Execute Google Authenticator on the console:
#: $ google-authenticator
# Do you want authentication tokens to be time-based (y/n)
#: y, this is used to generate TOTP tokens (time-based one-time password)
#: n, this generates HOTP tokens (counter-based one-time passwords)
#: In this case, the TOTP method is used
# Now, a QR-code is displayed on the SSH-console
#: Scan this code with a compatible app on your smartphone
#: Copy and store the keys listed below safely.
#: With the ''emergency scratch codes,'' the login can be performed without OTP
# Update the ''.google_authenticator'' file with this information.
#: For this, type ''y''.
# Confirm all other questions with ''y'' or with ''n'' if you want to use different settings.

== Integration into SSH-login ==
The Google Authenticator PAM module is fully configured. Now, these services, such as the SSH daemon, can be adjusted to enable a two-factor authentication through it.

'''Important hint:''' If the following configuration is made via SSH session, be sure to keep the current session open and test it in parallel with a second session. If the SSH daemon is misconfigured, you will no longer be able to log in.

=== Adjustments in /etc/pam.d/sshd ===
Open the /etc/pam.d/sshd file with an editor. Comment out the line ''@include common-''auth and add the line for Google Authenticator below it. Store and close the file afterwards.

<pre>
[...]
# Standard Un*x authentication.
#@include common-auth
[...]
# Google Authenticator
auth required pam_google_authenticator.so
</pre>

=== Adjust sshd_config ===
In the configuration file ''/etc/ssh/sshd_config'', you can now set '''ChallengeResponseAuthentication''' to ''yes''.
<pre>
[...]
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication yes
[...]
</pre>

Also, check that UsePAM is set to yes and add the following line below it: '''AuthenticationMethods'''. In this example, an authentication is accepted via public key and one-time password.<ref>[http://manpages.ubuntu.com/manpages/bionic/man5/sshd_config.5.html sshd_config — OpenSSH SSH daemon configuration file] (manpages.ubuntu.com)</ref>

<pre>
[...]
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive
[...]
</pre>

=== Restart SSH daemon ===
Now, you can restart the SSH daemon to activate the configuration.

<pre>$ sudo systemctl restart sshd.service</pre>

=== Login process ===
The following screenshots show the login process of an SSH shell with activated two-factor authentication by Google Authenticator.
<gallery>
File:Ubuntu-Bionic-SSH-Login-01.png|Start the SSH session. You will now be asked for the time-based one-time password. Open your app and enter the six-digit numeric code.
File:Ubuntu-Bionic-SSH-Login-02.png|After entering TOTP, the login is made on the Ubuntu server 18.04 LTS system.
</gallery>

== References ==
<references />

{{Tniedermeier}}
{{Aranzinger}}
[[Category:SSH]]
[[de:SSH-Login mit 2-Faktor-Authentifizierung absichern]]

Restrict executable SSH-commands via authorized keys

2026-06-11T07:56:38Z

Aranzinger: Created page with " The '''OpenSSH''' secure shell server allows a secure and encrypted remote access on Linux and Unix systems. On the server side, the '''authorized_keys''' file in the ''.ssh'' folder is primarily used for configuring a SSH public key authentication under Ubuntu. Normally, a user is granted '''full access''' on the system, on which the authentication was set up. In some cases, such as automatized backup processes, it is useful that the access is restricted to just a..."

The '''OpenSSH''' secure shell server allows a secure and encrypted remote access on Linux and Unix systems. On the server side, the '''authorized_keys''' file in the ''.ssh'' folder is primarily used for configuring a [[SSH public key authentication under Ubuntu]]. Normally, a user is granted '''full access''' on the system, on which the authentication was set up. In some cases, such as automatized backup processes, it is useful that the access is restricted to just a few, or even just a single '''command'''. The successful configuration steps are explained in this article.

== Purpose ==
The restriction of executable commands via SSH is mainly used for automatized backups. The dedicated backup users mostly have a private key without key phrase to execute automated backups. On the backup destination server, the public key of the user is added to the ''authorized_keys'' file so that this user can connect without entering a password.

Strictly speaking, from this point on, the user would actually have full access to the backup server, even though, for example, the "rsync" command is always used.

A command restriction for the user avoids that if the private key is compromised, the backup server is automatically compromised as well. As the user is restricted to a command in the ''authorized_keys'' file, it is not allowed to execute another command or to establish a terminal session via SSH.

== Restrict to a single command in authorized_keys ==
The '''/~/.ssh/authorized_keys''' file contains the public key of the user that is allowed to connect. (see also [[SSH public key authentication under Ubuntu]]):
<source lang="bash">
:~$ cat .ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCj98R[...]
</source>
To restrict the user to a single command, the parameter '''command=''' is entered before the key. After that, whenever an attempt is made to establish an SSH connection, only this command will be executed, even if, for example, a different command was provided.<ref name="sshdef">[http://oreilly.com/catalog/sshtdg/chapter/ch08.html Per-Account Server Configuration] (oreilly.com)</ref> In the following example, the user ''dailybackup'' is restricted to the ''date'' command for demonstration purposes.
For this, the ''command=date'' parameter is defined on the SSH-server:
<source lang="bash">
:~$ cat .ssh/authorized_keys
command="date" ssh-rsa AAAA[...]
</source>
From the client computer that connects to the server via SSH, the only command the user can then execute is ''date'':
<source lang="bash">
:~$ ssh dailybackup@192.168.56.105
Wed Apr 30 14:46:53 CEST 2014
Connection to 192.168.56.105 closed.
:~$ ssh dailybackup@192.168.56.105 "tail /etc/passwd"
Wed Apr 30 14:47:02 CEST 2014
</source>

== Analyse executed command on SSH-server ==
The analysis, which command must be entered in ''authorized_keys'', is made easier by the environment variable ''$SSH_ORIGINAL_COMMAND'':
<source lang="bash">
command="/bin/echo You invoked: $SSH_ORIGINAL_COMMAND" ssh-rsa AAAAB[..]
</source>
When a command is issued from the client, the command executed on the server is then displayed for analysis purposes:
<source lang="bash">
:~$ ssh dailybackup@192.168.56.105 tail /etc/passwd
You invoked: tail /etc/passwd
</source>

Some commands, for example ''rsync'', lead to an error message when used with the above ''command''. By taking a roundabout route using a script on the SSH server, the command, that was executed, can be also accessed: <ref name="sshdef" />
<source lang="bash">
:~$ vi logssh.sh
#!/bin/sh
if [ -n "$SSH_ORIGINAL_COMMAND" ]
then
echo "`/bin/date`: $SSH_ORIGINAL_COMMAND" >> $HOME/ssh-command-log
exec $SSH_ORIGINAL_COMMAND
fi
:~$ vi .ssh/authorized_keys
command="/home/dailybackup/logssh.sh" ssh-rsa AAAAB3N[...]
</source>
The client then calls up rsync:
<source lang="bash">
:~/tmp$ rsync -avz test.txt dailybackup@192.168.56.105:/home/dailybackup
sending incremental file list
[...]
</source>
The command executed via SSH appears in the log file on the SSH server. This command can be used again via ''command='' for restrictions:
<source lang="bash">
:~$ cat ssh-command-log
Wed Apr 30 15:10:54 CEST 2014: rsync --server -vlogDtprze.iLsf . /home/dailybackup
</source>

'''Hint:''' For problems with output redirection, <code>exec</code> can be used instead of <code>eval</code>

== Restrict multiple commands in authorized_keys ==
In general, it is possible via additional scripts to allow multiple commands for a key pair.

However, for maximum security, it is easier to generate a private key pair for every desired command and to safe the corresponding command.

== References ==
<references />

{{Gschoenberger}}
{{Aranzinger}}
[[Category:SSH]]
[[de:Ausführbare SSH-Kommandos per authorized keys einschränken]]

OpenSSH public key authentication fails

2026-06-11T06:25:36Z

Aranzinger: Created page with "This article describes how to resolve issues with SSH authentication using public key authentication. In the article SSH key login, it is explained how to set up public key authentication in general. == Server-side problems == In most cases, the reason why public key authentication is not working can be found in the file and directory permissions. The home directory on the server as well as the sub-directory .ssh is not allowed to have writing right..."

This article describes how to resolve issues with SSH authentication using public key authentication. In the article [[SSH Key Login|SSH key login]], it is explained how to set up public key authentication in general.

== Server-side problems ==
In most cases, the reason why public key authentication is not working can be found in the file and directory permissions. The home directory on the server as well as the sub-directory .ssh is not allowed to have writing rights for group and other. Furthermore, the file <code>authorized_keys</code> must be accessible only to the owner.

To set the rights correctly, log in to the server with the user for whom the SSH authentication should function.
<pre>
chmod go-w $HOME $HOME/.ssh
chmod 600 $HOME/.ssh/authorized_keys
chown `whoami` $HOME/.ssh/authorized_keys
</pre>

If this is not possible, you can alternatively deactivate the right verification of the server. The following option must be entered in the <code>/etc/ssh/sshd_config</code> file:
StrictModes no

Another error source can be the wrong settings in <code>/etc/ssh/sshd_config</code>. Here is an extract of options that can influence the public key authentication:
* AuthorizedKeysFile
* PreferredAuthentications
* PubkeyAuthentication

More settings can be found in the '''man sshd_config''' manpage.

== Client-sided problems ==
Alternatively, there may still be issues on the client side, that is, on the computer from which the SSH connection is initiated.

If the file rights are set open for the private key, the following error message is displayed by the SSH client:
<pre>
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for 'xyz' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: xyz
Permission denied (publickey,gssapi-with-mic).
</pre>

In this case, the private key is ignored. Set the rights correctly using the following command:
chmod 600 $HOME/.ssh/<Keyname>

Another possible error source could be a wrong setting in <code>.ssh/config</code> or <code>/etc/ssh/ssh_config</code>. An excerpt of possible options that may affect public key authentication, can be found here:
* PreferredAuthentications
* PubkeyAuthentication

All settings can be found in the '''man ssh_config''' manpage.

== Sources: ==
* http://www.openssh.org/faq.html#3.14

{{Cmitasch}}
{{Aranzinger}}
[[Category:SSH]]
[[de:OpenSSH Public Key Authentication schlägt fehl]]

AMD Security Vulnerabilities - June 2026

2026-06-10T12:16:49Z

Aranzinger: Created page with "On '''June 9th, 2026''', AMD published the security bulletins '''AMD-SB-3039'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3039.html ASP non-Coherent Memory Access – June 2026] (www.amd.com/en/resources/product-security)</ref> and '''AMD-SB-9025'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9025.html AMD uProf Vulnerabilities – June 2026] (www.amd.com/en/resources/product-security)</ref> for security vulnerabili..."

On '''June 9th, 2026''', AMD published the security bulletins '''AMD-SB-3039'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3039.html ASP non-Coherent Memory Access – June 2026] (www.amd.com/en/resources/product-security)</ref> and '''AMD-SB-9025'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9025.html AMD uProf Vulnerabilities – June 2026] (www.amd.com/en/resources/product-security)</ref> for security vulnerabilities.

== Information ==
'''AMD-SB-3039''': This is a malicious hypervisor that can undermine the integrity protection mechanisms of AMD Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP), by forcing AMD Security Processor (ASP) to work with the system storage without cache coherence. According to the publication, system settings controlled by the hypervisor enable the reconfiguration of the interaction between the storage requirements of the ASP and the CPU-cache. By disabling coherence, the ASP can read stale data from the DRAM when copying pages and updating the associated metadata, causing the guest to lose the most recent updates in the CPU cache. This could potentially undermine the integrity warranties of the SEV-SNP for guests and could cause data corruption.

'''AMD-SB-9025''': The vulnerability could allow a local attacker with user privileges to write to memory assigned by the kernel. AMD confirms that the issue occurs because from the driver creating a shared-section object with a NULL security descriptor and exposing kernel pointers in shared memory, which could allow an attacker to write to kernel-allocated memory and potentially cause a system crash or a denial-of-service condition.

== Affected systems ==

Here is a table listing the affected processors.

===== AMD EPYC™ Processors =====
{| class="wikitable"
|Product
|Mitigation
|-
|AMD EPYC™ 8004 Series Processors
|GenoaPI
1.0.0.H
|-
|AMD EPYC™ 9004 Series Processors
|GenoaPI
1.0.0.H
|-
|AMD EPYC™ 9005 Series Processors
|TurinPI

1.0.0.8
|-
|AMD EPYC™ Embedded 8004 Series Processors
|EmbGenoaPI-SP5

1.0.0.D
|-
|AMD EPYC™ Embedded 9004 Series Processors

(formerly codenamed "Genoa")
|EmbGenoaPI-SP5

1.0.0.D
|-
|AMD EPYC™ Embedded 9004 Series Processors

(formerly codenamed "Bergamo")
|EmbGenoaPI-SP5

1.0.0.D
|-
|AMD EPYC™ Embedded 9005 Series Processors
|EmbeddedTurinPI_SP5

1004
|}

{| class="wikitable"
| align="center" |CVE
| align="center" |CVSS Score
|-
| align="center" |[https://www.cve.org/CVERecord?id=CVE-2026-54509 CVE-2025-54509]
| align="center" |4.0 (Medium)
|-
| align="center" |[https://www.cve.org/CVERecord?id=CVE-2026-0466 CVE-2026-0466]
| align="center" |6.8 (Medium)
|-
| align="center" |[https://www.cve.org/CVERecord?id=CVE-2026-28237 CVE-2026-28237]
| align="center" |6.8 (Medium)
|}

In the following, there is an extract of this table in which all Supermicro mainboards are included that are offered by Thomas-Krenn:<ref>[https://www.supermicro.com/en/support/security_AMD-SB-3027 AMD Security Bulletin AMD-SB-3027, January 2027] (www.supermicro.com)</ref>

{| class="wikitable"
|+
!AMD motherboard
! align="center" |'''BIOS version'''
|-
| align="center" |H13SSW
| align="center" |3.8
|-
| align="center" |H13SSL-N/NT
| align="center" |3.8
|}

=== Updates for Thomas-Krenn products ===
Updates on the corresponding system can be found in the <tklink type="sitex" id="440">download area of Thomas-Krenn</tklink>.
The updates in the download area have been tested by us to guarantee the stability and compatibility of our systems.

If you require the latest version for your system and it is not yet available in our download area, you can get it at
[https://www.asus.com/de/support/download-center/ Asus], [https://www.supermicro.com/en/support/resources/downloadcenter/swdownload Supermicro] or [https://www.gigabyte.com/de/Support/Consumer/Download Gigabyte]

== References ==
<references/>

== More information ==
* [https://www.supermicro.com/en/support/security_AMD-SB-3027 AMD Security Bulletin AMD-SB-3039] (supermicro.com, Juni 2026)

{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category:AMD Safety Information]]
[[de:AMD Sicherheitslücken - Juni 2026]]

Slow SSH login due to DNS timeout

2026-06-10T08:52:47Z

Aranzinger: Created page with "This article describes solutions for when an '''SSH login is slow'''. ==Problem== It takes approximately 10 seconds when you log in to a Linux system via SSH until the password prompt appears. After this, the SSH session functions completely normal. ==Background== The SSH server tries to make a reverse DNS lookup for the IP from which the SSH connection is established. If there is no functioning configured DNS (for example a wrong registered IP for the DNS server in /..."

This article describes solutions for when an '''SSH login is slow'''.

==Problem==
It takes approximately 10 seconds when you log in to a Linux system via SSH until the password prompt appears. After this, the SSH session functions completely normal.

==Background==
The SSH server tries to make a reverse DNS lookup for the IP from which the SSH connection is established. If there is no functioning configured DNS (for example a wrong registered IP for the DNS server in /etc/resolv.conf), it takes 10 seconds until the timeout is reached for the reverse DNS lookup. Then, the password prompt appears.

In the following, information on the use of <code>ssh -v</code> (verbose mode) is listed:
<pre>
[admin@tpw admin]$ ssh -v root@192.168.1.154
OpenSSH_5.1p1, OpenSSL 0.9.8g 19 Oct 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.1.154 [192.168.1.154] port 22.
debug1: Connection established.
debug1: identity file /home/admin/.ssh/identity type -1
debug1: identity file /home/admin/.ssh/id_rsa type -1
debug1: identity file /home/admin/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-5
debug1: match: OpenSSH_5.1p1 Debian-5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.1.154' is known and matches the RSA host key.
debug1: Found key in /home/admin/.ssh/known_hosts:153
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
</pre>
Now, it takes ten minutes until it continues:
<pre>
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/admin/.ssh/identity
debug1: Trying private key: /home/admin/.ssh/id_rsa
debug1: Trying private key: /home/admin/.ssh/id_dsa
debug1: Next authentication method: password
root@192.168.1.154's password:
</pre>
After entering the password, it continues:
<pre>
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.utf8
Linux debian5 2.6.9-023stab048.6-smp #1 SMP Mon Nov 17 18:41:14 MSK 2008 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Jun 17 13:20:19 2009 from 192.168.1.52
debian5:~#
</pre>

==Solution==
On the target system, either add the IP address of the computer from which the connection is being established to /etc/hosts, or make sure that the DNS configuration on the target system is working properly.

===Enter IP in /etc/hosts===
The IP can be, for example, entered in /etc/hosts as follows:
<pre>
root@debian5:/# echo "192.168.1.52 laptop" >> /etc/hosts
root@debian5:/# cat /etc/hosts
127.0.0.1 debian5 localhost localhost.localdomain

::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
192.168.1.52 laptop
root@debian5:/#
</pre>

===Verify DNS configuration===
In the example, an incorrect DNS server was configured on the Debian 5 target system. The configuration was corected as follows:
<pre>
root@debian5:/# cat /etc/resolv.conf
nameserver 10.10.18.1
root@debian5:/# echo "nameserver 192.168.1.254" > /etc/resolv.conf
root@debian5:/# cat /etc/resolv.conf
nameserver 192.168.1.254
root@debian5:/#
</pre>

==More information==
* [http://www.macosxhints.com/article.php?story=20050329185832952 macosxhints.com: A possible fix for slow SSH connections ]

{{Wfischer}}
{{Aranzinger}}
[[Category:SSH]]
[[pl:Logowanie przez ssh powolne przez DNS Timeout]]
[[de:SSH Login langsam durch DNS Timeout]]

OpenSSH configuration

2026-06-10T06:30:22Z

Aranzinger: Created page with "The following configuration describes advanced OpenSSH configurations that can be expaned as needed. If you have more interesting contents, kindly send us a message. An overview of all server-side SSH configuration options can be found in the manpage of sshd_config. man sshd_config === Conditional configuration with "Match" === "Match", the configuration option, allows a global configuration (for example in <code>/etc/ssh/sshd_config</code>) to ove..."

The following configuration describes advanced OpenSSH configurations that can be expaned as needed. If you have more interesting contents, kindly send us a [[Special:contact|message]].

An overview of all server-side SSH configuration options can be found in the manpage of sshd_config.
man sshd_config

=== Conditional configuration with "Match" ===
"Match", the configuration option, allows a global configuration (for example in <code>/etc/ssh/sshd_config</code>) to overwrite one that is conditional. The following conditions are possible:
* User
* Group
* Host
* Address[

Here is an example for a configuration in /etc/ssh/sshd_config:
<pre>
PasswordAuthentication no
...

Match User admin
PasswordAuthentication yes
</pre>

In this case, the password authentication is deactivated globally. However, it was subsequently enabled for the "admin" user using a MATCH statement.

In general, "Match" is only for one option allowed:

AllowAgentForwarding, AllowTcpForwarding, Banner, ChrootDirectory, ForceCommand, GatewayPorts, GSSAPIAuthentication, HostbasedAuthentication, KbdInteractiveAuthentication, KerberosAuthentication, MaxAuthTries, MaxSessions, PasswordAuthentication, PermitEmptyPasswords, PermitOpen, PermitRootLogin, PubkeyAuthentication, RhostsRSAAuthentication, RSAAuthentication, X11DisplayOffset, X11Forwarding und X11UseLocalHost

=== VPN with OpenSSH ===
OpenSSH offers from version 4.3 the opportunity to set up a VPN tunnel. This creates a tun device on both the local and remote sides. As soon as it has been configured, the VPN can be used.

The "uml-utilities" package must be installed in advance on Ubuntu/Debian. This comes with the '''tunctl''' binary.

The SSH sever configuration '''sshd_config''' must be expanded by the following options:
PermitRootLogin yes
PermitTunnel yes

A tunnel can be set up with the option '''"-w"''':
ssh -w 0:0 1.2.3.4

After this, a "tun0" interface should be visible on both sides. An IP address must then be assigned to it.

You may need to enable IP forwarding.
echo 1 > /proc/sys/net/ipv4/ip_forward

For long-term VPN use, we recommend the use of [[OpenVPN with Pre-shared Key|OpenVPN]], which is much easier to configure and automate.

More information can be found here: https://help.ubuntu.com/community/SSH_VPN

{{Cmitasch}}
{{Aranzinger}}
[[Category:SSH]]
[[de:OpenSSH Konfiguration]]

Samba-server basics

2026-06-09T11:35:50Z

Aranzinger: Created page with "A '''Samba-Server''' helps with the integration of '''Windows- and Unix/Linux computers'''.<ref>[http://www.oreilly.de/german/freebooks/samba2ger/ch01.html#936841 Samba, 2. Auflage] www.oreilly.de</ref> '''Files''' can be, for example, exchanged or '''printers''' can be shared. The name Samba comes from the SMB protocol ('''''Server Message Block'''''), which is used for network-based data exchange on Windows. These days, people are increasingly referring to the "'''''Co..."

A '''Samba-Server''' helps with the integration of '''Windows- and Unix/Linux computers'''.<ref>[http://www.oreilly.de/german/freebooks/samba2ger/ch01.html#936841 Samba, 2. Auflage] www.oreilly.de</ref> '''Files''' can be, for example, exchanged or '''printers''' can be shared. The name Samba comes from the SMB protocol ('''''Server Message Block'''''), which is used for network-based data exchange on Windows. These days, people are increasingly referring to the "'''''Common Internet File System'''''" (CIFS) instead of SMB. CIFS is a further development of SMB and was developed by Microsoft.<ref>[http://msdn.microsoft.com/en-us/library/aa365233%28v=vs.85%29.aspx SMB and CIFS overview] (msdn.microsoft.com)</ref>

A free online book by O'Reilly provides detailed information about Samba/CIFS in German. It is available at [http://www.oreilly.de/german/freebooks/samba2ger/ Oreilly Samba 2nd edition]. Furthermore, the Samba community provides a detailed documentation about Samba: [https://help.ubuntu.com/community/Samba Samba Community]. This article presents the basics of working with a Samba server that is set up on '''Ubuntu 10.04 LTS'''.

__TOC__
== Server ==
=== Installation ===
The Samba package <ref>[http://packages.ubuntu.com/lucid/samba Samba Package] (packages.ubuntu.com)</ref> is installed on the server so that a file and print server can be set up.
<source lang="bash">
apt-get install samba
</source>

=== Configuration ===
The central configuration file is located at
<source lang="bash">
sudo vi /etc/samba/smb.conf
</source>
The corresponding man page provides a range of information on how to configure the Samba server using this file:
<source lang="bash">
man smb.conf
</source>
The file is divided into several parts. The global section ([global]) includes basic settings that may be followed by other sections on the release of resources.

As the first step in the configuration, comment out the following line in the "Authentication" section:
<source lang="bash">
# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
security = user
</source>
Due to these security measures, an existing user account on the server is required to access the Samba shares.<ref>[https://help.ubuntu.com/10.04/serverguide/C/samba-fileprint-security.html Samba Security] (help.ubuntu.com)</ref>

==== Network interfaces ====
If your server possesses multiple network interfaces, it may be that the smb-server is connected to the wrong interface. To do this, the line
<source lang="bash">
interfaces = 192.168.1.1/24
</source>
can be added to the "[global]" area of smb.conf. In this example, the SMB server listens on the address range in the 192.168.1.1/24 network.<ref>http://tldp.org/HOWTO/SMB-HOWTO-6.html</ref>

==== Add smb password ====
The following command creates a smb-password for the existing user "smbuser". It is important that this step is performed for an existing user, as every smb-user needs a valid account on the server. The password you set can be used later to access the SMB share:
<source lang="bash">
sudo smbpasswd -a smbuser
</source>
As the smb-password does not have to comply with the password of the actual account, it can definitely time-consuming to administrate different passwords. On Ubuntu, the "libpam-smbpass" package exists, which can be used to keep Linux and smb passwords synchronized.

So that the changes are effective, the server must reload the configuration:
<source lang="bash">
sudo service smbd reload
</source>
Zuvor können die modifizierten Einstellungen auch auf ihre Korrektheit geprüft werden:
<source lang="bash">
testparm /etc/samba/smb.conf
</source>

=== Add a resource ===
In the following configuration example, the home directories of the smb-users are released. In the first step, a new resource is added to the "smb.conf" file:
<source lang="bash">
sudo vi /etc/samba/smb.conf
</source>
The following paragraph is commented out:
<source lang="bash">
# Un-comment the following (and tweak the other settings below to suit)
# to enable the default home directory shares. This will share each
# user's home directory as \\server\username
[homes]
comment = Home Directories
browseable = yes
</source>
Now, the home-directories are available for all users, which means that the users can access each other´s directories (provided, of course, that an SMB password has been set and the user therefore has access to the SMB server). The parameter "browseable" allows Windows users to browse the Samba share using Windows Explorer.
To be more restrictive with home directories, the following line can be commented out:
<source lang="bash">
# By default, \\server\username shares can be connected to by anyone
# with access to the samba server. Un-comment the following parameter
# to make sure that only "username" can connect to \\server\username
# This might need tweaking when using external authentication schemes
valid users = %S
</source>
Then, for example, the user "tktest" will no longer be able to access the home directory of "smbuser" (from clients perspective):
<source lang="bash">
sudo mount -t smbfs //192.168.56.101/smbuser /media/ -o username=tktest
Password:
mount error(13): Permission denied
</source>
Further security measures are presented, for example, on [https://help.ubuntu.com/10.04/serverguide/C/samba-fileprint-security.html Samba Security] (help.ubuntu.com) or [http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-samba.html Securing samba] (samba.org).

== Client ==
=== Installation ===
The following package is required for the access on the smb-server on the client:
<source lang="bash">
sudo apt-get install smbfs smbclient
</source>
With the smbclient, an initial connection test can be started:
<source lang="bash">
smbclient -U smbuser -L 192.168.56.101
</source>

=== Mounting of smb share ===
With the mount command, the smb directory can be integrated locally:
<source lang="bash">
sudo mount -t cifs //192.168.56.101/smbuser /media/ -o username=smbuser
</source>
After this command, the smb-directory will be accessible at "/media/

== References ==
<references />

{{Aranzinger}}
[[Category:Ubuntu]]
[[de:Samba-Server Grundlagen]]

Supermicro BMC Security Advisories June 2026

2026-06-09T05:30:51Z

Aranzinger: Created page with "In '''June 2026''', Supermicro published security advisories for the BMC-firmware of its mainboards. This security vulnerability requires a '''firmware update'''. In this article, you will find information on this security advisory and where to find updates on Thomas-Krenn products. == Security advisories == {| class="wikitable" |- style="background-color: #EFEFEF; font-weight: bold;" ! align="center" |CVE ! align="center" |Risk potential: ! align="center" |Title |-..."

In '''June 2026''', Supermicro published security advisories for the BMC-firmware of its mainboards. This security vulnerability requires a '''firmware update'''.

In this article, you will find information on this security advisory and where to find updates on Thomas-Krenn products.

== Security advisories ==
{| class="wikitable"
|- style="background-color: #EFEFEF; font-weight: bold;"
! align="center" |CVE
! align="center" |Risk potential:
! align="center" |Title
|-
|align="center" | [https://www.cve.org/CVERecord?id=CVE-2026-3820 CVE-2026-3820]
| align="center" | 7.2 (high)
| align="center" | '''Command-Injection''' (The security vulnerability allows an attacker to get administrator rights and to manipulate the SMTP service configuration. This could cause the system to execute unintended commands when calling processes)
|-
|}

== Updates for Thomas-Krenn products ==
Updates on the corresponding system can be found in the <tklink type="sitex" id="440">download area of Thomas-Krenn</tklink>.
The updates in the download are have been tested by us to guarantee the stability and compatibility of our systems.

If you require the latest version for your system and it is not yet available in our download area, you will find it at [https://www.asus.com/de/support/download-center/ Asus] or [https://www.supermicro.com/en/support/resources/downloadcenter/swdownload Supermicro].

== More information ==
* [https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026 Vulnerabilities in Supermicro BMC firmware, June 2026]
{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category: Server Hardware]]
[[de:Supermicro BMC Sicherheitshinweise Juni 2026]]

Samba Sharing with Authentication

2026-06-08T13:06:35Z

Aranzinger: Created page with "As a supplement to a basic Samba share, this article shows you how to set up a username- and password-based Samba share using a Debian 8-based system. Ubuntu 16.04 as well as Windows 10 is used as client software to test the connection. Information on the fundamental and unrestricted release can be found in the article Simple Samba Shares in Debian. == Installation and configuration on Debian server == The following paragraphs show the required configuration..."

As a supplement to a basic Samba share, this article shows you how to set up a username- and password-based Samba share using a [[Debian]] 8-based system. [[Ubuntu]] 16.04 as well as Windows 10 is used as client software to test the connection. Information on the fundamental and unrestricted release can be found in the article [[Simple Samba Shares in Debian]].

== Installation and configuration on Debian server ==
The following paragraphs show the required configuration steps on a Debian server to set up the Samba server. The shared folder can then be mounted using a Linux-based or Windows-based client.

=== Installation of the Samba service ===
The [[Simple Samba Sharing on Debian#Installation of Samba service|Installation of Samba service]] and the basic [[Einfache Samba Freigabe unter Debian#Konfiguration|configuration]] is done in the same way as for the article [[Simple Samba Shares in Debian]].

=== User-restricted configuration ===
This configuration example shows how to do a '''SMB-Share with authentication'''. To do this, a user named "smbuser" is created on the Debian system, and a ''restricted'' share entry is added to the ''smb.conf'' configuration file.

# Create SMB-user
#:<pre>$ sudo useradd -s /bin/false smbuser</pre>
# Set password
#:<pre>$ sudo smbpasswd -a smbuser</pre>
# Entry in the ''smb.conf'' file:
<pre>
[global]
workgroup = smb
security = user
map to guest = never

[homes]
comment = Home Directories
browsable = no
read only = no
create mode = 0750

[restricted]
valid users = smbuser
#We restrict the acces on the ''smbuser'' user
#valid users = @smbusers
#Alternatively, it can also be restricted to one user group.
path = /media/storage2/
public = no
writable = yes
comment = smb restricted share
printable = no
guest ok = no
create mask = 0600
directory mask = 0700
</pre>

This configuration uses the example mountpoint ''/media/storage2''.
To restrict access to the shared folder as much as possible, this ''/media/storage2'' mountpoint is assigned to the ''smbuser'' user and equipped with the directory rights 700 so that this user (and root) receives reading and writing rights.

: <pre>$sudo chown -R smbuser:smbuser /media/storage2</pre>
: <pre>$sudo chmod 700 /media/storage2</pre>

=== Restart Samba ===
To apply the configuration, you have to restart the Samba service. This is made on Debian 8 with ''systemd''.

: <pre>$ sudo systemctl restart smbd.service</pre>

== Mounting of release ==
After the Samba server has been configured and restarted completely, the created share can now be used by clients. This is explained in the following sections using an Ubuntu 16.04 and a Windows 10 client.

=== On a Linux-based client ===
The '''cifs-utils''' package is used in all current Linux-based distributions. Up to and including [[Ubuntu]] 12.04, the old '''smbfs''' package could be used.<ref>[https://wiki.ubuntuusers.de/Samba_Client_cifs/ Samba Client cifs] (wiki.ubuntuusers.de)</ref>

: <pre>$ apt-get install cifs-utils</pre>

The Samba user ''smbuser'', as configured on the Debian system, is used, and you will be prompted for the password.
<pre>
$ sudo mount -t cifs //<IP-des-Samba-Servers>/restricted /media/tniedermeier/test -o user=smbuser
Password for smbuser@//<IP-des-Samba-Servers>/restricted: ********
</pre>

Further information on mounted releases can be received using the "mount" command in the terminal.

=== On a Windows 10 client ===
The share can be connected to a Windows 10 client as explained in the following section. There are multiple opportunities to establish a connection.

You can connect to the network drive using the following command in the command prompt:<ref>[https://technet.microsoft.com/en-us/en-en/library/gg651155(v=ws.11).aspx Net use] (technet.microsoft.com)</ref>
:<code>C:\Users\tniedermeier>net use <Laufwerksbuchstabe>: \\<IP-des-Samba-Servers>\restricted /user:smbuser <Passwort></code>

Alternatively, you can also connect the network drive using file explorer, as explained in the following steps:
<gallery>
File:samba-windows10-authentifizierung-001.png|'''Step 1:''' Click right on "Network" in the left-hand menu of the file explorer, then click left on the context menu option "Map network drive".
File:samba-windows10-authentifizierung-002.png|'''Step 2:''' Select an available drive letter and type the path to the shared folder in the "Folder" field, for example ''\\<IP-des-Samba-Servers>\restricted''. After this, click on ''Finish''.
File:samba-windows10-authentifizierung-003.png|The network drive has been started successfully. Its content is now displayed in the explorer.
File:samba-windows10-authentifizierung-004.png|The new connected network drive ''restricted'' is now displayed in the left hand menu of the explorer.
</gallery>

If you want to access the release without assigning a drive letter to it, you can also simply type the network path directly into the address bar in the explorer:
: <code>\\<IP-des-Samba-Servers>\restricted</code>

== References ==
<references />

{{Tniedermeier}}
{{Aranzinger}}
[[Category:Debian]]
[[de:Samba Freigabe mit Authentifizierung]]
[[pl:Udostępnienie w Sambie z uwierzytelnieniem]]

Secure SSH login on Debian with fail2ban

2026-06-05T08:26:17Z

Aranzinger: Created page with "'''fail2ban''', which is a tool written in Python, pursues the target to secure server services against DoS attacks. It verifies log files according to predefined patterns and temporarily blocks the relevant IP addresses if access attempts fail repeatedly. This article explains how to secure a Debian based server with fail2ban. The used version from fail2ban is '''1.0.2-2''' on '''Debian 12'''. ==Problem== When executing the command "journalctl -u ssh", multiple failed..."

'''fail2ban''', which is a tool written in Python, pursues the target to secure server services against DoS attacks. It verifies log files according to predefined patterns and temporarily blocks the relevant IP addresses if access attempts fail repeatedly. This article explains how to secure a Debian based server with fail2ban. The used version from fail2ban is '''1.0.2-2''' on '''Debian 12'''.

==Problem==
When executing the command "journalctl -u ssh", multiple failed login attempts appear with the protocol SSH that were not written by you.

<pre>
Feb 19 09:21:15 servername sshd[22796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.207.xx.xx user=root
Feb 19 09:21:17 servername sshd[22796]: Failed password for root from 218.207.xx.xx port 22 ssh2
</pre>

==Explanation==
* The removed user (accidentally) used the wrong server IP and accidentally tried to log in to your server. The number of login attempts is usually low here.
* You are the victim of a Brute Force attack, which automatically attempts to log in using the root user and various passwords (for example from so-called dictionary files). The number of login attempts is noticeably high here.

==Solution==
Secure your SSH login with the fail2ban tool, [[Prohibit SSH root login on Debian]] or only login with [[SSH public key authentication under Ubuntu]].

==What is fail2ban==
fail2ban is a tool written in Python that secures different server services against unauthorized access.
In the configuration example below, an IP address is blocked for one hour after 4 failed login attempts for SSH have occurred.
==Installation of fail2ban==
<pre lang="bash">
sudo apt install fail2ban
</pre>
==Configuration of fail2ban==
In the ''/etc/fail2ban/'' folder, you will find the global configuration file ''jail.conf''. However, this file cannot be edited, since it is overwritten every time the package is updated. The own configuration can be made in the
"jail.local".
<pre>
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local>
</pre>
Hierzu kopieren Sie die "jail.conf" nach "jail.local".
<pre lang="bash">
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
</pre>

Verify the settings on your local IP address of your server. The duration for which an IP address should be blocked is increased to an hour in our example and the number of blocks to be created is reduced to 3. Similarly, the Banaction must be changed from "iptables" to "nftables" when configuring. This configuration must be made in the following section of the ''jail.local'' file:

<pre>
[...]
[DEFAULT]

#
# MISCELLANEOUS OPTIONS
#

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space (and/or comma) separator.
ignoreip = 127.0.0.1/8

# External command that will take an tagged arguments to ignore, e.g. <ip>,
# and return true if the IP is to be ignored. False otherwise.
#
# ignorecommand = /path/to/command <ip>
ignorecommand =

# "bantime" is the number of seconds that a host is banned.
bantime = 3600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

[...]

banaction = nftables-multiport
banaction_allports = nftables-allports
</pre>
You can adjust the parameters for individual services (as here in the SSH daemon article) separately.

Now, in the section for the SSH daemon in your own ''jail.local'' configuration file (which you copied earlier), add the necessary parameters to monitor it via fail2ban:

<pre>
[...]
#
# SSH servers
#

[sshd]

enabled = true
port = ssh
# filter = sshd
logpath = %(sshd_log)s
backend = systemd
maxretry = 4
[...]
</pre>

After this, restart fail2ban so that the changes are applied.

<code>sudo systemctl restart fail2ban.service</code>

{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category:Debian]]
[[Category:SSH]]
[[pl:Zabezpieczenie loginu SSH w Debianie z fail2ban]]
[[de:SSH Login unter Debian mit fail2ban absichern]]

Prohibit SSH root login on Debian

2026-06-05T05:25:36Z

Aranzinger: /* Further securing of the SSH server */

If you want to prohibit the direct SSH root login on Debian, you will need at least one additional user to the root user, who is authorized to log in to the server. With this user, you can switch to the root account.

'''ATTENTION:''' If you did not create any other users, you will log yourself out of the system!

== PermitRootLogin no ==

Edit the /etc/ssh/sshd_config file and set
PermitRootLogin yes

on
PermitRootLogin no

After this, restart the SSH service
/etc/init.d/ssh restart (alternatively: service ssh restart)

Now, the root user is not allowed to log into the system directly. You have to log in as usual with a user account and then switch with
su

to the root account.

== AllowGroups ==

You can also use the AllowGroups parameter to restrict which users are allowed to log in via SSH.

Excerpt from the <code>man sshd_config</code>:
:<cite>AllowGroups</cite>
::<cite>This keyword can be followed by a list of group name patterns, separated by spaces. If specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.</cite>

To create a group named sshusers and add a user to that group, execute the following commands as the root user:
addgroup --system sshusers
adduser xyz sshusers

After this, configure the following options in /etc/ssh/sshd_config:
LoginGraceTime 30
AllowGroups sshusers
PermitRootLogin no
StrictModes yes

Then restart the SSH service
/etc/init.d/ssh restart

== Further securing of the SSH server ==
More information on securing a SSH server can be found in the following articles:
* [[Securing SSH Login on Debian with fail2ban]]
* [[SSH Key Login]]
{{Aranzinger}}
[[Category:Debian]][[Category:Linux]]
[[de:SSH Root Login unter Debian verbieten]]

Raspi-firmware: missing /boot/firmware, did you forget to mount it

2026-06-03T12:41:35Z

Aranzinger:

When installing [[Debian]] 12.0 using the live image, the raspi-firmware package will be also installed. However, this is not required on x86 systems and should therefore be deinstalled. If raspi-firmware is present, however, it causes the following error when installing a kernel update: '''raspi-firmware: missing /boot/firmware, did you forget to mount it?'''.

== Problem ==
Debian 12.0 was installed via live image. When attempting to install updates using '''sudo apt dist-upgrade''', the following error occurs:
<pre>
/etc/kernel/postinst.d/initramfs-tools:
update-initramfs: Generating /boot/initrd.img-6.1.0-10-amd64
raspi-firmware: missing /boot/firmware, did you forget to mount it?
run-parts: /etc/initramfs/post-update.d//z50-raspi-firmware exited with return code 1
run-parts: /etc/kernel/postinst.d/initramfs-tools exited with return code 1
dpkg: error processing package linux-image-6.1.0-10-amd64 (--configure):
installed linux-image-6.1.0-10-amd64 package post-installation script subprocess returned error exit status 1
</pre>

It is no longer possible to deinstall raspi-firmware without first performing some preparatory steps. The deinstallation will fail otherwise.

== Solution ==
First, the new kernel must be deinstalled. Remove raspi-firmware and reinstall linux-image-amd64. After this, updates are possible without problems:
# '''sudo apt purge linux-image-6.1.0-10-amd64'''
#: This will remove two packages: ''The following packages will be REMOVED: linux-image-6.1.0-10-amd64* linux-image-amd64*'' '''sudo apt purge raspi-firmware'''
# '''sudo apt install linux-image-amd64'''
#: This will reinstall both packages due to their dependencies: ''The following NEW packages will be installed: linux-image-6.1.0-10-amd64 linux-image-amd64''

== More information ==
* [https://forums.debian.net/viewtopic.php?t=154857 Errors while updating system or install new packages Debian 12 (Solved sort of)] (forums.debian.net, 12.06.2023)
* [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1035382 Bookworm amd64 live install ISO RC1 and RC2 install pointless raspi-firmware package] (bugs.debian.org)
* [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1035783 raspi-firmware: unowned files after purge (policy 6.8, 10.8): /boot/firmware/fixup*.dat, /boot/firmware/start*.elf, /boot/firmware/bootcode.bin] (bugs.debian.org)

{{Wfischer}}
{{Aranzinger}}
[[Category:Debian]]
[[de:Raspi-firmware: missing /boot/firmware, did you forget to mount it]]

Setup Postfix in Debian

2026-05-29T06:24:32Z

Aranzinger: Created page with "'''Postfix''' is a widely used mail server, or more specifically, an MTA ([http://de.wikipedia.org/wiki/Mail_Transfer_Agent Mail Transfer Agent]). In this article, we describe how to install Postfix on Debian Lenny 5.0. In this example, we use a test server (lists.wefi.net). Replace this name with the name of your server. == Install package == The Postfix installation must be started on the command line as follows: apt-get install postfix Debian provides a note that..."

'''Postfix''' is a widely used mail server, or more specifically, an MTA ([http://de.wikipedia.org/wiki/Mail_Transfer_Agent Mail Transfer Agent]). In this article, we describe how to install Postfix on Debian Lenny 5.0. In this example, we use a test server (lists.wefi.net). Replace this name with the name of your server.

== Install package ==
The Postfix installation must be started on the command line as follows:
apt-get install postfix

Debian provides a note that Exim is removed and questions if you want to continue with the installation:
<pre>
lists:~# apt-get install postfix
Reading package lists... Done
Building dependency tree
Reading state information... Done
Suggested packages:
procmail postfix-mysql postfix-pgsql postfix-ldap postfix-pcre sasl2-bin libsasl2-modules
resolvconf postfix-cdb ufw
The following packages will be REMOVED:
exim4 exim4-base exim4-config exim4-daemon-light
The following NEW packages will be installed:
postfix
0 upgraded, 1 newly installed, 4 to remove and 0 not upgraded.
Need to get 1224kB of archives.
After this operation, 1008kB disk space will be freed.
Do you want to continue [Y/n]? y
Get:1 http://http.at.debian.org lenny/main postfix 2.5.5-1.1 [1224kB]
Fetched 1224kB in 0s (6060kB/s)
Preconfiguring packages ...
</pre>

=== Package configuration ===
[[file:Postfix-Installation-unter-Debian-Lenny-01-tpye-of-mail-configuration.png|right|thumb|300px|Postfix Configuration: General type of mail configuration]]
In the first configuration step, we select '''Internet Site''' in this example. Select the corresponding entry depending on your individual requirements.
<pre>
Package configuration
┌───────────────────────────┤ Postfix Configuration ├───────────────────────────┐
│ Please select the mail server configuration type that best meets your needs. │
│ │
│ No configuration: │
│ Should be chosen to leave the current configuration unchanged. │
│ Internet site: │
│ Mail is sent and received directly using SMTP. │
│ Internet with smarthost: │
│ Mail is received directly using SMTP or by running a utility such │
│ as fetchmail. Outgoing mail is sent using a smarthost. │
│ Satellite system: │
│ All mail is sent to another machine, called a 'smarthost', for delivery. │
│ Local only: │
│ The only delivered mail is the mail for local users. There is no network. │
│ │
│ General type of mail configuration: │
│ │
│ No configuration │
│ Internet Site │
│ Internet with smarthost │
│ Satellite system │
│ Local only │
│ │
│ │
│ <Ok> <Cancel> │
│ │
└───────────────────────────────────────────────────────────────────────────────┘
</pre>

[[file:Postfix-Installation-unter-Debian-Lenny-02-system-mail-name.png|right|thumb|300px|Postfix Configuration: System mail name]]
In the second step, we state the mail name of the server. Since the example involves a mailing list server, here lists.wefi.net (the mail address, for example, is then mailingliste@lists.wefi.net):
<pre>
Package configuration

┌──────────────────────────────────┤ Postfix Configuration ├───────────────────────────────────┐
│ The "mail name" is the domain name used to "qualify" _ALL_ mail addresses without a domain │
│ name. This includes mail to and from <root>: please do not make your machine send out mail │
│ from root@example.org unless root@example.org has told you to. │
│ │
│ This name will also be used by other programs. It should be the single, fully qualified │
│ domain name (FQDN). │
│ │
│ Thus, if a mail address on the local host is foo@example.org, the correct value for this │
│ option would be example.org. │
│ │
│ System mail name: │
│ │
│ lists.wefi.net______________________________________________________________________________ │
│ │
│ <Ok> <Cancel> │
│ │
└──────────────────────────────────────────────────────────────────────────────────────────────┘
</pre>

=== Completion of installation ===
<pre>
(Reading database ... 21540 files and directories currently installed.)
Removing exim4 ...
dpkg: exim4-config: dependency problems, but removing anyway as you request:
exim4-base depends on exim4-config (>= 4.30) | exim4-config-2; however:
Package exim4-config is to be removed.
Package exim4-config-2 is not installed.
Package exim4-config which provides exim4-config-2 is to be removed.
exim4-base depends on exim4-config (>= 4.30) | exim4-config-2; however:
Package exim4-config is to be removed.
Package exim4-config-2 is not installed.
Package exim4-config which provides exim4-config-2 is to be removed.
Removing exim4-config ...
dpkg: exim4-daemon-light: dependency problems, but removing anyway as you request:
bsd-mailx depends on exim4 | mail-transport-agent; however:
Package exim4 is not installed.
Package mail-transport-agent is not installed.
Package exim4-daemon-light which provides mail-transport-agent is to be removed.
Removing exim4-daemon-light ...
Stopping MTA: exim4_listener.
Removing exim4-base ...
Processing triggers for man-db ...
Selecting previously deselected package postfix.
(Reading database ... 21404 files and directories currently installed.)
Unpacking postfix (from .../postfix_2.5.5-1.1_i386.deb) ...
Processing triggers for man-db ...
Setting up postfix (2.5.5-1.1) ...
Adding group `postfix' (GID 108) ...
Done.
Adding system user `postfix' (UID 104) ...
Adding new user `postfix' (UID 104) with group `postfix' ...
Not creating home directory `/var/spool/postfix'.
Creating /etc/postfix/dynamicmaps.cf
Adding tcp map entry to /etc/postfix/dynamicmaps.cf
Adding group `postdrop' (GID 109) ...
Done.
setting myhostname: lists.wefi.net
setting alias maps
setting alias database
changing /etc/mailname to lists.wefi.net
setting myorigin
setting destinations: lists.wefi.net, localhost.wefi.net, , localhost
setting relayhost:
setting mynetworks: 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
setting mailbox_size_limit: 0
setting recipient_delimiter: +
setting inet_interfaces: all
WARNING: /etc/aliases exists, but does not have a root alias.

Postfix is now set up with a default configuration. If you need to make
changes, edit
/etc/postfix/main.cf (and others) as needed. To view Postfix configuration
values, see postconf(1).

After modifying main.cf, be sure to run '/etc/init.d/postfix reload'.

Running newaliases
Stopping Postfix Mail Transport Agent: postfix.
Starting Postfix Mail Transport Agent: postfix.
lists:~#
</pre>

=== Verification of mail delivery ===
You can verify with telnet (as described in [[Test TCP Port 25 (smtp) access with telnet]]) if the mail delivery functions:

<pre>
ubuntu@ubuntu:~$ telnet lists.wefi.net 25
Trying 80.66.32.103...
Connected to lists.wefi.net.
Escape character is '^]'.
220 lists.wefi.net ESMTP Postfix (Debian/GNU)
EHLO test.example.com
250-lists.wefi.net
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM: test@example.com
250 2.1.0 Ok
RCPT TO: postmaster@lists.wefi.net
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: Test message

This is a test.

.
250 2.0.0 Ok: queued as 87D2CDE40A2
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
user@ubuntu:~$
</pre>

This message has now been delivered to the server:
<pre>
lists:~# mail
Mail version 8.1.2 01/15/2001. Type ? for help.
"/var/mail/root": 1 message 1 new
>N 1 test@example.com Tue Jun 1 10:00 16/545 Testnachricht
& 1
Message 1:
From test@example.com Tue Jun 1 10:00:49 2010
X-Original-To: postmaster@lists.wefi.net
Subject: Testnachricht
Date: Tue, 1 Jun 2010 10:00:08 +0200 (CEST)
From: test@example.com
To: undisclosed-recipients:;

This is a test.

& q
Saved 1 message in /root/mbox
lists:~#
</pre>

== More information ==
* [http://de.wikipedia.org/wiki/Postfix_%28Mail_Transfer_Agent%29 Postfix (Mail Transfer Agent)] (Wikipedia)
* [http://www.postfix.org/ Postfix Projekt Webseite]

{{Wfischer}}
{{Aranzinger}}
[[Category:Debian]]
[[de:Postfix unter Debian einrichten]]
[[pl:Konfiguracja Postfix-a w Debianie]]

Creating mailing lists in Mailman

2026-05-28T11:54:19Z

Aranzinger: /* Configuration parameter */

In this article, we explain how to '''create a new mailing list in Debian'''. We also present important configuration parameters. Information on installing Mailman can be found in the article [[Setup Mailman in Debian]].

== Create mailing list ==

A new mailing list can be created with the '''newlist''' command. Next, enter your email address. Mailman will use this address to send you email notifications in the future (for example, when new subscribers join the mailing list). Then, configure /etc/aliases as described:
<pre>
lists:~# newlist test-mailingliste
Enter the email of the person running the list: email@example.org
Initial test-mailingliste password:
To finish creating your mailing list, you must edit your /etc/aliases (or
equivalent) file by adding the following lines, and possibly running the
`newaliases' program:

## test-mailingliste mailing list
test-mailingliste: "|/var/lib/mailman/mail/mailman post test-mailingliste"
test-mailingliste-admin: "|/var/lib/mailman/mail/mailman admin test-mailingliste"
test-mailingliste-bounces: "|/var/lib/mailman/mail/mailman bounces test-mailingliste"
test-mailingliste-confirm: "|/var/lib/mailman/mail/mailman confirm test-mailingliste"
test-mailingliste-join: "|/var/lib/mailman/mail/mailman join test-mailingliste"
test-mailingliste-leave: "|/var/lib/mailman/mail/mailman leave test-mailingliste"
test-mailingliste-owner: "|/var/lib/mailman/mail/mailman owner test-mailingliste"
test-mailingliste-request: "|/var/lib/mailman/mail/mailman request test-mailingliste"
test-mailingliste-subscribe: "|/var/lib/mailman/mail/mailman subscribe test-mailingliste"
test-mailingliste-unsubscribe: "|/var/lib/mailman/mail/mailman unsubscribe test-mailingliste"

Hit enter to notify test-mailingliste owner...

lists:~# vi /etc/aliases
lists:~# tail -n 12 /etc/aliases

## test-mailingliste mailing list
test-mailingliste: "|/var/lib/mailman/mail/mailman post test-mailingliste"
test-mailingliste-admin: "|/var/lib/mailman/mail/mailman admin test-mailingliste"
test-mailingliste-bounces: "|/var/lib/mailman/mail/mailman bounces test-mailingliste"
test-mailingliste-confirm: "|/var/lib/mailman/mail/mailman confirm test-mailingliste"
test-mailingliste-join: "|/var/lib/mailman/mail/mailman join test-mailingliste"
test-mailingliste-leave: "|/var/lib/mailman/mail/mailman leave test-mailingliste"
test-mailingliste-owner: "|/var/lib/mailman/mail/mailman owner test-mailingliste"
test-mailingliste-request: "|/var/lib/mailman/mail/mailman request test-mailingliste"
test-mailingliste-subscribe: "|/var/lib/mailman/mail/mailman subscribe test-mailingliste"
test-mailingliste-unsubscribe: "|/var/lib/mailman/mail/mailman unsubscribe test-mailingliste"
lists:~# postalias /etc/aliases
lists:~#
</pre>

== Configuration parameter ==
Some important configuration parameters can be adjusted in the web interface:
* General options:
** '''real_name''': Name of mailing list.
** '''description''': A brief one-lined description.
** '''reply_goes_to_list''': Here, you can define where replies to postings should be sent (E-Mail Reply-To field). "This list" is often a good choice here. "Explicit address" is particularly useful for announcement mailing lists. In that case, you can use the '''reply_to_address''' option to specify, for example, a different mailing list as the Reply-To address, to which users can send their replies.
** '''host_name''': Hostname, at which the email address can be reached (just check this value).
* Privacy options:
** '''private_roster''': Specifies who can view the list of all mailing list subscribers. ''List members'' is the default setting, but ''List admin only'' is often the better choice.
* Privacy options: Sender filters:
** '''default_member_moderation''': Specifies whether posts from new members are moderated. This is useful, for example, for announcement mailing lists.

{{Wfischer}}
{{Aranzinger}}
[[Category:Debian]]
[[de:Mailinglisten unter Mailman erstellen]]
[[pl:Tworzenie list dyskusyjnych w Mailman-ie]]

Setup of Mailman in Debian

2026-05-22T08:10:39Z

Aranzinger: /* Completed installation */

'''GNU Mailman''' is a software for administrating mailing lists for free. In this article, we describe how to setup Mailman on Debian Lenny (Debian 5.0). At Thomas-Krenn, we use Mailman for mailing lists of the [[IPMI Sensor Monitoring Plugin]].

== Install MTA ==
For the operation of mailing lists with Mailman, the MTA (Mail Transfer Agent) is required. During the subsequent installation of Postfix, select '''Internet Site''' as the 'General type of mail configuration'.

Further information on the installation of Postfix can be found in the article [[Setup of Postfix on Debian]].

== Install Mailman ==

The Mailman can be installed using apt-get:

apt-get install mailman

<pre>
lists:~# apt-get install mailman
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
apache2 apache2-mpm-worker pwgen python-support ucf
Suggested packages:
spamassassin lynx listadmin
The following NEW packages will be installed:
apache2 apache2-mpm-worker mailman pwgen python-support ucf
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 9965kB of archives.
After this operation, 45.7MB of additional disk space will be used.
Do you want to continue [Y/n]? y
Get:1 http://http.at.debian.org lenny/main python-support 0.8.4lenny1 [28.4kB]
Get:2 http://http.at.debian.org lenny/main ucf 3.0016 [64.4kB]
Get:3 http://security.debian.org lenny/updates/main apache2-mpm-worker 2.2.9-10+lenny7 [242kB]
Get:4 http://http.at.debian.org lenny/main pwgen 2.06-1 [19.2kB]
Get:5 http://http.at.debian.org lenny/main mailman 1:2.1.11-11 [9566kB]
Get:6 http://security.debian.org lenny/updates/main apache2 2.2.9-10+lenny7 [45.4kB]
Fetched 9965kB in 1s (5665kB/s)
Preconfiguring packages ...
</pre>

=== Package configuration ===

==== Supported language ====
[[file:Mailman-Installation-unter-Debian-Lenny-01-languages-to-support.png|right|thumb|300px|Configuring mailman: Languages to support]]
The request on which language should be supported appears during installation:
<pre>
Package configuration

┌────────────────────────────────────┤ Configuring mailman ├────────────────────────────────────┐
│ For each supported language, Mailman stores default language specific texts in │
│ /etc/mailman/LANG/ giving them conffile like treatment with the help of ucf. This means │
│ approximately 150kB for each supported language on the root file system. │
│ │
│ If you need a different set of languages at a later time, just run dpkg-reconfigure mailman. │
│ │
│ NOTE: Languages enabled on existing mailing lists are forcibly re-enabled when deselected │
│ and mailman needs at least one language for displaying its messages. │
│ │
│ Languages to support: │
│ │
│ [ ] ar (Arabic) │
│ [ ] ca (Catalan) │
│ [ ] cs (Czech) ▒ │
│ [ ] da (Danish) ▒ │
│ [*] de (German) ▒ │
│ [*] en (English) ▒ │
│ [ ] es (Spanish) ▒ │
│ [ ] et (Estonian) ▒ │
│ [ ] eu (Basque) │
│ │
│ │
│ <Ok> │
│ │
└───────────────────────────────────────────────────────────────────────────────────────────────┘
</pre>

==== Default language ====
[[file:Mailman-Installation-unter-Debian-Lenny-02-default-language-for-mailman.png|right|thumb|300px|Configuring mailman: Default language for Mailman]]
If you have choosen multiple languages, the default language can be determined:
<pre>
Package configuration
┌────────────────────────────────────┤ Configuring mailman ├────────────────────────────────────┐
│ The web page will be shown in this language, and in general, Mailman will use this language │
│ to communicate with the user. │
│ │
│ Default language for Mailman: │
│ │
│ de (German) │
│ en (English) │
│ │
│ │
│ <Ok> │
│ │
└───────────────────────────────────────────────────────────────────────────────────────────────┘
</pre>

==== Note on further configuration steps ====
[[file:Mailman-Installation-unter-Debian-Lenny-03-missing-site-list.png|right|thumb|300px|Configuring mailman: Missing site list]]
Finally, here is a note regarding additional configuration steps that are required that must be performed manually after installation:
<pre>
Package configuration

┌────────────────────────────────────┤ Configuring mailman ├────────────────────────────────────┐
│ │
│ Missing site list │
│ │
│ Mailman needs a so-called "site list", which is the list from which password reminders and │
│ such are sent out from. This list needs to be created before mailman will start. │
│ │
│ To create the list, run "newlist mailman" and follow the instructions on-screen. Note that │
│ you also need to start mailman after that, using /etc/init.d/mailman start. │
│ │
│ <Ok> │
│ │
└───────────────────────────────────────────────────────────────────────────────────────────────┘
</pre>

=== Completion of installation ===
<pre>
Selecting previously deselected package python-support.
(Reading database ... 21572 files and directories currently installed.)
Unpacking python-support (from .../python-support_0.8.4lenny1_all.deb) ...
Selecting previously deselected package apache2-mpm-worker.
Unpacking apache2-mpm-worker (from .../apache2-mpm-worker_2.2.9-10+lenny7_i386.deb) ...
Selecting previously deselected package apache2.
Unpacking apache2 (from .../apache2_2.2.9-10+lenny7_all.deb) ...
Selecting previously deselected package ucf.
Unpacking ucf (from .../archives/ucf_3.0016_all.deb) ...
Moving old data out of the way
Selecting previously deselected package pwgen.
Unpacking pwgen (from .../archives/pwgen_2.06-1_i386.deb) ...
Selecting previously deselected package mailman.
Unpacking mailman (from .../mailman_1%3a2.1.11-11_i386.deb) ...
Processing triggers for man-db ...
Setting up python-support (0.8.4lenny1) ...
Setting up apache2-mpm-worker (2.2.9-10+lenny7) ...
Starting web server: apache2.
Setting up apache2 (2.2.9-10+lenny7) ...
Setting up ucf (3.0016) ...
Setting up pwgen (2.06-1) ...
Setting up mailman (1:2.1.11-11) ...
Looking for enabled languages (this may take some time) ... done.
Installing site language en ............................................ done.
Configuring mailman for domain lists.wefi.net ...
Upgrading from version 0x0 to 0x2010bf0
getting rid of old source files
Site list for mailman missing (looking for list named 'mailman'). (warning).
Please create it; until then, mailman will refuse to start. (warning).
lists:~#
</pre>

== Further configuration ==

=== Verify configuration ===
The configuration file, /etc/mailman/mm_cfg.py, must be verified. It is important that all DEFAULT entries are correct:
<pre>
lists:~# grep DEFAULT /etc/mailman/mm_cfg.py
DEFAULT_MSG_FOOTER for an example."""
DEFAULT_URL_PATTERN = 'http://%s/cgi-bin/mailman/'
DEFAULT_EMAIL_HOST = 'lists.wefi.net'
DEFAULT_URL_HOST = 'lists.wefi.net'
add_virtualhost(DEFAULT_URL_HOST, DEFAULT_EMAIL_HOST)
DEFAULT_SERVER_LANGUAGE = 'en'
DEFAULT_SEND_REMINDERS = 0
lists:~#
</pre>

=== newlist mailman ===

The so-called 'site list' can be created using
newlist mailman.
One of your addresses must be stated here as email address:
<pre>
lists:~# newlist mailman
Enter the email of the person running the list: email@example.org
Initial mailman password:
To finish creating your mailing list, you must edit your /etc/aliases (or
equivalent) file by adding the following lines, and possibly running the
`newaliases' program:

## mailman mailing list
mailman: "|/var/lib/mailman/mail/mailman post mailman"
mailman-admin: "|/var/lib/mailman/mail/mailman admin mailman"
mailman-bounces: "|/var/lib/mailman/mail/mailman bounces mailman"
mailman-confirm: "|/var/lib/mailman/mail/mailman confirm mailman"
mailman-join: "|/var/lib/mailman/mail/mailman join mailman"
mailman-leave: "|/var/lib/mailman/mail/mailman leave mailman"
mailman-owner: "|/var/lib/mailman/mail/mailman owner mailman"
mailman-request: "|/var/lib/mailman/mail/mailman request mailman"
mailman-subscribe: "|/var/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe: "|/var/lib/mailman/mail/mailman unsubscribe mailman"

Hit enter to notify mailman owner...

lists:~#
</pre>
'''Note:''' The message will not be sent to the specified email address until Mailman has been started.

Now, the entries in /etc/aliases must be added and the command <code>postadmin /etc/aliases</code> must be executed (if you use Postfix as here in the example):
<pre>
lists:~# vi /etc/aliases
lists:~# cat /etc/aliases
# /etc/aliases
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
noc: root
security: root

## mailman mailing list
mailman: "|/var/lib/mailman/mail/mailman post mailman"
mailman-admin: "|/var/lib/mailman/mail/mailman admin mailman"
mailman-bounces: "|/var/lib/mailman/mail/mailman bounces mailman"
mailman-confirm: "|/var/lib/mailman/mail/mailman confirm mailman"
mailman-join: "|/var/lib/mailman/mail/mailman join mailman"
mailman-leave: "|/var/lib/mailman/mail/mailman leave mailman"
mailman-owner: "|/var/lib/mailman/mail/mailman owner mailman"
mailman-request: "|/var/lib/mailman/mail/mailman request mailman"
mailman-subscribe: "|/var/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe: "|/var/lib/mailman/mail/mailman unsubscribe mailman"

lists:~# postalias /etc/aliases
lists:~#
</pre>

=== Start Mailman ===
Now, start Mailman:
/etc/init.d/mailman start

=== Create mailing lists ===
Information on this topic can be found in the article [[Creation of mailing lists in Mailman]].

== More information ==
* http://de.wikipedia.org/wiki/GNU_Mailman
* http://library.linode.com/email/mailman/debian-5-lenny

{{Wfischer}}
{{Aranzinger}}
[[Category:Debian]]
[[pl:Mailman w Debianie]]
[[de:Mailman unter Debian einrichten]]

Setting up password authentication with Active Directory on Debian

2026-05-22T05:01:48Z

Aranzinger: Created page with "Central directory services such as OpenLDAP or Active Directory (AD) simplify the '''password management''' for administrator and user. With regard to Linux server, the aspect of the SSH '''authentication''' via AD is interesting. From an IT security perspective, this solution also has its advantages: * Administrators do not have to choose and administrate different passwords for every server. You can log in to the servers with the AD password. * The password change or d..."

Central directory services such as OpenLDAP or Active Directory (AD) simplify the '''password management''' for administrator and user. With regard to Linux server, the aspect of the SSH '''authentication''' via AD is interesting. From an IT security perspective, this solution also has its advantages:
* Administrators do not have to choose and administrate different passwords for every server. You can log in to the servers with the AD password.
* The password change or deactivation of an account can be made via AD.
* Central administrated root passwords do not have to be known by all administrators anymore.

The following article shows how to configure an in Debian 7 ''wheezy'' with '''libpam-ldapd''' via ''mod_pam'' with an AD. The authentication is not only valid for [[:Kategorie:SSH|SSH]] but also for all services that use PAM (like, for example, ''sudo'') after successful configuration. As the libpam-ldapd packages are also available for Ubuntu<ref>[http://packages.ubuntu.com/trusty/libpam-ldapd libpam-ldapd] (packages.ubuntu.com)</ref>, the instructions can be also used for Ubuntu.

__TOC__
== Requirements and purpose ==
The following information is required for the setup:
# The LDAP-URL of the AD server
# The search or Base DN in which the users are located.
# (recommended) A Bind DN, including a password, used to search the Active Directory or the base DN.
# For TLS
#* The certificate file for the encrypted communication (since passwords are transferred between the server and AD during authentication, an encrypted communication is highly recommended).
# The users, who want to sign up, '''must already exist''' on the server

In the following, the objectives of the instructions are listed:
* Password authentication of users via the passwords stored in AD.
* Other things like groups, home-paths or similar are '''not''' retrieved from the AD.
* The ''root'' user should be able to sign up with local passwords.

'''Attention: Changes to PAM module configurations may prevent you from logging in or authenticating. Always have a root terminal ready in case of an emergency!'''

== Testing connection to AD ==
First, the connection between server<->AD is tested. When using LDAP with START_TLS, the communication is made via port 389:
<pre>
# telnet ldap.example.com 389
Trying ...
Connected to ldap.example.com
Escape character is '^]'.
</pre>

After this, an actual LDAP query is made via ldapsearch (for an encrypted connection - parameter '-ZZ' -, the certificate must be configured in the ''/etc/ldap.conf'' file.):
<pre>
ldapsearch -x -H ldap://ldap.example.com -D "CN=Georg Schönberger,OU=Users,DC=example,DC=com" \
-b OU=Users,DC=example,DC=com -W -ZZ sAMAccountName=gschoenberger
</pre>

== Installation of libpam-ldapd ==
The central component on the Debian server forms the package [https://packages.debian.org/wheezy/libpam-ldapd libpam-ldapd] (packages.debian.org). With this package, the daemon [https://packages.debian.org/wheezy/nslcd nslcd] (packages.debian.org) is also installed that is responsible for the communication between server <-> AD.
<pre>
# apt-get install libpam-ldapd
[...]
The following NEW packages will be installed:
bind9-host geoip-database ldap-utils libbind9-80 libcap2 libdns88 libgeoip1 libisc84 libisccc80 libisccfg82
liblwres80 libnss-ldapd libpam-ldapd libxml2 nscd nslcd sgml-base xml-core
</pre>

<gallery>
Ldap-auth-configure-1.png|The LDAP-Url points to the host name of the AD-server.
Ldap-auth-configure-2.png|The search base is the part of the directory where users are located.
Ldap-auth-configure-3.png|If the AD is only used for the password authentication, the file ''nsswitch.conf'' does not have to be configured.
</gallery>

Those who want to perform the package configuration once again, to adjust values, must to call up
<pre>
# dpkg-reconfigure nslcd
</pre>

== Configuration of nslcd ==
The following map and filter entries, binddn and bindpw, and TLS options must be added to the ''/etc/nslcd.conf'' file:
<pre>
[...]
base ou=Users,dc=example,dc=com
map passwd uid sAMAccountName
filter passwd (objectClass=user)

# The LDAP protocol version to use.
ldap_version 3

# The DN to bind with for normal lookups.
binddn cn=reader,dc=example,dc=com
bindpw secret

[...]

# SSL options
ssl start_tls
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/Example-com-cacert.pem
[...]
</pre>
The settings of the package installation that have been configured are located, as described above, in the ''/etc/nslcd.conf'' file.

== Configuration of pam_ldap ==
'''In general, the configuration of the package installation is suitable for an AD-authentication'''. However, users can authenticate themselves with the standard configuration per AD/LDAP as well as with local password. To disable local passwords for users other than "root", the following change must be made to the file ''/etc/pam.d/common-auth.conf''.

'''Attention:''' After this change, only the ''root'' user can use its local password. All other users rely on Active Directory and a working connection between the server and Active Directory:<ref>[http://pig.made-it.com/pam.html PAM Explanation] (pig.made-it.com)</ref>
<pre>
# vi /etc/pam.d/common-auth
[...]
auth sufficient pam_ldap.so minimum_uid=1000
auth requisite pam_succeed_if.so uid eq 0
auth sufficient pam_unix.so nullok_secure
# here's the fallback if no module succeeds
[...]
</pre>
After that, AD authentication will be sufficient for all users with a UID greater than 1000 to log in. Local passwords will no longer work!

The configuration of the AD authentication is completed after the steps described above.

== Error analysis ==
=== nslcd ===
The daemon ''nslcd'' provides a Debus mode for analyzing the LDAP authentication:
<pre>
# nslcd -d
nslcd: DEBUG: add_uri(ldap://ldap.example.com)
nslcd: DEBUG: ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT,2)
[...]
nslcd: accepting connections
</pre>
If the <code>-d</code> parameter is stated more often, the ''nslcd'' debug level increases.

The error message is a bit misleading
<pre>
DEBUG: failed to bind to LDAP server ldap://ldap.example.com: Invalid credentials: 80090308:
LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v23f0
</pre>
that also appears when a user account does not yet exist on the server.

=== pam_ldap ===
Those who want to adjust the pam-rules in the ''/etc/pam.d/common-auth.conf'' file, encounters the following error in the log file ‘’/var/log/auth.log'':
<pre>pam_succeed_if(sshd:auth): incomplete condition detected</pre>, when the terms for ''pam_succeed_if.so '' are not correct.<ref>[https://bugzilla.redhat.com/show_bug.cgi?id=594903 Insufficient error checking in pam_succeed_if] (bugzilla.redhat.com)</ref>

== References ==
<references />

{{Gschoenberger}}
{{Aranzinger}}
[[Category:Debian]]
[[de:Passwort-Authentifizierung mit Active Directory unter Debian einrichten]]

PCIe link lost

2026-05-21T11:16:45Z

Aranzinger: Created page with "On Linux systems, when using Intel I350 network chips, messages such as '''PCIe link lost''' may appear, followed by '''igb 0000:82:00.0 enp130s0f0: malformed Tx packet detected and dropped, LVMMC:0xffffffff'''. Therefore, the affected network interface does not work. As a solution, the Linux kernel parameter '''pcie_aspm.policy=performance''' or an updated BIOS with deactivated ASPM can be used. == Affected hardware and software == We have encountered this issue i..."

On [[Linux]] systems, when using Intel I350 network chips, messages such as '''PCIe link lost''' may appear, followed by '''igb 0000:82:00.0 enp130s0f0: malformed Tx packet detected and dropped, LVMMC:0xffffffff'''. Therefore, the affected network interface does not work. As a solution, the Linux kernel parameter '''pcie_aspm.policy=performance''' or an updated BIOS with deactivated ASPM can be used.

== Affected hardware and software ==
We have encountered this issue in isolated cases after several weeks of testing with the following components:
* ASUS RS500A-E11-RS12U with [[AMD EPYC 7003 Milan]] CPU (AMD EPYC 7543P) with Intel I350-AM2
** BIOS 0901
* [[Proxmox VE]] with kernel 5.15.35-1-pve

== Problem ==
Example 21.6.2022:
<pre>
Jun 21 00:53:43 PMX2 kernel: [568234.890225] igb 0000:82:00.0 enp130s0f0: PCIe link lost
Jun 21 00:53:43 PMX2 kernel: [568234.890714] ------------[ cut here ]------------
Jun 21 00:53:43 PMX2 kernel: [568234.891150] igb: Failed to read reg 0x40e8!
Jun 21 00:53:43 PMX2 kernel: [568234.891611] WARNING: CPU: 15 PID: 1607760 at drivers/net/ethernet/intel/igb/igb_main.c:747 igb_rd32.cold+0x3a/0x46 [igb]
Jun 21 00:53:43 PMX2 kernel: [568234.892059] Modules linked in: sch_ingress ebtable_filter ebtables ip_set ip6table_raw iptable_raw ip6table_filter ip6_tables iptable_filter bpfilter sctp ip6_udp_tunnel
udp_tunnel nf_tables bonding tls openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 softdog nfnetlink_log nfnetlink ipmi_ssif intel_rapl_msr intel_rapl_common amd64_edac edac_
mce_amd kvm_amd ast drm_vram_helper drm_ttm_helper kvm ttm drm_kms_helper cec irqbypass crct10dif_pclmul rc_core ghash_clmulni_intel aesni_intel fb_sys_fops crypto_simd cryptd rapl wmi_bmof efi_pstore pc
spkr acpi_ipmi syscopyarea cdc_ether sysfillrect usbnet sysimgblt joydev input_leds mii ipmi_si ccp ptdma k10temp ipmi_devintf ipmi_msghandler mac_hid vhost_net vhost vhost_iotlb tap ib_iser rdma_cm iw_c

Jun 21 00:53:43 PMX2 kernel: [568234.892098] zstd_compress hid_generic usbmouse usbkbd usbhid hid raid6_pq libcrc32c simplefb crc32_pclmul nvme nvme_core igb xhci_pci i2c_algo_bit ahci xhci_pci_renesas
dca libahci xhci_hcd i2c_piix4 bnxt_en wmi
Jun 21 00:53:43 PMX2 kernel: [568234.896894] CPU: 15 PID: 1607760 Comm: nload Tainted: P O 5.15.35-1-pve #1
Jun 21 00:53:43 PMX2 kernel: [568234.897392] Hardware name: ASUSTeK COMPUTER INC. RS500A-E11-RS12U/KMPA-U16 Series, BIOS 0901 12/03/2021
Jun 21 00:53:43 PMX2 kernel: [568234.897890] RIP: 0010:igb_rd32.cold+0x3a/0x46 [igb]
Jun 21 00:53:43 PMX2 kernel: [568234.898391] Code: c7 c6 94 23 3e c0 e8 ea e4 33 ed 48 8b bb 30 ff ff ff e8 5a 2c cc ec 84 c0 74 16 44 89 ee 48 c7 c7 60 30 3e c0 e8 b9 f2 2a ed <0f> 0b e9 b8 03 fe ff e9
cf 03 fe ff 0f b6 d0 be 00 00 04 00 48 c7
Jun 21 00:53:43 PMX2 kernel: [568234.899403] RSP: 0018:ffffbc9e812d3a98 EFLAGS: 00010282
Jun 21 00:53:43 PMX2 kernel: [568234.899906] RAX: 0000000000000000 RBX: ffff947b663fced0 RCX: ffff949a0e1e0588
Jun 21 00:53:43 PMX2 kernel: [568234.900414] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff949a0e1e0580
Jun 21 00:53:43 PMX2 kernel: [568234.900915] RBP: ffffbc9e812d3ab0 R08: 0000000000000003 R09: 0000000000000001
Jun 21 00:53:43 PMX2 kernel: [568234.901411] R10: ffff947b7610c7c0 R11: ffffffffc0d410c0 R12: 00000000ffffffff
Jun 21 00:53:43 PMX2 kernel: [568234.901902] R13: 00000000000040e8 R14: 00000000000198e8 R15: 0000000003f1d080
Jun 21 00:53:43 PMX2 kernel: [568234.902389] FS: 00007f4cb056d740(0000) GS:ffff949a0e1c0000(0000) knlGS:0000000000000000
Jun 21 00:53:43 PMX2 kernel: [568234.902879] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jun 21 00:53:43 PMX2 kernel: [568234.903364] CR2: 00007f4f7bbf2670 CR3: 00000006414e8004 CR4: 0000000000770ee0
Jun 21 00:53:43 PMX2 kernel: [568234.903850] PKRU: 55555554
Jun 21 00:53:43 PMX2 kernel: [568234.904336] Call Trace:
Jun 21 00:53:43 PMX2 kernel: [568234.904808] <TASK>
Jun 21 00:53:43 PMX2 kernel: [568234.905275] igb_update_stats+0x4c0/0x880 [igb]
Jun 21 00:53:43 PMX2 kernel: [568234.905743] igb_get_stats64+0x30/0x80 [igb]
Jun 21 00:53:43 PMX2 kernel: [568234.906205] dev_get_stats+0x60/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.906663] netstat_show.constprop.0+0x57/0xb0
Jun 21 00:53:43 PMX2 kernel: [568234.907117] tx_dropped_show+0x16/0x20
Jun 21 00:53:43 PMX2 kernel: [568234.907564] dev_attr_show+0x1d/0x40
Jun 21 00:53:43 PMX2 kernel: [568234.908014] sysfs_kf_seq_show+0xa1/0x100
Jun 21 00:53:43 PMX2 kernel: [568234.908451] kernfs_seq_show+0x27/0x30
Jun 21 00:53:43 PMX2 kernel: [568234.908882] seq_read_iter+0x122/0x4b0
Jun 21 00:53:43 PMX2 kernel: [568234.909309] ? aa_file_perm+0x11e/0x570
Jun 21 00:53:43 PMX2 kernel: [568234.909732] kernfs_fop_read_iter+0x150/0x1b0
Jun 21 00:53:43 PMX2 kernel: [568234.910150] new_sync_read+0x110/0x1a0
Jun 21 00:53:43 PMX2 kernel: [568234.910564] vfs_read+0x100/0x1a0
Jun 21 00:53:43 PMX2 kernel: [568234.910970] ksys_read+0x67/0xe0
Jun 21 00:53:43 PMX2 kernel: [568234.911368] __x64_sys_read+0x1a/0x20
Jun 21 00:53:43 PMX2 kernel: [568234.911766] do_syscall_64+0x5c/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.912170] ? do_syscall_64+0x69/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.912560] ? do_syscall_64+0x69/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.912944] ? syscall_exit_to_user_mode+0x27/0x50
Jun 21 00:53:43 PMX2 kernel: [568234.913330] ? __x64_sys_read+0x1a/0x20
Jun 21 00:53:43 PMX2 kernel: [568234.913706] ? do_syscall_64+0x69/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.914073] ? syscall_exit_to_user_mode+0x27/0x50
Jun 21 00:53:43 PMX2 kernel: [568234.914431] ? do_syscall_64+0x69/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.914777] ? __x64_sys_close+0x12/0x40
Jun 21 00:53:43 PMX2 kernel: [568234.915112] ? do_syscall_64+0x69/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.915436] ? do_syscall_64+0x69/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.915745] ? do_syscall_64+0x69/0xc0
Jun 21 00:53:43 PMX2 kernel: [568234.916052] ? asm_sysvec_apic_timer_interrupt+0xa/0x20
Jun 21 00:53:43 PMX2 kernel: [568234.916342] entry_SYSCALL_64_after_hwframe+0x44/0xae
Jun 21 00:53:43 PMX2 kernel: [568234.916623] RIP: 0033:0x7f4cb0666e8e
Jun 21 00:53:43 PMX2 kernel: [568234.916890] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 6e 18 0a 00 e8 89 e8 01 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a
c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
Jun 21 00:53:43 PMX2 kernel: [568234.917444] RSP: 002b:00007ffe81260f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
Jun 21 00:53:43 PMX2 kernel: [568234.917719] RAX: ffffffffffffffda RBX: 0000000000001fff RCX: 00007f4cb0666e8e
Jun 21 00:53:43 PMX2 kernel: [568234.917988] RDX: 0000000000001fff RSI: 000055e09cb3adf0 RDI: 0000000000000003
Jun 21 00:53:43 PMX2 kernel: [568234.918250] RBP: 000055e09cb3adf0 R08: 0000000000000000 R09: 00007f4cb0736be0
Jun 21 00:53:43 PMX2 kernel: [568234.918508] R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000001fff
Jun 21 00:53:43 PMX2 kernel: [568234.918764] R13: 00007ffe81261118 R14: 000055e09bc21398 R15: 000055e09bc21370
Jun 21 00:53:43 PMX2 kernel: [568234.919020] </TASK>
Jun 21 00:53:43 PMX2 kernel: [568234.919272] ---[ end trace e754faf722c4d59f ]---
Jun 21 00:53:43 PMX2 kernel: [568234.919529] igb 0000:82:00.0 enp130s0f0: malformed Tx packet detected and dropped, LVMMC:0xffffffff
Jun 21 00:53:43 PMX2 kernel: [568234.919586] igb 0000:82:00.1 enp130s0f1: PCIe link lost
Jun 21 00:53:43 PMX2 kernel: [568234.920381] ------------[ cut here ]------------
Jun 21 00:53:43 PMX2 kernel: [568234.920832] igb: Failed to read reg 0xc030!
Jun 21 00:53:43 PMX2 kernel: [568234.921292] WARNING: CPU: 47 PID: 1607760 at drivers/net/ethernet/intel/igb/igb_main.c:747 igb_rd32.cold+0x3a/0x46 [igb]
Jun 21 00:53:43 PMX2 kernel: [568234.921782] Modules linked in: sch_ingress ebtable_filter ebtables ip_set ip6table_raw iptable_raw ip6table_filter ip6_tables iptable_filter bpfilter sctp ip6_udp_tunnel
udp_tunnel nf_tables bonding tls openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 softdog nfnetlink_log nfnetlink ipmi_ssif intel_rapl_msr intel_rapl_common amd64_edac edac_
mce_amd kvm_amd ast drm_vram_helper drm_ttm_helper kvm ttm drm_kms_helper cec irqbypass crct10dif_pclmul rc_core ghash_clmulni_intel aesni_intel fb_sys_fops crypto_simd cryptd rapl wmi_bmof efi_pstore pc
spkr acpi_ipmi syscopyarea cdc_ether sysfillrect usbnet sysimgblt joydev input_leds mii ipmi_si ccp ptdma k10temp ipmi_devintf ipmi_msghandler mac_hid vhost_net vhost vhost_iotlb tap ib_iser rdma_cm iw_c
m ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi drm sunrpc ip_tables x_tables autofs4 zfs(PO) zunicode(PO) zzstd(O) zlua(O) zavl(PO) icp(PO) zcommon(PO) znvpair(PO) spl(O) btrfs blak
e2b_generic xor
</pre>

Beispiel 26.6.2022:
<pre>
[...]
Jun 26 18:46:36 PMX2 kernel: [1064607.600707] igb 0000:82:00.0 enp130s0f0: malformed Tx packet detected and dropped, LVMMC:0xffffffff
Jun 26 18:46:37 PMX2 kernel: [1064608.624690] igb 0000:82:00.1 enp130s0f1: malformed Tx packet detected and dropped, LVMMC:0xffffffff
[...]
</pre>

== Possible solutions ==

=== Updated BIOS ===
The new BIOS version 1301 (Milan, 2023/03/15) deactivates ASPM on all PCIe ports (<cite>Disable ASPM on all PCIe ports.</cite>) and resolves the problem.

=== Kernel parameter ===
Alternatively, as a workaround, the PCIe ASPM policy can be set to performance using the following kernel boot parameter:<pre>sed -i '$ s/$/ pcie_aspm.policy=performance/' /etc/kernel/cmdline</pre>
On systemd-boot-systems, this command adds the parameter to the /etc/kernel/cmdline file. On Proxmox systems, a refresh of the Proxmox boot tool must be performed after changing the file:
<pre>proxmox-boot-tool refresh</pre>After a reboot, it can be verified if the parameters are active using <pre>cat /proc/cmdline</pre>

== More information ==
* [https://access.redhat.com/solutions/2190691 igb "malformed Tx packet detected and dropped, LVMMC" message] (access.redhat.com, 05.03.2016)
* [https://access.redhat.com/solutions/6753701 Intel I350 NIC with igb logs "Refused to change power state" and "PCIe link lost"] (access.redhat.com, Updated February 23 2022)
* [https://patchwork.ozlabs.org/project/netdev/patch/1406207604-31653-6-git-send-email-jeffrey.t.kirsher@intel.com/ igb: Add message when malformed packets detected by hw] (patchwork.ozlabs.org, 24.07.2014)
* [https://community.zyxel.com/en/discussion/2574/degraded-gigabit-problem-with-gs1200-8 Degraded Gigabit problem with GS1200-8] (community.zyxel.com, April 2019)

== References ==
<references />

{{Wfischer}}
{{Jsterr}}
{{Aranzinger}}
[[Category:Linux]]
[[Category:Proxmox Troubleshooting]]
[[de:PCIe link lost]]