Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pd 1068 acme dns authenticators 13.3 #2702

Merged
merged 9 commits into from
May 1, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions content/CORETutorials/ChangingDefaultShell.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ The default shell for an account is the environment that user accesses in a loca
The default shell for a new installation is `zsh`.

You can change the default shell in **Accounts > Users**.
1. Click <i class="fa fa-chevron-right" aria-hidden="true"></i> for the root user and click **Edit**.
1. Click <i class="fa fa-chevron-right" aria-hidden="true"></i> for the root user and click **Edit**.

![AccountsUsersEditRootShell](/images/CORE/Accounts/AccountsUsersEditRootShell.png "Shell Options")

2. Choose the desired shell from the **Shell** dropdown list and click **SAVE**.
**Shell** options are:

{{< include file="archive/COREshellOptions.md" >}}
{{< include file="/static/includes/COREshellOptions.md" >}}
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,13 @@ Go to **System > ACME DNS** and click **ADD**.

![SystemACMEDNSAdd](/images/CORE/System/SystemACMEDNSAdd.png "ACME DNS Add")

Name the authenticator, choose a DNS provider, and configure any required **Authenticator Attributes**:
Name the authenticator.
Leave **Authenticator** set to **Route53**.
Enter the **Access ID Key** and **Secret Access Key** from Amazon.

{{< hint type=note >}}
The Route 53 Amazon DNS web service requires entering an Amazon account **Access ID Key** and **Secret Access Key**.
See the [AWS documentation](https://aws.amazon.com/premiumsupport/knowledge-center/create-access-key/) for more details about generating these keys.
{{< hint type=note title="Supported DNS Providers" >}}
Amazon Route 53 is the only supported DNS provider in TrueNAS CORE.
See the [AWS documentation](https://aws.amazon.com/premiumsupport/knowledge-center/create-access-key/) for more details about generating the **Access ID Key** and **Secret Access Key**.
{{< /hint >}}

Click **SUBMIT** to register the DNS Authenticator and add it to the authenticator options for ACME Certificates.
Expand Down
11 changes: 8 additions & 3 deletions content/CoreSecurityReports/SMB1Advisory.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,17 @@ weight: 10

**Do not use SMB1**

SMB1, also known as SMBv1, is an early version of the Windows SMB file-sharing protocol. [Microsoft has deprecated the SMB1 protocol for security reasons and strongly recommends removing SMB1](https://support.microsoft.com/en-us/help/4034314/smbv1-is-not-installed-by-default-in-windows). SMB1 is disabled by default in FreeNAS and TrueNAS. Current SMB networking clients use later versions of the SMB protocol.
SMB1, also known as SMBv1, is an early version of the Windows SMB file-sharing protocol. [Microsoft has deprecated the SMB1 protocol for security reasons and strongly recommends removing SMB1](https://support.microsoft.com/en-us/help/4034314/smbv1-is-not-installed-by-default-in-windows).
SMB1 is disabled by default in FreeNAS and TrueNAS.
Current SMB networking clients use later versions of the SMB protocol.

Microsoft maintains a list of [older products that still require SMB1](https://blogs.technet.microsoft.com/filecab/2017/06/01/smb1-product-clearinghouse/).

Windows Explorer (File Explorer) does not need SMB1, or a separate protocol called NetBIOS (sometimes called "NetBIOS over TCP/IP"), to discover and list SMB shares from a TrueNAS server. All modern versions of Windows use a newer protocol called WS-Discovery, which is more reliable and faster. TrueNAS automatically enables WS-Discovery to allow discovery of SMB shares by client devices.
Windows Explorer (File Explorer) does not need SMB1, or a separate protocol called NetBIOS (sometimes called "NetBIOS over TCP/IP"), to discover and list SMB shares from a TrueNAS server.
All modern versions of Windows use a newer protocol called WS-Discovery, which is more reliable and faster.
TrueNAS automatically enables WS-Discovery to allow discovery of SMB shares by client devices.

**Do not enable SMB1 on FreeNAS or TrueNAS without understanding the security implications and taking measures to protect the network from those risks.** Contact the vendor of older products for upgrades to support newer, more secure versions of SMB, or replace older products with ones that do not require the security risks of SMB1.
**Do not enable SMB1 on FreeNAS or TrueNAS without understanding the security implications and taking measures to protect the network from those risks.**
Contact the vendor of older products for upgrades to support newer, more secure versions of SMB, or replace older products with ones that do not require the security risks of SMB1.

**Do not enable SMB1** unless it is absolutely required for essential equipment that cannot be upgraded or replaced, the security implications are understood, and steps have been taken to protect the network from those security risks.
2 changes: 1 addition & 1 deletion content/UIReference/System/ACMEDNS.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ tags:
| Name | Description |
|------|-------------|
| **Name**| Internal identifier for the authenticator. |
| **Authenticator** | Choose a DNS provider and configure any required authenticator attributes. |
| **Authenticator** | DNS provider for the authenticator. Amazon Route 53 is the only supported DNS provider in TrueNAS CORE. |
| **Access ID Key** | Key generated by the Amazon Web Services account. See the [AWS Access Key documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) for instructions to generate the key. |
| **Secret Access Key** | Key generated by the Amazon Web Services account. See the [AWS Access Key documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) for instructions to generate the key. |
{{< /truetable >}}
3 changes: 2 additions & 1 deletion words-to-ignore.txt
Original file line number Diff line number Diff line change
Expand Up @@ -1955,6 +1955,7 @@ UIBugReport
COREshellOptions
Javascript
javascript
JavaScript
COREUIReference
CORERequiredFields
COREshellOptions
Expand Down Expand Up @@ -2021,4 +2022,4 @@ pathname
iSCSIShare
SharingStorage
Diskgraphs
msec
msec
Loading