Thomas-Krenn-Wiki - New pages [en]

OPNsense plugins

2026-08-11T07:12:58Z

Aranzinger: Created page with "The functions of the Open Source firewall OPNsense can be extended by multiple '''plugins'''. The following table shows the plugins available with the corresponding version numbers (OPNsense version 25.1.1): {| class="wikitable" !Plugin !Version !Description |- |os-acme-client |4.11 |ACME Client |- |os-apcupsd |1.2_3 |APCUPSD - APC UPS daemon |- |os-beats |1 |Send logs, network, metrics and heartbeat to Elasticsearch |- |os-bind |1.34_2 |BIND domain name service |-..."

The functions of the Open Source firewall [[OPNsense]] can be extended by multiple '''plugins'''.

The following table shows the plugins available with the corresponding version numbers (OPNsense version 25.1.1):

{| class="wikitable"
!Plugin
!Version
!Description
|-
|os-acme-client
|4.11
|ACME Client
|-
|os-apcupsd
|1.2_3
|APCUPSD - APC UPS daemon
|-
|os-beats
|1
|Send logs, network, metrics and heartbeat to Elasticsearch
|-
|os-bind
|1.34_2
|BIND domain name service
|-
|os-c-icap
|1.9
|c-icap connects the web proxy with a virus scanner
|-
|os-cache
|1.0_1
|Webserver cache
|-
|os-caddy
|2.0.4_2
|Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing
|-
|os-chrony
|1.5_3
|Chrony time synchronisation
|-
|os-clamav
|1.8.1
|Antivirus engine for detecting malicious threats
|-
|os-collectd
|1.4_1
|Collect system and application performance metrics periodically
|-
|os-cpu-microcode-amd
|1.1
|AMD CPU microcode updates
|-
|os-cpu-microcode-intel
|1.1
|Intel CPU microcode updates
|-
|os-crowdsec
|1.0.12
|Lightweight and collaborative security engine
|-
|os-ddclient
|1.28
|Dynamic DNS client
|-
|os-debug
|1.7
|Debugging Tools
|-
|os-dec-hw
|1.1_3
|Deciso hardware specific information
|-
|os-dmidecode
|1.2
|Display hardware information on the dashboard
|-
|os-dnscrypt-proxy
|1.16
|Flexible DNS proxy supporting DNSCrypt and DoH
|-
|os-etpro-telemetry
|1.8
|ET Pro Telemetry Edition
|-
|os-freeradius
|1.9.28_1
|RADIUS Authentication, Authorization and Accounting Server
|-
|os-frr
|1.49
|The FRRouting Protocol Suite
|-
|os-ftp-proxy
|1.0_4
|Control ftp-proxy processes
|-
|os-gdrive-backup
|1
|Backup configurations using Google Drive
|-
|os-git-backup
|1.1_1
|Track config changes using git
|-
|os-google-cloud-sdk
|1.0_1
|Google Cloud SDK
|-
|os-grid_example
|1.1
|A sample framework application
|-
|os-haproxy
|4.6_1
|Reliable, high performance TCP/HTTP load balancer
|-
|os-helloworld
|1.4_1
|A sample framework application
|-
|os-hw-probe
|1.0_1
|Collect hardware diagnostics
|-
|os-igmp-proxy
|1.5_6
|IGMP-Proxy Service
|-
|os-intrusion-detection-content-et-open
|1.0.2_2
|IDS Proofpoint full ET open ruleset complementary subset for ET Pro Telemetry edition
|-
|os-intrusion-detection-content-et-pro
|1.0.2_1
|IDS Proofpoint ET Pro ruleset (needs a valid subscription)
|-
|os-intrusion-detection-content-ptopen
|1
|IDS Positive Technologies ESC ruleset
|-
|os-intrusion-detection-content-snort-vrt
|1.2
|IDS Snort VRT ruleset (needs registration or subscription)
|-
|os-iperf
|1.0_2
|Connection speed tester
|-
|os-lcdproc-sdeclcd
|1.1_1
|LCDProc for SDEC LCD devices
|-
|os-lldpd
|1.2
|LLDP allows you to know exactly on which port is a server
|-
|os-maltrail
|1.10_1
|Malicious traffic detection system
|-
|os-mdns-repeater
|1.2
|Proxy multicast DNS between networks
|-
|os-munin-node
|1.1_1
|Munin monitoring agent
|-
|os-ndp-proxy-go
|1.1
|IPv6 Neighbor Discovery Protocol (NDP) Proxy
|-
|os-ndproxy
|1.1
|Neighbor Discovery Proxy
|-
|os-net-snmp
|1.6
|Net-SNMP is a daemon for the SNMP protocol
|-
|os-netbird
|1.1
|Peer-to-peer VPN that seamlessly connects your devices
|-
|os-netdata
|1.2_1
|Real-time performance monitoring
|-
|os-nextcloud-backup
|1.0_1
|Track config changes using NextCloud
|-
|os-nginx
|1.35_4
|Nginx HTTP server and reverse proxy
|-
|os-node_exporter
|1.2
|Prometheus exporter for machine metrics
|-
|os-nrpe
|1.1_1
|Execute nagios plugins
|-
|os-ntopng
|1.3
|Traffic Analysis and Flow Collection
|-
|os-nut
|1.9_1
|Network UPS Tools
|-
|os-openconnect
|1.4.6
|OpenConnect Client
|-
|os-openvpn-legacy
|1
|OpenVPN legacy support
|-
|os-OPNProxy
|1.0.5_4
|OPNsense proxy additions
|-
|os-postfix
|1.24
|SMTP mail relay
|-
|os-puppet-agent
|1.2
|Manage Puppet Agent
|-
|os-qemu-guest-agent
|1.3
|QEMU Guest Agent for OPNsense
|-
|os-radsecproxy
|1.1
|RADIUS proxy provides both RADIUS UDP and TCP/TLS (RadSec) transport
|-
|os-realtek-re
|1
|Realtek re(4) vendor driver
|-
|os-redis
|1.1_3
|Redis DB
|-
|os-relayd
|2.9_2
|Relayd Load Balancer
|-
|os-rfc2136
|1.9_4
|RFC-2136 Support
|-
|os-rspamd
|1.13_2
|Protect your network from spam
|-
|os-sftp-backup
|1.1_2
|Backup configurations using SFTP
|-
|os-shadowsocks
|1.3
|Secure socks5 proxy
|-
|os-siproxd
|1.3_3
|Siproxd is a proxy daemon for the SIP protocol
|-
|os-smart
|2.4
|SMART tools
|-
|os-squid
|1.4
|Squid is a caching proxy for the web
|-
|os-sslh
|1.0_1
|sslh configuration front-end
|-
|os-strongswan-legacy
|1
|IPsec legacy support
|-
|os-stunnel
|1.0.6_1
|Stunnel TLS proxy
|-
|os-sunnyvalley
|1.5_1
|Vendor Repository for Zenarmor (Enterprise Security Modules - NGFW, SSE, SASE, f.k.a Sensei)
|-
|os-tailscale
|1.3
|VPN mesh securely connecting clients using WireGuard
|-
|os-tayga
|1.3
|Tayga NAT64
|-
|os-telegraf
|1.12.13
|Agent for collecting metrics and data
|-
|os-tftp
|1
|TFTP server
|-
|os-theme-advanced
|1.1
|Theme based on AdvancedTomato GUI
|-
|os-theme-cicada
|1.4
|The cicada theme - dark grey onyx
|-
|os-theme-flexcolor
|1
|Theme with 3 different color schemes: black as default, light and dark-light
|-
|os-theme-rebellion
|1.9.3
|A suitably dark theme
|-
|os-theme-tukan
|1.3
|The tukan theme - blue/white
|-
|os-theme-vicuna
|1.5
|The vicuna theme - blue sapphire
|-
|os-tinc
|1.7_4
|Tinc VPN
|-
|os-tor
|1.1
|The Onion Router
|-
|os-turnserver
|1.1
|The coturn STUN/TURN Server
|-
|os-udpbroadcastrelay
|1.0_5
|Control udpbroadcastrelay processes
|-
|os-upnp
|1.8
|UPnP IGD & PCP/NAT-PMP Service
|-
|os-virtualbox
|1.0_1
|VirtualBox guest additions
|-
|os-vmware
|1.5_1
|VMware tools
|-
|os-vnstat
|1.3_1
|Network traffic monitor
|-
|os-wazuh-agent
|1.2_3
|Agent for the open source security platform Wazuh
|-
|os-wol
|2.5_3
|Wake on LAN Service
|-
|os-xen
|1.2_1
|Xen guest utilities
|-
|os-zabbix6-agent
|1.18
|Zabbix monitoring agent
|-
|os-zabbix6-proxy
|1.16
|Zabbix monitoring proxy
|-
|os-zabbix7-agent
|1.18
|Zabbix monitoring agent
|-
|os-zabbix7-proxy
|1.16
|Zabbix monitoring proxy
|-
|os-zabbix72-agent
|1.18
|Zabbix monitoring agent
|-
|os-zabbix72-proxy
|1.16
|Zabbix monitoring proxy
|-
|os-zabbix74-agent
|1.18
|Zabbix monitoring agent
|-
|os-zabbix74-proxy
|1.16
|Zabbix monitoring proxy
|-
|os-zerotier
|1.3.2_6
|Virtual Networks That Just Work

|}

{{Wfischer}}
{{Aranzinger}}
[[Category:OPNsense]]
[[Category:Review 2025 Q3]]
[[de:OPNsense Plugins]]

Update VMware ESXi

2026-08-06T10:45:03Z

Aranzinger: /* References */

Updates for VMware ESXi can be easily installed via the command line, even for the free version of the ESXi hypervisor. In this example, we explain how to install updates via command line using [[VMware ESXi 6.7]].<ref>[https://kb.vmware.com/articleview?docid=2008939 “esxcli software vib” commands to patch an ESXi 5.x/6.x host] (kb.vmware.com, VMware Knowledge Base Article 2008939)</ref>

== Download updates ==
In the following knowledge base article about VMware, you will find information on how to download the updates that are currently available for your system:
* https://kb.vmware.com/s/article/1021623
<gallery>
File:ESXi-6.7-Update-01-Downloads.png|Download available updates from VMware.
</gallery>

== Load updates to EXSi host ==
In the next step, load the updates to the ESXi host. This is, for example, possible by using the datastore browser in the vSphere web client.
<gallery>
File:ESXi-6.7-Update-02-Web-Client.png|Open datastore browser.
File:ESXi-6.7-Update-03-New-Directory.png|Create new directory.
File:ESXi-6.7-Update-04-Upload.png|Click on upload and select files.
File:ESXi-6.7-Update-05-Files.png|Files have been uploaded.
</gallery>

== Install updates on the command line ==
Activate the SSH shell in the web client, stop or migrate all virtual machines and put the host into maintenance mode:
[root@localhost:~] vim-cmd hostsvc/maintenance_mode_enter

Next, install the updates on the esxcli command as follows:
<pre>
[root@localhost:~] esxcli software vib update -d /vmfs/volumes/datastore1/updates/ESXi670-201806001.zip
Installation Result
Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective.
Reboot Required: true
VIBs Installed: VMware_bootbank_cpu-microcode_6.7.0-0.14.8941472, VMware_bootbank_esx-base_6.7.0-0.14.8941472, VMware_bootbank_vsan_6.7.0-0.14.8941472, VMware_bootbank_vsanhealth_6.7.0-0.14.8941472, VMware_locker_tools-light_10.2.1.8267844-8941472
VIBs Removed: VMware_bootbank_cpu-microcode_6.7.0-0.0.8169922, VMware_bootbank_esx-base_6.7.0-0.0.8169922, VMware_bootbank_vsan_6.7.0-0.0.8169922, VMware_bootbank_vsanhealth_6.7.0-0.0.8169922, VMware_locker_tools-light_10.2.0.7253323-8169922
VIBs Skipped: VMW_bootbank_ata-libata-92_3.00.9.2-16vmw.670.0.0.8169922, VMW_bootbank_ata-pata-amd_0.3.10-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-atiixp_0.4.6-4vmw.670.0.0.8169922, VMW_bootbank_ata-pata-cmd64x_0.2.5-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-hpt3x2n_0.3.4-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-pdc2027x_1.0-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-serverworks_0.4.3-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-sil680_0.4.8-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-via_0.3.3-2vmw.670.0.0.8169922, VMW_bootbank_block-cciss_3.6.14-10vmw.670.0.0.8169922, VMW_bootbank_bnxtnet_20.6.101.7-11vmw.670.0.0.8169922, VMW_bootbank_brcmfcoe_11.4.1078.0-8vmw.670.0.0.8169922, VMW_bootbank_char-random_1.0-3vmw.670.0.0.8169922, VMW_bootbank_ehci-ehci-hcd_1.0-4vmw.670.0.0.8169922, VMW_bootbank_elxiscsi_11.4.1174.0-2vmw.670.0.0.8169922, VMW_bootbank_elxnet_11.4.1094.0-5vmw.670.0.0.8169922, VMW_bootbank_hid-hid_1.0-3vmw.670.0.0.8169922, VMW_bootbank_i40en_1.3.1-18vmw.670.0.0.8169922, VMW_bootbank_iavmd_1.2.0.1011-2vmw.670.0.0.8169922, VMW_bootbank_igbn_0.1.0.0-15vmw.670.0.0.8169922, VMW_bootbank_ima-qla4xxx_2.02.18-1vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-devintf_39.1-4vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-msghandler_39.1-4vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-si-drv_39.1-4vmw.670.0.0.8169922, VMW_bootbank_iser_1.0.0.0-1vmw.670.0.0.8169922, VMW_bootbank_ixgben_1.4.1-11vmw.670.0.0.8169922, VMW_bootbank_lpfc_11.4.33.1-6vmw.670.0.0.8169922, VMW_bootbank_lpnic_11.4.59.0-1vmw.670.0.0.8169922, VMW_bootbank_lsi-mr3_7.702.13.00-4vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt2_20.00.04.00-4vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt35_03.00.01.00-10vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt3_16.00.01.00-1vmw.670.0.0.8169922, VMW_bootbank_misc-cnic-register_1.78.75.v60.7-1vmw.670.0.0.8169922, VMW_bootbank_misc-drivers_6.7.0-0.0.8169922, VMW_bootbank_mtip32xx-native_3.9.6-1vmw.670.0.0.8169922, VMW_bootbank_ne1000_0.8.3-4vmw.670.0.0.8169922, VMW_bootbank_nenic_1.0.11.0-1vmw.670.0.0.8169922, VMW_bootbank_net-bnx2_2.2.4f.v60.10-2vmw.670.0.0.8169922, VMW_bootbank_net-bnx2x_1.78.80.v60.12-2vmw.670.0.0.8169922, VMW_bootbank_net-cdc-ether_1.0-3vmw.670.0.0.8169922, VMW_bootbank_net-cnic_1.78.76.v60.13-2vmw.670.0.0.8169922, VMW_bootbank_net-e1000_8.0.3.1-5vmw.670.0.0.8169922, VMW_bootbank_net-e1000e_3.2.2.1-2vmw.670.0.0.8169922, VMW_bootbank_net-enic_2.1.2.38-2vmw.670.0.0.8169922, VMW_bootbank_net-fcoe_1.0.29.9.3-7vmw.670.0.0.8169922, VMW_bootbank_net-forcedeth_0.61-2vmw.670.0.0.8169922, VMW_bootbank_net-igb_5.0.5.1.1-5vmw.670.0.0.8169922, VMW_bootbank_net-ixgbe_3.7.13.7.14iov-20vmw.670.0.0.8169922, VMW_bootbank_net-libfcoe-92_1.0.24.9.4-8vmw.670.0.0.8169922, VMW_bootbank_net-mlx4-core_1.9.7.0-1vmw.670.0.0.8169922, VMW_bootbank_net-mlx4-en_1.9.7.0-1vmw.670.0.0.8169922, VMW_bootbank_net-nx-nic_5.0.621-5vmw.670.0.0.8169922, VMW_bootbank_net-tg3_3.131d.v60.4-2vmw.670.0.0.8169922, VMW_bootbank_net-usbnet_1.0-3vmw.670.0.0.8169922, VMW_bootbank_net-vmxnet3_1.1.3.0-3vmw.670.0.0.8169922, VMW_bootbank_nhpsa_2.0.22-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-core_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-en_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-rdma_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx5-core_4.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx5-rdma_4.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_ntg3_4.1.3.0-1vmw.670.0.0.8169922, VMW_bootbank_nvme_1.2.1.34-1vmw.670.0.0.8169922, VMW_bootbank_nvmxnet3-ens_2.0.0.21-1vmw.670.0.0.8169922, VMW_bootbank_nvmxnet3_2.0.0.27-1vmw.670.0.0.8169922, VMW_bootbank_ohci-usb-ohci_1.0-3vmw.670.0.0.8169922, VMW_bootbank_pvscsi_0.1-2vmw.670.0.0.8169922, VMW_bootbank_qcnic_1.0.2.0.4-1vmw.670.0.0.8169922, VMW_bootbank_qedentv_2.0.6.4-8vmw.670.0.0.8169922, VMW_bootbank_qfle3_1.0.50.11-9vmw.670.0.0.8169922, VMW_bootbank_qfle3f_1.0.25.0.2-14vmw.670.0.0.8169922, VMW_bootbank_qfle3i_1.0.2.3.9-3vmw.670.0.0.8169922, VMW_bootbank_qflge_1.1.0.11-1vmw.670.0.0.8169922, VMW_bootbank_sata-ahci_3.0-26vmw.670.0.0.8169922, VMW_bootbank_sata-ata-piix_2.12-10vmw.670.0.0.8169922, VMW_bootbank_sata-sata-nv_3.5-4vmw.670.0.0.8169922, VMW_bootbank_sata-sata-promise_2.12-3vmw.670.0.0.8169922, VMW_bootbank_sata-sata-sil24_1.1-1vmw.670.0.0.8169922, VMW_bootbank_sata-sata-sil_2.3-4vmw.670.0.0.8169922, VMW_bootbank_sata-sata-svw_2.3-3vmw.670.0.0.8169922, VMW_bootbank_scsi-aacraid_1.1.5.1-9vmw.670.0.0.8169922, VMW_bootbank_scsi-adp94xx_1.0.8.12-6vmw.670.0.0.8169922, VMW_bootbank_scsi-aic79xx_3.1-6vmw.670.0.0.8169922, VMW_bootbank_scsi-bnx2fc_1.78.78.v60.8-1vmw.670.0.0.8169922, VMW_bootbank_scsi-bnx2i_2.78.76.v60.8-1vmw.670.0.0.8169922, VMW_bootbank_scsi-fnic_1.5.0.45-3vmw.670.0.0.8169922, VMW_bootbank_scsi-hpsa_6.0.0.84-3vmw.670.0.0.8169922, VMW_bootbank_scsi-ips_7.12.05-4vmw.670.0.0.8169922, VMW_bootbank_scsi-iscsi-linux-92_1.0.0.2-3vmw.670.0.0.8169922, VMW_bootbank_scsi-libfc-92_1.0.40.9.3-5vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid-mbox_2.20.5.1-6vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid-sas_6.603.55.00-2vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid2_2.00.4-9vmw.670.0.0.8169922, VMW_bootbank_scsi-mpt2sas_19.00.00.00-2vmw.670.0.0.8169922, VMW_bootbank_scsi-mptsas_4.23.01.00-10vmw.670.0.0.8169922, VMW_bootbank_scsi-mptspi_4.23.01.00-10vmw.670.0.0.8169922, VMW_bootbank_scsi-qla4xxx_5.01.03.2-7vmw.670.0.0.8169922, VMW_bootbank_shim-iscsi-linux-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-iscsi-linux-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libata-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libata-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfc-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfc-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfcoe-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfcoe-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-3-0_6.7.0-0.0.8169922, VMW_bootbank_smartpqi_1.0.1.553-10vmw.670.0.0.8169922, VMW_bootbank_uhci-usb-uhci_1.0-3vmw.670.0.0.8169922, VMW_bootbank_usb-storage-usb-storage_1.0-3vmw.670.0.0.8169922, VMW_bootbank_usbcore-usb_1.0-3vmw.670.0.0.8169922, VMW_bootbank_vmkata_0.1-1vmw.670.0.0.8169922, VMW_bootbank_vmkfcoe_1.0.0.0-1vmw.670.0.0.8169922, VMW_bootbank_vmkplexer-vmkplexer_6.7.0-0.0.8169922, VMW_bootbank_vmkusb_0.1-1vmw.670.0.0.8169922, VMW_bootbank_vmw-ahci_1.2.0-6vmw.670.0.0.8169922, VMW_bootbank_xhci-xhci_1.0-3vmw.670.0.0.8169922, VMware_bootbank_elx-esx-libelxima.so_11.4.1184.0-0.0.8169922, VMware_bootbank_esx-dvfilter-generic-fastpath_6.7.0-0.0.8169922, VMware_bootbank_esx-ui_1.25.0-7872652, VMware_bootbank_esx-xserver_6.7.0-0.0.8169922, VMware_bootbank_lsu-hp-hpsa-plugin_2.0.0-13vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-lsi-mr3-plugin_1.0.0-12vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-lsi-msgpt3-plugin_1.0.0-8vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-megaraid-sas-plugin_1.0.0-9vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-mpt2sas-plugin_2.0.0-7vmw.670.0.0.8169922, VMware_bootbank_native-misc-drivers_6.7.0-0.0.8169922, VMware_bootbank_qlnativefc_3.0.1.0-5vmw.670.0.0.8169922, VMware_bootbank_rste_2.0.2.0088-7vmw.670.0.0.8169922, VMware_bootbank_vmware-esx-esxcli-nvme-plugin_1.2.0.32-0.0.8169922
[root@localhost:~] esxcli software vib update -d /vmfs/volumes/datastore1/updates/ESXi670-201807001.zip
Installation Result
Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective.
Reboot Required: true
VIBs Installed: VMW_bootbank_qedentv_2.0.6.4-10vmw.670.0.17.9214924, VMware_bootbank_esx-base_6.7.0-0.17.9214924, VMware_bootbank_vsan_6.7.0-0.17.9214924, VMware_bootbank_vsanhealth_6.7.0-0.17.9214924
VIBs Removed: VMW_bootbank_qedentv_2.0.6.4-8vmw.670.0.0.8169922, VMware_bootbank_esx-base_6.7.0-0.14.8941472, VMware_bootbank_vsan_6.7.0-0.14.8941472, VMware_bootbank_vsanhealth_6.7.0-0.14.8941472
VIBs Skipped: VMW_bootbank_ata-libata-92_3.00.9.2-16vmw.670.0.0.8169922, VMW_bootbank_ata-pata-amd_0.3.10-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-atiixp_0.4.6-4vmw.670.0.0.8169922, VMW_bootbank_ata-pata-cmd64x_0.2.5-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-hpt3x2n_0.3.4-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-pdc2027x_1.0-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-serverworks_0.4.3-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-sil680_0.4.8-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-via_0.3.3-2vmw.670.0.0.8169922, VMW_bootbank_block-cciss_3.6.14-10vmw.670.0.0.8169922, VMW_bootbank_bnxtnet_20.6.101.7-11vmw.670.0.0.8169922, VMW_bootbank_brcmfcoe_11.4.1078.0-8vmw.670.0.0.8169922, VMW_bootbank_char-random_1.0-3vmw.670.0.0.8169922, VMW_bootbank_ehci-ehci-hcd_1.0-4vmw.670.0.0.8169922, VMW_bootbank_elxiscsi_11.4.1174.0-2vmw.670.0.0.8169922, VMW_bootbank_elxnet_11.4.1094.0-5vmw.670.0.0.8169922, VMW_bootbank_hid-hid_1.0-3vmw.670.0.0.8169922, VMW_bootbank_i40en_1.3.1-18vmw.670.0.0.8169922, VMW_bootbank_iavmd_1.2.0.1011-2vmw.670.0.0.8169922, VMW_bootbank_igbn_0.1.0.0-15vmw.670.0.0.8169922, VMW_bootbank_ima-qla4xxx_2.02.18-1vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-devintf_39.1-4vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-msghandler_39.1-4vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-si-drv_39.1-4vmw.670.0.0.8169922, VMW_bootbank_iser_1.0.0.0-1vmw.670.0.0.8169922, VMW_bootbank_ixgben_1.4.1-11vmw.670.0.0.8169922, VMW_bootbank_lpfc_11.4.33.1-6vmw.670.0.0.8169922, VMW_bootbank_lpnic_11.4.59.0-1vmw.670.0.0.8169922, VMW_bootbank_lsi-mr3_7.702.13.00-4vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt2_20.00.04.00-4vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt35_03.00.01.00-10vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt3_16.00.01.00-1vmw.670.0.0.8169922, VMW_bootbank_misc-cnic-register_1.78.75.v60.7-1vmw.670.0.0.8169922, VMW_bootbank_misc-drivers_6.7.0-0.0.8169922, VMW_bootbank_mtip32xx-native_3.9.6-1vmw.670.0.0.8169922, VMW_bootbank_ne1000_0.8.3-4vmw.670.0.0.8169922, VMW_bootbank_nenic_1.0.11.0-1vmw.670.0.0.8169922, VMW_bootbank_net-bnx2_2.2.4f.v60.10-2vmw.670.0.0.8169922, VMW_bootbank_net-bnx2x_1.78.80.v60.12-2vmw.670.0.0.8169922, VMW_bootbank_net-cdc-ether_1.0-3vmw.670.0.0.8169922, VMW_bootbank_net-cnic_1.78.76.v60.13-2vmw.670.0.0.8169922, VMW_bootbank_net-e1000_8.0.3.1-5vmw.670.0.0.8169922, VMW_bootbank_net-e1000e_3.2.2.1-2vmw.670.0.0.8169922, VMW_bootbank_net-enic_2.1.2.38-2vmw.670.0.0.8169922, VMW_bootbank_net-fcoe_1.0.29.9.3-7vmw.670.0.0.8169922, VMW_bootbank_net-forcedeth_0.61-2vmw.670.0.0.8169922, VMW_bootbank_net-igb_5.0.5.1.1-5vmw.670.0.0.8169922, VMW_bootbank_net-ixgbe_3.7.13.7.14iov-20vmw.670.0.0.8169922, VMW_bootbank_net-libfcoe-92_1.0.24.9.4-8vmw.670.0.0.8169922, VMW_bootbank_net-mlx4-core_1.9.7.0-1vmw.670.0.0.8169922, VMW_bootbank_net-mlx4-en_1.9.7.0-1vmw.670.0.0.8169922, VMW_bootbank_net-nx-nic_5.0.621-5vmw.670.0.0.8169922, VMW_bootbank_net-tg3_3.131d.v60.4-2vmw.670.0.0.8169922, VMW_bootbank_net-usbnet_1.0-3vmw.670.0.0.8169922, VMW_bootbank_net-vmxnet3_1.1.3.0-3vmw.670.0.0.8169922, VMW_bootbank_nhpsa_2.0.22-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-core_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-en_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-rdma_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx5-core_4.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx5-rdma_4.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_ntg3_4.1.3.0-1vmw.670.0.0.8169922, VMW_bootbank_nvme_1.2.1.34-1vmw.670.0.0.8169922, VMW_bootbank_nvmxnet3-ens_2.0.0.21-1vmw.670.0.0.8169922, VMW_bootbank_nvmxnet3_2.0.0.27-1vmw.670.0.0.8169922, VMW_bootbank_ohci-usb-ohci_1.0-3vmw.670.0.0.8169922, VMW_bootbank_pvscsi_0.1-2vmw.670.0.0.8169922, VMW_bootbank_qcnic_1.0.2.0.4-1vmw.670.0.0.8169922, VMW_bootbank_qfle3_1.0.50.11-9vmw.670.0.0.8169922, VMW_bootbank_qfle3f_1.0.25.0.2-14vmw.670.0.0.8169922, VMW_bootbank_qfle3i_1.0.2.3.9-3vmw.670.0.0.8169922, VMW_bootbank_qflge_1.1.0.11-1vmw.670.0.0.8169922, VMW_bootbank_sata-ahci_3.0-26vmw.670.0.0.8169922, VMW_bootbank_sata-ata-piix_2.12-10vmw.670.0.0.8169922, VMW_bootbank_sata-sata-nv_3.5-4vmw.670.0.0.8169922, VMW_bootbank_sata-sata-promise_2.12-3vmw.670.0.0.8169922, VMW_bootbank_sata-sata-sil24_1.1-1vmw.670.0.0.8169922, VMW_bootbank_sata-sata-sil_2.3-4vmw.670.0.0.8169922, VMW_bootbank_sata-sata-svw_2.3-3vmw.670.0.0.8169922, VMW_bootbank_scsi-aacraid_1.1.5.1-9vmw.670.0.0.8169922, VMW_bootbank_scsi-adp94xx_1.0.8.12-6vmw.670.0.0.8169922, VMW_bootbank_scsi-aic79xx_3.1-6vmw.670.0.0.8169922, VMW_bootbank_scsi-bnx2fc_1.78.78.v60.8-1vmw.670.0.0.8169922, VMW_bootbank_scsi-bnx2i_2.78.76.v60.8-1vmw.670.0.0.8169922, VMW_bootbank_scsi-fnic_1.5.0.45-3vmw.670.0.0.8169922, VMW_bootbank_scsi-hpsa_6.0.0.84-3vmw.670.0.0.8169922, VMW_bootbank_scsi-ips_7.12.05-4vmw.670.0.0.8169922, VMW_bootbank_scsi-iscsi-linux-92_1.0.0.2-3vmw.670.0.0.8169922, VMW_bootbank_scsi-libfc-92_1.0.40.9.3-5vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid-mbox_2.20.5.1-6vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid-sas_6.603.55.00-2vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid2_2.00.4-9vmw.670.0.0.8169922, VMW_bootbank_scsi-mpt2sas_19.00.00.00-2vmw.670.0.0.8169922, VMW_bootbank_scsi-mptsas_4.23.01.00-10vmw.670.0.0.8169922, VMW_bootbank_scsi-mptspi_4.23.01.00-10vmw.670.0.0.8169922, VMW_bootbank_scsi-qla4xxx_5.01.03.2-7vmw.670.0.0.8169922, VMW_bootbank_shim-iscsi-linux-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-iscsi-linux-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libata-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libata-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfc-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfc-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfcoe-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfcoe-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-3-0_6.7.0-0.0.8169922, VMW_bootbank_smartpqi_1.0.1.553-10vmw.670.0.0.8169922, VMW_bootbank_uhci-usb-uhci_1.0-3vmw.670.0.0.8169922, VMW_bootbank_usb-storage-usb-storage_1.0-3vmw.670.0.0.8169922, VMW_bootbank_usbcore-usb_1.0-3vmw.670.0.0.8169922, VMW_bootbank_vmkata_0.1-1vmw.670.0.0.8169922, VMW_bootbank_vmkfcoe_1.0.0.0-1vmw.670.0.0.8169922, VMW_bootbank_vmkplexer-vmkplexer_6.7.0-0.0.8169922, VMW_bootbank_vmkusb_0.1-1vmw.670.0.0.8169922, VMW_bootbank_vmw-ahci_1.2.0-6vmw.670.0.0.8169922, VMW_bootbank_xhci-xhci_1.0-3vmw.670.0.0.8169922, VMware_bootbank_cpu-microcode_6.7.0-0.14.8941472, VMware_bootbank_elx-esx-libelxima.so_11.4.1184.0-0.0.8169922, VMware_bootbank_esx-dvfilter-generic-fastpath_6.7.0-0.0.8169922, VMware_bootbank_esx-ui_1.25.0-7872652, VMware_bootbank_esx-xserver_6.7.0-0.0.8169922, VMware_bootbank_lsu-hp-hpsa-plugin_2.0.0-13vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-lsi-mr3-plugin_1.0.0-12vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-lsi-msgpt3-plugin_1.0.0-8vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-megaraid-sas-plugin_1.0.0-9vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-mpt2sas-plugin_2.0.0-7vmw.670.0.0.8169922, VMware_bootbank_native-misc-drivers_6.7.0-0.0.8169922, VMware_bootbank_qlnativefc_3.0.1.0-5vmw.670.0.0.8169922, VMware_bootbank_rste_2.0.2.0088-7vmw.670.0.0.8169922, VMware_bootbank_vmware-esx-esxcli-nvme-plugin_1.2.0.32-0.0.8169922, VMware_locker_tools-light_10.2.1.8267844-8941472
[root@localhost:~] esxcli software vib update -d /vmfs/volumes/datastore1/updates/ESXi670-201808001.zip
Installation Result
Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective.
Reboot Required: true
VIBs Installed: VMware_bootbank_cpu-microcode_6.7.0-0.20.9484548, VMware_bootbank_esx-base_6.7.0-0.20.9484548, VMware_bootbank_esx-ui_1.25.1-9210161, VMware_bootbank_vsan_6.7.0-0.20.9484548, VMware_bootbank_vsanhealth_6.7.0-0.20.9484548
VIBs Removed: VMware_bootbank_cpu-microcode_6.7.0-0.14.8941472, VMware_bootbank_esx-base_6.7.0-0.17.9214924, VMware_bootbank_esx-ui_1.25.0-7872652, VMware_bootbank_vsan_6.7.0-0.17.9214924, VMware_bootbank_vsanhealth_6.7.0-0.17.9214924
VIBs Skipped: VMW_bootbank_ata-libata-92_3.00.9.2-16vmw.670.0.0.8169922, VMW_bootbank_ata-pata-amd_0.3.10-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-atiixp_0.4.6-4vmw.670.0.0.8169922, VMW_bootbank_ata-pata-cmd64x_0.2.5-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-hpt3x2n_0.3.4-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-pdc2027x_1.0-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-serverworks_0.4.3-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-sil680_0.4.8-3vmw.670.0.0.8169922, VMW_bootbank_ata-pata-via_0.3.3-2vmw.670.0.0.8169922, VMW_bootbank_block-cciss_3.6.14-10vmw.670.0.0.8169922, VMW_bootbank_bnxtnet_20.6.101.7-11vmw.670.0.0.8169922, VMW_bootbank_brcmfcoe_11.4.1078.0-8vmw.670.0.0.8169922, VMW_bootbank_char-random_1.0-3vmw.670.0.0.8169922, VMW_bootbank_ehci-ehci-hcd_1.0-4vmw.670.0.0.8169922, VMW_bootbank_elxiscsi_11.4.1174.0-2vmw.670.0.0.8169922, VMW_bootbank_elxnet_11.4.1094.0-5vmw.670.0.0.8169922, VMW_bootbank_hid-hid_1.0-3vmw.670.0.0.8169922, VMW_bootbank_i40en_1.3.1-18vmw.670.0.0.8169922, VMW_bootbank_iavmd_1.2.0.1011-2vmw.670.0.0.8169922, VMW_bootbank_igbn_0.1.0.0-15vmw.670.0.0.8169922, VMW_bootbank_ima-qla4xxx_2.02.18-1vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-devintf_39.1-4vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-msghandler_39.1-4vmw.670.0.0.8169922, VMW_bootbank_ipmi-ipmi-si-drv_39.1-4vmw.670.0.0.8169922, VMW_bootbank_iser_1.0.0.0-1vmw.670.0.0.8169922, VMW_bootbank_ixgben_1.4.1-11vmw.670.0.0.8169922, VMW_bootbank_lpfc_11.4.33.1-6vmw.670.0.0.8169922, VMW_bootbank_lpnic_11.4.59.0-1vmw.670.0.0.8169922, VMW_bootbank_lsi-mr3_7.702.13.00-4vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt2_20.00.04.00-4vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt35_03.00.01.00-10vmw.670.0.0.8169922, VMW_bootbank_lsi-msgpt3_16.00.01.00-1vmw.670.0.0.8169922, VMW_bootbank_misc-cnic-register_1.78.75.v60.7-1vmw.670.0.0.8169922, VMW_bootbank_misc-drivers_6.7.0-0.0.8169922, VMW_bootbank_mtip32xx-native_3.9.6-1vmw.670.0.0.8169922, VMW_bootbank_ne1000_0.8.3-4vmw.670.0.0.8169922, VMW_bootbank_nenic_1.0.11.0-1vmw.670.0.0.8169922, VMW_bootbank_net-bnx2_2.2.4f.v60.10-2vmw.670.0.0.8169922, VMW_bootbank_net-bnx2x_1.78.80.v60.12-2vmw.670.0.0.8169922, VMW_bootbank_net-cdc-ether_1.0-3vmw.670.0.0.8169922, VMW_bootbank_net-cnic_1.78.76.v60.13-2vmw.670.0.0.8169922, VMW_bootbank_net-e1000_8.0.3.1-5vmw.670.0.0.8169922, VMW_bootbank_net-e1000e_3.2.2.1-2vmw.670.0.0.8169922, VMW_bootbank_net-enic_2.1.2.38-2vmw.670.0.0.8169922, VMW_bootbank_net-fcoe_1.0.29.9.3-7vmw.670.0.0.8169922, VMW_bootbank_net-forcedeth_0.61-2vmw.670.0.0.8169922, VMW_bootbank_net-igb_5.0.5.1.1-5vmw.670.0.0.8169922, VMW_bootbank_net-ixgbe_3.7.13.7.14iov-20vmw.670.0.0.8169922, VMW_bootbank_net-libfcoe-92_1.0.24.9.4-8vmw.670.0.0.8169922, VMW_bootbank_net-mlx4-core_1.9.7.0-1vmw.670.0.0.8169922, VMW_bootbank_net-mlx4-en_1.9.7.0-1vmw.670.0.0.8169922, VMW_bootbank_net-nx-nic_5.0.621-5vmw.670.0.0.8169922, VMW_bootbank_net-tg3_3.131d.v60.4-2vmw.670.0.0.8169922, VMW_bootbank_net-usbnet_1.0-3vmw.670.0.0.8169922, VMW_bootbank_net-vmxnet3_1.1.3.0-3vmw.670.0.0.8169922, VMW_bootbank_nhpsa_2.0.22-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-core_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-en_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx4-rdma_3.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx5-core_4.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_nmlx5-rdma_4.17.9.12-1vmw.670.0.0.8169922, VMW_bootbank_ntg3_4.1.3.0-1vmw.670.0.0.8169922, VMW_bootbank_nvme_1.2.1.34-1vmw.670.0.0.8169922, VMW_bootbank_nvmxnet3-ens_2.0.0.21-1vmw.670.0.0.8169922, VMW_bootbank_nvmxnet3_2.0.0.27-1vmw.670.0.0.8169922, VMW_bootbank_ohci-usb-ohci_1.0-3vmw.670.0.0.8169922, VMW_bootbank_pvscsi_0.1-2vmw.670.0.0.8169922, VMW_bootbank_qcnic_1.0.2.0.4-1vmw.670.0.0.8169922, VMW_bootbank_qedentv_2.0.6.4-10vmw.670.0.17.9214924, VMW_bootbank_qfle3_1.0.50.11-9vmw.670.0.0.8169922, VMW_bootbank_qfle3f_1.0.25.0.2-14vmw.670.0.0.8169922, VMW_bootbank_qfle3i_1.0.2.3.9-3vmw.670.0.0.8169922, VMW_bootbank_qflge_1.1.0.11-1vmw.670.0.0.8169922, VMW_bootbank_sata-ahci_3.0-26vmw.670.0.0.8169922, VMW_bootbank_sata-ata-piix_2.12-10vmw.670.0.0.8169922, VMW_bootbank_sata-sata-nv_3.5-4vmw.670.0.0.8169922, VMW_bootbank_sata-sata-promise_2.12-3vmw.670.0.0.8169922, VMW_bootbank_sata-sata-sil24_1.1-1vmw.670.0.0.8169922, VMW_bootbank_sata-sata-sil_2.3-4vmw.670.0.0.8169922, VMW_bootbank_sata-sata-svw_2.3-3vmw.670.0.0.8169922, VMW_bootbank_scsi-aacraid_1.1.5.1-9vmw.670.0.0.8169922, VMW_bootbank_scsi-adp94xx_1.0.8.12-6vmw.670.0.0.8169922, VMW_bootbank_scsi-aic79xx_3.1-6vmw.670.0.0.8169922, VMW_bootbank_scsi-bnx2fc_1.78.78.v60.8-1vmw.670.0.0.8169922, VMW_bootbank_scsi-bnx2i_2.78.76.v60.8-1vmw.670.0.0.8169922, VMW_bootbank_scsi-fnic_1.5.0.45-3vmw.670.0.0.8169922, VMW_bootbank_scsi-hpsa_6.0.0.84-3vmw.670.0.0.8169922, VMW_bootbank_scsi-ips_7.12.05-4vmw.670.0.0.8169922, VMW_bootbank_scsi-iscsi-linux-92_1.0.0.2-3vmw.670.0.0.8169922, VMW_bootbank_scsi-libfc-92_1.0.40.9.3-5vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid-mbox_2.20.5.1-6vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid-sas_6.603.55.00-2vmw.670.0.0.8169922, VMW_bootbank_scsi-megaraid2_2.00.4-9vmw.670.0.0.8169922, VMW_bootbank_scsi-mpt2sas_19.00.00.00-2vmw.670.0.0.8169922, VMW_bootbank_scsi-mptsas_4.23.01.00-10vmw.670.0.0.8169922, VMW_bootbank_scsi-mptspi_4.23.01.00-10vmw.670.0.0.8169922, VMW_bootbank_scsi-qla4xxx_5.01.03.2-7vmw.670.0.0.8169922, VMW_bootbank_shim-iscsi-linux-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-iscsi-linux-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libata-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libata-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfc-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfc-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfcoe-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-libfcoe-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-1-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-2-0_6.7.0-0.0.8169922, VMW_bootbank_shim-vmklinux-9-2-3-0_6.7.0-0.0.8169922, VMW_bootbank_smartpqi_1.0.1.553-10vmw.670.0.0.8169922, VMW_bootbank_uhci-usb-uhci_1.0-3vmw.670.0.0.8169922, VMW_bootbank_usb-storage-usb-storage_1.0-3vmw.670.0.0.8169922, VMW_bootbank_usbcore-usb_1.0-3vmw.670.0.0.8169922, VMW_bootbank_vmkata_0.1-1vmw.670.0.0.8169922, VMW_bootbank_vmkfcoe_1.0.0.0-1vmw.670.0.0.8169922, VMW_bootbank_vmkplexer-vmkplexer_6.7.0-0.0.8169922, VMW_bootbank_vmkusb_0.1-1vmw.670.0.0.8169922, VMW_bootbank_vmw-ahci_1.2.0-6vmw.670.0.0.8169922, VMW_bootbank_xhci-xhci_1.0-3vmw.670.0.0.8169922, VMware_bootbank_elx-esx-libelxima.so_11.4.1184.0-0.0.8169922, VMware_bootbank_esx-dvfilter-generic-fastpath_6.7.0-0.0.8169922, VMware_bootbank_esx-xserver_6.7.0-0.0.8169922, VMware_bootbank_lsu-hp-hpsa-plugin_2.0.0-13vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-lsi-mr3-plugin_1.0.0-12vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-lsi-msgpt3-plugin_1.0.0-8vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-megaraid-sas-plugin_1.0.0-9vmw.670.0.0.8169922, VMware_bootbank_lsu-lsi-mpt2sas-plugin_2.0.0-7vmw.670.0.0.8169922, VMware_bootbank_native-misc-drivers_6.7.0-0.0.8169922, VMware_bootbank_qlnativefc_3.0.1.0-5vmw.670.0.0.8169922, VMware_bootbank_rste_2.0.2.0088-7vmw.670.0.0.8169922, VMware_bootbank_vmware-esx-esxcli-nvme-plugin_1.2.0.32-0.0.8169922, VMware_locker_tools-light_10.2.1.8267844-8941472
[root@localhost:~]
</pre>

== Verify updates ==
You can also use esxcli to verify the versions that were just installed:
<pre>
[root@localhost:~] esxcli software vib list
Name Version Vendor Acceptance Level Install Date
----------------------------- ------------------------------------ ------ ---------------- ------------
ata-libata-92 3.00.9.2-16vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-amd 0.3.10-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-atiixp 0.4.6-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-cmd64x 0.2.5-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-hpt3x2n 0.3.4-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-pdc2027x 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-serverworks 0.4.3-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-sil680 0.4.8-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ata-pata-via 0.3.3-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
block-cciss 3.6.14-10vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
bnxtnet 20.6.101.7-11vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
brcmfcoe 11.4.1078.0-8vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
char-random 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ehci-ehci-hcd 1.0-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
elxiscsi 11.4.1174.0-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
elxnet 11.4.1094.0-5vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
hid-hid 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
i40en 1.3.1-18vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
iavmd 1.2.0.1011-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
igbn 0.1.0.0-15vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ima-qla4xxx 2.02.18-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ipmi-ipmi-devintf 39.1-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ipmi-ipmi-msghandler 39.1-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ipmi-ipmi-si-drv 39.1-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
iser 1.0.0.0-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ixgben 1.4.1-11vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
lpfc 11.4.33.1-6vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
lpnic 11.4.59.0-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
lsi-mr3 7.702.13.00-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
lsi-msgpt2 20.00.04.00-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
lsi-msgpt35 03.00.01.00-10vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
lsi-msgpt3 16.00.01.00-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
misc-cnic-register 1.78.75.v60.7-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
misc-drivers 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
mtip32xx-native 3.9.6-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ne1000 0.8.3-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nenic 1.0.11.0-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-bnx2 2.2.4f.v60.10-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-bnx2x 1.78.80.v60.12-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-cdc-ether 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-cnic 1.78.76.v60.13-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-e1000 8.0.3.1-5vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-e1000e 3.2.2.1-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-enic 2.1.2.38-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-fcoe 1.0.29.9.3-7vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-forcedeth 0.61-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-igb 5.0.5.1.1-5vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-ixgbe 3.7.13.7.14iov-20vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-libfcoe-92 1.0.24.9.4-8vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-mlx4-core 1.9.7.0-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-mlx4-en 1.9.7.0-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-nx-nic 5.0.621-5vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-tg3 3.131d.v60.4-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-usbnet 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
net-vmxnet3 1.1.3.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nhpsa 2.0.22-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nmlx4-core 3.17.9.12-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nmlx4-en 3.17.9.12-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nmlx4-rdma 3.17.9.12-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nmlx5-core 4.17.9.12-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nmlx5-rdma 4.17.9.12-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ntg3 4.1.3.0-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nvme 1.2.1.34-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nvmxnet3-ens 2.0.0.21-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
nvmxnet3 2.0.0.27-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
ohci-usb-ohci 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
pvscsi 0.1-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
qcnic 1.0.2.0.4-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
qedentv 2.0.6.4-8vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
qfle3 1.0.50.11-9vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
qfle3f 1.0.25.0.2-14vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
qfle3i 1.0.2.3.9-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
qflge 1.1.0.11-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
sata-ahci 3.0-26vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
sata-ata-piix 2.12-10vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
sata-sata-nv 3.5-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
sata-sata-promise 2.12-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
sata-sata-sil24 1.1-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
sata-sata-sil 2.3-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
sata-sata-svw 2.3-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-aacraid 1.1.5.1-9vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-adp94xx 1.0.8.12-6vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-aic79xx 3.1-6vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-bnx2fc 1.78.78.v60.8-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-bnx2i 2.78.76.v60.8-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-fnic 1.5.0.45-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-hpsa 6.0.0.84-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-ips 7.12.05-4vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-iscsi-linux-92 1.0.0.2-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-libfc-92 1.0.40.9.3-5vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-megaraid-mbox 2.20.5.1-6vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-megaraid-sas 6.603.55.00-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-megaraid2 2.00.4-9vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-mpt2sas 19.00.00.00-2vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-mptsas 4.23.01.00-10vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-mptspi 4.23.01.00-10vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
scsi-qla4xxx 5.01.03.2-7vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
shim-iscsi-linux-9-2-1-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-iscsi-linux-9-2-2-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-libata-9-2-1-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-libata-9-2-2-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-libfc-9-2-1-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-libfc-9-2-2-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-libfcoe-9-2-1-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-libfcoe-9-2-2-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-vmklinux-9-2-1-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-vmklinux-9-2-2-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
shim-vmklinux-9-2-3-0 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
smartpqi 1.0.1.553-10vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
uhci-usb-uhci 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
usb-storage-usb-storage 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
usbcore-usb 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
vmkata 0.1-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
vmkfcoe 1.0.0.0-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
vmkplexer-vmkplexer 6.7.0-0.0.8169922 VMW VMwareCertified 2018-08-27
vmkusb 0.1-1vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
vmw-ahci 1.2.0-6vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
xhci-xhci 1.0-3vmw.670.0.0.8169922 VMW VMwareCertified 2018-08-27
cpu-microcode 6.7.0-0.0.8169922 VMware VMwareCertified 2018-08-27
elx-esx-libelxima.so 11.4.1184.0-0.0.8169922 VMware VMwareCertified 2018-08-27
esx-base 6.7.0-0.0.8169922 VMware VMwareCertified 2018-08-27
esx-dvfilter-generic-fastpath 6.7.0-0.0.8169922 VMware VMwareCertified 2018-08-27
esx-ui 1.25.0-7872652 VMware VMwareCertified 2018-08-27
esx-xserver 6.7.0-0.0.8169922 VMware VMwareCertified 2018-08-27
lsu-hp-hpsa-plugin 2.0.0-13vmw.670.0.0.8169922 VMware VMwareCertified 2018-08-27
lsu-lsi-lsi-mr3-plugin 1.0.0-12vmw.670.0.0.8169922 VMware VMwareCertified 2018-08-27
lsu-lsi-lsi-msgpt3-plugin 1.0.0-8vmw.670.0.0.8169922 VMware VMwareCertified 2018-08-27
lsu-lsi-megaraid-sas-plugin 1.0.0-9vmw.670.0.0.8169922 VMware VMwareCertified 2018-08-27
lsu-lsi-mpt2sas-plugin 2.0.0-7vmw.670.0.0.8169922 VMware VMwareCertified 2018-08-27
native-misc-drivers 6.7.0-0.0.8169922 VMware VMwareCertified 2018-08-27
qlnativefc 3.0.1.0-5vmw.670.0.0.8169922 VMware VMwareCertified 2018-08-27
rste 2.0.2.0088-7vmw.670.0.0.8169922 VMware VMwareCertified 2018-08-27
vmware-esx-esxcli-nvme-plugin 1.2.0.32-0.0.8169922 VMware VMwareCertified 2018-08-27
vsan 6.7.0-0.0.8169922 VMware VMwareCertified 2018-08-27
vsanhealth 6.7.0-0.0.8169922 VMware VMwareCertified 2018-08-27
tools-light 10.2.1.8267844-8941472 VMware VMwareCertified 2018-08-27
[root@localhost:~]
</pre>

== Perform reboot and exit maintenance mode ==
Now, perform the reboot:
[root@localhost:~] reboot

After the reboot, exit maintenance mode:
[root@localhost:~] vim-cmd hostsvc/maintenance_mode_exit

== References ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category:VMware vSphere 6.7]]
[[de:VMware ESXi updaten]]

IPMI configuration for Supermicro systems

2026-08-06T09:30:00Z

Aranzinger: Created page with "This article describes tools for the configuration of IPMI modules for Supermicro systems. Alternatively, the ipmitool can also be used if the server is operated on Linux (see also IPMI Configuration under Linux using ipmitool). == IPnMAC == With this tool (on Linux IPMICFG, see below), it is possible to set the IP address and the MAC address locally on the server. It must be taken into consideration that the correct MAC..."

This article describes tools for the configuration of IPMI modules for Supermicro systems. Alternatively, the ipmitool can also be used if the server is operated on Linux (see also [[Configuring IPMI under Linux using ipmitool|IPMI Configuration under Linux using ipmitool]]).

== IPnMAC ==

With this tool (on Linux IPMICFG, see below), it is possible to set the IP address and the MAC address locally on the server. It must be taken into consideration that the correct MAC address is already preconfigured.

== XGICFG ==

With the XGICFG tool (for DOS), diverse network parameters can be locally set for the IPMI module on the server. The possible options are listed in the following:

-m Show IP and MAC
-m IP Set IP (format :###.###.###.###)
-k Show Subnet Mask
-k Mask Set Subnet Mask (format :###.###.###.###)
-dhcp on Enable the DHCP
-dhcp off Disable the DHCP
-g Show Gateway IP
-g IP Set Gateway IP (format :###.###.###.###)

== IPMICFG ==

IPMICFG allows the local configuration of multiple IPMI settings and is available for the following operating systems:
* Windows (In addition to the command-line program IPMICFG, it also includes the graphical ''IPMI Configuration Utility'')
* Linux
* DOS

Detailed information on IPMICFG: [[IPMI configuration for Supermicro servers with ipmicfg]]

== IPMI view ==
[[Supermicro IPMI View]] also allows the IPMI configuration of Supermicro systems. For the access via IPMI view, however, a working IP address for IPMI must have been set up beforehand.

== psetup ==
IPMI modules, that are based on the Raritan KIRA chip (such as the IPMI module for X7 motherboards), can also be configured by using psetup: [[Raritan KIRA basierendes Remote Management mit psetup konfigurieren|Configuration of Raritan KIRA based Remote Management with psetup]].

== IPMI configuration via BIOS ==

For the new Supermicro motherboards (X8/X9/H8 series), the configuration of the IPMI module is possible via mainboard BIOS: [[Supermicro IPMI Configuration through BIOS or Web Interface]]

== Weblinks ==

[https://www.thomas-krenn.com/redx/tools/mb_download.php/mid.x426274344b6e4f5a6365383d/SW_IPMICfg-Utility-Windows_1.5_110420.zip Download IPMI Config-Tool for Windows]

[https://www.thomas-krenn.com/redx/tools/mb_download.php/mid.x4146352f4e6338477669733d/IPMICFG-DOS_v1.25_100106_1.zip Download IPMI Config-Tool for DOS]

[https://www.thomas-krenn.com/redx/tools/mb_download.php/mid.x77383743655052663377773d/SW_IPMICFG-Linux_v1.37_20110429.zip Download IPMI Config-Tool for Linux]

[ftp://ftp.supermicro.com/CDR-0010_2.10_IPMI_Server_Managment/ Content IPMI CD]

[ftp://ftp.supermicro.com/CDR-0010_2.10_IPMI_Server_Managment/IPMI_Solution/ IPMI-View]

[ftp://ftp.supermicro.com/CDR-0010_2.10_IPMI_Server_Managment/Manuals IPMI Documentation]

[[Category:IPMI]]
[[pl:Konfiguracja IPMI w systemach Supermicro]]
[[de:IPMI Konfiguration für Supermicro Systeme]]
{{Aranzinger}}

Software tools for IPMI at a glance

2026-08-06T05:51:48Z

Aranzinger: /* Manufacturer specific toolsy */

For [[IPMI Basics|IPMI]], there are multiple software tools for different purposes and operating systems. In the following, there is an overview of useful '''IPMI tools'''.

== Linux ==

=== IPMItool ===
[http://ipmitool.sourceforge.net/ IPMItool] is already included in multiple Linux distributions.

You can now communicate with IPMItool in two different ways with IPMI BMC's:
* via network by using a so-called LAN channel. In this case, only IPMItool is required.
* locally via a system interface to the BMC of the computer on which you are currently using IPMItool. In this case, the IPMI device driver from OpenIPMI is required (see below).

Originally, IPMItool was often bundled with OpenIPMI in packages provided by distributions. However, since these are independent software tools, IPMItool is now usually provided as a standalone package.<ref>[https://bugzilla.redhat.com/show_bug.cgi?id=466762 Bug 466762 - Review Request: ipmitool - Utility for IPMI control ] (bugzilla.redhat.com)</ref>

More information on the IPMItool in Thomas-Krenn-Wiki:
* [[IPMI Konfiguration unter Linux mittels ipmitool|Configuring IPMI under Linux using ipmitool]]
* [[Ipmitool zur Remotesteuerung von Servern nutzen|Using Ipmitool to Remotely Control Servers]]
* [[Ipmitool zur Sensorabfrage von Servern nutzen|Using Ipmitool to Check Server Sensors]]

=== OpenIPMI ===
[http://openipmi.sourceforge.net/ OpenIPMI] consists of two parts:
* an IPMI device driver for the Linux kernel
* a user-level library that provides a higher abstraction of IPMI

Updates from OpenIPMI in RHEL:
* [http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.4/html/Technical_Notes/OpenIPMI.html OpenIPMI updates in RHEL 5.4]
* [http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5.b1/html/Technical_Notes/ch01.html#OpenIPMI OpenIPMI updates in RHEL 5.5]

More information on OpenIPMI in Thomas-Krenn-Wiki:
* [[IPMI Analyse mit openipmish|IPMI analysis with openipmish]]

=== FreeIPMI ===
[[FreeIPMI]], just like IPMItool, allows IPMI queries both over the network and locally via a system interface. FreeIPMI, however, requires '''no IPMI device driver'''. The required code for the access via system interface is already included in FreeIPMI. It is not possible to run the OpenIPMI device driver and FreeIPMI at the same time.

FreeIPMI is specifically designed to meet the requirements of large computer clusters (HPC). At Thomas-Krenn, we use FreeIPMI at [[IPMI Sensor Monitoring Plugin]] (v2 and v3) for Nagios/Icinga.

FreeIPMI is included in RHEL 5 as Technology Preview.<ref>http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/Release_Notes/sect-Release_Notes-Technology_Previews.html</ref>

=== IPMIutil ===
[http://ipmiutil.sourceforge.net/ IPMIutil] is another tool in the IPMI environment. In addition to Linux, it is also available for Windows, Solaris, BSD, and EFI. More details can be found in the [http://ipmiutil.sourceforge.net/docs/ipmisw-compare.htm comparison table of IPMIutil].

IPMIutil is included in Fedora 14.<ref>http://fedoraproject.org/wiki/Features/ipmiutil</ref>

== Windows ==

=== Microsoft IPMI provider ===
The Microsoft IPMI provider is not an independent tool. Instead, as a WMI provider, it allows other tools to access IPMI BMC information.

More information at Microsoft:
* [http://msdn.microsoft.com/en-us/library/aa391402%28VS.85%29.aspx IPMI Provider (Windows)] (http://msdn.microsoft.com)

=== IPMIutil for Windows ===
(see [[#IPMIutil]])

== iPhone ==
[[file:IPhone-IPMI-touch-01.png|right|thumb|300px|IPMI touch on the iPhone]]
There are two IPMI apps for the iphone by [http://www.yellowkompressor.com/ www.yellowkompressor.com]
* [http://www.yellowkompressor.com/ipmi-touch/ipmi-touch/ IPMI touch] (subject to a fee), [http://itunes.apple.com/app/ipmi-touch/id325614107 IPMI touch in the AppStore]
* [http://www.yellowkompressor.com/ipmi-touch/ipmi-light/ IPMI light] (free of charge), [http://itunes.apple.com/app/ipmi-light/id325610519 IPMI light in the AppStore]

== Manufacturer-specific tools ==

=== Supermicro tools ===
See [[IPMI Konfiguration für Supermicro Systeme|IPMI configuration for Supermicro systems]].

== References ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category:IPMI]]
[[pl:Przegląd narzędzi programowych IPMI]]
[[de:Softwaretools für IPMI im Überblick]]

Terraform with Proxmox VE tutorial

2026-08-05T05:48:16Z

Aranzinger: Created page with "This article is about the first use of Terraform with Proxmox VE. You will receive all the necessary information beginning with the installation of Terraform to the first deployment of a Proxmox resource (VM). == Overview == Once setup is complete, the basic workflow in Terraform with Proxmox VE is as follows: # '''Install Terraform''' # '''Create Proxmox API-Token:''' for Terraform to access Proxmox VE # '''Create Terraform Provider:''' Communicates Terraform that..."

This article is about the first use of Terraform with [[Proxmox VE]]. You will receive all the necessary information beginning with the installation of Terraform to the first deployment of a Proxmox resource (VM).

== Overview ==
Once setup is complete, the basic workflow in Terraform with Proxmox VE is as follows:
# '''Install Terraform'''
# '''Create Proxmox API-Token:''' for Terraform to access Proxmox VE
# '''Create Terraform Provider:''' Communicates Terraform that Proxmox VE is the deployment target
# '''Create Cloud-Init-Image:''' For a simple and completed deployment including IP addresses
# '''Create or modify Terraform resources'''
# '''Terraform Init:''' Terraform tests the connection to the provider
# '''Terraform Plan:''' Terraform displays the planned changes
# '''Terraform Apply:''' Terraform displays/modifies the resources

== Terraform installation ==
=== Terraform installation ===

A Debian 12 container has been created and Terraform has been installed with the following commands:<ref>[https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli Terraform Installation] (developer.hashicorp.com)</ref>

<pre>
apt install curl unzip &&
curl -O https://releases.hashicorp.com/terraform/1.5.3/terraform_1.5.3_linux_amd64.zip &&
unzip terraform_1.5.3_linux_amd64.zip
mv terraform /usr/local/bin
</pre>

=== Creation of API token in PVE ===

First, an API token must be created in Proxmox VE. This can be made on datacenter level at <code>Permissions -> API-Tokens -> Add</code>. It is important that <code>Privilege Separation</code> is set to <code>No</code> for this functional test, or that you do not check the box when creating the API token. Please make a copy of the API key after you create it, as you will not be able to view it again later. In our case, this results in the following credentials:

<pre>root@pam!terraform2
b057aea1-a092-49c3-b530-a53fd9e6fccc</pre>

== Terraform configuration ==
=== Creating Terraform provider ===

So that Terraform knows, that it should use Proxmox as provider, a <code>provider.tf</code>-file must be created:

<pre>touch provider.tf
nano provider.tf
</pre>

<pre>
terraform {

required_providers {
proxmox = {
source = "telmate/proxmox"
version = "2.9.14"
}
}
}

variable "proxmox_api_url" {
type = string
}

variable "proxmox_api_token_id" {
type = string
sensitive = true
}

variable "proxmox_api_token_secret" {
type = string
sensitive = true
}

provider "proxmox" {

pm_api_url= var.proxmox_api_url
pm_api_token_id = var.proxmox_api_token_id
pm_api_token_secret = var.proxmox_api_token_secret
pm_tls_insecure = true
}
</pre>

=== Enter API credentials ===

In addition, Terraform must now authenticate with Proxmox VE using the API user and API key. Here, the configuration file <code>credentials.auto.tfvars</code> can be used and adapted to the environment:

<pre>
touch credentials.auto.tfvars
nano credentials.auto.tfvars
</pre>

<pre>
proxmox_api_url = "https://10.2.1.130:8006/api2/json"
proxmox_api_token_id = "root@pam!terraform2"
proxmox_api_token_secret = "b057aea1-a092-49c3-b530-a53fd9e6fccc"
</pre>

== Cloudinit under Proxmox VE ==
Since using cloud images makes sense in Terraform, here is a quick look at how to create and modify one. For this, an Ubuntu image is downloaded '''on the Proxmox hypervisor''' and the package <code>libguestfs-tools</code> is installed, which is required to make adjustments in the cloud image.<ref>[https://libguestfs.org/virt-customize.1.html virt-customize - Customize a virtual machine] (libguestfs.org)</ref>
Details for the creation of Cloud-Init-Templates can be found in the article [[Cloud Init Templates in Proxmox VE - Quickstart]]

=== Virt-Customize ===
The Virt-Customize tool is quite extensive and is also able to perform the following option:
<pre>
--run SCRIPT
--touch FILE
--firstboot SCRIPT
--mkdir DIR
--move SOURCE:DEST
--install PKG,PKG
--firstboot-install PKG,PKG
--append-line FILE:LINE
</pre>

== Overview in Proxmox VE ==
The templates are prepared and you can now use these templates to deploy as many VMs as you like. In the following example, there are 4 VMs that are ready to run immediately, including IP configuration, hostname, etc. To achieve this, 3 additional resource files were created with the names <code>srv_demo_2.tf</code>, <code>srv_demo_3.tf</code> and <code>srv_demo_4.tf</code> and adapted to our needs.

[[file:Proxmox Terraform.png|Terraform-Container and both templates (9000) and (9001)|frameless|without]]

== Terraform Workflow ==
=== Terraform Init ===

After this, it can be tested if Terraform can access the Proxmox host via API. For this, <code>terraform init</code> is used:

<pre>root@js-terraform-01:~# terraform init

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of telmate/proxmox from the dependency lock file
- Using previously-installed telmate/proxmox v2.9.14

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
root@js-terraform-01:~# </pre>

=== Create Terraform resource ===

The goal of Terraform is, simply put, to be able to provision individual resources on various hypervisors (in this case with Proxmox VE). For this, Terraform configuration files are created, which describe what the resource to be provisioned should look like. Here is an example of the <code>srvdemo1.tf</code> file. We will be using a clone, so we need the VM template <code>ubuntu2204-ci</code>, which will later be created using a cloud image.

<pre>
touch srvdemo1.tf
nano srvdemo1.tf
</pre>

<pre>resource "proxmox_vm_qemu" "srv_demo_1" {
name = "srv-demo-1"
desc = "Ubuntu-Server"
target_node = "PMX4"
sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj8ipwPHVSI/yvERzILBD52zL1jj6Ja3ptWlVhR0WK6ElBekwKL314Sps79xAitJb>
agent = 1
clone = "ubuntu2204-ci"
qemu_os = "l26"
# this l26 is a small l like linux
cores = 2
sockets = 1
cpu = "host"
memory = 8096
scsihw = "virtio-scsi-pci"

vga {
type = "std"
}

disk {
storage = "vm_nvme"
type = "scsi"
size = "83212M"
discard = "on"
ssd = "1"
}

network {
bridge = "vmbr0"
model = "virtio"
}

## must match the template

os_type = "cloud-init"
ipconfig0 = "ip=dhcp"
nameserver = "192.168.110.61"
ciuser = "tk"
}
</pre>

A VM is created, including IP configuration. In addition, a cloud image is used, which you can also customize to suit your own needs.

=== Terraform plan ===

With <code> terraform plan </code>, you can use Terraform to provision the VM. This means that no resources are created yet. The configuration file and the connection to the provider are tested and validated.

<pre>root@js-terraform-01:~# terraform plan
+ create

Terraform will perform the following actions:

# proxmox_vm_qemu.srv_demo_1 will be created
+ resource "proxmox_vm_qemu" "srv_demo_1" {
+ additional_wait = 5
+ agent = 1
+ automatic_reboot = true
+ balloon = 0
+ bios = "seabios"
+ boot = (known after apply)
+ bootdisk = (known after apply)
+ ciuser = "tk"
+ clone = "ubuntu2204-ci"
+ clone_wait = 10
+ cores = 2
+ cpu = "host"
+ default_ipv4_address = (known after apply)
+ define_connection_info = true
+ desc = "Ubuntu-Server"
+ force_create = false
+ full_clone = true
+ guest_agent_ready_timeout = 100
+ hotplug = "network,disk,usb"
+ id = (known after apply)
+ ipconfig0 = "ip=dhcp"
+ kvm = true
+ memory = 8096
+ name = "srv-demo-1"
+ nameserver = "192.168.110.61"
+ onboot = false
+ oncreate = true
+ os_type = "cloud-init"
+ preprovision = true
+ reboot_required = (known after apply)
+ scsihw = "virtio-scsi-pci"
+ searchdomain = (known after apply)
+ sockets = 1
+ ssh_host = (known after apply)
+ ssh_port = (known after apply)
+ sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj8ipwPHVSI/yvERzILBD52zL1jj6JaSKoN1t1ftXEKbp+cuwZPUWykvSaR13ptWlVhR0WK6ElBekwKL314Sps79xAitJbbD35yDuMVtLUK/Bo+j2ehuWWmFZMwi1UKsPgCzF/YarsX12aCIS2Gyyf2NnscgOGlQKIdcgtfO23Xz18yxQxmFuRFVbFscd7gghRoQWsoKKwldbCKS8JEbXE8Mrb5mA7XD1C4dQLMnFvoJUvx3UqZinQHc20lWjqlZIOZ0uxRz6ssVFoCn+bKKNdf43JEnwPhcxQC2vGmKWunojNsXCifdx16fvd/wegXrdL8uw2oWUAvNsjCIUYCFn+VOn5JXEAxlXCAUNN9Z9H6/64QhwTjAXibwzB8Yj2+mGqd2ODy9ZIs+nzqxsmITA8+ayaEigZngol54f6vafmQzRHrM6Zn768UEYqEGb2LgYtI/0eTClO+E0HAPVfwpRwy6T1MhmIY8otSizE3PN3pg+fcyxv9oyMnxVsYCpspzE= root@js-terraform-01>"
+ tablet = true
+ target_node = "PMX4"
+ unused_disk = (known after apply)
+ vcpus = 0
+ vlan = -1
+ vmid = (known after apply)

+ disk {
+ backup = true
+ cache = "none"
+ discard = "on"
+ file = (known after apply)
+ format = (known after apply)
+ iops = 0
+ iops_max = 0
+ iops_max_length = 0
+ iops_rd = 0
+ iops_rd_max = 0
+ iops_rd_max_length = 0
+ iops_wr = 0
+ iops_wr_max = 0
+ iops_wr_max_length = 0
+ iothread = 0
+ mbps = 0
+ mbps_rd = 0
+ mbps_rd_max = 0
+ mbps_wr = 0
+ mbps_wr_max = 0
+ media = (known after apply)
+ replicate = 0
+ size = "83212M"
+ slot = (known after apply)
+ ssd = 1
+ storage = "vm_nvme"
+ storage_type = (known after apply)
+ type = "scsi"
+ volume = (known after apply)
}

+ network {
+ bridge = "vmbr0"
+ firewall = false
+ link_down = false
+ macaddr = (known after apply)
+ model = "virtio"
+ queues = (known after apply)
+ rate = (known after apply)
+ tag = -1
}

+ vga {
+ type = "std"
}
}

</pre>

=== Terraform Apply ===

You can then create the resources using <code>terraform apply </code>. Confirm with <code>yes</code>, and then (in this case, 4 VMs) will be deployed. The output has been shortened for clarity, so that only the complete output of <code>srv_demo_1</code> is displayed:

<pre>root@js-terraform-01:~# terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

# proxmox_vm_qemu.srv_demo_1 will be created
+ resource "proxmox_vm_qemu" "srv_demo_1" {
+ additional_wait = 5
+ agent = 1
+ automatic_reboot = true
+ balloon = 0
+ bios = "seabios"
+ boot = (known after apply)
+ bootdisk = (known after apply)
+ ciuser = "tk"
+ clone = "ubuntu2204-ci"
+ clone_wait = 10
+ cores = 2
+ cpu = "host"
+ default_ipv4_address = (known after apply)
+ define_connection_info = true
+ desc = "Ubuntu-Server"
+ force_create = false
+ full_clone = true
+ guest_agent_ready_timeout = 100
+ hotplug = "network,disk,usb"
+ id = (known after apply)
+ ipconfig0 = "ip=dhcp"
+ kvm = true
+ memory = 8096
+ name = "srv-demo-1"
+ nameserver = "192.168.110.61"
+ onboot = false
+ oncreate = true
+ os_type = "cloud-init"
+ preprovision = true
+ reboot_required = (known after apply)
+ scsihw = "virtio-scsi-pci"
+ searchdomain = (known after apply)
+ sockets = 1
+ ssh_host = (known after apply)
+ ssh_port = (known after apply)
+ sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj8ipwPHVSI/yvERzILBD52zL1jj6JaSKoN1t1ftXEKbp+cuwZPUWykvSaR13ptWlVhR0WK6ElBekwKL314Sps79xAitJbbD35yDuMVtLUK/Bo+j2ehuWWmFZMwi1UKsPgCzF/YarsX12aCIS2Gyyf2NnscgOGlQKIdcgtfO23Xz18yxQxmFuRFVbFscd7gghRoQWsoKKwldbCKS8JEbXE8Mrb5mA7XD1C4dQLMnFvoJUv= root@js-terraform-01>"
+ tablet = true
+ target_node = "PMX4"
+ unused_disk = (known after apply)
+ vcpus = 0
+ vlan = -1
+ vmid = (known after apply)

+ disk {
+ backup = true
+ cache = "none"
+ discard = "on"
+ file = (known after apply)
+ format = (known after apply)
+ iops = 0
+ iops_max = 0
+ iops_max_length = 0
+ iops_rd = 0
+ iops_rd_max = 0
+ iops_rd_max_length = 0
+ iops_wr = 0
+ iops_wr_max = 0
+ iops_wr_max_length = 0
+ iothread = 0
+ mbps = 0
+ mbps_rd = 0
+ mbps_rd_max = 0
+ mbps_wr = 0
+ mbps_wr_max = 0
+ media = (known after apply)
+ replicate = 0
+ size = "83212M"
+ slot = (known after apply)
+ ssd = 1
+ storage = "vm_nvme"
+ storage_type = (known after apply)
+ type = "scsi"
+ volume = (known after apply)
}

+ network {
+ bridge = "vmbr0"
+ firewall = false
+ link_down = false
+ macaddr = (known after apply)
+ model = "virtio"
+ queues = (known after apply)
+ rate = (known after apply)
+ tag = -1
}

+ vga {
+ type = "std"
}
}

# proxmox_vm_qemu.srv_demo_2 will be created
# proxmox_vm_qemu.srv_demo_3 will be created
# proxmox_vm_qemu.srv_demo_4 will be created

Plan: 4 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

proxmox_vm_qemu.srv_demo_4: Creating...
proxmox_vm_qemu.srv_demo_2: Creating...
proxmox_vm_qemu.srv_demo_3: Creating...
proxmox_vm_qemu.srv_demo_1: Creating...
...
proxmox_vm_qemu.srv_demo_4: Creation complete after 39s [id=PMX4/qemu/103]
proxmox_vm_qemu.srv_demo_3: Creation complete after 47s [id=PMX4/qemu/101]
proxmox_vm_qemu.srv_demo_1: Creation complete after 49s [id=PMX4/qemu/102]
proxmox_vm_qemu.srv_demo_2: Creation complete after 53s [id=PMX4/qemu/104]

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.
</pre>
[[file:Proxmox Terraform Apply.png|without|small|650x650px|Terraform allocates Proxmox VMs]]

== More information ==
* [https://www.youtube.com/watch?v=dvyeoDBUtsU& YouTube video on Proxmox Automation with Terraform]: Live-Demo on using and configuring Terraform in Proxmox VE
* [https://registry.terraform.io/providers/Telmate/proxmox/latest Proxmox Terraform Provider]: Terraform-Provider Docs (Telmate/proxmox)

== References ==
<references />

 
{{jsterr}}
{{Aranzinger}}
[[Category:VMs/Containers]]
[[de:Terraform mit Proxmox VE Tutorial]]

IPMI/BMC Security Vulnerability in Older Implementations

2026-07-31T09:05:42Z

Aranzinger: /* Sources */

== Introduction ==
In July 2025, attention was once again drawn to a vulnerability that has been known for many years in various implementations of the Intelligent Platform Management Interface (IPMI) and the underlying Baseboard Management Controllers (BMCs). Security researchers have identified numerous management interfaces that are available via Internet, which remain vulnerable to an attack on the authentication mechanism.

The vulnerability allows, with certain requirements, to read out password hashes from user accounts. After that, they can be analyzed offline or attacked via brute force or dictionary attacks. As IPMI operates independently of the installed operating system and provides extensive administrative functions, a successful compromise poses a significant security risk.

== Background ==
IPMI is a standardized management interface for administrating servers. The implementation is made via Baseboard Management Controller (BMC), which operates independently from the operating system. Administrators can also

* switch on and switch off servers
* monitor the system condition
* update firmware
* perform console access as well as
* remote installations

As these functions are also available when the operating system is switched off or does not function, the BMC possesses multiple authorizations and should be extra protected.

== Description of vulnerability ==
The affected vulnerability concerns the authentication mechanism, which are older than IMPI-2.0 implementations. An attacker can send special prepared authentication requests and can therefore receive hash values from user passwords without successful authentication.

Next, the hash values can be analyzed offline. Depending on the password quality, an attacker could use this to determine the actual login data. After successful login, the attacker gets access to all management functions of the BMC.

The vulnerability itself does not allow direct access to the operating system, but it can allow the complete remote access to the server.

== Affected systems ==
In general, servers whose BMC firmware implements the vulnerable authentication mechanism and whose IPMI interface is accessible from untrusted networks may be affected.

The following are particularly relevant:

* older server platforms
* not updated BMC firmware
* IPMI interfaces accessible from the public network
* systems with weak or reused passwords

Whether a specific system is affected depends on the manufacturer, firmware version, and configuration.

== Potential impact ==
A successful utilization may have the following consequences:

* disclosure of password hashes
* offline attacks on user passwords
* complete access on the BMC
* remote console access
* turning systems on and off
* integration of virtual installation medium
* change of firmware configuration
* bypassing Operating System Security Mechanisms

As the BMC operates independently of the host system, a lot of these opportunities remain in place even if the actual operating system is switched off.

== Verification of the own infrastructure ==
Administrators should check

* if IPMI interfaces are publicly available
* which firmware version is used
* if safety updates are available
* which user accounts are available
* if strong passwords should be used
* which networks should have access to the BMC.

In addition, it is recommended to monitor the firewall rulesas well as the management networks on a regular basis.

== Protective measures ==
The following measures are recommended to protect the system:

* install latest BMC-firmware
* make IPMI accessible exclusively via internal management networks
* avoid public accessibility
* use strong individual passwords
* remove unused user accounts
* replace standard passwords
* restrict management accesses on confidential administrators
* use VPN or Jump Hosts for the remote access, if possible

== Firmware updates ==
Multiple server manufacturers provide updated firmware versions that fix known vulnerabilities or implement additional protective measures. The respective release notes should be controlled before an update and the update is performed in accordance with the manufacturer's recommendations.

=== Updates for Thomas-Krenn products ===
Updates on the corresponding system can be found in the <tklink type="sitex" id="440">Thomas-Krenn download area</tklink>.
The versions in the download area have been tested by us to guarantee the stability and compatiblity of our systems.

If you require the latest version for your system and it is not yet available in our download area, you can get it at the respective manufacturer.

== Conclusion ==
The renewed attention for this vulnerability, that has been known for years, shows that management interfaces continue to be a frequently underestimated target for attacks. Independent from the age of the vulnerability, public available BMC or IPMI interfaces should be verified on a regular basis, operted with the latest firmware and available via secured management networks only.

== Sources ==

* [https://www.thomas-krenn.com/de/wikiDE/index.php?title=IPMI_Sicherheitsupdates&xtxsearchselecthit=1 Thomas-Krenn Wiki: IPMI Safety Updates]
* [https://www.heise.de/news/Server-Fernwartung-24-650-Server-fuer-20-Jahre-alte-Luecke-anfaellig-11382232.html Remote Server Maintenance – 24.650 Server vulnerable for 20 year old vulnerability] (heise.de, July 2026)
* [https://www.golem.de/news/passwort-hashes-auslesbar-20-jahre-alte-bmc-luecke-gefaehrdet-ueber-24-000-server-2607-211397.html Passwort-Hashes readable – 20 year old BMC vulnerability puts more than 24,000 servers at risk] (golem.de, July 2026)

{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category:Server Hardware]]
[[de:IPMI/BMC-Sicherheitslücke in älteren Implementierungen]]

Copy-on-Write principle in ZFS

2026-07-30T07:44:00Z

Aranzinger:

'''Copy-on-Write''' is an optimization principle of data processing in which changes are not made directly to the existing data set, but are always written to a new copy. As the cornerstone of the [[ZFS Basics|ZFS]] file system's storage strategy, CoW, in combination with transaction groups, ensures that an interrupted write operation can never result in an inconsistent file system. This is why ZFS stands out from classic file systems that overwrite the data completely.

== Copy-on-Write principle ==
For write operations based on the CoW principle, '''data blocks are not overwritten when changes are made'''. Instead, new data blocks are written with the changes, and the old data blocks are simply overwritten. To receive the consistency of the data, CoW works with a reference system that is also known as ''Hash-Tree'' (or ''Merkle-Tree'')<ref>[https://en.wikipedia.org/wiki/Merkle_tree Merkle Tree] (en.wikipedia.org, 2026)</ref>. With the help of this system it is ensured that errors in data integrity can be noticed all time.

=== The tree structure ===
[[File:Zfs-merkletree.png|alt=Image 1: A simple Hash-tree.|thumb|1st image: A simple hash tree]]
In the first image, a simplified view of a hash tree is represented:

* At the endpoints of the trees, that are also called ''leaves'', the data blocks can be found.
* The nodes above, ''inner nodes'' or ''branches'', include ''block pointers''. Every of these ''pointers'' includes information on the underlying blocks, for example the physical location of the data, the size of blocks as well as the number of the transaction group (''Birth-TXG''), in which the block has been written to. The most important information, however, is the '''check sum'''.
* At the top level, the ''uberblock'' is located. This value is unique within a <code>zpool</code> and is recalculated after every write operation. It includes the check sum from which can be used to verify all data contained in <code>zpool</code>.

=== Application in transaction groups ===
ZFS stores the data in so-called ''transaction groups (txg)'' in the RAM of the system. After a determined timeline, the default setting is 5 seconds, or when enough data has been collected, all changes collected in the transaction group are committed simultaneously<ref name=":0" />.

With this procedure, it is ensured that an inconsistent data set is excluded by an interrupted writing process.

Either the ''txg'' is committed: Then a new "uberblock" was created, and the file system is now consistent.

Or the ''txg'' has not been committed: In that case, the old "uberblock" is considered current, and the file system is also consistent (just older).

== The writing process ==
[[File:Zfs-CoW.png|alt=|thumb|2nd image: After a writing process, the replaced blocks are released. The unchanged blocks remain untouched<ref name=":0">[https://openzfs.github.io/openzfs-docs/Basic%20Concepts/Copy-on-write.html#transaction-groups Copy-on-Write in the OpenZFS Documentation] (openzfs.github.io, 2026)</ref>.]]
In the second image, the condition of the file system can be seen with Copy-on-Write after a writing process. The following steps have contributed to this result:

# A change makes it necessary to replace the data in the block <code>D4</code>
# A new block <code>D4'</code> is created that includes the new data
# The new block should be included into the ''Hash''-tree. For this, it is necessary to form a new <code>inode2</code>, which is described with <code>inode2'</code> here. This step is necessary, as the checksum must be recalculated for all parent nodes
# As described in step 3, <code>root</code> and <code>uberblock</code> are also recreated
# The ''inner nodes'' are reconnected with the unchanged nodes and the check sums are reformed. The new data blocks are now integrated

With the integration of the new data block, the old data block <code>D4</code> was replaced and released, just like all parent nodes. As long as there is no ''snapshot'' that references the old block, it can be reused for future write operations.

== Consequences of CoW-strategy ==
CoW gives rise to some of ZFS's most important features as a logical consequence. However, this also highlights some of ZFS's weaknesses. These are listed as advantages and disadvantages in the following.

=== Advantages ===

* '''''[[ZFS Snapshots|Snapshots]]''''' – in other words, snapshots of a system's state - '''can be simply created by CoW'''. All you need to do is reference and freeze the "uberblock" and its underlying nodes and blocks.
* '''''Clones''''' '''can be also simply created''', as simple references can be used here as well.
* '''''Incremental Duplication''''' '''is exactly''', as every block knows, in which transaction group it has been created. This allows ZFS to jump directly to the changed sections when comparing two snapshots, rather than checking each file individually.
* '''''Data corruption'' is traceable and often repairable'''. Damaged blocks can be identified by verifying the check sums. If the file system has been built redundant, no damaged block can be recreated in most cases.
* '''''<code>fsck</code>'' is obsolete''', as CoW always ensures a consistant pool.

=== Disadvantages ===

* '''Fragmentation''' occurs''.'' Every change is written into new blocks. As a result, even files that were originally written sequentially become fragmented. The fuller <code>zpool</code> gets, the more difficult it gets to find sufficiently contiguous blocks for sequential writing processes.
* Free storage space is required at all times, because even during deletion operations, the blocks that were used are not deleted; instead, new nodes and blocks must be created.
* If only parts of a data set must be changed, it can be slow independent of the <code>recordsize</code>, as the whole data set must be read. For a data set with <code>recordsize=128k</code> in which 8 KB are to be modified, 128 KB must be read, 8 KB must be modified in memory, and the result must then be written back as a new 128-KB record.

== More information ==
[https://www.heise.de/select/ix/2017/2/1486040905020105 ZFS, Part 1: Concepts and basics from Michael Plura] (heise.de, 2017)

[https://www.linux-magazin.de/ausgaben/2026/06/openzfs-2-4/ The Time Machine in Kernel Space: ZFS-Workflows on Ubuntu 24.04] (linux-magazin.de, 2026)

[https://web.archive.org/web/20060428092023/http://www.sun.com/2004-0914/feature/ "ZFS: The last word in file systems." by Jeff Bonwick] (web.archive.org, 2026)

== Sources ==
<references />

{{Sbohn}}
{{Aranzinger}}
[[de:Copy-on-Write Prinzip in ZFS]]
[[Category:Storage]]

Onboard RAID on Supermicro X12 Motherboards

2026-07-29T05:37:28Z

Aranzinger:

This article is about the topic Onboard RAID on X12 Supermicro [[:Category:Motherboards|Motherboards]]. It is explained how to create, administrate and delete a [[RAID]] in the BIOS. It also explains how Distributed PPL and Journaling Mode are used to counteract the [[RAID Write Hole]].

== Setup ==
In the following, it is explained how to create an Onboard RAID in the BIOS of your motherboard and which modes you need to be aware of.

=== Create RAID in the BIOS ===

To create a RAID in the BIOS, you must first enter the BIOS. You can do this by pressing the "Del" key several times during the boot process.
The following images describe how to create a simple RAID 5 array. Please note that with the onboard RAID controller on Supermicro X12 motherboards, only RAID 0, 1, 5, and 10 can be created.

<gallery>
File:Advanced-Reiter.png|Use the arrow keys to navigate to the tab '''Advanced'''.
File:SATA and RSTe Configuration.png|Use the arrow keys to navigate to '''SATA And RSTe Configuration''' access this menu by clicking on '''Enter'''.
File:AHCI-Einstellung.png|Select the '''SATA Mode Selection''' option and change the mode from '''AHCI''' to '''Intel RSTe Premium with Intel Optane System Acceleration.'''
File:Controller im BIOS.png|Navigate back to the tab '''Advanced'''. Here, the '''Intel(R) VROC SATA Controller''' is displayed. You can now configure this by pressing '''Enter.'''
File:Save changes and reset.png|Now use the arrow keys to navigate to the '''Save & Exit''' tab and select '''Save Changes and Reset.''' This will save your changes and restart the system. Enter the BIOS again during the restart..
File:Controller-BIOS.png|Navigate back to '''Advanced''' and select the onboard RAID controller. Here you will see the '''Create RAID Volume''' option, as well as the ports, names, and capacities of the connected storage devices. To create a RAID, select the '''Create RAID Volume''' option.
File:CreateRAIDvolume.png|This menu is used to create the RAID. Enter the desired '''name''' in the Name field. Under RAID Level, select the desired RAID level. In the '''Select Disks''' submenu, you can select the disks that will be part of the RAID array. '''Strip Size''' specifies the block size. Under '''Capacity''', you can select the capacity. However, this field is filled in automatically once you have selected the disks. Then select '''Create Volume''' to create the RAID.
File:RAID übersicht.png|The RAID you created is now displayed under '''RAID Volumes'''.
</gallery>

=== Delete RAID ===

To delete a RAID, use the arrow keys to navigate back to the "Advanced" tab, then to the "[[Intel VROC (SATA RAID)|Intel(R) VROC]] SATA Controller" subitem. Now press Enter to access the controller menu. Then select the RAID you want to delete and press Enter again.

<gallery>
File:RAID übersicht.png| Here, you can select the RAID you want to delete by clicking on '''Enter'''.
File:RAID Löschen.png|To delete the RAID, select the '''Delete''' option here.
File:RAID löschen Bestätigung.png|Confirm the deletion by selecting '''Yes. Please note that all data on the deleted storage device will be lost after deletion. Therefore, please delete the RAID only if you are certain that you no longer need the data.'''
</gallery>

=== RAID mode for parity RAID ===

The X12 series of Supermicro motherboards offers two different modes for configuring a RAID array with parity data. The explanation and configuration of the modes can be found in the following two paragraphs.
An advantage provide, however, both modes: With parity-based RAIDs (in the case of onboard RAIDs on X12 motherboards, this is limited to RAID 5), data is not lost if a power outage and a RAID drive failure occur simultaneously.

==== Distributed PPL ====

In the '''Distributed PPL''' version, the so-called '''RAID Write Hole journal''' is stored on all disks in the RAID array. This provides full protection against the RAID write hole, but there is a performance degradation during write-intensive tasks.
This kind of RAID can be easily created by selecting RAID 5 when creating the RAID and changing the '''RWH Policy''' from "Disable" to "Distributed PPL".

<gallery>
File:1 Modus wählen.png|Here you can select the mode '''Distributed PPL'''.
</gallery>

==== Journaling Mode ====

In this variant, the '''RAID Write Hole journal''' is stored on an extra hard drive. This hard drive can only be used for this purpose. The data carrier is also '''not''' included in the RAID array. If you want to create a RAID 5 in '''Journaling Mode''', instead of the usual three storage devices, four are required, since only the '''RAID Write Hole journal''' is stored on the fourth one. The performance degradation for write-intensive tasks depends on the performance of the storage device on which the RAID W/H journal is stored. However, the write speed is usually '''faster''' than in distributed mode. The journaling hard drive must be at least as large as the smallest hard drive in the RAID array.

<gallery>
File:Platte wählen.png|Select a hard drive on which the RAID W/H journal should be stored, and press '''Enter.'''
File:Markieren.png|Navigate to '''Mark as Journaling Drive''' and press '''Enter'''. Confirm the message that appears by selecting '''Yes'''.
File:RAIDerstellen.png|You can now create the RAID. Select RAID Level 5, then select the desired hard drives. You cannot select the hard drive marked as the journaling drive, as it is not part of the RAID array. Under '''RWH Policy''', select '''Journaling Drive''', and under '''Select RWH Journaling Drive''', select the hard drive you previously designated as the journaling drive.
</gallery>

To stop configuring the hard drive as a spare drive, follow the steps described above, but this time select '''Reset to non-RAID''' instead of '''Mark as Spare''' and confirm by pressing Enter.

== Administration ==
In the following, it is explained which options you have to administrate your Onboard RAID and how to remove hard drives from the RAID array.

=== Configuration spare plate ===

To administrate a RAID that has already been created, you have the opportunity to configure hard drives as '''spare plates'''. A spare plate is a hard drive, which is initially not in operation and takes over if a hard drive in the RAID array fails. The following series of images describes how this works.

<gallery>
File:Spare-Platte wählen.png|Select a desired hard drive to configure it as spare plate.
File:Spare-Markieren.png|Select '''Mark as Spare'''.
File:3 Bestätigen.png|Confirm the designation of the spare plate with '''Yes'''.
</gallery>

The steps described must be performed that the hard drive is not configured as spare plate. However, select '''Reset to non-RAID''' instead of '''Mark as Spare''' and confirm with Enter.

=== Remove hard drives from RAID array ===

If you have too many hard drives in your RAID array and you want to delete one, perform the following steps. For this example, a RAID 5 array with 4 hard drives was created although 3 would be enough.

<gallery>
File:RAIDwählen.png|Select the RAID array from which you want to remove the hard drive.
File:PlatteWählen.png|Select now the data carrier that should be removed from the RAID array.
File:ResetToNonRaid.png|Select here the option '''Reset to non-RAID'''.
File:Bestätigen.png|Confirm the removal by selecting '''Yes''' and pressing Enter.
</gallery>

After a hard drive has been removed, the RAID is in '''Degraded''' mode. This means that the RAID still functions but no longer in optimal condition. Normally, this mode occurs, when the hard drive fails unexpectedly. In this case, it is recommended to change it and to start a rebuild.

<gallery>
File:RaidWählen.png|Select the RAID, in which you want to start the rebuild.
File:RebuildWählen.png|Select the option '''Rebuild'''.
File:RebuildPlatteWählen.png|Select the hard drive with which you want to start the rebuild.
File:RebuildBestätigen.png|Confirm with '''Yes''', to start the rebuild.
</gallery>

=== Change RWH policy ===

The above described '''RWH Policy''' can also be changed afterwards. To do this, go back to the '''Controller BIOS''' and select the desired RAID. Next, select the desired mode under the '''RWH Policy''' option.

<gallery>
File:Policy ändern.png|Here, you can change the desired mode.
</gallery>

{{tbiebl}}
{{Aranzinger}}
[[Category:RAID Controllers]]
[[de:Onboard RAID auf Supermicro X12 Mainboards]]

Remove a Proxmox node from the cluster and add it again

2026-07-24T05:45:30Z

Aranzinger: Created page with "This article shows how to remove a node from a [https://www.thomas-krenn.com/de/wiki/Proxmox_VE?xtxsearchselecthit=1 Proxmox] Ceph cluster and, if necessary, add it back. == Requirements == * There must be no VMs or containers on the node to be removed. Therefore, it is recommended that you migrate them to another node beforehand (see the "Preparation" section for more information). * Please note that your cluster has enough free storage space to distribute the data o..."

This article shows how to remove a node from a [https://www.thomas-krenn.com/de/wiki/Proxmox_VE?xtxsearchselecthit=1 Proxmox] Ceph cluster and, if necessary, add it back.

== Requirements ==

* There must be no VMs or containers on the node to be removed. Therefore, it is recommended that you migrate them to another node beforehand (see the "Preparation" section for more information).
* Please note that your cluster has enough free storage space to distribute the data onto the remaining nodes

== Preparations ==
===Migration of VMs & containers===

Migrate all virtual machines and containers on any server. <gallery>
File:1 Migrate.png|Right-click the VM or container, then click '''[Migrate]'''.
File:Bulk Migrate.png|Alternatively, you can also use the '''[Bulk Migrate]''' by right clicking on the node to migrate several at once.
File:2 Migrate.png|In this window, select the node to which the VM or CT should be migrated.
File:3 Migrate.png|In the following, click on '''[Migrate]'''.
File:4 Migrate.png|The VM is migrated to the selected node.
File:5 Migrate.png|The VM/CT is now assigned in the overview to another node. Repeat this procedure until all VMs and containers are migrated.
</gallery>

=== Delete OSDs ===
<gallery>
File:1 OSD löschen.png|Select '''[Ceph] --> [OSD]'''
File:2 OSD löschen.png|Select an OSD of the node and click in the upper right corner on '''[Out]'''.
File:3 OSD löschen.png|In the following, select the same OSD and click on '''[Stop]''' this time'''.'''
File:4 OSD löschen.png|The OSD should now be displayed as down/out.
File:5 OSD löschen.png|Now select the OSD again and choose '''[More]''' --> '''[Destroy]''' --> '''[Remove]'''. This will completely delete the OSD. Repeat this process for the remaining OSDs.
File:6 OSD löschen.png|After deleting the OSDs, the desired node should look like this.
</gallery>

=== Delete Monitor, Manager, MetaDataServer Daemons ===
To avoid later complications when creating different daemons, it is recommended to delete it before the node is removed. Please follow these steps:<gallery>
File:Proxmox Monitor löschen.png|In the overview, click on '''[Ceph]''' --> '''[Monitor]''' and select the monitor that should be deleted. Next, click on '''[Destroy]'''.
File:Proxmox Manager löschen.png|Follow the same order for the managers as well.
File:Proxmox MetaDataServer löschen.png|In the websurface, click on '''[Ceph]''' --> '''[CephFS]''' and select the MetaDataServer. Next, click on '''[Destroy]'''.
</gallery>

=== Reading out name ===
Find the name of your node either in the GUI under the "Server View" or use these command in the CLI: ''"pvecm nodes".''The name of the server is required in the following step.
root@PMX1:~# pvecm nodes

Membership information
----------------------
Nodeid Votes Name
1 1 '''PMX1''' (local)
2 1 PMX2
3 1 PMX3
 

==Remove cluster node==
First, connect using the IP address of another node to prevent the connection from being lost during removal. Next, you have to shut down the node that should be removed. Please make sure that the node does not turn back on (for example with Wake-On-LAN).

In the following, you can enter the following command to remove the node from the cluster. Use the CLI of any other node for that.
root@PMX2:~# pvecm delnode PMX1
Killing node 1
root@PMX2:~#
 

==Reinstallation & configuration of node==

Now, it is important to know that the node can not be simply added back to the cluster, as a complete reinstallation must be performed. However, the previous configuration can also be used. Please note that the same PVE version is used as in the cluster. If you want to use another hardware, make sure that it is identical with the hardware of the remaining cluster nodes.

Now, you can start the configuration of your new system. For this, the configuration of the network and the editing of the host entries is necessary. Helpful tips for the configuration can be found in the following documentation: [https://pve.proxmox.com/pve-docs/chapter-sysadmin.html Proxmox Dokumentation]

== Cluster Join ==
Next, the node can be readded to the cluster.<gallery>
File:1 Proxmox Cluster join.png|Connect to the cluster that should be joined by the node and go to '''[Datacenter]''' --> '''[Cluster]''' and click on '''[Join Information]'''.
File:2 Proxmox Cluster join.png|Here, you can copy the Join information with a click on '''[Copy Information].''' After this, switch to the node that should be added.
File:3 Proxmox Cluster join.png|Here, go to '''[Datacenter]''' --> '''[Cluster]''' and click on '''[Join Cluster]'''.
File:4 Proxmox Cluster join.png|Under '''[Information]''', paste the Join information you copied earlier. You will also need the password and Link0 and Link1. These should be configured to match the cluster.
File:5 Proxmox Cluster join.png|Now, the node is added to the cluster.
</gallery>

== Ceph installation and configuration ==
The last step for the integration of a node into the cluster is the installation and configuration of Ceph on the newly added server.<gallery>
File:1 Ceph Installation.png|Select the new node and click on '''[Ceph]''' and perform the installation.
File:2 Ceph Installation.png|The configuration should be automatically applied to the other nodes.
File:3 Ceph Installation.png|Next, go to '''[Ceph]''' --> '''[Monitor]''' click '''[Create]''' and recreate the monitor.
File:4 Ceph Installation.png|For the manager service, click on '''[Create]'''.
File:5 Ceph Installation.png|To recreate the MDS, select '''[Ceph]''' --> '''[CephFS]''' and click '''[Create]'''.
File:6 Ceph Installation.png|Finally, you must create the OSDs under '''[Ceph] --> [OSD].''' You must use the same device class as you did for the other nodes.
File:7 Ceph Installation.png|The OSDs after creating them.
File:8 Ceph Installation.png|Ceph still needs some time to redistribute all the data. This may take a while.
File:9 Ceph Installation.png|After a short wait, everything should be back to normal.
</gallery>

{{Npauli}}
{{Aranzinger}}
[[Category:Proxmox Administration]]
[[de:Proxmox Node aus Cluster entfernen und erneut hinzufügen]]

Windows Server Core Licensing

2026-07-23T11:36:39Z

Aranzinger: /* Windows Server Access Licenses(CAL) */

Since '''[[Windows Server 2016 Editionsunterschiede|Windows Server 2016]]''', '''Microsoft''' relies on '''core licensing'''.

In this article, all important information, that is required for the '''licensing of Windows Server''', is included.

It is possible to test the latest server version up to 180 days for free.

A corresponding download can be found in [https://www.microsoft.com/de-de/evalcenter Microsoft Evaluation Center]. {{#widget:Imagebox-left|link={{#tklink:type=sitex|id=18135|linkonly=1}}|image=/de/wikiDE/images/9/99/WindowsServer2025-shoplink.png|text=Click here for our Microsoft software in the Thomas-Krenn online shop|campaign=Windows Server 2025 edition differences}} {{#widget:SitexBox|link={{#tklink:type=sitex|id=18135|linkonly=1}}|text=Click here for our Microsoft software in the Thomas-Krenn online shop|campaign=Windows Server 2025 edition differences}}

==Windows Server licensing==
Since Windows server 2016, it must be distinguished between Essentials and Standard/Datacenter . Every system running a Windows Server instance must be licensed, whether it is physical or virtualized.

===Windows Server Essentials===
For the Essentials Edition, the licensing model remains "per CPU / per server".

Essentials still has the limitation that a maximum of two CPUs may be installed.

An Essentials license includes two CPUs. Therefore, only one Essentials license needs to be assigned per server.

===Windows Server Standard and Datacenter===
For the Standard and Datacenter Edition, a '''core licensing''' is required. It must be noted how much active, physical kernels possesses a CPU.

To obtain two virtual licenses for the Standard Edition and unlimited licenses for the Datacenter Edition, the following three rules must be observed:

:'''Rule #1:''' Every physical '''processor''' is scored based on '''at least 8 cores'''
:'''Rule #2:''' Every physical '''server''' is scored based on '''at least 16 cores'''
:'''Rule #3:''' '''All physical and active cores''' must be licensed in accordance with Rule #1 and Rule #2

If you want to increase virtualization rights for the Standard Edition, you must double the number of licenses for 4 VMs, triple them for 6 VMs, quadruple them for 8 VMs, and so on.

==== Basis and additional licenses ====
There are so-called basis licenses and additional licenses. The basis licenses are available with 16 or 24 cores. Additional licenses are available with 2, 4 or 16 cores.

The following chart shows that additional licenses are required only when there are 4 or more CPUs or more than 8 cores.

[[file:Windows Server 2016 Core-Lizenzierung.png |900px]]

'''You are still unsure? No problem!'''

In the [https://www.thomas-krenn.com/de/index.html Thomas-Krenn online shop], you do not need to worry about the core licensing yourself.

Our online configurator automatically calculates the correct number of licenses, so that your new Windows server system is licensed correctly.

If you have questions on the licensing, do not hesitate to contact us.

==Software assurance==
Of course, you can also purchase software assurance for the new server operating system.

:'''Did you know? Software assurance for OEM!'''
: Within 90 days, you can buy a software assurance for your OEM Windows Server license
: An OEM license becomes a volume license when combined with software assurance. You have the same advantages as a volume license customer.
: Even after the SA expires, the OEM license remains a volume license, so you will continue to benefit from it.

Benefits you can enjoy through software assurance:
*'''License mobility''' - all 90 days right of reassignment of the license
*'''free upgrade to a new version of Windows Server'''
*Windows Virtual Desktop access licenses (VDA)
*and more...<ref>[https://download.microsoft.com/download/0/0/3/0039f316-45cf-4083-aa6e-c35da9d25c1b/sa_interactivebenefitschart.pdf Software Assurance] (www.microsoft.com)</ref>

==Windows Server Access Licenses(CAL)==
Windows Server Access Licenses - '''CAL'''s ('''C'''lient '''A'''ccess '''L'''icence) - are required for the access on systems with Windows Server operating system:

For every user '''or''' every device, you require a CAL. If the user or the device accesses a Windows Server via remote desktop, a RDS-CAL is '''required''' additionally.

CAL is tied to the '''latest version''' of Windows Server, which means that to license a user's access to a Windows Server 2025, you need a Windows Server 2025 User CAL for that user.

In this scenario, you must not use an older Windows Server CAL!

All important information about the topic access licenses/CALs, can be found directly at Microsoft<ref>[https://www.microsoft.com/de-de/Licensing/produktlizenzierung/client-access-license.aspx Server-Access-License – Client Access License, CAL] (www.microsoft.com)</ref>.

:'''Did you know? There are OEM-CALs!''' Every OEM-CAL (Windows-Server-CAL and RDS-CAL) allows the access on every Windows server, regardless of the manufacturer, regardless of whether the Windows Server was licensed through OEM or volume licensing.

You can purchase additional OEM CALs at any time in the Thomas-Krenn online shop: <tklink type=sitex id=18135/>.

==Downgrade right==
Every Windows Server license includes an '''unlimited downgrade right''', whether OEM or volume licenses.

With your Windows Server license, you have the right to install all underlying Windows Server versions and editions.

With a Windows Server 2025 Standard license, for example, you may install Windows Server 2016 Standard or Windows Server 2019 Essentials, but not, for example, Windows Server 2019 Datacenter.

To exercise this downgrade right, all you need is an installation medium as well as an installation product key (Windows key) of the operating system that should be installed.

There are so-called '''downgrade kits''' that include these installation mediums as well as product keys. You can also purchase these directly from Thomas-Krenn.

All important information on the downgrade topic can be found at Microsoft<ref>
[https://www.microsoft.com/OEM/de/licensing/sblicensing/Pages/downgrade_rights.aspx#fbid=APiJYEBPjyu Information on downgrade rights] (www.microsoft.com)</ref>.

== References ==
<references />

== More information ==
*[https://www.microsoft.com/licensing/guidance/Windows-Server-2025 Microsoft Licence Guide] (www.microsoft.com)
*[https://www.microsoft.com/en-us/cloud-platform/windows-server Windows Server] (EN) (www.microsoft.com)
*<tklink type="sitex" id="18135">Windows Server 2025 Pricing Information
</tklink> (www.thomas-krenn.com)
*[[Windows Server 2025 Editionsunterschiede|Windows Server 2025 Differences Between Editions]] (www.wiki.thomas-krenn.com)
*[https://www.thomas-krenn.com/de/tkmag/webinare/windows-server-2025-lizenzierung-und-editionen/ Thomas-Krenn Webinar on Windows Server 2025 Licensing]] (www.thomas-krenn.com)

{{aoberneder}}
{{Aranzinger}}
[[pl:Model licencjonowania w oparciu o rdzenie w Windows Server 2016]]
[[de:Windows Server Core-Lizenzierung]]

[[Category:Windows Server 2019]]
[[Category:Windows Server 2022]]
[[Category:Windows Server 2025]]

Administration of RAID with MDADM

2026-07-23T07:14:17Z

Aranzinger: Created page with "'''This article includes the general procedure of creating and administrating an array with MDADM.''' MDAMD (multiple disk administration) is a program that helps with the administration of a Software RAID in Linux. With this program, RAID-arrays can be created, configured, monitored and deleted. MDADM is released as free software under the GNU General Public License (GPL). MDADM creates so-called multiple devices (short MD) from different block devices (such as an ent..."

'''This article includes the general procedure of creating and administrating an array with MDADM.'''

MDAMD (multiple disk administration) is a program that helps with the administration of a Software RAID in Linux.
With this program, RAID-arrays can be created, configured, monitored and deleted.
MDADM is released as free software under the GNU General Public License (GPL).

MDADM creates so-called multiple devices (short MD) from different block devices (such as an entire hard drive, a single partition, or a USB flash drive)

MDADM is a practical software RAID solution that can be actively developed.
It allows simultaneous, parallel access to all disks.
In addition, the arrays created are hardware-independent, which significantly enhances data security.

== Possible RAID levels ==

*Linear: Chaining of multiple parities
*Multipath: No RAID, but mapping of a file on two different paths on the same partition (mirroring).
*Faulty: Emulates a faulty RAID system for test cases.
*Level 0 (Block Level Striping): Chaining multiple small block devices together to form one large one.
*Level 1 (Mirror): Mirroring of a disk
*Level 4: Like level 0, but with an additional device for parity bit (increased reliability).
*Level 5: Like level 4, the parity bits are distributed across all devices.
*Level 6: However, like level 5, it uses two independent parity bits per segment (increased reliability).
*Level 10: Combination of level 0 and 1.

== Installation of mdadm ==

If RAID was not set up during the Linux installation, you must install the mdadm package from the repositories.
<pre>:~$ sudo aptitude install mdadm</pre>
After the installation, there are no further steps required for the configuration and the tool can be used.

== Commands for configuration and administration ==

=== Basic syntax ===
<pre>
mdadm [mode] <raiddevice> [options] <component-devices>
</pre>

=== Create array ===
<pre>
mdadm --create /dev/md/<Label> --level=<RAID-Level> --raid-devices=<number of physical partitions in the array> /dev/sdX1 /dev/sdY1
</pre>
Parameter:
* <code>--create</code> An optional parameter can be specified to set a label for the RAID. For example: <code>/dev/md/md_1</code>
* <code>--level=</code>: Specifies the desired RAID level. Valid entries are <code>linear, raid0, 0, stripe, raid1, 1, mirror, raid4, 4, raid5, 5, raid6, 6, raid10, 10, multipath, mp, faulty, container</code>
* <code>--raid-devices=</code>: Specifies the number of physical partitions in the software RAID. In addition, the individual partitions must be stated. For example: <code>--raid-devices=2 /dev/sda2 /dev/sdb3</code>

==== RAID 0 with MDADM ====
To create a RAID 0 (Block Level Striping) array, at least 2 partitions are required. They should be the same size and located on different physical hard drives.
The RAID 0 array can be initialized with the following command: <code>mdadm --create /dev/md/<Label> --level=0 --raid-devices=<Anzahl> /dev/sdX1 /dev/sdY1</code>

Example (2 physical hard drives):
<pre>
root@swraid:~# mdadm --create /dev/md/md_test --level=0 --raid-devices=2 /dev/sdb1 /dev/sdc1
mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md/md_test started.
</pre>

==== RAID 1 with MDADM ====
To create a RAID 1 (Block Level Mirroring) array, at least two physical partitions are required. They should be the same size and located on different physical hard drives.
The RAID 1 array can be initialized with the following command: <code>mdadm --create /dev/md/<Label> --level=1 --raid-devices=<number> /dev/sdX1 /dev/sdY1</code>

Example (2 physical hard drives):
<pre>
root@swraid:/dev# mdadm --create /dev/md/md_test --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1
mdadm: Note: this array has metadata at the start and
may not be suitable as a boot device. If you plan to
store '/boot' on this device please ensure that
your boot-loader understands md/v1.x metadata, or use
--metadata=0.90
Continue creating array? yes
mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md/md_test started.
</pre>

=== Delete array ===
To remove a RAID array, the array must be unmounted (<code>umount</code>) and the command <code> mdadm --stop /dev/md/<name of RAID></code> must be called up. Although this unmounts the array from the system, the RAID array remains physically in place.

To remove the array, the superblock of every hard drive, which determines the hard drive/partition as RAID-device, must be set to 0. This can be performed with the command <code> mdadm --zero-superblock /dev/<physical partition></code>.

Example:
<pre>
root@swraid:/dev# umount -l /mnt/test
root@swraid:/dev# mdadm --stop /dev/md/md_test
mdadm: stopped /dev/md/md_test
root@swraid:/dev# mdadm --zero-superblock /dev/sdb1
root@swraid:/dev# mdadm --zero-superblock /dev/sdc1
</pre>

=== Listing arrays/partitions ===
RAID-arrays can be listed with two kinds of commands. <code>--detail</code> refers to a completely active array, while <code>--examine</code> refers to the individual physical devices in a RAID array.
<pre>
root@swraid:/mnt/test# mdadm --examine --brief --scan --config=partitions
ARRAY /dev/md/md_test metadata=1.2 UUID=81c1d8e5:27f6f8b9:9cdc99e6:9d92a1cf name=swraid:md_test
</pre>
This command can also be abbreviated with <code>-Ebsc partitions</code>.

<pre>
root@swraid:/dev/md# mdadm --detail /dev/md/md_test
/dev/md/md_test:
Version : 1.2
Creation Time : Fri Jul 5 09:14:36 2013
Raid Level : raid0
Array Size : 16776192 (16.00 GiB 17.18 GB)
Raid Devices : 2
Total Devices : 2
Persistence : Superblock is persistent

Update Time : Fri Jul 5 09:14:36 2013
State : clean
Active Devices : 2
Working Devices : 2
Failed Devices : 0
Spare Devices : 0

Chunk Size : 512K

Name : swraid:md_test (local to host swraid)
UUID : 81c1d8e5:27f6f8b9:9cdc99e6:9d92a1cf
Events : 0

Number Major Minor RaidDevice State
0 8 17 0 active sync /dev/sdb1
1 8 33 1 active sync /dev/sdc1
</pre>

=== Hotspare ===
Hotspare hard drives/partitions are hard drives/partitions that are not normally used. These are used when one of the active hard drives or partitions in the RAID array has an error or is defective. If no hot spare disk is defined in a software RAID, the rebuild of a failed RAID array must be started manually. If a Hotspare is available, it is automatically started with the rebuild. A Hotspare hard drive can be added with the command <code> mdadm --add /dev/md/<RAID-name> /dev/sdX1</code>, where the first parameter is the name of the RAID array and the second is the name of the hard drive to be added. If a Hotspare hard drive should be removed from the RAID array, the command <code>mdadm --remove /dev/md/<RAID-name> /dev/sdX1</code> must be called up. Here, the first parameter is the name of the RAID array, and the second is the name of the hot spare hard drive.

=== Rebuild ===
If a partition or hard drive has a defect (software or hardware), the RAID array must be rebuilt. To do this, the defect device must be removed from the RAID. The command <code>mdadm --manage /dev/md/<RAID-name> -r /dev/sdX1</code> is required for this. The first parameter refers to the RAID array. The second to the defect device. If there is no Hotspare hard drive available, a new hard drive must be partitioned. It is important that the new hard drive has the same partition as the defect one. The tools <code>fdisk /dev/sdX</code>, <code>cfdisk /dev/sdX1</code> as well as <code>parted /dev/sdX1</code> help with the partition of a hard drive.
If the new hard drive is partitioned correctly, it can be added to the RAID array. This can be made with <code>mdadm --manage /dev/md/<RAID-Name> -a /dev/sdX1</code>. If no errors occurred during this process, you can begin the actual rebuild. For this, the new partition must be set to "faulty" in the RAID array: <code>mdadm --manage --set-faulty /dev/md/<RAID-name> /dev/sdX1</code>. This triggers the rebuild of the RAID array.
With <code>watch cat /proc/mdstat</code>, the progress of the rebuild can be tracked.

<pre>
Every 2.0s: cat /proc/mdstat Fri Jul 5 09:59:16 2013

root@swraid:/dev# watch cat /proc/mdstat
Personalities : [raid0] [raid1]
md127 : active raid1 sdc1[1] sdb1[0]
8384448 blocks super 1.2 [2/2] [UU]
[==============>......] check = 74.7% (6267520/8384448) finish=0.1min speed=202178K/sec

unused devices: <none>
</pre>
As soon as the rebuild of the RAID compound has been completed, the partition must be removed from the RAID array and added again to remove the status "faulty". <code> mdadm --manage /dev/md/<RAID-name> -r /dev/sdX1</code> for removing and <code>mdadm --manage /dev/md/<RAID-name> -a /dev/sdX1</code> for adding.
With the command <code>mdadm --detail /dev/md/<RAID-name> </code>, the status of the RAID array can be verified again. This should now have the '''State: clean''' status.

=== Set up email address for array monitoring ===

To receive an email notification in the event of a failure, you can enter the desired email address in the mdadm configuration file (<code>/etc/mdadm/mdadm.conf</code>) under <code>MAILADDR root</code> instead of ''root''.
For this, an email service (<code>postfix, exim, ...</code>) must be configured on the system.
Open '''/etc/mdadm/mdadm.conf''' with an editor and edit the following line:

Instead of <code>MAILADDR root</code>, enter an email address such as <code>MAILADDR email@example.com</code> and save it.

=== Verify array ===
The tool <code>checkarray</code> is required to conduct continuous monitoring. This can be added to the list of Cronjobs with <code>crontab -e</code>.
<pre>
/usr/share/mdadm/checkarray --cron --all --quiet
</pre>

{{Sstrassner}}
{{Aranzinger}}
[[Category:Linux Software RAID]]
[[de:Software RAID mit MDADM verwalten]]

IPMI configuration for Supermicro servers with ipmicfg

2026-07-22T12:18:28Z

Aranzinger:

This article describes the tool ipmicfg for Supermicro systems. Alternatively, when the server is operated on Linux, the ipmitool (see article [[Configuring IPMI under Linux using ipmitool|Configuring IPMI on Linux using ipmitool]]) or [[FreeIPMI]] can also be used. Older systems could be also interesting for the tools IPnMAC and XGICFG. Information can be found in the article [[IPMI_Konfiguration_f%C3%BCr_Supermicro_Systeme|IPMI Configuration for Supermicro Systems]]

If there are problems with the configuration, it may be because the required modules have not been loaded. Please take the following article into consideration: [[IPMI Init Script für Debian|IPMI Init Script for Debian]]

== Basic configuration ==
[[file:Supermicro-IPMICFG-Windows-version-1.03-Build-110420.png|thumb|right|250px|Screenshot ipmicfg.exe on Windows]]
IPMICFG version 1.02 (Build 120820) provides the following options:
<pre>
root@test:~# ./ipmicfg-linux.x86_64.static

IPMICFG Version 1.14.3 (Build 130725)
Copyright 2013 Super Micro Computer, Inc.
Usage: IPMICFG params (Example: IPMICFG -m 192.168.1.123)
-m Show IP and MAC.
-m IP Set IP (format: ###.###.###.###).
-a MAC Set MAC (format: ##:##:##:##:##:##).
-k Show Subnet Mask.
-k Mask Set Subnet Mask (format: ###.###.###.###).
-dhcp Get the DHCP status.
-dhcp on Enable the DHCP.
-dhcp off Disable the DHCP.
-g Show Gateway IP.
-g IP Set Gateway IP (format: ###.###.###.###).
-r BMC cold reset.
option: -d | Detected IPMI device for BMC reset.
-garp on Enable the Gratuitous ARP.
-garp off Disable the Gratuitous ARP.
-fd Reset to the factory default.
option: -d | Detected IPMI device for BMC reset.
-fdl Reset to the factory default. (Clean LAN)
option: -d | Detected IPMI device for BMC reset.
-fde Reset to the factory default. (Clean FRU & LAN)
option: -d | Detected IPMI device for BMC reset.
-ver Get Firmware revision.
-vlan Get VLAN status.
-vlan on <VLANtag> Enable the VLAN and set the VLAN tag.
If VLANtag is not given it uses previously saved value.
-vlan off Disable the VLAN.
-selftest Checking and reporting on the basic health of BMC.
-raw Send a RAW IPMI request and print response.
Format: NetFn Cmd [Data1 ... DataN]
-fru info Show FRU inventory area Info.
-fru list Show all FRU values.
-fru cthelp Show chassis type code.
-fru help Show help of FRU Write.
-fru <Field> Show FRU field value.
-fru <Field> <Value> Write FRU.
-fru 1m Update FRU Product Manufacturer from DMITable.
-fru 1p Update FRU Product Prodcut Name from DMITable.
-fru 1s Update FRU Product S/N from DMITable.
-fru 2m Update FRU Board Manufacturer from DMITable.
-fru 2p Update FRU Board Product Name from DMITable.
-fru 2s Update FRU Board S/N from DMITable.
-fru 3s Update FRU Chassis S/N from DMITable.
-fru backup <file> Backup FRU to file <Binary format>.
-fru restore <file> Restore FRU from file <Binary format>.
-fru tbackup <file> Backup FRU to file <Text format>.
-fru trestore <file> Restore FRU from file <Text format>.
-fru ver <V1> <V2> Get/Set FRU version. (V1 V2 are BCD format)
-sel info Show SEL info.
-sel list Show SEL records.
-sel del Delete all SEL records.
-sel raw Show SEL raw data.
-sdr Show SDR records and reading.
-sdr del <SDR ID> Delete SDR record.
-sdr ver <V1> <V2> Get/Set SDR version. (V1 V2 are BCD format)
-nm nmsdr Display NM SDR.
-nm seltime Get SEL time.
-nm deviceid Get ME Device ID.
-nm reset Reboots ME.
-nm reset2default Force ME reset to Default.
-nm updatemode Force ME to Update Mode.
-nm selftest Get Self Test Results.
-nm listimagesinfo List ME Images information.
-nm oemgetpower OEM Power command for ME.
-nm oemgettemp OEM Temp. command for ME.
-nm pstate Get Max allowed CPU P-State.
-nm tstate Get Max allowed CPU T-State.
-nm cpumemtemp Get CPU/Memory temperature.
-nm hostcpudata Get host CPU data.
-fan Get Fan Mode.
-fan <mode> Set Fan Mode.
-pminfo Power supply PMBus health.
-psfruinfo Power supply FRU health.
-psbbpinfo Battery backup power status.
-autodischarge <module> <day> Set auto discharge by days.
-discharge <module> Manually discharge battery.
-user list List user privilege information.
-user help Show user privilege code.
-user add <user id> <user name> <password> <privilege>
Add user.
-user del <user id> Delete user.
-user level <user id> <privilege> Update user privilege.
-user setpwd <user id> <password> Update user password.
-conf upload <file> <option> Upload IPMI configuration form binary file.
option: -p | Bypass warning message.
-conf download <file> Download IPMI configuration to binary file.
-conf tupload <file> <option> Upload IPMI configuration from text file.
option: -p | Bypass warning message.
-conf tdownload <file> Download IPMI configuration to text file.
-clrint Clear chassis intrusion.
root@test:~#
</pre>

To configure the IPMI module for the first time, it is necessary to state the IP address through which the IPMI module should be accessible.
<pre>
ipmicfg -m ###.###.###.###
</pre>

After that, the IPMI module is available via web interface.

== Factory default settings ==
To set the IPMI module on the default settings, please enter
<pre>
ipmicfg -fd
</pre>

Please note that all settings, including all users, are deleted. Furthermore, the DHCP server is switched on after reset.

== Problems with Offset Sensor Readings ==
Under certain circumstances, some sensor readings may be incorrect or may not be read at all.
To solve the issue, the following steps must be performed:

[[Correcting Faulty IPMI Sensors by Fully Initializing the IPMI Module]]

== Command reference ==
=== Display IP and MAC address ===
<pre>
ipmicfg -m
</pre>

=== Set IP address ===
<pre>
ipmicfg -m ###.###.###.###
</pre>

=== Set MAC address ===
<pre>
ipmicfg -a ##:##:##:##:##:##
</pre>

=== Display Subnet mask ===
<pre>
ipmicfg -k
</pre>

=== Set Subnet mask ===
<pre>
ipmicfg -k ###.###.###.###
</pre>

=== Switch on DHCP ===
<pre>
ipmicfg -dhcp on
</pre>

=== Switch off DHCP ===
<pre>
ipmicfg -dhcp off
</pre>

=== Display Gateway IP address ===
<pre>
ipmicfg -g
</pre>

=== Set Gateway IP address ===
<pre>
ipmicfg -g ###.###.###.###
</pre>

=== BMC Cold Reset ===
<pre>
ipmicfg -r
</pre>

=== Recreate default settings ===
<pre>
ipmicfg -fd
</pre>

=== Enable the Gratuitous ARP ===
<pre>
ipmicfg -garp on
</pre>

=== Disable the Gratuitous ARP ===
<pre>
ipmicfg -garp off
</pre>

== Download ipmicfg ==

If the ipmicfg is not yet installed on the system, it can be downloaded via [https://www.thomas-krenn.com/de/download.html Thomas-Krenn download area]. For this, select the specific mainboard.

At Supermicro, it is available here:
* ftp://ftp.supermicro.com/utility/IPMICFG/

{{Bbayer}}
{{Aranzinger}}
[[Category:IPMI]]
[[de:IPMI Konfiguration für Supermicro Server mittels ipmicfg]]
[[pl:Konfiguracja IPMI w serwerach Supermicro za pomocą ipmicfg]]

ZFS basics

2026-07-22T09:28:13Z

Aranzinger: Created page with "'''ZFS''' (''Pseudo-acronym'', short for ''Zettabyte File System'') is a '''file system''' that has been originally developed by Sun Microsystems for the operating system Solaris. The OpenZFS project develops an Open-Source variant<ref name=":0">[https://openzfs.github.io/openzfs-docs/index.html OpenZFS Documentation] (openzfs.github.io, 2026)</ref>. ZFS distinguishes itself from other file systems through its focus on data integrity, storage capacity, and the management..."

'''ZFS''' (''Pseudo-acronym'', short for ''Zettabyte File System'') is a '''file system''' that has been originally developed by Sun Microsystems for the operating system Solaris. The OpenZFS project develops an Open-Source variant<ref name=":0">[https://openzfs.github.io/openzfs-docs/index.html OpenZFS Documentation] (openzfs.github.io, 2026)</ref>. ZFS distinguishes itself from other file systems through its focus on data integrity, storage capacity, and the management of physical drives within a logical device pool.

== Basic function ==
The main focus of ZFS is on '''data integrity'''. To ensure this data integrity, ZFS relies on a '''transactional''' approach. This means that writing processes are always completely performed or never<ref>[https://docs.oracle.com/cd/E19120-01/open.solaris/817-2271/gaypi/index.html Transactional Semantics] (docs.oracle.com, 2026)</ref>.

A simple, asynchron writing process collects or buffers data for a determined period in a so-called '''transaction group (TXG)''' in the RAM of the system. After this period, the changes are transferred to permanent storage. This completes the transaction.

To ensure data consistency when following this procedure, ZFS uses a '''[[Copy-on-Write (COW)|Copy-on-Write (CoW)]]''' strategy. During a write operation, no blocks are overwritten. Instead, the blocks, with the corresponding changes, are copied to a different location. The old blocks remain intact, but the file system points to the new blocks. If the old blocks are not referenced anymore (for example from [[ZFS Snapshots|Snapshots]]), they may be overwritten during future write operations.

== Setup ==
[[File:Zfs-storage_stack.png|alt=Abb. 1: A simplified, illustrative representation of the ZFS storage stack|thumb|Image 1: A simplified, illustrative representation of the ZFS storage stack.]]
To understand the function of ZFS, its building blocks must be understood.

Three levels form the structure of the ZFS storage stack<ref>[https://openzfs.org/wiki/System_Administration "System Administration" in openzfs Wiki] (openzfs.org, 2026)</ref> (see image 1): The lowest level are the '''physical data carriers'''. These are grouped together in logical units within a storage pool called '''<code>zpool</code>'''. Logical objects are provided for the operating system via <code>zpool</code>. In addition to the '''datasets''', that correspond to classic file systems, there are also '''metadata''' such as snapshots and bookmarks.

{| {{Prettytable}} cellspacing="0" style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #a0a0a0 solid; border-collapse: collapse; " rules="all"
|The hardware level is not further explained in this article. If you require consulting on an efficient and performant design of a ZFS infrastructure, do not hesitate to contact us: [https://www.thomas-krenn.com/de/unternehmen/kontakt-tk/thomas-krenn-ansprechpartner/slide.presales Contact persons]
|-
|}
Furthermore, the ''Adaptive Replacement Cache (ARC)'' and the ''ZFS Intent Log (ZIL)'' are also important elements for the function of ZFS.

=== zpool ===
The <code>zpool</code> is a virtual storage pool that is formed by so-called <code>vdevs</code> (''Virtual Devices'' in brief). ZFS can administrate multiple <code>zpools</code>. The individual <code>zpools</code> are independent from each other and must be administrated separately.

==== vdev ====
A <code>vdev</code> is a logical data carrier within a <code>zpools</code> that is created by a physical data carrier or a fusion of multiple physical data carriers. It can be formed by the following entities:

* physical data carrier
* data carrier arrays (for example RAID)
* partitions

In productive environments, a <code>vdev</code> is usually created by individual physical data carriers.

It is also possible to form a <code>vdev</code> out of files. This is an exceptional case and is only recommended for testing purposes.

'''Storage''' <code>vdevs</code> are provided for data storage. ZFS provides different redundancy levels for storage <code>vdevs</code><ref name=":1">[https://openzfs.github.io/openzfs-docs/man/master/7/zfsconcepts.7.html zfsconcepts.7] (openzfs.github.io, 2026)</ref>:

* Single (simple data carrier)
* Mirror (mirrored data carrier)
* RAIDZ-1/2/3 (data storage network with 1/2/3 parities)
* [[ZFS dRAID Grundlagen und Einrichtung|dRAID]]

In addition, there are further <code>vdevs</code> for special use:

* '''Spare''': Is used for the failure of a physical data carrier from a storage <code>vdev</code> used for recovery (resilvering)<ref name=":1" />
* '''Cache''': The read buffer, also known as L2ARC ''(Level 2 Adaptive Replacement Cache),'' is an extension of the ''[[Benutzer:Sbohn/Spielwiese5#ARC|ARC]]''<ref name=":1" />
* '''Log''': The so-called ''SLOG'' ''(Separate Intent Log)'' <code>vdev</code> is responsible for caching during synchronous write operations. It is the relocation of ''[[Benutzer:Sbohn/Spielwiese5#ZIL|ZIL]] (ZFS Intent Log)''<ref name=":1" />
* '''Dedup''': This <code>vdev</code> is used for storing the ''Deduplication Table (DDT)'' for deduplicate in the <code>zpool</code>
* '''Special''': A<code>vdev</code> is used for storing metadata and optionally small data blocks. <ref name=":1" />It also stores the DDT if there is no dedicated <code>vdev</code> for it.

=== Datasets ===
A dataset forms the upper level of the ZFS Storage Stack. The following datasets can be formed with ZFS:

* '''ZVOL:''' The ''ZFS Volume'' is a virtual block device
* '''File system:''' ZFS-native file systems can be set up
* '''Clone:''' A standalone, writable copy of a ZFS snapshot<ref name=":1" />

ZVOLs can be used to insert regular file systems on operating system layers.

=== Meta data ===
In addition to data sets, there are further logical objects in ZFS:

* '''Snapshot:''' A snapshot is a momentary representation of a system's state. The blocks described at the time of the snapshot are immutable (''immutable'') and remain in place at least until the snapshot and its references are deleted<ref name=":1" />
* '''Bookmark:''' A bookmark is a read-only copy of the filesystem or a volume. They are tied to snapshots and are retained even if the snapshot is deleted<ref name=":1" />

== ARC and ZIL ==
In addition to the storage stack, there are two other important modules for using ZFS efficiently.

=== ARC ===

The ''Adaptive Replacement Cache'' ''(ARC)'' is the reading buffer of ZFS. It is formed in the RAM of the host system<ref name=":2">[https://openzfs.github.io/openzfs-docs/Performance%20and%20Tuning/Workload%20Tuning.html#adaptive-replacement-cache Adaptive Replacement Cache] (openzfs.github.io, 2026)</ref>.

The general task of the ARC is to provide blocks for fast reading processes. For this, the ARC builds lists about buffered entries<ref name=":2" />. The ARC distinguishes from ''most recent'' (''MRU - Most Recently Used'') blocks and ''frequently'' (''MFU - Most Frequently Used'') used blocks. Therefore, the ARC is faster as commonly used read buffers that only keep MRU in the buffer<ref>[https://github.com/openzfs/zfs/blob/master/module/zfs/arc.c OpenZFS ARC Source Code] (github.com/openzfs, 2026)</ref>.

==== L2ARC ====
The ''Level 2 ARC (L2ARC)'' is formed in the permanent storage (NVMe preferred)<ref name=":2" />. If data is evicted from the ARC, ZFS can store it in the L2ARC and access it during subsequent read operations.

=== ZIL ===
The ''ZFS Intent Log (ZIL)'' is a temporary cache that is used for synchron writing processes.

The ZIL is not a cache in the strict sense: During a synchronous write operation, the data is written simultaneously to a transaction group (in RAM) and to the ZIL (on physical storage media)<ref>[https://github.com/openzfs/zfs/blob/master/module/zfs/zil.c OpenZFS ZIL Source Code] (github.com/openzfs, 2026)</ref>. As soon as the data from the transaction group has been fully written to the <code>vdev</code>, the data is rejected in the ZIL. The ZIL is responsible for data integrity even in the event of system failures. Because data must be written to permanent storage, which is slow compared to RAM, synchronous write operations are less efficient.

==== SLOG ====
The ''Separate Intent Log (SLOG)'' outsources ''ZIL''-blocks to a separate <code>vdev</code><ref>[https://openzfs.github.io/openzfs-docs/Performance%20and%20Tuning/Workload%20Tuning.html#synchronous-i-o OpenZFS - Synchron Writing Process] (openzfs.github.io, 2026)</ref>. This is useful, when the data carriers used for the SLOG have a higher writing performance.

== More information ==
Official documentation: [https://openzfs.github.io/openzfs-docs/index.html OpenZFS Documentation]

Basic article: [https://arstechnica.com/information-technology/2020/05/zfs-101-understanding-zfs-storage-and-performance/ ZFS 101—Understanding ZFS storage and performance]

Synchron/Asynchron writing processes: [https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/ ZFS sync/async + ZIL/SLOG, explained]

TrueNAS article on ZIL and SLOG: [https://www.truenas.com/blog/zfs-zil-and-slog-demystified/ The ZFS ZIL and SLOG Demystified]

ZFS on Linux: https://zfsonlinux.org/

Aaron Toponce about ZFS: [https://web.archive.org/web/20230904234829/https://pthree.org/2012/04/17/install-zfs-on-debian-gnulinux/ ZFS Administration]

== References ==
<references />

{{Sbohn}}
{{Aranzinger}}
[[Category:Storage]]
[[Category:Review 2027 Q3]]
[[de:ZFS Grundlagen]]

OPNsense network card driver

2026-07-21T11:26:59Z

Aranzinger: Created page with "OPNsense contains drivers for numerous network cards. This Wiki article shows, '''which drivers are used for which network card'''. Some drivers must be activated manually. Information on this topic can be found in the article Activation of OPNsense Chelsio Mellanox Broadcom network card driver. == Driver versions == {| class="wikitable" |+ ! rowspan="2" |Driver !Supported network chips/cards !Driver version in OPNsense 26.7 !Driver version in OPNsense 26.1 !Dr..."

[[OPNsense]] contains drivers for numerous network cards. This Wiki article shows, '''which drivers are used for which network card'''. Some drivers must be activated manually. Information on this topic can be found in the article [[Activation of OPNsense Chelsio Mellanox Broadcom network card driver]].

== Driver versions ==
{| class="wikitable"
|+
! rowspan="2" |Driver
!Supported network chips/cards
!Driver version
in OPNsense 26.7
!Driver version
in OPNsense 26.1
!Driver version
in OPNsense 25.7
!Driver version
in OPNsense 25.1
!Driver version
in OPNsense 24.7
!Driver version
in OPNsense 24.1
!Driver version
in OPNsense 23.7
!Driver version
in OPNsense 23.1
!Driver version
in OPNsense 22.7
!Driver version
in OPNsense 22.1
!Driver version
in OPNsense 21.7
!Driver version
in OPNsense 21.1
!Driver version
in OPNsense 20.7
!Driver version
in [[OPNsense]] 20.1
|-
!Kernel version
!FreeBSD 15.1-RELEASE
! colspan="2" |FreeBSD 14.3-RELEASE
!FreeBSD 14.2-RELEASE
!FreeBSD 14.1-RELEASE
! colspan="2" |FreeBSD 13.2-RELEASE
! colspan="2" |FreeBSD 13.1-RELEASE
!FreeBSD 13.0-STABLE
! colspan="3" |FreeBSD 12.1
![[FreeBSD]] 11.2
|-
|[https://www.freebsd.org/cgi/man.cgi?query=bge&sektion=4&format=html bge]
|
* Broadcom 1Gbit, for example:
** H12SSL-i - BCM5720
** H12SSW-iN - BCM5720
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=bnxt&sektion=4&format=html bnxt]
|
* Broadcom 10GBit, for example:
** H12SSL-NT/CT - BCM57416
** H12SSW-NT - BCM57416
** P210TP - BCM57416
*Broadcom 25GBit,for example:
** X12SPZ-SPLN6F - BCM57414
** P225P - BCM57414
| colspan="4" |230.0.133.0 (via iflib, driver is activated automatically)<ref>[Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> for a system with a built-in Broadcom P225P network card:
<pre>
dev.bnxt.0.iflib.driver_version: 230.0.133.0
dev.bnxt.0.%iommu: rid=0x8100
dev.bnxt.0.%parent: pci6
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d7 subvendor=0x14e4 subdevice=0x1402 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:129:0:0
dev.bnxt.0.%driver: bnxt
</pre>
</ref>
|
|2.20.0.1 (via iflib, '''driver is now activated automatically''')<ref>[Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> for a system with a built-in Broadcom P225P network card:
<pre>
dev.bnxt.0.iflib.driver_version: 2.20.0.1
dev.bnxt.0.%domain: 0
dev.bnxt.0.%parent: pci6
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d7 subvendor=0x14e4 subdevice=0x1402 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:24:0:0 handle=\_SB_.PC01.BR1A.H000
dev.bnxt.0.%driver: bnxt
dev.bnxt.0.%desc: Broadcom BCM57414 NetXtreme-E 10Gb/25Gb Ethernet
</pre>
</ref>
|
|2.20.0.1 (via iflib)<ref name=":5">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a system with a Supermicro H13SSL-NT motherboard:
<pre>
dev.bnxt.0.iflib.driver_version: 2.20.0.1
dev.bnxt.0.%domain: 0
dev.bnxt.0.%parent: pci1
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d8 subvendor=0x15d9 subdevice=0x16d8 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:195:0:0
dev.bnxt.0.%driver: bnxt
</pre>
</ref>
| colspan="3" |1.0.0.2 (via iflib)<ref name=":2">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code>
<pre>
dev.bnxt.0.iflib.driver_version: 1.0.0.2
dev.bnxt.0.%parent: pci2
dev.bnxt.0.%pnpinfo: vendor=0x14e4 device=0x16d7 subvendor=0x14e4 subdevice=0x1402 class=0x020000
dev.bnxt.0.%location: slot=0 function=0 dbsf=pci0:194:0:0
dev.bnxt.0.%driver: bnxt
dev.bnxt.0.%desc: Broadcom BCM57414 NetXtreme-E 10Gb/25Gb Ethernet
</pre>
</ref>
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=cxgbe&sektion=4&format=html cxgbe]
|
* Chelsio T4/T5/T6
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=em&sektion=4&format=html em]
|
* Intel I219
|
|
|
|
|
|
|
|
|
|
|
| colspan="2" rowspan="2" |7.6.1-k (via iflib)<ref name=":0">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a LES compact 4L with I210:
<pre>
dev.igb.0.iflib.driver_version: 7.6.1-k
dev.igb.0.%parent: pci1
dev.igb.0.%pnpinfo: vendor=0x8086 device=0x157b subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igb.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP01.PXSX
dev.igb.0.%driver: igb
dev.igb.0.%desc: Intel(R) PRO/1000 PCI-Express Network Driver
</pre>
</ref>
|7.6.1-k
|-
|igb
|
* Intel I210
* Intel I211
* Intel I350
| colspan="4" |2.5.28-fbsd (via iflib)<ref name=":7">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a LES compact 4L:
<pre>
dev.igb.0.iflib.driver_version: 2.5.28-fbsd
dev.igb.0.%iommu: rid=0x100
dev.igb.0.%parent: pci1
dev.igb.0.%pnpinfo: vendor=0x8086 device=0x157b subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igb.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP01.PXSX
dev.igb.0.%driver: igb
</pre>
</ref>
| colspan="3" |2.5.19-fbsd (via iflib)<ref name=":6">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on an <tklink type="sitex" id="20785">Edge 4L</tklink>:
<pre>
dev.igb.0.iflib.driver_version: 2.5.19-fbsd
dev.igb.0.%parent: pci1
dev.igb.0.%pnpinfo: vendor=0x8086 device=0x1533 subvendor=0xffff subdevice=0x0000 class=0x020000
dev.igb.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP03.PXSX
dev.igb.0.%driver: igb
dev.igb.0.%desc: Intel(R) I210 (Copper)
</pre>
</ref>
|
| colspan="3" |7.6.1-k (via iflib)<ref name=":0" />
|2.5.3-k
|-
|igc
|
* Intel I225-V
* Intel I225-LM
* Intel I226-V
| colspan="5" |1 (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.igc.0.iflib.driver_version' -A 6</code> on a <tklink type="sitex" id="20700">LES v4</tklink>:
<pre>
dev.igc.0.iflib.driver_version: 1
dev.igc.0.%parent: pci1
dev.igc.0.%pnpinfo: vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igc.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PC00.RP01.PXSX
dev.igc.0.%driver: igc
dev.igc.0.%desc: Intel(R) Ethernet Controller I225-V
dev.igc.%parent:
</pre>
</ref>
<ref>Read out via <code>sysctl -a | grep -E 'dev.igc.0.iflib.driver_version' -A 6</code> on a <tklink type="sitex" id="21011">LES plus v4</tklink>:
<pre>
dev.igc.0.iflib.driver_version: 1
dev.igc.0.%parent: pci2
dev.igc.0.%pnpinfo: vendor=0x8086 device=0x125c subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igc.0.%location: slot=0 function=0 dbsf=pci0:2:0:0 handle=\_SB_.PC00.RP05.PXSX
dev.igc.0.%driver: igc
dev.igc.0.%desc: Intel(R) Ethernet Controller I226-V
dev.igc.%parent:
</pre>
</ref>
| colspan="5" |1 (via iflib)<ref name=":1">Read out via <code>sysctl -a | grep -E 'dev.igc.0.iflib.driver_version' -A 6</code> on a <tklink type="sitex" id="20159">LES network 6L</tklink>:
<pre>
dev.igc.0.iflib.driver_version: 1
dev.igc.0.%parent: pci1
dev.igc.0.%pnpinfo: vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igc.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PCI0.RP05.PXSX
dev.igc.0.%driver: igc
dev.igc.0.%desc: Intel(R) Ethernet Controller I225-V
dev.igc.%parent:
</pre>
</ref>
| colspan="4" |(not supported)
|-
|ix
|
* Intel X520
* Intel X550
* Intel E610
| colspan="2" |5.0.1-k(via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with a Kontron K3881-C motherboard and E610 interfaces:
<pre>
dev.ix.0.iflib.driver_version: 5.0.1-k
dev.ix.0.%iommu: rid=0x700
dev.ix.0.%parent: pci6
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x57b0 subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:7:0:0 handle=\_SB_.PC00.RP09.PXSX
dev.ix.0.%driver: ix
dev.ix.0.%desc: Intel(R) E610 (10 GbE)
</pre>
</ref>
|5.0.1-k(via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with X520 (82599ES) interfaces:
<pre>
dev.ix.0.iflib.driver_version: 5.0.1-k
dev.ix.0.%iommu: rid=0x200
dev.ix.0.%parent: pci2
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x10fb subvendor=0xffff subdevice=0xffff class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:2:0:0 handle=\_SB_.PC00.RP01.PXSX
dev.ix.0.%driver: ix
dev.ix.0.%desc: Intel(R) X520 82599ES (SFI/SFP+)
</pre>
</ref>
|
|4.0.1-k (via iflib)<ref name=":4">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with Supermicro X12SPi-TF motherboard:
<pre>
dev.ix.0.iflib.driver_version: 4.0.1-k
dev.ix.0.%domain: 0
dev.ix.0.%parent: pci1
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x1563 subvendor=0x15d9 subdevice=0x1563 class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PC00.RP01.D033
dev.ix.0.%driver: ix
</pre>
</ref>
|
|4.0.1-k (via iflib)<ref name=":4" />
|
|4.0.1-k (via iflib)<ref name=":3">Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 6</code> on a system with Supermicro X10SDV-TP8F motherboard:
<pre>
dev.ix.0.iflib.driver_version: 4.0.1-k
dev.ix.0.%parent: pci5
dev.ix.0.%pnpinfo: vendor=0x8086 device=0x15ac subvendor=0x15d9 subdevice=0x15ac class=0x020000
dev.ix.0.%location: slot=0 function=0 dbsf=pci0:4:0:0 handle=\_SB_.PCI0.BR2C.H000
dev.ix.0.%driver: ix
dev.ix.0.%desc: Intel(R) X552 (SFP+)
</pre>
</ref>
|
|
|
|
|3.2.12-k ? (was on OPNsense 18.7)
|-
|[https://www.freebsd.org/cgi/man.cgi?query=ixl&sektion=4&format=html ixl]
|
* Intel X700 Series
| colspan="3" |2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with Advantech FWA-3034:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%iommu: rid=0x200
dev.ixl.0.%parent: pci2
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x1572 subvendor=0x13fe subdevice=0x303d class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:2:0:0 handle=\_SB_.PC00.PEG0.PEGP
dev.ixl.0.%driver: ixl
</pre>
</ref>
|2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a system with Asus P13R-M/10G-2T motherboard:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%iommu: rid=0x300
dev.ixl.0.%parent: pci3
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x15ff subvendor=0x1043 subdevice=0x0000 class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:3:0:0 handle=\_SB_.PC00.RP13.PXSX
dev.ixl.0.%driver: ixl
</pre>
</ref>
|2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a system that has a built-in Intel X710-T4 network card:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%domain: 0
dev.ixl.0.%parent: pci8
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x15ff subvendor=0x8086 subdevice=0x0001 class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:81:0:0 handle=\_SB_.PC02.BR2A.H000
dev.ixl.0.%driver: ixl
dev.ixl.0.%desc: Intel(R) Ethernet Controller X710 for 10GBASE-T - 2.3.3-k
</pre>
</ref>
|
|2.3.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a system featuring an Asus P12R-M/10G-2T motherboard:
<pre>
dev.ixl.0.iflib.driver_version: 2.3.3-k
dev.ixl.0.%parent: pci3
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x15ff subvendor=0x1043 subdevice=0x0000 class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:3:0:0 handle=\_SB_.PC00.RP09.D073
dev.ixl.0.%driver: ixl
dev.ixl.0.%desc: Intel(R) Ethernet Controller X710 for 10GBASE-T - 2.3.3-k
</pre>
</ref>
|
|2.3.1-k (via iflib)
|
|
| colspan="2" |2.1.0-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a Supermicro AOC-STG-i4S network card:
<pre>
dev.ixl.0.iflib.driver_version: 2.1.0-k
dev.ixl.0.%parent: pci20
dev.ixl.0.%pnpinfo: vendor=0x8086 device=0x1572 subvendor=0x15d9 subdevice=0x087e class=0x020000
dev.ixl.0.%location: slot=0 function=0 dbsf=pci0:65:0:0
dev.ixl.0.%driver: ixl
dev.ixl.0.%desc: Intel(R) Ethernet Controller X710 for 10GbE SFP+ - 2.1.0-k
</pre>
</ref>
|1.9.9-k ?
|-
|ice
|
* Intel E800 Series
| colspan="3" |1.43.3-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with Advantech FWA-3034:
<pre>
dev.ice.0.iflib.driver_version: 1.43.3-k
dev.ice.0.%iommu: rid=0x100
dev.ice.0.%parent: pci1
dev.ice.0.%pnpinfo: vendor=0x8086 device=0x1593 subvendor=0x13fe subdevice=0x2060 class=0x020000
dev.ice.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PC00.PEG1.PEGP
dev.ice.0.%driver: ice
</pre>
</ref>
|
|1.39.13-k (via iflib)<ref>Read out via <code>sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> with a system that has a built-in Intel E810-XXVDA2 network card:
<pre>
dev.ice.0.iflib.driver_version: 1.39.13-k
dev.ice.0.%domain: 0
dev.ice.0.%parent: pci10
dev.ice.0.%pnpinfo: vendor=0x8086 device=0x159b subvendor=0x8086 subdevice=0x0003 class=0x020000
dev.ice.0.%location: slot=0 function=0 dbsf=pci0:138:0:0 handle=\_SB_.PC04.BR4A.H000
dev.ice.0.%driver: ice
dev.ice.0.%desc: Intel(R) Ethernet Network Adapter E810-XXV-2 - 1.39.13-k
</pre>
</ref>
|
|1.37.11-k (via iflib)<ref>Read out via <code>root@OPNsense:~ # sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code>on a system with Supermicro X12SDV-4C-SP6F motherboard:
<pre>
dev.ice.0.iflib.driver_version: 1.37.11-k
dev.ice.0.%domain: 0
dev.ice.0.%parent: pci8
dev.ice.0.%pnpinfo: vendor=0x8086 device=0x124d subvendor=0x15d9 subdevice=0x124d class=0x020000
dev.ice.0.%location: slot=0 function=0 dbsf=pci0:244:0:0 handle=\_SB_.PC02.VP2A.CPM0
dev.ice.0.%driver: ice
</pre>
</ref>
|
|1.34.2-k (via iflib)<ref>Read out via <code>root@OPNsense:~ # sysctl -a | grep -E 'dev.*.iflib.driver_version' -A 5</code> on a system with Supermicro X12SDV-4C-SP6F motherboard:
<pre>
dev.ice.1.iflib.driver_version: 1.34.2-k
dev.ice.1.%domain: 0
dev.ice.1.%parent: pci8
dev.ice.1.%pnpinfo: vendor=0x8086 device=0x124d subvendor=0x15d9 subdevice=0x124d class=0x020000
dev.ice.1.%location: slot=0 function=2 dbsf=pci0:244:0:2 handle=\_SB_.PC02.VP2A.D077
dev.ice.1.%driver: ice
</pre>
</ref>
|
| colspan="4" |(not supported)
|-
|[https://www.freebsd.org/cgi/man.cgi?query=mlx4en&sektion=4&format=html mlx4en]
|
* Mellanox ConnectX-4
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|[https://www.freebsd.org/cgi/man.cgi?query=mlx5en&sektion=4&format=html mlx5en]
|
* Mellanox ConnectX-5
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|-
|re
|
* Realtek
| colspan="14" |See [[Realtek NICs in OPNsense]]
|}

== iflib ==
Iflib is a framework for network interface drivers for FreeBSD. It has been developed to remove standard codeblocks (boilerplates) that are often required for modern network interface devices. This should allow driver developers to focus on the specific code required for their hardware.<ref>[https://www.freebsd.org/cgi/man.cgi?query=iflib&sektion=4&apropos=0&manpath=FreeBSD+12.2-RELEASE+and+Ports iflib Manpage] (www.freebsd.org)</ref>

Iflib was launched in the fall of 2017 and provides a standardized set of functions for implementing network drivers. iflib currently supports most Intel drivers and cards from Broadcom NetExtreme family.<ref>[https://www.youtube.com/watch?v=FuNgy8Ag4DE Sam Gwydir: Improving netdump hardware support and performance with iflib - BSDCan 2018] (youtube.com)</ref>

The idea behind iflib was to reduce the redundant code in different NIC drivers to standardize certain kernel interface functions. Most, but not all, NIC drivers have been rewritten by the manufacturers to support the iflib API. The new library handles tasks such as connecting Netmap devices to relieve the manufacturers' driver developers of this burden.

The use of iflib in FreeBSD means that the driver versions have changed. The version that can be seen in the current FreeBSD kernels is the iflib version of the driver and this version number usually does not match the latest version of the driver listed on the manufacturer's website. Some manufacturers provide an iflib version of their FreeBSD driver for newer kernel versions and an older, non-iflib version for older kernels. And the real catch is that, for some NIC drivers, the version number that appears to be newer and higher is actually older code than what might be included in a non-iflib version.<ref>[https://forum.netgate.com/topic/155324/any-one-know-which-intel-ix-driver-for-x520-card-is-in-the-actual-kernel/4?_=1620296660376&lang=de Any one know which Intel ix driver for x520 card is in the actual kernel?] (forum.netgate.com)</ref>

== IPS support ==
An overview, which drivers are supported by IPS, is shown in the following spreadsheet:
* [https://docs.google.com/spreadsheets/d/1RVj8K3XOzWi-Bkjq6hUxWudu7Cxd8FFTqjLiBMzZWEM/edit#gid=0 netmap(4) on OPNsense] (docs.google.com/spreadsheets)

Information on ixl driver netmap support:
* [https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=230465#c30 ixl: not working in netmap mode (Comment #30)] (bugs.freebsd.org) <cite>I'm not surprised this works, because ixl in FreeBSD 12.x is implemented through iflib, and netmap in this case uses iflib to access the hw (and iflib must work, otherwise you would not be able to use an ixl NIC using the traditional networking tools and applications).</cite>

More information:
* [https://www.thomas-krenn.com/de/tkmag/allgemein/opnsense-webinar-intrusion-detection-pro-und-contra/ OPNsense Webinar: Intrusion Detection – Pro and Contra] (TKmag, 16.06.2020)

== References ==
<references />

{{Wfischer}}
{{Tniedermeier}}
{{Aranzinger}}
[[Category:OPNsense]]
[[de:OPNsense Netzwerkkarten-Treiber]]

Installation of Open WebUI with Ollama

2026-07-20T12:37:05Z

Aranzinger: Created page with "'''Open WebUI''' provides a browser-based user interface for local KI-models. In connection with Ollama, user can select models and use them via webbrowser. This article shows the installation of Open WebUI as docker container. Ollama is operated natively on the same Ubuntu server.  == Requirements == These instructions are..."

'''Open WebUI''' provides a browser-based user interface for local KI-models. In connection with Ollama, user can select models and use them via webbrowser.

This article shows the installation of Open WebUI as docker container. Ollama is operated natively on the same Ubuntu server.



== Requirements ==

These instructions are designed for Ubuntu server 24.04 LTS. The following components must already be installed:

* Ollama in accordance with the article [[Installation of Ollama]]
* Docker in accordance with the article [[Docker Installation under Ubuntu 24.04]]
* At least one locally installed Ollama model
* User with <code>sudo</code>-rights
* Free TCP-Port <code>8080</code>

Check the Ollama service:

<syntaxhighlight lang="bash">sudo systemctl status ollama</syntaxhighlight>

If the connection is successful, a JSON response containing the installed models is returned.

If no model is available, download, for example, <code>gemma3:4b</code>:

<syntaxhighlight lang="bash">ollama pull gemma3:4b</syntaxhighlight>

Check the docker installation:

<syntaxhighlight lang="bash">sudo docker version</syntaxhighlight>

== Install WebUI ==

Open WebUI runs in a docker container. As Ollama is natively installed on the same server, the container with the host network is started.

Start WebUI:

<syntaxhighlight lang="bash" line="1">sudo docker run -d \
--network=host \
-v open-webui:/app/backend/data \
-e OLLAMA_BASE_URL=http://127.0.0.1:11434 \
--name open-webui \
--restart always \
ghcr.io/open-webui/open-webui:main</syntaxhighlight>

The Docker volume <code>open-webui</code> stores user accounts, settings and chat histories permanently.

The <code>main</code> tag refers to the current version. For the productive operation, a fixed version number should be used after the test has been successful.



Check the container status:

<syntaxhighlight lang="bash">sudo docker ps --filter name=open-webui</syntaxhighlight>

If necessary, view the startup logs:

<syntaxhighlight lang="bash">sudo docker logs --tail=100 open-webui</syntaxhighlight>

== Open web interface ==

Open the following address in a browser:

<code>http://<IP-DES-SERVERS>:8080</code>

The first user account created on a new installation is granted administrator privileges.




Log in and select <code>gemma3:4b</code> from the model selection.

Send, for example, the following request:

:Explain the difference between RAID 5 und RAID 6.

If the model responds, the connection between Open WebUI and Ollama functions.



== Check Ollama connection ==

If no models are displayed, open the following in Open WebUI:

<code>Admin Panel > Settings > Connections</code>

The Ollama address should point to the following URL:

<code>http://127.0.0.1:11434</code>

In addition, check the Ubuntu server:

<syntaxhighlight lang="bash">curl http://127.0.0.1:11434/api/tags</syntaxhighlight>

As Open WebUI is started with <code>--network=host</code>, the container can use the local Ollama address directly.

== Update Open WebUI ==

Load the current container image:

<syntaxhighlight lang="bash">sudo docker pull ghcr.io/open-webui/open-webui:main</syntaxhighlight>

Stop and remove the previous container:

<syntaxhighlight lang="bash" line="1">sudo docker stop open-webui
sudo docker rm open-webui</syntaxhighlight>

After that, restart Open WebUI:

<syntaxhighlight lang="bash" line="1">sudo docker run -d \
--network=host \
-v open-webui:/app/backend/data \
-e OLLAMA_BASE_URL=http://127.0.0.1:11434 \
--name open-webui \
--restart always \
ghcr.io/open-webui/open-webui:main</syntaxhighlight>

The data in the docker volume <code>open-webui</code> is retained.

== Secure access ==

Open WebUI uses user accounts. Nevertheless, port <code>8080</code> should not be accessible from the Internet without protection.

A VPN or a reverse proxy with HTTPS is recommended for the access from the Internet. For a reverse proxy, WebSockets support must be enabled.

For purely internal use, access can be restricted to the local network using UFW:

<syntaxhighlight lang="bash">sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp</syntaxhighlight>

Adapt the subnet to your own environment:

== Troubleshooting ==

=== Websurface is not available ===

Check the container status:

<syntaxhighlight lang="bash">sudo docker ps -a --filter name=open-webui</syntaxhighlight>

View the logs:

<syntaxhighlight lang="bash">sudo docker logs open-webui</syntaxhighlight>

Verify, if port <code>8080</code> is already used:

<syntaxhighlight lang="bash">sudo ss -tulpn | grep 8080</syntaxhighlight>

=== No models are displayed ===

Check the installed Ollama models:

<syntaxhighlight lang="bash">ollama ls</syntaxhighlight>

Check Ollama API:

<syntaxhighlight lang="bash">curl http://127.0.0.1:11434/api/tags</syntaxhighlight>

Restart both services if necessary:

<syntaxhighlight lang="bash" line="1">sudo systemctl restart ollama
sudo docker restart open-webui</syntaxhighlight>

=== Page is not displayed correctly after an update ===

Open the web interface in a private browser window to test it. If it works there, delete the cache and the website data for the Open-WebUI-address.

== Deinstallation ==

Stop and remove the container:

<syntaxhighlight lang="bash" line="1">sudo docker stop open-webui
sudo docker rm open-webui</syntaxhighlight>

The stored data remains in the Docker volume for the time being.

Remove the volume to delete all Open-WebUI-data completely:

<syntaxhighlight lang="bash">sudo docker volume rm open-webui</syntaxhighlight>

'''Attention:''' User accounts, settings and chat histories are completely deleted.

== Sources ==

* [https://docs.openwebui.com/getting-started/quick-start/ Open WebUI Documentation – Quick Start] (en)
* [https://docs.openwebui.com/getting-started/quick-start/connect-a-provider/starting-with-ollama/ Open WebUI Documentation – Ollama] (en)
* [https://docs.openwebui.com/troubleshooting/connection-error/ Open WebUI Documentation – Connection Errors] (en)
* [https://www.thomas-krenn.com/de/wiki/Docker_Installation_unter_Ubuntu_24.04 Docker Installation on Ubuntu 24.04]
* [https://docs.ollama.com/api/introduction Ollama Documentation – API Introduction] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Artificial Intelligence]]
[[Category:Linux]]
[[Category:Ubuntu]]
[[Category:Docker]]

Activation of NVIDIA vGPU for RDS Sessions on Windows Server

2026-07-20T10:28:32Z

Aranzinger: Created page with "On Windows Server, applications within an RDS session may not use the assigned NVIDIA vGPU. Instead, Windows uses Microsoft Basic Render Driver by default. As a result, DirectX-based 3D applications, in particular, cannot access the GPU. This article shows how to activate NVIDIA vGPU for RDS-sessions.  == Requirements == The NVIDIA vGPU must be assigned to the vi..."

On Windows Server, applications within an RDS session may not use the assigned NVIDIA vGPU. Instead, Windows uses Microsoft Basic Render Driver by default. As a result, DirectX-based 3D applications, in particular, cannot access the GPU.

This article shows how to activate NVIDIA vGPU for RDS-sessions.



== Requirements ==
The NVIDIA vGPU must be assigned to the virtual machine and the suitable guest driver must be installed.

Check first if Windows recognizes the vGPU:

<syntaxhighlight lang="powershell">nvidia-smi</syntaxhighlight>

The command should display the assigned GPU and the graphics memory available.



== Enable Group Policy ==

Open the dialogue <code>Execute</code> via <code>Windows-Key+ R</code> and start:

<code>gpedit.msc</code>

Navigate to:

<code>Computer-Configuration > Administrative Templates> Windows-Components> Remotedesktopservices > Remotedesktop-Session-Host > Remote-Session-Environment</code>



Activate the guideline:

<code>Hardware graphics adapter for all remotedesktopservices-sessions</code>

The English name is:

<code>Use the hardware default graphics adapter for all Remote Desktop Services Sessions</code>



After that, restart Windows-Server-VM.

== Check GPU-use ==

Re-establish an RDS connection and launch an application that uses GPU acceleration.

Check the utilization in the Task-Manager:

<code>Performance > GPU</code>

Alternatively, you can execute the following command:

<syntaxhighlight lang="powershell">nvidia-smi</syntaxhighlight>

If a GPU still does not appear, check the NVIDIA vGPU guest driver, the assigned vGPU profile, and the licensing.

== Background ==

NVIDIA describes this behaviour for all supported Windows Server guest operating systems. The default settings uses Microsoft Basic Render Driver, as Software Rendering can be more efficient for simple 2D-applications.
DirectX-based 3D-applications cannot, however, access the GPU.

== Sources ==

* [https://docs.nvidia.com/vgpu/19.0/known-issues/bug-no-id-no-gpu-utilization-windows-server-guests.html NVIDIA vGPU Documentation – RDS sessions do not use the GPU with Microsoft Windows Server as guest OS] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Windows]]
[[Category:Virtual Desktop Infrastructure (VDI)]]
[[de:NVIDIA vGPU für RDS-Sitzungen unter Windows Server aktivieren]]

Supermicro BMC Security Advisories July 2026

2026-07-20T05:49:48Z

Aranzinger:

In '''July 2026''', Supermicro published security advisories regarding the BMC-firmware of its mainboards. This security vulnerability requires a '''firmware update'''.

In this article, you will find information on this security advisory and where to find updates on Thomas-Krenn products.

== Security advisories ==
{| class="wikitable"
|- style="background-color: #EFEFEF; font-weight: bold;"
! align="center" |CVE
! align="center" |Risk potential
! align="center" |Description
|-
|align="center" | CVE-2026-3821
| align="center" | High 8.8
| align="left" | '''Execution of arbitrary code''' (The SMASH-services of Supermicro (SMC) show a security vulnerability that allows the execution of an arbitrary code. An authorized attacker can exploit SMASH input functions to compromise data integrity or launch a denial-of-service (DoS) attack against the BMC.)
|-
|}

== Updates for Thomas-Krenn products ==
Updates on the corresponding system can be found in the <tklink type="sitex" id="440">download area of Thomas-Krenn</tklink>.
The updates in the download area have been tested by us to guarantee the stability and compatibility of our systems.

If you require the latest version for your system and it is not yet available in our download area, you can get it at [https://www.asus.com/de/support/download-center/ Asus] or [https://www.supermicro.com/en/support/resources/downloadcenter/swdownload Supermicro].

== More information ==
* [https://www.supermicro.com/en/support/security_BMC_IPMI_Jul_2026 Vulnerabilities in Supermicro BMC Firmware, July 2026]
{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category:Server Hardware]]
[[de:Supermicro BMC Sicherheitshinweise Juli 2026]]

Installation of Ollama

2026-07-17T07:38:13Z

Aranzinger:

'''Ollama''' allows the local operation of Large Language Models (LLMs) on a Linux server. The models run on the own hardware and can be used via command line or HTTP-API.

This article presents the native installation of Ollama on an Ubuntu server. As an example, a small model is downloaded and tested by using the local command line as well as the local API.



== Requirements ==

These instructions are designed for Ubuntu Server 24.04 LTS. The installation normally functions on an Ubuntu Server LTS and 22.04 LTS, too. For GPU-systems should be verified if a suitable driver is available for the used Ubuntu version in advance.

The following resources are recommended for initial testing:

* user with <code>sudo</code>-rights
* at least 8 GB RAM
* at least 20 GB storage available
* Internet access for installation and model download
* optional for a supported NVIDIA or AMD-GPU

Verify the intalled Ubuntu version:

<syntaxhighlight lang="bash">cat /etc/os-release</syntaxhighlight>

Install <code>curl</code>:

<syntaxhighlight lang="bash">sudo apt install -y curl</syntaxhighlight>

== Install Ollama ==
Execute the official installation script:

<syntaxhighlight lang="bash">curl -fsSL https://ollama.com/install.sh | sh</syntaxhighlight>



Next, verify the installed version:

<syntaxhighlight lang="bash">ollama -v</syntaxhighlight>

The installation script sets up a systemd-service. Check its status:

<syntaxhighlight lang="bash">sudo systemctl status ollama</syntaxhighlight>

The service should be displayed with the <code>active (running)</code> state.

If the service is not started, it can be activated manually:

<syntaxhighlight lang="bash">sudo systemctl enable --now ollama</syntaxhighlight>

== Start initial model ==

In this example, <code>gemma3:4b</code> is used. The model requires approximately 2.2 GB storage for the download and is suitable for the initial function test.

Start the model:

<syntaxhighlight lang="bash">ollama run gemma3:4b</syntaxhighlight>

Ollama automatically downloads the model the first time it is runned. It may take a few minutes depending on the Internet connection.



Next, enter the following query, for example:

:Explain the difference between RAID 5 and RAID 6.

Finish the session with:

<syntaxhighlight lang="bash">/bye</syntaxhighlight>

Display the installed models:

<syntaxhighlight lang="bash">ollama ls</syntaxhighlight>

== Verify GPU-usage ==

Ollama automatically uses a supported GPU if the required driver is installed.

Start the model and open the second SSH-session:

<syntaxhighlight lang="bash">ollama run gemma3:4b</syntaxhighlight>

Check the current version there:

<syntaxhighlight lang="bash">ollama ps</syntaxhighlight>

The column <code>PROCESSOR</code> displays if the model is executed on the CPU, GPU or on both.

With an NVIDIA GPU, you can also check the utilization:

<syntaxhighlight lang="bash">nvidia-smi</syntaxhighlight>

If there is no supported GPU available, Ollama executes the model via CPU and RAM. Response times are generally longer in such cases.



== Check Ollama-API ==

Ollama provides a local HTTP-API on port <code>11434</code> by default.

Display the models available via API:

<syntaxhighlight lang="bash">curl http://127.0.0.1:11434/api/tags</syntaxhighlight>

If the connection is successful, a JSON response containing the installed models is returned.

The local API is, for example, used by Open WebUI, n8n and own applications.

== Optional: Acces from the local network ==

By default, Ollama only listens on <code>127.0.0.1</code>. If another system should access the API in the local network, the Bind address must be adjusted.

Open the systemd extension:

<syntaxhighlight lang="bash">sudo systemctl edit ollama.service</syntaxhighlight>

Add the following content:

<syntaxhighlight lang="ini" line="1">[Service]
Environment="OLLAMA_HOST=0.0.0.0:11434"</syntaxhighlight>

Apply changes:

<syntaxhighlight lang="bash" line="1">sudo systemctl daemon-reload
sudo systemctl restart ollama</syntaxhighlight>

Next, verify the port:

<syntaxhighlight lang="bash">sudo ss -tulpn | grep 11434</syntaxhighlight>

By default, the Ollama API does not have its own user authentication for locally run models. Port <code>11434</code> should therefore only be released for reuqired systems and should not be directly available from the Internet.

Here is an example for the release of an internal subnet with UFW:

<syntaxhighlight lang="bash">sudo ufw allow from 192.168.1.0/24 to any port 11434 proto tcp</syntaxhighlight>

Customize the subnet to suit your own environment.

Further Ollama environment variables can be added in the same systemd-extension. All <code>Environment="..."</code> lines are entered together under a <code>[Service]</code> block.

== Update Ollama ==

On Linux, Ollama is updated by running the installation script again:

<syntaxhighlight lang="bash">curl -fsSL https://ollama.com/install.sh | sh</syntaxhighlight>

Models that have already been downloaded will remain.

After that, check the version:

<syntaxhighlight lang="bash">ollama -v</syntaxhighlight>

== Troubleshooting ==

=== Ollama-service does not run ===

Verify the service status:

<syntaxhighlight lang="bash">sudo systemctl status ollama</syntaxhighlight>

Display the most recent log entries:

<syntaxhighlight lang="bash">sudo journalctl -e -u ollama</syntaxhighlight>

=== Model does not start ===

Check the available storage space:

<syntaxhighlight lang="bash">df -h</syntaxhighlight>

Display the installed models:

<syntaxhighlight lang="bash">ollama ls</syntaxhighlight>

If necessary, download the model again:

<syntaxhighlight lang="bash">ollama pull gemma3:4b</syntaxhighlight>

=== Port 11434 is not available ===

Check if Ollama listens on the port:

<syntaxhighlight lang="bash">sudo ss -tulpn | grep 11434</syntaxhighlight>

Restart the service:

<syntaxhighlight lang="bash">sudo systemctl restart ollama</syntaxhighlight>

== Sources ==

* [https://docs.ollama.com/linux Ollama Documentation – Linux] (en)
* [https://docs.ollama.com/quickstart Ollama Documentation – Quickstart] (en)
* [https://docs.ollama.com/api/introduction Ollama Documentation – API Introduction] (en)
* [https://docs.ollama.com/faq Ollama Documentation – FAQ] (en)
* [https://ollama.com/library/gemma3:4b Ollama Model Library – Gemma 3 4B] (en)
* [https://ubuntu.com/about/release-cycle Ubuntu Release Cycle] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Artificial Intelligence]]
[[Category:Linux]]
[[Category:Ubuntu]]
[[de: Ollama installieren]]

Failed to fetch enterprise.proxmox.com 401 Unauthorized

2026-07-16T12:53:03Z

Aranzinger: Created page with "Proxmox Server Solutions GmbH from Vienna provides two package repositories for Proxmox VE: '''Proxmox VE Enterprise Repository''' (subject to a fee, recommended for productive use) and '''Proxmox VE No-Subscription Repository''' (free of charge, recommended for testing purposes). After Installation of Proxmox VE, the following error message appears when trying to install updates: '''<nowiki>Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/buster/I..."

Proxmox Server Solutions GmbH from Vienna provides two package repositories for [[Proxmox VE]]: '''Proxmox VE Enterprise Repository''' (subject to a fee, recommended for productive use) and '''Proxmox VE No-Subscription Repository''' (free of charge, recommended for testing purposes). After [[Installation of Proxmox VE]], the following error message appears when trying to install updates: '''<nowiki>Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/buster/InRelease 401 Unauthorized</nowiki>'''. This article shows how to solve this error by either setting up a paid subscription to the Enterprise Repository or, alternatively, using the free No-Subscription Repository.

== Troubleshooting ==
[[File:Proxmox_8_Updates_Refresh_Error.png|thumb|right|After the installation, Proxmox VE displays the following error message when trying to install the updates. The access to '''Proxmox VE Enterprise Repository''' can be unlocked with a subscription key. Alternatively, the '''Proxmox VE No-Subscription Repository''' is available for testing purposes.]] After the installation of Proxmox VE, the following message appears without further configuration when trying to install updates:
<pre>
Header
Proxmox
Virtual Environment 8.1.3
Node 'pve'
Show details
Logs
()
starting apt-get update
Get:1 http://security.debian.org bookworm-security InRelease [48.0 kB]
[...]
Get:9 http://ftp.at.debian.org/debian bookworm/main Translation-en [6109 kB]
Err:10 https://enterprise.proxmox.com/debian/ceph-quincy bookworm InRelease
401 Unauthorized [IP: 212.224.123.70 443]
Err:11 https://enterprise.proxmox.com/debian/pve bookworm InRelease
401 Unauthorized [IP: 212.224.123.70 443]
Get:12 http://ftp.at.debian.org/debian bookworm/contrib amd64 Packages [54.1 kB]
Get:13 http://ftp.at.debian.org/debian bookworm/contrib Translation-en [48.7 kB]
Get:14 http://ftp.at.debian.org/debian bookworm-updates/main amd64 Packages [12.7 kB]
Get:15 http://ftp.at.debian.org/debian bookworm-updates/main Translation-en [13.8 kB]
Reading package lists...
E: Failed to fetch https://enterprise.proxmox.com/debian/ceph-quincy/dists/bookworm/InRelease 401 Unauthorized [IP: 212.224.123.70 443]
E: The repository 'https://enterprise.proxmox.com/debian/ceph-quincy bookworm InRelease' is not signed.
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bookworm/InRelease 401 Unauthorized [IP: 212.224.123.70 443]
E: The repository 'https://enterprise.proxmox.com/debian/pve bookworm InRelease' is not signed.
TASK ERROR: command 'apt-get update' failed: exit code 100
</pre>

== Solution 1: Proxmox VE Enterprise Repository ==
This is the default, stable and recommended repository that is available for all users of Proxmox VE subcriptions. It contains the most stable packages and is suitable for production use. The pve-enterprise Repository is activated by default (/etc/apt/sources.list.d/pve-enterprise.list).

Information on the subscriptions available can be found in the article [[Proxmox VE Support-Subscriptions]].

== Solution 2: Proxmox VE No-Subscription Repository ==
This is the repository that is recommended for testing and non-production purposes. The included packages are not as intensively tested and validated as those from the Proxmox VE Enterprise Repository. There is no subscription key required for the access on the pve-no-subscription Repository.

The following settings must be selected in /etc/apt/sources.list for using the No-Subscription Repository:
<pre>
deb http://ftp.at.debian.org/debian bookworm main contrib
deb http://ftp.at.debian.org/debian bookworm-updates main contrib

# PVE pve-no-subscription repository provided by proxmox.com,
# NOT recommended for production use
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

# security updates
deb http://security.debian.org bookworm-security main contrib
</pre>

Note: So that the message "failed to fetch" disappears permanently, you must comment out the respective repository listed in each file by adding a "#" before it in the following two files:
* /etc/apt/sources.list.d/pve-enterprise.list:
*: <pre># deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterprise</pre>
* /etc/apt/sources.list.d/ceph.list:
*: <pre># deb https://enterprise.proxmox.com/debian/ceph-quincy bookworm enterprise</pre>

== More information ==
* [https://pve.proxmox.com/wiki/Package_Repositories Package Repositories] (pve.proxmox.com/wiki)

{{Wfischer}}
{{Aranzinger}}
[[Category:Proxmox Troubleshooting]]
[[de:Failed to fetch enterprise.proxmox.com 401 Unauthorized]]

Synology UC3400 Metadata-Overflow

2026-07-15T12:03:11Z

Aranzinger: Created page with "right On the Synology UC3400, a very high number of metadata objects (>10 million) leads to a critical condition in combination with migrations and snapshot load that may cause CPU and RAM overloads and cause migrations to fail. This article describes symptoms and provides possible solutions. == Initial situation == The UC3400 administrates SAN and LUN structures with the help of a internal metadata database. When there is..."

[[file:UC3400_Front.png|frameless|322x322px|right]]
On the Synology UC3400, a very high number of metadata objects (>10 million) leads to a critical condition in combination with migrations and snapshot load that may cause CPU and RAM overloads and cause migrations to fail.

This article describes symptoms and provides possible solutions.

== Initial situation ==
The UC3400 administrates SAN and LUN structures with the help of a internal metadata database. When there is a very large number of objects, the metadata can grow significantly. In addition, long snapshot chains, numerous copy-on-write operations, and the simultaneous processing of I/O and metadata accesses lead to increased system load.

The situation becomes particularly critical when there is a high number of snapshots, long operation hours without reorganisation, the migration of more extensive LUNs or the high rates of changes within a short time.

== Problem description ==
When there are more than '''approximately 10 million metadata objects''', a significant system overload occurs on the UC3400. This condition is often referred to as '''Metadata overflow'''.

Possible symptoms are:

* CPU-/RAM-load permanently close to 100%
* migrations are canceled or "timeouted"
* system reacts very slowly
* storage and snapshot operations block each other
* SAN-services fail temporarily
* risk for inconsistent LUN conditions increases

'''The following applies to the Synology UC3400:'''

* < 5 million objects → stable
* 5–10 million objects → marginal
* 10 million objects → critical (overflow risk)
* 50 milion objects → can only be operated effectively with significant optimization

== '''Immediate measures''' ==
The following measures can be implemented to restore operational capability quickly:

'''Note:''' These measures are intended solely as temporary workarounds and do not constitute a long-term solution for production operations.
* stop migration
* reduce snapshot load
* restart services (only in maintenance window)

== '''Recommended solution strategy''' ==
The most sustainable solution is a reorganization of the LUN-structure and a migration into smaller, clearly separated units.

=== Create new LUN ===
The most stable method is:

# create new LUN
# transmit data via storage migration or backup restore
# delete old LUN

As a result, all old metadata will be deleted completely.

=== Alternative: Metadata-Rebuild ===
{| {{Prettytable}} cellspacing="0" style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #a0a0a0 solid; border-collapse: collapse; " rules="all"
|'''Note: A Metadata-Rebuild should be only performed if there is a current and functional backup of all relevant data!'''
|-
|}

This risky procedure is intended solely as a last resort for recovery after all other diagnostic and repair measures have been proven unsuccessful.

Only with complete backup:

* metadata structure is deleted and recreated
* risk of iSCSI-Mapping losses
* only recommended for emergencies
== Prevention ==
To avoid the above mentioned problems, the following measures can be implemented:
* limit snapshot number
* LUN-recreation for long durations on a regular basis
* unload metadata regularly
* divide migrations in smaller sessions
* monitoring of CPU / RAM and SAN metadata load

'''Recommendation:''' When migrating large amounts of data, you should involve Synology Support early on. This way, they can assist with the data migration if needed, and you will receive recommendations on best practices to minimize risks.

{{Wsuess}}
{{Aranzinger}}
[[Category:Storage]]
[[de:Synology UC3400 Metadaten-Overflow]]

IPMI BMC reset for IPMI problems

2026-07-09T11:34:27Z

Aranzinger:

If there are any problems with IPMI or Remote Management Webinterface, the BMC (Baseboard Management Controller) can be '''restartet''' using the '''IPMItool'''. In this example, it is explained how to restart the BMC in Linux with ipmitool.

== IPMI BMC reset via ipmitool (remote) ==
If the server does not run on Linux, ipmitool can be executed on a Linux computer to restart the BMC of another server by using its IPMI IP address.

The command for the reset of the module on the server 10.0.0.1 (default user and pw) is as follows:
ipmitool mc reset cold -I lan -H 10.0.0.1 -U admin -P password

The last parameter is optional. It is prompted for the password if it has not been entered yet. Communication between the ipmitool on the Linux system and the IPMI BMC of the server takes place via UDP port 623.

== IPMI BMC reset via ipmitool (local) ==
If Linux is installed on the server itself, BMC can be reset locally (with root rights):
ipmitool mc reset cold

== Alternative: Turn off server ==
If the described procedure does not function with a reset via IPMI command, there is always the possibility to shut down the server and to turn off the power for 30 seconds then. To do this, the server must be disconnected completely from the power supply. This procedure also leads to a reset of the BMC.

== Recreate default settings ==
If you also want to recreate default settings, you can use the ipmicfg tool for Supermicro-based systems (see also [[IPMICFG#Recreation of default settings]]).

{{Aranzinger}}
[[Category:Remote Management]]
[[de:IPMI BMC reset bei IPMI Problemen]]

Windows Server 2025: Differences between editions

2026-07-09T07:41:43Z

Aranzinger: Created page with "Microsoft Windows Server 2025 is an operating system of the Windows series and the successor of Windows Server 2022. This article presents the differences between Windows Server 2025 editions. Pricing information on Windows Server 2025 can be found in the Thomas-Krenn online shop at <tklink type=sitex id=18135/>. For Windows Server 2025, Microsoft is now adopting the same approach it used for Window..."

Microsoft [[:Category:Windows Server 2025 | Windows Server 2025]] is an operating system of the Windows series and the successor of [[:Category:Windows Server 2022 | Windows Server 2022]].

This article presents the differences between Windows Server 2025 editions. Pricing information on Windows Server 2025 can be found in the Thomas-Krenn online shop at <tklink type=sitex id=18135/>. For Windows Server 2025, Microsoft is now adopting the same approach it used for Windows Server 2019 and Windows Server 2022, which is a '''Core Licensing'''. Information on this new licensing model can be found in the article [[Windows Server Core-Lizenzierung|Windows Server Core Licensing]].

== Editions ==
Microsoft Windows Server 2025 is available in four different editions:
* Essentials
* Standard
* Datacenter
*Datacenter Azure Edition

These four editions are suitable for the following application areas:
{| {{Prettytable}} width="1000px"
|- style="background-color: #EFEFEF; font-weight: bold;"
! Edition|| Suitable for... || Virtualization rights || Access licenses || CPU limit
|-
|'''Essentials'''
|align="center"| small companies with basic IT needs; very small IT department or no IT department of their own
|align="center"| Installation: 1 physical '''or''' 1 virtual *
|align="center"| no CALs required (limited to 25 users / 50 devices)
|align="center"| max. 1 CPU, max. 10 cores
|-
|'''Standard'''
|align="center"| for all companies that require extended features and virtualize to a lesser extent
|align="center"| 2 virtual Windows Server machines**
| rowspan="3" align="center" | CALs required***
|align="center" rowspan="2"| unlimited cores
|-
|'''Datacenter'''
|align="center"| for all companies with high IT workload needs and with a high number of virtual systems
| rowspan="2" align="center" | An unlimited number of virtual Windows Server machines
|-
|'''Datacenter Azure Edition'''
|align="center"| small companies with basic IT needs; very small IT department or no IT department on their own
|align="center"| 2,048 logical processors
|-
|}

:(*) The Windows Server Essentials license allows an installation of a physical and virtual Essentials Server if the physical server only provides the Hyper-V role for the virtualization of the Essentials Server.<ref>[https://www.microsoft.com/licensing/terms/productoffering/WindowsServerStandardDatacenterEssentials/OL#UseRights Windows Server Standard, Datacenter, and Essentials] (EN) (www.microsoft.com/licensing/terms)</ref>
:(**) The Windows Server Standard Edition License allows 2 OSEs (operating system environments) if all physical cores are licensed.
:(***) CALs are required for every user or for every device, which accesses a server directly or indirectly. Detailed information on this topic can be found on the Microsoft website. <ref>[https://www.microsoft.com/en-us/licensing/product-licensing/client-access-license Client Access Licenses and Management Licenses] (EN) (www.microsoft.com)</ref>

== Minimum hardware requirements for Windows Server 2025 ==
The following table presents the official minimum requirements for Windows Server 2025.<ref>[https://learn.microsoft.com/de-de/windows-server/get-started/hardware-requirements?tabs=cpu&pivots=windows-server-2025 Windows Server 2025 - Hardware Requirements] (DE) (www.learn.microsoft.com)</ref> The actual requirements are dependent on the system configuration and on the installed applications and features.

{| style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #a0a0a0 solid; border-collapse: collapse; " rules="all" width="650px" cellspacing="0" {{Prettytable}}
|- |- style="background-color: #EFEFEF; font-weight: bold;"
! Description || Minimum requirements
|-
|Processor architecture || x64
|-
|Processor speed || 1,4 GHz
|-
|Storage (RAM) || 512 MB* (recommended: ECC or similar technologies)
|-
|Hard drive storage space || 32 GB**
|-
|Network card || 1x Ethernet with a minimum throughput in the 1 GBit/s-range
|-
|}
:(*) 2GB for server with "desktop view".
:(**) Computer with more than 16 GB RAM require larger storage space for paging, hibernation, and backup files.

== What is new in Windows Server 2025 ==
In Windows Server 2022, the list of the new features is relatively short. Microsoft focuses on the new operating system Azure Stack HCI with new features.

We can look forward to the following new features in Windows Server 2025:<ref>[https://learn.microsoft.com/de-de/windows-server/get-started/whats-new-windows-server-2025 Windows Server 2025 - News] (DE) (www.learn.microsoft.com)</ref>

* Hotpatching
* TLS 1.3
* Improved Active Directory
* Optimized and improved performance for virtual machines and containers
* Improved administration

== Removed or not further developed features in Windows Server 2025 ==
In Windows Server 2025, there are few features that were not further developed or that were removed from Windows Server 2025.

The following features will no longer be included in Windows Server 2025:<ref>[https://learn.microsoft.com/de-de/windows-server/get-started/removed-deprecated-features-windows-server-2025 Windows Server 2025 - Removed Features] (DE) (www.learn.microsoft.com)</ref>

* IIS 6 administration console(Web-Lgcy-Mgmt-Console)
* NTLMv1
* WordPad
* SMTP-Server
* Windows PowerShell 2.0 Engine

== References ==
<references />

{{bbayer}}
{{Aranzinger}}
[[Category:Windows Server 2025]]
[[de:Windows Server 2025 Editionsunterschiede]]

How to: Install Nextcloud with an NFS data directory

2026-07-09T07:09:37Z

Smueller:

This article describes how to install Nextcloud Server on Ubuntu 26.04 LTS. Apache with PHP-FPM is used as the web server, while MariaDB provides the required database.

The actual Nextcloud user data is stored on an NFS-mounted storage system. The NFS storage is used as the primary Nextcloud data directory and is not integrated through the Nextcloud “External Storage” app.

This guide uses the following example values:

* Nextcloud address: <code>cloud.example.com</code>
* NFS server: <code>nfs.example.com</code>
* NFS export: <code>/nextcloud</code>
* Local NFS mount point: <code>/srv/nextcloud-data</code>
* Nextcloud directory: <code>/var/www/nextcloud</code>
* Database name: <code>nextcloud</code>
* Database user: <code>nextcloud</code>

Adjust these values to match your environment.

'''Note:''' In this setup, the NFS storage is part of the primary Nextcloud storage. If the NFS server is unavailable, the Nextcloud data directory will also be unavailable.

== Requirements ==

The following components are required for this guide:

* Ubuntu Server 26.04 LTS, 64-bit
* Apache 2.4
* PHP 8.5 with PHP-FPM
* MariaDB 11.8
* Redis
* An accessible NFSv4 export
* A DNS record for the Nextcloud domain
* TCP ports 80 and 443 must be reachable

For a small installation, the following resources can be used as an example:

* 4 vCPUs
* 4 GiB RAM
* At least 20 GiB of local storage for the operating system, Nextcloud application, database and logs
* Separate storage for the Nextcloud data directory

The actual resource requirements depend on factors such as the number of users, installed apps, number of files and concurrent access.

'''Important:''' NFS storage does not replace a backup. A complete backup must include at least the Nextcloud data directory, the MariaDB database and the Nextcloud configuration.

== Preparing the system ==

The following commands are executed as the <code>root</code> user.

First update the operating system:

<pre>
apt update
apt full-upgrade -y
</pre>

If a new kernel was installed, restart the system:

<pre>
reboot
</pre>

Then verify the installed Ubuntu version:

<pre>
cat /etc/os-release
</pre>

The output should contain the following information, among other values:

<pre>
VERSION_ID="26.04"
VERSION_CODENAME=resolute
</pre>

== Installing the required packages ==

Install Apache, MariaDB, PHP 8.5, Redis and the required PHP extensions:

<pre>
apt install -y \
apache2 \
mariadb-server \
php8.5-fpm \
php8.5-cli \
php8.5-common \
php8.5-curl \
php8.5-gd \
php8.5-gmp \
php8.5-imagick \
php8.5-intl \
php8.5-mbstring \
php8.5-mysql \
php8.5-xml \
php8.5-zip \
php8.5-bcmath \
php8.5-bz2 \
php8.5-apcu \
php8.5-redis \
redis-server \
nfs-common \
cron \
bzip2 \
wget
</pre>

Enable and start the required services:

<pre>
systemctl enable --now \
apache2 \
mariadb \
php8.5-fpm \
redis-server \
cron
</pre>

Verify the installed PHP version:

<pre>
php8.5 --version
</pre>

The output should begin with <code>PHP 8.5</code>.

The loaded PHP modules can be checked with the following command:

<pre>
php8.5 -m
</pre>

The following modules should be present, among others:

<pre>
apcu
curl
dom
fileinfo
gd
gmp
imagick
intl
mbstring
mysqli
openssl
pdo_mysql
redis
SimpleXML
xml
xmlreader
xmlwriter
zip
</pre>

== Configuring PHP 8.5 ==

Nextcloud requires suitable PHP settings for both PHP-FPM and command-line PHP calls.

=== Configuring PHP-FPM ===

Create a dedicated PHP configuration file for Nextcloud:

<pre>
nano /etc/php/8.5/fpm/conf.d/99-nextcloud.ini
</pre>

Add the following configuration:

<pre>
memory_limit = 512M
upload_max_filesize = 10G
post_max_size = 10G
max_execution_time = 3600
max_input_time = 3600
output_buffering = 0
</pre>

The values for <code>upload_max_filesize</code> and <code>post_max_size</code> determine the maximum file size that can be uploaded through the web interface. Adjust these values to suit your environment if required.

=== Configuring PHP CLI ===

The PHP command-line interface is used for cron jobs, maintenance tasks and the Nextcloud updater.

Create the following configuration file:

<pre>
nano /etc/php/8.5/cli/conf.d/99-nextcloud.ini
</pre>

Add the following content:

<pre>
memory_limit = 512M
apc.enable_cli = 1
</pre>

Verify the configuration:

<pre>
php8.5 --ini
php8.5 -i | grep -E 'memory_limit|apc.enable_cli'
</pre>

Restart PHP-FPM:

<pre>
systemctl restart php8.5-fpm
</pre>

Check the service status:

<pre>
systemctl status php8.5-fpm
</pre>

== Setting up the NFS data directory ==

=== Creating the mount point ===

Create the local mount point:

<pre>
mkdir -p /srv/nextcloud-data
</pre>

=== Configuring the NFS mount ===

Add the following line to <code>/etc/fstab</code>:

<pre>
nfs.example.com:/nextcloud /srv/nextcloud-data nfs4 rw,hard,_netdev,x-systemd.automount 0 0
</pre>

Adjust the NFS server and export path to match your environment.

Reload the systemd configuration:

<pre>
systemctl daemon-reload
</pre>

Access the mount point to trigger the automatic mount:

<pre>
ls -la /srv/nextcloud-data
</pre>

Alternatively, the mount can be triggered manually:

<pre>
mount /srv/nextcloud-data
</pre>

Verify that the NFS file system has been mounted:

<pre>
findmnt /srv/nextcloud-data
</pre>

Example:

<pre>
TARGET SOURCE FSTYPE OPTIONS
/srv/nextcloud-data nfs.example.com:/nextcloud nfs4 rw,relatime,...
</pre>

Only continue with the installation if <code>/srv/nextcloud-data</code> is actually mounted as an NFS file system.

=== Setting permissions ===

Apache and PHP-FPM run as the <code>www-data</code> user by default on Ubuntu.

Check its UID and GID:

<pre>
id www-data
</pre>

By default, Ubuntu uses UID and GID <code>33</code> for <code>www-data</code>.

The NFS directory must allow the <code>www-data</code> user to write to it. If NFS <code>root_squash</code> is enabled, ownership usually cannot be changed from the Nextcloud server. In this case, set the permissions directly on the NFS server.

Example on the NFS server:

<pre>
chown -R 33:33 /path/to/export/nextcloud
chmod 0750 /path/to/export/nextcloud
</pre>

Then perform a write test on the Nextcloud server as the <code>www-data</code> user:

<pre>
sudo -u www-data touch /srv/nextcloud-data/.write-test
sudo -u www-data rm /srv/nextcloud-data/.write-test
</pre>

If this test fails, correct the NFS export settings, UID/GID mapping or file system permissions before continuing.

'''Note:''' The data directory should be used exclusively by Nextcloud. Files should not be modified directly on the NFS share in parallel.

=== Making Apache and PHP-FPM depend on the NFS mount ===

To prevent the relevant services from starting without the data directory being available, systemd dependencies can be configured.

First create a dependency for Apache:

<pre>
systemctl edit apache2
</pre>

Add the following configuration:

<pre>
[Unit]
RequiresMountsFor=/srv/nextcloud-data
Wants=network-online.target
After=network-online.target
</pre>

Then create the corresponding dependency for PHP-FPM:

<pre>
systemctl edit php8.5-fpm
</pre>

Add the following configuration there as well:

<pre>
[Unit]
RequiresMountsFor=/srv/nextcloud-data
Wants=network-online.target
After=network-online.target
</pre>

Reload the systemd configuration:

<pre>
systemctl daemon-reload
</pre>

Check the configured dependencies:

<pre>
systemctl cat apache2
systemctl cat php8.5-fpm
</pre>

== Configuring MariaDB ==

=== Setting the transaction isolation level ===

Nextcloud requires the <code>READ-COMMITTED</code> transaction isolation level for MySQL or MariaDB.

Create the following configuration file:

<pre>
nano /etc/mysql/mariadb.conf.d/99-nextcloud.cnf
</pre>

Add the following content:

<pre>
[mysqld]
transaction-isolation = READ-COMMITTED
</pre>

If MariaDB binary logging is enabled, the <code>ROW</code> format must also be used:

<pre>
[mysqld]
transaction-isolation = READ-COMMITTED
binlog_format = ROW
</pre>

Restart MariaDB:

<pre>
systemctl restart mariadb
</pre>

Verify the configured transaction isolation level:

<pre>
mariadb -e "SHOW VARIABLES LIKE 'transaction_isolation';"
</pre>

The output should contain the following value:

<pre>
READ-COMMITTED
</pre>

=== Creating the database and user ===

Open the MariaDB console:

<pre>
mariadb
</pre>

Create the database and a database user that can only connect locally:

<pre>
CREATE DATABASE nextcloud
CHARACTER SET utf8mb4
COLLATE utf8mb4_general_ci;

CREATE USER 'nextcloud'@'localhost'
IDENTIFIED BY 'SECURE-DATABASE-PASSWORD';

GRANT ALL PRIVILEGES
ON nextcloud.*
TO 'nextcloud'@'localhost';

FLUSH PRIVILEGES;
EXIT;
</pre>

Replace <code>SECURE-DATABASE-PASSWORD</code> with a long, random password used exclusively for this database.

Because MariaDB and Nextcloud are installed on the same server, the user is deliberately restricted to <code>localhost</code>.

Test the login:

<pre>
mariadb -u nextcloud -p -h localhost nextcloud
</pre>

Exit the MariaDB console afterwards:

<pre>
EXIT;
</pre>

== Installing Nextcloud ==

At the time this article was created, Nextcloud <code>34.0.1</code> was the current stable version.

Before performing a later installation, check whether a newer version is available within the supported Nextcloud release branch.

Download the Nextcloud archive and the corresponding SHA-256 checksum:

<pre>
cd /tmp

NEXTCLOUD_VERSION="34.0.1"

wget https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2
wget https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.sha256
</pre>

Verify the integrity of the archive:

<pre>
sha256sum -c nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.sha256
</pre>

The output must contain <code>OK</code>:

<pre>
nextcloud-34.0.1.tar.bz2: OK
</pre>

Extract Nextcloud:

<pre>
tar -xjf nextcloud-${NEXTCLOUD_VERSION}.tar.bz2
mv nextcloud /var/www/nextcloud
</pre>

Set the owner:

<pre>
chown -R www-data:www-data /var/www/nextcloud
</pre>

Check the permissions:

<pre>
ls -ld /var/www/nextcloud
</pre>

After a successful installation, the downloaded archive files can optionally be removed:

<pre>
rm -f /tmp/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2
rm -f /tmp/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.sha256
</pre>

== Configuring Apache with PHP-FPM ==

This guide uses a dedicated subdomain for Nextcloud:

<pre>
cloud.example.com
</pre>

Enable the required Apache modules:

<pre>
a2enmod \
proxy_fcgi \
setenvif \
rewrite \
headers \
env \
dir \
mime \
ssl \
http2
</pre>

Enable the PHP 8.5 FPM configuration:

<pre>
a2enconf php8.5-fpm
</pre>

Create the Apache configuration:

<pre>
nano /etc/apache2/sites-available/nextcloud.conf
</pre>

Add the following configuration:

<pre>
<VirtualHost *:80>
ServerName cloud.example.com
DocumentRoot /var/www/nextcloud

<Directory /var/www/nextcloud/>
Require all granted
AllowOverride All
Options FollowSymLinks

<IfModule mod_dav.c>
Dav off
</IfModule>

SetEnv HOME /var/www/nextcloud
SetEnv HTTP_HOME /var/www/nextcloud
</Directory>

ErrorLog ${APACHE_LOG_DIR}/nextcloud-error.log
CustomLog ${APACHE_LOG_DIR}/nextcloud-access.log combined
</VirtualHost>
</pre>

Replace <code>cloud.example.com</code> with the actual DNS name of the Nextcloud installation.

Enable the Nextcloud site:

<pre>
a2ensite nextcloud.conf
</pre>

If the default Apache site is no longer required, it can be disabled:

<pre>
a2dissite 000-default.conf
</pre>

Check the Apache configuration:

<pre>
apache2ctl configtest
</pre>

If the configuration is valid, the following output is displayed:

<pre>
Syntax OK
</pre>

Restart Apache and PHP-FPM:

<pre>
systemctl restart php8.5-fpm
systemctl restart apache2
</pre>

Check both services:

<pre>
systemctl status php8.5-fpm
systemctl status apache2
</pre>

== Configuring the firewall ==

This step is only required if UFW is used on the server.

Before making changes, ensure that SSH remains allowed:

<pre>
ufw allow OpenSSH
</pre>

Allow HTTP and HTTPS:

<pre>
ufw allow 'Apache Full'
</pre>

Check the rules:

<pre>
ufw status
</pre>

Example:

<pre>
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Apache Full ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
</pre>

== Setting up HTTPS ==

Nextcloud should only be accessible over HTTPS on production systems.

The following requirements apply for a publicly trusted certificate:

* The domain points to the Nextcloud server.
* TCP port 80 is reachable for certificate validation.
* TCP port 443 is reachable for subsequent HTTPS access.

Install Certbot and the Apache plugin:

<pre>
apt install -y certbot python3-certbot-apache
</pre>

Request the certificate:

<pre>
certbot --apache --redirect -d cloud.example.com
</pre>

Certbot configures the certificate and redirects HTTP requests to HTTPS.

Test automatic certificate renewal:

<pre>
certbot renew --dry-run
</pre>

Check the Certbot timer:

<pre>
systemctl status certbot.timer
</pre>

If a reverse proxy or load balancer is already placed in front of Nextcloud, TLS termination can alternatively take place there. In that case, the Nextcloud settings for trusted proxies and forwarded headers must also be configured correctly.

Self-signed certificates should only be used in isolated internal environments where the certificate can be added as trusted on all clients.

== Completing the installation in the browser ==

Open the Nextcloud domain in a browser:

<pre>
https://cloud.example.com/
</pre>

Enter the following information in the installation dialog.

=== Administrator account ===

Create an administrator account with a secure password used exclusively for Nextcloud.

=== Data directory ===

Use the following path as the data directory:

<pre>
/srv/nextcloud-data
</pre>

=== Database ===

Select MariaDB or MySQL and use the following values:

* Database user: <code>nextcloud</code>
* Database password: the password defined previously
* Database name: <code>nextcloud</code>
* Database host: <code>localhost</code>

Then start the installation.

<gallery>
File:003-Admin-Erstellen.png|Create an administrator account with a secure password.
File:004-Speicherort-Festlegen.png|Use the previously mounted NFS share as the data directory.
File:Datenbank-hinzufügen.png|Enter the credentials for the local MariaDB database.
File:006-Finish.png|After a successful installation, the Nextcloud dashboard is displayed.
</gallery>

== Configuring background jobs ==

Nextcloud requires background jobs to be executed regularly. Cron should be used for server installations.

Create the following cron file:

<pre>
nano /etc/cron.d/nextcloud
</pre>

Add the following content:

<pre>
*/5 * * * * www-data /usr/bin/php8.5 -f /var/www/nextcloud/cron.php
</pre>

Set the correct file permissions:

<pre>
chmod 0644 /etc/cron.d/nextcloud
</pre>

Enable cron mode in Nextcloud:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ background:cron
</pre>

Restart the cron service:

<pre>
systemctl restart cron
</pre>

Check the entry:

<pre>
cat /etc/cron.d/nextcloud
</pre>

Test the cron job manually once:

<pre>
sudo -u www-data php8.5 -f /var/www/nextcloud/cron.php
</pre>

The status of the background jobs can later be checked in Nextcloud under “Administration settings” → “Basic settings”.

== Configuring APCu and Redis ==

APCu is used for the local application cache. Redis handles transactional file locking and can also be used as a distributed cache.

Open the Nextcloud configuration:

<pre>
nano /var/www/nextcloud/config/config.php
</pre>

Add the following entries inside the <code>$CONFIG</code> array:

<pre>
'memcache.local' => '\OC\Memcache\APCu',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',

'redis' => [
'host' => '127.0.0.1',
'port' => 6379,
'timeout' => 0.0,
],
</pre>

Ensure that all entries are placed inside the existing <code>$CONFIG</code> array and that preceding entries are separated correctly with commas.

Restart PHP-FPM and Apache:

<pre>
systemctl restart php8.5-fpm
systemctl restart apache2
</pre>

Check the Redis service:

<pre>
systemctl status redis-server
</pre>

Test the connection:

<pre>
redis-cli ping
</pre>

The expected response is:

<pre>
PONG
</pre>

== Enabling pretty URLs ==

Pretty URLs remove the <code>index.php</code> component from Nextcloud URLs.

First set the complete Nextcloud URL:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set overwrite.cli.url \
--value="https://cloud.example.com"
</pre>

Then set the rewrite base:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set htaccess.RewriteBase \
--value="/"
</pre>

Update the Nextcloud <code>.htaccess</code> file:

<pre>
sudo -u www-data php8.5 \
/var/www/nextcloud/occ maintenance:update:htaccess
</pre>

Reload Apache:

<pre>
systemctl reload apache2
</pre>

Nextcloud URLs should now be displayed without <code>index.php</code>.

== Verifying the installation ==

First check the Nextcloud status:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ status
</pre>

A successful installation returns information similar to the following:

<pre>
installed: true
maintenance: false
needsDbUpgrade: false
version: 34.0.1.0
versionstring: 34.0.1
</pre>

Also check the relevant services:

<pre>
systemctl status apache2
systemctl status php8.5-fpm
systemctl status mariadb
systemctl status redis-server
systemctl status cron
</pre>

Check the NFS mount again:

<pre>
findmnt /srv/nextcloud-data
</pre>

Verify that Nextcloud can still write to the data directory:

<pre>
sudo -u www-data touch /srv/nextcloud-data/.write-test
sudo -u www-data rm /srv/nextcloud-data/.write-test
</pre>

Check the Nextcloud configuration:

<pre>
sudo -u www-data php8.5 \
/var/www/nextcloud/occ config:list system
</pre>

Finally, open “Administration settings” → “Overview” in Nextcloud. Missing PHP modules, cache issues, failed background jobs and other configuration problems are displayed there.

== Optional configurations ==

=== Setting the default phone region ===

If phone numbers without an international country code are used in Nextcloud, a default region can be configured.

For Germany, use:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set default_phone_region \
--value="DE"
</pre>

=== Configuring the maintenance window ===

Nextcloud can run resource-intensive daily background jobs preferentially during a maintenance window.

The following example sets the start of the maintenance window to 01:00 UTC:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ \
config:system:set maintenance_window_start \
--type=integer \
--value=1
</pre>

=== Running available repairs ===

After updates or configuration changes, the Nextcloud repair routines can be executed:

<pre>
sudo -u www-data php8.5 \
/var/www/nextcloud/occ maintenance:repair
</pre>

== Operational notes ==

At least the following points should be considered for ongoing operation:

* Install security updates regularly
* Update Nextcloud and installed apps regularly
* Back up the MariaDB database
* Back up the NFS data directory
* Back up <code>/var/www/nextcloud/config</code>
* Monitor NFS availability
* Monitor local disk space
* Monitor Apache, PHP-FPM, MariaDB and Redis
* Check the Nextcloud administration overview regularly
* Check background jobs regularly
* Test restoring from existing backups

Relevant log files include:

<pre>
/var/log/apache2/nextcloud-error.log
/var/log/apache2/nextcloud-access.log
/var/log/php8.5-fpm.log
/srv/nextcloud-data/nextcloud.log
</pre>

The systemd logs can also be displayed with the following commands:

<pre>
journalctl -u apache2
journalctl -u php8.5-fpm
journalctl -u mariadb
journalctl -u redis-server
</pre>

=== Displaying the Nextcloud version ===

The currently installed Nextcloud version can be checked at any time:

<pre>
sudo -u www-data php8.5 /var/www/nextcloud/occ status
</pre>

=== Displaying the PHP version ===

The command-line PHP version can be checked as follows:

<pre>
php8.5 --version
</pre>

The PHP-FPM version used by Apache can be checked through the service:

<pre>
systemctl status php8.5-fpm
</pre>

{{Smueller}}
[[Category:Server Software]]
[[Category:Ubuntu]]
[[de:Nextcloud Installation mit NFS-Mount (HowTo)]]

Linux network analysis with traceroute

2026-07-08T11:45:40Z

Aranzinger:

The Linux tool '''traceroute''' provides a lot of possibilities to trace the path of network packets through a network or the Internet to a specific host. This article provides an overview of the function of [http://de.wikipedia.org/wiki/Traceroute traceroute]. Furthermore, we present interesting option parameters for traceroute. In addition to traceroute, [[Linux Netzwerk Analyse mit mtr|mtr]] is also interesting. It combines the functionality of traceroute and ping.

== Function ==

Traceroute traces the path of network packets to a specific host. To do this, traceroute modifies the time-to-live (TTL) field of the IP protocol. By using small TTL values, traceroute attempts to elicit ICMP TIME_EXCEEDED responses from the individual routers. The only required parameter for traceroute is the host to which the path is to be traced.

To identify the individual hops (routers) along the path from the current computer to the desired host, traceroute proceeds as follows:
# First, it sends an IP packet with TTL=1. As a result, the first router (the default gateway) discards the packet and sends back an ICMP TIME_EXCEEDED response.
# Now traceroute sends additional packets, incrementing the TTL by 1 each time. With the second packet (TTL=2), the packet first passes through the default gateway to the next router on the path to the host. Since the default gateway decrements the TTL by 1 when forwarding the packet, the packet arrives at the second router with a TTL of 1. This router discards the packet and sends an ICMP TIME_EXCEEDED response back to the original computer. The process works similarly with TTL=3 at the third router, TTL=4 at the fourth router, and so on.
# If an IP packet with a sufficiently high TTL eventually reaches the destination host, the host responds with an ICMP "port unreachable" message.

== Methods of testing packets ==

For the IP test packets sent, different protocols can be used. These options allow you to send test packets even with restrictive firewall configurations. In addition, this method lets you track the exact path used by a specific protocol (in case packets are routed differently depending on the protocol at some point along the path).

=== UDP (default) ===

In the default configuration, UDP datagrams are used as IP test packets. An 'unlikely' port is used for this purpose. The starting port is set to 33434 and is incremented by 1 for each subsequent test packet.

This method can be used by any user and does not require root rights.

Example (the first three hops were anonymized):
<pre>
[root@tpw ~]# traceroute www.google.com
traceroute to www.google.com (209.85.129.147), 30 hops max, 60 byte packets
1 XXX (XXX) 1.929 ms 1.982 ms 2.141 ms
2 XXX (XXX) 3.795 ms 3.769 ms 3.751 ms
3 XXX (XXX) 5.673 ms 5.650 ms 5.634 ms
4 iix12-aux11.highway.telekom.at (195.3.70.206) 21.027 ms 195.3.118.50 (195.3.118.50) 21.025 ms 21.328 ms
5 72.14.198.241 (72.14.198.241) 21.436 ms 21.406 ms 21.401 ms
6 209.85.255.176 (209.85.255.176) 21.497 ms 209.85.255.178 (209.85.255.178) 23.380 ms 23.300 ms
7 72.14.232.165 (72.14.232.165) 23.301 ms 21.613 ms 72.14.232.201 (72.14.232.201) 21.661 ms
8 72.14.239.170 (72.14.239.170) 21.678 ms 72.14.233.210 (72.14.233.210) 34.381 ms 34.365 ms
9 fk-in-f147.1e100.net (209.85.129.147) 19.659 ms 19.280 ms 19.291 ms
[root@tpw ~]#

</pre>

=== ICMP (-I) ===

This method uses ICMP echo requests ('Ping') for testing.

This method requires superuser-rights.

Example (the first three hops were anonymized):
<pre>
[root@tpw ~]# traceroute -I www.google.com
traceroute to www.google.com (209.85.129.147), 30 hops max, 60 byte packets
1 XXX (XXX) 1.948 ms 2.022 ms 2.202 ms
2 XXX (XXX) 3.915 ms 3.918 ms 3.929 ms
3 XXX (XXX) 5.870 ms 5.876 ms 5.889 ms
4 iix12-aux11.highway.telekom.at (195.3.70.206) 17.967 ms 19.781 ms 19.784 ms
5 72.14.198.241 (72.14.198.241) 19.869 ms 19.867 ms 19.915 ms
6 209.85.255.178 (209.85.255.178) 20.044 ms 19.502 ms 19.470 ms
7 72.14.232.201 (72.14.232.201) 19.529 ms 19.523 ms 72.14.232.203 (72.14.232.203) 19.532 ms
8 72.14.233.210 (72.14.233.210) 27.065 ms 34.198 ms 34.165 ms
9 fk-in-f147.1e100.net (209.85.129.147) 18.249 ms 19.352 ms 17.936 ms
[root@tpw ~]#
</pre>

=== TCP (-T) ===

This method uses a fix TCP port (port 80 is default). With the option -p, another destination port can be also selected (for example -p 25 to check the path to a mail server). This also allows you to get past firewalls that do not let through UDP datagrams or ICMP messages, for example.

This method uses the "half-open technique". This means that the target applications (for example a web server if the test packets are sent to port 80) do not see the test packets. Normally, a TCP SYN packet is simply sent. If no application is listening on that port on the target host, a TCP RESET is simply returned. However, if an application is listening on that port on the destination host, the destination host sends back a TCP SYN+ACK. Traceroute then responds with a TCP RESET (instead of accepting the connection with a TCP ACK). In this way, the TCP session is discarded without the application on the destination host noticing anything.

This method requires superuser-rights.

Example (the first three hops were anonymized):
<pre>
[root@tpw ~]# traceroute -T -p 80 www.google.com
traceroute to www.google.com (209.85.129.147), 30 hops max, 60 byte packets
1 XXX (XXX) 3.187 ms 3.165 ms 3.142 ms
2 XXX (XXX) 4.502 ms 4.486 ms 4.478 ms
3 XXX (XXX) 6.409 ms 6.394 ms 6.365 ms
4 195.3.118.50 (195.3.118.50) 22.834 ms 22.828 ms iix12-aux11.highway.telekom.at (195.3.70.206) 22.822 ms
5 72.14.198.241 (72.14.198.241) 22.848 ms 22.827 ms 22.803 ms
6 209.85.255.178 (209.85.255.178) 22.822 ms 209.85.255.176 (209.85.255.176) 20.884 ms 209.85.255.178 (209.85.255.178) 20.880 ms
7 72.14.232.165 (72.14.232.165) 20.916 ms 19.753 ms 72.14.232.203 (72.14.232.203) 19.744 ms
8 72.14.233.210 (72.14.233.210) 33.508 ms 72.14.233.206 (72.14.233.206) 21.713 ms 21.655 ms
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 fk-in-f147.1e100.net (209.85.129.147) 19.678 ms 19.715 ms 19.728 ms
[root@tpw ~]#
</pre>

=== UDP (-U) ===

This method uses a fix UDP port (port 53 is default). It is also used to bypass firewalls.

Unlike the TCP method, an application on the destination host receives these UDP datagrams if it is listening on the corresponding port. This can confuse the application in question. In most cases, the application will not send a response (so traceroute does not see a final hop in the trace).

This method can be used by any user and does not require root rights).

== More information ==
* Manpage of traceroute

{{Wfischer}}
{{Aranzinger}}
[[Category:Linux Networking]][[Category:Linux Performance]]
[[pl:Analiza sieci w Linuksie z traceroute]]
[[de:Linux Netzwerk Analyse mit traceroute]]

How to set up VLAN in OPNsense

2026-07-08T08:03:12Z

Aranzinger: Created page with "'''Virtual Local Area Networks''' - VLANs - are an important tool for the network infrastructure, particularly in environments with firewall solutions such as OPNsense. They allow to divide a physical network into multiple logical networks, which improves security and organization. This article describes how to set up VLANs in OPNsense 25.1. == Assign VLAN == First, a '''VLAN-ID between 1 and 4094''' is assigned to an interface. The ID 4095 is reser..."

'''Virtual Local Area Networks''' - [[VLAN Basics|VLANs]] - are an important tool for the network infrastructure, particularly in environments with firewall solutions such as [[OPNsense]]. They allow to divide a physical network into multiple logical networks, which improves security and organization. This article describes how to set up VLANs in OPNsense 25.1.

== Assign VLAN ==
First, a '''VLAN-ID between 1 and 4094''' is assigned to an interface. The ID 4095 is reserved, as in all VLAN networks.<ref name=IEEE802.1Q>[http://www.microhowto.info/tutorials/802.1q.html#idp28880 IEEE 802.1Q VLAN] <cite>"Each 802.1Q VLAN is identified by a 12-bit integer called a VID (VLAN Identifier) in the range 1 to 4094 inclusive. The values 0 and 4095 are reserved and should not be used."</cite></ref>.

<gallery>
File:OPNsense-25.1-vlan-configuration-001.png|Go to '''Interfaces ‣ Devices ‣ VLAN'''.
File:OPNsense-25.1-vlan-configuration-002.png|Here, click on the '''+'''.
File:OPNsense-25.1-vlan-configuration-003.png|Assign the desired '''Interface''' as well as the '''VLAN-ID''', in this example '''10'''.
File:OPNsense-25.1-vlan-configuration-004.png|Click on '''Apply'''.
</gallery>

It is also possible to use an interface as [[VLAN#Tagged VLANs|Trunk]] by simply assigning a second VLAN with a different ID to the same interface.

== Create interface ==
The following screenshots demonstrate the process of adding a network interface:

<gallery>
File:OPNsense-25.1-vlan-configuration-005.png|In the webinterface, navigate to '''Interfaces''' ‣ '''Assignments''' and select the new VLAN in the section '''Assign a new interface.'''
File:OPNsense-25.1-vlan-configuration-006.png|State a description and click on '''Add'''.
File:OPNsense-25.1-vlan-configuration-007.png|The new VLAN was added as new interface '''Lab''' in this example. Click on '''Save'''.
</gallery>

In Thomas-Krenn-Wiki, you will find information on how to [[OPNsense add interface|add an OPNsense interface]].

== Assign IP address ==
Here, an IP address is assigned to the added interface. There are several options available, such as automatic address assignment using DHCP or manual configuration of a static IP address (Static IPv4). In this example, a static address assignment with the IP-address '''192.168.10.1/24''' is used.

<gallery>
File:OPNsense-25.1-vlan-configuration-008.png|Click on the menu item '''Assignments''' ‣ '''Interfaces''' on the previously created VLAN interface.
File:OPNsense-25.1-vlan-configuration-009.png|Activate it with the help of the option '''Enable Interface'''.
File:OPNsense-25.1-vlan-configuration-010.png|Go to the menu item '''IPv4 Configuration Type''' after activation of the interface and select one of the '''options''' described earlier.
File:OPNsense-25.1-vlan-configuration-011.png|If you selected the '''Static IPv4''' option, scroll down to the '''Static IPv4 configuration''' section. State the static IPv4 address as well as the subnet. After that, click on '''Save'''.
File:OPNsense-25.1-vlan-configuration-012.png|Store the configuration with '''Apply changes.'''
</gallery>

== Firewall rules ==
'''Note:''' By default, all incoming connections on this interface are blocked. To change this, you must create rules to control and secure data traffic for the VLAN you created.

<gallery>
File:OPNsense-25.1-vlan-configuration-013.png|Go to the '''Firewall''' menu and click on '''Rules''' to create rules here.
</gallery>

== References ==
<references />

{{ederr}}
{{Aranzinger}}
[[Category:OPNsense]]
[[de:VLAN einrichten unter OPNsense]]

Network configuration Ubuntu - Netplan

2026-07-08T06:07:19Z

Aranzinger: Aranzinger moved page Network configuration - Netplan to Network configuration Ubuntu - Netplan

In the current version of [[Ubuntu]] Server, Ubuntu 18.04 (Bionic Beaver), the network configuration can no longer be set in the file <code>/etc/network/interfaces</code> in a default installation. Since Ubuntu 17.10, there is [http://manpages.ubuntu.com/manpages/bionic/man5/netplan.5.html Netplan], which is a new option to configure network interfaces. The network configuration is stored in .yaml-files. In addition to changes to the configuration of the network interfaces, there are also new configurations regarding the hostname.

== Network configuration (static) ==

<pre>
sudo rm /etc/netplan/50-cloud-init.yaml
sudo touch /etc/netplan/01-ens160.yaml
</pre>
The content of the file in a static network configuration should look as follows:
<pre>
network:
version: 2
renderer: networkd
ethernets:
ens160:
dhcp4: no
dhcp6: no
addresses: [10.2.2.123/24]
gateway4: 10.2.2.1
nameservers:
addresses: [192.168.110.50]
</pre>

Next, the network configuration can be activated:

<pre> sudo netplan apply</pre>

'''Note:''' Please use spaces for indentation in this file and do not use tabs.

== Change hostname ==
In Ubuntu 18.04, it is no longer enough to set the hostname via <code>/etc/hostname</code> or <code>hostnamectl</code>. After a reboot of the server, the hostname would be lost again, as it has not been stored. In the following, it is explained how to permanently set the host name:

<code>nano /etc/cloud/cloud.cfg</code>

<pre>
# This will cause the set+update hostname module to not operate (if true)
preserve_hostname: false
</pre>

Here, the value preserve_hostname must be set from false to true.

<pre>
# This will cause the set+update hostname module to not operate (if true)
preserve_hostname: true
</pre>

After that, the hostname can be set permanently using the following commands:

<pre>
sudo nano /etc/hostname
sudo hostnamectl set-hostname web-01
</pre>

== Network configuration (other) ==
For other network configurations, such as DHCP, Bonds, WLAN etc., you will find corresponding notes on the [https://netplan.io/examples netplan.io] website.

{{Jsterr}}
{{Aranzinger}}
[[Category:Ubuntu]]
[[de:Netzwerk-Konfiguration Ubuntu - Netplan]]

NVMe-CLI

2026-07-07T11:07:10Z

Aranzinger: Created page with "The '''NVMe Command Line Interface''' ('''NVMe-CLI''') provides multiple '''functions on querying and configuring NVMe SSDs''' on Linux and FreeBSD. In this article, we explain how to install NVMe-CLI and which funtions NVMe-CLI offers. == Version information == In the Linux distributions, the following versions of NVMe-CLI are included: {| class="wikitable" |+ ! colspan="2" |Linux distribution !NVMe-CLI version |- | rowspan="3" |Debian GNU/Linux |1..."

The '''NVMe Command Line Interface''' ('''NVMe-CLI''') provides multiple '''functions on querying and configuring [[NVMe]] [[SSD]]s''' on [[Linux]] and [[FreeBSD]]. In this article, we explain how to install NVMe-CLI and which funtions NVMe-CLI offers.

== Version information ==
In the Linux distributions, the following versions of NVMe-CLI are included:
{| class="wikitable"
|+
! colspan="2" |Linux distribution
!NVMe-CLI version
|-
| rowspan="3" |[[Debian GNU/Linux]]
|12.0 (Bookworm)
|nvme-cli [https://packages.debian.org/bookworm/nvme-cli 2.3]
|-
|11.0 (Bullseye)
|nvme-cli [https://packages.debian.org/bullseye/nvme-cli 1.12]
|-
|10.0 (Buster)
|nvme-cli [https://packages.debian.org/buster/nvme-cli 1.7]
|-
| rowspan="2" |[[Ubuntu]]
|22.04 LTS
|nvme-cli [https://packages.ubuntu.com/jammy/nvme-cli 1.16]
|-
|20.04 LTS
|nvme-cli [https://packages.ubuntu.com/focal/nvme-cli 1.9]
|-
|[[Proxmox VE]]
|7.x
|nvme-cli 1.12
|}
Changelog (in part):
{| class="wikitable"
|+
!NVMe-CLI version
!Release date
!Changes
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.1-rc0 v2.1-rc0]
|14.07.2022
|new solidigm plugin
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0 v2.0]
|08.04.2022
|first release of nvme-cli 2
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc7 v2.0-rc7]
|18.03.2022
|add transcend, virtium plugin commands
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc6 v2.0-rc6]
|11.03.2022
|cmds-main: Add intel plugin commands
cmds-plugins: Add huawei plugin commands
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc4 v2.0-rc4]
|22.02.2022
|Micron and NetApp plugin got a few fixes
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc3 v2.0-rc3]
|11.02.2022
|update wdc plugin version to 1.16.3
|-
|[https://github.com/linux-nvme/nvme-cli/releases/tag/v2.0-rc0 v2.0-rc0]
|14.01.2022
|code base of nvme-cli has been splitted into a nvme-cli and libnvme
a lot's of cleanups and refactoring
|}

== NVMe-CLI installation ==
NVMe-CLI is installed via apt on [[Debian]] and [[Ubuntu]]:
apt install nvme-cli

On [[FreeBSD]], the installation works as follows:
pkg install nvme-cli

== NVMe-CLI function overview ==

=== nvme help ===
<pre>
test@ubuntu-22-04:~$ nvme help
nvme-1.16
usage: nvme <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

The following are all implemented sub-commands:
list List all NVMe devices and namespaces on machine
list-subsys List nvme subsystems
id-ctrl Send NVMe Identify Controller
id-ns Send NVMe Identify Namespace, display structure
id-ns-granularity Send NVMe Identify Namespace Granularity List, display structure
list-ns Send NVMe Identify List, display structure
list-ctrl Send NVMe Identify Controller List, display structure
nvm-id-ctrl Send NVMe Identify Controller NVM Command Set, display structure
primary-ctrl-caps Send NVMe Identify Primary Controller Capabilities
list-secondary List Secondary Controllers associated with a Primary Controller
cmdset-ind-id-ns I/O Command Set Independent Identify Namespace
ns-descs Send NVMe Namespace Descriptor List, display structure
id-nvmset Send NVMe Identify NVM Set List, display structure
id-uuid Send NVMe Identify UUID List, display structure
id-iocs Send NVMe Identify I/O Command Set, display structure
id-domain Send NVMe Identify Domain List, display structure
list-endgrp Send NVMe Identify Endurance Group List, display structure
create-ns Creates a namespace with the provided parameters
delete-ns Deletes a namespace from the controller
attach-ns Attaches a namespace to requested controller(s)
detach-ns Detaches a namespace from requested controller(s)
get-ns-id Retrieve the namespace ID of opened block device
get-log Generic NVMe get log, returns log in raw format
telemetry-log Retrieve FW Telemetry log write to file
fw-log Retrieve FW Log, show it
changed-ns-list-log Retrieve Changed Namespace List, show it
smart-log Retrieve SMART Log, show it
ana-log Retrieve ANA Log, show it
error-log Retrieve Error Log, show it
effects-log Retrieve Command Effects Log, show it
endurance-log Retrieve Endurance Group Log, show it
predictable-lat-log Retrieve Predictable Latency per Nvmset Log, show it
pred-lat-event-agg-log Retrieve Predictable Latency Event Aggregate Log, show it
persistent-event-log Retrieve Presistent Event Log, show it
endurance-event-agg-log Retrieve Endurance Group Event Aggregate Log, show it
lba-status-log Retrieve LBA Status Information Log, show it
resv-notif-log Retrieve Reservation Notification Log, show it
boot-part-log Retrieve Boot Partition Log, show it
get-feature Get feature and show the resulting value
device-self-test Perform the necessary tests to observe the performance
self-test-log Retrieve the SELF-TEST Log, show it
supported-log-pages Retrieve the Supported Log pages details, show it
set-feature Set a feature and show the resulting value
set-property Set a property and show the resulting value
get-property Get a property and show the resulting value
format Format namespace with new block format
fw-commit Verify and commit firmware to a specific slot (fw-activate in old version < 1.2)
fw-download Download new firmware
admin-passthru Submit an arbitrary admin command, return results
io-passthru Submit an arbitrary IO command, return results
security-send Submit a Security Send command, return results
security-recv Submit a Security Receive command, return results
get-lba-status Submit a Get LBA Status command, return results
capacity-mgmt Submit Capacity Management Command, return results
resv-acquire Submit a Reservation Acquire, return results
resv-register Submit a Reservation Register, return results
resv-release Submit a Reservation Release, return results
resv-report Submit a Reservation Report, return results
dsm Submit a Data Set Management command, return results
copy Submit a Simple Copy command, return results
flush Submit a Flush command, return results
compare Submit a Compare command, return results
read Submit a read command, return results
write Submit a write command, return results
write-zeroes Submit a write zeroes command, return results
write-uncor Submit a write uncorrectable command, return results
verify Submit a verify command, return results
sanitize Submit a sanitize command
sanitize-log Retrieve sanitize log, show it
reset Resets the controller
subsystem-reset Resets the subsystem
ns-rescan Rescans the NVME namespaces
show-regs Shows the controller registers or properties. Requires character device
discover Discover NVMeoF subsystems
connect-all Discover and Connect to NVMeoF subsystems
connect Connect to NVMeoF subsystem
disconnect Disconnect from NVMeoF subsystem
disconnect-all Disconnect from all connected NVMeoF subsystems
gen-hostnqn Generate NVMeoF host NQN
show-hostnqn Show NVMeoF host NQN
dir-receive Submit a Directive Receive command, return results
dir-send Submit a Directive Send command, return results
virt-mgmt Manage Flexible Resources between Primary and Secondary Controller
rpmb Replay Protection Memory Block commands
fid-support-effects-log Submit Feature ID Support and Effects Log, Return result
lockdown Submit a Lockdown command,return result
version Shows the program version
help Display this help

See 'nvme help <command>' for more information on a specific command

The following are all installed plugin extensions:
ymtc Ymtc vendor specific extensions
nvidia NVIDIA vendor specific extensions
zns Zoned Namespace Command Set
transcend Transcend vendor specific extensions
sfx ScaleFlux vendor specific extensions
dera Dera vendor specific extensions
shannon Shannon vendor specific extensions
virtium Virtium vendor specific extensions
seagate Seagate vendor specific extensions
micron Micron vendor specific extensions
toshiba Toshiba NVME plugin
netapp NetApp vendor specific extensions
huawei Huawei vendor specific extensions
wdc Western Digital vendor specific extensions
memblaze Memblaze vendor specific extensions
lnvm LightNVM specific extensions
amzn Amazon vendor specific extensions
intel Intel vendor specific extensions

See 'nvme <plugin> help' for more information on a plugin
</pre>

=== nvme micron help ===
<pre>
test@ubuntu-22-04:~$ nvme micron help
nvme-1.16
usage: nvme micron <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Micron vendor specific extensions

The following are all implemented sub-commands:
select-download Selective Firmware Download
vs-temperature-stats Retrieve Micron temperature statistics
vs-pcie-stats Retrieve Micron PCIe error stats
clear-pcie-correctable-errors Clear correctable PCIe errors
vs-internal-log Retrieve Micron logs
vs-telemetry-controller-option Enable/Disable controller telemetry log generation
vs-nand-stats Retrieve NAND Stats
vs-drive-info Retrieve Drive information
plugin-version Display plugin version info
cloud-SSD-plugin-version Display plugin version info
log-page-directory Retrieve log page directory
vs-fw-activate-history Display FW activation history
vs-error-reason-identifier Retrieve Error reason
vs-smart-add-log Retrieve extended SMART data
clear-fw-activate-history Clear FW activation history
vs-smbus-option Enable/Disable SMBUS on the drive
version Shows the program version
help Display this help

See 'nvme micron help <command>' for more information on a specific command
</pre>

=== nvme toshiba help ===
<pre>
test@ubuntu-22-04:~$ nvme toshiba help
nvme-1.16
usage: nvme toshiba <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Toshiba NVME plugin

The following are all implemented sub-commands:
vs-smart-add-log Extended SMART information
vs-internal-log Get Internal Log
clear-pcie-correctable-errors Clear PCIe correctable error count
version Shows the program version
help Display this help

See 'nvme toshiba help <command>' for more information on a specific command
</pre>

=== nvme wdc help ===
The following commands are provided for WDC SSDs (details on 'drive-resize' can be found in [[Drive-Resize von Western Digital NVME SSDs|Drive-Resize of Western Digital NVME SSDs]]):
<pre>
test@ubuntu-22-04:~$ nvme wdc help
nvme-1.16
usage: nvme wdc <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Western Digital vendor specific extensions

The following are all implemented sub-commands:
cap-diag WDC Capture-Diagnostics
drive-log WDC Drive Log
get-crash-dump WDC Crash Dump
get-pfail-dump WDC Pfail Dump
id-ctrl WDC identify controller
purge WDC Purge
purge-monitor WDC Purge Monitor
vs-internal-log WDC Internal Firmware Log
vs-nand-stats WDC NAND Statistics
vs-smart-add-log WDC Additional Smart Log
clear-pcie-correctable-errors WDC Clear PCIe Correctable Error Count
drive-essentials WDC Drive Essentials
get-drive-status WDC Get Drive Status
clear-assert-dump WDC Clear Assert Dump
drive-resize WDC Drive Resize
vs-fw-activate-history WDC Get FW Activate History
clear-fw-activate-history WDC Clear FW Activate History
enc-get-log WDC Get Enclosure Log
vs-telemetry-controller-option WDC Enable/Disable Controller Initiated Telemetry Log
vs-error-reason-identifier WDC Telemetry Reason Identifier
log-page-directory WDC Get Log Page Directory
namespace-resize WDC NamespaceDrive Resize
vs-drive-info WDC Get Drive Info
vs-temperature-stats WDC Get Temperature Stats
capabilities WDC Device Capabilities
cloud-SSD-plugin-version WDC Cloud SSD Plugin Version
vs-pcie-stats WDC VS PCIE Statistics
get-latency-monitor-log WDC Get Latency Monitor Log Page
version Shows the program version
help Display this help

See 'nvme wdc help <command>' for more information on a specific command
</pre>

=== nvme intel help ===
<pre>
test@ubuntu-22-04:~$ nvme intel help
nvme-1.16
usage: nvme intel <command> [<device>] [<args>]

The '<device>' may be either an NVMe character device (ex: /dev/nvme0) or an
nvme block device (ex: /dev/nvme0n1).

Intel vendor specific extensions

The following are all implemented sub-commands:
id-ctrl Send NVMe Identify Controller
internal-log Retrieve Intel internal firmware log, save it
lat-stats Retrieve Intel IO Latency Statistics log, show it
set-bucket-thresholds Set Latency Stats Bucket Values, save it
lat-stats-tracking Enable and disable Latency Statistics logging.
market-name Retrieve Intel Marketing Name log, show it
smart-log-add Retrieve Intel SMART Log, show it
temp-stats Retrieve Intel Temperature Statistics log, show it
version Shows the program version
help Display this help

See 'nvme intel help <command>' for more information on a specific command
</pre>

== NVMe-CLI examples ==
The following examples were collected on an Ubuntu 22.04 system with an ATP M.2 NVMe SSD.

=== nvme list ===
<pre>
test@ubuntu-22-04:~$ sudo nvme list
Node SN Model Namespace Usage Format FW Rev
--------------------- -------------------- ---------------------------------------- --------- -------------------------- ---------------- --------
/dev/nvme0n1 20040089-000002 ATP NVMe M.2 2280 SSD 1 5,08 GB / 120,03 GB 512 B + 0 B 42A0S79A
</pre>

=== nvme list-subsys ===
<pre>
test@ubuntu-22-04:~$ sudo nvme list-subsys
nvme-subsys0 - NQN=nqn.2014.08.org.nvmexpress:1db21db220040089-000002 ATP NVMe M.2 2280 SSD
\
+- nvme0 pcie 0000:01:00.0 live
</pre>

In the following, you will find the output of a [[Proxmox VE]] 7.x system with four [[Western Digital SN640 TCG U.2 NVMe SSDs]]:
root@pmx01:~# nvme list-subsys
nvme-subsys0 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B7800000000000000000
\
+- nvme0 pcie 0000:84:00.0 live
nvme-subsys1 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B0000000000000000000
\
+- nvme1 pcie 0000:85:00.0 live
nvme-subsys2 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B7000000000000000000
\
+- nvme2 pcie 0000:86:00.0 live
nvme-subsys3 - NQN=nqn.2018-01.com.wdc:NGUID:0014EE830220B4000000000000000000
\
+- nvme3 pcie 0000:87:00.0 live
</pre>

=== nvme smart-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme smart-log /dev/nvme0n1
Smart Log for NVME device:nvme0n1 namespace-id:ffffffff
critical_warning : 0
temperature : 38 C (311 Kelvin)
available_spare : 100%
available_spare_threshold : 10%
percentage_used : 0%
endurance group critical warning summary: 0
data_units_read : 314.978
data_units_written : 197.916
host_read_commands : 1.739.034
host_write_commands : 2.384.025
controller_busy_time : 46
power_cycles : 106
power_on_hours : 68
unsafe_shutdowns : 59
media_errors : 0
num_err_log_entries : 0
Warning Temperature Time : 0
Critical Composite Temperature Time : 0
Temperature Sensor 1 : 27 C (300 Kelvin)
Temperature Sensor 2 : 38 C (311 Kelvin)
Thermal Management T1 Trans Count : 0
Thermal Management T2 Trans Count : 0
Thermal Management T1 Total Time : 0
Thermal Management T2 Total Time : 0
</pre>

=== nvme fw-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme fw-log /dev/nvme0n1
Firmware Log for device:nvme0n1
afi : 0x11
frs1 : 42A0S79A
frs2 : 42A0S79A
</pre>

=== nvme error-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme error-log /dev/nvme0n1
Error Log Entries for device:nvme0n1 entries:64
.................
Entry[ 0]
.................
error_count : 0
sqid : 0
cmdid : 0
status_field : 0(SUCCESS: The command completed successfully)
phase_tag : 0
parm_err_loc : 0
lba : 0
nsid : 0
vs : 0
trtype : The transport type is not indicated or the error is not transport related.
cs : 0
trtype_spec_info: 0
[...]
.................
Entry[63]
.................
error_count : 0
sqid : 0
cmdid : 0
status_field : 0(SUCCESS: The command completed successfully)
phase_tag : 0
parm_err_loc : 0
lba : 0
nsid : 0
vs : 0
trtype : The transport type is not indicated or the error is not transport related.
cs : 0
trtype_spec_info: 0
.................
</pre>

=== nvme effects-log /dev/nvme0n1 ===
<pre>
test@ubuntu-22-04:~$ sudo nvme effects-log /dev/nvme0n1
Admin Command Set
ACS0 [Delete I/O Submission Queue ] 00000001
ACS1 [Create I/O Submission Queue ] 00000001
ACS2 [Get Log Page ] 00000001
ACS4 [Delete I/O Completion Queue ] 00000001
ACS5 [Create I/O Completion Queue ] 00000001
ACS6 [Identify ] 00000001
ACS8 [Abort ] 00000001
ACS9 [Set Features ] 00000001
ACS10 [Get Features ] 00000001
ACS12 [Asynchronous Event Request ] 00000001
ACS16 [Firmware Commit ] 00000011
ACS17 [Firmware Image Download ] 00000001
ACS20 [Device Self-test ] 00000001
ACS128 [Format NVM ] 00010003
ACS129 [Security Send ] 00000003
ACS130 [Security Receive ] 00000001
ACS132 [Sanitize ] 00010003
ACS192 [Unknown ] 00000017
ACS193 [Unknown ] 00000017
ACS194 [Unknown ] 00000001
ACS224 [Unknown ] 00000001
ACS228 [Unknown ] 00000001
ACS229 [Unknown ] 00000001
ACS230 [Unknown ] 00000001

NVM Command Set
IOCS0 [Flush ] 00000003
IOCS1 [Write ] 00000003
IOCS2 [Read ] 00000001
IOCS4 [Write Uncorrectable ] 00000003
IOCS5 [Compare ] 00000001
IOCS8 [Write Zeroes ] 00000003
IOCS9 [Dataset Management ] 00000003
</pre>

== More information ==
* [https://github.com/linux-nvme/nvme-cli nvme-cli] (github.com/linux-nvme)
* [https://nvmexpress.org/open-source-nvme-management-utility-nvme-command-line-interface-nvme-cli/ Open Source NVMe™ Management Utility – NVMe Command Line Interface (NVMe-CLI)] (nvmexpress.org, 25.02.2020)

{{Wfischer}}
{{Aranzinger}}
[[Category:SSDs]]
[[de:NVMe-CLI]]

EFI shell USB drive

2026-07-03T05:28:16Z

Aranzinger: Created page with "The '''EFI shell''' allows to run EFI applications, such as tools for updating the BIOS or the firmware of network cards or RAID controllers. In a lot of systems, an EFI shell is already included in the BIOS. If an integrated EFI shell is missing, an USB drive with EFI shell can be used as an alternative. == Create USB stick with EFI shell == The following steps must be performed, to create an USB drive with EFI shell: # Format USB stick with '''FAT32''' # Create '''/..."

The '''EFI shell''' allows to run EFI applications, such as tools for updating the BIOS or the firmware of network cards or RAID controllers. In a lot of systems, an EFI shell is already included in the BIOS. If an integrated EFI shell is missing, an USB drive with EFI shell can be used as an alternative.

== Create USB stick with EFI shell ==
The following steps must be performed, to create an USB drive with EFI shell:
# Format USB stick with '''FAT32'''
# Create '''/efi/boot''' directory on USB drive
# Download UEFI shell ('''Shell.efi''') and store it in the /efi/boot/ directory on the USB drive:
#*https://github.com/tianocore/edk2/blob/edk2-stable201903/ShellBinPkg/UefiShell/X64/Shell.efi (includes UEFI interactive shell v2.2)
# Rename Shell.efi to '''Bootx64.efi'''

== Test UEFI shell ==
Next, you can boot from this USB stick and use the EFI shell:
<gallery>
File:BIOS-Boot-Override-USB-Pen-Drive.jpg|Boot into the BIOS and, under '''Save & Exit''' in the '''Boot Override''' section''',''' select the UEFI entry for the USB drive you created. ('''UEFI: Lexar USB Flash Drive ...''' in this example).
File:EFI-Shell-v2.2.jpg|The EFI shell is started.
</gallery>

{{Wfischer}}
{{Aranzinger}}

[[Category:UEFI]]
[[de:EFI Shell USB Stick]]

Grafana installation and configuration on Ubuntu server 18.04 LTS

2026-07-01T09:27:26Z

Aranzinger: Created page with "'''Grafana''' is a webbased open source frontend for virtualizing metrics and for alerting when thresholds are exceeded. Grafana '''supports numerous data sources''', for example Time Series databases such as InfluxDB, Graphite or Prometheus, log files via Elasticsearch and SQL data bases. Pre-defined dashboards are available through a marketplace.<ref>[https://grafana.com/grafana/dashboards Grafana Dashboards] (grafana.com)</ref> This aticle explains the '''installa..."

'''Grafana''' is a webbased open source frontend for virtualizing metrics and for alerting when thresholds are exceeded. Grafana '''supports numerous data sources''', for example Time Series databases such as [[InfluxDB]], Graphite or Prometheus, log files via Elasticsearch and SQL data bases. Pre-defined dashboards are available through a marketplace.<ref>[https://grafana.com/grafana/dashboards Grafana Dashboards] (grafana.com)</ref> This aticle explains the '''installation of Grafana''' in version 6.6.2 on '''[[Ubuntu]] 18.04 LTS''' as well as the '''connection of a InfluxDB database as a data source'''.

[[File:OPNsense-Grafana-Dashboard.png|thumb|right|Grafana dashboard with InfluxDB as datasource for monitoring a [[OPNsense]] firewall]]

== Installation ==
Grafana can be easily installed using Ubuntu's built-in package manager.<ref>[https://grafana.com/docs/grafana/latest/installation/debian/ Install on Debian or Ubuntu] (grafana.com)</ref> The following paragraphs show how to install Grafana on Ubuntu. Information about the installation on Windows, MAC and other Linux distributions can be found in the Grafana download area.<ref>[https://grafana.com/grafana/download Download Grafana] (grafana.com)</ref>

=== Add package sources ===
Since Grafana is not included in the official package repositories, the Grafana repository can be added as follows:
<pre>
tk@monitoringlesv2:~$ sudo apt install -y apt-transport-https
tk@monitoringlesv2:~$ sudo apt install -y software-properties-common wget
tk@monitoringlesv2:~$ wget -q -O - https://packages.grafana.com/gpg.key | sudo apt-key add -
tk@monitoringlesv2:~$ sudo add-apt-repository "deb https://packages.grafana.com/oss/deb stable main"
tk@monitoringlesv2:~$ sudo apt update
</pre>

=== Install Grafana and activate Systemd daemon ===
After the package sources have been added, Grafana can be installed and the SystemD-service can be started and activated for Grafana:
<pre>
tk@monitoringlesv2:~$ sudo apt install grafana
tk@monitoringlesv2:~$ sudo systemctl daemon-reload
tk@monitoringlesv2:~$ sudo systemctl enable grafana-server
tk@monitoringlesv2:~$ sudo systemctl start grafana-server
tk@monitoringlesv2:~$ sudo systemctl status grafana-server
</pre>

== Configure Grafana ==
The configuration is made via Grafana webinterface.<ref>[https://grafana.com/docs/grafana/latest/guides/getting_started/ Getting started] (grafana.com)</ref>
To proceed with the remaining configuration steps, launch a browser of your choice.

* Webinterface: http://<IP-des-Grafana-Servers>:3000
* Username: admin
* Password: admin

=== Login to webinterface ===
Log in with the username "admin" and the password "admin":
<gallery>
File:Ubuntu-Server-18.04-Grafana-001.png|Grafana login
File:Ubuntu-Server-18.04-Grafana-002.png|Log in to the web interface using the username "admin" and password "admin".
File:Ubuntu-Server-18.04-Grafana-003.png|A prompt to change your password appears.
</gallery>

=== Add datasource ===
This paragraph shows how to connect an InfluxDB as datasource to Grafana:
<gallery>
File:Ubuntu-Server-18.04-Grafana-004.png|After logging in to the web interface, you will see the following screen. Click on ''Add data source''.
File:Ubuntu-Server-18.04-Grafana-005.png|Click ''Select'' in the InfluxDB row.
File:Ubuntu-Server-18.04-Grafana-006.png|Assign a name to the data source, specify the path to InfluxDB, and select the database you want to connect to. Click ''Save & Test''.
File:Ubuntu-Server-18.04-Grafana-007.png|If the message '''Data source is working''' appears, the connection from InfluxDB to Grafana was successful.
File:Ubuntu-Server-18.04-Grafana-008.png|Click ''Back''.
</gallery>

=== Import dashboard ===
Pre-defined Grafana dashboards can be easily imported:
<gallery>
File:Ubuntu-Server-18.04-Grafana-009.png|Switch to the menu option Dashboards → Home.
File:Ubuntu-Server-18.04-Grafana-010.png|Go to Create → Import, to import a dashboard.
File:Ubuntu-Server-18.04-Grafana-011.png|Search for a suitable dashboard on Grafana and enter the URL or dashboard ID here.
File:Ubuntu-Server-18.04-Grafana-012.png|Depending on the dashboard, adjust a few more variables and then click ''Import''.
</gallery>

== References ==
<references />

{{Tniedermeier}}
{{Aranzinger}}
[[Category:Ubuntu]]
[[Category:Monitoring]]
[[pl:Instalacja i konfiguracja oprogramowania Grafana w Ubuntu Server 18.04 LTS]]
[[de:Grafana Installation und Konfiguration unter Ubuntu Server 18.04 LTS]]

Upload own Ubuntu packages to reprepro repository

2026-07-01T05:30:30Z

Aranzinger: Created page with "In the following article, it is explained '''how to upload''' your own Ubuntu packages to a '''reprepro''' repository. The packages are transferred in a folder on the repository server with '''dupload''' via scp and processed there via an inoticoming job from reprepro. In the examples shown, the client is running Ubuntu 12.10, and the server is running '''Ubuntu 12.04.2''' with kernel 3.2.0-38-generic. In the article Create Own apt repository using reprepro on Ubuntu..."

In the following article, it is explained '''how to upload''' your own Ubuntu packages to a '''reprepro''' repository. The packages are transferred in a folder on the repository server with '''dupload''' via scp and processed there via an inoticoming job from reprepro. In the examples shown, the client is running Ubuntu 12.10, and the server is running '''Ubuntu 12.04.2''' with kernel 3.2.0-38-generic.

In the article [[Create Own apt repository using reprepro on Ubuntu]], it is explained how to generate an own reprepro repository.

== Installation ==
=== On the repository server ===
<code>inoticoming</code><ref>[http://manpages.ubuntu.com/manpages/lucid/man1/inoticoming.1.html inoticoming Ubuntu-package] (packages.ubuntu.com)</ref> triggered actions, when files are added to a folder.
<pre>
:~$ sudo apt-get install inoticoming
</pre>

=== On the client ===
<code>dupload</code><ref>[http://packages.ubuntu.com/precise/dupload dupload Ubuntu-package] (packages.ubuntu.com)</ref> loads the Ubuntu packages from the repository server that is monitored by inoticoming.
<pre>
:~$ sudo apt-get install dupload
</pre>

== Configuration ==
=== On the server ===
The configuration file <code>incoming</code> sets the rules and folders for uploads of new packages into the reprepro repository. The configuration file <code>incoming</code> is located in the <code>/conf</code> folder of the used reprepro repos.
<pre>
:~$ vi packages/conf/incoming
Name: incoming
IncomingDir: /home/repository/incoming
Allow: precise
Cleanup: on_deny on_error
Tempdir: /home/repository/incoming_tmp
LogDir: /home/repository/incoming_log
</pre>
The <code>incoming</code> rule is called by <code>inoticoming</code> via <code>inoticoming</code>:
<pre>
:~$ inoticoming --logfile /home/repository/incoming_log/upload.log /home/repository/incoming/ \
> --stderr-to-log --stdout-to-log --suffix '.changes' \
> reprepro --waitforlock 100 processincoming incoming {} \;
</pre>
Make sure that <code>inoticoming</code> runs under the same user account that manages the repository and uploads the packages. This ensures that the files and folders can be created and have the correct permissions.
<pre>
:~$ ps -u repository
PID TTY TIME CMD
[...]
3098 ? 00:00:00 inoticoming
</pre>

=== On the client ===
First, an SSH key is transmitted to the server for authentication:
<pre>
:~$ ssh-copy-id -i .ssh/key_rsa.pub repository@192.168.56.102
</pre>
The dupload-configuration specifies how the packages are loaded into the rep:
<pre>
:~$ vi .dupload.conf
package config;
$default_host = "tkpack";
$cfg{'tkpack'} = {
fqdn => "192.168.56.102",
method => "scp",
login => "repository",
incoming => "/home/repository/incoming/",
# files pass on to dinstall which sends emails itself
dinstall_runs => 1,
};
</pre>

== Upload packages to repository ==
You can then use <code>dupload</code> to upload a package to the repo '''from the client''' (in this case, without sending notification emails):
<pre>
:~$ dupload -f --nomail -t tkpack tkmon_0.0.1-1_amd64.changes
dupload warning: mail options disabled, can't run `/usr/sbin/sendmail': No such file or directory
dupload note: no announcement will be sent.
Uploading (scp) to 192.168.56.102:/home/repository/incoming/
[ job tkmon_0.0.1-1_amd64 from tkmon_0.0.1-1_amd64.changes
tkmon_0.0.1-1.dsc, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1-1.debian.tar.gz, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1.orig.tar.gz, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1-1_all.deb, size ok, md5sum ok, sha1sum ok, sha256sum ok
tkmon_0.0.1-1_amd64.changes ok ]
Uploading (scp) to tkpack (192.168.56.102)
[ Uploading job tkmon_0.0.1-1_amd64
tkmon_0.0.1-1.dsc 0.8 kB, ok (0 s, 0.81 kB/s)
tkmon_0.0.1-1.debian.tar.gz 6.1 kB, ok (0 s, 6.07 kB/s)
tkmon_0.0.1.orig.tar.gz 720.0 kB, ok (1 s, 720.00 kB/s)
tkmon_0.0.1-1_all.deb 701.7 kB, ok (1 s, 701.66 kB/s)
tkmon_0.0.1-1_amd64.changes 1.4 kB, ok (0 s, 1.43 kB/s) ]
</pre>

'''On the server''', <code>inoticoming</code> loads the packages with reprepro into the repository:
<pre>
:~/incoming_log$ cat upload.log
Will call action reprepro for: tkmon_0.0.1-1_amd64.changes
Exporting indices...
:~/incoming_log$ reprepro list precise
precise|main|i386: tkmon 0.0.1-1
precise|main|amd64: tkmon 0.0.1-1
precise|main|source: tkmon 0.0.1-1
</pre>

== Troubleshooting ==
The following error occurs when using the upload method <code>scpb</code>, which is actually recommended in the dupload man page:
<pre>
[...]
chmod: cannot access `tkmon_0.0.1-1.dsc': No such file or directory
chmod: cannot access `tkmon_0.0.1-1.debian.tar.gz': No such file or directory
chmod: cannot access `tkmon_0.0.1.orig.tar.gz': No such file or directory
chmod: cannot access `tkmon_0.0.1-1_all.deb': No such file or directory
chmod: cannot access `tkmon_0.0.1-1_amd64.changes': No such file or directory
dupload fatal error: ssh -x -l repository 192.168.56.102 'cd /home/repository/incoming/;chmod 0644 tkmon_0.0.1-1.dsc tkmon_0.0.1-1.debian.tar.gz tkmon_0.0.1.orig.tar.gz tkmon_0.0.1-1_all.deb tkmon_0.0.1-1_amd64.changes ;' failed
at /usr/bin/dupload line 662
</pre>
This error occurs because <code>inoticoming</code> is processing the uploaded packages too quickly. The packages have already been moved to the repository by <code>reprepro</code>, so <code>dupload</code> can no longer perform a <code>chmod</code>.

=== Workaround ===
The right permissions can be set with preupload-hook before the upload. This also allows you to upload using <code>scpb</code>.
<pre>
[...]
$preupload{'file'} = 'chmod 644 %1',
$preupload{'deb'} = 'chmod 644 %1',
$cfg{'tkpack'} = {
fqdn => "192.168.56.102",
method => "scpb",
login => "repository",
[...]
</pre>

== References ==
<references />

{{Gschoenberger}}
{{Aranzinger}}
[[Category:Ubuntu]]
[[de:Eigene Ubuntu-Pakete in reprepro Repository hochladen]]

Linux file systems

2026-06-30T10:37:36Z

Aranzinger: Created page with "There are numerous '''file systems''' for different application purposes. This article includes excerpts highlighting particularly relevant file systems that are also included in the Linux Storage Stack Diagram. Further file systems are mentioned in the documentation of the Linux kernel.<ref>[https://www.kernel.org/doc/html/latest/filesystems/ Filesystems in the Linux kernel] (www.kernel.org)</ref> == File systems for storing data == ==..."

There are numerous '''file systems''' for different application purposes. This article includes excerpts highlighting particularly relevant file systems that are also included in the [[Linux Storage Stack Diagram|Linux Storage Stack Diagram]].
Further file systems are mentioned in the documentation of the Linux kernel.<ref>[https://www.kernel.org/doc/html/latest/filesystems/ Filesystems in the Linux kernel] (www.kernel.org)</ref>

== File systems for storing data ==

=== Block-based file systems ===
The following list displays block-based file systems:
* [https://docs.kernel.org/filesystems/btrfs.html btrfs] - Copy-on-write file system.
* [https://docs.kernel.org/filesystems/ext2.html ext2] - New version of extended file system.
* [https://docs.kernel.org/admin-guide/ext4.html ext4] - An enhanced version of the journal-based ext3 file system with support for large file systems (64-bit).
* [https://www.kernel.org/doc/html/latest/filesystems/f2fs.html f2fs] - A file system that uses NAND flash storage devices and is based on a log-structured file system (LFS).
* [https://docs.kernel.org/filesystems/gfs2.html gfs2] - Cluster file system.
* [https://docs.kernel.org/filesystems/isofs.html iso9660] - Read-only file system for optical data carrier (CD-ROM, DVD-ROM, Blu-ray Disc etc.).
* [https://docs.kernel.org/filesystems/ntfs3.html ntfs3] - A fully functional read/write driver for NTFS up to version 3.1.
* [https://docs.kernel.org/filesystems/ocfs2-online-filecheck.html ocfs2] - (Oracle Cluster File System 2) cluster file system from Oracle.
* [https://docs.kernel.org/filesystems/squashfs.html squashfs] - Comprimized, read-only file system.
* [https://docs.kernel.org/filesystems/vfat.html vfat] - File system for Microsoft operating systems.
* [https://docs.kernel.org/admin-guide/xfs.html xfs] - Journaling file system for Unix-like operating systems developed by Silicon Graphics (SGI)

More details can be found in the article [[Block-based Linux file systems]].

=== Network FS ===
* ceph
* coda
* nfs
* smbfs

=== Stackable FS ===
* [https://docs.kernel.org/filesystems/ecryptfs.html ecryptfs] - (Enterprise Cryptographic Filesystem) POSIX-compliant cryptographic stacked file system.
* [https://docs.kernel.org/filesystems/overlayfs.html overlayfs] - An overlay file system that provides a writable file system on top of another (usually read-only) file system (often used for live CDs).

=== Raw Flash FS ===
* jffs2
* ubifs

== More file systems ==

=== Pseudo FS ===
* futexfs
* pipefs
* [https://docs.kernel.org/filesystems/proc.html proc] - (process filesystem) serves as an interface to internal data structures in the kernel. It can be used to obtain information about the system and to change certain kernel parameters at runtime (sysctl).
* [https://docs.kernel.org/filesystems/sysfs.html sysfs] - RAM-based file system that was originally based on ramfs. It provides the ability to export kernel data structures, their attributes, and the relationships between them to user space.
* usbfs

=== Special Purpose FS ===
* devtmpfs
* ramfs
* tmpfs

== Einzelnachweise ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category: Linux Basics]]
[[de:Linux Dateisysteme]]

FSCK Best Practices

2026-06-30T08:14:53Z

Aranzinger:

File system checks (FSCK) verify the consistency of '''file systems'''. Generally, a check of journaling file systems such as Ext3, [[Ext4]], or [[XFS]] is performed quickly, since the metadata journal ensures consistency. Nevertheless, there may be situations in which a file system becomes corrupted and must be '''fixed'''. A '''regular FSCK''' is '''recommended''' on server systems to prevent file system problems.

== Periodic check on Ubuntu ==
Ubuntu has deactivated the periodical file system check (FSCK) with the release of [[Ubuntu]] 12.04 Precise.<ref name="e2fsprogs">[https://bugs.launchpad.net/ubuntu/+source/e2fsprogs/+bug/1083985 fsck routine checks on boot are disabled] (launchpad.net)</ref>
* Up through Ubuntu 12.04, FSCK was run at regular intervals during system boot. For this, <code>max-mount-counts</code> and <code>interval-between-checks</code> were set on certain values when generating the file system:
<pre>
$ sudo tune2fs -l /dev/sda1 | egrep -i "mount count|Check interval|Last|Next"
Mount count: 2
Maximum mount count: 39
Last checked: Mon Jun 29 20:23:44 2015
Check interval: 15552000 (6 months)
Next check after: Sat Dec 26 19:23:44 2015
</pre>
* Starting on April 12, you will see the following output: a value of -1 for <code>max-mount-counts</code> and a value of 0 for <code>interval-between-checks</code> disable periodic FSCK:
<pre>
$ sudo tune2fs -l /dev/sda1 | egrep -i "mount count|Check interval|Last|Next"
Last mounted on: /
Mount count: 80
Maximum mount count: -1
Last checked: Fri Jul 18 21:27:32 2014
Check interval: 0 (<none>)
</pre>

'''Hint:''' In server environments, it is generally recommended to verify file systems on a regular basis. Further information can be also found in:
* [https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-fsck.html#fsck-best-practices FSCK Best Practices] (redhat.com)
* [https://access.redhat.com/solutions/39682 Is it advisable to disable filesystem checks?] (redhat.com)

== Enable periodic FSCK ==
'''Attention:''' In some cases, it may be advisable to perform an FSCK manually rather than on a scheduled basis on server systems. For larger file systems, an FSCK can take quite a while. If a reboot causes the mount count to reach its limit or if you exceed the interval between checks, an FSCK will be performed during boot, during which the server will be unavailable! When performing the FSCK manually, you determine when it runs.

The use of [[LVM basics|LVM]] also allows to dismiss the FSCK on a snapshot. The downtime of the productive file system can be limited to a minimum with that. See also [[#Filesystem check with LVM Snapshot]].

=== Requirement fstab ===
In fstab, the ''pass'', or ''fs_passno'', field must be set right for the periodic check.<ref>[http://linux.die.net/man/5/fstab fstab man Page]</ref>
The default value for the root filesystem is 1. It is best to set other filesystems to 2:
<pre>
$ sudo vi /etc/fstab
# / was on /dev/sda1 during installation
UUID=410ffeb7-f200-4d44-9517-d1b0926bd574 / ext4 errors=remount-ro 0 1
# /home was on /dev/sda2 during installation
UUID=30995b90-3348-4de3-905b-593f7e2de487 /home ext4 defaults 0 2
</pre>

=== Configure settings ===
To enable periodic FSCK at boot time, adjust the values <code>max-mount-counts</code> and <code>interval-between-checks</code> with tune2fs:
# <code>max-mount-counts</code>: Number of mount-processes on which the file system is verified automatically.
# <code>interval-between-checks</code>: Maximum time elapsed between two checks.
<pre>
$ sudo tune2fs -c 60 /dev/sda1
tune2fs 1.42.9 (4-Feb-2014)
Setting maximal mount count to 60
$ sudo tune2fs -i 30d /dev/sda1
tune2fs 1.42.9 (4-Feb-2014)
Setting interval between checks to 2592000 seconds
</pre>

== Force FSCK when booting ==
'''Hint:''' The settings of the ''pass'', or also ''fs_passno'', field ( see [[#Requirement fstab]]) are ignored during a forced FSCK! All file systems listed in fstab are verified.

Up through Ubuntu version 15.10, it was possible to force an FSCK on the next reboot by creating the file /forcefsck. The next boot would then run an FSCK:
<pre>
$ sudo touch /forcefsck
</pre>

From Ubuntu 16.04, this is possible via the following kernel boot parameter (that can be set in the Grub configuration):<ref>[https://ubuntuforums.org/showthread.php?t=2326230&p=13496775#post13496775 forcefsck not working] (ubuntuforums.org, 30.05.2016)</ref>
fsck.mode=force

=== Auto repair ===
'''Attention:''' The following option triggers an auto-repair when errors occur. Automatic error correction is not always desirable or practical in every situation!
<pre>
$ sudo vi /etc/default/rcS
[...]
# automatically repair filesystems with inconsistencies during boot
FSCKFIX=yes
</pre>

== Standard settings for new file systems ==
The standard settings for new created file systems can be made in the ''mke2fs.conf'' file. The periodical check of file systems is deactivated via default. To activate it, set ''enable_periodic_fsck'' to 1:
<pre>
$ sudo vi /etc/mke2fs.conf
[defaults]
base_features = sparse_super,filetype,resize_inode,dir_index,ext_attr
default_mntopts = acl,user_xattr
enable_periodic_fsck = 1
[...]
</pre>
As a result, the FSCK is set up automatically for new file systems:
<pre>
$ sudo mkfs.ext4 /dev/loop0
[...]
This filesystem will be automatically checked every 23 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
</pre>

== Manual file system check ==
A manual file system check for ext4 can be started with fsck.ext4 from the e2fsprogs package.<ref>[http://packages.ubuntu.com/trusty/e2fsprogs Package e2fsprogs] (packages.ubuntu.com)</ref> The name of the other tools, for example for XFS, can be found in the article [[Linux file systems]].

Ideally, a FSCK is not only started on mounted file systems. The following is located in the manpage:<ref>[http://linux.die.net/man/8/e2fsck e2fsck man Page] (linux.die.net)</ref>
<blockquote>
Note that, in general, it is not safe to run e2fsck on mounted filesystems. The only exception is if the -n option is specified, and -c, -l, or -L options are not specified. However, even if it is safe to do so, the results printed by e2fsck are not valid if the filesystem is mounted.
</blockquote>

If the file system is currently in a ''clean'' state, the FSCK must be started with ''-f'':
<pre>
$ sudo fsck.ext4 /dev/loop0
e2fsck 1.42.9 (4-Feb-2014)
/dev/loop0: clean, 11/7680 files, 2370/30720 blocks
$ sudo fsck.ext4 -f /dev/loop0
e2fsck 1.42.9 (4-Feb-2014)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/loop0: 11/7680 files (9.1% non-contiguous), 2370/30720 blocks
</pre>

=== Not interactive filesystem check ===
The option ''-n'' performs a FSCK in read-only mode and assumes ''No'' as the answer to any question that may arise. The option is therefore suitable for not starting an FSCK interactively, for example regularly and automatized via cron job. Please note that the file system must not be mounted in this case.

== Filesystem check with LVM snapshot ==
Using LVM allows you to perform file system checks using a snapshot. This means the device being checked does not need to be unmounted for the duration of the check. It is sufficient to unmount the file system being checked in order to create the snapshot. Theoretically, an LVM snapshot of a mounted file system would also be possible. However, the snapshot is only clean and truly consistent if the logical volume is not mounted.

This method for a FSCK using an LVM snapshot is also recommended by Theodore Ts'o in Mailing List Posts.<ref name="e2fsprogs" /><ref name="periodicfsck">[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773267 Provide a means to query fsck whether it would run a routine check] (debian.org)</ref>

'''Note:''' The ''lazy'' option can be helpful if users are currently working with the file system. With a lazy unmount, file system resources are released when they are no longer in use by users. You can also use ''lsof'' beforehand to check whether a file system is currently still in use. In the following example, unmounting is not possible because a user is still in the directory:
<pre>
# lsof | grep -i mnt
bash 6963 root cwd DIR 252,0 1024 2 /mnt
lsof 14456 root cwd DIR 252,0 1024 2 /mnt
grep 14457 root cwd DIR 252,0 1024 2 /mnt
lsof 14458 root cwd DIR 252,0 1024 2 /mnt
# umount /mnt
umount: /mnt: device is busy.
(In some cases useful info about processes that use
the device is found by lsof(8) or fuser(1))
</pre>

'''Attention:''' The snapshot must not fill up during the FSCK. Therefore, when creating the snapshot, make sure to choose an appropriate size! In this case, a snapshot size of 20 gigabytes was selected.

The following commands must be used for creating the snapshot and for starting the FSCK:
<pre>
# umount -l /dev/vg00/data
# lvcreate -s -n data_snap -L 20G /dev/vg00/data
# mount /dev/vg00/data /mnt/
# fsck.ext4 -f /dev/vg00/data_snap
# lvremove -f /dev/vg00/data_snap
</pre>
The advantage of LVM is that the file system can be remounted immediately after the snapshot is created.

== References ==
<references />

{{Cmitasch}}
{{Gschoenberger}}
{{Aranzinger}}
[[Category:Linux Basics]]
[[de:FSCK Best Practices]]

VMware Contract ID

2026-06-30T05:37:18Z

Aranzinger: Created page with "For the renewal of an existing or soon-to-expire VMware support & subscription contract, the '''Support Contract ID''' of the product is required. This information can be found in your [https://support.broadcom.com/ Broadcom Support Portal] in '''MyEntitlements.''' <gallery width="1024" height="820" showcarousel="false" slideinfozoneopacity="0.95"> file:Vmware support id 1.png|Select '''My Entitlements''' file:Vmware support id 2.png|Select your '''Site ID''' , then ''..."

For the renewal of an existing or soon-to-expire VMware support & subscription contract, the '''Support Contract ID''' of the product is required.

This information can be found in your [https://support.broadcom.com/ Broadcom Support Portal] in '''MyEntitlements.'''

<gallery width="1024" height="820" showcarousel="false" slideinfozoneopacity="0.95">
file:Vmware support id 1.png|Select '''My Entitlements'''
file:Vmware support id 2.png|Select your '''Site ID''' , then '''Entitlement Details''' and '''Contract Details'''.
file:Vmware support id 3.png|You will find the required '''Contract Number''' in the left column.
</gallery>

{{Npauli}}
{{Aranzinger}}
[[Category:VMware vSphere 8.0]]
[[de:VMware Contract ID]]
[[pl:Przedłużenie wsparcia producenta oraz subskrypcji produktów VMware - VMware Contract ID]]

Upgrade Linux Mint Debian Edition

2026-06-29T11:52:39Z

Aranzinger: Created page with "An installation of '''Linux Mint Debian Edition''' (LMDE) can be updated to a newer version once it is released. In this example, we present the upgrade from LMDE 6 to LMDE 7. == Preparation == To prepare, the updatetool mintupgrade must be installed:<ref>[https://blog.linuxmint.com/?p=4923 How to upgrade to LMDE 7] (blog.linuxmint.com, 14.10.2025)</ref> apt update apt install mintupgrade '''Important note - create backup:''' Before you continue, we recommend t..."

An installation of '''[[Linux]] Mint Debian Edition''' (LMDE) can be updated to a newer version once it is released. In this example, we present the upgrade from LMDE 6 to LMDE 7.

== Preparation ==
To prepare, the updatetool mintupgrade must be installed:<ref>[https://blog.linuxmint.com/?p=4923 How to upgrade to LMDE 7] (blog.linuxmint.com, 14.10.2025)</ref>
apt update
apt install mintupgrade

'''Important note - create backup:''' Before you continue, we recommend to create a recent backup of your data.

== Perform update ==
Next, start the updatetool:
sudo mintupgrade

The following screenshots display the individual steps of the upgrade process:
<gallery>
File:LMDE-7-Upgrade-01.png
File:LMDE-7-Upgrade-02.png
File:LMDE-7-Upgrade-03.png
File:LMDE-7-Upgrade-08.png
File:LMDE-7-Upgrade-09.png
File:LMDE-7-Upgrade-10.png
File:LMDE-7-Upgrade-11.png
File:LMDE-7-Upgrade-12.png
File:LMDE-7-Upgrade-13.png
File:LMDE-7-Upgrade-14.png
</gallery>

== Cancel and restart upgrade ==
After this, remove the updatetool and restart the system:

apt remove mintupgrade
sudo reboot

== References ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category:Linux Mint]]
[[de:Upgrade Linux Mint Debian Edition]]

Installation of N8n

2026-06-19T06:10:54Z

Aranzinger:

'''n8n''' is a performant open-source platform for automatizing workflows. In contrast to cloud services such as Zapier or Make.com, n8n enables self-hostet operation, which allows you to maintain full control over your data, workflows, and costs.

This article describes four different self-contained methods ("paths") to install n8n on a local Linux server. Select the path that fits best to your use case and follow the steps from beginning to end.

== Requirements ==
=== General requirements (for all methods) ===
*'''Server:''' A physical server or a virtual machine.
*'''Resources:''' At least 1 vCPU and 2 GB RAM. 2+ vCPUs and 4+ GB RAM are recommended for productive use.
*'''User rights:''' You will require a user with <code>sudo</code>-rights.
*'''System updates:''' It is recommended to update the system in advance:
<pre>
sudo apt update && sudo apt upgrade -y
</pre>

=== Specific software (depending on the path) ===
*'''For path 1 & 2 (Docker / Docker Compose):''' Install the docker engine and the compose plugin via the '''official docker repositories'''.
<pre>
sudo apt-get remove docker docker-engine docker.io containerd runc && sudo apt-get autoremove -y
# 2. Set up Repository and install docker
sudo apt-get update && sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
# 3. Set permissions (crucial!)
sudo usermod -aG docker $USER
</pre>
'''Important:''' So that docker permissions work, you have to '''log out and log in''' or execute the command <code>newgrp docker</code> in your current shell.

*'''For path 3 (npm):''' Install Node.js (v18+) and the package manager npm.
<pre>
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt-get install -y nodejs
</pre>

*'''For path 4 (Proxmox):''' A functional Proxmox VE installation is required.

== Installation paths ==

=== Path 1: Docker (fast & simple for tests) ===
This method is ideal to test n8n fast and uncomplicated.

'''Step 1: Create data directory''' This steps avoids permission issues in the container.
<pre>
mkdir -p ~/.n8n
sudo chown -R $USER:$USER ~/.n8n
</pre>

'''Step 2: Start container'''
<pre>
docker run -d --rm --name n8n -p 5678:5678 -v ~/.n8n:/home/node/.n8n n8nio/n8n:latest
</pre>
n8n is available on <code>http://<Ihre-Server-IP>:5678</code>. You will see a security warning about "secure cookie".

'''Step 3: Resolve access issue''' You have two possibilities:
*'''A) Fast workaround (unsafe):''' Stop the old container (<code>docker stop n8n</code>) and restart it with additional environment variable.
This is only suitable for localhost testing!
<pre>
docker run -d --rm --name n8n -p 5678:5678 -v ~/.n8n:/home/node/.n8n -e "N8N_SECURE_COOKIE=false" n8nio/n8n:latest
</pre>

*'''B) Secure approach using Reverse Proxy (recommended):''' Set up a reverse proxy to run n8n over HTTPS using a domain.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

---

=== Path 2: Docker Compose (recommended for productive use) ===
This method is a robust method and ideal for long-term use, as it clearly divides the data base and n8n.

'''Step 1: Create project directory and configuration file'''
<pre>
mkdir -p ~/n8n-produktiv
cd ~/n8n-produktiv
nano docker-compose.yml
</pre>

'''Step 2: Add content for <code>docker-compose.yml</code>'''
Replace the placeholders for the passwords.
<pre>
services:
n8n:
image: n8nio/n8n:latest
ports:
- "5678:5678"
restart: always
environment:
- DB_TYPE=postgresdb
- DB_POSTGRESDB_HOST=postgres
- DB_POSTGRESDB_PORT=5432
- DB_POSTGRESDB_DATABASE=n8n
- DB_POSTGRESDB_USER=n8n
- DB_POSTGRESDB_PASSWORD=IHR_N8N_DB_PASSWORT
- GENERIC_TIMEZONE=Europe/Berlin
volumes:
- n8n_data:/home/node/.n8n
depends_on:
- postgres
postgres:
image: postgres:14
restart: always
environment:
- POSTGRES_USER=n8n
- POSTGRES_PASSWORD=IHR_N8N_DB_PASSWORT
- POSTGRES_DB=n8n
volumes:
- postgres_data:/var/lib/postgresql/data
volumes:
n8n_data:
postgres_data:
</pre>

'''Step 3: Start container'''
<pre>
docker compose up -d
</pre>
As the port is only connected to 127.0.0.1, n8n is not directly accessible from outside. This is intentional.

'''Step 4: Enable access'''
You have two possibilities:
*'''A) Fast workaround (unsafe):''' Change the port assignment in the <code>docker-compose.yml</code> to <code>"5678:5678"</code> and add to the <code>environment</code>-block in n8n the line <code>- N8N_SECURE_COOKIE=false</code>. Restart with <code>docker compose up -d</code>.
This is only suitable for LAN-only test without external accessibility!

*'''B) Secure approach using Reverse Proxy (recommended): '''Set up a Reverse Proxy, that forwards the traffic to <code>127.0.0.1:5678</code>.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

---

=== Path 3: npm (for developers) ===
This method installs n8n directly on the host system.

'''Step 1: Install n8n globally'''
The global installation requires administrator rights.
<pre>
sudo npm install -g n8n
</pre>

'''Step 2: Start n8n'''
Execute the command as normal user.
<pre>
n8n
</pre>
n8n is now available on <code>http://<Your<nowiki/>-Server-IP>:5678</code> and displays a safety warning. Terminate the process with <code>Strg+C</code>.

'''Step 3: Resolve access issue'''
You have two possibilities:
*'''A) Fast workaround (unsafe):''' Start n8n with a preceding environment variable.
Please note that this is only suitable for localhost tests!
<pre>
N8N_SECURE_COOKIE=false n8n
</pre>

*'''B) Secure approach with Reverse Proxy (recommended): '''Let n8n run in the background (for example with <code>pm2</code> oder <code>systemd</code>) and set up a Reverse Proxy in front of it.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

---

=== Path 4: Proxmox Helper Scripts (LXC) ===
This method creates a dedicated, lean Linux container for n8n.

Attention: We do not recommend this for productive use!

'''Step 1: Execute installation script'''
Execute this command on the '''Proxmox-Host''' shell and follow the interactive dialogue.
<pre>
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/n8n.sh)"
</pre>

'''Step 2: Test access'''
After the installation, the script outputs the IP address of the container. n8n is available on <code>http://<IP-des-LXC-Containers>:5678</code> and displays the safety warning.

'''Step 3: Resolve access issue'''
You have two possibilities:
*'''A) Fast workaround (unsafe):''' The environment variable must be configured directly in the container.
This is only suitable for LAN-tests without external availability!
<pre>
# 1. Verbinden Sie sich mit der Shell des n8n-Containers
ssh root@<IP-des-LXC-Containers>
# 2. Öffnen Sie die systemd-Service-Datei
nano /etc/systemd/system/n8n.service
# 3. Fügen Sie unter dem Abschnitt [Service] folgende Zeile hinzu:
Environment="N8N_SECURE_COOKIE=false"
# 4. Speichern, schließen und die Dienste neu laden/starten
systemctl daemon-reload && systemctl restart n8n
</pre>

*'''B) Secure approach with Reverse Proxy (recommended):''' Set up a Reverse Proxy on another server or in another container that forwards the traffic to <code>http://<IP-des-LXC-Containers>:5678</code>.
:'''Detailed instructions: [[Installation of Reverse Proxy for n8n with Nginx Proxy Manager]]'''

== Sources ==
* [https://docs.n8n.io/hosting/self-hosted/ n8n Documentation – Self‑Hosted] (en)
* [https://github.com/n8n-io/n8n n8n auf GitHub] (en)
* [https://tteck.github.io/Proxmox/ Proxmox VE Helper-Scripts von tteck] (en)

{{fmueller}}
{{Aranzinger}}
[[Category:Automation]]
[[Category:Artificial Intelligence]]
[[Category:Docker]]
[[Category:VMs/Containers]]
[[de:N8n installieren]]

Creation of Proxmox HA cluster

2026-06-18T10:12:06Z

Aranzinger: Created page with "This article describes the configuration of a '''High Availability Cluster''' or '''HA Cluster''' using three servers with '''Proxmox''' '''VE''' 8.2.2. In this example, Ceph is configured within the cluster as the data storage. ==Requirements for High Availability== Before configuring the HA cluster, it must be verified if all requirements are fulfilled: *3 server systems identical in design * all nodes must be located in the same system * date and time must be sy..."

This article describes the configuration of a '''High Availability Cluster''' or '''HA Cluster''' using three servers with '''Proxmox''' '''VE''' 8.2.2. In this example, [[Ceph]] is configured within the cluster as the data storage.

==Requirements for High Availability==
Before configuring the HA cluster, it must be verified if all requirements are fulfilled:
*3 server systems identical in design
* all nodes must be located in the same system
* date and time must be synchronized (NTP)
* SSH must be released for SSH on port 22

==Installation and configuration==
First, Proxmox must be installed on all 3 nodes. Please make sure that you have entered the correct host name and IP configuration.

=== Network configuration ===
After that, the network configuration of all nodes must be made. The following steps must be executed after the installation has been successful:<gallery>
file:Initiale Netzwerkkonfiguration.png|First, select the host name and click on '''[Network]'''. Next, you will see the initial network configuration, which can be adjusted according to your requirements.
file:Netzwerkkonfiguration PVE.png|After that, the changes are applied by clicking on '''[Apply]'''. This process must be repeated on the remaining nodes.
</gallery>

Now, the network configuration can be verified with a ping test. You can also test the ping with jumbo frames, if configured. The following command would test this with an MTU configured to 9000 bytes:<pre>
ping -M do -s 8972 [IP-Adresse]
</pre>

===Create Proxmox VE cluster===
The following steps must be executed to create the cluster:
<gallery>
file:Create PVE Cluster.png|Go to '''[Datacenter]''' '''[Cluster]''' and click on '''[Create Cluster]'''. Now, a pop-up appears where a '''Clustername''' and the '''Network''' are entered for the PVE-cluster. By clicking on '''[Create]''' , the cluster is created.
file:PVE Cluster Join Information .png|Now you can copy the join information by selecting the '''[Join Information]''' option and clicking '''[Copy Information]'''. This step is required for adding the remaining nodes.
file:PVE Cluster Join.png|To add the remaining nodes to the cluster, connect to their GUI and under '''[Datacenter]''' '''[Cluster]''', click '''[Join Cluster]'''. After that, the join information, the password and the network can be entered. By clicking on '''[Join 'Clustername'],''' the host is added. Repeat this process for the remaining servers.
file:PVE Cluster Final.png|The overview should look similar to this.
</gallery>

'''Hint for a cluster with a lot of nodes:''' For clusters with a large number of nodes (25 or more), enter all nodes in the local hosts file on each cluster node. Otherwise, it may come to high network traffic and stability problems.

===Add Ceph storage===
To create a Ceph storage for storing all data, the following steps must be performed:<gallery>
file:1 Ceph Installation.png|Select a node here and click on '''[Ceph]''' and '''[Install Ceph]''' to start the installation.
file:Ceph Network.png|After the installation has been completed, the '''Ceph-Network''' can be stated. In addition, you can also set the number of '''replicates''' here. Click on '''[Next]''' to complete the configuration. This process is repeated for all nodes.
file:Ceph MON MGR.png|Next, some services must be configured for Ceph. The first are the monitoring and management services. For this, click '''[Ceph],''' then '''[Monitor]''' and then '''[Create]''' in Monitor and Manager. In this example, one service is created per host.
file:Ceph MON MGR done.png|The result should look similar to this image.
file:Disk Wipe GPT.png|The HDDs/SSDs/NVMes must be prepared for the creation of the OSDs. To do this, delete them under '''[Disks]''' '''[Wipe Disk]''' and initialize them with GPT '''[Initialize Disk with GPT]'''. Repeat this with all data carriers.
file:Ceph OSD.png|Now, you can create the OSDs under '''[Ceph]''' '''[OSD]''' by clicking on '''[Create: OSD].''' Select the disk and a device class and confirm it by clicking on '''[Create]'''. This must be repeated for all data carriers.
file:MDS Erstellung.png|After creating the OSD, a Meta Data server can be created under '''[CephFS].''' These are required for CephFS. For this, click on '''[Create].''' In this example, a MDS host is created per host'''.'''
file:CephFS.png|You can now create CephFS by clicking '''[Create CephFS]'''. You can use the default values here.
file:Ceph Pool erstellen.png|Finally, a pool must be created to store all data from the VMs/CTs. For this, switch to '''[Pools]''' and click '''[Create]'''. Next, you must assign a pool name; you can also set a '''target ratio''' of '''0.9'''.
file:Ceph Health Status.png|Finally, you can check the Ceph dashboard, and everything should be showing as Healthy.
</gallery>

===Configuration High Availability ===
Now you can create the required virtual machines and containers on the cluster. To take advantage of the cluster's high availability, it is essential that the configured VMs/CTs are added to the HA. To set this up, follow the steps below:
<gallery>
file:Add VM to HA.png|Go to '''[Datacenter]''' and click on '''[HA]'''. You can now add the VM to HA by clicking '''[Add]'''. To do so, enter the VM ID and a request state, then confirm by clicking '''[Add]'''.
</gallery>

After all steps have been executed, the cluster is functional and your virtual instance is highly available.

{{Npauli}}
{{Tlindinger}}
{{Aranzinger}}
[[Category:Proxmox Administration]]
[[de:Proxmox HA Cluster erstellen]]

LVM basic configuration

2026-06-18T07:09:52Z

Aranzinger:

In the following article, the '''basic configuration''' of LVs is explained. The used system is a '''Ubuntu Server 10.4''' with the 2.6.32-24 kernel and the LVM-version 2.02.54(1) (2009-10-26). In the following, it is explained how to create '''partitions''' of '''''Physical Volumes''''' (PVs), a '''''Volume Group''''' (VG) and the '''''Logical Volumes''''' (LVs) built on top of them.

==Creating partitions==
First, the partitions for the PVs are created. The following points must be taken into account:

*[[Partition Alignment]]
**Switch display to sectors (Switch "-u")
**switch off DOS-compatible mode (Switch "-c")
*for later LVM management
**switch system ID of partition to "8e" (Switch "-t" bei fdisk)
After the changes, the partition table looks as follows:
<pre>
root@ubuntu:/home/tktest# fdisk -lu

Disk /dev/sda: 5368 MB, 5368709120 bytes
255 heads, 63 sectors/track, 652 cylinders, total 10485760 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00051afd

Device Boot Start End Blocks Id System
/dev/sda1 * 2048 9920511 4959232 83 Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2 9922558 10483711 280577 5 Extended
Partition 2 does not end on cylinder boundary.
/dev/sda5 9922560 10483711 280576 82 Linux swap / Solaris

Disk /dev/sdb: 2147 MB, 2147483648 bytes
22 heads, 16 sectors/track, 11915 cylinders, total 4194304 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x1673663d

Device Boot Start End Blocks Id System
/dev/sdb1 2048 4194303 2096128 8e Linux LVM

Disk /dev/sdc: 2147 MB, 2147483648 bytes
22 heads, 16 sectors/track, 11915 cylinders, total 4194304 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xbd277faf

Device Boot Start End Blocks Id System
/dev/sdc1 2048 4194303 2096128 8e Linux LVM
</pre>
==Preparation of PVs==
PVs also include meta data for the administration of volumes (see also [[LVM basics]]). 255 sectors (á 512 byte) are created for the meta data by default. Among other things, a meta data area that is too small can result in, for example, the inability to create snapshots anymore: [[Fix LVM VG vgname metadata too large for circular buffer]]. Therefore, it will make sense to configure a larger meta data area. If you want to enlargen your meta data area, the parameter "--metadatasize" must be added to the command "pvcreate" and then select the desired size at:
<pre>
--metadatasize size
</pre>
After that, the partitions are initialized as PV.

<pre>
root@ubuntu:~# pvcreate /dev/sdb1
Physical volume "/dev/sdb1" successfully created
root@ubuntu:~# pvcreate /dev/sdc1
Physical volume "/dev/sdc1" successfully created
</pre>
The commands "pvs" and "pvdisplay" offer a variety of possibilities to display the current status of the PVs.
<pre>
root@ubuntu:~# pvs
PV VG Fmt Attr PSize PFree
/dev/sdb1 lvm2 -- 2.00g 2.00g
/dev/sdc1 lvm2 -- 2.00g 2.00g
</pre>

==Creating a VG==
The PVs, that have been created before, are now summarized to a VG.
<pre>
root@ubuntu:~# vgcreate vg00 /dev/sdb1 /dev/sdc1
Volume group "vg00" successfully created
</pre>
The "pvdisplay" now shows that a VG was created with the PVs:
<pre>
root@ubuntu:~# pvdisplay
--- Physical volume ---
PV Name /dev/sdb1
VG Name vg00
PV Size 2.00 GiB / not usable 3.00 MiB
Allocatable yes
PE Size 4.00 MiB
Total PE 511
Free PE 511
Allocated PE 0
PV UUID fl9ipM-bhhQ-V46G-2iH3-R3yZ-9DsN-JbRmY9

--- Physical volume ---
PV Name /dev/sdc1
VG Name vg00
PV Size 2.00 GiB / not usable 3.00 MiB
Allocatable yes
PE Size 4.00 MiB
Total PE 511
Free PE 511
Allocated PE 0
PV UUID d1iY5L-ac3F-W5Sz-zyaE-uaT3-f66r-I3831o
</pre>
vgdisplay also shows information on VG:
<pre>
root@ubuntu:~# vgdisplay
--- Volume group ---
VG Name vg00
System ID
Format lvm2
Metadata Areas 2
Metadata Sequence No 1
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 0
Open LV 0
Max PV 0
Cur PV 2
Act PV 2
VG Size 3.99 GiB
PE Size 4.00 MiB
Total PE 1022
Alloc PE / Size 0 / 0
Free PE / Size 1022 / 3.99 GiB
VG UUID YTEj9f-9LCT-EOP5-JBEA-YHSz-c0R1-TMzVmy
</pre>
What stands out here is, that the PE size is 4.00 MiB. Since the lvm2-format, the number of PEs is not limited anymore. According to the Man page of vgcreate, a high number of PEs can slow down the tools. However, the number of pEs does not have influence on the I/O-performance of the Logical Volumes. If you want to change the PE-size, add the parameter to "vgcreate"
<pre>
-s, --physicalextentsize PhysicalExtentSize
</pre>
==Creating LVs==

There are different possibilities to specify the size of the LV to be created. However, all LVs require the parameter "-l" or "-L".
*size specification in, for example, Gigabyte:
<pre>
lvcreate -n data -L1G vg00
</pre>
*Percentage of available storage in the VG:
<pre>
lvcreate -n data -l100%VG vg00
</pre>
*Percentage of free storage in the VG:
<pre>
lvcreate -n data -l100%FREE vg00
</pre>
The example in progress is continued by dividing the VG into two equally sized LVs:
<pre>
root@ubuntu:~# lvcreate -n data -l50%VG vg00
Logical volume "data" created
root@ubuntu:~# lvcreate -n data1 -l100%FREE vg00
Logical volume "data1" created
</pre>
Now, the status of the Logical Volume can be taken into consideration:
<pre>
root@ubuntu:~# lvdisplay
--- Logical volume ---
LV Name /dev/vg00/data
VG Name vg00
LV UUID S1btrq-zQZQ-h9oU-2VE6-UNoT-hkqB-Fpv7pG
LV Write Access read/write
LV Status available
# open 0
LV Size 2.00 GiB
Current LE 511
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 252:0

--- Logical volume ---
LV Name /dev/vg00/data1
VG Name vg00
LV UUID Syaml9-d1Ax-RYTs-tSZy-vEyq-yzqW-VoOddZ
LV Write Access read/write
LV Status available
# open 0
LV Size 2.00 GiB
Current LE 511
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 252:1
</pre>
==Creating file system==
Now, the LVs can be formatted with a file system and mounted afterwards:
<pre>
mkfs.ext4 /dev/vg00/data
mkdir data
mount /dev/vg00/data data
</pre>
==Removing LV==
If a LV should be removed, it can be removed via lvremove command:
<pre>
root@ubuntu:~# lvremove /dev/vg00/data_snap
Do you really want to remove active logical volume data_snap? [y/n]: y
Logical volume "data_snap" successfully removed
</pre>
The LV data_snap does no longer appear as an LV. However, the underlying partition is still listed as a PV:
<pre>
--- Physical volume ---
PV Name /dev/sde1
VG Name vg00
PV Size 2.00 GiB / not usable 3.00 MiB
Allocatable yes
PE Size 4.00 MiB
Total PE 511
Free PE 511
Allocated PE 0
PV UUID lKEW15-1YHu-dikC-S0Pm-72UJ-UMPg-fgiW0Y
</pre>
If the partition should be released completely, the PV must be removed from the VG first:
<pre>
root@ubuntu:~# vgreduce vg00 /dev/sde1
Removed "/dev/sde1" from volume group "vg00"
root@ubuntu:~# pvdisplay
"/dev/sde1" is a new physical volume of "2.00 GiB"
--- NEW Physical volume ---
PV Name /dev/sde1
VG Name
PV Size 2.00 GiB
Allocatable NO
PE Size 0
Total PE 0
Free PE 0
Allocated PE 0
PV UUID lKEW15-1YHu-dikC-S0Pm-72UJ-UMPg-fgiW0Y
</pre>
Now, the PV can be also deleted completely to reformat, for example, the hard drive:
<pre>
root@ubuntu:~# pvremove /dev/sde1
Labels on physical volume "/dev/sde1" successfully wiped
</pre>

{{Gschoenberger}}
{{Aranzinger}}
[[Category:LVM]]
[[de:LVM Grundkonfiguration]]

Linux performance analysis in 60 seconds

2026-06-17T13:17:30Z

Aranzinger:

When a critical '''performance issue''' arises on a [[Linux]] server, there is often little time to analyze the problem in detail. Brendan Gregg, computer performance analyst and kernel engineer, describes in a blog posting and in a video, '''which Linux commands he uses for the performance analysis in the first 60 seconds'''.

== Commands for performance analysis ==
The following commands are recommended by Brendan Gregg:<ref>[http://techblog.netflix.com/2015/11/linux-performance-analysis-in-60s.html Linux Performance Analysis in 60,000 Milliseconds] (techblog.netflix.com, 30.11.2015)</ref>
<pre>
uptime
dmesg | tail
vmstat 1
mpstat -P ALL 1
pidstat 1
iostat -xz 1
free -m
sar -n DEV 1
sar -n TCP,ETCP 1
top
</pre>

More information on these commands can be found in the following articles:
* vmstat: [[Linux Performance Measurements using vmstat]]
* mpstat: [[Linux CPU performance measurements with mpstat]]
* iostat: [[Linux I/O Performance measurements with iostat]]
* free: [[Linux Page Cache Basics]]
* sar: [[Collect and report Linux System Activity Information with sar]]
* top: [[Linux-tool top]]

== Video ==
In this video, Brendan Gregg shows how to execute these commands in 60 seconds:<ref>[http://www.brendangregg.com/blog/2015-12-03/linux-perf-60s-video.html Linux Performance Analysis in 60s (video)] (www.brendangregg.com/blog, 03.12.2015)</ref>

{{#widget:YouTube|id=ZdVpKx6Wmc8}}

== References ==
<references />

{{Wfischer}}
{{Aranzinger}}
[[Category:Linux Performance]]
[[de:Linux Performance Analyse in 60 Sekunden]]

Docker basics - the most important terms

2026-06-17T12:17:57Z

Aranzinger: Created page with "This article provides an introduction in Docker and shows useful terms, which can be useful when using Docker and Docker containers: <pre> # Start container docker container run <IMAGENAME> starts a container based on an image (Example: checkmk/check-mk-raw:2.2.0-latest) # List containers (active) docker ps displays a list of all containers that are currently active # List containers (all) docker ps -all displays all containers on the system including those that ha..."

This article provides an introduction in Docker and shows useful terms, which can be useful when using Docker and Docker containers:

<pre>
# Start container
docker container run <IMAGENAME> starts a container based on an image (Example: checkmk/check-mk-raw:2.2.0-latest)

# List containers (active)
docker ps displays a list of all containers that are currently active

# List containers (all)
docker ps -all displays all containers on the system including those that have been stopped.

# Stop container
docker stop <CONTAINER-NAME> stops a container

# Reboot container
docker restart <CONTAINER-NAME> restarts a Docker container

# Delete container
docker remove <CONTAINER-NAME> deletes a container

# Display container volume
docker volume ls displays all created container volumes

# Delete container volume
docker volume rm <VOLUME-NAME> - deletes a named volume

# Execute container shell command in container
docker exec <CONTAINER-NAME> <COMMAND> executes the command and displays the output on its own terminal (locally)

# Open the interactive full shell in the container (interactive terminal)
docker exec -it <CONTAINER-NAME> bash

# Display container logs:
docker container logs <CONTAINER-NAME>
</pre>

{{jsterr}}
{{Aranzinger}}
[[Category:Docker]]
[[de:Docker Grundlagen - die wichtigsten Befehle]]

Measuring TCP and UDP Network Performance with iperf

2026-06-17T08:44:44Z

Aranzinger:

'''iperf''', the open-source tool, allows to measure the maximum TCP and UDP network bandwidth. It is an alternative for netperf<ref>[http://www.netperf.org/ Netperf] (www.netperf.org)</ref>.

== Installation ==
Iperf is already included in the Debian and Ubuntu repository, which means that an installation is easy possible via <code>apt-get install iperf</code>.

For RHEL and CentOS, the package is available in the EPEL<ref>[http://dl.fedoraproject.org/pub/epel/6/x86_64/repoview/iperf.html IPerf Paket aus EPEL Repository] (download.fedora.redhat.com)</ref> repository.

Alternatively, the source code can be downloaded from the IPerf website <ref>[http://sourceforge.net/projects/iperf/files/ IPerf] (sourceforge.net)</ref>.

== Use ==
Iperf works according to the client-sever model, which means that the iperf daemon must be started first on a server and then connects to the iperf client. Client and server are included in the same binary. When entering the IP address for the client, be sure to select the one associated with the network interface you want to test.

=== Measure TCP performance ===
In this case, the TCP performance of a 1 GBit network card is measured.

Server1:
<pre>
[root@server1 ~]# iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
[ 4] local 192.168.255.1 port 5001 connected with 192.168.255.2 port 39838
[ ID] Interval Transfer Bandwidth
[ 4] 0.0-10.0 sec 1.10 GBytes 941 Mbits/sec
</pre>

Server2:
<pre>
[root@server2 ~]# iperf -c 192.168.255.1
------------------------------------------------------------
Client connecting to 192.168.255.1, TCP port 5001
TCP window size: 16.0 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.255.2 port 39838 connected with 192.168.255.1 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 1.10 GBytes 944 Mbits/sec
</pre>

=== Measure UDP performance ===
The UDP performance is measured on the same system. In this case, the used bandwidth (-b) must be stated. The default here is only 1 MBit per second.

Server1:
<pre>
[root@server1 ~]# iperf -s -u
------------------------------------------------------------
Server listening on UDP port 5001
Receiving 1470 byte datagrams
UDP buffer size: 126 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.255.1 port 5001 connected with 192.168.255.2 port 40612
[ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams
[ 3] 0.0-10.0 sec 889 MBytes 746 Mbits/sec 0.065 ms 621/634707 (0.098%)
[ 3] 0.0-10.0 sec 1 datagrams received out-of-order
</pre>

Server2:
<pre>
[root@server2 ~]# iperf -c 192.168.255.1 -u -b 1000M
------------------------------------------------------------
Client connecting to 192.168.255.1, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 126 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.255.2 port 40612 connected with 192.168.255.1 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 890 MBytes 746 Mbits/sec
[ 3] Sent 634708 datagrams
[ 3] Server Report:
[ 3] 0.0-10.0 sec 889 MBytes 746 Mbits/sec 0.065 ms 621/634707 (0.098%)
[ 3] 0.0-10.0 sec 1 datagrams received out-of-order
</pre>

== Hints for 10G/40G tests ==
When testing 40 Gbit/s connections, it is possible that an individual CPU-core can become a bottleneck. In this case, it is recommended that several parallel tests are operated on different ports.

More information on this topic can be found, for example, on the following pages:
* [https://fasterdata.es.net/host-tuning/linux/100g-tuning/ 40G/100G Tuning] (fasterdata.es.net)
* [https://fasterdata.es.net/performance-testing/network-troubleshooting-tools/iperf/multi-stream-iperf3/ iperf3 at 40Gbps and above] (fasterdata.es.net)
* [https://calomel.org/network_performance.html Network Tuning and Performance: a simple guide to enhancing network speeds] (calomel.org)

== References ==
<references/>

{{Cmitasch}}
{{Aranzinger}}
[[Category:Linux Networking]]
[[Category:Linux Performance]]
[[de:TCP und UDP Netzwerk Performance mit iperf messen]]

Permanently Change the Root Data Directory in Docker

2026-06-17T05:40:20Z

Aranzinger: Created page with "This article explains how to permanently switch the default root data directory <code>/var/lib/docker/</code> to a different directory. == Background information == The <code>/var/lib/docker</code> directory stores all images, volumes from Docker and can grow significantly depending on how many containers are used. The directory is structured as follows:<pre> root@js-checkmk-02:/var/lib/docker# ls buildkit containers engine-id image network overlay2 plugins runt..."

This article explains how to permanently switch the default root data directory <code>/var/lib/docker/</code> to a different directory.

== Background information ==
The <code>/var/lib/docker</code> directory stores all images, volumes from Docker and can grow significantly depending on how many containers are used. The directory is structured as follows:<pre>
root@js-checkmk-02:/var/lib/docker# ls
buildkit containers engine-id image network overlay2 plugins runtimes swarm tmp volumes</pre> You can see that it is used if you, for example, verify the status with df -h:

<pre>root@js-checkmk-02:/var/lib/docker# df -h
Filesystem Size Used Avail Use% Mounted on
udev 3.9G 0 3.9G 0% /dev
tmpfs 794M 684K 794M 1% /run
/dev/sda1 47G 3.8G 41G 9% /
tmpfs 3.9G 0 3.9G 0% /dev/shm
tmpfs 5.0M 0 5.0M 0% /run/lock
/dev/sda15 124M 12M 113M 10% /boot/efi
tmpfs 794M 0 794M 0% /run/user/0
tmpfs 794M 0 794M 0% /run/user/1000
overlay 47G 3.8G 41G 9% /var/lib/docker/overlay2/a6a4203cef42815c7187f584436e5eb9dff385e3ca9c92d597a38806b9dc255d/merged
</pre>

== Configuration ==
First, <code>docker</code> must be stopped, which has immediately influence on all active containers. In addition, we install the tool <code>rsync</code>.<pre>
root@js-checkmk-02:/# systemctl stop docker && apt install rsync
</pre>After this, it must be communicated to Docker where to find the new data root:

<pre># Create directory if it has not been created yet
root@js-checkmk-02:/# mkdir -p /root/docker/root

# Daemon-Datei anlegen in /etc/docker
root@js-checkmk-02:/# nano /etc/docker/daemon.json

# Please add the following into the file, then adjust your path and store it. In this example, we change it to /root/docker/root

{
"data-root": "/root/docker/root"

}
</pre>Next, the whole content of the old docker-root-directory is copied into the new data-root-directory and then the old <code>/var/lib/docker</code> directory is renamed to <code>/var/lib/docker.old</code>.

<pre>rsync -aP /var/lib/docker/ "/root/docker/root"
cp -rp /var/lib/docker/* "/root/docker/root"
mv /var/lib/docker /var/lib/docker.old
</pre>
After that, Docker can be restarted and it should be verified if all containers still function:<pre>
systemctl start docker
</pre>If everything functions, the old data-root-directory can be deleted:<pre>
rm -rf /var/lib/docker.old</pre>

{{jsterr}}
{{Aranzinger}}
[[Category:Docker]]
[[de:Root Data Directory in Docker dauerhaft ändern]]

Checkmk RAW Edition - Docker Container Installation

2026-06-16T11:51:57Z

Aranzinger: Created page with "These instructions show how to install and start the free RAW-edition on a Debian server. == Installation == The installation of Docker on a server is a requirement (see Docker installation on Debian 12). == Container (custom parameter) == Please note: We will provide the default password shortly so that you can log in right away. Otherwise, you may have trouble logging in. Please note that you have to change the following parameters: * <code>-p 8006:5000</cod..."

These instructions show how to install and start the free RAW-edition on a [[Debian]] server.

== Installation ==
The installation of Docker on a server is a requirement (see [[Docker installation on Debian 12]]).

== Container (custom parameter) ==
Please note: We will provide the default password shortly so that you can log in right away. Otherwise, you may have trouble logging in. Please note that you have to change the following parameters:

* <code>-p 8006:5000</code> (This is the port for accessing the Web-UI, default is usually 8080:5000)
* <code>-p 8007:8000</code> (This is the port for the agent communication, default is usually 8000:8000)
* <code>-e CMK_PASSWORD='relation'</code> (The password for the Web-UI user cmkadmin is set here)
* <code>-e MAIL_RELAY_HOST='mail.thomas-krenn.com'</code> (Please state your mail server if it can be used as relay host)
<pre>

root@js-checkmk-02:/home/tk# docker container run -dit -p 8006:5000 -p 8007:8000 --tmpfs /opt/omd/sites/cmk/tmp:uid=1000,gid=1000 -v monitoring:/omd/sites --name monitoring -v /etc/localtime:/etc/localtime:ro -e CMK_PASSWORD='relation' -e MAIL_RELAY_HOST='mail.thomas-krenn.com' --restart always checkmk/check-mk-raw:2.2.0-latest

Unable to find image 'checkmk/check-mk-raw:2.2.0-latest' locally
2.2.0-latest: Pulling from checkmk/check-mk-raw
125a6e411906: Pull complete
1a8b24f9c661: Pull complete
e005a80d7504: Pull complete
727db143e9a5: Pull complete
1c9d1984857d: Pull complete
6261e32c9473: Pull complete
Digest: sha256:c75927b694b02fbd748c48f1aa9469964f3c003757ebbd01c17e21daaeb08b20
Status: Downloaded newer image for checkmk/check-mk-raw:2.2.0-latest
23a12948f6b3d3a8bb0ed1808a9e4aef6f4183509c14b34de8b84175e7a12a00

</pre>

It is searched for the container image online, which will be downloaded. After that, the container will start immediately. You can verify with <code>docker ps</code> if everything has functioned:

<pre>
root@js-checkmk-01:~# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
756a5156e143 checkmk/check-mk-raw:2.2.0-latest "/docker-entrypoint.…" 29 seconds ago Up 28 seconds (health: starting) 6557/tcp, 0.0.0.0:8000->8000/tcp, :::8000->8000/tcp, 0.0.0.0:8080->5000/tcp, :::8080->5000/tcp monitoring
</pre>

== Webinterface ==
You can test the Web-UI with <code>http://IP-DES-DOCKER-SERVERS:8006</code>. Here, we used custom port 8006.

== Login data ==
You can log in using the following data in the login screen. Please note that the password is the one you set when you first started the container!

* User: cmkadmin
* Password: relation

{{jsterr}}
{{Aranzinger}}
[[Category:Docker]]
[[Category:Monitoring]]
[[de:Checkmk RAW Edition - Docker Container Installation]]

Proxmox Backup Server No Subscription Update Repository

2026-06-16T09:08:21Z

Smueller:

The [[Proxmox Backup Server]] provides different package repositories for installing updates. For production systems, Thomas-Krenn.AG recommends using a [[Proxmox Backup Server Support Subscriptions|Proxmox Backup Server Subscription]].

A valid subscription provides access to the extensively tested Enterprise Repository. Depending on the selected subscription level, technical support from Proxmox is also included. Purchasing a subscription also supports the continuous development of Proxmox Backup Server.

For test and development environments, the publicly available No-Subscription Repository can be used instead. It contains newer packages that have not yet undergone the same extensive testing and validation process as the packages in the Enterprise Repository. Therefore, the No-Subscription Repository is not recommended for production systems.

== Error message without a valid subscription ==

After a default installation, the Enterprise Repository is enabled. If no valid subscription is configured, updating the package lists may result in an error similar to the following:

<pre>
apt update
</pre>

<pre>
Err: https://enterprise.proxmox.com/debian/pbs trixie InRelease
401 Unauthorized
E: Failed to fetch https://enterprise.proxmox.com/debian/pbs/dists/trixie/InRelease
E: The repository 'https://enterprise.proxmox.com/debian/pbs trixie InRelease' is not signed.
</pre>

In this case, the Enterprise Repository must be disabled and the No-Subscription Repository must be configured.

The following configuration applies to Proxmox Backup Server 4.x based on Debian 13 “Trixie”.

== Disable the Enterprise Repository ==

By default, the Enterprise Repository is configured in the following file:

<pre>
/etc/apt/sources.list.d/pbs-enterprise.sources
</pre>

The file can be opened using an editor such as <code>nano</code>:

<pre>
nano /etc/apt/sources.list.d/pbs-enterprise.sources
</pre>

The default repository configuration looks similar to the following:

<pre>
Types: deb
URIs: https://enterprise.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
</pre>

To disable the Enterprise Repository, add the following line:

<pre>
Enabled: false
</pre>

The complete file should then look as follows:

<pre>
Types: deb
URIs: https://enterprise.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
Enabled: false
</pre>

Alternatively, the repository file can be removed:

<pre>
rm /etc/apt/sources.list.d/pbs-enterprise.sources
</pre>

Disabling the repository configuration is generally preferable, as it can easily be enabled again later.

== Configure the No-Subscription Repository ==

Create or edit the following file:

<pre>
nano /etc/apt/sources.list.d/proxmox.sources
</pre>

Add the following content:

<pre>
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
</pre>

Alternatively, the file can be created directly from the command line:

<pre>
cat > /etc/apt/sources.list.d/proxmox.sources << 'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF
</pre>

== Verify the repository configuration ==

Update the package lists:

<pre>
apt update
</pre>

The configured package repositories can be checked using the following command:

<pre>
apt policy
</pre>

The output should include the No-Subscription Repository for Debian 13 “Trixie”. The Enterprise Repository should no longer be queried.

The system can then be updated:

<pre>
apt update
apt full-upgrade
</pre>

After kernel updates or other system-level updates, the Proxmox Backup Server should be restarted:

<pre>
reboot
</pre>

== Check for outdated repository files ==

After upgrading from Proxmox Backup Server 3 to Proxmox Backup Server 4, repository entries for Debian 12 “Bookworm” may still be present.

All configured repository files can be checked using the following command:

<pre>
grep -R --line-number --extended-regexp \
'bookworm|trixie|enterprise\.proxmox|download\.proxmox' \
/etc/apt/sources.list \
/etc/apt/sources.list.d/ 2>/dev/null
</pre>

Outdated entries containing <code>bookworm</code> must be removed or disabled. Repository entries for different Debian releases must not be mixed.

{{Smueller}}
[[Category:Proxmox Backupserver]]
[[de:Proxmox Backup Server No Subscription Update Repository]]

Secure SSH login with 2 factor authentication

2026-06-11T10:08:07Z

Aranzinger: /* Configuration */

A SSH shell belongs to the essential management tools on Linux based servers. This shell is already well covered by using certificate based login methods only and by deactivating root logins.
Furthermore, an additional registration step can be added, for example a one-time password, with a second factor. This further enhances security, as a successful login now relies on something you have (the certificate) and something you know (the one-time password). This article shows how to secure '''the SSH login with Google Authenticator as second factor''' on an '''Ubuntu Server 18.04 LTS'''.

== Preparatory measures ==
First, configure certificate-based authentication on your Ubuntu Server 18.04 LTS system using a [[OpenSSH Public Key Authentifizierung unter Ubuntu|OpenSSH Public Key]].

== libpam-google-authenticator ==
The following paragraph provides an insight into the Google Authenticator PAM-module and shows the installation and configuration.

=== Integration ===
The two-factor authentication is connected as PAM module ((Pluggable Authentication Module) to the operating system.

=== Installation ===
The installation of the PAM module from Google Authenticator can be made on Debian and Ubuntu via apt. It is contained in the official package sources.

<code>$ sudo apt install libpam-google-authenticator</code>

=== Compatibility ===
The authentication via PAM module is compatible with a variety of system services. A lot of steps can therefore be further secured using Google Authenticator. The list command applied to the /etc/pam.d/ directory returns the services and tools currently supported in a base installation of Ubuntu 18.04 LTS Server.

<pre>
$ ls -m /etc/pam.d/
atd, chfn, chpasswd, chsh, common-account, common-auth, common-password,
common-session, common-session-noninteractive, cron, login, newusers, other,
passwd, polkit-1, runuser, runuser-l, sshd, su, sudo, systemd-user, vmtoolsd
</pre>

=== Configuration ===
After the PAM module has been installed, it can be presented, initialized and configured as follows:

# Execute Google Authenticator on the console:
#: $ google-authenticator
# Do you want authentication tokens to be time-based (y/n)
#: y, this is used to generate TOTP tokens (time-based one-time password)
#: n, this generates HOTP tokens (counter-based one-time passwords)
#: In this case, the TOTP method is used
# Now, a QR-code is displayed on the SSH-console
#: Scan this code with a compatible app on your smartphone
#: Copy and store the keys listed below safely.
#: With the ''emergency scratch codes,'' the login can be performed without OTP
# Update the ''.google_authenticator'' file with this information.
#: For this, type ''y''.
# Confirm all other questions with ''y'' or with ''n'' if you want to use different settings.

== Integration into SSH-login ==
The Google Authenticator PAM module is fully configured. Now, these services, such as the SSH daemon, can be adjusted to enable a two-factor authentication through it.

'''Important hint:''' If the following configuration is made via SSH session, be sure to keep the current session open and test it in parallel with a second session. If the SSH daemon is misconfigured, you will no longer be able to log in.

=== Adjustments in /etc/pam.d/sshd ===
Open the /etc/pam.d/sshd file with an editor. Comment out the line ''@include common-''auth and add the line for Google Authenticator below it. Store and close the file afterwards.

<pre>
[...]
# Standard Un*x authentication.
#@include common-auth
[...]
# Google Authenticator
auth required pam_google_authenticator.so
</pre>

=== Adjust sshd_config ===
In the configuration file ''/etc/ssh/sshd_config'', you can now set '''ChallengeResponseAuthentication''' to ''yes''.
<pre>
[...]
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication yes
[...]
</pre>

Also, check that UsePAM is set to yes and add the following line below it: '''AuthenticationMethods'''. In this example, an authentication is accepted via public key and one-time password.<ref>[http://manpages.ubuntu.com/manpages/bionic/man5/sshd_config.5.html sshd_config — OpenSSH SSH daemon configuration file] (manpages.ubuntu.com)</ref>

<pre>
[...]
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive
[...]
</pre>

=== Restart SSH daemon ===
Now, you can restart the SSH daemon to activate the configuration.

<pre>$ sudo systemctl restart sshd.service</pre>

=== Login process ===
The following screenshots show the login process of an SSH shell with activated two-factor authentication by Google Authenticator.
<gallery>
File:Ubuntu-Bionic-SSH-Login-01.png|Start the SSH session. You will now be asked for the time-based one-time password. Open your app and enter the six-digit numeric code.
File:Ubuntu-Bionic-SSH-Login-02.png|After entering TOTP, the login is made on the Ubuntu server 18.04 LTS system.
</gallery>

== References ==
<references />

{{Tniedermeier}}
{{Aranzinger}}
[[Category:SSH]]
[[de:SSH-Login mit 2-Faktor-Authentifizierung absichern]]

Restrict executable SSH-commands via authorized keys

2026-06-11T07:56:38Z

Aranzinger: Created page with " The '''OpenSSH''' secure shell server allows a secure and encrypted remote access on Linux and Unix systems. On the server side, the '''authorized_keys''' file in the ''.ssh'' folder is primarily used for configuring a SSH public key authentication under Ubuntu. Normally, a user is granted '''full access''' on the system, on which the authentication was set up. In some cases, such as automatized backup processes, it is useful that the access is restricted to just a..."

The '''OpenSSH''' secure shell server allows a secure and encrypted remote access on Linux and Unix systems. On the server side, the '''authorized_keys''' file in the ''.ssh'' folder is primarily used for configuring a [[SSH public key authentication under Ubuntu]]. Normally, a user is granted '''full access''' on the system, on which the authentication was set up. In some cases, such as automatized backup processes, it is useful that the access is restricted to just a few, or even just a single '''command'''. The successful configuration steps are explained in this article.

== Purpose ==
The restriction of executable commands via SSH is mainly used for automatized backups. The dedicated backup users mostly have a private key without key phrase to execute automated backups. On the backup destination server, the public key of the user is added to the ''authorized_keys'' file so that this user can connect without entering a password.

Strictly speaking, from this point on, the user would actually have full access to the backup server, even though, for example, the "rsync" command is always used.

A command restriction for the user avoids that if the private key is compromised, the backup server is automatically compromised as well. As the user is restricted to a command in the ''authorized_keys'' file, it is not allowed to execute another command or to establish a terminal session via SSH.

== Restrict to a single command in authorized_keys ==
The '''/~/.ssh/authorized_keys''' file contains the public key of the user that is allowed to connect. (see also [[SSH public key authentication under Ubuntu]]):
<source lang="bash">
:~$ cat .ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCj98R[...]
</source>
To restrict the user to a single command, the parameter '''command=''' is entered before the key. After that, whenever an attempt is made to establish an SSH connection, only this command will be executed, even if, for example, a different command was provided.<ref name="sshdef">[http://oreilly.com/catalog/sshtdg/chapter/ch08.html Per-Account Server Configuration] (oreilly.com)</ref> In the following example, the user ''dailybackup'' is restricted to the ''date'' command for demonstration purposes.
For this, the ''command=date'' parameter is defined on the SSH-server:
<source lang="bash">
:~$ cat .ssh/authorized_keys
command="date" ssh-rsa AAAA[...]
</source>
From the client computer that connects to the server via SSH, the only command the user can then execute is ''date'':
<source lang="bash">
:~$ ssh dailybackup@192.168.56.105
Wed Apr 30 14:46:53 CEST 2014
Connection to 192.168.56.105 closed.
:~$ ssh dailybackup@192.168.56.105 "tail /etc/passwd"
Wed Apr 30 14:47:02 CEST 2014
</source>

== Analyse executed command on SSH-server ==
The analysis, which command must be entered in ''authorized_keys'', is made easier by the environment variable ''$SSH_ORIGINAL_COMMAND'':
<source lang="bash">
command="/bin/echo You invoked: $SSH_ORIGINAL_COMMAND" ssh-rsa AAAAB[..]
</source>
When a command is issued from the client, the command executed on the server is then displayed for analysis purposes:
<source lang="bash">
:~$ ssh dailybackup@192.168.56.105 tail /etc/passwd
You invoked: tail /etc/passwd
</source>

Some commands, for example ''rsync'', lead to an error message when used with the above ''command''. By taking a roundabout route using a script on the SSH server, the command, that was executed, can be also accessed: <ref name="sshdef" />
<source lang="bash">
:~$ vi logssh.sh
#!/bin/sh
if [ -n "$SSH_ORIGINAL_COMMAND" ]
then
echo "`/bin/date`: $SSH_ORIGINAL_COMMAND" >> $HOME/ssh-command-log
exec $SSH_ORIGINAL_COMMAND
fi
:~$ vi .ssh/authorized_keys
command="/home/dailybackup/logssh.sh" ssh-rsa AAAAB3N[...]
</source>
The client then calls up rsync:
<source lang="bash">
:~/tmp$ rsync -avz test.txt dailybackup@192.168.56.105:/home/dailybackup
sending incremental file list
[...]
</source>
The command executed via SSH appears in the log file on the SSH server. This command can be used again via ''command='' for restrictions:
<source lang="bash">
:~$ cat ssh-command-log
Wed Apr 30 15:10:54 CEST 2014: rsync --server -vlogDtprze.iLsf . /home/dailybackup
</source>

'''Hint:''' For problems with output redirection, <code>exec</code> can be used instead of <code>eval</code>

== Restrict multiple commands in authorized_keys ==
In general, it is possible via additional scripts to allow multiple commands for a key pair.

However, for maximum security, it is easier to generate a private key pair for every desired command and to safe the corresponding command.

== References ==
<references />

{{Gschoenberger}}
{{Aranzinger}}
[[Category:SSH]]
[[de:Ausführbare SSH-Kommandos per authorized keys einschränken]]

OpenSSH public key authentication fails

2026-06-11T06:25:36Z

Aranzinger: Created page with "This article describes how to resolve issues with SSH authentication using public key authentication. In the article SSH key login, it is explained how to set up public key authentication in general. == Server-side problems == In most cases, the reason why public key authentication is not working can be found in the file and directory permissions. The home directory on the server as well as the sub-directory .ssh is not allowed to have writing right..."

This article describes how to resolve issues with SSH authentication using public key authentication. In the article [[SSH Key Login|SSH key login]], it is explained how to set up public key authentication in general.

== Server-side problems ==
In most cases, the reason why public key authentication is not working can be found in the file and directory permissions. The home directory on the server as well as the sub-directory .ssh is not allowed to have writing rights for group and other. Furthermore, the file <code>authorized_keys</code> must be accessible only to the owner.

To set the rights correctly, log in to the server with the user for whom the SSH authentication should function.
<pre>
chmod go-w $HOME $HOME/.ssh
chmod 600 $HOME/.ssh/authorized_keys
chown `whoami` $HOME/.ssh/authorized_keys
</pre>

If this is not possible, you can alternatively deactivate the right verification of the server. The following option must be entered in the <code>/etc/ssh/sshd_config</code> file:
StrictModes no

Another error source can be the wrong settings in <code>/etc/ssh/sshd_config</code>. Here is an extract of options that can influence the public key authentication:
* AuthorizedKeysFile
* PreferredAuthentications
* PubkeyAuthentication

More settings can be found in the '''man sshd_config''' manpage.

== Client-sided problems ==
Alternatively, there may still be issues on the client side, that is, on the computer from which the SSH connection is initiated.

If the file rights are set open for the private key, the following error message is displayed by the SSH client:
<pre>
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for 'xyz' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: xyz
Permission denied (publickey,gssapi-with-mic).
</pre>

In this case, the private key is ignored. Set the rights correctly using the following command:
chmod 600 $HOME/.ssh/<Keyname>

Another possible error source could be a wrong setting in <code>.ssh/config</code> or <code>/etc/ssh/ssh_config</code>. An excerpt of possible options that may affect public key authentication, can be found here:
* PreferredAuthentications
* PubkeyAuthentication

All settings can be found in the '''man ssh_config''' manpage.

== Sources: ==
* http://www.openssh.org/faq.html#3.14

{{Cmitasch}}
{{Aranzinger}}
[[Category:SSH]]
[[de:OpenSSH Public Key Authentication schlägt fehl]]

AMD Security Vulnerabilities - June 2026

2026-06-10T12:16:49Z

Aranzinger: Created page with "On '''June 9th, 2026''', AMD published the security bulletins '''AMD-SB-3039'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3039.html ASP non-Coherent Memory Access – June 2026] (www.amd.com/en/resources/product-security)</ref> and '''AMD-SB-9025'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9025.html AMD uProf Vulnerabilities – June 2026] (www.amd.com/en/resources/product-security)</ref> for security vulnerabili..."

On '''June 9th, 2026''', AMD published the security bulletins '''AMD-SB-3039'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3039.html ASP non-Coherent Memory Access – June 2026] (www.amd.com/en/resources/product-security)</ref> and '''AMD-SB-9025'''<ref>[https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9025.html AMD uProf Vulnerabilities – June 2026] (www.amd.com/en/resources/product-security)</ref> for security vulnerabilities.

== Information ==
'''AMD-SB-3039''': This is a malicious hypervisor that can undermine the integrity protection mechanisms of AMD Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP), by forcing AMD Security Processor (ASP) to work with the system storage without cache coherence. According to the publication, system settings controlled by the hypervisor enable the reconfiguration of the interaction between the storage requirements of the ASP and the CPU-cache. By disabling coherence, the ASP can read stale data from the DRAM when copying pages and updating the associated metadata, causing the guest to lose the most recent updates in the CPU cache. This could potentially undermine the integrity warranties of the SEV-SNP for guests and could cause data corruption.

'''AMD-SB-9025''': The vulnerability could allow a local attacker with user privileges to write to memory assigned by the kernel. AMD confirms that the issue occurs because from the driver creating a shared-section object with a NULL security descriptor and exposing kernel pointers in shared memory, which could allow an attacker to write to kernel-allocated memory and potentially cause a system crash or a denial-of-service condition.

== Affected systems ==

Here is a table listing the affected processors.

===== AMD EPYC™ Processors =====
{| class="wikitable"
|Product
|Mitigation
|-
|AMD EPYC™ 8004 Series Processors
|GenoaPI
1.0.0.H
|-
|AMD EPYC™ 9004 Series Processors
|GenoaPI
1.0.0.H
|-
|AMD EPYC™ 9005 Series Processors
|TurinPI

1.0.0.8
|-
|AMD EPYC™ Embedded 8004 Series Processors
|EmbGenoaPI-SP5

1.0.0.D
|-
|AMD EPYC™ Embedded 9004 Series Processors

(formerly codenamed "Genoa")
|EmbGenoaPI-SP5

1.0.0.D
|-
|AMD EPYC™ Embedded 9004 Series Processors

(formerly codenamed "Bergamo")
|EmbGenoaPI-SP5

1.0.0.D
|-
|AMD EPYC™ Embedded 9005 Series Processors
|EmbeddedTurinPI_SP5

1004
|}

{| class="wikitable"
| align="center" |CVE
| align="center" |CVSS Score
|-
| align="center" |[https://www.cve.org/CVERecord?id=CVE-2026-54509 CVE-2025-54509]
| align="center" |4.0 (Medium)
|-
| align="center" |[https://www.cve.org/CVERecord?id=CVE-2026-0466 CVE-2026-0466]
| align="center" |6.8 (Medium)
|-
| align="center" |[https://www.cve.org/CVERecord?id=CVE-2026-28237 CVE-2026-28237]
| align="center" |6.8 (Medium)
|}

In the following, there is an extract of this table in which all Supermicro mainboards are included that are offered by Thomas-Krenn:<ref>[https://www.supermicro.com/en/support/security_AMD-SB-3027 AMD Security Bulletin AMD-SB-3027, January 2027] (www.supermicro.com)</ref>

{| class="wikitable"
|+
!AMD motherboard
! align="center" |'''BIOS version'''
|-
| align="center" |H13SSW
| align="center" |3.8
|-
| align="center" |H13SSL-N/NT
| align="center" |3.8
|}

=== Updates for Thomas-Krenn products ===
Updates on the corresponding system can be found in the <tklink type="sitex" id="440">download area of Thomas-Krenn</tklink>.
The updates in the download area have been tested by us to guarantee the stability and compatibility of our systems.

If you require the latest version for your system and it is not yet available in our download area, you can get it at
[https://www.asus.com/de/support/download-center/ Asus], [https://www.supermicro.com/en/support/resources/downloadcenter/swdownload Supermicro] or [https://www.gigabyte.com/de/Support/Consumer/Download Gigabyte]

== References ==
<references/>

== More information ==
* [https://www.supermicro.com/en/support/security_AMD-SB-3027 AMD Security Bulletin AMD-SB-3039] (supermicro.com, Juni 2026)

{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category:AMD Safety Information]]
[[de:AMD Sicherheitslücken - Juni 2026]]

Slow SSH login due to DNS timeout

2026-06-10T08:52:47Z

Aranzinger: Created page with "This article describes solutions for when an '''SSH login is slow'''. ==Problem== It takes approximately 10 seconds when you log in to a Linux system via SSH until the password prompt appears. After this, the SSH session functions completely normal. ==Background== The SSH server tries to make a reverse DNS lookup for the IP from which the SSH connection is established. If there is no functioning configured DNS (for example a wrong registered IP for the DNS server in /..."

This article describes solutions for when an '''SSH login is slow'''.

==Problem==
It takes approximately 10 seconds when you log in to a Linux system via SSH until the password prompt appears. After this, the SSH session functions completely normal.

==Background==
The SSH server tries to make a reverse DNS lookup for the IP from which the SSH connection is established. If there is no functioning configured DNS (for example a wrong registered IP for the DNS server in /etc/resolv.conf), it takes 10 seconds until the timeout is reached for the reverse DNS lookup. Then, the password prompt appears.

In the following, information on the use of <code>ssh -v</code> (verbose mode) is listed:
<pre>
[admin@tpw admin]$ ssh -v root@192.168.1.154
OpenSSH_5.1p1, OpenSSL 0.9.8g 19 Oct 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.1.154 [192.168.1.154] port 22.
debug1: Connection established.
debug1: identity file /home/admin/.ssh/identity type -1
debug1: identity file /home/admin/.ssh/id_rsa type -1
debug1: identity file /home/admin/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-5
debug1: match: OpenSSH_5.1p1 Debian-5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.1.154' is known and matches the RSA host key.
debug1: Found key in /home/admin/.ssh/known_hosts:153
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
</pre>
Now, it takes ten minutes until it continues:
<pre>
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/admin/.ssh/identity
debug1: Trying private key: /home/admin/.ssh/id_rsa
debug1: Trying private key: /home/admin/.ssh/id_dsa
debug1: Next authentication method: password
root@192.168.1.154's password:
</pre>
After entering the password, it continues:
<pre>
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.utf8
Linux debian5 2.6.9-023stab048.6-smp #1 SMP Mon Nov 17 18:41:14 MSK 2008 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Jun 17 13:20:19 2009 from 192.168.1.52
debian5:~#
</pre>

==Solution==
On the target system, either add the IP address of the computer from which the connection is being established to /etc/hosts, or make sure that the DNS configuration on the target system is working properly.

===Enter IP in /etc/hosts===
The IP can be, for example, entered in /etc/hosts as follows:
<pre>
root@debian5:/# echo "192.168.1.52 laptop" >> /etc/hosts
root@debian5:/# cat /etc/hosts
127.0.0.1 debian5 localhost localhost.localdomain

::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
192.168.1.52 laptop
root@debian5:/#
</pre>

===Verify DNS configuration===
In the example, an incorrect DNS server was configured on the Debian 5 target system. The configuration was corected as follows:
<pre>
root@debian5:/# cat /etc/resolv.conf
nameserver 10.10.18.1
root@debian5:/# echo "nameserver 192.168.1.254" > /etc/resolv.conf
root@debian5:/# cat /etc/resolv.conf
nameserver 192.168.1.254
root@debian5:/#
</pre>

==More information==
* [http://www.macosxhints.com/article.php?story=20050329185832952 macosxhints.com: A possible fix for slow SSH connections ]

{{Wfischer}}
{{Aranzinger}}
[[Category:SSH]]
[[pl:Logowanie przez ssh powolne przez DNS Timeout]]
[[de:SSH Login langsam durch DNS Timeout]]

OpenSSH configuration

2026-06-10T06:30:22Z

Aranzinger: Created page with "The following configuration describes advanced OpenSSH configurations that can be expaned as needed. If you have more interesting contents, kindly send us a message. An overview of all server-side SSH configuration options can be found in the manpage of sshd_config. man sshd_config === Conditional configuration with "Match" === "Match", the configuration option, allows a global configuration (for example in <code>/etc/ssh/sshd_config</code>) to ove..."

The following configuration describes advanced OpenSSH configurations that can be expaned as needed. If you have more interesting contents, kindly send us a [[Special:contact|message]].

An overview of all server-side SSH configuration options can be found in the manpage of sshd_config.
man sshd_config

=== Conditional configuration with "Match" ===
"Match", the configuration option, allows a global configuration (for example in <code>/etc/ssh/sshd_config</code>) to overwrite one that is conditional. The following conditions are possible:
* User
* Group
* Host
* Address[

Here is an example for a configuration in /etc/ssh/sshd_config:
<pre>
PasswordAuthentication no
...

Match User admin
PasswordAuthentication yes
</pre>

In this case, the password authentication is deactivated globally. However, it was subsequently enabled for the "admin" user using a MATCH statement.

In general, "Match" is only for one option allowed:

AllowAgentForwarding, AllowTcpForwarding, Banner, ChrootDirectory, ForceCommand, GatewayPorts, GSSAPIAuthentication, HostbasedAuthentication, KbdInteractiveAuthentication, KerberosAuthentication, MaxAuthTries, MaxSessions, PasswordAuthentication, PermitEmptyPasswords, PermitOpen, PermitRootLogin, PubkeyAuthentication, RhostsRSAAuthentication, RSAAuthentication, X11DisplayOffset, X11Forwarding und X11UseLocalHost

=== VPN with OpenSSH ===
OpenSSH offers from version 4.3 the opportunity to set up a VPN tunnel. This creates a tun device on both the local and remote sides. As soon as it has been configured, the VPN can be used.

The "uml-utilities" package must be installed in advance on Ubuntu/Debian. This comes with the '''tunctl''' binary.

The SSH sever configuration '''sshd_config''' must be expanded by the following options:
PermitRootLogin yes
PermitTunnel yes

A tunnel can be set up with the option '''"-w"''':
ssh -w 0:0 1.2.3.4

After this, a "tun0" interface should be visible on both sides. An IP address must then be assigned to it.

You may need to enable IP forwarding.
echo 1 > /proc/sys/net/ipv4/ip_forward

For long-term VPN use, we recommend the use of [[OpenVPN with Pre-shared Key|OpenVPN]], which is much easier to configure and automate.

More information can be found here: https://help.ubuntu.com/community/SSH_VPN

{{Cmitasch}}
{{Aranzinger}}
[[Category:SSH]]
[[de:OpenSSH Konfiguration]]

Samba-server basics

2026-06-09T11:35:50Z

Aranzinger: Created page with "A '''Samba-Server''' helps with the integration of '''Windows- and Unix/Linux computers'''.<ref>[http://www.oreilly.de/german/freebooks/samba2ger/ch01.html#936841 Samba, 2. Auflage] www.oreilly.de</ref> '''Files''' can be, for example, exchanged or '''printers''' can be shared. The name Samba comes from the SMB protocol ('''''Server Message Block'''''), which is used for network-based data exchange on Windows. These days, people are increasingly referring to the "'''''Co..."

A '''Samba-Server''' helps with the integration of '''Windows- and Unix/Linux computers'''.<ref>[http://www.oreilly.de/german/freebooks/samba2ger/ch01.html#936841 Samba, 2. Auflage] www.oreilly.de</ref> '''Files''' can be, for example, exchanged or '''printers''' can be shared. The name Samba comes from the SMB protocol ('''''Server Message Block'''''), which is used for network-based data exchange on Windows. These days, people are increasingly referring to the "'''''Common Internet File System'''''" (CIFS) instead of SMB. CIFS is a further development of SMB and was developed by Microsoft.<ref>[http://msdn.microsoft.com/en-us/library/aa365233%28v=vs.85%29.aspx SMB and CIFS overview] (msdn.microsoft.com)</ref>

A free online book by O'Reilly provides detailed information about Samba/CIFS in German. It is available at [http://www.oreilly.de/german/freebooks/samba2ger/ Oreilly Samba 2nd edition]. Furthermore, the Samba community provides a detailed documentation about Samba: [https://help.ubuntu.com/community/Samba Samba Community]. This article presents the basics of working with a Samba server that is set up on '''Ubuntu 10.04 LTS'''.

__TOC__
== Server ==
=== Installation ===
The Samba package <ref>[http://packages.ubuntu.com/lucid/samba Samba Package] (packages.ubuntu.com)</ref> is installed on the server so that a file and print server can be set up.
<source lang="bash">
apt-get install samba
</source>

=== Configuration ===
The central configuration file is located at
<source lang="bash">
sudo vi /etc/samba/smb.conf
</source>
The corresponding man page provides a range of information on how to configure the Samba server using this file:
<source lang="bash">
man smb.conf
</source>
The file is divided into several parts. The global section ([global]) includes basic settings that may be followed by other sections on the release of resources.

As the first step in the configuration, comment out the following line in the "Authentication" section:
<source lang="bash">
# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
security = user
</source>
Due to these security measures, an existing user account on the server is required to access the Samba shares.<ref>[https://help.ubuntu.com/10.04/serverguide/C/samba-fileprint-security.html Samba Security] (help.ubuntu.com)</ref>

==== Network interfaces ====
If your server possesses multiple network interfaces, it may be that the smb-server is connected to the wrong interface. To do this, the line
<source lang="bash">
interfaces = 192.168.1.1/24
</source>
can be added to the "[global]" area of smb.conf. In this example, the SMB server listens on the address range in the 192.168.1.1/24 network.<ref>http://tldp.org/HOWTO/SMB-HOWTO-6.html</ref>

==== Add smb password ====
The following command creates a smb-password for the existing user "smbuser". It is important that this step is performed for an existing user, as every smb-user needs a valid account on the server. The password you set can be used later to access the SMB share:
<source lang="bash">
sudo smbpasswd -a smbuser
</source>
As the smb-password does not have to comply with the password of the actual account, it can definitely time-consuming to administrate different passwords. On Ubuntu, the "libpam-smbpass" package exists, which can be used to keep Linux and smb passwords synchronized.

So that the changes are effective, the server must reload the configuration:
<source lang="bash">
sudo service smbd reload
</source>
Zuvor können die modifizierten Einstellungen auch auf ihre Korrektheit geprüft werden:
<source lang="bash">
testparm /etc/samba/smb.conf
</source>

=== Add a resource ===
In the following configuration example, the home directories of the smb-users are released. In the first step, a new resource is added to the "smb.conf" file:
<source lang="bash">
sudo vi /etc/samba/smb.conf
</source>
The following paragraph is commented out:
<source lang="bash">
# Un-comment the following (and tweak the other settings below to suit)
# to enable the default home directory shares. This will share each
# user's home directory as \\server\username
[homes]
comment = Home Directories
browseable = yes
</source>
Now, the home-directories are available for all users, which means that the users can access each other´s directories (provided, of course, that an SMB password has been set and the user therefore has access to the SMB server). The parameter "browseable" allows Windows users to browse the Samba share using Windows Explorer.
To be more restrictive with home directories, the following line can be commented out:
<source lang="bash">
# By default, \\server\username shares can be connected to by anyone
# with access to the samba server. Un-comment the following parameter
# to make sure that only "username" can connect to \\server\username
# This might need tweaking when using external authentication schemes
valid users = %S
</source>
Then, for example, the user "tktest" will no longer be able to access the home directory of "smbuser" (from clients perspective):
<source lang="bash">
sudo mount -t smbfs //192.168.56.101/smbuser /media/ -o username=tktest
Password:
mount error(13): Permission denied
</source>
Further security measures are presented, for example, on [https://help.ubuntu.com/10.04/serverguide/C/samba-fileprint-security.html Samba Security] (help.ubuntu.com) or [http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-samba.html Securing samba] (samba.org).

== Client ==
=== Installation ===
The following package is required for the access on the smb-server on the client:
<source lang="bash">
sudo apt-get install smbfs smbclient
</source>
With the smbclient, an initial connection test can be started:
<source lang="bash">
smbclient -U smbuser -L 192.168.56.101
</source>

=== Mounting of smb share ===
With the mount command, the smb directory can be integrated locally:
<source lang="bash">
sudo mount -t cifs //192.168.56.101/smbuser /media/ -o username=smbuser
</source>
After this command, the smb-directory will be accessible at "/media/

== References ==
<references />

{{Aranzinger}}
[[Category:Ubuntu]]
[[de:Samba-Server Grundlagen]]

Supermicro BMC Security Advisories June 2026

2026-06-09T05:30:51Z

Aranzinger: Created page with "In '''June 2026''', Supermicro published security advisories for the BMC-firmware of its mainboards. This security vulnerability requires a '''firmware update'''. In this article, you will find information on this security advisory and where to find updates on Thomas-Krenn products. == Security advisories == {| class="wikitable" |- style="background-color: #EFEFEF; font-weight: bold;" ! align="center" |CVE ! align="center" |Risk potential: ! align="center" |Title |-..."

In '''June 2026''', Supermicro published security advisories for the BMC-firmware of its mainboards. This security vulnerability requires a '''firmware update'''.

In this article, you will find information on this security advisory and where to find updates on Thomas-Krenn products.

== Security advisories ==
{| class="wikitable"
|- style="background-color: #EFEFEF; font-weight: bold;"
! align="center" |CVE
! align="center" |Risk potential:
! align="center" |Title
|-
|align="center" | [https://www.cve.org/CVERecord?id=CVE-2026-3820 CVE-2026-3820]
| align="center" | 7.2 (high)
| align="center" | '''Command-Injection''' (The security vulnerability allows an attacker to get administrator rights and to manipulate the SMTP service configuration. This could cause the system to execute unintended commands when calling processes)
|-
|}

== Updates for Thomas-Krenn products ==
Updates on the corresponding system can be found in the <tklink type="sitex" id="440">download area of Thomas-Krenn</tklink>.
The updates in the download are have been tested by us to guarantee the stability and compatibility of our systems.

If you require the latest version for your system and it is not yet available in our download area, you will find it at [https://www.asus.com/de/support/download-center/ Asus] or [https://www.supermicro.com/en/support/resources/downloadcenter/swdownload Supermicro].

== More information ==
* [https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026 Vulnerabilities in Supermicro BMC firmware, June 2026]
{{Thomas-Krenn.AG}}
{{Aranzinger}}
[[Category: Server Hardware]]
[[de:Supermicro BMC Sicherheitshinweise Juni 2026]]