Security

[wave2453]

Hello,
I am attempting to stand up a FreeNAS VM on version 11.0-U4 (54848d13b). I need to get the machine to meet PCI requirements but, it is showing a lot of security errors with the system. Has anyone else run into this issue or have any advice on how to proceed. Some of the services are needing updated or edited and I was unsure how that would affect the system as a whole or future upgrades. I have uploaded a scan result showing the list of vulnerabilities we are finding.

 

[dlavigne]

Most of those should be addressed by 11.1 as it updated the base pkgs: https://bugs.freenas.org/issues/24885. If you find any remaining vulnerable pkgs in BETA1, you can create a bug report at bugs.freenas.org asking them to be updated.

 

[wave2453]

Is there a way to switch from STABLE to PRERELEASE. Is there any indicator when 11.1 will be in STABLE?

 

[SweetAndLow]

Is there a way to switch from STABLE to PRERELEASE. Is there any indicator when 11.1 will be in STABLE?

Don't run a beta on production servers or will not end well. The beta is for testing and planning only, imo.

https://forums.freenas.org/index.php?threads/freenas-11-1-beta1-now-available.58674/
FreeNAS 11.1-BETA1 Now Available | FreeNAS Community - FreeNAS forums

 

[wave2453]

In that case I probably can't run FreeNAS in my production if the STABLE model doesn't pass those security scans. Thanks for the help/advice.

 

[SweetAndLow]

In that case I probably can't run FreeNAS in my production if the STABLE model doesn't pass those security scans. Thanks for the help/advice.

Do any appliance like systems pass those scans?

 

[dlavigne]

Is there a way to switch from STABLE to PRERELEASE. Is there any indicator when 11.1 will be in STABLE?

Yes, you can switch to that train for testing.

Note that RC1 will be out momentarily and we're on track (barring any last minute showstoppers) to release RELEASE on Monday (Nov 6).

 

[wave2453]

Do any appliance like systems pass those scans?

None that I know of. For an appliance to stay on top of PCI requirements is no small feat. In the past I have just made file shares on Ubuntu boxes encrypted with EcryptFS to perform the task I needed.

 

[wave2453]

Yes, you can switch to that train for testing.

Note that RC1 will be out momentarily and we're on track (barring any last minute showstoppers) to release RELEASE on Monday (Nov 6).

Thank you for letting me know. SweetandLow makes a good point though that I shouldn't run the PRERELEASE as my prod box.