Is it normal to have this many unRAID upgrades?

[wayner]

I assumed that with an unRAID server that I would have months of uptime on the server. But I have been running unRAID for less than a month and I now see the third unRAID OS upgrade (6.3>6.31>6.32). If I stay on top of these then I am updating the OS and rebooting pretty much every week.

Is this unusual or is there normally an upgrade every week or two?

And is it recommended to upgrade or is it not a big deal to let it slide for a few months.

My Win7 desktop is now at 103 days and I know I should run the upgrades but I don't want to shut the machine down.

[EnterNoEscape]

I just upgrade when it's convenient. 6.3 is still a fairly new release so the updates will be frequent. They have a tendency to die down after a while, but there isn't really a rhythm to it. The biggest reason to update is of course bug fixes, but another really good reason to upgrade is if you're interested in the latest kernel security fixes.

[stuckless]

I have 59 days of uptime with unRAID (that's likely when I last updated)... just because there is a new release, doesn't mean that you need to take it. Same with any kind of system, really. I will sometimes look at the updates, and if I see something in the update that I think would be good for me, then I'll take it.

I'm running 6.2.3.

I do intend to do an update at some point, but I haven't found the time, yet In theory it's a few minutes, but I won't upgrade unless I know I can afford the time to troubleshoot, if I have to.

EDIT: If my system was directly exposed to the internet, I'd probably do the updates as they happen, simply because of the security updates.

[wayner]

Originally Posted by EnterNoEscape

The biggest reason to update is of course bug fixes, but another really good reason to upgrade is if you're interested in the latest kernel security fixes.

If you don't expose your system to the internet then do you have to worry about this? My system is available externally via VPN but I don't forward any ports for my unRAID server.

[EnterNoEscape]

Originally Posted by wayner

If you don't expose your system to the internet then do you have to worry about this? My system is available externally via VPN but I don't forward any ports for my unRAID server.

Just because you are behind a router doesn't mean your network is a safe place. There are plenty of things that could be going on with your network that you wouldn't even be aware of. Just think about how many IoT devices are a part of botnets and the owners are still completely oblivious to it. Security updates matter.

[wayner]

Originally Posted by EnterNoEscape

Just because you are behind a router doesn't mean your network is a safe place. There are plenty of things that could be going on with your network that you wouldn't even be aware of. Just think about how many IoT devices are a part of botnets and the owners are still completely oblivious to it. Security updates matter.

Comments like this make me worry about going to IPv6 in the future. I have heard folks say that NAT isn't really a security feature, but if every device on your LAN is exposed to the internet then surely there are more risks if the security on the device is poorly implemented like the webcams that you are referring to.

[EnterNoEscape]

Originally Posted by wayner

Comments like this make me worry about going to IPv6 in the future. I have heard folks say that NAT isn't really a security feature, but if every device on your LAN is exposed to the internet then surely there are more risks if the security on the device is poorly implemented like the webcams that you are referring to.

I had a candid conversation about IPv6 with my manager recently. We both agreed that it's a little scary when you think about it. Also I don't see why v6 is desirable on any internal network. I would really prefer internal networks to continue with v4 and the internet can be all v6 with the router doing the translations. My impression is that all it does for you is increases your chances of being hacked.

[KarylFStein]

Originally Posted by wayner

Comments like this make me worry about going to IPv6 in the future. I have heard folks say that NAT isn't really a security feature, but if every device on your LAN is exposed to the internet then surely there are more risks if the security on the device is poorly implemented like the webcams that you are referring to.

Enabling IPv6 on your home network doesn't automatically open all your devices up to direct connections from the Internet. I run IPv6 at home, (although not everything supports it e.g. unRAID ). My perimeter security works the same as with IPv4 meaning I still need to enable access to IPv6 endpoints through a firewall.

The IoT issue has nothing to do with IPv6 and EnE is right that you should treat your home network as suspect. If one thing is compromised it could be used as a launchpad to compromise other things. If you can view your home webcam when away from home something is allowing that channel and NAT won't help.

[wayner]

Originally Posted by KarylFStein

If you can view your home webcam when away from home something is allowing that channel and NAT won't help.

I can view my webcam away from home but that is because I manually forward ports to do so. But I make sure that I change the default password to a strong password.

But I know what you mean about the devices that are easy ports of entry into your LAN. Playing around with Shodan for a few minutes shows you this. I bet in less than 5 minutes you could find SageTV web servers open to the internet with the default sage/frey combo.

[KarylFStein]

Originally Posted by wayner

I can view my webcam away from home but that is because I manually forward ports to do so. But I make sure that I change the default password to a strong password.

But I know what you mean about the devices that are easy ports of entry into your LAN. Playing around with Shodan for a few minutes shows you this. I bet in less than 5 minutes you could find SageTV web servers open to the internet with the default sage/frey combo.

To take this further: what if the webcam/SageTV/etc. piece that validates your password has a flaw where you could bypass the checks by e.g. sending a password with unprintable characters in it? In that case and many like it a strong password is moot. Once a flaw like that is somewhat public they are just as an easy point of entry as default passwords on devices.

I'm just sayin' that IPv6 should not be the concern.

[EnterNoEscape]

Originally Posted by KarylFStein

Enabling IPv6 on your home network doesn't automatically open all your devices up to direct connections from the Internet. I run IPv6 at home, (although not everything supports it e.g. unRAID ). My perimeter security works the same as with IPv4 meaning I still need to enable access to IPv6 endpoints through a firewall.

The IoT issue has nothing to do with IPv6 and EnE is right that you should treat your home network as suspect. If one thing is compromised it could be used as a launchpad to compromise other things. If you can view your home webcam when away from home something is allowing that channel and NAT won't help.

I have not used IPv6 in my house, so I had not considered that you would just use a firewall instead of NATing. Is that the typical setup?

I was not associating the IoT thing with IPv6. The standard just came up so I commented on it.

[KarylFStein]

Originally Posted by EnterNoEscape

I have not used IPv6 in my house, so I had not considered that you would just use a firewall instead of NATing. Is that the typical setup?

I was not associating the IoT thing with IPv6. The standard just came up so I commented on it.

I can't speak to what's typical. My off-the-shelf router/firewall had a default "deny all" rule for IPv6, which I would expect (hope) is typical. When it negotiates IPv6 with my ISP (Comcast), it gets a prefix ("block") of addresses. My devices then create IPv6 addresses based on the prefix that Comcast gave me and their MAC address. My router/firewall then has a screen for IPv6 rules which is just like the one for IPv4 except without NAT options. So I say something like port 80 on this (exceptionally large) IPv6 address is allowed through. Cut and paste is needed for the IP address . This for example is my web server: 2601:40f:4101:ee18:682a:8ea9:5d77:7bcc.

[wayner]

I guess the other question on this is how your ISP deals with IPv6. Presumably they will give you a block of IP addresses, anyone know what the expectation is, will you get assigned something like 2^16 IP addresses? And will they all be static?

[KarylFStein]

Originally Posted by wayner

I guess the other question on this is how your ISP deals with IPv6. Presumably they will give you a block of IP addresses, anyone know what the expectation is, will you get assigned something like 2^16 IP addresses? And will they all be static?

You want no bigger than a 64bit prefix (/64). This is because stateless address allocation needs the remaining 64 bits. People may prefer a slightly smaller prefix like /60 so they can have multiple subnets. It looks like Comcast is giving me a /64. I imagine an ISP wouldn't go with anything larger because it would break stateless allocation.

I doubt that the prefix is guaranteed to be static unless you have some business-class package. That said, mine hasn't changed in the past year or so when I implemented IPv6. The host part for stateless is (I believe) usually just the MAC address, so that wouldn't change unless you changed hardware.

You don't have to use stateless and can assign with DHCP instead.

[KarylFStein]

Well, I just checked and it turns out my prefix HAS changed . That's annoying because it means having to change all the firewall rules and DNS configurations. Plus it looks like Comcast doesn't yet support static IPv6 prefixes even for business class, (not that I use business class). Good thing I'm just using IPv6 for my own amusement...

[wayner]

What the F is the reason to ever change your prefix over than as a way of trying to force you to buy a more expensive service? I could maybe understand it if IPv6 is still in the beta phase and they are trying to figure out how to assign prefixes to customers, but that is about it.

Aren't there enough IPv6 addresses that the ISP doesn't have to worry about recycling them?

[KarylFStein]

Originally Posted by wayner

What the F is the reason to ever change your prefix over than as a way of trying to force you to buy a more expensive service? I could maybe understand it if IPv6 is still in the beta phase and they are trying to figure out how to assign prefixes to customers, but that is about it.

Aren't there enough IPv6 addresses that the ISP doesn't have to worry about recycling them?

Beats me. I'm guessing it was easier to set up this way. Next time I reboot my router I'll try to remember to check if the prefix changes, (may be part of the negotiation). Just poking around on some forums I see Comcast saying that static prefixes are coming, (guessing for business class). And also it seems Comcast is not the only one doing dynamic prefixes and annoying users.

[stanger89]

Since we're talking security, anybody putting IoT devices on a separate VLAN? Is it worthwhile? Is it a good idea?

[wayner]

In many/most/all instances don't you want to be able to talk to those IoT devices from devices on your LAN?

Off the top of my head I have the following IoT devices: IP cams, irrigation controller, garage door controller, LED light strip controller, Hue lighting controller.

In every instance I will want to access these devices via a web UI from PCs on my LAN or via mobile devices like my iPhones/iPads. Plus many of these devices integrate with my HA controller, so they at least have to be able to talk to it.

[EnterNoEscape]

There are devices that do everything through the Internet. Those would be good candidates for isolation.