MichaIng / DietPi

Lightweight justice for your single-board computer!
https://dietpi.com/
GNU General Public License v2.0
4.89k stars 498 forks source link

Open Beta v7.1 | Please help testing and hardening the upcoming release #4294

Closed MichaIng closed 3 years ago

MichaIng commented 3 years ago
RC version v7.1.2
v7.1.0 PR #4288
v7.1.1 PR #4299
v7.1.2 PR #4308
Changelog https://github.com/MichaIng/DietPi/blob/beta/CHANGELOG.txt
Code changes https://github.com/MichaIng/DietPi/compare/master...beta
Release planned 2021-04-28

How to apply: https://github.com/MichaIng/DietPi/blob/master/BRANCH_SYSTEM.md

Related/solved issues: https://github.com/MichaIng/DietPi/issues?q=is%3Aissue+milestone%3Av7.1


Beta v7.1.2

(2021-04-28)

Supported SBC changes

Changes

New Scripts

New Software

Removed Software

Fixes

Joulinar commented 3 years ago

Was testing migration of Sonarr without issues. At least on an empty system it was working well. Notification was given on DietPi v7.1 update and I could reinstall Sonarr afterwards.

@MichaIng One question. Does Sonarr v3 still require Mono? Because it's still a dependency and will be setup during dietpi-software reinstall 144

Joulinar commented 3 years ago

I guess I found an issue on dietpi-vpn.

What I did:

  1. run dietpi-vpn
  2. select Custom
  3. OK
  4. don't do anything, just select <Exit>
  5. Exit DietPi-Explorer? <Ok>
  6. getting the error dialog now as the system is trying top open /etc/openvpn/client.ovpn still
  7. this is the error dialog
    Click to expand!
                ┌────────────────────────────────────────────────────┤ DietPi-VPN ├────────────────────────────────────────────────────┐
                │  - Command: cp  /etc/openvpn/client.ovpn                                                                             │
                │  - Exit code: 1                                                                                                      │
                │  - DietPi version: v7.1.0 (MichaIng/beta) | HW_MODEL: 3 | HW_ARCH: 2 | DISTRO: 5                                     │
                │  - Image creator: DietPi Core Team                                                                                   │
                │  - Pre-image: Raspbian Lite                                                                                          │
                │  - Error log:                                                                                                        │
                │ cp: cannot stat '': No such file or directory                                                                        │
                │                                                                                                                      │
                │                         Retry          : Re-run the last command that failed                                         │
                │                         DietPi-Config  : Edit network, APT/NTP mirror settings etc                                   │
                │                         Open subshell  : Open a subshell to investigate or solve the issue                           │
                │                         Send report    : Uploads bugreport containing system info to DietPi                          │
                │                                        ●─ Devs only ──────────────────────────────────────●                          │
                │                         Change command : Adjust and rerun the command                                                │
                │                                                                                                                      │
                │                                                                                                                      │
                │                                  <Ok>                                      <Exit>                                    │
                │                                                                                                                      │
                └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

As well I see another error if I scroll up on my SSH session /boot/dietpi/dietpi-vpn: line 125: /tmp/.dietpi-explorer_selected_location: No such file or directory

MichaIng commented 3 years ago

Was testing migration of Sonarr without issues.

Yes, the DEB package pre/postinst scripts do quite a good to to cleanly migrate Sonarr v2 instances. And the package can be/is pre-configured to use our custom data dir right from the start. A few settings cannot be migrated, e.g. removed or changed ones, like arguments for the "Custom Script" feature, but all important parts are migrated safely.

One question. Does Sonarr v3 still require Mono?

Yes it does, same as Radarr v3. Only Jackett got a non-Mono .NET version.

Good find with DietPi-VPN. Looks like a return is missing when dietpi-explorer returns an exit code, if does it not return one?? I'll check.

EDIT: It does not return a exit code: https://github.com/MichaIng/DietPi/blob/dev/dietpi/dietpi-vpn#L123

Joulinar commented 3 years ago

the error happen right after this box

┌──────────────┤ DietPi-Explorer ├───────────────┐
│                                                │
│ Exit DietPi-Explorer?                          │
│                                                │
│           <Ok>               <Cancel>          │
│                                                │
└────────────────────────────────────────────────┘
MichaIng commented 3 years ago

Solved: https://github.com/MichaIng/DietPi/commit/8fe74a87610d4d7b63ac018537b403d54d97e6ee The commit looks larger than it is. I replaced two:

if G_WHIP; then

    <many code lines>

fi

with

G_WHIP || return 0

<many code lines>

to reduce unnecessary code line indentation.

MichaIng commented 3 years ago

Another little related enhancement: https://github.com/MichaIng/DietPi/commit/2c88d26e4faf568e6239495fc9eebe23a6253b52

When "Custom" was selected but the DietPi-Explorer exited, "Custom" was shown in the menu, like if it was selected successfully. Since the custom file is not shown anywhere in the menu it is not visible that no valid selection has been made.

Now, in that case no variable is touched, hence the previous provider is shown as if nothing had changed, which is the true.

MichaIng commented 3 years ago

Beta v7.1.1 has been merged: #4299

gstrauss commented 3 years ago

DietPi-LetsEncrypt | Lighttpd: HTTPS is now enabled for IPv6 requests and the deprecated TLSv1.0 and TLSv1.1 are disabled from Debian Buster on. With the Lighttpd version shipped by Debian Stretch, those TLS versions cannot be disabled.

Debian Buster has lighttpd 1.4.53 (+ some patches). buster-backports has lighttpd 1.4.59. Since lighttpd 1.4.48, lighttpd supports ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2") If you are on an older system with very old openssl, then with openssl 1.0.2 ssl.openssl.ssl-conf-cmd = ("Protocol" => "-ALL, TLSv1.2")

lighttpd 1.4.56 and later disable old TLS versions (< TLSv1.2) by default.

MichaIng commented 3 years ago

That is how it's done now: https://github.com/MichaIng/DietPi/blob/dev/dietpi/dietpi-letsencrypt#L160-L170

The old system requires the ssl.use-sslv3 = "disable" syntax anyway, so no overlap of old OpenSSL and new Lighttpd syntax or the other way round.

lighttpd 1.4.56 and later disable old TLS versions (< TLSv1.2) by default.

That is good to know, however no harm to keep the directive to disable it, e.g. if some old/custom config is in place that overrides the Lighttpd default. Also I like to have those settings exposed in general, so users see what is possible by only checking the config and could change it to "MinProtocol" => "TLSv1.3" e.g.

gstrauss commented 3 years ago

ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2", "Options" => "-SessionTicket")

In lighttpd 1.4.56 and later, it is recommended that you remove "Options" => "-SessionTicket" since it is safe to use TLSv1.2 Session Tickets in lighttpd 1.4.56 and later, since lighttpd rotates the session ticket encryption keys automatically starting with lighttpd 1.4.56. More details at lighttpd TLS Session Tickets This lighttpd feature is something that Apache and nginx do not do as well (https://github.com/mozilla/server-side-tls/issues/135)

Separately, ssl.disable-client-renegotiation = "enable" is the default, and it is recommended to keep the default for security reasons. This is not something that someone should change on a whim, so it probably ought not to be listed in the config.

MichaIng commented 3 years ago

Great news about session tickets in Lighttpd v1.4.56. I guess for the patched v1.4.53 from Debian Buster this is not true yet? At least for Bullseye and up I'll have it removed. We cannot count on backports as RPi (Raspbian) has no backports. Probably I'll add a CLI-based version estimation with next release, to correctly treat backports and own source builds.

EDIT: Changed with: https://github.com/MichaIng/DietPi/commit/e6da401d5850f19664a6099369ad9f513ff3fe2c

naddel91 commented 3 years ago

dietpi-ddns does not work for me. I tried domain and username to login, but it reports "DDNS update test failed, please check your input: unknown". I only have login data (username and password). that cannot be the culprit of the error here since manually logging in (website dynu.net) works fine.

Joulinar commented 3 years ago

Hi,

usually DDNS provider offering an update URL that would need to be added inside dietpi-ddns. There is a description according dynu.com

https://www.dynu.com/DynamicDNS/IPUpdateClient/Custom

naddel91 commented 3 years ago

it works using the update URL. but why is Dynu in the profiles then?

Joulinar commented 3 years ago

according the script, update URL is exactly same as on dynu.com web side

https://github.com/MichaIng/DietPi/blob/29502ae182253876eca4f875c9651713fc4d022e/dietpi/dietpi-ddns#L130

Do you use any special character on your password? just a question.

naddel91 commented 3 years ago

strange. will try again after stable release. thanks for your help.

EDIT: when manually entering the data, I was asked for login name. that was not the case when using the profile that was already there. maybe that's the reason?

Joulinar commented 3 years ago

You mean the custom profile? Nö that not the reason. The custom profile doesn't know what fields are required. Therefore it will aks all data. However in the custom profile it should be fine just to enter the update link according provider website and leave user + pw empty

naddel91 commented 3 years ago

I mean, the script did not ask me for username, only domain when using the pre-configured Dynu-profile.

Joulinar commented 3 years ago

This is correct. As you can see on provider web site, this is not required. Only domain and password.

naddel91 commented 3 years ago

ok, good to know. will try again when 7.1(.1) is public.

Joulinar commented 3 years ago

Actually there is no change planned for the ddns tool. Means it would be good to find out why it is failing in your case

naddel91 commented 3 years ago

test update failed when entering through pre-configured profile (dynu). working fine when updating manually (custom).

Joulinar commented 3 years ago

can you do a screenshot from the error message pls

naddel91 commented 3 years ago

it is "nochg" that failed. when entering manually there is one more prompt to enter (username). and manually using this here works fine:

https://api.dynu.com/nic/update?hostname=hostdomain&password=mypassword

"DDNS update test succeeded: │ │ nochg "

using the preconfigured script (dynu) with the same credentials fails telling me "NOCHG" as error.

DDNS update test failed, please check your input: │ │ nochg

naddel91 commented 3 years ago

https://abload.de/img/ddnsdietpifailssljfd.png

Joulinar commented 3 years ago

the user name should not be required. As you see on the link you posted, there is no username value.

naddel91 commented 3 years ago

I know, but there might be something strange with the underlying URL. because custom works fine. same input into the Dynu-profile fails.

Joulinar commented 3 years ago

Found what nochg means

nochg means that the IP has not changed so the update is skipped

https://www.dynu.com/en-US/Forum/ViewTopic/nochg/6911 https://www.dynu.com/forum/viewtopic/server-reply-after-ip-update/263

There is a list of response codes on dynu.com https://www.dynu.com/DynamicDNS/IP-Update-Protocol#responsecode

can you force a change on your public IP on your router?

MichaIng commented 3 years ago

Many thanks for reporting. The response is checked wrong (literal asterisks ... https://github.com/MichaIng/DietPi/commit/de09da5c9fe0a04e32707d540ab792e1e728f468 ). Can you please test it with after:

curl -sSfL https://raw.githubusercontent.com/MichaIng/DietPi/dev/dietpi/dietpi-ddns -o /boot/dietpi/dietpi-ddns
naddel91 commented 3 years ago

that did it! Micha FTW! Joulinar, too. Of course!

MichaIng commented 3 years ago

Great.

When using a custom provider, we do not know how the response is composed, so we just check for successful connection + HTTP 2xx response (curl with "-f" option). That means that the test can succeed even if the update failed, when the server does not response with an HTTP error but an error code as body of a regular 200 response (like Dyno and also DuckDNS).

So adding further providers gives the test more meaning, but the response need to be checked correctly of course 😄.

naddel91 commented 3 years ago

So dietpi 7.1.1 is stable now? ;)

Joulinar commented 3 years ago

well we are already on 7.1.2 within development 😉 https://github.com/MichaIng/DietPi/pull/4308

marcelloinfoweb commented 3 years ago

The temperature display on the Home screen when logging in via ssh has been removed.

Joulinar commented 3 years ago

what SBC you are running on?

marcelloinfoweb commented 3 years ago

‎em que SBC você está executando?‎

Raspberry Zero W

Before it showed the temperature

Joulinar commented 3 years ago

for me it is working well on my RPi3B+

─────────────────────────────────────────────────────
 DietPi v7.1.2 (dev) : 02:37 - Wed 04/28/21
 ─────────────────────────────────────────────────────
 - Device model : RPi 3 Model B+ (armv7l)
 - Uptime : up 0 minutes
 - CPU temp : 46'C : 114'F (Optimal temperature)
 - LAN IP : 192.168.0.12 (eth0)
 - Info Text : !!! DEMO 32bit !!!
 ─────────────────────────────────────────────────────

can you check inside dietpi-banner if CPU temp is checked

 ┌───────────────────────────────────────────────────────────────
 │ Please (de)select options via spacebar to be shown in the :   
 │                                                               
 │    [*] 0   Device model                                       
 │    [*] 1   Uptime                                             
 │    [*] 2   CPU temp                                           
 │    [ ] 3   FQDN/hostname                                      
 │    [ ] 4   NIS domainname                                     
 │    [*] 5   LAN IP                                             
 │    [ ] 6   WAN IP                                             
 │    [ ] 7   Freespace (RootFS)                                 
 │    [ ] 8   Freespace (userdata)                               
 │    [ ] 9   Weather (wttr.in)                                  
 │    [*] 10  Info Text                                          
marcelloinfoweb commented 3 years ago

for me it is working well on my RPi3B+

─────────────────────────────────────────────────────
 DietPi v7.1.2 (dev) : 02:37 - Wed 04/28/21
 ─────────────────────────────────────────────────────
 - Device model : RPi 3 Model B+ (armv7l)
 - Uptime : up 0 minutes
 - CPU temp : 46'C : 114'F (Optimal temperature)
 - LAN IP : 192.168.0.12 (eth0)
 - Info Text : !!! DEMO 32bit !!!
 ─────────────────────────────────────────────────────

can you check inside dietpi-banner if CPU temp is checked

 ┌───────────────────────────────────────────────────────────────
 │ Please (de)select options via spacebar to be shown in the :   
 │                                                               
 │    [*] 0   Device model                                       
 │    [*] 1   Uptime                                             
 │    [*] 2   CPU temp                                           
 │    [ ] 3   FQDN/hostname                                      
 │    [ ] 4   NIS domainname                                     
 │    [*] 5   LAN IP                                             
 │    [ ] 6   WAN IP                                             
 │    [ ] 7   Freespace (RootFS)                                 
 │    [ ] 8   Freespace (userdata)                               
 │    [ ] 9   Weather (wttr.in)                                  
 │    [*] 10  Info Text                                          

I didn't know this "dietpi-banner" command, thanks !!!

MichaIng commented 3 years ago

But also I accidentally switched the defaults. On a VM, the temperature should have not been shown by default (since a VM cannot know it). Now it is correct: https://github.com/MichaIng/DietPi/commit/4513a8446178fd78c6f9132056f8ee0367f83b2c

MichaIng commented 3 years ago

Beta v7.1.2 has been merged: #4308

MichaIng commented 3 years ago

DietPi v7.1 has been released: #4305

Many thanks to all testers ❤️!