Console menu

The console menu is what the virtual appliance (OVA and qcow2) shows on its console in the hypervisor. An installation with Docker has no console menu. The items are quoted here exactly as the menu shows them.

Choose an item by typing its number and pressing Enter. If the screen is garbled, Enter draws the menu again.
A yes/no question needs yes, y, j or ja. Anything else means no, including Enter on its own.
The top shows the appliance version, the VM image version and the address of the web interface. “NO NETWORK ADDRESS” means the appliance has no address. The menu redraws itself once it gets one.
Restart, update and reinstall start within a minute. The screen shows “working… mm:ss” and finally <Title>: WORKED. or <Title>: FAILED (exit N).. Pressing Enter leaves the action running in the background. After 15 minutes the screen says “Not finished after 15 minutes. Menu item 4 shows the log.”

1 Status, and how to reach the web interface

Shows:

network address and hostname;
operating system, kernel, whether automatic security updates are on, and how many are pending;
whether the appliance is running, stopped or not installed yet, and why;
free and used space on the data disk;
whether the controller is running, and when it last checked in. It should check in every minute;
the controller’s last action;
Appliance software version and VM image version;
the address of the web interface and the SHA-256 fingerprint of the appliance’s certificate.

If the browser warns about the certificate the first time, compare it with the fingerprint shown here.

2 Test the connection to sslbrain Cloud

Tests cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com. The appliance must reach all three.

Answer	Meaning
reachable (HTTP nnn)	The address answers.
NAME DOES NOT RESOLVE	The appliance cannot look up the name in DNS.
NO ANSWER	Usually a firewall blocking the traffic.

The ports are listed under Security.

3 Configure the network

Sets a static address on the virtual machine. The screen asks for:

the IPv4 address with prefix, for example 192.168.1.50/24;
default gateway;
DNS servers, comma-separated;
hostname.

Cancel keeps the current settings.

4 View logs

Scroll with the arrow keys and close with q.

Item	Log
1 The appliance, last 200 lines	The appliance’s own log
2 The controller: updates, restarts, signature checks	The controller’s log: updates, restarts and signature checks
3 First boot: image pull, verification, activation	The first start: download, verification and activation of the appliance image
b Back	Back to the menu

If an update fails, the reason is in log 2. See When something does not work.

5 Restart the appliance

Restarts the appliance (the container). The virtual machine keeps running. The web interface is gone for a moment.

6 Update to the latest version

Does the same as Update now in the web interface. The latest signed version is downloaded and its signature checked. The appliance must answer correctly within 300 seconds of starting. If any step fails, the version that ran before is started. See Keep sslbrain up to date.

7 Free disk space

Deletes unused Docker images and build cache, and shows free space before and after. The running appliance is not touched.

8 Reboot this machine

Restarts the whole virtual machine after the question “Reboot this machine now?”. The appliance starts by itself once the machine is up.

9 Danger zone

The item is called Danger zone (root shell, support SSH, OS update, disk), and the screen warns: “This may break your installation, please backup first.” Take a backup first: Save a backup and restore from it.

1 Open a root shell

The root account has no password. The root shell opens with a one-time code from the console and an answer from sslbrain Cloud.

Choose 9 Danger zone, then 1 Open a root shell. The screen shows a code, for example K7Q2-M9XD. It is valid for 30 minutes and for one session.
Open Appliances in sslbrain Cloud, click the appliance and choose the Shell access tab. Enter the code and click Get the answer.
Type the answer, for example 4H7M-Q2XD-9KTB, at Answer in the console. A correct answer opens one root shell, and the code is spent.

Licence	Who can fetch the answer
Free and Basic	FairSSL support, with a support case. Send the code from the console to support.
Professional and Enterprise	The account’s Owner and Administrator themselves, and FairSSL support with a support case.

The licence must be valid. A licence waiting for payment does not give the customer’s administrators access. The support case is written to the log, and the customer can see it.

Five wrong answers in a row lock for 15 minutes. After that, the menu shows a new code.
sslbrain Cloud logs who fetched the answer to which code, and when.
The appliance reports to sslbrain Cloud when a session opens and when it closes. The session’s recording is sent with the close. If the power goes or the console stops during a session, the close and the recording are reported when the console starts again. If it is over 2 MiB compressed, the end is sent. Owner and Administrator see the sessions and download the recordings under Shell access. The recording also stays on the machine, see 3 View recorded shell sessions.
The account’s Owner and Administrators with a verified email address get a mail each time a session actually opens. Fetching an answer sends no mail.
When the appliance has no connection to sslbrain Cloud, it keeps the events and sends them when the connection is back. The mail about the opening comes then.
An appliance that is not yet registered and connected to sslbrain Cloud cannot show a code. FairSSL support can then help through temporary SSH.

2 Temporary SSH for support

Opens SSH for 24 hours so FairSSL support can log in. See Support and diagnostics.

3 View recorded shell sessions

Shows the last 10 recordings from the root shell, with everything that was on the screen. The recordings are also sent to sslbrain Cloud. SSH sessions are not recorded here.

4 Force an OS update now

Installs operating system updates now instead of at the daily run. A full upgrade also moves packages the appliance depends on, such as Docker. The screen says whether the machine needs a restart. Otherwise a required restart happens at 03:00.

5 Claim new space from the virtual disk

Extends the partition, volume and file system to the size of the virtual disk. The disk itself is enlarged in the hypervisor.

Shut down the virtual machine.
Enlarge the virtual disk in the hypervisor.
Start the machine and choose 9 Danger zone, then 5 Claim new space from the virtual disk.

6 Reinstall the appliance software (data kept)

Downloads the running version again, checks its signature and recreates the container. Certificates, settings, accounts and the database are kept. The web interface is gone for a few minutes. This item is one of the fixes when an update fails. See When something does not work.

0 Back to the main menu returns to the main menu.