Learn FreeNAS

Brian Adeloye of Tenable Network Security has found a vulnerability  in all versions of FreeNAS before  0.7.2.5543. With this vulnerability root acccess can be gained via the web GUI without authentication.

There are two solutions:

1) Upgrade to the latest stable version of FreeNAS – 0.7.2.5543:  https://sourceforge.net/projects/freenas/files/stable/0.7.2/

2) Restrict web GUI access to trusted IP addresses only.

For most people using FreeNAS in their homes behind a firewall this shouldn’t be an issue, but it is worth upgrading anyway just to be 100% sure.

A maintenance update for FreeNAS 0.7.2 has been released by the FreeNAS development team. This new version includes Samba 3.5.5 and experimental iSCSI boot/install.

It is also worth noting that the system requirements have changed. The minimum space to install is now 128MB with 384MB of RAM for embedded and 400MB 256MB of RAM for a full install.

Full release notes:
http://sourceforge.net/projects/freenas/files/stable/0.7.2/NOTES%200.7.2.txt/view

Download:
http://sourceforge.net/projects/freenas/files/

Related links:
FreeNAS 0.7.2.5462 Sabanda Released!

Warner Losh from iXsystems has kindly send me a disk image of the first FreeNAS 0.8 developer build. The guys at iXsystems have done a great job so far and the core of FreeNAS has been successfully ported to FreeBSD 8.1.

A basic web GUI is up and running and things are starting to take shape. I am working with Warner to try and get some screen shots for you.

If the current rate of progress continues there should be a more general preview build available in the next couple of weeks with the ability to configure the network, disks, filesystems, NFS and SAMBA from the web GUI.

Warner is hoping to do weekly snapshots and I will try and blog about the updates as then come.

iXsystems has uploaded a snapshot of their new FreeBSD 8.1-based FreeNAS.

This snapshot is for developers only. It is not functionally complete yet, and there are likely many rough edges.

If you are interested in playing with it you will need to download the code and build it yourself. You can find the code in SVN and here is the accompanying README.

The new FreeNAS is based on nanoBSD and builds for 32 and  64 bit machines, but building a 32 bit image on a 64 bit installation is currently broken.

Related links:

FreeNAS: iXsystems’ FreeNAS snapshot

There doesn’t seem to have been an actual official announcement about this, but it seems FreeNAS 0.7.1 has been released.

You can download it from SourceForge: http://sourceforge.net/projects/freenas/files/

FreeNAS 0.7.1 (Shere):

Majors changes:

• Upgrade e2fsprogs to 1.41.9.
• Upgrade istgt to version 20100125.
• Upgrade msmtp to 1.4.19.
• Upgrade transmission to 1.76.
• Upgrade PHP to 5.2.12 (Thanks to Xin LI).
• Upgrade fuppes to 0.660.
• Upgrade rsync to 3.0.7.
• Upgrade inadyn-mt to 02.18.08.
• Upgrade netatalk to 2.0.5.
• Upgrade bash to 4.0.35.
• Upgrade lighttpd to 1.4.25.
• Upgrade proftpd to 1.3.2c.

Minors changes:

• Modify Samba default buffer size.
• Modify Tuning values.
• Add new MIB in System|Advanced|sysctl.conf.
• Add UTF-8 with English menu in File Manager (quixplorer).
• Restrict NFS sharing directory with alldirs.
• Add serial console support.

Bug fixes:

• Fix bug in istgt script.
• Fix Samba ‘Unknown socket option IPTOS_LOWDELAY’ messages. Thanks to Daisuke Aoyama. (BR 2894782|2858262).
• Fix mt-daapd/firefly error ‘Undefined symbol "avcodec_decode_audio"’ (BR 2895960).
• Fix bug in iSCSI initiator script (BR 2916334). Thanks to Daisuke Aoyama.
• Set home dir for Quixplorer users. Thanks to Daisuke Aoyama.
• Remove useless character in email (BR 2928068).
• Every reboot increases the number of ‘proc’ entries in fstab on ‘full’ installations (BR 2929029).
• Fix message in console menu ‘Reset WebGUI password’ (BR 2929338).
• Fix initial resolv issue.
• Fix full install upgrade error.
• Fix nsswitch error when ldap is enabled (BR 2936505).
• Fix transmission umask does not work (BR 2945242).
• Fix WebGUI allows usernames longer than 16 characters (BR 2934168).
• Fix cannot check WebGUI default port.
• Fix fail to apply if webserver authentication is enabled and documentroot is missing.

Permanent restrictions:

• It is not possible to format a SoftRAID disk with MSDOS FAT16/32.
• It is not possible to encrypt a disk partition, only complete disks are supported.
• It is not possible to get seperate CPU stats per processor on SMP machines because FreeBSD does not support that feature.
• Enable ‘polling’ on interfaces used by a LAGG interface will make it inoperable.
• It is not possible to mount EXT2 disks with an inode size of 256 bytes. You have to format it with 128 bytes on Linux to use them on FreeBSD.

Known bugs:

• If DHCP for IPv4 is used, the IPv6 statically configured DNS server will be overriden by the IPv4 DNS server.
• Downgrading to 0.69 via WebGUI fails because of broken pipe error.
• FreeBSD’s ext2fs module, as of release 7.1, cannot mount ext2 file systems with 256-byte large inodes, only 128 byte sized. Unfortunately, 256 byte is the default size with many recent Linux distributions.

Volker Theile and the FreeNAS team are proud to announce the release of FreeNAS 0.7. Codenamed Khasadar (which is a form of police from Frank Herbert’s famous novel Dune) you can download the ISO and image files here: https://sourceforge.net/projects/freenas/files/stable/0.7.

Majors changes:

• Add ability to configure the login shell for a user.
  
• Local users must join the group ‘ftp’ to be able to login via FTP if ‘Local users only’ in ‘Services|FTP’ is enabled.
  
• Add a user portal. This allows a local user to login and change it’s
  password. The user must have access permissions to login to the user
  portal.
  This can be configured in the user configuration WebGUI. Please note that
  the administrator needs to apply changes done by the local users because
  there have to be restarted several services (which is not allowed to be
  done by a user).
  
• Announce AFP shares using Bonjour/ZeroConf (FR 2839592). Thanks to Morton
  Jonuschat.
  
• Add AFP FP_SYNCFORK command support (FR 2836955). Thanks to Morton
  Jonuschat
  for the patch.
  
• Add Adaptec AACRAID 32/64-bit driver to v5.2.0 Build 17517.
  

Major software upgrades:

• Upgrade Samba to 3.0.37.
  
• Upgrade transmission to 1.72.
  
• Upgrade lighttpd to 1.4.23.
  
• Upgrade ProFTPD to 1.3.2a.
  
• Upgrade iSCSI initiator to 2.2.3.
  
• Upgrade fusefs-ntfs/ntfs-3g to 2009.4.4.
  
• Upgrade e2fsprogs to 1.41.8.
  
• Upgrade inadyn-mt to 02.14.10.
  
• Upgrade fuppes to SVN-0.640.
  

Minors changes:

• Set transmission umask to 0002 per default. This can be customize via the
  ‘Services|BitTorrent’ WebGUI or the rc.conf variable ‘transmission_umask’
  (FR 2813791).
  
• Add ixgbe driver to i386 kernel.
  
• Add ixgb driver to AMD64 kernel (BR 2813759).
  Add support for Blowfish 448 bits encryption (FR 2816028).
  Add configuration option in ‘Services|BitTorrent’ to enable/disable usage
  of distributed hash table (DHT).
  
• Add /usr/bin/getopt command (FR 2824548).
  
• Add extra options for S.M.A.R.T. in ‘Disks|Management|Disk|Edit’ (FR
  2824730).
  
• Add RAID1 balance algorithm ‘prefer’ (FR 2833989).
  
• Add latvian language support. Thanks to the translators.
  
• Update Quixplorer russian translation (BR 2841900). Thanks to Alexey
  Sannikov.
  
• Add ‘Max. login attempts’ to ‘Services|FTP’ (FR 2844193).
  
• Get AFP dbd cnid scheme working (BR 2844900).
  
• Set ‘dir-listing.encoding = “utf-8″‘ for the webserver directory listing
  (FR 2872624).
  
• Display volume serial number in ‘Disks|Management’ (FR 2881880).
  
• Now it is possible to configure iSCSI-Targets for export: removable media
  (static & dynamic size), pass-through devices. Thanks to Vasily Chalykh.
  

Bug fixes:

• Prohibit user ‘transmission’ to login via FTP.
  
• ZPool disk space usage isn’t displayed correctly (BR 2810584).
  
• Improved Unison WebGUI to be able to configure ZFS shares as working
  directory (BR 2795084).
  
• Synchronizing ZFS configuration fails (BR 2814324).
  
• Restrict bittorrent administrative WebGUI port to [1024,65535] (BR
  2835342).
  
• The ‘Unmount disk/partition’ checkbox on ‘Disks|Mount Point|Fsck’ was ignored (BR 2860297).
  

Permanent restrictions:

• It is not possible to format a SoftRAID disk with MSDOS FAT16/32.
  
• It is not possible to encrypt a disk partition, only complete disks
  are supported.
  
• It is not possible to get seperate CPU stats per processor on SMP
  machines because
  FreeBSD does not support that feature.
  
• Enable ‘polling’ on interfaces used by a LAGG interface will make it
  inoperable.
  
• It is not possible to mount EXT2 disks with an inode size of 256
  bytes. You
  have to format it with 128 bytes on Linux to use them on FreeBSD.
  

Known bugs:

• If DHCP for IPv4 is used, the IPv6 statically configured DNS server
  will be
  overriden by the IPv4 DNS server.
  
• Downgrading to 0.69 via WebGUI fails because of broken pipe error.
  
• FreeBSD’s ext2fs module, as of release 7.1, cannot mount ext2 file systems
  with 256-byte large inodes, only 128 byte sized. Unfortunately, 256
  byte is
  the default size with many recent Linux distributions.
  

Volker Theile and the FreeNAS team have proudly to announced the first release candidate of FreeNAS 0.7.

It can be downloaded from http://www.freenas.org/index.php?option=com_versions&Itemid=51

Version 0.7 is a major upgrade to FreeNAS with the most significant changes being the move to FreeBSD 7.2 and the inclusion of ZFS. Also the minimum specification has changed, if you want to use ZFS you will need 512MB of memory.

Majors changes:

• Upgrade to FreeBSD 7.2.
  
• Include ZFS support.
  
• Upgrade iSCSI initiator to 2.1.1.
  
• Replace iSCSI target by istgt. Please note, if you have used devices with the previous iSCSI target software you have to recreate your target.
  
• Upgrade transmission to 1.61. Add ‘Watch directory’ and ‘Extra options’ fields to ‘Services|BitTorrent’ WebGUI.
  

Known bugs:

• Downgrading to 0.69 via WebGUI fails because of broken pipe error.
  
• FreeBSD’s ext2fs module, as of release 7.1, cannot mount ext2 file systems
  with 256-byte large inodes, only 128 byte sized. Unfortunately, 256 byte is
  the default size with many recent Linux distributions.
  

You can see the full release notes at
https://sourceforge.net/project/shownotes.php?release_id=691284&group_id=151951

FreeNAS 0.69.2 (code name Muad’Dib; a term with multiple applications within Frank Herbert’s Dune universe) has been released. This is a maintenance release to the 0.69 branch.

Majors changes:

• Add another WOL patch. It is tested for nfe(4) und xl(4). Thanks to Tobias Reber.
  
• Add switch in ‘System|Advanced’ WebGUI to enable the console screensaver (FR 2777301).
  
• Upgrade Adaptec SCSI RAID administration tool to 6.10.18359.
  
• Add ability to enable or disable rc.conf variables configured via ‘System|Advanced|rc.conf’.
  
• Add danish WebGUI translation. Thanks to all translators.
  
• Add kernel patches to get ARTiGO A2000 hardware working. Thanks to David Davis for the patches.
  
• Add ability to use %d (date) and %h (hostname) in email subjects (e.g. Services|UPS) (FR 2796141).
  

Minors changes:

• Add ‘MaxLoginAttempts’ event to FTP ban list rules (FR 2777481).
  
• Add ‘ClientConnectRate’ event to FTP ban list rules.
  
• Allow selecting the key length of the cryptographic algorithm used to encrypt a disk (FR 2779692).
  
• Add system power control options to ‘System|Advanced|rc.conf’ (FR 2784889).
  
• Show FTP transfer log in ‘Diagnostics|Logs|FTP|Transfer’ (FR 2785325).
  
• Add filechooser button to ‘Home directory’ editbox in ‘Access|Users|Edit’ WebGUI (FR 2790909).
  
• Sort various lists displayed in the WebGUI using a ‘natural order’ algorithm (FR 2481934). Thanks to Marion Desnault for the patch.
  

Bug fixes:

• It was not possible to configure multiple FTP ban list rules. Thanks to Michael Zoon.
  
• Modify Fuppes UPnP configuration to get PS3 with firmware 2.70 working again (BR 2782729).
  
• Editing existing config items in WebGUI will display incorrect data (e.g. ‘System|Advanced|rc.conf’ or ‘System|Advanced|sysctl.conf’) (BR 2792956).
  
• Fix bug in WebGUI which is caused by unhandled special HTML characters used in various languages (BR 2793875).
  
• Set Quixplorer user permissions to ‘View only’ because of security reason because Quixplorer does not respect system user permissions (BR 2798934).
  
• Disk temperature not detected correct for SCSI devices (BR 2801565).
  
• Fix JPCERT/CC JVN#89791790 (Cross-site scripting vulnerability).
  

It can be downloaded here and you can read the full release announcement here.

FreeNAS 0.69.1 code named Omnius (referring to a collection of artificially intelligent entities from Frank Herbert’s Dune) has been released. It can be downloaded here.

Majors changes:

• Upgrade Samba to 3.0.34.
  
• Upgrade ProFTPD to 1.3.2.
  
• Upgrade mDNSResponder to 1.08.6.
  
• Upgrade lighttpd to 1.4.22.
  
• Upgrade cdialog to 1.1.20080819.
  
• Upgrade e2fsprogs to 1.41.4.
  
• Upgrade nut to 2.4.1. Thanks to Joerg Pulz for the core dump patch. This
  version uses TCP wrappers instead of the internal ACL mechanism. Because of
  that all client can listen the UPS. If you want to prevent this you have to
  use the FreeNAS client firewall to block specific IP ranges. See

  http://lists.alioth.debian.org/pipermail/nut-upsuser/2009-February/004862.html

  for a detailed explanation.
  

• Upgrade transmission to 1.51.
  
• Upgrade fusefs-ntfs/ntfs-3g to 2009.2.1.
  
• Upgrade 3Ware serial ATA RAID controller driver to 9.5.1.
  
• Upgrade bash to 4.0.10.
  

Minors changes:

• Add ‘SSL/TLS only’ on ‘Services|FTP’ page to allow TLS/SSL connections
  only.
  
• Add ‘Reverse DNS lookup’ on ‘Services|FTP’ page. This and the ‘Ident
  protocol’
  option are disabled per default because they may slow down or break the
  user
  login to the FTP server in some situations.
  
• Add ‘Authentication’ checkbox on ‘Services|BitTorrent’ page to
  enable/disable
  authentication for TransmissionBT WebGUI.
  
• Add checkbox to enable WOL on ‘Network|Interfaces|LAN’ and
  ‘Interfaces|Optionalx’
  pages. Please note that WOL only works for nfe, nve, sis, vr, xl. Thanks to
  Tobias Reber for the patch.
  
• Add traceroute6 command (FR 2531610).
  
• Add *.iso support to Fuppes UPnP (FR 2521047).
  
• Move ‘m2ts’ video file extension to ‘default’ section (BR 2643180).
  
• Add ‘Remote monitoring’ to ‘Services|UPS’ to allow adding remote
  monitors that
  monitor the local installed UPS in slave mode.
  
• Use WebGUI administrator password for the NUT user ‘root’.
  
• Add ability to mount UDF ISO images.
  
• Disable download feature in Quixplorer because there are misc. (PHP and
  system) limitations that makes this feature senseless.
  
• Prevent generation of core dump files (BR 2662404). Can be enabled via
  ‘System|Advanced|sysctl.conf’.
  
• Add ability to enable/disable sysctl variables in
  ‘System|Advanced|sysctl.conf’.
  
• Add XMLRPC services that are available via

  http://xxx.xxx.xxx.xxx/xmlrpc.php,

  e.g. system.getInfo.
  

• Add ability to configure ProFTPD module mod_ban via WebGUI (FR 2546338).
  
• Add device I/O statistics to ‘Status|Disks’ page (FR 2704919).
  
• Replace msntp with FreeBSD’s ntpdate.
  
• Allow setting TransmissionBT WebGUI user name (FR 2745563).
  
• Allow to set the following TransmissionBT settings via WebGUI: peer port,
  port forwarding, pex, encryption mode and max. upload/download bandwidth
  (FR 2765940).
  

Bug fixes:

• Set correct friendly name in fuppes.cfg for Xbox 360. The correct
  friendly name will be generated automatically (e.g. ‘xxxx : 1′).
  
• Set correct shutdown property in upsmon.conf (BR 2521141).
  
• Starting FTP service fails when using DHCP on LAN interface (BR 2519951).
  
• FPSyncDir patch correction (BR 2546107).
  
• UPS service improvements. Display NUT messages in syslog and send
  emails when
  using shutdown mode ‘UPS reaches low battery’ (BR 2549047).
  
• Change user agent string for PS3 to ‘PLAYSTATION 3′ in fuppes.cfg (BR
  2600554).
  
• Formating disks with ‘Software RAID’ doesn’t clear GEOM metadata (BR
  2609681).
  
• GUI menu separator line too thick in Safari (BR 2652160). Thanks to
  skabde.
  
• Add patch for PHP bug #45996 (libxml2 2.7 causes breakage with
  character data
  in xml_parse()).
  
• Display dialog to set WebGUI port when configuring network settings via
  console menu (BR 2661938).
  
• Fix problem with DAAP & Mac iTunes 8.1 (BR 2701606). Thanks to Alexey
  Sannikov.
  
• Fix false positive bug while detecting disk mount state (BR 2706994).
  Thanks
  to desummoner for the patch.
  

Permanent restrictions:

• It is not possible to format a SoftRAID disk with MSDOS FAT16/32.
  
• It is not possible to encrypt a disk partition, only complete disks
  are supported.
  
• It is not possible to get seperate CPU stats per processor on SMP
  machines because
  FreeBSD does not support that feature.
  
• Enable ‘polling’ on interfaces used by a LAGG interface will make it
  inoperable.
  
• It is not possible to mount EXT2 disks with an inode size of 256
  bytes. You
  have to format it with 128 bytes on Linux to use them on FreeBSD.
  

Known bugs:

• If DHCP for IPv4 is used, the IPv6 statically configured DNS server
  will be
  overriden by the IPv4 DNS server.
  

After substantial development, FreeNAS 0.69 (revision 4276) has been released. Code named “Kwisatz Haderach” (which is the name of a prophesied messiah in Frank Herbert's fictional Dune universe.) version 0.69 adds lots of new features.

If can be downloaded from http://www.freenas.org/index.php?option=com_versions&Itemid=51

Note that there are some limitations when upgrading
0.69 because of various changes like the increased size the root file system, due to the many new features.

This only affect users that are using 'embedded' + DATA partition installations. In this case you have to backup your DATA partition and install FreeNAS completely new. The 'embedded' and 'full' installations are not affected.

Anyway, if you have a 'embedded' and 'full' installation it is worth to
think about doing a new installation because FreeNAS 0.69 allows you to create a SWAP partition during installation which will be really helpful to prevent errors in some situations, e.g. doing background file system checks of large HDD's or dowloading large files via Quixplorer.

Majors changes:
- Add TFTP service. It is accessible via 'Services|TFTP' in the WebGUI.
- Add Samba patch CVE-2008-4314.
- Upgrade nano to 2.0.9.
- Upgrade PHP to 5.2.8.
- Add WOL support for misc NIC's. Thanks to Tobias Reber for porting WOL patch to FreeBSD 6.4.
- Upgrade nfe driver. Thanks to Tobias Reber for backporting FreeBSD 7.0 driver and adding WOL support.
- Finally fixed Samba lock file problem (they are located in/var/db/samba now). You can increase the memory filesystem size for /var for LiveCD and'embedded' installations by modifying the rc.conf variable named 'varsize'. This is necessary if you are running out of file space for *.tdb files (this normally happens on heavy Samba share usage with many users). The default size
is 32MB.
- Replace FTP server pure-ftpd 1.0.21 with proftpd 1.3.2rc3. Please note that there can be set additional options via rc.conf variables which are not displayed in the service WebGUI. Please have a look into /etc/rc.d/proftpd script for a detailed list of options.
- Add TCP Wrappers. All applications linked against libwrap support this feature, for example services like FTP, TFTP, SSH, NFS… The rules can be configured via WebGUI 'Network|Hosts'.
- Upgrade ATAidle to 2.4.
- Upgrade transmission to 1.42.
- Upgrade rsync to 3.0.5.
- Upgrade cdialog to 1.1.20080316.
- Upgrade msmtp to 1.4.17.
- Add ability to create a SWAP partition during installation.
- Enhance the 'System|Advanced|Swap' page to select a file or disk device as swap space.

Minors changes:
- Set date in email-header when sending email.
- Add WebGUI link 'Help|Forum' to FreeNAS forum hosted on Sourceforge.
- Refactor 'Access|LDAP' WebGUI. Now it is possible to add additional options to ldap.conf via WebGUI.
- Add *.divx file extension support to Fuppes (UPnP server) (FR 2400097).
- Add FTP bandwidth limit for local and anonymous users (FR 1860459).
- Add PHP PDO SQLite3 support (FR 2352505).
- Display service state (running/stopped) in 'Services|Status'.
- Add exit status for send_email function in email.subr (BR 2422479).
- Add nfsstat for NFS diagnostics (FR 2093184).
- Do not display links for files in Quixplorer file view.
- Add knobs to the fusefs rc.d script (NTFS support) to safely wait until all data has been written on shutdown. To enable this feature you have to set the rc.conf variables 'fusefs_safe=YES' and 'fusefs_safe_evil=YES' in 'System|Advanced|rc.conf'.
- Display CPU temperature and frequency in 'Status|System' page (FR 2480272). The frequency levels are displayed as tooltips. Please note that these values are not displayed if FreeBSD is not able to get these hardware informations via sysctl.
- Update translation files. Thanks to all translators contributing to
FreeNAS.

Bug fixes:
- The 'default gateway' entered during the console setup is not set without doing a reboot (BR 2406068).
- Fix file size bug in Quixplorer (BR 2445421).
PHP can not get correct file size for files larger than 2GB. See http://de.php.net/manual/en/function.filesize.php for detailed description.
- iSCSI-Target target configuration should only accept one extent or device as storage (BR 2454804).
- If 'Hard disk standby time' is set for a drive, the execution of ataidle is delayed to prevent drives to spin up again during the boot process because ataidle immediately spins down the drives on execution. The delay value (default is 60 seconds) can be modified via 'ataidle_delay' rc.conf variable (BR 2471158).
- Get SNMP module 'netgraph' working. Fixed by adding missing kernel modules.
- Static IPv6 ifconfig is set correct now in rc.conf.
- QuiXplorer incorrectly copies premissions (BR 2491739).
- WebGUI filechooser reports incorrect file size for files > 2GB (BR
2499277).

Permanent restrictions:
- It is not possible to format a SoftRAID disk with MSDOS FAT16/32.
- It is not possible to encrypt a disk partition, only complete disks are supported.
- It is not possible to get seperate CPU stats per processor on SMP
machines because FreeBSD does not support that feature.
- Enable 'polling' on interfaces used by a LAGG interface will make it
inoperable.