If you are running AD in a 2003/2008 mixed domain, see this forum post for instructions on how to prevent the secure channel key from becoming corrupted.

In some large domains, caching user data appears to stall the FreeNAS™ GUI or fails to populate the user cache on the PDC. If this occurs in a multi-tiered forest, specify allow trusted domains = no in the auxiliary parameters field of Sharing -> CIFS Shares.

The LDAP code uses DNS to determine the location of the domain controllers and global catalog servers in the network. Use the host -t srv _ldap._tcp.domainname.com command to determine the network's SRV records and, if necessary, change the weight and/or priority of the SRV record to reflect the fastest server. More information about SRV records can be found in the Technet article How DNS Support for Active Directory Works.

If the cache becomes out of sync due to an AD server being taken off and back online, resync the cache using System -> Settings -> Advanced -> Rebuild LDAP/AD Cache.

8.4 CIFS

The Common Internet File System (CIFS) is a network protocol that offers file services for (typically) Windows computers. FreeNAS™ uses Samba to provide CIFS capability without the need for a Windows server in the network. UNIX-like systems that provide a CIFS client can also connect to CIFS shares. Before configuring this service, you should first create your CIFS Shares in Sharing -> CIFS Shares -> Add CIFS Share. After configuring this service, go to Services -> Control Panel to start the service.

NOTE: after starting the CIFS service, it may take several minutes for the master browser election to occur and for the FreeNAS™ system to become available in Windows Explorer.

Starting this service will open the following ports on the FreeNAS™ system:

• TCP 139 (smbd)

• TCP 445 (smbd)

• UDP 137 (nmbd)

• UDP 138 (nmbd)

Figure 8.4a shows the configuration options which are described in Table 8.4a. This configuration screen is really a front-end to smb.conf.

Figure 8.4a: Configuring CIFS

Table 8.4a: CIFS Configuration Options

NOTE: beginning with FreeNAS™ versions 8.0.3-RELEASE, changes to CIFS settings and CIFS shares take effect immediately. For previous versions, changes will not take effect until you manually stop and start the CIFS service.

8.4.1 Troubleshooting Tips

Compared to other networking protocols, CIFS is not fast. Enabling the following checkboxes may help to increase network throughput: "Large RW support", "Send files with sendfile(2)", and "Enable AIO". Adjusting the AIO minimum and maximum size settings to better fit your networking infrastructure may improve or degrade performance.

Samba's "write cache" parameter has been reported to improve write performance in some configurations and can be added to the Auxiliary Parameters field. Use an integer value which is a multiple of _SC_PAGESIZE (typically 4096) to avoid memory fragmentation. This will increase Samba's memory requirements and should not be used on systems with limited RAM.

If you wish to increase network performance, read the Samba section on socket options. It indicates which options are available and recommends that you experiment to see which are supported by your clients and improve your network's performance.

Windows automatically caches file sharing information. If you make changes to a CIFS share or to the permissions of a volume/dataset being shared by CIFS and are no longer able to access the share, try logging out and back into the Windows system.

Where possible, avoid using a mix of case in filenames as this may cause confusion for Windows users. Representing and resolving filenames with Samba explains this in more detail.

8.5 Dynamic DNS

Dynamic DNS (DDNS) is useful if your FreeNAS™ system is connected to an ISP that periodically changes the IP address of the system. With dynamic DNS, the system can automatically associate its current IP address with a domain name, allowing you to access the FreeNAS™ system even if the IP address changes. DDNS requires you to register with a DDNS service such as DynDNS.

Figure 8.5a shows the DDNS configuration screen and Table 8.5a summarizes the configuration options. The values you need to input will be given to you by the DDNS provider. After configuring DDNS, don't forget to start the DDNS service in Services -> Control Services.

Figure 8.5a: Configuring DDNS

Table 8.5a: DDNS Configuration Options

8.6 FTP

FreeNAS™ allows you to configure the proftpd FTP server so that users can browse and download data using their web browser or FTP client software. The advantage of FTP is that easy-to-use cross-platform utilities are available to manage uploads to and downloads from the FreeNAS™ system. The disadvantage of FTP is that it is considered to be an insecure protocol, meaning that it should not be used to transfer sensitive files. If you are concerned about sensitive data, see section 8.6.4 Encrypting FTP.

In order for FTP to work, you will need to set appropriate permissions on the storage volume, and depending upon your configuration needs, you may also need to create users and groups. This section includes configuration examples demonstrating some common scenarios.

Figure 8.6a shows the configuration screen for the FTP service:

Figure 8.6a: Configuring FTP

Table 8.6a summarizes the available options when configuring the FTP server:

Table 8.6a: FTP Configuration Options

The following example demonstrates the auxiliary parameters that will prevent all users from performing the FTP DELETE command:

 <Limit DELE>
  DenyAll
 </Limit>

8.6.1 Anonymous FTP

Anonymous FTP may be appropriate for a small network where the FreeNAS™ system is not accessible from the Internet and everyone in your internal network needs easy access to the stored data. Anonymous FTP does not require you to create a user account for every user. In addition, passwords are not required so you don't have to manage changed passwords on the FreeNAS™ system.

To configure anonymous FTP:

1. Give the built-in ftp user account permissions to the volume/dataset in Storage -> Volume -> View All Volumes. Click the Change Permissions button for the volume/dataset that you wish to share using FTP. In the screen shown in Figure 8.6b, select the ftp user in the drop-down menu for Owner(user), select the ftp group for Owner(group), review that the permissions are appropriate for your network, keep the type of ACL as Unix, check the box Set permission recursively, and click the Change button.

NOTE: for FTP, the type of client does not matter when it comes to the type of ACL. This means that you always use Unix ACLs, even if Windows clients will be accessing FreeNAS™ via FTP.

2. Configure anonymous FTP in Services -> FTP. In the screen shown in Figure 8.6a:

• check the box Allow Anonymous Login

• change the path to the name of the volume/dataset

3. Start the FTP service in Control Services. Click the red OFF button next to FTP. After a second or so, it will change to a blue ON , indicating that the service has been enabled.

4. Test the connection from a client using a utility such as Filezilla. In the example shown in Figure 8.6c, the IP address of the FreeNAS™ server is 192.168.1.113, the Username is anonymous, and the Password is the email address of the user.

Figure 8.6b: Assign ftp User Account Permissions to the Volume

Figure 8.6c: Connecting Using Filezilla

8.6.2 Specified User Access in chroot

If you require your users to authenticate before accessing the data on the FreeNAS™ system, you will need to create a user account for each user. If you create a ZFS dataset for each user, you can chroot each user so that they are limited to the contents of their own home directory and you can also restrict the size of that home directory using a ZFS quota. To configure this scenario:

1. Create a ZFS dataset for each user in Storage -> Create ZFS Dataset. In the example shown in Figure 8.6d, a ZFS dataset named user1 has been created with a ZFS quota of 20GB. In later steps, we will create a user named user1 to associate with the dataset. Repeat this process to create a dataset for every user that will need access to the FTP service.

Figure 8.6d: Create a ZFS Dataset with a Quota

2. Create a user account for each user in Account -> Users -> Add User. In the screen shown in Figure 8.6e, input a Username for the user (in this example, user1), change the Home Directory to the name of an existing dataset (in our example, the dataset named /mnt/test1/user1), input a description under Full Name, input the user's email address, input and confirm the user's password, and click the OK button. Repeat this process to create a user account for every user that will need access to the FTP service, making sure to assign each user their own dataset.

3. Set the permissions for each dataset in Storage -> Volume -> View All Volumes. This is how you associate a user account with a dataset and set the desired permissions for that user. Click the Change Permissions button for a dataset that you specified as the Home Directory when you created a user account. In the screen shown in Figure 8.6f, select the user in the drop-down menu for Owner(user) and Owner(group) (in this example, user1), keep the type of ACL as Unix, review the read and write permissions to see if they are appropriate to that user, check the box Set permission recursively, and click the Change button.

NOTE: for FTP, the type of client does not matter when it comes to the type of ACL. This means that you always use Unix ACLs, even if Windows clients will be accessing FreeNAS™ via FTP.

Figure 8.6e: Creating a User Account

Figure 8.6f: Setting the Dataset's Permissions

4. Configure FTP in Services -> FTP. In the screen shown in Figure 8.6a:

• make sure the boxes for Allow Anonymous Login and Allow Root Login are unchecked

• check the box Allow Local User Login

• check the box Always Chroot

5. Start the FTP service in Control Services. Click the red OFF button next to FTP. After a second or so, it will change to a blue ON , indicating that the service has been enabled.

6. Test the connection from a client using a utility such as Filezilla. This time in the example shown in Figure 8.6d, use the IP address of the FreeNAS™ system, the Username of a user that has been associated with a dataset, and the Password for that user.

8.6.3 Encrypting FTP

During installation, an RSA certificate and key are auto-generated for you. You can view these or cut/paste your own signed certificate and key in System -> Settings -> SSL. To configure any FTP scenario to use encrypted connections:

1. Enable SSL/TLS in Services -> FTP. Check the box Enable SSL/TLS. Once you press OK, proftpd will automatically restart and be configured to use the certificate stored in the SSL tab.

2. Specify secure FTP when accessing the FreeNAS™ system. For example, in Filezilla input ftps://IP_address (for an implicit connection) or ftpes://IP_address (for an explicit connection) as the Host when connecting. The first time you connect, you should be presented with the certificate of the FreeNAS™ system. Click OK to accept the certificate and negotiate an encrypted connection.

8.6.4 Troubleshooting

A very common issue is that proftpd won't start if it can't resolve the system's hostname to an IP via DNS. To see if the FTP service is running, go to the console shell (or a command prompt in an SSH session) and issue the command:

sockstat -4p 21

If there is nothing listening on port 21, proftpd isn't running. To see the error message that occurs when FreeNAS™ tries to start the FTP service, go to System -> Settings -> Advanced and check the box "Show console messages in the footer (Requires UI reload)". Refresh your browser and the console messages should display at the bottom of your screen.

Next, go to Services -> Control Services and switch the FTP service off then back on in the GUI. Watch the console messages for errors.

If the error refers to DNS, either create an entry in your local DNS server with the FreeNAS™ system's hostname and IP address, or make an entry containing that information in /etc/hosts on the FreeNAS™ server.

8.7 LDAP

FreeNAS™ includes an OpenLDAP client for accessing information from an LDAP server. An LDAP server provides directory services for finding network resources such as users and their associated permissions. Examples of LDAP servers include Microsoft Server (2000 and newer), Mac OS X Server, Novell eDirectory, and OpenLDAP running on a BSD or Linux system. If an LDAP server is running on your network, you should configure the FreeNAS™ LDAP service so that the network's users can authenticate to the LDAP server and thus be provided authorized access to the data stored on the FreeNAS™ system.

Figure 8.7a shows the LDAP Configuration screen that is seen when you click Services -> LDAP.

Figure 8.7a: Configuring LDAP

Table 8.7a summarizes the available configuration options:

Table 8.7a: LDAP Configuration Options

NOTE: FreeNAS™ automatically appends the root DN. This means that you should not include the scope and root DN when inputting the user, group, password, and machine suffixes.

8.8 NFS

Network File System (NFS) is a protocol for sharing files on a network. Before configuring this service, you should first create your NFS Shares in Sharing -> NFS Shares -> Add NFS Share. After configuring this service, go to Services -> Control Panel to start the service.

Starting this service will open the following ports on the FreeNAS™ system:

• TCP and UDP 111 (rpcbind)

• TCP 2049 (nfsd)

Additionally, mountd and rpcbind will each bind to a randomly available UDP port. Figure 8.8a shows the configuration screen and Table 8.8a summarizes the configuration options for the NFS service.

Figure 8.8a: Configuring NFS

Table 8.8a: NFS Configuration Options

8.9 S.M.A.R.T

FreeNAS™ uses the smartd(8) service to monitor disk S.M.A.R.T. data for signs of problems. To fully configure S.M.A.R.T. you need to:

• configure when to run the S.M.A.R.T tests in System -> S.M.A.R.T Tests -> Add S.M.A.R.T. Test

• enable S.M.A.R.T. for each disk member of a volume in Volumes -> View All Volumes

• check the configuration of the S.M.A.R.T service in Services -> S.M.A.R.T.

• start the S.M.A.R.T. service in Services -> Control Services

Figure 8.9a shows the configuration screen that appears when you click Services -> S.M.A.R.T.

NOTE: smartd will wake up at every Check Interval you configure in Figure 8.9a. It will check the times you configured in your tests (described in Figure 4.6a) to see if any tests should be run. Since the smallest time increment for a test is an hour (60 minutes), it usually does not make sense to set a check interval value higher than 60 minutes. For example, if you set the check interval for 120 minutes and the smart test to every hour, the test will only be run every 2 hours since the daemon only wakes up every 2 hours.

Table 8.9a summarizes the options in the S.M.A.R.T Configuration screen.

Figure 8.9a: S.M.A.R.T Configuration Options

Table 8.9a: S.M.A.R.T Configuration Options

8.10 SNMP

SNMP (Simple Network Management Protocol) is a protocol used to monitor network-attached devices for conditions that warrant administrative attention. FreeNAS™ can be configured as a bsnmpd(8) server where bsnmp is FreeBSD's simple and extensible SNMP daemon. If you enable SNMP, the following port will be enabled on the FreeNAS™ system:

• UDP 161 (bsnmpd listens here for SNMP requests)

Figure 8.10a shows the SNMP configuration screen and Table 8.10a summarizes the configuration options:

Figure 8.10a: Configuring SNMP

Table 8.10a: SNMP Configuration Options

8.11 SSH

Secure Shell (SSH) allows for files to be transferred securely over an encrypted network. If you configure your FreeNAS™ system as an SSH server, the users in your network will need to use SSH client software in order to transfer files using SSH. You will also need to create a user account for every user requiring SSH access in Account -> Users -> Add User. When creating your users, set their home directory to the volume/dataset that you wish them to have access to. This section shows the FreeNAS™ SSH configuration options, demonstrates an example configuration that restricts users to their home directory, and provides some troubleshooting tips.

Figure 8.11a shows the Services -> SSH configuration screen and Table 8.11a summarizes the configuration options:

Figure 8.11a: SSH Configuration

Table 8.11a: SSH Configuration Options

A few sshd_config(5) options that are useful to input in the Extra Options field include:

• ClientAliveInterval: increase this number if ssh connections tend to drop

• ClientMaxStartup: defaults to 10; increase if you have more users

8.11.1 Chrooting SFTP users

By default when you configure SSH, users can use the ssh command to login to the FreeNAS™ system and the scp and sftp commands to transfer files. While these commands will default to the user's home directory, users are able to navigate outside of their home directory which can pose a security risk. SSH supports using a chroot to confine users to only the sftp command and to be limited to the contents of their own home directory. To configure this scenario on FreeNAS™, perform the following steps.

1. Create a ZFS dataset for each user requiring sftp access in Storage -> Create ZFS Dataset. In the example shown in Figure 8.11b, a ZFS dataset named user1 has been created on volume /mnt/test1 with a ZFS quota of 20GB. In the next step, we will create a user named user1 to associate with this dataset. Repeat this process to create a dataset for every user that will need access to the SSH service.

Figure 8.11b: Create a ZFS Dataset with a Quota

2. Create a user account for each user in Account -> Users -> Add User. In the screen shown in Figure 8.11c, input a Username for the user (in this example, user1), change the Home Directory to the name of an existing dataset (in our example, the dataset named /mnt/test1/user1), input a description under Full Name, input the user's email address, input and confirm the user's password, and click the OK button. Repeat this process to create a user account for every user that will need access to the SSH service.

Figure 8.11c: Creating a User Account

3. Set permissions in Storage -> Volume -> View All Volumes. SSH chroot is very specific in what permissions it allows (see the ChrootDirectory keyword in sshd_config(5) for details). Your configuration will not work if the permissions on the datasets used by SSH chroot users differ from those shown in Figure 8.11d.

Figure 8.11d: Permissions Required by SSH Chroot

4. Create a home directory within each dataset. Due to the permissions required by SSH chroot, the user will not have permissions to write to the root of their dataset. Since your intention is to limit them to the contents of their home directory, you can manually create a home directory for the user within their dataset. To do so, you will need to access the FreeNAS™ system's shell using the instructions in section 10.8.7 FAQ: How do I get to the Command Line / CLI / shell.

Once you have access to the FreeNAS™ console, create a home directory for each user within their own dataset and change the ownership of the directory to the user. Example 8.11a demonstrates the commands used to create a home directory called user1 for the user account user1 on dataset /mnt/test1/user1:

Example 8.11a: Creating a User's Home Directory

mkdir /mnt/test1/user1/user1
chown user1:user1 /mnt/test1/user1/user1

5. Configure SSH in Services -> SSH. Add these lines to the Extra Options section as shown in Figure 8.11e.

Figure 8.11e: Configure SSH for chroot

6. Start the SSH service in Control Services. Click the red OFF button next to SSH. After a second or so, it will change to a blue ON , indicating that the service has been enabled.

7. Test the connection from a client using a utility such as WinSCP. In the example shown in Figure 8.11f, user1 is connecting to a FreeNAS™ server with an IP address of 192.168.2.9.

Once connected, the user can see the files on their Windows system in the left frame and the files on the FreeNAS™ system in the right frame, as shown in Figure 8.11g.

Figure 8.11f: Connecting to the SSH chroot from WinSCP

Figure 8.11g: Using WinSCP Within a chroot

Notice that the directory structure on the FreeNAS™ system starts at <root>. If the user clicks on <root>, they can not navigate to a higher folder. If the user tries to copy a file from the Windows system to <root>, the operation will fail. However, if the user clicks on their home folder (in this example, user1), they will enter that folder and can copy files to/from the Windows system within that folder.

8.11.2 Troubleshooting SSH Connections

If you add any Extra Options in the SSH configuration screen, be aware that the keywords listed in sshd_config(5) are case sensitive. This means that your configuration will fail to do what you intended if you don't match the upper and lowercase letters of the keyword.

When configuring SSH, you should always test your configuration as an SSH user account to ensure that the user is limited to what you have configured and does have permission to do what you want them to do. If the user account is experiencing problems, the SSH error messages are usually pretty specific to what the problem is. You will need to access the console to read these messages with the following command:

tail -f /var/log/messages

8.12 TFTP

Trivial File Transfer Protocol (TFTP) is a light-weight version of FTP usually used to transfer configuration or boot files between machines, such as routers, in a local environment. TFTP is extremely limited, providing no authentication, and is rarely used interactively by a user. If you enable TFTP on your FreeNAS™ server, it will open UDP port 69. An example where this is useful is when you wish to store all of the images and configuration files for your network's devices on the FreeNAS™ system. Figure 8.12a shows the TFTP configuration screen and Table 8.12a summarizes the available options:

Figure 8.12a: TFTP Configuration

Table 8.12a: TFTP Configuration Options

8.13 UPS

FreeNAS™ uses NUT (Network UPS Tools) to provide UPS support.

Figure 8.13a shows the UPS configuration screen:

Figure 8.13a: UPS Configuration Screen

Table 8.13a summarizes the options in the UPS Configuration screen.

Table 8.13a: UPS Configuration Options

NOTE: for USB devices, the easiest way to determine the correct device name is to enable console logging in System -> Settings -> Advanced -> check the box for "Show console messages". Refresh your browser and plug in the USB device. The messages will give the name of the /dev/ugenX.X device; replace the X's in your configuration with the actual numbers that show on the console.

8.14 iSCSI

iSCSI is a protocol standard that allows the consolidation of storage data. iSCSI allows FreeNAS™ to act like a storage area network (SAN) over an existing Ethernet network. Specifically, it exports disk devices over an Ethernet network that iSCSI clients (called initiators) can attach to and mount. Traditional SANs operate over fibre channel networks which require a fibre channel infrastructure such as fibre channel HBAs, fibre channel switches, and discreet cabling. iSCSI can be used over an existing Ethernet network, although dedicated networks can be built for iSCSI traffic in an effort to boost performance. iSCSI also provides an advantage in an environment that uses Windows shell programs; these programs tend to filter “Network Location” but iSCSI mounts are not filtered.

Before configuring iSCSI on your FreeNAS™ device, you should be familiar with the following iSCSI terminology:

CHAP: a protocol used for authenticating initiators (clients) by a target (server). CHAP uses a shared secret and three-way authentication to determine if a system is authorized to access the storage device and to periodically confirm that the session has not been hijacked by another system.

Mutual CHAP: a superset of CHAP. The target authenticates the initiator as in CHAP, and additionally the initiator uses CHAP to authenticate the target.

Initiator: the remote system (client) which has authorized access to the storage data on the FreeNAS™ system.

Target: a storage resource on the FreeNAS™ system (server).

Extent: the storage unit to be shared. It can either be a file or a device.

In order to configure iSCSI, you need to:

• review the Target Global Configuration parameters

• decide if you will use CHAP or mutual CHAP for authentication; if so, create an authorized access

• create either a device extent or a file extent

• determine which hosts are allowed to connect using iSCSI and create an initiator

• determine if you need to create a portal (only required when the FreeNAS™ system has multiple IP addresses or network interfaces that will be used for iSCSI connections

• create a target

• associate a target with an extent

• start the iSCSI service in Services -> Control Services

NOTE: FreeNAS™ uses istgt to provide iSCSI. At this time, istgt does not support SIGHUP-style configuration reloading, meaning that FreeNAS™ has to restart istgt to make configuration changes take effect. This means that any changes to existing iSCSI shares will cause any client that happens to be writing at the time to be thrown into read-only mode. Future versions of istgt will fix this known issue. Many iSCSI initiators handle the iSCSI service dropping off fairly gracefully. VMware ESXi pauses its VMs while it tries to reconnect, offering a fairly large grace period where things will recover automatically.

8.14.1 Target Global Configuration

The Target Global Configuration screen, shown in Figures 8.14a, contains settings that apply to all iSCSI shares. Table 8.14a summarizes the settings that can be configured in the Target Global Configuration screen. The integer values in the table are used to tune network performance; most of these values are described in RFC 3720. LUC (Logical Unit Controller) is an API provided by istgt to control removable media by providing functions to list targets, un/load a media to a unit, change media file, or reset a LUN.

Figure 8.14a: iSCSI Target Global Configuration Variables

Table 8.14a: Target Global Configuration Settings

8.14.2 Authorized Accesses

If you will be using CHAP or mutual CHAP to provide authentication, you must create an authorized access. Go to Services → ISCSI → Authorized Accesses → Add Authorized Access which will open the screen seen in Figure 8.14b.

NOTE: CHAP does not work with GlobalSAN initiators on Mac OS X.

Figure 8.14b: Adding Authorized Access for iSCSI

Table 8.14b summarizes the settings that can be configured when adding an authorized access:

Table 8.14b: Authorized Access Configuration Settings

As users are added, they will be listed under Authorized Accesses. In the example shown in Figure 8.14c, three users (test1, test2, and test3) have been configured and there are two groups created, with group 1 consisting of a single CHAP user and group 2 consisting of a mutual CHAP user and a CHAP user.

Figure 8.14c: Viewing Authorized iSCSI Users

8.14.3 Device Extents

The next step is to configure the share. In iSCSI terminology, you don't share a volume; instead you share either a device extent or a file extent:

Device extent: allows an unformatted disk, a zvol, or an existing HAST device to be exported via iSCSI. The advantage of a device extent is that it is faster than a file extent. The disadvantage is that the entire volume is exported. If you only want to share a portion of a volume using iSCSI, either create a zvol (if it is a ZFS volume) or use a file extent. You can create a zvol by clicking Storage -> Create ZFS Volume.

File extent: allows you to export a portion of a volume. When creating a file extent, you can specify either a non-existing file name or an existing ZFS dataset. The advantage of file extents is that you can create multiple exports per volume. The disadvantage is that they are slower than device extents.

To add a device extent, go to Services → ISCSI → Device Extents → Add Device Extent. In the example shown in Figure 8.14d, a device extent is being created using a raw (unformatted) disk.

Figure 8.14d: Adding an iSCSI Device Extent

Table 8.14c summarizes the settings that can be configured when creating a device extent:

Table 8.14c: Device Extent Configuration Settings

8.14.4 Extents

To add a file extent, go to Services → ISCSI → Extents → Add Extent. In the example shown in Figure 8.14e, a file extent named data with a maximum size of 20 GB will be created on the ZFS dataset /mnt/tank/iscsi. Note that the file extent creation will fail if you do not append the name of the file to be created to the volume/dataset name.

Figure 8.14e: Adding an iSCSI File Extent

Table 8.14d summarizes the settings that can be configured when creating an File Extent:

Table 8.14d: File Extent Configuration Settings

8.14.5 Initiators

The next step is to configure authorized initiators, or the systems which are allowed to connect to the stored data. Going to Services → ISCSI → Initiators → Add Initiator will bring up the screen shown in Figure 8.14f. Table 8.14e summarizes the settings that can be configured when adding an initiator.

NOTE: at this time, the FreeNAS™ system itself can not be configured as an initiator.

Figure 8.14f: Adding an iSCSI Initiator

Table 8.14e: Initiator Configuration Settings

In the example shown in Figure 8.14g, two groups have been created. Group 1 allows connections from any initiator on any network; Group 2 only allows connections from any initiator on the 10.10.1.0/24 network.

Figure 8.14g: Sample iSCSI Initiator Configuration

8.14.6 Portals

A portal allows FreeNAS™ systems with multiple IP addresses or interfaces to provide services on different interfaces or subnets. Going to Services → ISCSI → Portals → Add Portal will bring up the screen shown in Figure 8.14h:

Figure 8.14h: Adding an iSCSI Portal

In this example, 0.0.0.0:3260 is a wildcard that will cause the system to bind to every IP address and interface. This allows you to use multi-path I/O (MPIO).

Table 8.12f summarizes the settings that can be configured when adding a portal:

Table 8.14f: Portal Configuration Settings

8.14.7 Targets

Next you should add a Target using Services → ISCSI → Targets → Add Target, as shown in Figure 8.14i. A target combines a portal ID, allowed initiator ID, and an authentication method.

Table 8.14g summarizes the settings that can be configured when creating a Target.

NOTE: multiple computers can not connect to the same iSCSI target as iSCSI acts like a physical disk rather than a share. If you need to support multiple clients to the same data, use CIFS or NFS instead of iSCSI or create multiple iSCSI targets (one per client).

Figure 8.14i: Adding an iSCSI Target

Table 8.14g: Target Settings

8.14.8 Target/Extents

The last step is associating extents to targets within Services → ISCSI → Target/Extents → Add Target/Extent. This screen is shown in Figure 8.14j. Use the drop-down menus to select the desired target and extent.

Figure 8.14j: Associating iSCSI Targets/Extents

Table 8.14h summarizes the settings that can be configured when associating targets and extents:

Table 8.14h: Target/Extents Configuration Settings

It is best practice to associate extents to targets in a 1:1 manner, although the software will allow multiple extents to be associated to a target.

Once iSCSI has been configured, click the Services -> Control Services icon. Click the iSCSI button to change it from Off to On and thus start the iSCSI service.

8.14.9 Connecting to iSCSI Share

In order to access the data on the iSCSI share, clients will need to use iSCSI initiator software.

An iSCSI Initiator client is pre-installed with Windows 7. A detailed how-to for this client can be found here.

Mac OS X does not include an initiator. This how-to demonstrates how to use globalSAN, a free and easy-to-use Mac initiator.

BSD systems provide command line initiators: iscontrol(8) comes with FreeBSD, iscsi-initiator(8) comes with NetBSD, and iscsid(8) comes with OpenBSD.

Some Linux distros provide the command line utility iscsiadm from Open-iSCSI. Google to see if a package exists for your distribution should the command not exist on your Linux system.

Instructions for connecting from a VMware ESXi Server can be found at How to configure FreeNAS 8 for iSCSI and connect to ESX(i). Note that the requirements for booting vSphere 4.x off iSCSI differ between ESX and ESXi. ESX requires a hardware iSCSI adapter while ESXi requires specific iSCSI boot firmware support. The magic is on the booting host side, meaning that there is no difference to the FreeNAS™ configuration. See the iSCSI SAN Configuration Guide for details.

8.15 Rsync

The Rsync section of Services is used to configure an rsync server. See section 4.6 Rsync Tasks for instructions on how to configure an rsync client and an example of configuring both ends of an rsync connection.

This section describes the configurable options for the rsyncd service and rsync modules.

Figure 8.15a shows the rsyncd configuration screen which is accessed from Services -> Rsync -> Configure Rsyncd.

Figure 8.15a: Rsyncd Configuration

Table 8.15a summarizes the options that can be configured for the rsync daemon:

Table 8.15a: Rsync Configuration Options

8.15.1 Rsync Modules

Figure 8.15b shows the configuration screen that appears when you click Services -> Rsync -> Rsync Modules -> Add Rsync Module.

Figure 8.15b: Adding an Rsync Module

Table 8.15b summarizes the options that can be configured when creating a rsync module:

Table 8.15b: Rsync Module Configuration Options

NOTE: one of the things that isn't apparent from the documentation for some versions of rsyncd.conf(5) is that * is an alias for all.

9 Additional Options

This section covers the remaining miscellaneous options available from the FreeNAS™ web interface.

9.1 Display System Processes

If you click Display System Processes, a screen will open showing the output of top(1). An example is shown in Figure 9.1a.

Figure 9.1a: System Processes Running on FreeNAS™

The display will automatically refresh itself. Simply click the X in the upper right corner to close the display when you are finished. Note that the display is read-only, meaning that you won't be able to issue a kill command within it.

9.2 Reboot

If you click Reboot, you will receive the warning message shown in Figure 9.2a.

Figure 9.2a: Reboot Warning Message

Click the Cancel button if you wish to cancel the reboot request. Otherwise, click the Reboot button to reboot the system. Rebooting the system will disconnect all clients, including the web administration GUI. The URL in your web browser will change to add /system/reboot/ to the end of the IP address. Wait a few minutes for the system to boot, then use your browser's back button to return to the FreeNAS™ system's IP address. If all went well, you should receive the GUI login menu. However, if something went wrong, you will need physical access to the FreeNAS™ system's monitor and keyboard so that you can determine what problem is preventing the system from resuming normal operation.

9.3 Shutdown

If you click Shutdown, you will receive the warning message shown in Figure 9.3a and your browser colour will change to red to indicate that you have selected an option that will negatively impact users of the FreeNAS™ system.

Figure 9.3a: Shutdown Warning Message

Click the Cancel button if you wish to cancel the shutdown request. Otherwise, click the Shutdown button to reboot the system. Shutting down the system will disconnect all clients, including the web administration GUI, and will power off the FreeNAS™ system. You will need physical access to the FreeNAS™ system in order to turn it back on.

9.4 Log Out

To log out of the FreeNAS™ GUI, simply click the Log Out button in the upper right corner. You will immediately be logged out. An informational message will indicate that you are logged out and will provide a hyperlink which you can click on to log back in.

9.5 Help

The Help button in the upper right corner provides hyperlinks to the various FreeNAS™ resources, including: forums, mailing lists, IRC channel, bug tracker, and this documentation. Each of these resources is discussed in more detail in the next section.

It also displays the currently installed FreeNAS™ version.

9.6 Alert

FreeNAS™ provides an alert system to provide a visual warning of any conditions that require administrative attention. The Alert button in the far right corner will flash red when there is an outstanding alert. For example, the first time you access the administrative GUI, the alert button will be flashing. If you click the icon, you will see the screen shown in Figure 9.6a:

Figure 9.6a: Example Alert Message

Behind the scenes, an alert script checks for various alert conditions, such as volume status, and writes these to /var/tmp/alert. A javascript retrieves the current alert status every 5 minutes and will change the solid green alert icon (if there are no current alert conditions) to flashing red (if a new alert is detected).

Section 3: Getting Help

10 FreeNAS™ Support Resources

FreeNAS™ has a large installation base and an active user community. This means that many usage questions have already been answered and the details are available on the Internet. If you get stuck using FreeNAS™, spend a few moments searching the Internet for the word FreeNAS™ with some key words that describe your error message or the function that you are trying to implement.

FreeNAS™ 8.0 was released in May of 2011 while the original version of FreeNAS™ (now at version .7) has been around since 2005. Accordingly, much of the of information available on the Internet was written for FreeNAS™ .7.x and may or may not apply to FreeNAS™ 8.x.

The rest of this section discusses the additional resources available to FreeNAS™ 8.x users:

• Website and Social Media

• Trac Database

• IRC

• Mailing Lists

• Forums

• Instructional Videos

• Professional Support

• FAQs

10.1 Website and Social Media

The FreeNAS™ website contains links to all of the available documentation, support, and social media resources. Major announcements are also posted to the main page.

Users are welcome to network on the FreeNAS™ social media sites:

• LinkedIn

• Google+

• Facebook

A twitter feed is also available.

10.2 Trac Database

FreeNAS™ 8 uses a trac database where you can view existing support tickets to see if your issue has already been reported or create new tickets for unreported issues. You do not need to create a login account in order to view existing tickets, but you will need to use the Register link if you wish to create a ticket. See section 11.2 Submit Bug Reports if you wish to create a support ticket.

10.3 IRC

If you wish to ask a question in “real time”, you can try the #freenas channel on IRC Freenode. Depending upon the time of day (and your time zone), a FreeNAS™ developer or other FreeNAS™ users may be available to assist you. If you don't get an answer right away, remain on the channel as other users tend to read the channel history in order to answer questions as they are able to.

If you don't have an IRC chat client, you can use the FreeNAS™ browser-based client.

To get the most out of the IRC channel, keep the following points in mind:

• don't ask "can anyone help me?"; instead, just ask your question. If someone knows the answer, they will try to assist you.

• don't ask a question and then leave. Users who know the answer can't help you if you disappear.

• don't take it personally if no one answers or demand that someone answers your question. Maybe no one who knows the answer is available, maybe your question is really hard, or maybe it is a question that has already been answered many times in the other support resources. Try asking again in a few hours or research the other resources to see if you've missed anything.

• Don't post error messages in the channel as the IRC software will probably kick you out. Instead, use a pasting service such as pastebin and refer to the URL on channel. If you prefer to paste an image of your error, you can upload it to a temporary screenshot hosting service such as Upload Screenshot and post the URL to your uploaded image.

10.4 Mailing Lists

Several FreeNAS™ mailing lists are available which allow users and developers to ask and answer questions related to the topic of the mailing list. To post an email to a list, you will need to subscribe to it first. Each mailing list is archived, allowing you to browse for information by date, thread name, or author.

The following mailing lists are available:

• freenas-announce: This is a low-volume, read-only list where major milestones, such as new releases, are announced.

• freenas-commit: This is a read-only list. As code changes in the FreeNAS™ repository, the commit message is automatically sent to this list.

• freenas-devel: FreeNAS™ developers are subscribed to this list. Technical questions about the current FreeNAS™ release can be posted here.

• freenas-docs: This list is for discussion regarding FreeNAS™ documentation.

• freenas-testing: FreeNAS™ developers are subscribed to this list. Technical questions about the upcoming FreeNAS™ release and feedback on testing snapshots can be posted here.

• freenas-translations: This list is for discussion regarding FreeNAS™ localization and translating FreeNAS™ documentation.

Archives of the mailing lists are available from Gmane which allows you to read the archives in various formats (blog style, news reader style) and to subscribe to RSS feeds for the lists.

10.5 Forums

Another information source for FreeNAS™ is the Forums. Forums contain user-contributed tips and guides which have been categorized, making it an ideal resource if you wish to learn more about a certain aspect of FreeNAS™. A searchbar is included should you wish to search by keyword; alternately, you can click a category to browse through the threads that exist for that topic.

The following categories are available under Help and Support:

• FreeNAS™ 4 N00bs: post here if you are new to FreeNAS™ and are unsure which category best matches your question.

• Feature Requests: for the discussion of upcoming features and to request features not listed on the Roadmap.

• Bug Reporting: do you think you have found a bug in FreeNAS™ and want to discuss it before creating a support ticket?

• Hardware: for the discussion of hardware and tips for getting the most out of your hardware.

• User Authentication: LDAP and Active Directory.

• Sharing: AFP, CIFS, NFS, and iSCSI.

• Storage: replication, snapshots, volumes, and ZFS.

• Networking: networking hardware, performance, link aggregation, VLANs, DDNS, FTP, SNMP, SSH, and TFTP.

• Installation: installing help or advice before performing the installation.

The following categories are available under Development:

• FreeNAS™: general development discussion.

• nanobsd: the embedded operating system FreeNAS™ is based upon.

• Django: the web framework used by the FreeNAS™ graphical administrative interface.

• Dojo Toolkit: the javascript toolkit used to create widgets and handle client side processing.

The following categories are available under How-To Guides:

• Hacking: undocumented tricks for getting the most out of your FreeNAS™ system.

• Installation: specific installation scenarios (hardware and/or software).

• Configuration: specific configuration scenarios (e.g. software or client configuration).

• Hardware: instructions for setting up specific hardware.

The following categories are available under Community Forum:

• Off-topic: want to discuss something of interest to FreeNAS™ users but which is not necessarily related to FreeNAS™? This is your place.

• Resources: blogs, reviews, and other sources of FreeNAS™ information not listed at freenas.org.

• Introductions: FreeNAS™ Community meet 'n greet - introduce yourself and let us know who we are chatting with.

The following language-specific categories are available under International, allowing FreeNAS™ users to interact with each other in their native language:

• German - Deutsch

• French - Francais

• Italian - Italiano

• Spanish - Espanol

If you wish to ask a question on the forum, you will need to click the Register link to create an account and login using that account. When asking a question on the forum, it is important that you:

• first check to see if the question has already been asked. If you find a similar question, don't create a new thread. Instead use the "Reply to Thread" button to add your comments to the existing thread.

• review the available categories to see which one is most closely related to your question. Click on that category and use the "Post New Thread" button to open the editor. After typing your post and before you click the "Submit New Thread" button, make sure the "Subscribe to this thread and notify me of changes" box is checked. That way you will be notified whenever anyone answers your question.

10.6 Instructional Videos

A series of instructional videos is being created for FreeNAS™ 8.x. The videos that are available so far are:

• How to Install FreeNAS™ 8

• FreeNAS™ System Configuration Overview

• FreeNAS™ 8: Volumes Overview

• FreeNAS™ 8: Shares Overview

• FreeNAS™: Network Configuration Overview

• FreeNAS™: Active Directory

• FreeNAS™ 8: iSCSI In-depth

• FreeNAS™ 8: All in One

• FreeNAS™ 8: LAGG and VLAN

The Too Smart Guys show also has a series of videos:

• Building a FreeNAS 8 Box - Part 1 Hardware

• FreeNAS 8 - Build and Install

• FreeNAS 8 EP3 Configuration

10.7 Professional Support

In addition to the freely available community resources, iXsystems offers professional support packages. iXsystems' development team works hard to improve new and current versions of FreeNAS™, providing them with the insight to provide expert FreeNAS™ support and consultation services. Their Professional Services team can also configure your FreeNAS™ hardware and software to deliver the highest levels of performance, stability, and security. See the FreeNAS™ Professional Support page to request a quote.

10.8 FAQs

This section contains some of the questions which are asked most often on the FreeNAS™ IRC channel. Additional FAQs can be found in this forum post.

10.8.1 Can a RAID-Z array be expanded? For example, if I start off with a 8x2TB RAID-Z2 array can I add more drives to it in the future?

A. You can add drives to a volume, but not to a RAIDZ group. For example, if your volume is a 3 drive RAIDZ, you can add another 3 drive RAIDZ in the future, giving you a RAIDZ+0. But you can't change it to a 4 drive RAIDZ. This a limitation/feature of ZFS.

10.8.2 Is there a command to force FreeBSD to scan for new disks? I'm trying to add some disks to my array using the hot-swappable bays and a 3ware SATA card. The drives go in fine and light up, but the operating system can't see them.

A. Use the command:

tw_cli /c0 rescan

Then you use the drives to create units and export them to the operating system. When finished, run camcontrol rescan all and they will show up in the GUI.

10.8.3 If my hardware/motherboard dies, can I rebuild with new/different hardware and still import/read the data from my disks? What about my datasets?

A. Yes, as long as you aren't using hardware RAID and let ZFS handle the RAID, A dataset is basically a folder/directory that lives on your volume with your other files, but which has a separate mount point, such as /mnt/your-pool/dataset_1.

10.8.4 How do I replace a bad drive?

A. It is recommended that you first upgrade to latest version of 8.0.3 to make sure that your system is not effected by previously known bugs. You will also need access to the FreeNAS™ system to replace the hard drive and to run some commands from the FreeNAS™ console.

If you are replacing a disk that is a member of a RAIDZ1 or RAIDZ2:

1. Determine the device name and UUID of the disk that needs to be replaced in Storage -> Volumes -> View all Volumes -> View Disks icon for effected volume.

2. Shut down the system, pull out the failed drive, and replace it with a new disk of the same size or larger into the same port.

3. Power-on the system. At this point the RAIDZ will be in a DEGRADED state and the disk will be listed as Unavailable.

4. From the command line type zpool replace tank ada7 where tank represents the pool name and ada7 represents the device name.

5. The pool will begin re-silvering. This can take a long time (many hours); be patient and let it finish. You can check the status of the resilvering with zpool status -v. Once the resilvering finishes, zpool status -v will still say DEGRADED.

6. Type the command zpool detach tank /dev/ada7/old, replacing tank and ada7 with your pool name and device name. Check the status again and the DEGRADED and /dev/ada7/old should be gone and the pool state should be ONLINE.

7. Type the command zpool export tank. This will prepare the specified pool for an auto-import of the disk.

8. From the GUI go to: Storage -> Volumes -> Auto Import. Your disk should now show in the drop-down menu.

9. Should the disk not appear in the drop-down menu, make sure that you are running the latest version of FreeNAS™ upgrade if you are not. If you are running the latest FreeNAS™, try backing up your configuration from System -> Settings -> Config -> Save Config. Then, reset the configuration to the factory defaults using the Factory Restore button, and try the auto-import again. Once your disk is imported, you can return to your saved configuration using the Upload Config button.

10.8.5 Can I share files from my external USB drive?

A. No, at this time the GUI does not support this. This should be fixed in a later version.

10.8.6 Can I mount my MAC formatted drive?

A. No, at this time FreeNAS™ and FreeBSD do not support mounting HFS/HFS+ filesystems.

10.8.7 How do I get to the command line /CLI/shell?

A. There are 2 ways: from the console (the screen you see when you boot), and using SSH.

To use the console, you will need access to the keyboard connected to FreeNAS™. Select option "9) Shell" from the menu shown in Figure 2.4a in section 2.4 Initial Setup. To return to the console menu from the shell, type exit.

To access the FreeNAS™ system using SSH, you will need to enable the SSH service in Control Services. You will also need a client program to make the connection. When connecting, use the IP address of the FreeNAS™ system and the username admin. If you need to gain root privileges during the session type su.

10.8.8 Does FreeNAS support 4k sector drives? How do I check if it is configured?

A. Yes. FreeNAS detects and uses 4K sectors automatically.

From the command line, type these command to check if you have 512 or 4k sectors configured:

zpool set cachefile=/data/zfs/zpool.cache tank  (change tank to your pool name)
zdb -U /data/zfs/zpool.cache  | grep ashift

If the answer = 9, you have 512 byte sectors. If the answer = 12, you have 4k byte sectors.

Any hard drive produced after January 1, 2011 should be a 4K Advanced Format drive, though some drives retain backwards compatibility by performing 512 byte emulation. FreeNAS™ always uses 4K sector for ZFS if the underlying hard drive is advanced format in order to get maximum performance. For UFS, the format always uses 4K sectors.

When you create your volumes, you can optionally check the box to "Force 4096 bytes sector size". This will not improve performance on 512-byte sector hard drives but could be helpful in a RAIDZ that also contains advanced format drives.

10.8.9 My network transfer speeds are very slow, what is wrong?

A. You need to determine whether the bottleneck is your LAN, your disks/array/controller, not enough RAM, your CPU load, a misconfiguration, the type of share in use, or that some tuning is required.

• if you're using a 10-100Mb/s wired router/switch you should get somewhere around 11-12MB/s

• if you're transferring across the Internet, your speed will only be as fast as your slowest link

• if you're using a Gig interface, check that it is properly enabled on both the switch and the FreeNAS™ system. To check the FreeNAS™ system, run this command at the console:

ifconfig -a grep media

If it is not showing at 1000Mb/s, add the following line to the Options field of the interface's settings:

media 1000baseTX mediaopt full-duplex

10.8.10 Why do changes I make at the command line to config files or settings disappear after a reboot?

A. FreeNAS™is booted from a compressed filesystem and the configuration that is stored in a database is loaded into RAM. Any changes made at the command line do not get added to the configuration database. While you can make changes persist using the tips in this forum post, those changes won't survive an upgrade and it is not recommended to manually add command line edits to the database. Instead, if the functionality you desire is not possible through the GUI, go to support.freenas.org and search to see if a feature request to add that functionality already exists. If there is no existing ticket, create a ticket describing the needed functionality.

Section 4: Contributing to FreeNAS™

11 How to Get Involved

As an open source community, FreeNAS™ relies on the input and expertise of its users to help improve FreeNAS™. When you take some time to assist the community, your contributions benefit everyone who uses FreeNAS™.

This section describes some areas of participation to get you started. It is by no means an exhaustive list. If you have an idea that you think would benefit the FreeNAS™ community, bring it up on one of the resources mentioned in section 10 FreeNAS™ Support Resources.

This section demonstrates how you can:

• Assist with Localization

• Submit Bug Reports

• Test Upcoming Versions

11.1 Assist with Localization

FreeNAS™ uses Pootle, an open source application, for managing the localization of the menu screens used by the FreeNAS™ graphical administrative interface. Pootle makes it easy to find out the localization status of your native language and to translate the text for any menus that have not been localized yet. By providing a web editor and commenting system, Pootle allows translators to spend their time making and reviewing translations rather than learning how to use a translation submission tool.

To see the status of a localization, open up the FreeNAS™ Translation System in your browser, as seen in Figure 11.1a:

Figure 11.1a: FreeNAS™ Localization System

The localizations FreeNAS™ users have requested are listed alphabetically on the left. If your language is missing and you would like to help in its translation, send an email to the translations mailing list so it can be added.

The green bar in the Overall Completion column indicates the percentage of FreeNAS™ menus that have been localized. If a language is not at 100%, it means that the menus that currently aren't translated will appear in English instead of in that language.

If you wish to help localize your language, you should first join the translations mailing list and introduce yourself and which language(s) you can assist with. This will allow you to meet other volunteers as well as keep abreast of any notices or updates that may effect the translations. You will also need to click on the Register link in order to create a Pootle login account.

The first time you log into the FreeNAS™ Pootle interface, you'll be prompted to select your language so that you can access that language's translation whenever you login. Alternately, you can click the Home link to see the status of all of the languages. To work on a translation, click the link for the language -> click the FreeNAS™ link for the project -> click the link for LC_MESSAGES -> and click the link for django.po. Every text line available in the GUI menu screens has been assigned a string number. If you click the number, an editor will open where you can translate the text. In the example shown in Figure 11.1b, a user has selected string number 46 in the German translation; the other strings in the screenshot have already been translated:

Figure 11.1b: Using the Pootle Interface to Edit a Translation String

Simply type in the translated text and click the Submit button to save your change.

11.2 Submit Bug Reports

FreeNAS™ uses Trac, an open source bug reporting system, to manage bug reports and feature requests submitted by users. You can search for existing bugs and submit a bug report at support.freenas.org.

If you find a bug while using FreeNAS™ or if you would like to request a feature in an upcoming version, take the time to research your bug/feature first, before submitting your bug report. This is so that you don't end up duplicating an existing report and to ensure that your report contains the information that the developers need in order to implement the fix or the feature.

Before submitting a bug report, perform the following steps:

• determine if you are running the latest version of FreeNAS™ 8.x. FreeNAS™ developers tend to fix bugs rapidly and new features are being implemented as 8.x matures. If you are not running the latest version, it is quite likely that the bug has already been fixed or the missing feature has been implemented. If this is the case, your best course of action is to backup your data and configuration and perform an upgrade to the latest version. Note that FreeNAS™ will stabilize at version 8.2 and that the most recent version may be labelled as a beta or an RC; it will still be considered more stable than the release before it.

• if you are running the latest version, use the search feature at support.freenas.org to see if a similar report/request already exists. If one does, do not create another ticket. Instead, add a comment to the existing ticket if you have additional information to add.

If a similar report does not already exist, keep the following points in mind when you create your bug report or feature request:

• you will need to register for an account, confirm you registration email address, and be logged in before you can create a new ticket.

• in the Summary section shown in Figure 11.2a, include descriptive keywords that describe your problem or feature request. This is useful for other users who search for a similar problem. You can also include a comma separated list of keywords in the Keywords section.

• in the Description section, describe the problem, how to recreate it, and include the text of any error messages. If you are requesting a feature, describe the benefit provided by the feature and, if applicable, provide examples of other products that use that feature or the URL of the homepage for the software. If you would like to include a screenshot of your configuration or error, check the "I have files to attach to this ticket" box.

• under Type, select defect if it is a bug report or enhancement if it is a feature request.

• for bug reports, be sure to select the version of FreeNAS™ that you are using.

• press the Preview button to read through your ticket before submitting it. Make sure it includes all of the information that someone else would need to understand your problem or request. Once you are satisfied with your ticket, click the Create Ticket button to submit it.

• if you get stuck in how to fill out a field in the ticket, the TracTickets link at the bottom of the ticket creation page has several examples.