Moogle's 4.3.5 beta test diary

[Moogle Stiltzkin]

I prefer journaling my own thoughts and review for 4.3.5 in my own thread so i don't spam other peoples.

If you want to make a short comment about your own experiences, you can post them in the main 4.3.5 thread over here
viewtopic.php?f=151&t=143255#p683283

also if you encounter bugs, don't forget to post that to helpdesk
https://helpdesk.qnap.com/



So installed the QTS 4.3.5.0683 build 20180830 Public Beta ( 2018/08/30 )
https://www.qnap.com/qts/4.3.5/en


*update
QTS 4.3.5.0684 build 20180831 Public Beta





noticed a bunch of notifications, some of it is stuff like migration and fixing some errors during migration. anyway... wanted to start from scratch to avoid a patchwork of a migration that may or may not be doing things cleanly (no idea about that)

1 - after updating to 4.3.5.jpg

did a factory reset here (did backup previously of course. doing reset will wipe your data. so i don't recommend doing this without backups. also 4.3.5 is beta, so just do backups period )

2 - reset NAS.jpg

but that was not sufficient, and a reinitialization was required to truly wipe everything. so did reinitialization next.

the reinitialization was pretty straight forward, and when it finally completes, you then are greeted in QTS with some pop ups. You only deal with them once so no big deal. It at least tells you all the first things you ought to know anyway, then can close and make it not bother you again with the same message.

The most important first thing to do (cause you need to set it up and wait for it to complete raid syncing before actual use), is the storage manager setting up your volume/pools. That too was a rather easy process.

I created my first volume selecting the 4x4tb as thick vol raid5

4 - after reinitialization p2.jpg

there are resources online like this for example that will help you decide on your setup

From Youtube.com


but it felt that the sliders in QTS for setting up was quite sufficient for explaining your choices.


maybe it is also better to adjust the sync to take priority so that it gets done soonest. then later on i can change it back to medium setting.

11 - storage manager p3.jpg

in storage manager, usually by default the qnap suggests 50% utilization of your total usable space. i set aside 5% for snapshots (by going to snapshots and setting the reserve option). then after that, when i first created the pool/volume setup, i max allocated the rest for the pool/vol since i did actually need all of it.

the down side of doing this is, i cannot unallocate the space already allocated. so i need to be very certain about this allocation before i commit to it.

If later i need more space, i can unallocate the reserved space for snapshots and disable that feature. But if i get to that point, thats already a big warning sign that i would be better off adding another 4tb hdd and expand my storage. I got 2 bays extra for that, so i am future proofed for expanding my storage as my requirements may change later on.







Beta testing checklist - last updated, 4.9.2018
// just a checklist of things i've already tried and tested myself

1. myqnapcloud - works (also tested with lets encrypt https, and photo station service remote access. Also tested photo station sharing center to view shared gallery. everything working fine)
2. video station - works (also tested live transcoding with graphics card. also tested the media add on for front cover poster thumbnails. Though i'm not sure that graphics acceleration for transcoding is working fully)
3. photo station - works (facial media add on does not work properly .. )
4. cloudlink - works
5. notification center - works
6. security counselor - works (a bug though with high risk yet report shows no mention of high risk item. misinformation bug?)
7. virtual station - works
8. storage manager - works
9 reinitialization - works
10. plex - works
11. qvpn - works (tested connecting to PIA VPN. To verify it works, i used download station and downloaded a magnet on an ipleak site to confirm the ip i get is from the vpn. I also tested from myqnapcloud to see that the registered device is also using the vpn ip. However have to ensure that ipv6 is disabled in the virtual switch settings to prevent ip leak. could not test qbelt because i only have 1 machine with qts 4.3.5 also the windows and android qbelt client app is not yet available)
12. virtual switch - works (however in overview, there was a temporary yellow/pink hue flash of the qnap model graphic when refresh on overview. Is a minor bug)
13. download station - works
14. hybrid backup sync - works (tested restore job from TS-653a and a TS-509 Pro to the TS-877)
15. snapshots - works
16. hd station (using hdplayer accessed via the remote RDP VNC. works, even tested plugging in aktimate mini speakers, and sound gets correctly outputted through them)
17. ssd profile tool - works
18. ssd over provisioning - works
19. scan hdd for bad blocks - works
20 - run smart test short and long - works
21. do network performance test - works ( https://github.com/adolfintel/speedtest and also with iperf )
22. qboost - i'm not sure that this is working properly. because i still had swap memory even after i ran optimize memory. had to reboot to fix my issue. i suspect qts 4.3.5 has memory leak issues somewhere.
23. qsirch - works
24. multimedia management - works kinda (but i'm not sure that the items being scanned shows proper number of items being processed correctly when you view from multimedia management UI in QTS. I'm also getting thumbnail generation errors every now and then during a scan. this seems to be an ongoing issue i've been experiencing)
25. update qts - works (however i may have noticed a louder fans or hdd noise not sure which, while it was updating from QTS 4.3.5.0683 to QTS 4.3.5.0684 was a bit concerned )
26. test media playback with mpc-hc for windows 10 pc via samba - works
27. add login to win 10 credential manager and access to QNAP via samba - works
28. complete beta test program a - done
29. complete beta test program b - done
30. add third party repository in appcenter - works (even managed to install some apps that also are working such as onecd's autosort and nobanner in appcenter qpkgs)
31. app center - works (but i did notice the nvidia app in appcenter has a skull mark. removing it and installing nvidia driver app made that issue go away though)
32. spotlight - can't test this, i don't have a mac
33. report problems to helpdesk - done
34. locate nas - works (new music tunes working, also the led lights flashes correctly as well)
35. login with ssh winscp putty - works
36. resource monitor - works (temperature readings seem to be okay as well as far as i saw)
37. creating shares - works
38. encrypting shares - works (locking and unlocking encrypted shares works. Rebooting also auto locks shares, also works)
39. smart test and temperature scheduling set for all hdds - works
40. schedule and run raid scrubbing - works

[Moogle Stiltzkin]

changing your password from default early on is also a good idea. but even better is to perhaps use the new app security counselor you can install from the app center, and use that to run through a checklist of security issues you ought to deal with early on during your new QNAP setup.

13 - security counselor.jpg

you can select from these, i just used the default since i am not familiar with it. so try out default first then modify it later.

13 - security counselor p2.jpg

13 - security counselor p6.jpg

13 - security counselor p7.jpg

before there was security counselor, i had to run of the top of my head a mental list of what i may have forgotten to edit for my security settings. no longer. now you got this app where you can configure the checklist for you

it not only tells you the severity of the item not secure, it also lets you click on it and bring you straight to the QTS setting for it to make the adjustment to secure it.

However i did notice one warning about NFS allowing access by all ip. But it brought me to the share to configure. But what i did instead, was go to services, and disable NFS (because i don't have any other linux machines requiring NFS).

i re-ran the scan still says the same, so no idea. maybe i need to configure the security for restricted lan ip via a whitelist? there is also the share access priviliges which seemed okay to me.



*update

maybe found a bug. I ran scan, and in notifications it says it found high risk in security. but when i went to see the report, it only shows medium. So that notification warning does not match with the report so is a bug



*update

by the way the security counselor scheduling is either daily, or weekdays or weekends..... i don't mind scheduling but i wish it could do weekly or monthly. i don't like running too many active scheduling stuff so often.




"the nas doesn't allow the installation of non-qnap store apps." what it is trying to say is, enabling installing non qnap store apps is insecure. and that this highlight is an active part of the checklist. is the wording clear or is there something better?

I felt if it had simply said that "installing non-qnap store apps is enabled" would have sufficed. Then when you browse to the setting, it explains why that is a bad idea.



*update

did more testing with the counselor.

First, i use the basic policy to get familiarized with it.

Next i went through the checklist of security stuff i need to secure based on scan. and what i felt was excessive for my requirements, i later changed to a custom policy.

my issue here is, why not make the items unselectable from the scan? instead... i got to go back to the policy setting and scroll through the list, to find the item then untick from there. after having to search through a block of txt to find that entry bit inconvenient.

next it will suggest changing settings to conform to that policy, which you can apply or untick from executing those changes, but merely have the policy scan available, which is nice and exactly how i want it to be.


i found one bug, that after i apply the new custom config and made sure to tick enable to change settings when i apply new security policy, i ran the scan and the NFS allow all ip is still showing as insecure, meaning that it didn't manage to apply the correction in the setting right?

nfs security counselor bug.jpg

[OneCD]

before there was security counselor, i had to run of the top of my head a mental list of what i may have forgotten to edit for my security settings. no longer. now you got this app where you can configure the checklist for you

Security Counselor looks like a great idea.

I added the iThemes Security plugin to my WordPress installation, and it has a similar function called 'Security Check'. Great for those (like me) who may not realise their setup has the wrong bits exposed until they're hacked (which hasn't happened yet).

[Moogle Stiltzkin]

Security Counselor looks like a great idea.

I added the iThemes Security plugin to my WordPress installation, and it has a similar function called 'Security Check'. Great for those (like me) who may not realise their setup has the wrong bits exposed until they're hacked (which hasn't happened yet).

yeah i had wordpress plugins that did something similarly too a security checklist applies quite well to lots of other things.

[Moogle Stiltzkin]

Myqnapcloud dyndns (and photostation service app accessed through it remotely)

I also tested and confirmed myqnapcloud working on 4.3.5

lets encrypt https green lock also confirmed working.

i did not use upnp, so had to manually port forward ( i don't like upnp, despite it being convenient). the bare minimum i needed was to port forward 443 in order to get the myqnapcloud url to work properly. you can of course modify that port to something else if you prefer something else.

in myqnapcloud you can adjust your settings for public or private depending on what you require.


for apps like photostation, i had to navigate to myqnapcloud then go to the services tab to get the photostation option from there the smart url which then offers the full list of urls to pick from. i managed to get the direct photostation url i needed to test, which worked.

9 myqnapcloud p13.jpg

in qnap you can view your pics like this using photostation (yes remotely using your myqnapcloud dyndns)

photostation gallery.png

i also tested creating a shared album. This is the url i can see from a list of options

Code: Select all

https://"your ID".myqnapcloud.com/photo/share/?sid="some random code"

Then you get this

photostation gallery2.jpg

photostation gallery3.jpg

You can opt to use a password login or not, it's up to you. and you can set the share to expire or exist indefinitely.


photostation viewing options:
you have 2 methods.
- login to photostation via myqnapcloud and view as per normal.
- login to the shared link (and browse that way)

*pre-requisites to get myqnapcloud setup and accessible

- setup a myqnapcloud account
https://www.qnap.com/en/how-to/tutorial ... d-service/

- manual port forwarding or upnp setup. you need to enable in both QNAP QTS cloudlink, as well as on your router, if you want to use this. Personally i did not use it. Instead i simply just port forward 443, thats all. maybe some more ports like 80, 8080 etc based on what service you want to access, if it doesn't work with just 443.

- network security needs to either allow all ip, or to add your wan ip into the whitelist. I use vpn, so using a whitelist isn't going to work well because my ip is random. so i had to disable this to get myqnapcloud dyndns to work.

9 myqnapcloud p11.jpg

- enable the services apps. like photostation etc from appcenter.

- in qts cloudlink > myqnapcloud > publish services then tick to enabled from checklist your app to publish e.g. photostation. For non public use, i recommend enabling private.

- also in cloudlink myqnapcloud, setup the access control. private if just for yourself. customized if you want to be able to invite your friends by their email address.

- setup ssl from cloudlink myqnapcloud. I use the free lets encrypt which is integrated into QTS and works with the myqnapcloud dyndns because it's free.

- setup access code

What is an Access code? How do I set up my Access code?
The myQNAPcloud web site shows all of the published services of your QNAP devices by default. If you would like to show published services only to specific users, you may set up an Access code. To do so, please use myQNAPcloud in your QNAP device and set the published services as private services.

https://support.myqnapcloud.com/faq/wha ... de?lang=en

- if you want to access your myqnapcloud services through VPN securely, there is also the myqnapcloud connect app which is able to do so via VPN. your QNAP QTS and the myqnapcloud connect app vpn settings both need to be configured.

few things i noticed about myqnapcloud, things that may make the myqnapcloud dyndns not work
- using qvpn and setting PIA VPN as gateway (disconnecting vpn and setting back to default gateway fixes it)
- QTS security network filter using whitelist (setting to allow all ips fixes it)
- if you don't port forward 443 (if you portforward it will fix this issue)



I also question about the effectiveness of the network connectivity detection

9 myqnapcloud.jpg

it's ecstatic if you opt to use upnp for auto configuration. But if instead you choose to manual port forward, it doesn't want to rely work with you at that point. It didn't want to acknowledge that internet connectivity works as i did test photostation myqnapcloud dyndns as functional. yet the web connectivity does not resolve to acknowledge that as working.

QNAP could definitely improve on this to improve their connectivity checks and to report whether it is functional or not.

another weird thing is, upnp auto configuration. In that window you can view all the service ports used by all the QTS services. But .... the problem is... if you untick upnp port forwarding, it will hide these port numbers and tables from your view. So just because i refuse to use upnp, it is then punishing me by not letting me view the tables of all the service ports needed by these services (so i can then manually port forward myself). Why do this? :/

also i may not open all ports since i don't use all the services, but why not run a check and let me know which ports are indeed working (via manual port forward. I'm not asking it to auto configure for me, i simply want it to check if the port forward i manually set is functional or not, thats all).




tested myqnapcloud changing the access control there, will also change your setting in QTS access control as well. that is working.

[Moogle Stiltzkin]

setting up hybrid backup sync is also one of the other things i do early on. at least to be ready by the time raid sync completes.

14 - hybridbackupsync.jpg

the soonest i do a restore from my backup QNAP the better.


I setup a restore plan in HBS. but before that, i make Shares exactly the same as my backup NAS. Then i restore the contents to the matching shares. And when that completes, i disable restore, so it does not overwrite my main NAS.

From hence forth, i will setup and use a backup plan instead which is now going in the other direction.

ETA 1 day to restore from backups



*update

Hybrid backup sync completed recovery from backup NAS.

14 - hybridbackupsync p4.jpg

14 - hybridbackupsync p5.jpg

could not download detailed logs, it wasn't enabled



just to double check whether it recovered correctly, the number of folders and files matches.

TS-877

14 - hybridbackupsync p6.jpg

TS-653A

14 - hybridbackupsync p7.jpg

also did a random file check, no issues either

crc.jpg

Tested some files e.g videos and music, all worked fine. in fact i had a foobar2000 music playlist that could just play without issue as if there was no downtime (because i recovered to the exact same file pathing structure as originally, so playlist worked just fine). So QNAP recover works great


So since the recover job is complete, i then disable the job, so i don't accidentally click restore. So from now on, all my new files get stored on the TS-877, then will be backed up to the TS-653A. So i have to create a new backup job for that later




hm... this is new. I got a server busy or network disconnected message only thing i am doing is running a recover job from a TS-509 Pro to TS-877 atm. Also playing a video file to watch while i wait for it to finish. Anyway, i click the okay, then the reload and it logs back into qts. i then check HBS there doesn't seem to be any issues mentioned, and it is still running. Then i also checked the resource monitor to see what the system load is like, it looks okay.

server busy.jpg

server busy 2.jpg

[Moogle Stiltzkin]

the new qvpn with the graphics network topology providing a much insightful preview of your networking layout.

and of course the mysteriously new qbelt vpn protocol

QBelt
QBelt is a proprietary communications protocol incorporating DTLS and AES-256 encryption to ensure connections to your QNAP NAS are kept secure

Datagram Transport Layer Security (DTLS)
DTLS is a derivation of SSL protocol. It provides the same security services (integrity, authentification and confidentiality) but under UDP protocol. DTLS is implemented by several projects including CyaSSL and the OpenSSL project.

History
This protocol was created to do that which SSL can't : to create a secure protocol under UDP. It's why this protocol is an adaptation of TLS 1.1

https://wiki.wireshark.org/DTLS

15 - qvpn.jpg

in qbelt options you can set the dns to use like dyndns, or the qnap default (which they recommend for vpn setup especially), or your own custom dns.

15 - qvpn p4.jpg

then for client devices, they want you to use their myQNAPcloud Connect app to be able to connect to the qvpn.

myQNAPcloud Connect is designed for Windows users to access the published services of the QNAP NAS quickly and securely over the Internet via VPN. Through myQNAPcloud Connect, you can easily manage files by drag-and-drop within Windows Explorer.

https://www.qnap.com/en/utilities/essentials


or am i mistaken? because from the drop down i do not need a qbelt protocol from the selection list or is this an oversight i discovered?

15 - qvpn p5.jpg

more digging, i see that for android devices, there is the qvpn app nestled away in a hidden corner

QVPN Device Client (coming soon)
Connect to your QNAP NAS over VPN with QBelt

*NAS system requirements: requires QTS 4.3.5 (or later) and QVPN 2.0 to enable the QBelt protocol.


Easy to connect
Powered by QNAP's proprietary QBelt protocol, connecting to your QNAP NAS from your mobile device has never been easier.

Tier 2 VPN Connections
Set up a Tier 2 VPN connection directly from your mobile device using QBelt, PPTP, OpenVPN, L2TP, or VPN services such as VyperVPN.

Speed Control
Powerful measurement tools provide a wealth of information about the speed of your VPN connections.

Connection History
Track previous connections to your NAS from your mobile device.

Advanced Control
Advanced settings allow you to control how QVPN Device Client connects to your NAS.

15 - qvpn p6.jpg

https://www.qnap.com/en/mobile-apps?cat ... oductivity



and for windows (it's listed under enterprise)

15 - qvpn p7.jpg

https://www.qnap.com/en/utilities/enterprise


in QTS you go to QVPN, and you can find the app links there, but they are not currently available unfortunately.

15 - qvpn p8.jpg

anyway, the types of usage for QBELT via QVPN would be something like this for running a secure backup over the internet

offsite.jpg

or just simple access to your QNAP over the internet, either streaming media, or common file copy/paste/delete/edit, or whatever.

[Moogle Stiltzkin]

Beta program test A

Download and install the QTS 4.3.5 Beta on your QNAP NAS.

- done

Install at least two SSDs on your QNAP NAS.

-done

Go to “QTS Main Manu” and start using the SSD Profiling Tool.

- done

5 - cache acceleration p7.jpg

5 - cache acceleration p12.jpg

Click “View Report” and export the test report.

- done

5 - cache acceleration p19.jpg

Complete the online form below and submit your SSD Profiling Tool test report.

- done

[Moogle Stiltzkin]

Beta Test Program B: QTS 4.3.5 Feasibility Test. Tell us the refreshing and useful features you find!

Already submitted to survey. for continued feedback, i'm using this forum thread

[Moogle Stiltzkin]

uh... first issue i found, though this could just be specific to my own hard drive having an issue.

17 - raid sync error detect.jpg

last time i checked for bad blocks was like early this year. i also did long smart test last month or so


so now i got to postpone running HBS restore, so i can do a badblocks check and probably smart test long first.

what the heck is medium error anyway? how serious is that?

[Moogle Stiltzkin]

A weird bug i also found was in appcenter. The nvidia drivers has a cross on it. But the thing is, i had already format reset, and furthermore done a reinitialization. So why is there a cross mark on a new reinit system ?

7 - appcenter p7 bug.jpg

anyway i resolved it by removing that, and it was replaced with the nvidia driver app. weird

7 - appcenter p8 fix.jpg

anyway graphics looks like this in hardware to confirm it's working

18 - graphics card.jpg

[Moogle Stiltzkin]

Notification center

more fine tunning and a centralized notification system.


i may have found a bug. for example, now in apps you can select the option for notification. However, it seems that it did not detect a rule that already had selected all app related stuff to be notified.

So this is how i ended up creating another rule that overlaps again for apps, because the UI insisted that there was no existing rule in place.

8 - notification center p21.jpg

But when i browsed notification rules and inspected, sure enough for apps those items were already selected. So why then is the screenshot indicating there was no rule for it?

8 - notification center p24.jpg

See, even after there were clearly rules for it, this is still showing blank as if it doesn't already exist.

8 - notification center p26 bug.jpg

other than that, notifications does work

8 - notification center p20.jpg

but it's too effective. i wish they added a basic default template that is less spammy, and alerts only for the most important things rather than simply everything (because it can become too overwhelming. I reached 50 email notifications by email before i disabled email and sms notifications and just stuck to push notifications).

So a less spammy default rule template is my strong recommendations for notification center. Atm it just seems to me, you can create any rules as you like and have at it. But for a newbie, we just want something already pre-configured as a sane base template, and from there we can tinker with it further. a blank rule setting where the user may not know what to tick or leave untick from scratch is a bit of a headache.



*update

after more consideration, the alert notification is fine, because it warns you about warnings and errors which are important stuff you should be notified about. so for that i'd make active.

the one that can easily get spammy is event notification. that one requires more fine tuning.




I'm going through my list of notifications that email was sent for.

8 - notification center p27.jpg

first i filter for warnings and errors. so they were all relevant, however, the notifications for high severity in the security counselor when i ran scan, is atm buggy because in counselor when i checked the report, it does not show any item that is high risk. So maybe for now, i can exclude notifications for it until it gets fixed. Normally i would want to know about high severity, but if it's misinformation then it's not helpful being spammed.


Anyway it's very easy to exclude an item. just click add setting, then integrate into an existing rule, or add a new one. This edit/add setting from the notification center is very handy.

8 - notification center p28.jpg

*update

to fix event notifications to be less annoying, i set the criteria to be only for warning or error severity only. Since those are the really must know.

8 - notification center p29.jpg

As for the informational types..... there may be cause for setting these up for notification as well, such as like when my HBS backup completes for example. These i can simply just create a simple rule just for HBS job status, and thats it.

there are probably more important things i would like to be immediately notified about but, this is the bare minimum i need for now.

[Moogle Stiltzkin]

virtual switch changes

i just left it at default for the auto detection features they added.

16 - network virtual p3.jpg

*update

found a bug. Whats a Gatewaty?

virtual switch bug.jpg

*update


found another bug. in the overview, the qnap model image can flash momentarily to some weird yellow/pink hue mid refresh

switch bug.jpg

[Moogle Stiltzkin]

System reboot changes

One of the other changes is how the QNAP now reboots. It will show you a list of activity for services being shutting down so you the user are not left clueless what is the hold up. It kind of reminds me of how windows 10 behaves by nagging about processes it is closing during the process of shutting down.

system reboot list.jpg

system reboot list 2.jpg

[Trexx]

uh... first issue i found, though this could just be specific to my own hard drive having an issue.

17 - raid sync error detect.jpg

last time i checked for bad blocks was like early this year. i also did long smart test last month or so


so now i got to postpone running HBS restore, so i can do a badblocks check and probably smart test long first.

what the heck is medium error anyway? how serious is that?

Medium error means badblocks (possibly). I did get some "phantom" ones in middle 4.3.4 builds that seemed to occur when SATA bus was under stress (raid resync and other processes running simultaneously). But with latest version seems more reliable. Doesn't surprise me it showing up during raid sync.

I would do a badblock scan in QTS. Enable bitmap for volume and to be extra sure, remove suspect drive and run vendor test against it externally if QTS badblock shows no issues.