Console menu

Open the console menu to check the appliance’s status and find its web address.

What you need

Access to the virtual machine’s console in the hypervisor.
A virtual appliance (OVA or qcow2). Docker has no console menu.

Open the web interface from the console

Open the virtual machine’s console in the hypervisor.
Type 1 and press Enter for 1 Status, and how to reach the web interface.
Open the displayed web address in your browser. If the browser warns about the certificate, compare its SHA-256 fingerprint with the one in the console.

Check that it works

The browser shows the appliance’s sign-in page. The console shows the web address and Appliance software version.

If it fails

NO NETWORK ADDRESS → see the network settings under 3 Configure the network.
The connection to sslbrain Cloud (EU) fails → run 2 Test the connection to sslbrain Cloud.
An action shows FAILED (exit N) → open 4 View logs and find the cause.
An action has not finished after 15 minutes → open the log in menu item 4. Enter lets the action continue in the background.

The menu is in English. Type the item number and press Enter. A yes/no question requires yes, y, j or ja; Enter alone means no. An action shows working... mm:ss, then WORKED. or FAILED (exit N).

1 Status, and how to reach the web interface

Shows:

network address and hostname;
operating system, kernel, whether automatic security updates are on, and how many are pending;
whether the appliance is running, stopped or not installed yet, and why;
free and used space on the data disk;
whether the controller is running, and when it last checked in. It should check in every minute;
the controller’s last action;
Appliance software version and VM image version;
the address of the web interface and the SHA-256 fingerprint of the appliance’s certificate.

If the browser warns about the certificate the first time, compare it with the fingerprint shown here.

2 Test the connection to sslbrain Cloud

Tests cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com. The appliance must reach all three.

Answer	Meaning
reachable (HTTP nnn)	The address answers.
NAME DOES NOT RESOLVE	The appliance cannot look up the name in DNS.
NO ANSWER	Usually a firewall blocking the traffic.

The ports are listed under Security.

3 Configure the network

Sets a static address on the virtual machine. The screen asks for:

the IPv4 address with prefix, for example 192.168.1.50/24;
default gateway;
DNS servers, comma-separated;
hostname.

Cancel keeps the current settings.

4 View logs

Scroll with the arrow keys and close with q.

Item	Log
1 The appliance, last 200 lines	The appliance’s own log
2 The controller: updates, restarts, signature checks	The controller’s log: updates, restarts and signature checks
3 First boot: image pull, verification, activation	The first start: download, verification and activation of the appliance image
b Back	Back to the menu

If an update fails, the reason is in log 2. See When something does not work.

5 Restart the appliance

Restarts the appliance (the container). The virtual machine keeps running. The web interface is gone for a moment.

6 Update to the latest version

Does the same as Update now in the web interface. The latest signed version is downloaded and its signature checked. The appliance must answer correctly within 300 seconds of starting. If any step fails, the version that ran before is started. See Keep sslbrain up to date.

7 Free disk space

Deletes unused Docker images and build cache, and shows free space before and after. The running appliance is not touched.

8 Reboot this machine

Restarts the whole virtual machine after the question “Reboot this machine now?”. The appliance starts by itself once the machine is up.

9 Danger zone

The item is called Danger zone (root shell, support SSH, OS update, disk), and the screen warns: “This may break your installation, please backup first.” Take a backup first: Save a backup and restore from it.

1 Open a root shell

The root account has no password. The root shell opens with a one-time code from the console and an answer from sslbrain Cloud.

Choose 9 Danger zone, then 1 Open a root shell. The screen shows a code, for example K7Q2-M9XD. It is valid for 30 minutes and for one session.
Open Appliances in sslbrain Cloud, click the appliance and choose the Shell access tab. Enter the code and click Get the answer.
Type the answer, for example 4H7M-Q2XD-9KTB, at Answer in the console. A correct answer opens one root shell, and the code is spent.

Licence	Who can fetch the answer
Free and Basic	FairSSL support, with a support case. Send the code from the console to support.
Professional and Enterprise	The account’s Owner and Administrator themselves, and FairSSL support with a support case.

The licence must be valid. A licence waiting for payment does not give the customer’s administrators access. The support case is written to the log, and the customer can see it.

Five wrong answers in a row lock for 15 minutes. After that, the menu shows a new code.
sslbrain Cloud logs who fetched the answer to which code, and when.
The appliance reports to sslbrain Cloud when a session opens and when it closes. The session’s recording is sent with the close. If the power goes or the console stops during a session, the close and the recording are reported when the console starts again. If it is over 2 MiB compressed, the end is sent. Owner and Administrator see the sessions and download the recordings under Shell access. The recording also stays on the machine, see 3 View recorded shell sessions.
The account’s Owner and Administrators with a verified email address get a mail each time a session actually opens. Fetching an answer sends no mail.
When the appliance has no connection to sslbrain Cloud, it keeps the events and sends them when the connection is back. The mail about the opening comes then.
An appliance that is not yet registered and connected to sslbrain Cloud cannot show a code. FairSSL support can then help through SSH for troubleshooting.

2 Temporary SSH for support

Only someone with access to the appliance’s local console can open SSH for troubleshooting, for 24 hours. Even then, it requires access to the appliance on your network. FairSSL support can then log in. See Support and diagnostics.

3 View recorded shell sessions

Shows the last 10 recordings from the root shell, with everything that was on the screen. The recordings are also sent to sslbrain Cloud. SSH sessions are not recorded here.

4 Force an OS update now

Installs operating system updates now instead of at the daily run. A full upgrade also moves packages the appliance depends on, such as Docker. The screen says whether the machine needs a restart. Otherwise a required restart happens at 03:00.

5 Claim new space from the virtual disk

Extends the partition, volume and file system to the size of the virtual disk. The disk itself is enlarged in the hypervisor.

Shut down the virtual machine.
Enlarge the virtual disk in the hypervisor.
Start the machine and choose 9 Danger zone, then 5 Claim new space from the virtual disk.

6 Reinstall the appliance software (data kept)

Downloads the running version again, checks its signature and recreates the container. Certificates, settings, accounts and the database are kept. The web interface is gone for a few minutes. This item is one of the fixes when an update fails. See When something does not work.

0 Back to the main menu returns to the main menu.