Can i reboot server remotely?

[mrphillyblunt]

Total noob here, have had issues with my FreeNAS having issues and needing to be restarted, which got me thinking, what if I'm on the road, trying to access Plex or NextCloud and the server isn't working. Is there a way for me to easily reboot the machine remotely? Thanks in advance. Laymans terms appreciated...When I say noob, I mean TOTAL noob to the server world.

 

[iDenny]

You could use SSH to create a connection to your machine and then reboot it. However you put your security at risk when you open your NAS for the Internet. Otherwise, there are tons of clients (Win/Linux/iOS/Android, you name it) which may help you with that.

The second solution, even more retarded than the first one, is to open your internal network for the outside world, i.e. port-forwarding 80 port to your NAS. If you chose this solution, you may need to put IPS or IDS in front of your NAS.

 

[anodos]

You could use SSH to create a connection to your machine and then reboot it. However you put your security at risk when you open your NAS for the Internet. Otherwise, there are tons of clients (Win/Linux/iOS/Android, you name it) which may help you with that.

The second solution, even more retarded than the first one, is to open your internal network for the outside world, i.e. port-forwarding 80 port to your NAS. If you chose this solution, you may need to put IPS or IDS in front of your NAS.

VPN is a third and better option. The webui is not supposed to be exposed to the internet (even with an IPS / IDS).

 

[mrphillyblunt]

So, how exactly do I go about accessing it? What client would be good for windows and how do I setup my FreeNAS so I can access it via SSH (I have no securities set yet, nor will I have ANY sensitive info on the NAS. Again, total noob.

To anodos, how could I achieve it through VPN?

 

[mrphillyblunt]

Just downloaded PuTTY but have no idea what to do from here.

 

[iDenny]

So, how exactly do I go about accessing it? What client would be good for windows and how do I setup my FreeNAS so I can access it via SSH (I have no securities set yet, nor will I have ANY sensitive info on the NAS. Again, total noob.

To anodos, how could I achieve it through VPN?

Once again, it's not about your data, it's about your personal security. Anyway, in your home router, forward port 22 from the outside in to your NAS, e.g. "22 -> 192.168.1.33:22". When that is done, check your external IP-address (e.g. https://www.whatismyip.com). Use then your external IP-address to establish connection to your FreeNAS. There are tons of SSH-managers, e.g. http://www.putty.org/. If everything is OK, then you should be able to connect to yourself through the Internet.

anodos means that you can run a VPN server in your jail and then use it to securely reboot your main machine, i.e. FreeNAS.

 

[jgreco]

Once again, it's not about your data, it's about your personal security. Anyway, in your home router, forward port 22 from the outside in to your NAS, e.g. "22 -> 192.168.1.33:22".

No, you should never, never do this. Port 22 is scanned mercilessly on the public Internet, and leaving it open, unprotected, AND on port 22 is like putting a large "Kick Me" sign on your back while wearing a "Pwn me I'm EZ" T-shirt. At a bare minimum, pick a random port number to use for SSH port forwarding on the NAT gateway. Better is if you're using something like pfSense that can be set to automatically block repeated failed login attempts.

 

[iDenny]

Something like this:

And yes, it has been mentioned before, it is really bad idea to open your FreeNAS for the outside world.

 

[mrphillyblunt]

This is all gibberish to me...I'm truly fucked. I know this isn't complicated to you guys, but to me it is.

I wish there was a way I could just get one of you to set this up lol

 

[iDenny]

If you like some hardcore stuff, such as self-punishment, you may try to create a cronjob which will listen to any hard-coded port and if this port is pinged/contacted it will execute shutdown command (iptables rules).

Pros: wow, cool af, #hackerman
Cons: anyone can shutdown your FreeNAS using same address as you.

You better stick to setting up an OpenVPN server.

 

[iDenny]

This is all gibberish to me...I'm truly ****ed. I know this isn't complicated to you guys, but to me it is.

I wish there was a way I could just get one of you to set this up lol

Dude, https://lmgtfy.com/

 

[danb35]

With respect to our resident grinch, I'm not convinced that having SSH open, even on port 22, is such a terrible thing (as long as you're using public-key authentication rather than passwords), but it'd be better yet if FreeNAS would implement fail2ban or something similar. @mrphillyblunt, there are a few ways to do what you want to do, but it sounds like you'd need to do some research to make any of them work:

• Simply expose your web GUI to the internet. This will work fine, until you get pwned. DO NOT DO THIS. Even if you don't care about the data on your server, your system can be compromised and used to attack other systems on your network, or even other systems elsewhere.
• Use SSH with public key authentication. The configuration of both FreeNAS and your Windows machine is covered in Uncle Fester's Guide (among other places). You'll then need to forward a port from your router to your FreeNAS server.
• Use a VPN connection, ideally to your router. This requires your router to support acting as a VPN server, but if it can, this is probably the best and safest bet.

 

[anodos]

I personally forward [443 | 53 | 465 | etc] to 22. This allows me to bypass egress filtering on some annoying wifi networks. I still see monthly brute-force attempts.

 

[jgreco]

With respect to our resident grinch, I'm not convinced that having SSH open, even on port 22, is such a terrible thing (as long as you're using public-key authentication rather than passwords),

"That's right, because you can totally trust that there aren't any security vulnerabilities in well-audited encryption packages." <sarcasm />

https://www.theregister.co.uk/2017/..._brthis_week_unpatched_bug_in_openvpn_server/

http://www.securityfocus.com/bid/95814

https://www.openssh.com/txt/x11fwd.adv

OpenVPN, OpenSSL, OpenSSH. Not limiting ourselves to encryption, let's move on to the what-we-thought-was-well-understood area of stack vulnerabilities,

https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash

Linux, FreeBSD, NetBSD, etc.

Now here's the thing. What you really need to know is that there are Shodan style databases out there that show what's listening on what port, and so when inevitably some critical zero-day bug becomes known, the bad guys aren't probing the entire Internet to find out what nodes are running a suddenly-vulnerable version of something exposed to the Internet. They will already know where you are and what your weakness is, and they are in before you can patch it, or before you've even heard of it.

Do not port forward ssh from ${publicip}:22 to ${yournas}:22 unless you really don't care about your data. Even port forwarding a random port may be a bad idea. Some of the vulnerability search engines seem to be scanning semi-random ports, and with only 64K ports to try on your endpoint, this isn't really outside the realm of scan-ability for the bad guys, even for all four billion IP addresses on the Internet, and SSH announces what it is.

but it'd be better yet if FreeNAS would implement fail2ban or something similar.

I know the Linux community is in love with fail2ban, but sshguard is an incredibly lightweight compiled C program which can easily be run in realtime via syslogd. It doesn't suffer anywhere near as much mission creep as fail2ban, and costs really nothing to run. I would like to see everything implement sshguard, but it is really only a band-aid.

Security is all about convincing the bad guys to go bother someone else instead. A really dedicated intruder who wants into your specific network is going to be able to do that, one way or another. The rest of the time, setting up multiple layers of defense is a fairly good way to keep the bad guys out. For example, if you have to ssh into a DMZ network, where there are no tools available, it becomes much more difficult for an attacker to move further into your network using an attack on an inside machine.

Defending networks is hard.

 

[anodos]

Defending networks is hard.

Indeed. That's why we need vertex-based elliptic cryptography on N-way bojangle spaces. Network security is the continual process of discovering that the spaceship you put together from bedsheets and fireworks is a deathtrap.

 

[SweetAndLow]

How about fixing the problem instead of rebooting. Your system should never need to be rebooted and I mean never.

Hardware specs, FreeNAS version, symptoms, errors?

Sent from my Nexus 5X using Tapatalk

 

[jgreco]

How about fixing the problem instead of rebooting. Your system should never need to be rebooted and I mean never.

Hardware specs, freenas version, symptoms, errors?

With all due respect to the original poster, it sounds like there probably isn't a huge amount of interest in trying to debug and correct a problem that's happening in an add-on that isn't part of the base system. If rebooting the system causes the add-on to start working, at least for awhile, that requires much less technical skill than debugging a problem.

This doesn't thrill me, but it isn't a totally unreasonable solution. I remember the old days when a UNIX box that had been up for a month was considered "stale."

 

[styno]

I just run ssh on a random forwarded high port (and try to remember it). Once the ssh connection is established you can setup a tunnel for the web GUI (or plugin gui's) and go from there...

 

[scrappy]

I think the best answer here is none of the above at the moment. Not for a newbie user. There are many security repercussions a new user simply doesn't understand yet to suggest any sort of remote access to their LAN. This is something I believe a new user must educate themselves about thoroughly before attempting to poke any holes into their home network. I'd suggest reading up on SSH with public key encryption or a VPN. Make darn sure you're doing things correctly before attempting to remote access your home network.

 

[danb35]

I think the best answer here is none of the above at the moment.

Yeah, after reading OP's other thread I'm inclined to agree.