AlienMindbender wrote

today TP-Link released the official version 3.0.2 of the Omada Controller for Linux. Unfortunately, I am unable to un-tar the tar-file. Can anyone confirm that the tar-file is broken or is it my or my system's fault?

Hi AlienMindbender,

it's not a TAR file, it's a .deb package. Install with dpkg --install Omada_Controller_V3.0.2_Linux_x64.deb.deb

But - even more important - what is the difference between the Omada-EAP-Controller-for-Linux-community-version and the official version? Which one should I choose? I am currently running the official version 2.5.3 on my QNAP NAS.

This are the differences:

The community version is architecture-independent, thus running on a variety of systems (even none-x64). For the community version you need to provide mongodb and a Java JRE, both available in repositories or as TAR packages for most platforms, while in TP-Link's official Linux version both packages mongodb and JRE are still embedded (which makes their Omada Controller package depending on the CPU architecture).

The Java classes in the community version have been taken from the Windows pendant of Omada Controller 3.0.2, so they are the same as those in the Windows version.

A few classes in the official Linux version differ - probably due to updates or improvements - and most important: they eventualy added a new Java class providing privilege separation for the Omada process, what I did request already in April 2017 for EAP Controller 2.4.7. In contrary, the community version added privilege separation in the start/stop script since EAP Controller 2.5.3 (due to the lack of the Java sources it had to be a work-around).

Anyway, the privilege separation in Java classes will be integrated into the community version soon, since this is the "right" way to do it, so the work-around in the community version now can be abolished.

Another difference of the community version is my tpeap utility, which provides functions to manage and maintain Omada Controller such as scriptable backup procedures, theme and version selection for Omada Controller. And a manpage of course.

Which OS does your NAS use?

AlienMindbender wrote

Sorry to correct you, but they released both a deb and a tar file as two separate downloads (scroll down a litte further to find the tar-file). I am running Linux x86_64 on my QNAP-NAS and today I tried to use the distro-independent tar-file of v3.0.2, which I could not unpack... 

Oops, sorry, my fault. Didn't see this. Yes, it's a TAR file and yes, you are right: the gzip file is broken (gzip exits with error message "invalid compressed data--format violated").

However, (linux) user management on the QNAP is rather poor and that was the reason why I did not further look into your community version, since - if I remind correcty - needs a special user which runs the app. Maybe I'll give it a try now.

 

Yes, any server process on any Linux system (web server, FTP server, print service etc.) always runs under an unprivileged user. That's called Privilege Separation, a very common technique in the UNIX world, even older than Linux itself. It prevents root exploits in case some software has security-related bugs — such as the big holes in Java JRE7's RMI method for example, which unfortunately was used by EAP Controller up to v2.5.3 w/o privilege separation. And yes, hackers successfully did broke into a public server running EAP Controller using this well-known root exploit in the Java RMI method. That was the main reason why I did develop tpeap and later did create a portable community version.

In short: you never ever should run any service listening on network ports with administrative (root) privileges.

So, the official Omada Controller v3.0.2 for Linux finally introduces privilege separation — and that means that it will require such an user account, too. What's more, in the official version you have to manually create one, while in next release of the 3.0.2 community version it will get created automatically when installing the package.

See this, it's the start of Omada Controller official version immediately after installation:

    # ./control.sh start
    id: omada: no such user
    id: omada: no such user
    Failed to start Omada Controller. Please create user omada user
    # 
 

For now, you will have to create such an unprivileged order on the NAS, no matter which version of Omada Controller you use.

Can you log into the NAS using ssh?

AlienMindbender wrote

3. If you want Omada Controller to run as a user(it runs as root by default), you should modify OMADA_USER value in bin/control.sh

I had no change yet to look at the TAR file, but sure, you can run Omada Controller as a regular user. In this case:

• it can't be started on boot (since this requires to run as root),
• it won't be able to write it's PID into /var/run/pidfile (since this is one of the reasons it is requires to run as root on system boot) and
• its process has some restrictions on the system-call level, which might or might not be used by the program (only the developers know).

The only consequence I see at the moment is that you have to start and stop it manually.

As for your other questions:

To add an user you could also edit the system files /etc/passwd, /etc/shadow and /etc/group, but be careful to not lock you out by accident due to wrong entries. Search the web for a tutorial how to do this or read the mapages of those files in section 5 of the online manual (i.e. man 5 passwd).

As for embedded mongod and JRE: you're right, it can be an advantage if you don't have those packages installed. But beware: them commons daemon (jsvc) needed by the package version of Omada Cntroller isn't embedded, albeit it's just a single binary.

If you need it, I just re-packaged it to get rid of its rattail of dependencies — unbelievable, what some package maintainers want you have to install for just a binary .

AlienMindbender wrote

edit: I just realized that your community edition should also work on a RPi, which is perfect and even better for me than using the NAS. Just a short question: Which packages for mongodb and JRE are recommended? Is mongodb-server and openjdk-8-jre sufficient?

Sure, everything is in place already on Raspbian; mongodb, java and even jsvc are pre-installed by default. I worked the whole night on a new release of tpeap and it's nearly ready to run the official release of Omada Controller 3.0.2 on Raspbian, too. Just needs some polishing of tpeap's manpage, preparation of the .deb package and final integration to make it compatible with the 2.x versions of Omada Controller.

gabrielhopkins, thanks for your feedback. Glad that it works for you, too!