Following the tutorial and am trying to complete the security lockdown. I have a ugreen dxp4800pro and a mac. I have gotten to sep 5 in the security lockdown. Do I need to download unifi to complete this step? When I try to connect via ssh terminal I get Warning:connection is not using a post quantum key exchange algorithm. This session may be vulnerable to store now decrypt later attacks This server may need to be updated. Then it asks for password but password never seems to work. I’m using same login credentials I use to log in through the app or web browser. So any help would be greatly appreciated. Thanks in advance.. Joe
14 replies
tomspark wrote:
Hey Joe — thanks for posting, sorry for the slow reply. Two things: 1. The "post quantum key exchange" warning is a recent macOS SSH client heads-up about future ciphers — not a real error and doesn't block login. Ignore it. 2. SSH to a UGREEN NAS uses the SYSTEM user password which isn't always the same as your UGOS web-login password. Quick checks in order: - Is SSH actually enabled? UGOS → Control Panel → SSH (or Network Services) → toggle it ON if it isn't. - Username: try the one you set during the INITIAL NAS setup wizard — usually your first name capitalized (e.g. Joe), not admin. - Password: if you've changed your UGOS web password since first setup, try the ORIGINAL one — UGOS sometimes doesn't sync the system user password when you change it in the web UI. Reply back with whether SSH is enabled and what username you're typing into the ssh command and I'll narrow it from there. You don't need UniFi for any of this — step 5's lockdown is just SSH-side.
jackhammer57 wrote:
Hi Tom, Nothing to be sorry about. Your reply was anything but slow. I figured out the password problem. I was using a lowercase login instead of upper case. So now I’ve gotten the media stack downloaded but it seems to have hung up on me. It is stuck on installing. I logged into dashboard and it appears that gluetun is crashing. Dashboard is showing 8 of 15 services are up. Here is a pic not sure if it will show up properly or not. Thanks again for the help and all the work you have done to put this together. Joe
tomspark wrote:
Nice catch on the uppercase username! That's gluetun in a crash-restart loop, which happens when the VPN credentials haven't been set yet on a fresh install. Easy fix: 1. SparkBox Dashboard → Settings → Network → Edit VPN Settings 2. Heads-up — known UI bug: the VPN panel sometimes doesn't render on the first click. If it's blank, switch to the Home tab once then back to Settings → Network and it'll appear. 3. Drop in your WireGuard config (or OpenVPN creds). 4. Save. Gluetun comes up clean and the 7 dependent services (qBit, arr stack, Seerr, etc.) start behind it. If you don't have a VPN yet, Surfshark and NordVPN both work well with SparkBox via WireGuard.
tomspark wrote:
Quick correction on my last message — scratch the NordVPN suggestion, go with Surfshark. SparkBox's gluetun config is WireGuard-first and Surfshark's WireGuard support is what we test against. If you don't already have a VPN, Surfshark is the one. Sorry for the noise.
jackhammer57 wrote:
Having a problem with the edit vpn settings button not working. The tooltip in the vpn box isn’t working either. I have tried switching tabs and coming back but the edit button and tooltip in the vpn box still aren’t working. I have protonvpn and have set up a wireguard key.
tomspark wrote:
That's worse than the panel-render bug I warned about — the Edit button itself isn't firing, which is a JS-handler issue (probably stale dashboard JS). Two paths: 1. Hard-refresh: Ctrl+Shift+R on the dashboard. If the button still doesn't work, F12 → Console tab, click Edit VPN Settings again, paste any red errors. 2. Always-works workaround — edit .env directly via SSH: sudo nano /opt/sparkbox/.env Add these lines from your ProtonVPN WireGuard config: VPNPROVIDER=protonvpn VPNTYPE=wireguard WIREGUARDPRIVATEKEY=<your-private-key WIREGUARDADDRESSES=<your-assigned-IP/32 SERVERCOUNTRIES=United States Save (Ctrl+O, Enter, Ctrl+X), then: sudo sparkbox restart media Gluetun comes up clean and the 7 dependent services follow. Tracking the Edit-button regression as a class-level bug — thanks for the data.
jackhammer57 wrote:
so I updated the .env file like you suggested. (had to do it manually). VPN box now shows: Current: protonvpn · WireGuard · United States however still having problems with Gluetun. getting an error: dependency failed to start: container sb-gluetun is unhealthy
tomspark wrote:
Progress — .env was picked up (the VPN box confirming protonvpn/WireGuard/US is proof of that). The unhealthy gluetun is now a credentials-format issue 9 times out of 10. Pin the exact error: sudo docker logs sb-gluetun 2&1 | tail -30 Most common Proton + gluetun gotchas: 1. WIREGUARDPRIVATEKEY should be just the value after PrivateKey = in your downloaded ProtonVPN .conf file — no quotes, no PrivateKey = prefix. 2. WIREGUARDADDRESSES needs CIDR notation like 10.2.0.2/32. If you only pasted the bare IP without /32, gluetun rejects it. Paste the log output and we'll narrow it from there.
jackhammer57 wrote:
here is the error log
tomspark wrote:
Found it — gluetun's rejecting your SERVERCITIES value ("San Francisco" isn't in Proton's gluetun-supported city list for the US — that's the long list of valid cities you see in the error). Easiest fix is to drop the city filter entirely and let gluetun pick any US server: sudo nano /opt/sparkbox/.env Find the SERVERCITIES line and either delete it or change it to: SERVERCITIES= (empty value). Save, then: sudo sparkbox restart media Gluetun should come up green and the other 7 services follow. We can revisit picking a specific city later once you've got the stack running.
jackhammer57 wrote:
Tom, Thanks for all your help today. I am all green and have 15 of 15 services running. that was so much easier than if I had to make it all work together myself. I am sure we will be chatting more in the near future. Joe
tomspark wrote:
15/15 — that's the goal. You sticking through every layer tonight is exactly what beta testing is for. Three of the bugs you hit (Portainer 2.41 plaintext root cause + repair-seerr EACCES + the repair-seerr silent crash) became fixes in v1.6.101 / v1.6.102 / v1.6.103 — your evidence is what made those land same-day instead of next month. Thanks Joe. Enjoy the stack. Drop a thread or DM whenever something else comes up.
jackhammer57 wrote:
Thanks again. Your YouTube video showed up at just the right time. A couple of weeks ago I saw your jellyfin video as well as the one from digital aloha. I just got my nas, so yesterday I sat down to find the original video and came across your sparkbox video. And man am I sure glad I did. I would have definitely been pulling out what little hair I got left. Awesome job!!!
tomspark wrote:
That means a lot — really glad it landed when you needed it. The whole reason I built sparkbox was so people didn't have to sink a weekend learning docker compose just to watch their own movies. Enjoy the stack, and welcome to the d/sparkbox community.