Plugins won't start after reboot

[Doug Hall]

I'm trying to configure a NAS for a friend, so when I went from my network (192.168.1.###) to hers (10.0.1.###), everything broke. So, I borrowed her Time Capsule so that everything would be set up according to her network settings. I changed the obvious network settings from the NAS console startup. The default gateway was probably the most important, but it wasn't the only place I needed to change that.

I can't get the plugins to boot up after I restart the computer. I had problems with the two plugins I had installed Plex and Owncloud), so I deleted my jail dataset and started over. I got EVERYTHING working, then tested my changes with a restart. No go. I notice that the volume is locked after the restart. Is this normal? Unlocking it with my passphrase still won't allow the plugins to start up, however. Help! Is there a log file somewhere that will help me debug this? The jails aren't running. >jls returns nothing.

Thanks for any help!

 

[Doug Hall]

I just tried again. When the system reboots, my encrypted volume is locked, so none of the datasets show up. The plugins can't start because the jails aren't there. WTF!

 

[cyberjock]

Yep. You have to go and mount the encrypted volume.

 

[Doug Hall]

So, you mean if the server ever goes down, I have to go over to my client's house, log in, unencrypt the volume and MANUALLY start the plugins which are supposed to start up automatically? Let me repeat. The jails don't show up. Nothing starts until I manually do it. Now her server is on a UPS, but this is ridiculous!

 

[cyberjock]

Yep. The solution: Don't put your jail on an encrypted pool.

 

[cyberjock]

Remember, every time you reboot you have to go and re-enter the key+passphrase to get access to the pool.

I'm really not sure why you are surprised by this. The WHOLE point of all forms of encryption is to limit access to the data...

 

[Doug Hall]

Oh yeah. Good point. I guess I encrypted it more so that she could just toss any drive that fails. The security of the entire machine never crossed my mind.

 

[cyberjock]

Oh yeah. Good point. I guess I encrypted it more so that she could just toss any drive that fails. The security of the entire machine never crossed my mind. :)

;)

You should do what many people do that want a jail and encryption. Just get 2 spare disks and do a ZFS mirror. Put the jail/plugins on that and you have no more problems. At least, not unless the jail/plugins go crazy when they can't access stuff that is on the encrypted pool.

 

[Doug Hall]

No more room (or money, for that matter). My friend's computer is slam full. I'm running 6 4TB NAS drives in a RAID-Z2. It's okay, though. I can teach her how to bring it back up.

 

[Dusan]

Oh yeah. Good point. I guess I encrypted it more so that she could just toss any drive that fails. The security of the entire machine never crossed my mind. :)

There's an easy solution then. You can enable encryption, but do not add a passphrase. Such pool will still be encrypted, but will automount.
See my explanation of how the keys work here: https://bugs.freenas.org/issues/2435#note-3

 

[cyberjock]

Be warned that the encryption key will be stored on the FreeNAS boot media. If that goes bad you WILL lose access to your pool forever. Not something I'd recommend you do.

 

[Dusan]

Yes, but that part of the key is always stored on the boot USB key, it doesn't matter if you use a passphrase or not. That's why you should backup it via GUI (the Download Key button).

 

[panz]

I think that this have to be resolved by the developers; the jails could be forced to seek their paths only after decryption occurs (BTW in my - I hope - temporarily installation of FreeNAS 8.3.2 I have to _reinstall_ the mini DLNA plugin every time I reboot the machine, otherwise there's no chance the plugin will work

 

[Doug Hall]

panz, and others, I have found how to easily restart the jails from the gui interface. After the NAS restarts, go to the "View Volumes" window, click on the locked volume and unlock it from the "unlock" button below. (This part you probably already know, because it's in the documentation.) At this point, the plugins have already tried to start up but couldn't because the volume was locked. Also, if you go to the Jails section, no jails are listed. Here's the trick: Open the jail configuration window, don't change anything, but click the "Save" button. At this point, the jails appear, and you can start each of them right from the list, using the green lantern start button, below the list. Without going through the Jail configuration window, the jails never appear, and you'd just have to reinstall them, as panz said. It's probably a good idea to set the plugins to NOT automatically start, if your volumes are already locked with a passphrase.

 

[panz]

Good point, I've figured this yesterday :)

But this is a server, I don't like to do too much things to start it ;) Automation, automation, automation... this is the thing computers do better!

 

[Doug Hall]

I personally think changing the documentation and advice, would have done the trick. What I read was that you need to create a key and a passphrase. Period. So, that's what I did. What should have been said is:

You need to generate a key and keep one or more backups of this key. If you want to protect the contents of the entire volume, for example, if the server is stolen, then you need to also apply a passphrase to the volume. Doing this will prevent the volume from automatically being decrypted whenever the server starts.