TOS 6.0.500 Official Release

[tanktarta]

Well, my upgrade from 6.0.460 went fairly well, up to a point.

The upgrade started, but at some point before the first reboot the UI appeared to log itself out (instead of the "rebooting .." message I had seen on previous upgrade). It seemed to be suggesting that I had a session timeout, but I had only just logged in and started the upgrade immediately.

So I just waited, and TOS rebooted itself as normal, and I could refresh the page myself and log in to the new version, all data intact.

I was glad to see what appears to be improved file permissions control, so thanks TM for that.

However .... now I can no longer join my domain. Now I have had to rejoin the domain after every single upgrade, which is irritating but not really a huge problem. This time though, rejoining did not work. It just complains about an "Incorrect username or password". I have tried several users with permissions to join the domain, but none work.

I can't find any logs on my domain controller (Samba) that suggest the DC is even being contacted. And I can't find anything that looks relevant in TOS logs either.

The only sign of anything untoward I can find is by tailing /var/log/syslog. The following text just keeps repeating infinitely. Windows file sharing on TOS itself appears to be working, just without any domain integration.

Code: Select all

.
Sep 20 16:18:49 terra systemd[1]: Started trigger-samba.service.
Sep 20 16:18:49 terra systemd[1]: Condition check resulted in Kernel Security Modules - SMACK being skipped.
Sep 20 16:18:49 terra systemd[1]: Condition check resulted in Security Spcack being skipped.
Sep 20 16:18:49 terra systemd[1]: Starting trigger-samba.service...
Sep 20 16:18:51 terra systemd[1]: trigger-samba.service: Deactivated successfully.
Sep 20 16:18:51 terra systemd[1]: Started trigger-samba.service.
Sep 20 16:18:51 terra systemd[1]: Condition check resulted in Kernel Security Modules - SMACK being skipped.
Sep 20 16:18:51 terra systemd[1]: Condition check resulted in Security Spcack being skipped.
Sep 20 16:18:51 terra systemd[1]: Starting trigger-samba.service...

[jpeckinp]

OK here is everything I've tried to get Plex working again.
I uninstalled latest Plex update and went back to the base from the Application list on TOS. Which I know was working fine.
Cleared out all configuration files in the Plex folder.
Moved all the folders back into plex library folder.
I can see all the data in the folders on my desktop, my phone, everywhere and can even watch it via media players, so I know the data is good.
For some reason when I try to add libraries I go to /volume1/plex/library/movies click add and Plex says the library is empty.

If it's a permission thing I have gave access in every location I can think of. But you would think if it was that I wouldn't be able to access the data on other computers.

I'm going to post this on the Plex support forum also.

[RyanYang]

It seems to be related to SPC. You can try going to the security module of the control panel to turn off SPC.

[tanktarta]

It is not turned on. It has never been on.

Can anyone confirm if domain joining on 6.0.500 works for them?

[tanktarta]

I found some more logging that may point to the problem. If I run

Code: Select all

journalctl -f

while joining, I get this ..

Code: Select all

Sep 21 10:13:49 terra TOSDaemon[10774]: Decrypted data:  {"domain_name":"southpark.lan","dns_server":"192.168.91.11","management_mode":0,"connection_status":1,
    "senior_domain":0,"dc_ip":"","domain_net_bios":"","domain_FQDN":"","regist_dns":"eth0","update_interval":10,"username":"administrator",
    "password":"REDACTED",
    "domainPassword":"REDACTED"}
Sep 21 10:13:49 terra TOSDaemon[10774]: domain connectToAdServer config: {Name:southpark.lan DNS:192.168.91.11 Mode:0 Status:1 Senior:0 DcIP: NetBios: FQDN:
     Interface:eth0 UpdateInterval:10 UserName:administrator PassWord:REDACTED}
Sep 21 10:13:49 terra systemd[1]: Stopping Samba SMB Daemon...
Sep 21 10:13:49 terra systemd[1]: samba.service: Deactivated successfully.
Sep 21 10:13:49 terra systemd[1]: Stopped Samba SMB Daemon.
Sep 21 10:13:49 terra systemd[1]: samba.service: Consumed 3min 45.286s CPU time.
Sep 21 10:13:49 terra systemd[1]: Condition check resulted in Kernel Security Modules - SMACK being skipped.
Sep 21 10:13:49 terra systemd[1]: Condition check resulted in Security Spcack being skipped.
Sep 21 10:13:49 terra systemd[1]: Starting trigger-samba-secrets.service...
Sep 21 10:13:49 terra systemd[1]: Condition check resulted in Kernel Security Modules - SMACK being skipped.
Sep 21 10:13:49 terra systemd[1]: Condition check resulted in Security Spcack being skipped.
Sep 21 10:13:49 terra systemd[1]: Starting trigger-samba.service...
Sep 21 10:13:49 terra TOSDaemon[10774]: newConnect DialTLS fail, err: LDAP Result Code 200 "Network Error": tls: failed to parse certificate from server: x509: negative serial number
Sep 21 10:13:49 terra TOSDaemon[10774]: newConnect Bind fail, err: LDAP Result Code 8 "Strong Auth Required": BindSimple: Transport encryption required.
Sep 21 10:13:49 terra TOSDaemon[10774]: newConnect NTLMBind fail, err: unable to read LDAP response packet: EOF
Sep 21 10:13:49 terra systemd[1]: Condition check resulted in Kernel Security Modules - SMACK being skipped.
Sep 21 10:13:49 terra systemd[1]: Starting Samba SMB Daemon...
Sep 21 10:13:49 terra systemd[1]: Condition check resulted in Security Spcack being skipped.
Sep 21 10:13:50 terra service_prepare[1132190]: 0
Sep 21 10:13:50 terra service_prepare[1132190]: 0
Sep 21 10:13:50 terra smbd[1132297]: [2024/09/21 10:13:50.588665,  0] ../../source3/smbd/server.c:1758(main)
Sep 21 10:13:50 terra smbd[1132297]:   smbd version 4.15.13-Ubuntu started.
Sep 21 10:13:50 terra smbd[1132297]:   Copyright Andrew Tridgell and the Samba Team 1992-2021
Sep 21 10:13:50 terra systemd[1]: Started Samba SMB Daemon.
Sep 21 10:13:50 terra TOSDaemon[10774]: domain joinAdDomain failed, test pwd error: connect error
Sep 21 10:13:50 terra TOSDaemon[10774]: ERROR | 2024-09-21 10:13:50 | 200 |   POST |    192.168.91.4 | /domain/DomainServiceDetection? | 1.114525504s | Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0 | test pwd error: connect error
Sep 21 10:13:51 terra systemd[1]: trigger-samba-secrets.service: Deactivated successfully.
Sep 21 10:13:51 terra systemd[1]: Started trigger-samba-secrets.service.
Sep 21 10:13:51 terra systemd[1]: trigger-samba.service: Deactivated successfully.
Sep 21 10:13:51 terra systemd[1]: Started trigger-samba.service.
Sep 21 10:13:51 terra upsmon[8862]: Poll UPS [ups@localhost] failed - Driver not connected
Sep 21 10:13:56 terra upsmon[8862]: Poll UPS [ups@localhost] failed - Driver not connected

Passwords above changed to "REDACTED".

To me, the most suspicious error looks to be ..

Code: Select all

Sep 21 10:13:49 terra TOSDaemon[10774]: newConnect DialTLS fail, err: LDAP Result Code 200 "Network Error": tls: failed to parse certificate from server: x509: negative serial number

To re-iterate, this is using a Samba domain controller, which which domain joining on TOS has worked for every version until this one.

[tanktarta]

To answer myself again ..

My certificate does indeed a have a negative serial number. This certificate is generated automatically by the Samba domain controller. This is the default configuration, and all my other computers (both Linux and various Windows versions) can join the domain fine with this.

So it looks like there is some new restriction in this version of TOS that doesn't like this. I can find several references to this particular error on the internet, and they all seem to relate to the go language and it's X509 certificate passing. At one time, it was a known bug, but it looks like it should long be fixed. I am guessing TOSDaemon is written in go then .

I could probably generate my own certificate, and will try this when I figure out how.

Code: Select all

     root@dc1   ~    openssl x509 -in /var/lib/samba/private/tls/ca.pem -noout -text 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: -2135703706 (-0x7f4c409a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = Samba Administration, OU = Samba - temporary autogenerated CA certificate, CN = DC1.southpark.local
        Validity
            Not Before: Aug 16 20:16:00 2024 GMT
            Not After : Jul 17 20:16:00 2026 GMT
        Subject: O = Samba Administration, OU = Samba - temporary autogenerated CA certificate, CN = DC1.southpark.local
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:

[RyanYang]

Did you modify the DNS server and default gateway before the update? Perhaps you can try restarting the system process with:

Code: Select all

systemctl restart TOSDaemon.service

[RyanYang]

The permissions in this version are partially incompatible with those in the Beta version. After updating, you can try resetting the permissions. Some subfolder permissions might show anomalies. When editing the shared folder, you can set user permissions to "deny" and then reassign them, trying to check "inherit permissions" during the process. Alternatively, you can place the files in the shared folder or create a new directory.
Plex is currently being adapted for TOS 6 by the official team.

[RyanYang]

Could you let me know how you did it? Did you restart only after reinstalling? After re-enabling Emby, did you check the app user’s permissions by editing the permissions for the emby shared folder and any other newly created shared folders?

[RyanYang]

You need to wait for us to release the new installation method before you can use the TOS6 installation package for the F4-424 Max page.