All Activity

fixed for you

re-reading this, I noticed how much I typed NAS instead of UPS. OH the shame...

The Eaton 3P Ellipse is what I ended up with, so far it's working well. I still need to detach some of the TrueNAS config I'd set up before in order to enable monitoring in HexOS, but I at least got it detecting

Actually, I run OpenWRT in a VM on my HexOS and I pass the WiFi card into it as a backup AP. But if you just want internet on your HexOS you could have that be the router that connects to your WiFi as any device normally would. The only thing outside of HexOS or OpenWRT would be creating a bridge device on TrueNAS.

Your server would only have Internet/network connection as long as your PC is running. The moment you shutdown your PC the server loses connection.

yikes, I haven't heard of this brand before but thats definitely a bit red flag. just curious which eaton psu did you go with? my Eaton Tripp Lite OMNIVS1500LCD works just likes to provide wonky data because the nut drivers for it aren't great.

Technically it is possible, but configuring it could potentially be quite involved. Your sharing PC meets to act as a router. I think Windows had a slightly less involved way but I remember it being hit or miss, but that was like 10+ years ago now.

TLDR: DON'T INSTALL THE SOFTWARE ON YOUR NAS, IT'S A SECURITY NIGHTMARE, DON'T INSTALL ANY SOFTWARE PROVIDED BY YOUR UPS UNLESS YOU REALLY, REALLY TRUST IT I bought a Powercool Smart UPS earlier this year, it arrived with linux software and installation scripts, but I had concerns about just running this on my NAS so elected to try and manually configure it via TrueNAS (I couldn't get it working properly so abandoned that and bought a new Eaton UPS which just works). I've just gone back to look at the Powercool UPS with the intention of getting it set up for my gaming PC and thought I'd check the software out. First thing I did was look at how it was installed, which is as root, no sandboxing, no user for the software (so it's never getting installed) Then I asked copilot to audit it (an actual good use for AI): The summary (full report attached as markdown) is: neokylin/ ├── install.sh 🟡 MEDIUM #4 — deletes/relies on predictable /tmp socket & lockfile paths ├── SECURITY-REVIEW.md (audit report — added by this review) ├── upsSmartView.desktop ─ (launches per-user GUI that talks to root daemon; context for #2) ├── upsSmartView.service 🟠 HIGH #2 — runs upsSmartServer as root, no User=/sandboxing, Restart=always └── upsSmartView/ ├── upsSmartServer 🟠 HIGH #2 — root daemon, system()-executed external program via unauthenticated /tmp socket │ 🟡 MEDIUM #4 — predictable /tmp lockfile (symlink attack) │ 🟡 MEDIUM #6 — writes cleartext SMTP/shutdown passwords to config │ ⚪ LOW #7 — insecure RUNPATH (relative `lib`, /home/zang/… dev path) ├── upsSmartServer.sh 🟠 HIGH #3 — forces LD_LIBRARY_PATH to EOL bundled libs ├── upsSmartView 🔴 CRITICAL #1 — hardcoded FTP update credentials; plaintext-FTP updater, MD5-only integrity │ 🟡 MEDIUM #5 — default password `123456`, weak credential storage in SQLite ├── upsSmartView.sh 🟠 HIGH #3 — forces LD_LIBRARY_PATH to EOL bundled libs ├── copylib.sh ─ ├── cp.sh ─ ├── istartTest ─ ├── snmpTest ─ ├── snmpv3_boot_counter ─ (encoded engine ID only; not a secret) ├── libpng12.so.0 🟠 HIGH #3 — libpng 1.2.54, EOL branch with known CVEs ├── upsevent_ch.wav ─ ├── upsevent_en.wav ─ ├── config/ │ └── IDBK/ │ └── upsSmartView.conf 🟡 MEDIUM #6 — cleartext credentials at rest, world-readable (0644) ├── dep/ (95 bundled libraries) 🟠 HIGH #3 — EOL/vulnerable vendored stack, e.g.: │ ├── libssl.so.1.0.0 🟠 HIGH #3 — OpenSSL 1.0.2v-dev (EOL Dec 2019) │ ├── libcrypto.so.1.0.0 🟠 HIGH #3 — OpenSSL 1.0.2v-dev (EOL Dec 2019) │ ├── libQt5*.so.5 🟠 HIGH #3 — Qt 5.9.8 (EOL) │ ├── libicu*.so.56 🟠 HIGH #3 — ICU 56 (ancient) │ └── … 🟠 HIGH #3 — old libc, libexpat, libgcrypt, libfreetype, etc. ├── lib/ │ ├── libupdateManage.a 🔴 CRITICAL #1 — contains the hardcoded FTP credentials / FTP updater code │ ├── libsnmpClient.so ─ (SNMP attack surface for #3's vulnerable parsers) │ ├── libSnmpManage.a ─ (SNMP attack surface) │ ├── lib<model>*.so ─ (UPS device protocol drivers) │ ├── cJSON/ ─ (leftover vendor build artifacts — CMakeFiles, .o files) │ └── libmodbus/ ─ (leftover vendor build artifacts) ├── platforms/ │ └── libqxcb.so 🟠 HIGH #3 — part of the EOL Qt 5.9.8 runtime └── sqldrivers/ └── libqsqlite.so 🟠 HIGH #3 — part of the EOL Qt 5.9.8 runtime (also where #5's weak-password SQLite DB is accessed) This is would appear to be an intentional developer backdoor/maintenance pipeline left in production code pulling anything from a remote chinese IP and running it on your computer. It would be trivial to push some code to your NAS that not only can execute anything including stealing your data, but also wipe the entire thing (or just wipe any trace of them having been there) SECURITY-REVIEW.md

Is there a way to bridge the internet connection to a HexOS server from another computer that has internet? My situation does not allow me to have access to wired internet. I have the ability to connect my 2 computers together with an ethernet cable but cannot find information on how to bridge between the 2. Any insight would be appreciated.

All good, thank you for getting back to me

Had a reply from the App auther he is investigating

unfortunately i do not

Hey Mobius, do you have an idea as to when this functionality will be introduced? Thank you!

at this time you are able to set that up if you modify your ups settings in truenas

I love the new UPS monitoring feature and that I can set the server to shut down if the battery gets low. However I would prefer if I could set it to shut down in specific circumstances. For example, 5 minutes after switching to battery power.

A teeny tiny request of no big importance, but being able to change the app icons for apps installed through Truenas, so you don't have to see the boring generic Truenas icon, would be great. But changing icons in general for any apps would be nice too 🙂

Hey sorry for the delay in approving your post. We've been a little slammed lately as we are preparing for the 1.1 release in November.

Hey, Buddy Backup is always peer2peer, so each server is backing up to each server directly, you cannot pass through another server or get the data from another server. If possible, I highly recommend to do the initial backup from B to C locally and only then move C to it's final location.

So here is my situation. I have 2 NAS-es, 1 In my home (NAS A), 1 in my parents home (NAS B). NAS A is on a gigabit fiber conenction. NAS B is on a 80/80 mbit up/down connection. A and B perform buddy backups to eachother. I'm adding a larger storage server C to also hold backups for both. C is also behind a gigabit connection. Does the initial, 8+TB backup of B to C also have to go through the slow 80/80 connection? Or can it use the existing backup on A which is behind a gigabit connection, so it does to not take 14+ days to synchronise the initial backup? And broader, once setup, does B have to do a slow upload of the differential backups to both A and C every time, or does it only have to do an upload to one of them, so they can then internally replicate?

that's an interesting situation let me check into that for you

Hey, you can at any point remove a license from a HexOS server (which means HexOS will stop working, but not the server itself) and you can then reuse this license on another server. I'm just not sure if you need to reinstall HexOS to be able to claim it on another account or not.

I currently have two licenses that I am not using at the moment that I plan to in the future. I have a friend that I am considering helping set up a two server hex OS setup for ( Local and remote backup) If I use my licenses for a proof of concept for him will I be able to reclaimed those licenses and use them myself later in solution for myself in these two situations? 1. he chooses to go with this solution and purchases his own licenses (any issues adding a license from another account?) 2. He chooses to go with something else and we decommission the test servers

Thanks for the screenshots. I checked your server without changing anything. The drive shown is part of your storage pool, and its saved Thorough test passed with an age warning. A Thorough test checks the drive without erasing it. A Full test writes across the entire drive and erases its contents, so HexOS blocks it on drives that are already part of a pool. The confusing part is on our side: the report recommends a Full test even though this drive cannot safely run one, then shows an unhelpful error. I have recorded that for correction. This is separate from TrueNAS removing its SMART scheduling interface. Drive testing is still available in HexOS. You do not need to remove any drives, change your pool, or repeat the passed test to clear this message. We have made a fix to ensure that the thorough test is only available on drives not attached to a drive pool, since it deletes them as it tests.

Any drive that I am trying to run a 'full test' on does not run and just an error pops up. Is this related to the removal of SMART tests from TrueNAS? Or just a feature that isn't quite ready yet?

there is a short back up restore process to follow HexOS deck > Settings > TrueNAS In the truenas ui of original ssd. systems tab on left side of screen advanced settings from the systems menu click on manage configuration download configuration What to do with new ssd install hexos during the claiming process when asked if hexos should configure your storage drives, use the skip button in the truenas ui go back to manage configuration in advanced settings upload the config file from system 1 go to storage tab in truenas ui select import pool and follow the prompts.