Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Messages - EJocys

#1
@cookiemonster: My suggestion: diagnose the service failure. That is one real solution.

It's a solution, but not viable for a firewall, because it leaves thousands of systems vulnerable. Product already failed if consumer is forced to diagnose manufacturers' product. Microsoft has solved this problem with a solution that actually works in real life. Backup/alternative systems are essential. OpnSense developers just have to copy the solution, already provided by the most successful multi-billion dollar company with decades of experience in the operating system market.

@franco: What's wrong with using monit to do it and provide an update to the documentation for it if it's a must have?

"using monit to do it and provide an update to the documentation" and not providing a good out-of-the-box solution is exactly what's wrong :). The solution must be integrated and activated by default in the product and not in the documentation. Users prefer an out-of-the-box solution because the majority don't have skills or want to spend time reading documents and solving problems. Providing good out-of-the-box solutions is why Windows is always far ahead of Linux/BSD in terms of operating system market share.

Sure, I could figure out how monit works and update the OpnSense documentation, but I have hundreds of problems in my own projects and I'd rather fix my problems first. Like most consumers, I prefer the "set it and forget it" solutions :).
#2
I really tried to like OPNSense, but as a firewall it turned out to be an unreliable and dangerous out-of-the-box solution.

PROBLEM: The Suricata service stops constantly and leaves the internal network vulnerable.
This is because OPNSense doesn't seem to have service recovery enabled for important services by default and the Monit function just doesn't provide an easy solution, i.e. it requires the user to look up documentation and the documentation doesn't provide a clear and simple example how to reboot failed service.

SOLUTION: Microsoft did a very smart thing and enabled service recovery for important services out of the box on all of its operating systems. Also, Microsoft added a very easy to understand [Recovery] tab for each service. For example, "Microsoft Defender Antivirus Service" has maximum service recovery options enabled:

First Failure: Restart the Service
Second Failure: Restart the Service
Subsequent failures: Restart the Service
Reset fail count after: 1 days
Restart service after: 0 minutes

Please, add service recovery out of the box. For example: Services / Monit / Recovery
List all the services here, with pre-configured and basic recovery options to modify.

P.S.: A good system should try to counter the mistakes of others, that is, faulty services, and do everything possible to protect the user out-of-the-box.