Topics

So in the 23.7.2 announcement it says Route53 was added as a backend to ddclient, and points to the 1.15 change log.  However, after upgrading, I do not see Route53 listed as a backend.  Is it pending an update to the front-end to expose it?

Is the policy matching rule evaluation listed somewhere?  I read through the documentation, but can't find how it actually combines evaluations.

I presently have it set to an interface, with a vlan specified, and then a specific subnet of IPs.

However, it seems to match all traffic on that vlan, ignoring the specified IP subnet.  I'd expect these to be evaluated with && not || - is that wrong?

With 1.14, there are two panes with seemingly redundant configuration options.

I use remote elastic DB - in settings->configuration, I configure the remote reporting database as elastic.

In settings->data management, I then configure it again, though slightly differently.

It appears to be working, except that in data management, it indicates that it isn't working with '200 remote database connection failed'.

I have data in the dashboard/reports/etc though, so I'm pretty sure it is working, and this configuration is just.. wrong? broken? does something else but has the same name?


Also, please get rid of the annoying sidebar balloons.  They're asking me to submit feedback every time I click on Zenarmor - my feedback is that is super annoying and also is not consistent with the OPNsense UI.  I have no interest in the cloud portal, which is why it's turned off.  Nagging me every single time I use it is not improving your situation there.

I don't have too much information to really provide on this.  However, when performing the upgrade to 23.1.7 today, it reached upgrading Zenarmor/os-sensei to 1.13.  At this point it gave a message that it was saving state as it was running, and then "Waiting for PIDs: ..." - at this point the opnsense system went entirely unreachable and stopped forwarding traffic entirely.  After waiting for several minutes in this state, I had to use out of band console to go in and kill all eastpect processes, at which point the OPNsense system functioned again.

So I think this is a topic that's come up before, but I can't seem to find an answer.

I have an upload_sftp automation set up which goes to an Ubuntu VM.  Testing the connection passes, but when I run the automation, nothing happens.  I see in the system log:

<13>1 2022-11-05T14:57:18-05:00 gwo opnsense 50444 - [meta sequenceId="3"] AcmeClient: running automations for certificate: <cn>
<13>1 2022-11-05T14:57:18-05:00 gwo opnsense 50444 - [meta sequenceId="4"] AcmeClient: running automation (configd): <cn> ssl dist

Nothing seems to happen at this point.  If I do a tcpdump on the interface it would go out, I don't see anything happen.  There are no further log messages.

If I run upload_sftp.php manually, it works fine.

root@gwo:/usr/local/opnsense/scripts/OPNsense/AcmeClient # ./upload_sftp.php --log --host=<cn> --user=ssldist --certificates=<cn>
INFO: Logging to stdout enabled
INFO: No host key specified, using existing known_hosts entry for '<cn>'
INFO: SFTP: Connected to <cn>.
INFO: SFTP: sftp> pwd
INFO: SFTP: sftp> cd '/home/ssldist/<cn>'
INFO: SFTP: stat remote: No such file or directory
INFO: Creating remote directory: /home/ssldist/<cn>
INFO: SFTP: sftp> pwd
INFO: SFTP: sftp> mkdir '/home/ssldist/<cn>'
INFO: SFTP: sftp> cd '/home/ssldist/<cn>'
INFO: SFTP: sftp> pwd
INFO: SFTP: sftp> ls -la
INFO: SFTP: sftp> put '/tmp/sftp-upload-AyaTmK' 'ca.pem'
INFO: SFTP: Uploading /tmp/sftp-upload-AyaTmK to /home/ssldist/<cn>/ca.pem
INFO: SFTP: sftp> put '/tmp/sftp-upload-Ws0HCw' 'cert.pem'
INFO: SFTP: Uploading /tmp/sftp-upload-Ws0HCw to /home/ssldist/<cn>/cert.pem
INFO: SFTP: sftp> put '/tmp/sftp-upload-5MZRRw' 'fullchain.pem'
INFO: SFTP: Uploading /tmp/sftp-upload-5MZRRw to /home/ssldist/<cn>/fullchain.pem
INFO: SFTP: sftp> put '/tmp/sftp-upload-e035Kt' 'key.pem'
INFO: SFTP: Uploading /tmp/sftp-upload-e035Kt to /home/ssldist/<cn>/key.pem
INFO: SFTP: sftp> exit

I can't seem to find a way to further debug why the automation fails - I would expect it to be using equivalent arguments to what I'm running, but they don't seem to be logged anywhere.  Any tips for why the automation would fail when the script works?