.. _appendix-chapter-faq:

FAQ
===

General Questions
-----------------

How do I report a security issue?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The process for handling security-related problems is described in our GitHub `security policy`_.

.. _security policy: https://github.com/bareos/bareos/security/policy

.. _bareos-1920-updatefaq:

Upgrade of Bareos 19.2 with installed Python plugin on Debian
-------------------------------------------------------------

.. index::
   single: Platform; Debian
   single: bareos-19.2; Upgrade with Python packages on Debian

On Debian platform, if you update from Bareos <=19.2 to Bareos >= 20 with any Python plugin installed, you will face some difficulties with :command:`apt upgrade`.
This is due to the renaming of Python plugin packages into python2 packages and introducing the python3 packages. apt/dpkg is not able to handle this situation alone.


.. code-block:: shell-session
   :caption: Error upgrading from 19.2 with apt upgrade

   apt upgrade bareos bareos-director bareos-filedaemon
   Reading package lists... Done
   Building dependency tree
   Reading state information... Done
   Calculating upgrade... Done
   Some packages could not be installed. This may mean that you have
   requested an impossible situation or if you are using the unstable
   distribution that some required packages have not yet been created
   or been moved out of Incoming.
   The following information may help to resolve the situation:

   The following packages have unmet dependencies:
      bareos-director-python-plugin : Depends: bareos-common (= 19.2.12-2) but 21.1.2-1 is to be installed
      bareos-filedaemon-python-plugin : Depends: bareos-common (= 19.2.12-2) but 21.1.2-1 is to be installed
   E: Broken packages


In this case, it is advised to use :command:`apt` with `full-upgrade` and directly move to new recommended python3 plugin.

.. code-block:: shell-session
   :caption: for full upgrade to python3

   apt full-upgrade bareos-director-python3-plugin bareos-filedaemon-python3-plugin


.. _bareos-1825-updatefaq:

Bareos 18.2.5 FAQ
--------------------

What is the important feature introduced in Bareos 18.2?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

#. A new network protocol was introduced where TLS is immediately used.

  * When no certificates are configured, the network connection will still be
    encrypted using TLS-PSK.
  * When certificates are configured, Bareos will configure both TLS-PSK and
    TLS with certificates at the same time, so that the TLS protocol will
    choose which one to use.

How to update from Bareos 17.2?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

To update from Bareos 17.2, as always all core components need to be updated as
they need to be of the same Bareos version (|bconsole|, |bareosDir|, |bareosSd|).

How can I see what encryption is being used?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Whenever a connection is established, the used cipher is logged and will be
shown in the job log and messages output:


.. code-block:: sh
   :caption: console output

   Connecting to Director localhost:9101
    Encryption: ECDHE-PSK-CHACHA20-POLY1305



.. code-block:: sh
   :caption: job log

   [...] JobId 1: Connected Storage daemon at bareos:9103, encryption: ECDHE-PSK-CHACHA20-POLY1305

What should I do when I get "TLS negotiation failed"?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Bareos components use TLS-PSK as default. When the TLS negotiation fails then most likely identity
or password do not match. Doublecheck the component name and password in the respective configuration
to match each other.

How does the compatibility with old clients work?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The Bareos Director always connects to clients using the new immediate TLS
protocol.  If that fails, it will fall back to the old protocol and try to
connect again.

When the connection is successful, the director will store which protocol needs
to be used with the client and use this protocol the next time this client will
be connected.  Whenever the configuration is reloaded, the protocol information
will be cleared and the probing will be done again when the next connection to
this client is done.

.. code-block:: sh
   :caption: probing the client protocol

   [...] JobId 1: Probing... (result will be saved until config reload)
   [...] JobId 1: Connected Client: bareos-fd at localhost:9102, encryption: ECDHE-PSK-CHACHA20-POLY1305
   [...] JobId 1:    Handshake: Immediate TLS



Does Bareos support TLS 1.3?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Yes. If Bareos is compiled with OpenSSL 1.1.1, it will automatically use TLS
1.3 where possible.


Are old Bareos clients still working?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Bareos clients < 18.2 will still work, and the old protocol will be used.
This was mostly tested with Bareos 17.2 clients.



Can I use a new Bareos 18.2 client with my Bareos 17.2 system?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Yes, it is possible to use a Bareos 18.2 client, but some changes need to be done
in the configuration.

It is possible to use the Bareos 18.2 client with a Bareos 17.2 Server. However,
the new immediate TLS Protocol and TLS-PSK are not usable, as the server
components do not support it. This also means that it is **not** possible to
use TLS with certificates in this setup. The communication will be unencrypted
using the old protocol.

As in Bareos 18.2, the default value of **TLS Enable** was changed to **yes** to
automatically use TLS-PSK, and the meaning of **TLS Require** also was altered
so that it enforces the new protocol, these settings need to be changed.

In order to make Bareos 18.2 clients work with a Bareos 17.2 server, the following
changes need to be done:

* **On all Bareos 18.2 clients**, the directive **TLS Enable** in the file
  :file:`/etc/bareos/bareos-fd.d/director/bareos-dir.conf` needs to be set to **no**.
  If the directive **TLS Require** is set, it also needs
  to be set to **no** in the same file.
  This is enough for standard clients which do not have any special setup for the
  connections, and also for clients that are configured to use **client initiated
  connections**.

* For **clients that use the passive mode**, also the clients' setting in the
  Bareos 17.2 director in file :file:`/etc/bareos/bareos-dir.d/client/passive-fd.conf` needs
  to to be altered so that both directives **TLS Enable**
  and **TLS Require** are set to **no**.
