|
|
Subscribe / Log in / New account

OpenMediaVault: a distribution for NAS boxes

By Jonathan Corbet
January 2, 2015

Free NAS distributions
The Linux community has no shortage of general-purpose distributions that can be made to serve almost any need. But many Linux deployments are not on general-purpose machines; often the owner has a more specific objective in mind. One such objective is to put together a network-attached storage (NAS) box. A general-purpose distribution can easily be used in such a setting, but there are also several specialized distributions that make the task easier. This article, the first in a series, will look at OpenMediaVault, a Debian-based NAS-oriented distribution.

Given that the market is full of Linux-based NAS products, one might well wonder whether building a NAS server from scratch is worthwhile. There are a few reasons for doing so beyond the obvious "because we can." Most of the commercial products are relatively closed devices, depriving the owner of much of the freedom that Linux offers. They may not offer the specific combination of features and services that a user wants. It's a rare commercial box that gets regular security updates, but security is important for a storage server system. There may be a system sitting around already that is well suited to the task and just needs the right operating system. Or, if nothing else, it is comforting to have root access on the storage server and to be able to manage it with familiar commands and interfaces.

Installation

One of the advantages of a specialized distribution is that it tends to lack a lot of the baggage found in other distributions; a full OpenMediaVault 1.0.20 installation image weighs in at under 400MB, and the installed image takes just over 1GB. Booting that image yields a fairly standard sequence of Debian text-oriented installation screens. One thing that jumped out early on is that OpenMediaVault insists on taking a full disk for its own installation; it cannot work from a smaller partition, and it cannot export any part of the system disk to the network. That, of course, turns a four-bay server into a three-bay device; it also means that OpenMediaVault does not play well with any other distributions one might want to install on the system. Given that the system itself is quite small, it would be nice if it could accept life in a small partition and leave the bulk of the system drive available for other uses.

It's amusing that a storage server operating system's installation sequence ends by recommending that the user remove any floppies before rebooting into the installed system.

OpenMediaVault is based on the Debian stable ("wheezy") distribution, so it runs that distribution's venerable 3.2 kernel. That kernel has been consistently maintained since its release, so it will be well debugged and stable — but it won't be the place to look for exciting new features. There is no graphical desktop included with the system (unsurprisingly); it is Debian underneath, though, and is set up to use Debian's repositories, so a desktop environment could be installed if that truly seemed like a good idea.

Administration

[Main
screen] One can log into the console as root and do all of the usual administrative tasks from the command line. But the real added value in OpenMediaVault is in its web-oriented administration interface. At the outset, though, there were a couple of things that caught your editor's eye: (1) the whole thing is implemented in PHP, and (2) by default, only port 80 (HTTP) is supported. Supporting HTTPS out of the box is hard, of course; somebody has to come up with a server certificate from somewhere. One could also argue that a NAS box should run in a friendly environment, well sheltered from the Internet, so higher security might just get in the way. But it still feels wrong to have only insecure access to an important administrative function.

The administrative screens provide access to most of the functionality that users will want. At the storage level, one can manage individual disks, including wiping them completely if desired. There is access to SMART monitoring, and, happily, an extensive set of power-management controls allowing disks to be configured to spin down when they are idle. One thing that is missing, again, is partitioning; OpenMediaVault really wants to work exclusively with whole drives.

There is a RAID management layer, providing access to the MD subsystem in the kernel. Assembling a RAID array is a simple matter of filling out the [RAID
management screen] forms. The experience could be a little smoother; did it really have to spend five hours synchronizing a simple two-disk mirror array that had no data on it? But, little glitches like that aside, the RAID setup and management interface works well enough.

The filesystem screen allows the creation and mounting of filesystems on the available physical devices. The system can manage ext4, JFS, and XFS filesystems; there is no support for filesystems like Btrfs. There is also no logical volume manager support, thus no ability to create pools of space to be divided across filesystems. There is a screen for the management of disk quotas.

There is another set of screens for user and group management. They work well enough for a small number of users, but the interface is clearly oriented toward the management of individual user accounts, one at a time, in a local database. There is an "import" functionality, but it has its own special format; one can't, thus, just paste the contents of a password file into it. There is no provision for obtaining user information from an LDAP or NIS database. One might be able to set that up at the command-line level, but the web-based interface clearly doesn't envision tying into a larger network.

Exporting of filesystems via CIFS, NFS, and FTP is easily managed via the appropriate screens. One can also turn on services like rsync. There is no access to some of the fancier aspects of the NFS server — user-ID mapping, for example — but the basics are all there. Users can be allowed to access the server via SSH, but only if (1) the service has been explicitly enabled, and (2) the user in question is in the [Load
average display] "ssh" group. Most of the time, one assumes, there will be no reason to allow ordinary users to log into a NAS box.

Screens exist to provide system information in a number of forms; there are nice plots for network bandwidth usage or the system load average, for example. Conspicuously missing is any kind of plot of I/O bandwidth usage — a parameter that might be of interest on a box dedicated to storage! There is no provision for monitoring an uninterruptible power supply, unfortunately.

Closing notes

For the most part, the user interface works well. It does, though, have an annoying habit of requiring a click to save configuration changes, then another (at a distant location on screen) to confirm that the changes should really be saved. It might prevent a novice user from tripping, but it gets tiresome quickly. Also tiresome are the "do you really want to leave this page?" dialogs that pop up when the user does, indeed, want to leave an OpenMediaVault page.

One other little nit: there is a five-minute idle timeout by default; after that, the browser puts up this rather disconcerting image:

[session expired]

One does not normally want to hear about "software failures" on a storage box. In this case, the only failure is putting up a hair-raising warning when all that has happened is that the session has timed out.

For somebody wanting to set up a simple storage box for a home or a small office, OpenMediaVault might well be an attractive option. It takes away all of the fiddly details of setting up network services and, for the most part, things Just Work. Users wanting more advanced features or integration into a corporate network, instead, might find OpenMediaVault to be a bit more limiting than they would like. That is fine; those users do not appear to be the ones the project is targeting at this point. In the end, your editor is tempted to keep this distribution on the test server, but there are others to try out first; stay tuned.


to post comments

OpenMediaVault: a distribution for NAS boxes

Posted Jan 3, 2015 3:07 UTC (Sat) by TRS-80 (guest, #1804) [Link]

LVM support is available, albeit as a plugin that needs to be enabled. Ditto LDAP. Actually, I was surprised that the plugin system wasn't mentioned at all, as there is a fairly large range of community plugins available to give your OMV NAS many more functions than just plain fileserving.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 3, 2015 4:14 UTC (Sat) by josh (subscriber, #17465) [Link] (10 responses)

If the distribution wants a disk to itself, perhaps it would make sense to install it to a USB disk, rather than to a SATA disk.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 3, 2015 19:12 UTC (Sat) by eean (subscriber, #50420) [Link]

That was my thought as well. What's the intended use here? Seems completely nuts to use an entire disk.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 3, 2015 20:34 UTC (Sat) by Gollum (guest, #25237) [Link] (6 responses)

Yes, that is what I did on my HP MicroServer. Unfortunately, it ended up killing the USB disk after about 6-9 months. I guess it was a combination of a crappy disk, and regular disk writes (i.e. logs, etc).

I'm now looking at installing onto a CF disk (hoping that it will be somewhat higher quality), will see how that works.

I have a USB-CF adapter, as well as a SATA-CF adapter, so will see which works best. With the SATA-CF adapter, I would need up replace the BIOS on the microserver to enable running a hard drive from the CDROM interface, which is well understood, but I have just not got around to doing that just yet.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 0:22 UTC (Mon) by bobsol (subscriber, #54641) [Link] (5 responses)

check /etc/fstab for a noatime option to the mount for the USB and add if it's missing.

I have run routers for years (8 in one case) off CF storage with out problems. I think this works because the system mounts a ramdisk from the CF and only makes changes to the ramdisk with the exception of configuration changes.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 5:07 UTC (Mon) by Gollum (guest, #25237) [Link] (4 responses)

Sure, that makes perfect sense. However, OMV is based on Debian, which logs events, etc, to disk as well, which noatime would not affect.

I tried a package (can't recall the name offhand) that copies chunks of the fs into ramdisk, and copies it back when requested, to avoid unnecessary disk writes. Unfortunately, it turned out not to work too well.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 6:25 UTC (Mon) by dlang (guest, #313) [Link] (2 responses)

even when you are writing logs to disk, switching to noatime (or relatime) will significantly reduce the amount of writes to disk.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 7:06 UTC (Mon) by Seegras (guest, #20463) [Link]

This here's my pcengines APU, running from SD-card:
# grep tmpfs /etc/fstab
tmpfs /tmp tmpfs defaults,noatime 0 0
tmpfs /var/lock tmpfs defaults,noatime 0 0
tmpfs /var/tmp tmpfs defaults,noatime 0 0

It's a Debian, of course ;)

OpenMediaVault: a distribution for NAS boxes

Posted Jan 16, 2015 1:22 UTC (Fri) by privatedancer (guest, #100623) [Link]

best answer is too not write to disk. Stepping is a method of posting logs to your NOS box. The cut off is the signature presence sequel. I just may not have a correction to why the data. Reads Short

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 10:22 UTC (Mon) by paulj (subscriber, #341) [Link]

Sounds like OpenWRT, which is designed to run from flash, might be more suitable?

OpenMediaVault: a distribution for NAS boxes

Posted Jan 4, 2015 6:34 UTC (Sun) by Kayden (guest, #89093) [Link]

Yeah, the intent is to run off of USB. I've been running FreeNAS for a while off of USB, and it's been great. No point in taking up a drive bay, wasting power, and generating heat. The OS is tiny, anyway.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 8, 2015 20:16 UTC (Thu) by pj (subscriber, #4506) [Link]

I think I'd look at the WIP debian-live distro to install this on; then it can all run off of RO media with selective persistence, which should save the life of your flash media as well as be more powerfailure-resilient.

What is behind the web interface?

Posted Jan 3, 2015 11:46 UTC (Sat) by debacle (subscriber, #7114) [Link]

The web interface looks a little bit old-fashioned, but actually very nice! What program is it? Is it available in Debian? TIA!

OpenMediaVault: a distribution for NAS boxes

Posted Jan 3, 2015 12:24 UTC (Sat) by tjasper (subscriber, #4310) [Link] (12 responses)

I use this at work for file sharing and management, and really like the web interface etc. and control from any PC on the network. I did have to create a bespoke users list to import, and one can only import a limited (6?) lines at a time, but it's not too difficult and I only had about 50 users.

Some things on the Samba server aren't quite the way I wanted them, and the extra options in the web interface didn't quite give me the control I wanted, so I modified the smb.conf file directly. Oh, and I keep a check on it because any changes from the web interface will overwrite the modified file.

Also, it is possible to install this on top of a basic "wheezy" install (some digging on the forums is required, but I have done it on an earlier version). So if one does want a different partitioning scheme, then a netinst install of wheezy (or possibly a full install with XFCE or LXDE) followed by some command line trickery will allow that.

As someone else mentioned, there is an lvm plugin and also a NUT plugin which does allow monitoring of a UPS. It may be possible to import users from the Debian installation prior to the OMV overlay. Being Debian underneath means that some things are doable from the command line to tweak the installation to one's preferences.

I have found the support forum to be helpful and friendly. Someone on there even included a module to look at sensors via lm_sensors and add that to the series of graphs in the earlier version. I haven't looked recently since going to the 1.0 release.

The scary warning for the time-out is a recent "feature", earlier versions just put up an error dialog with a timeout message.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 3, 2015 15:06 UTC (Sat) by TRS-80 (guest, #1804) [Link] (11 responses)

The error message is a Guru Meditation, FWIW.

I too have made some manual edits to smb.conf, primarily to force permissions so that ACLs for group folders apply correctly. It does bug me you have to dig around on the internet to find the correct options (force security mode in particular) to get this to work, there's no documentation saying what options you should set to get sane behaviour.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 4, 2015 10:18 UTC (Sun) by tjasper (subscriber, #4310) [Link] (10 responses)

Is that more a feature of Samba, though?

Afterall, is one man's sanity is another's madness?

OpenMediaVault: a distribution for NAS boxes

Posted Jan 4, 2015 13:19 UTC (Sun) by TRS-80 (guest, #1804) [Link] (9 responses)

It's more a lacuna between Samba and POSIX ACLs - Samba will do what you tell it, but it won't tell you that POSIX ACLs can only remove permissions from a file, not add them beyond what the standard POSIX file permissions allow. So you need to force a rather wide POSIX file permission for ACLs to be useful. It's all obvious in retrospect, but it's just one of those gotchas that had me scratching my head. The Samba documentation on access controls gets frustratingly close to covering the problem, but just drops short.

It's possible it's a problem only seen with Mac clients of a Samba server setting odd permissions, this question was one of the pages I visited that cleared it up for me at the time. The fact that the OMV server was at the other end of a satellite link and I only occasionally got told there was a problem certainly didn't help.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 14, 2015 21:27 UTC (Wed) by robbe (guest, #16131) [Link] (8 responses)

> POSIX ACLs can only remove permissions from a file, not add them beyond
> what the standard POSIX file permissions allow.

That's not exactly correct. For a file that is owned by user1 & group2, and has mode rwxr-x---, Linux ACLs¹ could grant read permission to user3 (which is not in group2) and read+execute to all members of group4 (some of which are not in group2). That's giving additional permissions in my opinion. That's why "ls -l" prints a + after the permissions if ACLs were found.

It's true that ACLs can give no write permissions in this example, because the group rights are reused as an upper bound, masking all ACL permissions.

But for the Samba case, you could just point the file gid to an empty dummy group, and set the group permissions (i.e. the mask) to rwx. No need to give wide permissions...

There's also richacls, but they are still out of tree, I think.

¹ Which are based on a withdrawn POSIX draft -- that's the best we have, there is no ACL standard that made it through the POSIX process as of yet.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 14, 2015 22:58 UTC (Wed) by rleigh (guest, #14622) [Link]

There are also NFS4 ACLs which are rather more powerful (and complex) than "POSIX" ACLs. ZFS uses these, and if you use it on FreeBSD directly, or access a ZFS filesystem over NFS4, you get native support for them, which is pretty nice. Linux doesn't appear to expose them at present though; I would be interested to know if there are any plans to.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 15, 2015 2:10 UTC (Thu) by TRS-80 (guest, #1804) [Link]

Ah, I missed it's that the group permissions that are repurposed into being the upper bound mask for all ACLs, not that they are enforced after all ACLs are checked. Very subtle.

I also found a reference that turning off unix extensions in Samba solves the problems for Mac clients, although I haven't confirmed this.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 15, 2015 16:44 UTC (Thu) by cortana (subscriber, #24596) [Link] (5 responses)

It's true that ACLs can give no write permissions in this example, because the group rights are reused as an upper bound, masking all ACL permissions.

AIUI, ACLs have a separate 'mask' entry for the upper bound. For example:

$ ls -l a
-rw-rwxr--+ 1 sam parthenon 0 Jan 15 16:37 a

$ getfacl -t a
# file: a
USER   sam        rw-     
GROUP  parthenon  r--     
group  daemon     rwx     
mask              rwx     
other             r--     

Members of the daemon group can write to the file, even though members of parthenon cannot.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 15, 2015 20:47 UTC (Thu) by robbe (guest, #16131) [Link] (4 responses)

Yes, and it's this mask that ACL-unaware applications will see as the group permissions, as your "ls" output shows. That it's not the complete picture, and that parthenon members may not be able to write to the file, is hidden from these programs and their users.

For this reason I consider your example bad practise. Changing the file gid to daemon, and having group:parthenon:r as a separate ACL would be nicer, I think. The results will be the same, unless there is some weird corner case with users that are in both groups...?

OpenMediaVault: a distribution for NAS boxes

Posted Jan 16, 2015 0:29 UTC (Fri) by cortana (subscriber, #24596) [Link] (3 responses)

Oh, now I see what you mean. I didn't notice that ls displays the _mask_ permissions where it normally displays the group permissions. Looking further, it seems that the kernel actually reports the file mode to be 0674 in the result of the lstat system call. That's... really rather weird, and I'd like to know the rationale for it!

As for the corner case, a user in both groups will receive permissions from both the ACL_GROUP_OBJ and ACL_GROUP entry that matches their set of groups BTW (assuming that no ACL_USER_OBJ/ACL_USER entires matched first).

OpenMediaVault: a distribution for NAS boxes

Posted Jan 16, 2015 0:37 UTC (Fri) by TRS-80 (guest, #1804) [Link] (2 responses)

Group permissions becoming the mask permissions is the documented behaviour per acl(5):
There is a correspondence between the file owner, group, and other permissions and specific ACL entries: the owner permissions correspond to the permissions of the ACL_USER_OBJ entry. If the ACL has an ACL_MASK entry, the group permissions correspond to the permissions of the ACL_MASK entry. Otherwise, if the ACL has no ACL_MASK entry, the group permissions correspond to the permissions of the ACL_GROUP_OBJ entry. The other permissions correspond to the permissions of the ACL_OTHER_OBJ entry.
I can't explain the rationale, but as I said before, it is really subtle (ie confusing). Which gets back to my earlier point, there's no good overarching documentation that explains the big picture, particularly once you start dealing with Samba.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 16, 2015 9:32 UTC (Fri) by cesarb (subscriber, #6266) [Link] (1 responses)

My guess is that it makes the ACL permissions a subset of the "traditional" permissions, as seen by programs which don't know about ACLs. If a program sees that a file has 0640 permissions, it knows that the owner can read and write, a set of users can read but not write, and everyone else cannot read or write.

Some programs check the permissions for key configuration files, and complain if they're readable by anyone other than the owner. Reporting the mask as if it was the group permission keeps that functionality working even in the presence of ACLs.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 16, 2015 15:22 UTC (Fri) by bfields (subscriber, #19510) [Link]

I forget exactly how it works, but there's also some standards language to roughly the same effect--look up "file access permissions" in the SUS glossary.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 7:52 UTC (Mon) by jezuch (subscriber, #52988) [Link] (4 responses)

> One thing that jumped out early on is that OpenMediaVault insists on taking a full disk for its own installation

Apart from installing to an USB drive (but make sure it's not a crappy drive that will die after some months of sustained writes!), I think most (some?) NAS boxes have a small, internal drive intended as a host for the system partition. At least mine has (had, since I had to replace it with something bigger), albeit too small (256MB? Are you kidding me?) and on a legacy PATA interface (WTF?) that forces me to hand-compile the kernel since the one provided by Debian doesn't have a crucial option enabled.

> Conspicuously missing is any kind of plot of I/O bandwidth usage

I think it's redundant with the plot of network usage, since on a NAS [almost] everything goes through the network anyway :)

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 10:01 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link] (3 responses)

Where do they get these disks? Are they even produced anymore?

OpenMediaVault: a distribution for NAS boxes

Posted Jan 5, 2015 18:52 UTC (Mon) by klossner (subscriber, #30046) [Link] (1 responses)

PATA hard disks are still available, but they're expensive and small -- the biggest I can find is 250GB for $90, as contrasted with $30 for the same size SATA drive. Better to buy a SATA to PATA adapter for under $10 if it fits in your enclosure.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 7, 2015 18:33 UTC (Wed) by rahvin (guest, #16953) [Link]

I've got a whole stack of old IDE disks laying around. I believe two of them are 300GB though most are in the 120gb range purchased at the time the 134GB bug was still around.

OpenMediaVault: a distribution for NAS boxes

Posted Jan 7, 2015 9:26 UTC (Wed) by jezuch (subscriber, #52988) [Link]

> Where do they get these disks? Are they even produced anymore?

These are not rotating-rust-drives but something called "disk on a chip". In other words, an SSD, but the notion appears to be older than the "SSD" moniker. From what I can tell they're big in industrial installations. I got one from a Chinese manufacturer marketing to Big Industry, anyway. Maybe I should take it apart and see if the firmware does any industrial espionage :)

OpenMediaVault: a distribution for NAS boxes

Posted Jan 20, 2015 5:20 UTC (Tue) by Baylink (guest, #755) [Link] (3 responses)

I'd hoped, perhaps, for some comparison to OpenFiler, the distro I use in this space now, but I guess that was not to be...

Openfiler

Posted Jan 24, 2015 20:05 UTC (Sat) by corbet (editor, #1) [Link] (2 responses)

I looked at Openfiler, but it hasn't been updated since 2011. I kind of saw it as a dead project...

Openfiler

Posted Jan 24, 2015 20:58 UTC (Sat) by zdzichu (guest, #17118) [Link] (1 responses)

Another suggestion would be Oracle's ZFS Storage Appliance Simulator. Of course:
– it's not Linux
– for tests, it's only available as VirtualBox image
but it is useful to calibrate current Linux NAS offerings againts proprietary solution from few years back. I personally find the web UI and observability superior to everything on the market.

Openfiler

Posted Jan 26, 2015 12:12 UTC (Mon) by nye (subscriber, #51576) [Link]

>Oracle's ZFS Storage Appliance Simulator

The thing is, using Oracle's closed source ZFS branch essentially locks you in to an evolutionary dead end, when everyone else has headed in a different direction, which puts it squarely outside of LWN's remit.

(For the benefit of anyone who's unaware, the last common version of ZFS dates back to 2010, and since then the open and proprietary sides of the ZFS fork are incompatible with each other on-disk, in ways that are infeasible to fix - at least without Oracle deciding to make their ZFS open source.)


Copyright © 2015, Eklektix, Inc.
This article may be redistributed under the terms of the Creative Commons CC BY-SA 4.0 license
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds