2023-04

Security Report for TrueNAS SCALE 22.12.2

This is a security scan report of a default install of TrueNAS SCALE 22.12.12. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2023-04-07

2023-02

Security Report for TrueNAS SCALE 22.12.1

This is a security scan report of a default install of TrueNAS SCALE 22.12.1. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2023-02-21

2022-12

Security Report for TrueNAS SCALE 22.12.0

This is a security scan report of a default install of TrueNAS SCALE 22.12.0. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2022-12-13

2022-11

Security Report for TrueNAS 13.0-U3

This is a security scan report of a default install of TrueNAS 13.0-U3. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Note: This report was updated on Sept 16th 2022, to include additional information about the known issues.

2022-11-01

2022-09

Security Report for TrueNAS SCALE 22.02.4

This is a security scan report of a default install of TrueNAS SCALE 22.02.4. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2022-09-20

2022-08

Security Report for TrueNAS 13.0-U2

This is a security scan report of a default install of TrueNAS 13.0-U2. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Note: This report was updated on Sept 16th 2022, to include additional information about the known issues.

2022-08-18

Security Report for TrueNAS SCALE 22.02.3

This is a security scan report of a default install of TrueNAS SCALE 22.02.3. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2022-08-08

2022-06

Security Report for TrueNAS SCALE 22.02.2

This is a security scan report of a default install of TrueNAS SCALE 22.02.2. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2022-06-21

2022-05

Security Report for TrueNAS 13.0-U1

This is a security scan report of a default install of TrueNAS 13.0-U1. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Known Issues: 3 False Flags: 1 Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 2 Low Severity Alerts: 0 Information Alerts: 27 Known Issues squashfs-tools-4.

2022-05-09

Security Report for TrueNAS 13.0

This is a security scan report of a default install of TrueNAS 13.0. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Known Issues: 3 False Flags: 1 Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 2 Low Severity Alerts: 0 Information Alerts: 27 Known Issues squashfs-tools-4.

2022-05-09

Security Report for TrueNAS SCALE 22.02.1

This is a security scan report of a default install of TrueNAS SCALE 22.02.1. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2022-05-04

2022-04

Netatalk CVE Announcement

On March 21st 2022, the Netatalk project commited an update announcing 7 CVEs. Of those six affect AFP on TrueNAS 12.0 CVE-2022-23121 CVE-2022-23123 CVE-2022-23122 CVE-2022-23125 CVE-2022-23124 CVE-2022-0194 The CVEs only affect TrueNAS CORE. TrueNAS SCALE is not vulnerable. A fix for these CVEs has been completed, update any TrueNAS systems to version 12.0-U8.1 as soon as possible. iXsystems strongly recommends using the SMB or NFS sharing protocols. Users with different sharing protocols are encouraged to consider migrating.

2022-04-08

2022-02

Security Report for TrueNAS SCALE 22.02

This is a security scan report of a default install of TrueNAS SCALE 22.02. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If you are concered about results from a separate security audit that finds issues that are not listed below, contact the iXsystems Support Team for assistance.

2022-02-22

Security Report for TrueNAS 12.0-U8

This is a security scan report of a default install of TrueNAS 12.0-U8. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Known Issues: 5 False Flags: 2 Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 3 Low Severity Alerts: 0 Information Alerts: 27 Known Issues Ports with security issues are being updated in the TrueNAS 13.

2022-02-15

2021-12

Log4j Vulnerability Status

On December 13th, 2021 the US Cyber Security & Infrastructure Security Agency released an alert about a log4j vulnerabilities referred to as Log4j. This security vulnerability has been designated as CVE-2021-44228. The TrueNAS CORE 12.x releases, the TrueNAS SCALE 22.02 RC releases, and TrueCommand 2.x do not utilize log4j, and as a result iXsystems is pleased to report that these products are not vulnerable. However, iXsystems always encourages users to keep their TrueNAS and TrueCommand systems up to date to ensure they are running with the latest security patches at all times.

2021-12-17

Security Report for TrueNAS 12.0-U7

This is a security scan report of a default install of TrueNAS 12.0-U7. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Known Issues: 2 False Flags: 2 Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 3 Low Severity Alerts: 0 Information Alerts: 27 Known Issues nss-3.

2021-12-06

2021-10

Security Report for TrueNAS 12.0-U6

This is a security scan report of a default install of TrueNAS 12.0-U6. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Known Issues: 4 False Flags: 1 Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 3 Low Severity Alerts: 0 Information Alerts: 28 Known Issues apache24-2.

2021-10-05

2021-08

Security Report for TrueNAS 12.0-U5.1

This is a security scan report of a default install of TrueNAS 12.0-U5.1. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Known Issues: 8 Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 2 Low Severity Alerts: 0 Information Alerts: 28 Known Issues freetype2-2.

2021-08-10

2021-06

Security Report for TrueNAS 12.0-U4

This is a security scan report of a default install of TrueNAS 12.0-U4. When enabled, TrueNAS system services must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a separate security audit finds issues that are not listed below, contact the iXsystems Support Team for assistance. Known Issues: 4 Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 2 Low Severity Alerts: 0 Information Alerts: 28 Known Issues freetype2-2.

2021-06-01

2021-04

NAME:WRECK Vulnerability Status

On April 15th, 2021 the US Cyber Security & Infrastructure Security Agency released an alert about a set of nine vulnerabilities referred to as NAME:WRECK. Full Announcement by Forescout Research Labs can be viewed from Forescout Forescout Research Labs' report states that FreeBSD 12.1 is vulnerable. FreeBSD patched this vulnerability and released a notice on 2020-09-02. FreeBSD Security Advisory : FreeBSD-SA-20:26.dhclient The TrueNAS security errata for this patch is posted here.

2021-04-16

2020-12

Security Scan of TrueNAS 12.0-U1

This report is relevant to a default install of TrueNAS 12.0-U1. As services are enabled, they must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS Documentation. If assistance is required, contact the iXsystems Support Team. If a your security audit finds alerts that are not listed below, contact the iXsystems Support Team for assistance. Critical Severity Alerts: 0 High Severity Alerts: 0 Medium Severity Alerts: 2 Low Severity Alerts: 0 Information Alerts: 37 Medium Severity Alerts: 2 Nessus Alert ID 51192 - SSL Certificate Cannot Be Trusted Synopsis: The SSL certificate for this service cannot be trusted.

2020-12-08

2020-09

End of Life Statement for TrueCommand 1.1

TrueCommand 1.1 has reached its End of Life and is no longer receiving security updates. The TrueCommand 1.3.2 release announcment can be found here: https://www.ixsystems.com/blog/truecommand-1-3-2/ Please schedule a time to upgrade to TrueCommand 1.3.2, if assistance is required please contact the iXsystems Support Team. Web: https://support.ixsystems.com Email: support@iXsystems.com Telephone: Monday-Friday, 6:00AM to 6:00PM Pacific Standard Time: US-only toll-free: 855-473-7449 option 2 Local and international: 408-943-4100 option 2 Telephone After Hours: (24x7 Gold Level Support only): US-only toll-free: 855-499-5131 International: 408-878-3140 (International calling rates will apply)

2020-09-29

End of Life Statement for TrueCommand 1.0

TrueCommand 1.0 has reached its End of Life and is no longer receiving security updates. The TrueCommand 1.3.2 release announcment can be found here: https://www.ixsystems.com/blog/truecommand-1-3-2/ Please schedule a time to upgrade to TrueCommand 1.3.2, if assistance is required please contact the iXsystems Support Team. Web: https://support.ixsystems.com Email: support@iXsystems.com Telephone: Monday-Friday, 6:00AM to 6:00PM Pacific Standard Time: US-only toll-free: 855-473-7449 option 2 Local and international: 408-943-4100 option 2 Telephone After Hours: (24x7 Gold Level Support only): US-only toll-free: 855-499-5131 International: 408-878-3140 (International calling rates will apply)

2020-09-29

2020-04

Security Scan of TrueNAS 11.3-U2

This report is relevant to a default install of TrueNAS 11.3-U2. As services are enabled, they must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS User Guide. If assistance is needed to do so, contact the iXsystems Support Team. If in the course of a security audit you note alerts that are not listed below, contact the iXsystems Support Team for assistance.

2020-04-21

End of Life Statement for TrueNAS 11.3

TrueNAS 11.3-STABLE has reached its End of Life and is no longer receiving security updates. The TrueNAS 12.0 release announcment can be found here: https://www.truenas.com/docs/hub/intro/release-notes/tn-12_0-release/ Please schedule a time to upgrade to TrueNAS 12.0-U1, if assistance is required please contact the iXsystems Support Team.

2020-04-21

End of Life Statement for TrueNAS 11.2

TrueNAS 11.2-STABLE has reached its End of Life and is no longer receiving security updates. The TrueNAS 11.3 release announcment can be found here: https://www.ixsystems.com/blog/library/freenas-11-3-u2-1/ Please schedule a time to upgrade to TrueNAS 11.3-U2.1, if assistance is required please contact the iXsystems Support Team. Web: https://support.ixsystems.com Email: support@iXsystems.com Telephone: Monday-Friday, 6:00AM to 6:00PM Pacific Standard Time: US-only toll-free: 855-473-7449 option 2 Local and international: 408-943-4100 option 2 Telephone After Hours: (24x7 Gold Level Support only): US-only toll-free: 855-499-5131 International: 408-878-3140 (International calling rates will apply)

2020-04-21

2020-03

Security Scan of TrueNAS 11.2U8.1

This report is relevant to a default install of TrueNAS 11.2-U8.1. As services are enabled, they must be properly configured to prevent introducing any additional threat vectors. Follow industry best practices and the TrueNAS User Guide. If assistance is needed to do so, contact the iXsystems Support Team. If in the course of a security audit you note alerts that are not listed below, contact the iXsystems Support Team for assistance.

2020-03-31

TrueNAS Software Development Life Cycle

TrueNAS Software Development Life Cycle The TrueNAS (and FreeNAS) software development life cycle (SDLC) is the process for planning, creating, testing, deploying, and maintaining FreeNAS and TrueNAS releases. In TrueNAS there are five stages to the SDLC: requirement analysis, design and development, testing and evaluation, documentation, and maintenance. Requirement analysis: Determine the objectives, nature, and scope of future versions of the software. This involves gathering feedback and interpreting customer needs and requirements, diagnosing existing problems, and weighing the pros and cons of potential solutions.

2020-03-20

New Security Defaults for Active Directory

Critical Information for Current FreeNAS and TrueNAS Users regarding Active Directory Microsoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. These new security defaults are likely to disrupt existing FreeNAS and TrueNAS deployments once Windows systems are updated. Users not using Active Directory are unaffected by these Microsoft updates. The Windows updates may appear sometime in March 2020. *FreeNAS and TrueNAS users that utilize Active Directory should update to version 11.

2020-03-04