diff --git a/content/SCALE/GettingStarted/SCALEReleaseNotes.md b/content/SCALE/GettingStarted/SCALEReleaseNotes.md index b779ad0333..8b3cedf12e 100644 --- a/content/SCALE/GettingStarted/SCALEReleaseNotes.md +++ b/content/SCALE/GettingStarted/SCALEReleaseNotes.md @@ -84,8 +84,6 @@ More details are available from [Software Releases]({{< relref "/TrueNASUpgrades ### Upgrade Paths (Anticipated) {{< include file="/static/includes/SCALEUpgradePaths.md" >}} @@ -113,7 +111,8 @@ Enterprise customers should [contact Support](https://www.truenas.com/docs/scale --> ## Component Versions -Click the component version number to see the latest release notes for that component. +Component version numbers below are updated to reflect the latest TrueNAS 24.05 release. +Click the component version number to see release notes for that component. {{< truetable >}} | Component | Version | diff --git a/content/SCALE/SCALETutorials/Credentials/Certificates/AddCAsSCALE.md b/content/SCALE/SCALETutorials/Credentials/Certificates/AddCAsSCALE.md index 7c655f3c35..31056b22ee 100644 --- a/content/SCALE/SCALETutorials/Credentials/Certificates/AddCAsSCALE.md +++ b/content/SCALE/SCALETutorials/Credentials/Certificates/AddCAsSCALE.md @@ -13,26 +13,30 @@ keywords: The **Certificate Authorities** widget lets users set up a certificate authority (CA) that certifies the ownership of a public key by the named subject of the certificate. +{{< trueimage src="/images/SCALE/Credentials/AddCertificateAuthorityScreen.png" alt="Add Certificate Authority Screen" id="Add Certificate Authority Screen" >}} + To add a new CA: First, add the name and select the type of CA. The **Identifier and Type** step lets users name the CA and choose whether to create a new CA or import an existing CA. Users can also select a predefined certificate extension from the **Profiles** drop-down list. +Users can check **Add To Trusted Store** to add the CA to the TrueNAS trusted certificate store. Services on TrueNAS automatically recognize and trust CAs when you enable this option. This feature simplifies certificate management for environments with multiple services relying on the same CA, reducing repeated manual configuration. Users with strict certificate management requirements or a preference for manually controlling trusted CAs may benefit from leaving this option disabled. + Next, enter the certificate options. Select the key type. The **Key Type** selection changes the settings displayed. The **Certificate Options** step provides options for choosing what type of private key to use (as well as the number of bits in the key used by the cryptographic algorithm), the cryptographic algorithm the CA uses, and how many days the CA lasts. Now enter the certificate subject information. -The **Certificate Subject** step lets users define the location, name, and email for the organization using the certificate. +The **Certificate Subject** step lets users define the location, name, and email of the organization using the certificate. Users can also enter the system [fully-qualified hostname (FQDN)](https://kb.iu.edu/d/aiuv) and any additional domains for multi-domain support. Lastly, enter any extra constraints you need for your scenario. The **Extra Constraints** step contains certificate extension options. -* **Basic Constraints** when enabled this limits the path length for a certificate chain. -* **Authority Key Identifier** when enable provides a means of identifying the public key corresponding to the private key used to sign a certificate. +* **Basic Constraints** limits the path length for a certificate chain. +* **Authority Key Identifier** provides a means of identifying the public key corresponding to the private key used to sign a certificate. * **Key Usage** when enabled defines the purpose of the public key contained in a certificate. -* **Extended Key Usage** when enabled it further refines key usage extensions. +* **Extended Key Usage** further refines key usage extensions. Review the CA options. If you want to change something Click **Back** to reach the screen with the setting option you want to change, then click **Next** to advance to the **Confirm Options** step. diff --git a/content/SCALE/SCALETutorials/DataProtection/CloudSyncTasks/_index.md b/content/SCALE/SCALETutorials/DataProtection/CloudSyncTasks/_index.md index 617ee933e3..66764c0880 100644 --- a/content/SCALE/SCALETutorials/DataProtection/CloudSyncTasks/_index.md +++ b/content/SCALE/SCALETutorials/DataProtection/CloudSyncTasks/_index.md @@ -29,7 +29,7 @@ Cloud sync tasks allow for single-time transfers or recurring transfers on a sch Using the cloud means data can go to a third-party commercial vendor not directly affiliated with iXsystems. You should fully understand vendor pricing policies and services before using them for cloud sync tasks. -iXsystems is not responsible for any charges incurred from using third-party vendors with the cloud sync feature. +iXsystems is not responsible for any charges incurred using third-party vendors with the cloud sync feature. {{< /hint >}} ## Cloud Sync Task Requirements @@ -49,18 +49,18 @@ The option to encrypt data transferred to or from a cloud storage provider is av Select **Remote Encryption** to use [rclone crypt](https://rclone.org/crypt/) encryption during pull and push transfers. With **Pull** selected as the **Transfer Direction**, the **Remote Encryption** decrypts files stored on the remote system before the transfer. -This requires entering the same password used to encrypt data in both **Encryption Password** and **Encryption Salt**. +This requires entering the same password to encrypt data in both **Encryption Password** and **Encryption Salt**. With **Push** selected as the **Transfer Direction**, data is encrypted before it is transferred and stored on the remote system. -This also requires entering the same password used to encrypt data in both **Encryption Password** and **Encryption Salt**. +This also requires entering the same password to encrypt data in both **Encryption Password** and **Encryption Salt**. {{< include file="/static/includes/FilenameEncryption.md" >}} -When **Filename Encryption** is selected, transfers encrypt and decrypt file names with the rclone [Standard file name encryption mode](https://rclone.org/crypt//#file-name-encryption-modes). +When selecting **Filename Encryption** transfers encrypt and decrypt file names with the rclone [Standard file name encryption mode](https://rclone.org/crypt//#file-name-encryption-modes). The original directory structure of the files is preserved. When disabled, encryption does not hide file names or directory structure, file names can be 246 characters long, use sub-paths, and copy single files. -When enabled, file names are encrypted, file names are limited to 143 characters, directory structure is visible, and files with identical names have identical uploaded names. -File names can use sub-paths, single copy files, and shortcuts to shorten the directory recursion. +When enabled, file names are encrypted, file names are limited to 143 characters, the directory structure is visible, and files with identical names have identical uploaded names. +File names can use sub-paths, single-copy files, and shortcuts to shorten the directory recursion. ### Troubleshooting Transfer Mode Problems **Sync** keeps all the files identical between the two storage locations. diff --git a/content/SCALE/SCALETutorials/SystemSettings/Advanced/_index.md b/content/SCALE/SCALETutorials/SystemSettings/Advanced/_index.md index 4c473c938a..9837598b8d 100644 --- a/content/SCALE/SCALETutorials/SystemSettings/Advanced/_index.md +++ b/content/SCALE/SCALETutorials/SystemSettings/Advanced/_index.md @@ -70,7 +70,7 @@ It also stores Samba4 metadata, such as the user and group cache and share-level If the system has one pool, TrueNAS configures that pool as the system dataset pool. If your system has more than one pool, you can set the system dataset pool using the **Select Pool** dropdown. -Users can move the system dataset to an unencrypted pool or a key-encrypted pool. +Users can move the system dataset to an unencrypted or key-encrypted pool. ![SystemDatasetPoolConfigScreen](/images/SCALE/SystemSettings/SystemStorageConfigScreen.png "TrueNAS Advanced Settings System Dataset Pool Screen") @@ -101,6 +101,26 @@ Entering an IP address limits access to the system to only the address(es) enter
+## Setting Up FIPS and STIG +{{< enterprise >}} +Only Enterprise-licensed systems show the **Security** widget and have access to FIPS and STIG settings. +{{< /enterprise >}} + +To configure FIPS or STIG compliance on a TrueNAS server, you must first configure two-factor authentication for an admin user with full permissions. + +After configuring two-factor authentication, go to **System > Advanced Settings** and locate the **Security** widget. + +Click **Settings** to open the **System Security** configuration screen. + +![SystemSecurityScreen](/images/SCALE/SystemSettings/SystemSecurityScreen.png "System Security Screen") + +Select the toggle to enable FIPS and STIG, then click **Save**. You must enable FIPS with STIG! +The system prompts you to reboot. + +![SecurityFIPSSTIGRebootDialog](/images/SCALE/SystemSettings/SecurityFIPSSTIGRebootDialog.png "Reboot Require Dialog") + +The system reboot takes several minutes to complete before showing the login screen. + ## Contents {{< children depth="2" description="true" >}} diff --git a/content/SCALE/SCALEUIReference/Credentials/Certificates/CAScreensSCALE.md b/content/SCALE/SCALEUIReference/Credentials/Certificates/CAScreensSCALE.md index 9983d9dd25..10e9f1b781 100644 --- a/content/SCALE/SCALEUIReference/Credentials/Certificates/CAScreensSCALE.md +++ b/content/SCALE/SCALEUIReference/Credentials/Certificates/CAScreensSCALE.md @@ -8,7 +8,7 @@ tags: - certificates --- -The **Certificate Authorities** widget on the **Credentials > Certificates** screen displays certificate authorities(CAs) added to TrueNAS, and allows you to add new CAs, or download, delete, or edit the name of an existing CA. +The **Certificate Authorities** widget on the **Credentials > Certificates** screen displays certificate authorities(CAs) added to TrueNAS and allows you to add new CAs, or download, delete, or edit the name of an existing CA. ![CertificateAuthoritiesWidgetNoCAs](/images/SCALE/Credentials/CertificateAuthoritiesWidgetNoCAs.png "Certificate Authorities Widget No CAs") @@ -21,6 +21,7 @@ Each CA listed on the widget is a link that opens the **Edit CA** screen. **Add** opens the **[Add CA](#add-ca-wizard-screens)** wizard that steps you through setting up a certificate authority (CA) that certifies the ownership of a public key by the named subject of the certificate. ## Add CA Wizard Screens + The **Add CA** wizard screens step users through configuring a new certificate authority on TrueNAS. The wizard has five different configuration screens, one for each step in the CA configuration process: @@ -48,6 +49,7 @@ The selection in **Type** changes setting options on this screen, the **Certific | **Name** | Required. Enter a descriptive identifier for this certificate authority(CA). | | **Type** | Select the type of CA from the dropdown list. Options are **Internal CA**, **Intermediate CA**, and **Import CA**. **Internal CA** functions like a publicly trusted CA to sign certificates for an internal network. They are not trusted outside the private network. **Intermediate CA** lives between the root and end entity certificates and its main purpose is to define and authorize the types of certificates you can request from the root CA. **Import CA** allows you to import an existing CA onto the system. For more information see [What are Subordinate CAs and Why Would You Want Your Own?](https://www.globalsign.com/en/blog/what-is-an-intermediate-or-subordinate-certificate-authority). | | **Profiles** | Displays if **Internal CA** or **Intermediate CA** are set in **Type**. Select a predefined certificate extension from the dropdown list. | +| **Add To Trusted Store** | Check this option if you want to add the CA to the TrueNAS trusted certificate store. Services on TrueNAS automatically trust CAs with this option enabled. | {{< /truetable >}} {{< /expand >}} @@ -73,7 +75,7 @@ The **Key Type** selection changes fields displayed. **RSA** is the default sett {{< /expand >}} ### Certificate Subject Options -The **Certificate Subject** settings define the location, name, and email for the organization using the certificate. +The **Certificate Subject** settings define the location, name, and email of the organization using the certificate. Users can also enter the system [fully-qualified hostname (FQDN)](https://kb.iu.edu/d/aiuv) and any additional domains for multi-domain support. The **Certificate Subject** settings do not display if **Type** on the **Identifier and Type** screen is set to **Import CA**. @@ -97,15 +99,15 @@ The **Certificate Subject** settings do not display if **Type** on the **Identif ### Extra Constraints Options The **Extra Constraints** options contain certificate extension options. -* **Basic Constraints** that when enabled limits the path length for a certificate chain. -* **Authority Key Identifier** that when enabled provides a means of identifying the public key corresponding to the private key used to sign a certificate. -* **Key Usage** that when enable defines the purpose of the public key contained in a certificate. -* **Extended Key Usage** that when enable to further refines key usage extensions. +* **Basic Constraints** limits the path length for a certificate chain. +* **Authority Key Identifier** provides a means of identifying the public key corresponding to the private key used to sign a certificate. +* **Key Usage** defines the purpose of the public key contained in a certificate. +* **Extended Key Usage** further refines key usage extensions. The **Extra Constraints** settings change based on the selection in **Type** on the **Identifier and Type** screen. #### Extra Constraints - Internal or Intermediate CA -After selecting **Basic Constraints**, **Authority Key Identifier**, **Extended Key Usage**, or **Key Usage**, each displays more settings that option needs. +After selecting **Basic Constraints**, **Authority Key Identifier**, **Extended Key Usage**, or **Key Usage**, each displays more settings that the option needs. {{< expand "Click Here for More Information" "v" >}} ![AddCAExtraConstraintsAllExpanded](/images/SCALE/Credentials/AddCAExtraConstraintsAllExpanded.png "Add CA Internal Certificate") diff --git a/content/SCALE/SCALEUIReference/DataProtection/CloudSyncTasksScreensSCALE.md b/content/SCALE/SCALEUIReference/DataProtection/CloudSyncTasksScreensSCALE.md index 5857e035bb..a9d9b66f2d 100644 --- a/content/SCALE/SCALEUIReference/DataProtection/CloudSyncTasksScreensSCALE.md +++ b/content/SCALE/SCALEUIReference/DataProtection/CloudSyncTasksScreensSCALE.md @@ -33,17 +33,17 @@ Each task includes five icons for various functions: * The edit **Edit** icon opens the **[Edit Cloud Sync Task](#advanced-options-and-edit-cloud-sync-task-screens)** screen populated with with the settings for that task. -* The **Run Now** icon starts the cloud sync, running it outside of the scheduled time. +* The play_circle_filled **Run Now** icon starts the cloud sync, running it outside of the scheduled time. * The loop **Dry Run** icon performs the same function as the **Dry Run** button on the add and edit configuration screens. It performs a test of the configured settings. - When doing a dry run, you can close the window and monitor the task using the **Jobs** option on the top toolbar. + During a dry run, you can close the window and monitor the task using the **Jobs** option on the top toolbar. * The restore **Restore** icon creates a new cloud sync task from an existing task. The new task has the same settings but reverses the data transfer. * The delete **Delete** icon opens a confirmation dialog before the system deletes the task. -**State** displays the status of the next cloud sync task as **SUCCESS** for completed tasks, **FAILED** if the task fails to complete the sync, and **PENDING** for tasks that have not run yet. +**State** displays the status of the next cloud sync task as **SUCCESS** for completed tasks, **FAILED** if the task fails to complete the sync, and **PENDING** for tasks not run yet. Click on the state oval to open the **Logs** dialog for that task. **Download Logs** saves a copy of the current task logs. {{< trueimage src="/images/SCALE/DataProtection/CloudSyncTaskStateLogDialog.png" alt="Cloud Sync Task State Log" id="Cloud Sync Task State Log" >}} @@ -80,7 +80,7 @@ It includes two screens, **Provider** and **What and When**. ### Provider Wizard Screen The **Provider** wizard screen allows you to select the cloud sync provider with the **Credentials** dropdown. -Select the provider from the dropdown list to show the additional credential settings that the provider requires to establish a connection. +Select the provider from the dropdown list to show the additional required credential settings for the selected provider to establish a connection. {{< trueimage src="/images/SCALE/DataProtection/CloudSyncTaskWizardProviderScreen.png" alt="Cloudsync Task Wizard Provider Screen" id="Cloudsync Task Wizard Provider Screen" >}} @@ -92,7 +92,7 @@ Select **Add New** to open the **Cloud Credentials** screen. This is the same co ### What and When Wizard Screen The **What and When** screen sets the direction (PUSH or PULL), transfer mode (move, copy, or sync), the datasets or directories source and destination, and sets the schedule for the transfer. -The **Bucket** field displays for providers that use buckets to hold transferred files, folders, etc. +**Bucket** shows for providers that use buckets to hold transferred files, folders, etc. {{< trueimage src="/images/SCALE/DataProtection/CloudSyncTaskWizardWhatandWhenScreen.png" alt="Cloudsync Task Wizard Provider Screen" id="Cloudsync Task Wizard Provider Screen" >}} @@ -117,7 +117,7 @@ The **Manage Credentials** link opens the [Backup Credentials]({{< relref "/SCAL | **Description** | Enter a description of the cloud sync task. | | **Direction** | Select a direction option from the dropdown list. **PUSH** sends data to cloud storage. **PULL** receives data from cloud storage and is the default setting. | | **Transfer Mode** | Select the transfer mode type from the dropdown list. There are three options:
  • **COPY** - Select to duplicate each source file into the destination. If files with the same names are present on the destination, they are overwritten.
  • **MOVE** - Select to transfer files from the source to the destination and delete source files. Copies files from the source to the destination and then deletes them from the source. Files with the same names on the destination are overwritten.
  • **SYNC** - Select to change files on the destination to match those on the source. If a file does not exist on the source, it is also deleted from the destination.
    • | -| **Directory/Files** | Enter or click the arrow_right arrow to the left of **/mnt** folder to expand and show datasets and directories within that folder. When you locate the dataset or directory location to send to the cloud for push syncs, or as the destination to write to for pull syncs. Be cautious with pull destinations to avoid overwriting existing files. Click the arrow_right arrow to the left of **/mnt** folder again to collapse the directory tree. | +| **Directory/Files** | Enter or click the arrow_right arrow to the left of **/mnt** folder to expand and show datasets and directories within that folder. When you locate the dataset or directory location to send to the cloud for push syncs, or as the destination to write to for pull syncs. Be cautious with pull destinations to avoid overwriting existing files. Click the arrow_right arrow to the left of **/mnt** folder again to collapse the directory tree. Note: Clear the checkmark to the left of **/mnt**. Not clearing this checkmark can result in an **All selected directories must be at the same level** error message. | {{< /truetable >}} ### Remote Settings @@ -171,7 +171,7 @@ Selecting **Push** in **Direction** adds the **Take Snapshot** option in **Advan {{< truetable >}} | Settings | Description | |----------|-------------| -| **Take Snapshot** | Displays if **Direction** is set to **Push**. Select to take a snapshot before transferring data to the cloud storage provider. | +|**Use Snapshot** | This option ensures data consistency by creating a snapshot at the start of the backup or synchronization task. The process involves the following steps:
    1. Snapshot Creation: A snapshot of the current state is taken when the task is initiated.
    2. Backup/sync operation: The task utilizes the snapshot contents to perform the backup or synchronization, ensuring that the data remains consistent and unchanged during the operation.
    3. Snapshot removal: After the task completes, the snapshot is automatically removed to save storage space.
    This mechanism guarantees that the backup or synchronization task captures an exact state of your data at the start, even if changes occur during the process. | | **Create empty source dirs on destination after sync** | Select to create an empty source directory in the cloud storage provider folder when pushing data to the cloud provider location, or in TrueNAS if pulling data from the cloud storage provider. | | **Follow Symlinks** | Select to follow symbolic links (symlinks) and copy the items to which they link. | | **Pre-Script** | For advanced users. Enter a script to execute before running sync. See the [Cloud Sync tutorial]({{< relref "/SCALE/SCALETutorials/DataProtection/CloudSyncTasks/_index.md" >}}) for more information. | @@ -180,17 +180,24 @@ Selecting **Push** in **Direction** adds the **Take Snapshot** option in **Advan {{< /truetable >}} ### Advanced Remote Options -The **Advanced Remote Options** settings are for advanced users to configure remote encryption and transfer bandwidth speed and limit. +The **Advanced Remote Options** settings are for advanced users to configure remote encryption (if selected), transfer bandwidth speed, and bandwidth limit. +The **Edit Cloud Sync Task** screen **Advanced Remote Options** screen has an additional setting not found on the **Add Cloud Sync Task** screen. +{{< columns >}} {{< trueimage src="/images/SCALE/DataProtection/AddCloudSyncTaskPushControlAdvancedEncrypt.png" alt="Advanced Remote Encryption Options" id="Advanced Remote Encryption Options" >}} +<---> +{{< trueimage src="/images/SCALE/DataProtection/EditCloudSyncTaskControlAdvanced.png" alt="Edit Screen Advanced Remote Options" id="Edit Screen Advanced Remote Options" >}} +{{< /columns >}} {{< truetable >}} | Settings | Description | |----------|-------------| +| **Storage Class** | Shown on the **Edit Cloud Sync Task** screen. Select the AWS [Storage Class](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) from the dropdown list. Choose the storage classifications for each S3 object based on the specific use case or performance requirements. Options are:
  • **Standard** the AWS default storage class. Assigned if a storage class is not specified. Helps optimize costs between S3 Standard and S3 Standard-IA.
  • **Reduced Redundancy** is designed for non-critical, reproducible data that can be stored with less redundancy than the S3 Standard storage class.
  • **Standard-IA** Use for primary, or only copy of data that cannot be recreated. Amazon S3 stores the object data redundantly across multiple geographicallyseparated availability zones. Objects are resilient to the loss of an availability zone.
  • **One Zone-IA** Use if you can recreate the data if the availability zone fails, for object replicas when configuring cros-region replication (CRR). Also for data residency and isolation. Amazon S3 stores the object dat in only one availability zone, making it less expensive than S3 Standard-IA. Data is not resilient to the physical loss of the availability zone resulting from disasters such as earthquakes and floods.
  • **Intelligent-Teiring** is designed to optimize storage costs by automatically moving data to the most cost-effective access tier, without performance impact or operational overhead. Delivers automatic cost savings by moving data on a granular object level between access tiers when access patterns change. Ideal when optimizing storage costs for data with unknown or changing access patterns.
  • **Glacier** Use for long-term data that is rarely accessed, and requires milliseconds retrieval. Data is available for real-time access.
  • **Glacier Deep Archive** Use for archiving data rarely accessed. Data is archived, and not available for real-time access.
    • . | +| **Use --fast-list** | Select to use fewer transactions in exchange for more RAM. (https://rclone.org/docs/\#fast-list) This can also speed up or slow down the transfer. | | **Remote Encryption** | Select to use [rclone crypt](https://rclone.org/crypt/) encryption during pull and push transfers. Selecting **PUSH** in **Direction** encrypts files before transfer and stores the encrypted files on the remote system. Files are encrypted using the encryption password and encryption salt values. Selecting **PULL** decrypts files stored on the remote system before the transfer. Transferring the encrypted files requires entering the same encryption password and encryption salt used to encrypt the files. Additional details about the encryption algorithm and key derivation are available in the [rclone crypt File formats documentation](https://rclone.org/crypt/#file-formats). Selecting **Remote Encryption** shows the **Filename Encryption**, **Encryption Password**, and **Encryption Salt** settings. | -| **Filename Encryption** | **Not recommended** (see below). Shows after selecting **Remote Encryption**. When selected, transfers encrypt and decrypt file names with the rclone [Standard file name encryption mode](https://rclone.org/crypt//#file-name-encryption-modes). The original directory structure of the files is preserved.
    When enabled, file names are encrypted, file names are limited to 143 characters, directory structure is visible, and files with identical names have identical uploaded names. File names can use sub-paths, single-copy files, and shortcuts to shorten the directory recursion.
    When disabled, encryption does not hide file names or directory structure, file names can be 246 characters long, and you can use sub-paths, and copy single files. | +| **Filename Encryption** | **Not recommended** (see below). Shows after selecting **Remote Encryption**. When selected, transfers encrypt and decrypt file names with the rclone [standard file name encryption mode](https://rclone.org/crypt//#file-name-encryption-modes). The original directory structure of the files is preserved.
    When enabled, file names are encrypted, file names are limited to 143 characters, directory structure is visible, and files with identical names have identical uploaded names. File names can use sub-paths, single-copy files, and shortcuts to shorten the directory recursion.
    When disabled, encryption does not hide file names or directory structure, file names can be 246 characters long, and you can use sub-paths, and copy single files. | | **Encryption Password** | Shows after selecting **Remote Encryption**. Enter the password to encrypt and decrypt remote data.
    Warning: Always securely back up this password! Losing the encryption password results in data loss. | -| **Encryption Salt** | Shows after selecting **Remote Encryption**. Enter a long string of random characters for use as salt for the encryption password.
    Warning: Always securely back up the encryption salt value! Losing the salt value results in data loss. | +| **Encryption Salt** | Shows after selecting **Remote Encryption**. Enter a long string of random characters as salt for the encryption password.
    Warning: Always securely back up the encryption salt value! Losing the salt value results in data loss. | | **Transfers** | Select the option for the number of simultaneous file transfers based on the available bandwidth and destination system performance from the dropdown list. Options: **Low Bandwidth(4)**, **Medium Bandwidth (8)**, **High Bandwidth(16)**, and **Custom**. See [rclone --transfers](https://rclone.org/docs/#transfers-n). | | **Bandwidth limit** | Enter a single bandwidth limit or bandwidth limit schedule in rclone format. For example: *08:00,512 12:00,10MB 13:00,512 18:00,30MB 23:00,off*. Separate entries by pressing Enter. You can specify units with the beginning letter **b**, **k** (default), **M**, or **G**. See [rclone --bwlimit](https://rclone.org/docs/#bwlimit-bandwidth-spec). | {{< /truetable >}} diff --git a/content/SCALE/SCALEUIReference/SystemSettings/AdvancedSettingsScreen.md b/content/SCALE/SCALEUIReference/SystemSettings/AdvancedSettingsScreen.md index 8984488cf0..07fa1cf545 100644 --- a/content/SCALE/SCALEUIReference/SystemSettings/AdvancedSettingsScreen.md +++ b/content/SCALE/SCALEUIReference/SystemSettings/AdvancedSettingsScreen.md @@ -85,7 +85,7 @@ There are also options to configure a remote syslog server for recording system | **Syslog Server** | Enter the remote syslog server DNS hostname or IP address. Add a colon and the port number to the hostname to use non-standard port numbers, like *mysyslogserver:1928*. Log entries are written to local logs and sent to the remote syslog server. | | **Syslog Transport** | Enter the [transport protocol](https://tools.ietf.org/html/rfc8095) for the remote system log server connection. Selecting Transport Layer Security (TLS) displays the **Syslog TLS Certificate** and **Syslog TSL Certificate Authority** fields. This setting requires preconfiguring both the server system certificate and the certificate authority (CA). | | **Syslog TLS Certificate** | Displays after selecting **TLS** in **Syslog Transport**. Select the [transport protocol](https://tools.ietf.org/html/rfc8095) for the remote system log server TLS certificate from the dropdown list. Select the default or add the certificate and CA for the server using the **Credentials > Certificates** screen **Certificates** widget. | -| **Syslog TLS Certificate Authority** | Displays after selecting **TLS** in **Syslog Transport**. Select the TLS CA for the TLS server from the dropdown list. If not using the default, create the CA for the systlog server TLS certificate on the **Credentials > Certificates > Certificate Authorities** screen. | +| **Syslog TLS Certificate Authority** | Displays after selecting **TLS** in **Syslog Transport**. Select the TLS CA for the TLS server from the dropdown list. If not using the default, create the CA for the syslog server TLS certificate on the **Credentials > Certificates > Certificate Authorities** screen. | | **Include Audit Logs** | Select to enable audit logging. | {{< /truetable >}} {{< /expand >}} @@ -209,7 +209,7 @@ Users can move the system dataset to an unencrypted pool, or an encrypted pool w {{< trueimage src="/images/SCALE/SystemSettings/SystemStorageConfigScreen.png" alt="System Dataset Pool Config Screen" id="System Dataset Pool Config Screen" >}} Users can move the system dataset to a key-encrypted pool, but cannot change the pool encryption type afterward. -If the encrypted pool already has a passphrase set, you cannot move the system dataset to that pool. +You cannot move the system dataset to an encrypted pool with a passphrase set. ## Replication Widget The **Replication** widget displays the number of replication tasks that can execute simultaneously on the system. It allows users to adjust the maximum number of replication tasks the system can perform simultaneously. @@ -223,13 +223,13 @@ Click **Configure** to open the **Replication** configuration screen. Enter a number for the maximum number of simultaneous replication tasks you want to allow the system to process and click **Save**. ## Access Widget -The **Access** widget displays a list of all active sessions, including the user who initiated the session and what time it started. +The **Access** widget lists all active sessions, including the user who initiated them and when they started. It also displays the **Session Timeout** setting for your current session. -It allows administrators to manage other active sessions and to configure the session timeout for their account. +It allows administrators to manage other active sessions and configure the session timeout. {{< trueimage src="/images/SCALE/SystemSettings/AdvancedSystemSettingsAccessWidget.png" alt="Access Widget" id="Access Widget" >}} -**Terminate Other Sessions** ends all sessions except for the one you are currently using. +**Terminate Other Sessions** ends all sessions except the active session for the logged-in admin user. You can also end individual sessions by clicking the logout icon next to that session if it is not the admin user session. You must check a confirmation box before the system allows you to end sessions. @@ -240,7 +240,7 @@ It cannot be used to terminate your current session. TrueNAS logs out user sessions that are inactive for longer than the configured token setting. New activity resets the token counter. -If the configured session timeout is exceeded, TrueNAS displays a **Logout** dialog with the exceeded ticket lifetime value and the time that the session is scheduled to terminate. +If the configured session timeout is exceeded, TrueNAS displays a **Logout** dialog with the exceeded ticket lifetime value and the time the session is scheduled to terminate. {{< expand "Logout Dialog" "v" >}} {{< trueimage src="/images/SCALE/SystemSettings/TimeoutDialog.png" alt="Logout Dialog" id="Logout Dialog" >}} @@ -249,12 +249,12 @@ If the configured session timeout is exceeded, TrueNAS displays a **Logout** dia If the button is not clicked, the TrueNAS terminates the session automatically and returns to the login screen. {{< /expand >}} - **Configure** opens the **Token Settings** screen. + **Configure** opens the **Access Settings** screen. -### Token Settings Screen -The **Token Settings** screen allows users to configure the **Session Timeout** for the current account. +### Access Settings Screen +The **Access Settings** screen allows users to configure the **Session Timeout** for the current account. -{{< trueimage src="/images/SCALE/SystemSettings/TokenSettingsScreen.png" alt="Token Settings Screen" id="Token Settings Screen" >}} +{{< trueimage src="/images/SCALE/SystemSettings/AccessSettingsScreen.png" alt="Access Settings Screen" id="Access Settings Screen" >}} Select a value that fits your needs and security requirements. Enter the value in seconds. @@ -265,6 +265,11 @@ The default lifetime setting is 300 seconds or five minutes. The maximum is 2147482 seconds, or 24 days, 20 hours, 31 minutes, and 22 seconds. {{< /hint >}} +The **Login Banner** field allows specifying a text message the system shows before the TrueNAS login splash screen displays. +**Continue** on the banner screen closes the screen, then shows the login splash screen. +The maximum length of the banner text is 4096 characters including spaces. Long text wraps and banner text can use carriage returns to break up long messages to improve readability. +Leave **Login Banner** empty to show just the login screen without interruption by a banner screen. + ## Allowed IP Addresses Widget The **Allowed IP Addresses** widget displays IP addresses and networks added to the system that are allowed to use the API and UI. If this list is empty, then all IP addresses are allowed to use API and UI. @@ -275,7 +280,7 @@ The **Allowed IP Addresses** widget displays IP addresses and networks added to {{< hint type="warning" >}} Entering an IP address to the allowed IP address list denies access to the UI or API for all other IP addresses not listed. -Use only if you want to limit system access to a single or limited number of IP addresses. Leave the list blank to allow all IP addresses. +Use only if limiting system access to a single or limited number of IP addresses. Leave the list blank to allow all IP addresses. {{< /hint >}} Click **Add** next to **Allowed IP Addresses** to add an entry to the allowed IP Addresses list. @@ -355,14 +360,19 @@ The **Global Two Factor Authentication** widget allows you to set up two-factor ## System Security Widget {{< enterprise >}} -The **System Security** widget allows administrators of Enterprise-licensed systems to enable or disable FIPS 140-2 compliant algorithms. -This requires a system reboot to apply the settings. -High Availability (HA) systems reboot the standby controller and then prompt to failover and reboot the primary controller. +The **System Security** widget allows administrators of Enterprise-licensed systems to enable or disable FIPS 140-2 compliant algorithms, and general-purpose OS STIG compliance. +Changing FIPS or STIG settings requires a system reboot to apply setting changes. + +High Availability (HA) systems reboot the standby controller and then show a prompt to failover and reboot the primary controller. -{{< trueimage src="/images/SCALE/SystemSettings/AdvancedSystemSecurityWidget.png" alt="System Security Widget" id="System Security Widget" >}} +{{< trueimage src="/images/SCALE/SystemSettings/SystemAdvancedSecurityWidget.png" alt="System Security Widget" id="System Security Widget" >}} **Settings** opens the **System Security** configuration screen. -Click the **Enable FIPS** toggle to enable or disable enforcement, then click **Save**. +{{< trueimage src="/images/SCALE/SystemSettings/SystemSecurityScreen.png" alt="System Security Screen" id="System Security Screen" >}} + +The **Enable FIPS** toggle enables or disables enforcement. +The **Enable General Purpose OS STIG compatibility mode** toggle enables or disables the STIG compliance implementation. Requires two-factor authentication for an admin user with full permissions before enabling STIG compatibility. +**Save**. The system prompts to reboot (or failover for HA systems) to apply the settings. {{< /enterprise >}} diff --git a/data/properties/scale-downloads.yaml b/data/properties/scale-downloads.yaml index 7e709f6860..edcee5f3e7 100644 --- a/data/properties/scale-downloads.yaml +++ b/data/properties/scale-downloads.yaml @@ -115,6 +115,9 @@ majorVersions: majorVersion: "24.10 (Electric Eel)" releaseName: "Electric Eel" releases: + - name: "24.10.2" + link: "https://download.truenas.com/TrueNAS-SCALE-ElectricEel/24.10.2/" + date: "2024-01-28" - name: "24.10.1" link: "https://download.truenas.com/TrueNAS-SCALE-ElectricEel/24.10.1/" date: "2024-12-17" diff --git a/data/properties/scale-releases.yaml b/data/properties/scale-releases.yaml index 29de33b40a..a483dffef5 100644 --- a/data/properties/scale-releases.yaml +++ b/data/properties/scale-releases.yaml @@ -17,16 +17,11 @@ majorVersions: name: "TrueNAS 24.10 - Electric Eel" releaseName: "Electric Eel" releases: - - name: "24.10.1" - type: "Maintenance" - link: "https://www.truenas.com/docs/scale/24.10/gettingstarted/scalereleasenotes/#24101-changelog" - releaseDate: "2024-12-17" - latest: true - name: "24.10.2" type: "Maintenance" - link: "" + link: "https://www.truenas.com/docs/scale/24.10/gettingstarted/scalereleasenotes/#24102-changelog" releaseDate: "2025-01-28" - latest: false + latest: true - lifecycle: "Next" name: "TrueNAS 25.04 - Fangtooth" releaseName: "Fangtooth" @@ -39,7 +34,7 @@ majorVersions: - name: "25.04-BETA.1" type: "Early" link: "" - releaseDate: "2025-02-11" + releaseDate: "2025-02-13" latest: false - name: "25.04-RC.1" type: "Early" diff --git a/static/images/SCALE/Credentials/AddCertificateAuthorityScreen.png b/static/images/SCALE/Credentials/AddCertificateAuthorityScreen.png new file mode 100644 index 0000000000..2078a00828 Binary files /dev/null and b/static/images/SCALE/Credentials/AddCertificateAuthorityScreen.png differ diff --git a/static/images/SCALE/DataProtection/AddCloudSyncTaskPushTransferRemote.png b/static/images/SCALE/DataProtection/AddCloudSyncTaskPushTransferRemote.png index b25f4504fe..9427cf16ed 100644 Binary files a/static/images/SCALE/DataProtection/AddCloudSyncTaskPushTransferRemote.png and b/static/images/SCALE/DataProtection/AddCloudSyncTaskPushTransferRemote.png differ diff --git a/static/images/SCALE/DataProtection/CloudSyncTaskWidget.png b/static/images/SCALE/DataProtection/CloudSyncTaskWidget.png index 98b38846c3..36684ef305 100644 Binary files a/static/images/SCALE/DataProtection/CloudSyncTaskWidget.png and b/static/images/SCALE/DataProtection/CloudSyncTaskWidget.png differ diff --git a/static/images/SCALE/DataProtection/CloudSyncTaskWizardWhatandWhenScreen.png b/static/images/SCALE/DataProtection/CloudSyncTaskWizardWhatandWhenScreen.png index e1b32c13c1..95484d5552 100644 Binary files a/static/images/SCALE/DataProtection/CloudSyncTaskWizardWhatandWhenScreen.png and b/static/images/SCALE/DataProtection/CloudSyncTaskWizardWhatandWhenScreen.png differ diff --git a/static/images/SCALE/DataProtection/EditCloudSyncTaskControlAdvanced.png b/static/images/SCALE/DataProtection/EditCloudSyncTaskControlAdvanced.png new file mode 100644 index 0000000000..647081fc30 Binary files /dev/null and b/static/images/SCALE/DataProtection/EditCloudSyncTaskControlAdvanced.png differ diff --git a/static/images/SCALE/SystemSettings/AccessSettingsScreen.png b/static/images/SCALE/SystemSettings/AccessSettingsScreen.png new file mode 100644 index 0000000000..0cd99fd537 Binary files /dev/null and b/static/images/SCALE/SystemSettings/AccessSettingsScreen.png differ diff --git a/static/images/SCALE/SystemSettings/SecurityFIPSSTIGRebootDialog.png b/static/images/SCALE/SystemSettings/SecurityFIPSSTIGRebootDialog.png new file mode 100644 index 0000000000..ae648bb075 Binary files /dev/null and b/static/images/SCALE/SystemSettings/SecurityFIPSSTIGRebootDialog.png differ diff --git a/static/images/SCALE/SystemSettings/SystemAdvancedSecurityWidget.png b/static/images/SCALE/SystemSettings/SystemAdvancedSecurityWidget.png new file mode 100644 index 0000000000..5a8209224e Binary files /dev/null and b/static/images/SCALE/SystemSettings/SystemAdvancedSecurityWidget.png differ diff --git a/static/images/SCALE/SystemSettings/SystemSecurityScreen.png b/static/images/SCALE/SystemSettings/SystemSecurityScreen.png new file mode 100644 index 0000000000..ccd68e11d8 Binary files /dev/null and b/static/images/SCALE/SystemSettings/SystemSecurityScreen.png differ diff --git a/static/images/SCALE/SystemSettings/TokenSettingsScreen.png b/static/images/SCALE/SystemSettings/TokenSettingsScreen.png deleted file mode 100644 index 306550d6a5..0000000000 Binary files a/static/images/SCALE/SystemSettings/TokenSettingsScreen.png and /dev/null differ diff --git a/static/images/TrueNAS_Community_Edition.png b/static/images/TrueNAS_Community_Edition.png new file mode 100644 index 0000000000..e1e0f66a21 Binary files /dev/null and b/static/images/TrueNAS_Community_Edition.png differ diff --git a/static/images/TrueNAS_Community_Edition_White.png b/static/images/TrueNAS_Community_Edition_White.png new file mode 100644 index 0000000000..e67d4883fb Binary files /dev/null and b/static/images/TrueNAS_Community_Edition_White.png differ diff --git a/static/images/TrueNAS_Enterprise.png b/static/images/TrueNAS_Enterprise.png new file mode 100644 index 0000000000..0925d1a969 Binary files /dev/null and b/static/images/TrueNAS_Enterprise.png differ diff --git a/static/images/TrueNAS_Enterprise_White.png b/static/images/TrueNAS_Enterprise_White.png new file mode 100644 index 0000000000..fbd1ea9d5b Binary files /dev/null and b/static/images/TrueNAS_Enterprise_White.png differ diff --git a/static/includes/AccessSettingsWidget.md b/static/includes/AccessSettingsWidget.md index 085a9a5ed5..b6c757f4e4 100644 --- a/static/includes/AccessSettingsWidget.md +++ b/static/includes/AccessSettingsWidget.md @@ -1,31 +1,32 @@ -The **Access** widget displays a list of all active sessions, including the user who initiated the session and what time it started, the **Session Timeout** setting for your current session, and the UI **Login Banner**. +The **Access** widget displays a list of all active sessions including the current logged-in user and the time it started, the **Session Timeout** setting for your current session, and the UI **Login Banner**. It allows administrators to manage other active sessions and to configure the session timeout for their account. {{< trueimage src="/images/SCALE/SystemSettings/AdvancedSystemSettingsAccessWidget.png" alt="Access Widget" id="Access Widget" >}} -The **Terminate Other Sessions** button ends all sessions except for the one you are currently using. +The **Terminate Other Sessions** button ends all sessions except the current session. You can also end individual sessions by clicking the logout button next to that session. You must check a confirmation box before the system allows you to end sessions. -The logout icon is inactive for the currently logged in administrator session and active for any other current sessions. -It cannot be used to terminate the currently logged in active administrator session. +The logout icon is inactive for the currently logged-in administrator session and active for any other current sessions. +It cannot be used to terminate the currently logged-in active administrator session. **Session Timeout** displays the configured token duration for the current session (default five minutes). -TrueNAS logs out user sessions that are inactive for longer than that configured token setting for the user. +TrueNAS logs out user sessions that are inactive for longer than the configured token setting for the user. New activity resets the token counter. -If the configured session timeout is exceeded, TrueNAS displays a **Logout** dialog with the exceeded ticket lifetime value and the time that the session is scheduled to terminate. +If the configured session timeout is exceeded, TrueNAS displays a **Logout** dialog with the exceeded ticket lifetime value and the time the session is scheduled to terminate. {{< trueimage src="/images/SCALE/SystemSettings/TimeoutDialog.png" alt="Logout Dialog" id="Logout Dialog" >}} Click **Extend Session** to reset the token counter. -If the button is not clicked, the TrueNAS terminates the session automatically and returns to the log in screen.\ +If the button is not clicked, the TrueNAS terminates the session automatically and returns to the login screen. -**Login Banner** displays the custom text that TrueNAS displays before the login screen, if configured. +**Login Banner** displays the custom text that TrueNAS displays before the login screen. +If configured, users see the login banner and must click **Continue** to show the TrueNAS login splash screen. -Click **Configure** to open the **Access Settings** screen and configure **Session Timeout** or **Login Banner**. +To change settings, click **Configure** to open the **Access Settings** screen, where you can configure **Session Timeout** or **Login Banner**. {{< trueimage src="/images/SCALE/SystemSettings/TokenSettingsScreen.png" alt="Token Settings Screen" id="Token Settings Screen" >}} @@ -33,7 +34,7 @@ Select a value that fits user needs and security requirements. Enter the value in seconds. {{< hint type=tip title="Session Timeout Requirements" >}} -The default session timeout setting is 300 seconds, or five minutes. +The default session timeout setting is 300 seconds or five minutes. The minimum value allowed is 30 seconds and the maximum is 2147482 seconds, or 20 hours, 31 minutes, and 22 seconds. {{< /hint >}} diff --git a/static/includes/SCALEUpgradePaths.md b/static/includes/SCALEUpgradePaths.md index 7840d2b2e7..b6dbc98d1f 100644 --- a/static/includes/SCALEUpgradePaths.md +++ b/static/includes/SCALEUpgradePaths.md @@ -53,9 +53,15 @@ Users can skip major versions with a fresh ISO install followed by a configurati Carefully review release notes for each skipped major version before upgrading, noting any service deprecations or significant changes that impact the previous configuration. Consider stopping at major versions with significant impacts to address changes before continuing the upgrade path or be prepared to manually reconfigure incompatibilities on the latest target version. +{{< hint type=note >}} +This chart shows the basic update path to and from the latest release of each TrueNAS major version. +Depending on your use case and risk tolerance, some users may prefer to remain on an earlier minor or major version for a period of time before updating. +Visit the TrueNAS Software Status page for recommendations on which software version to use, tailored to user types ranging from Developer to Mission Critical. +{{< /hint >}} +
    - TrueNAS + TrueNAS Community Edition
    {{< mermaid class="mermaid_sizing" >}} @@ -68,25 +74,25 @@ Consider stopping at major versions with significant impacts to address changes E["22.12.4.2 (Bluefin)"] -->|update| F F["23.10.2 (Cobia)"] -->|update| G G["24.04.2.5 (Dragonfish)"] -->|update| H - H["24.10.1 (Electric Eel)"] -->|"(anticipated)"| I + H["24.10.2 (Electric Eel)"] -->|"(anticipated)"| I I["25.04.0 (Fangtooth)"] {{< /mermaid >}}
    - TrueNAS Enterprise + TrueNAS Enterprise
    {{< mermaid class="mermaid_sizing" >}} flowchart LR A["11.3-U5"] -->|update| B B["12.0-U8.1"] -->|update| C - C["13.0-U6.4"] -->|"(anticipated)"| F + C["13.0-U6.4"] -->|ISO install| F C["13.0-U6.4"] -->|"(anticipated)"| G D["23.10.2 (Cobia)"] -->|update| E - E["24.04.2.5 (Dragonfish)"] -->|"(anticipated)"| F - F["24.10.1 (Electric Eel)"] -->|"(anticipated)"| G + E["24.04.2.5 (Dragonfish)"] -->|update| F + F["24.10.2 (Electric Eel)"] -->|"(anticipated)"| G G["25.04.0 (Fangtooth)"] {{< /mermaid >}}
    @@ -144,4 +150,4 @@ Consider stopping at major versions with significant impacts to address changes const scrollContainer2 = document.getElementById('scrollContainer2'); addDragScroll(scrollContainer1); addDragScroll(scrollContainer2); - + \ No newline at end of file diff --git a/static/includes/SoftwareStatusPage.md b/static/includes/SoftwareStatusPage.md index 57e540ef5e..d95ff998a5 100644 --- a/static/includes/SoftwareStatusPage.md +++ b/static/includes/SoftwareStatusPage.md @@ -1,5 +1,5 @@ {{< hint type=note >}} -The Software Status page shows the latest recommendations for using the various TrueNAS software releases. -{{< /hint >}} \ No newline at end of file +Visit the TrueNAS Software Status page for recommendations on which software version to use, tailored to user types ranging from Developer to Mission Critical. +{{< /hint >}}