<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" >

<channel><title><![CDATA[Akzium - Blog]]></title><link><![CDATA[https://www.akzium.com/akziumblog]]></link><description><![CDATA[Blog]]></description><pubDate>Sun, 27 Sep 2026 06:15:53 -0500</pubDate><generator>Weebly</generator><item><title><![CDATA[Resolve Fortinet Error: Unable to connect to Fortiguard servers]]></title><link><![CDATA[https://www.akzium.com/akziumblog/resolve-fortinet-error-unable-to-connect-to-fortiguard-servers]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/resolve-fortinet-error-unable-to-connect-to-fortiguard-servers#comments]]></comments><pubDate>Thu, 24 Sep 2026 02:55:18 GMT</pubDate><category><![CDATA[Fortigate Anycast]]></category><category><![CDATA[Unable to reach Fortiguard]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/resolve-fortinet-error-unable-to-connect-to-fortiguard-servers</guid><description><![CDATA[       If your Fortinet firewall has suddenly begun displaying a "Unable to connect to Fortiguard Servers" message, here's the fix:Login to Fortigate with administrator accountLaunch CLIconfig system fortiguard&nbsp; &nbsp; set fortiguard-anycast disable&nbsp; &nbsp; set protocol https&nbsp; &nbsp; set port 443endexecute update-nowGive the system a few minutes and the error should resolve.Fortinet also provides this alternative:config system fortiguardset fortiguard-anycast disableset protocol u [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/unablefortiguard10_orig.webp" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="paragraph"><font size="4"><font color="#2a2a2a" style="">If your Fortinet firewall has suddenly begun displaying a "Unable to connect to Fortiguard Servers" message, here's the fix:</font><br /><br /><br /><font color="#2a2a2a" style="">Login to Fortigate with administrator account</font><br /><font color="#2a2a2a" style="">Launch CLI</font><br /><br /><br /><font color="#2a2a2a" style="">config system fortiguard<br />&nbsp; &nbsp; set fortiguard-anycast disable<br />&nbsp; &nbsp; set protocol https<br />&nbsp; &nbsp; set port 443<br />end</font><br /><br /><font color="#2a2a2a" style="">execute update-now</font><br /><br /><br /><font color="#2a2a2a" style="">Give the system a few minutes and the error should resolve.<br /><br />Fortinet also provides this alternative:<br /><br /></font><span style="color: rgba(0, 0, 0, 0.9);">config system fortiguard</span><br /><span style="color: rgba(0, 0, 0, 0.9);">set fortiguard-anycast disable</span><br /><span style="color: rgba(0, 0, 0, 0.9);">set protocol udp</span><br /><span style="color: rgba(0, 0, 0, 0.9);">set port 8888</span><br /><span style="color: rgba(0, 0, 0, 0.9);">set sdns-server-ip 208.91.112.220 173.243.140.53 210.7.96.53 200.91.112.220</span><br /><span style="color: rgba(0, 0, 0, 0.9);">end<br /></span><br /><span style="color: rgba(0, 0, 0, 0.9);">execute update-now<br /><br /></span></font><font size="3" color="#2a2a2a"># FortiGate Real-Time Debug Commands for FortiGuard Troubleshooting<br /><br />## 1. FortiGuard License &amp; Package Updates Debug<br /># Use this to troubleshoot firmware updates, AV definitions, or IPS signatures.<br />diagnose debug reset<br />diagnose debug application updateff -1<br />diagnose debug enable<br /><br /># Trigger the update check manually in a separate window or after enabling debug:<br />execute update-now<br /><br /><br />## 2. Web Filtering &amp; Rating Lookups Debug<br /># Use this to troubleshoot web filtering rating timeouts and certificate validation.<br />diagnose debug reset<br />diagnose debug application urlfilter -1<br />diagnose debug enable<br /><br /># Test the rating resolution manually from the CLI:<br />diagnose fortiguard url-rating get google[.]com<br />*note: remove the [ ] when issuing the command. They're added to prevent LI from automatically creating a URL link.<br /><br />## 3. Active FortiGuard Server List Matrix<br /># Use this to verify that the firewall has successfully switched to unicast nodes.<br />diagnose fortiguard table<br /><br /><br />## 4. Turn Off Debug Logging<br /># Run this immediately after capturing data to prevent high CPU utilization.<br />diagnose debug disable<br />diagnose debug reset</font><font color="#2a2a2a"><br /></font><br /></div>]]></content:encoded></item><item><title><![CDATA[Preserve Legacy Windows OS Activation After VMware to Proxmox Migration]]></title><link><![CDATA[https://www.akzium.com/akziumblog/preserve-legacy-windows-os-activation-after-vmware-to-proxmox-migration]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/preserve-legacy-windows-os-activation-after-vmware-to-proxmox-migration#comments]]></comments><pubDate>Thu, 03 Sep 2026 00:58:29 GMT</pubDate><category><![CDATA[Windows Activation After Proxmox Migration]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/preserve-legacy-windows-os-activation-after-vmware-to-proxmox-migration</guid><description><![CDATA[         Migrating a Windows VM from VMware to Proxmox? Don't Lose Your Windows Server Activation. Microsoft retired telephone activation as of December 2025. Users are redirected to an online portal (aka[.]ms/aoh) that requires a Microsoft Account. You log in, type in your Installation ID (generated on the server by running slui 4), and it attempts to generate a Confirmation ID for you. If you have a Retail or Volume License (MAK) key and you are simply doing a clean install or an offline activ [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/vmware-to-proxmox-min-png_orig.webp" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph" style="text-align:left;"><font size="3" color="#2a2a2a">Migrating a Windows VM from VMware to Proxmox? Don't Lose Your Windows Server Activation. Microsoft retired telephone activation as of December 2025. Users are redirected to an online portal (aka[.]ms/aoh) that requires a Microsoft Account. You log in, type in your Installation ID (generated on the server by running slui 4), and it attempts to generate a Confirmation ID for you. If you have a Retail or Volume License (MAK) key and you are simply doing a clean install or an offline activation on the exact same hardware, the portal will generally work. It will process the Installation ID and hand back a Confirmation ID to activate the server. <br /><br />An already-activated (non-KMS) Windows stores its activation in tokens.dat, which rode along with the VM's disk during the conversion. At boot, Windows re-validates that stored activation against the current hardware locally. Match the SMBIOS UUID (plus MAC/SMBIOS strings) to what VMware presented, and the existing activation re-validates with zero server contact.<br /><br />Here's how to do it (assuming a Retail / MAK / Volume license):<br /><br />Step 1 &mdash; Check your license type. In the guest, run slmgr /dlv. If it's KMS, it re-activates automatically &mdash; you're done. If it's Retail or MAK, keep going.<br /><br />Step 2 &mdash; Grab the original UUID from your .vmx. Find the uuid.bios line, e.g.: uuid.bios = "56 4d 59 5c 4c 56 4b 10-b8 e0 66 84 d3 2d 01 63"<br /><br />Step 3 &mdash; Fix the byte order: SMBIOS stores the first three UUID fields little-endian. Reverse the byte order within groups 1&ndash;3 only. Those example bytes become: 5c594d56-564c-104b-b8e0-6684d32d0163 Copying the raw string left-to-right gives the WRONG UUID and breaks activation.<br /><br />Step 4 &mdash; Apply it in Proxmox. Edit /etc/pve/qemu-server/&lt;VMID&gt;.conf and set: smbios1: uuid=5c594d56-564c-104b-b8e0-6684d32d0163 <br />**(Or enter it via the web UI under Options &rarr; SMBIOS settings.)<br /><br />Step 5 &mdash; Match the MAC address. Copy ethernet0.address from the .vmx onto your net0 line so the NIC identity carries over too. (*note: you can preserve the ethernet MAC address during the VMw-to-Pmx conversion)<br /><br />Step 6 &mdash; Verify inside the guest. Boot the VM and run: wmic path win32_computersystemproduct get uuid.<br />Confirm it matches your target, then check slmgr /xpr.<br /><br />One caveat: if your .vmx contains SMBIOS.reflectHost = "TRUE", the VM was mirroring the physical ESXi host's SMBIOS (common with OEM/ROK licenses). <br /><br />In that case you'll need to replicate the host's manufacturer strings and its SLIC/MSDM ACPI table instead &mdash; a different process.<br /><br />And remember: you own the license. If a MAK/Retail key still shows unactivated after matching the hardware, online reactivation is completely legitimate.<br /><br />Moving off VMware doesn't have to mean re-licensing your legacy Windows Server OS, but there's some techical work involved in making it function properly.</font></div>]]></content:encoded></item><item><title><![CDATA[VirtIO Drivers for Windows Operating Systems]]></title><link><![CDATA[https://www.akzium.com/akziumblog/virtio-drivers-for-windows-operating-systems]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/virtio-drivers-for-windows-operating-systems#comments]]></comments><pubDate>Tue, 01 Sep 2026 00:25:46 GMT</pubDate><category><![CDATA[VirtIO Archives]]></category><category><![CDATA[VirtIO Drivers]]></category><category><![CDATA[VirtIO Windows Drivers]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/virtio-drivers-for-windows-operating-systems</guid><description><![CDATA[         If you're still running older versions of Windows Server OS (2003/2008/2012) and are needing an archived copy of the VirtIO drivers for Windows - the download site is fedorapeople[.]org/groups/virt/virtio-win/direct-downloads/archive-virtio/. The fedorapeople[.]org domain is used by the virtio-win project, which is an open-source initiative sponsored by Red Hat and the Fedora Project. This repository hosts the paravirtualized network, storage, and balloon memory drivers necessary for ru [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/virtiodrivers-01_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3"><span style="color:rgba(0, 0, 0, 0.9)">If you're still running older versions of Windows Server OS (2003/2008/2012) and are needing an archived copy of the VirtIO drivers for Windows - the download site is fedorapeople[.]org/groups/virt/virtio-win/direct-downloads/archive-virtio/. The fedorapeople[.]org domain is used by the virtio-win project, which is an open-source initiative sponsored by Red Hat and the Fedora Project. This repository hosts the paravirtualized network, storage, and balloon memory drivers necessary for running Windows virtual machines efficiently on KVM/Qemu-based hypervisors including Proxmox VE.</span><span style="color:rgba(0, 0, 0, 0.9)"> </span><br /><br /><span style="color:rgba(0, 0, 0, 0.9)">Some older drivers are only available in .vfd (virtual floppy drive) format or as device driver files (.sys, .inf, .cat, .dll, .pdb). For example, the virtio .iso that contains drivers compatible with Windows Server 2008 are in this format, there is no .MSI or .EXE installer.</span><br /><br /><span style="color:rgba(0, 0, 0, 0.9)">So, to install these device drivers you have to launch Device Manager via Start &gt; Run &gt; devmgmt[.]msc and navigate to Devices. Expand the list and find devices with yellow exclamation marks - typically ethernet controllers, PCI devices. In the case of the ethernet devices Right-Click the Ethernet Controller and select Update Device Driver Software. Then choose Browse My Computer for the driver software. Point it to the mounted .ISO and browse to NetKVM\wlh\amd64 folder and install the updated device driver. Repeat for other devices (example: Memory Balloon driver is in Balloon\wlh\amd64 which typically shows up as "Unknown PCI device". *note: avoid memory ballooning in production environments.</span><br /><br /><span style="color:rgba(0, 0, 0, 0.9)">Once all of the device drivers are updated - reboot the VM. You may also need to go back and clean up "ghost" adapters that are left over from a VMware to Proxmox conversion. Go back into Device Manager &gt; View &gt; Show Hidden Devices and remove/uninstall any devices that are greyed-out in the device list.<br /><br />If you're migrating Windows OS server VMs from VMware to Proxmox, in many cases the VM will only boot at first if you change the HDD type to SATA. Once it boots, you install the VirtIO drivers and add a small 1Gb Single-SCSI volume and reboot. Once you've rebooted, Windows will detect the SCSI disk and virtual device. Shut down Windows. Remove the test SCSI disk. Change the disks from SATA to Virtio-Single-SCSI by first Detaching the disk, and then reattach by click on Unused Disk, Edit, and then change Bus/Device to SCSI. Navigate to Options, Boot Order, change the boot order to put the SCSI device first, and make sure to check the Enabled box next to the disk. The Windows server VM should boot and use the drive as SCSI rather than SATA - with a nice performance improvement.</span></font><br /><br /></div>]]></content:encoded></item><item><title><![CDATA[Proxmox rSysLog: Setting up rsyslog on Proxmox VE]]></title><link><![CDATA[https://www.akzium.com/akziumblog/proxmox-rsyslog-setup]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/proxmox-rsyslog-setup#comments]]></comments><pubDate>Tue, 14 Jul 2026 18:43:05 GMT</pubDate><category><![CDATA[Proxmox rsyslog]]></category><category><![CDATA[Proxmox Syslog Forwarding]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/proxmox-rsyslog-setup</guid><description><![CDATA[           Syslog (System Logging Protocol) is a standard protocol used by network devices, operating systems, and applications to generate and send diagnostic messages. These logs contain timestamps, severity levels, and specific data about system events, security warnings, configuration changes, or service failures.Tools like rsyslog (an enhanced, modular version of syslog) act as the delivery service. They process those event messages locally and can be configured to forward them over the net [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/published/rsyslog-logo-512x512.png?1784054926" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div><div style="height: 20px; overflow: hidden; width: 100%;"></div> <hr class="styled-hr" style="width:100%;"></hr> <div style="height: 20px; overflow: hidden; width: 100%;"></div></div>  <div class="paragraph"><font size="3"><font color="#2a2a2a">Syslog (System Logging Protocol) is a standard protocol used by network devices, operating systems, and applications to generate and send diagnostic messages. These logs contain timestamps, severity levels, and specific data about system events, security warnings, configuration changes, or service failures.Tools like rsyslog (an enhanced, modular version of syslog) act as the delivery service. They process those event messages locally and can be configured to forward them over the network. In this post I'll cover the installation and setup of rsyslog. Some platforms such as OpenObserve have deprecated support for rsyslog in favor of syslog-ng. I'll cover that in a separate post.</font><br /><br /><strong style="color:rgb(42, 42, 42)">Why Configure Proxmox to Send Rsyslog Data to a Central Server?</strong><br /><br /><font color="#2a2a2a">By default, Proxmox VE (which is based on Debian) manages system logs locally via systemd-journald. However, installing rsyslog and forwarding those logs to a centralized syslog server or log aggregator (such as Kiwi Syslog, or Splunk) offers critical operational benefits:</font><br /><br /><strong style="color:rgb(42, 42, 42)">Post-Crash Troubleshooting and Diagnostics:</strong><font color="#2a2a2a"> If a Proxmox host experiences a severe hardware failure, kernel panic, or sudden lockup, the local logs often become inaccessible or get corrupted. Offloading logs in real-time ensures you can review the exact moments leading up to the crash from a separate machine.</font><br /><br /><strong style="color:rgb(42, 42, 42)">Tamper-Resistant Security and Auditing:</strong><font color="#2a2a2a"> If a Proxmox node is compromised, a malicious actor's first move is often to clear or modify local log files to hide their tracks. Centralized logging preserves an immutable audit trail outside of the attacker's reach.</font><br /><br /><strong style="color:rgb(42, 42, 42)">Centralized Infrastructure Monitoring:</strong><font color="#2a2a2a"> Managing logs across a Proxmox cluster (or alongside other firewalls, switches, and servers) is tedious if you have to log into each machine individually. Centralization brings all data under one dashboard.</font><br /><br /><strong style="color:rgb(42, 42, 42)">Proactive Alerting and Long-Term Storage:</strong><font color="#2a2a2a"> Central log aggregators allow you to write advanced rules to trigger immediate alerts (e.g., failed SSH logins, hard drive smart errors, or high cluster fencing events). They also let you store massive historical backlogs without consuming valuable local storage on your hypervisor boot drives.</font><br /><br /><font color="#2a2a2a">Here are the setup steps for installing and activating rsyslog on each of your Proxmox nodes.&nbsp;</font><br /><br /><font color="#2a2a2a">Go to a System prompt:</font><br /><font color="#2a2a2a">apt update</font><br /><font color="#2a2a2a">apt install --no-install-recommends rsyslog -y</font><br /><font color="#2a2a2a">systemctl enable --now rsyslog</font><br /><font color="#2a2a2a">##</font><font color="#2a2a2a">Set (uncomment by removing # and change ForwardToSyslog=yes</font><br /><font color="#2a2a2a">nano /etc/systemd/journald.conf</font><br /><font color="#2a2a2a">ForwardToSyslog=yes</font><br /><br /><font color="#2a2a2a">Ctrl+o and enter to save, Ctrl+x to exit nano</font><br /><br /><font color="#2a2a2a">systemctl restart systemd-journald</font><br /><br /><font color="#2a2a2a">##Verify /var/log/syslog is growing</font><br /><font color="#2a2a2a">tail -f /var/log/syslog</font><br /><br /><font color="#2a2a2a">##Create the forwarding configuration</font><br /><font color="#2a2a2a">nano /etc/rsyslog.d/10-syslogserver.conf</font><br /><br /><font color="#2a2a2a"># Kiwi syslog forwarding</font><br /><font color="#2a2a2a">*.* action(</font><br /><font color="#2a2a2a">&nbsp; &nbsp; type="omfwd"</font><br /><font color="#2a2a2a">&nbsp; &nbsp; target="&lt;COLLECTOR_IP&gt;"</font><br /><font color="#2a2a2a">&nbsp; &nbsp; port="&lt;PORT&gt;"</font><br /><font color="#2a2a2a">&nbsp; &nbsp; protocol="tcp"&nbsp; ##(or "udp" depending on syslog server requirements)</font><br /><font color="#2a2a2a">&nbsp; &nbsp; template="RSYSLOG_SyslogProtocol23Format"</font><br /><font color="#2a2a2a">OR</font><br /><font color="#2a2a2a">&nbsp; &nbsp; template=RSYSLOG_TraditionalForwardFormat"</font><br /><font color="#2a2a2a">##do not use both template lines - use the one required by your syslog server. Kiwi requires Traditional (RFC 3164). Solutions like Adlumin require Protocol23 (RFC 5424).##</font><br /><font color="#2a2a2a">&nbsp; &nbsp; queue.type="LinkedList"</font><br /><font color="#2a2a2a">&nbsp; &nbsp; queue.filename="kiwi_fwd"</font><br /><font color="#2a2a2a">&nbsp; &nbsp; queue.maxdiskspace="1g"</font><br /><font color="#2a2a2a">&nbsp; &nbsp; queue.saveonshutdown="on"</font><br /><font color="#2a2a2a">&nbsp; &nbsp; action.resumeRetryCount="-1"</font><br /><font color="#2a2a2a">)</font><br /><font color="#2a2a2a">##Ctrl+o and enter to save, Ctrl+x to exit nano editor</font><br /><font color="#2a2a2a">## Validate and restart:</font><br /><font color="#2a2a2a">rsyslogd -N1</font><br /><font color="#2a2a2a">systemctl restart rsyslog</font><br /><font color="#2a2a2a">systemctl status rsyslog</font><br /><br /><font color="#2a2a2a">##Test:</font><br /><font color="#2a2a2a">logger -t kiwi-test "proxmox-node1 syslog forwarding test $(date)"<br /><br />systemctl status rsyslog<br />journalctl -u rsyslog -n 50 --no-pager<br />ls -la /var/spool/rsyslog</font><br /><br /><font color="#2a2a2a">##this should send data to your syslog server. If your Proxmox firewall is enabled, don't forget to create an outbound exception for the IP and Port to your syslog server.##</font><br /><br /><font color="#2a2a2a">pveproxy web-UI access logs live in /var/log/pveproxy/access.log, not the journal, so they won't be picked up by the configuration above. If you want your syslog server to track auth/UI access, add an imfile input:</font><br /><br /><font color="#2a2a2a">nano /etc/rsyslog.d/10-syslogserver.conf</font><br /><br /><font color="#2a2a2a">##place the following text at the top of the 10-syslogserver.conf file, above the action block, and restart rsyslog##</font></font><br /><br /><font color="#2a2a2a" size="3">module(load="imfile")<br />input(type="imfile"<br />&nbsp; &nbsp; &nbsp; File="/var/log/pveproxy/access.log"<br />&nbsp; &nbsp; &nbsp; Tag="pveproxy"<br />&nbsp; &nbsp; &nbsp; Severity="info"<br />&nbsp; &nbsp; &nbsp; Facility="local6")<br /><br />Ctrl+o and enter to save, Ctrl+x to exit nano.<br /><br />systemctl restart rsyslog<br />&#8203;systemctl status rsyslog</font><br /><br /></div>]]></content:encoded></item><item><title><![CDATA[Updating Windows Secure Boot Cert for Proxmox-hosted VMs]]></title><link><![CDATA[https://www.akzium.com/akziumblog/updating-windows-secure-boot-cert-for-proxmox-hosted-vms]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/updating-windows-secure-boot-cert-for-proxmox-hosted-vms#comments]]></comments><pubDate>Sat, 27 Jun 2026 19:00:17 GMT</pubDate><category><![CDATA[Fix Windows Secure Boot Certs]]></category><category><![CDATA[Proxmox Windows Secure Boot Fix]]></category><category><![CDATA[Windows Secure Boot Cert Remediation]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/updating-windows-secure-boot-cert-for-proxmox-hosted-vms</guid><description><![CDATA[         Windows Secure Boot Certificate Remediation for Proxmox VE Windows VMsThis runbook documents a safe process for remediating the Windows Secure Boot certificate expiration / Microsoft UEFI 2011-to-2023 certificate transition for a Windows virtual machine running on Proxmox VE 9.2 or later.ScopeApplies to Windows VMs running on Proxmox VE that use OVMF/UEFI firmware with Secure Boot enabled.This process covers:Suspending BitLocker before Secure Boot key changesEnrolling the updated Micros [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/pxmsenrollcertswindows-1_orig.png" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3" style="" color="#2a2a2a">Windows Secure Boot Certificate Remediation for Proxmox VE Windows VMs<br /><br /></font><br /><span></span><font size="3" color="#2a2a2a">This runbook documents a safe process for remediating the Windows Secure Boot certificate expiration / Microsoft UEFI 2011-to-2023 certificate transition for a Windows virtual machine running on Proxmox VE 9.2 or later.</font><br /><span></span><font size="3" color="#2a2a2a">Scope</font><br /><span></span><font size="3" color="#2a2a2a"><br />Applies to Windows VMs running on Proxmox VE that use OVMF/UEFI firmware with Secure Boot enabled.</font><br /><span></span><font size="3" color="#2a2a2a"><br />This process covers:</font><br /><span></span><br /><br /><span></span><ul style=""><li><font size="3" color="#2a2a2a">Suspending BitLocker before Secure Boot key changes</font></li><li><font size="3" color="#2a2a2a">Enrolling the updated Microsoft UEFI 2023 certificates in the Proxmox VM EFI disk</font></li><li><font size="3" color="#2a2a2a">Triggering or verifying the Windows-side Secure Boot servicing process</font></li><li><font size="3" color="#2a2a2a">Verifying update status</font></li><li><font size="3" color="#2a2a2a">Re-enabling BitLocker protection</font></li></ul><br /><br /><span></span><font size="3" color="#2a2a2a">Important Concepts</font><br /><span></span><font size="3" color="#2a2a2a">1. Proxmox certificate enrollment updates the VM's virtual UEFI/OVMF Secure Boot certificate store.</font><br /><span></span><font size="3" color="#2a2a2a">2. This does not automatically guarantee that Windows has completed its own Secure Boot servicing process.</font><br /><span></span><font size="3" color="#2a2a2a">3. Windows may still need to deploy the 2023 Secure Boot certificates and install the PCA2023-signed boot manager.</font><br /><span></span><font size="3" color="#2a2a2a">4. If BitLocker is enabled, Secure Boot certificate/key changes can trigger BitLocker recovery because TPM measured-boot values may change.</font><br /><span></span><font size="3" color="#2a2a2a">5. In most cases, BitLocker should be suspended, not decrypted or permanently disabled.</font><br /><span></span><font size="3" color="#2a2a2a"><br />Pre-Change Checklist</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm the VM uses UEFI/OVMF firmware.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm Secure Boot is enabled for the VM.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm the VM has an EFI disk.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm the VM has a current backup.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm the backup includes the VM's EFI disk.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm the Windows BitLocker recovery key is documented and accessible.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm you have administrative access inside Windows.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Confirm you have Proxmox administrative access.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Schedule a maintenance window.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Notify users/application owners as appropriate.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Step 1 - Check BitLocker Status</strong></font><br /><span></span><font size="3" color="#2a2a2a">Start the Windows VM and log in.</font><br /><span></span><font size="3" color="#2a2a2a">Open PowerShell as Administrator and run:</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -status</font><br /><span></span><font size="3" color="#2a2a2a">Check whether drive C: or any other attached volumes are BitLocker protected.</font><br /><span></span><font size="3" color="#2a2a2a">To view protectors for C:, run:</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -protectors -get C:</font><br /><span></span><font size="3" color="#2a2a2a">If additional protected data drives exist, repeat the relevant commands for each protected drive.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Step 2 - Suspend BitLocker Protection</strong></font><br /><span></span><font size="3" color="#2a2a2a">Do not decrypt the drive unless there is a separate operational reason to do so.</font><br /><span></span><font size="3" color="#2a2a2a">Suspend BitLocker protection on C::</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -protectors -disable C: -RebootCount 0</font><br /><span></span><font size="3" color="#2a2a2a">Alternative PowerShell cmdlet:</font><br /><span></span><font size="3" color="#2a2a2a">Suspend-BitLocker -MountPoint "C:" -RebootCount 0</font><br /><span></span><font size="3" color="#2a2a2a"><br />Why use -RebootCount 0?</font><br /><span></span><font size="3" color="#2a2a2a">This prevents BitLocker protection from automatically resuming after a single reboot. That is useful because the Secure Boot servicing process may require more than one reboot.</font><br /><span></span><font size="3" color="#2a2a2a">If there are other BitLocker-protected volumes, suspend protection on those volumes as well.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Step 3 - Gracefully Shut Down the VM</strong></font><br /><span></span><font size="3" color="#2a2a2a">From inside Windows, perform a normal shutdown.</font><br /><span></span><font size="3" color="#2a2a2a">Do not simply power off the VM unless Windows is hung or unavailable.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Step 4 - Enroll Updated Certificates in Proxmox</strong></font><br /><span></span><font size="3" color="#2a2a2a">Use either the Proxmox GUI or the Proxmox CLI.</font><br /><span></span><em><u><font size="3" color="#2a2a2a">Option A - Proxmox Web GUI</font></u></em><br /><span></span><font size="3" color="#2a2a2a">1. In the Proxmox web interface, select the Windows VM.</font><br /><span></span><font size="3" color="#2a2a2a">2. Go to the Hardware tab.</font><br /><span></span><font size="3" color="#2a2a2a">3. Select the EFI Disk.</font><br /><span></span><font size="3" color="#2a2a2a">4. Click Disk Action.</font><br /><span></span><font size="3" color="#2a2a2a">5. Click Enroll Updated Certificates.</font><br /><span></span><font size="3" color="#2a2a2a">6. Confirm the action.</font><br /><span></span><font size="3" color="#2a2a2a">7. Start the VM after the enrollment completes.</font><br /><span></span><u><em><font size="3" color="#2a2a2a">Option B - Proxmox CLI</font></em></u><br /><span></span><font size="3" color="#2a2a2a">1. Make sure the VM is powered off.</font><br /><span></span><font size="3" color="#2a2a2a">2. Open the shell on the Proxmox node.</font><br /><span></span><font size="3" color="#2a2a2a">3. Run the following command, replacing &lt;VMID&gt; with the actual VM ID:</font><br /><span></span><font size="3" color="#2a2a2a">qm enroll-efi-keys &lt;VMID&gt;</font><br /><span></span><font size="3" color="#2a2a2a">Example:</font><br /><span></span><font size="3" color="#2a2a2a">qm enroll-efi-keys 104</font><br /><span></span><font size="3" color="#2a2a2a">4. Start the VM after the command completes.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Notes</strong></font><br /><span></span><font size="3" color="#2a2a2a">- The Proxmox warning commonly references the marker ms-cert=2023k.</font><br /><span></span><font size="3" color="#2a2a2a">- If the VM is missing the 2023 Microsoft certificates, Proxmox may display a warning about outdated UEFI certificates.</font><br /><span></span><font size="3" color="#2a2a2a">- The CLI method requires the VM to be shut down.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Step 5 - Start Windows</strong></font><br /><span></span><font size="3" color="#2a2a2a">Boot the Windows VM normally.</font><br /><span></span><font size="3" color="#2a2a2a">Expected result:</font><br /><span></span><font size="3" color="#2a2a2a">- Windows should boot normally.</font><br /><span></span><font size="3" color="#2a2a2a">- BitLocker should not prompt for a recovery key if protection was properly suspended.</font><br /><span></span><font size="3" color="#2a2a2a">- If BitLocker recovery still appears, use the documented recovery key.</font><br /><span></span><strong><font size="3" color="#2a2a2a"><br />Step 6 - Trigger or Verify Windows Secure Boot Servicing</font></strong><br /><span></span><font size="3" color="#2a2a2a">The Proxmox certificate enrollment updates the VM firmware certificate store, but Windows still needs to complete its own Secure Boot update process.</font><br /><span></span><font size="3" color="#2a2a2a"><br />Windows uses the Secure-Boot-Update scheduled task:</font><br /><span></span><font size="3" color="#2a2a2a">\Microsoft\Windows\PI\Secure-Boot-Update</font><br /><span></span><font size="3" color="#2a2a2a"><br />For IT-managed or manual deployment, Microsoft documents using the AvailableUpdates registry value.</font><br /><span></span><font size="3" color="#2a2a2a">Open PowerShell as Administrator and run:</font><br /><span></span><font size="3" color="#2a2a2a">Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" `</font><br /><span></span><font size="3" color="#2a2a2a">-Name AvailableUpdates `</font><br /><span></span><font size="3" color="#2a2a2a">-Type DWord `</font><br /><span></span><font size="3" color="#2a2a2a">-Value 0x5944</font><br /><span></span><font size="3" color="#2a2a2a"><br />Then run the scheduled task:</font><br /><span></span><font size="3" color="#2a2a2a">Start-ScheduledTask -TaskPath "\Microsoft\Windows\PI\" -TaskName "Secure-Boot-Update"</font><br /><span></span><font size="3" color="#2a2a2a"><br />Reboot as required.</font><br /><span></span><font size="3" color="#2a2a2a">The Secure Boot servicing process may require more than one reboot.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Step 7 - Verify Windows Secure Boot Update Status</strong></font><br /><span></span><font size="3" color="#2a2a2a">After Windows has rebooted, open PowerShell as Administrator and run:</font><br /><span></span><font size="3" color="#2a2a2a">Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" `</font><br /><span></span><font size="3" color="#2a2a2a">-Name UEFICA2023Status,UEFICA2023Error,UEFICA2023ErrorEvent</font><br /><span></span><font size="3" color="#2a2a2a">Expected successful status:</font><br /><span></span><font size="3" color="#2a2a2a">UEFICA2023Status : Updated</font><br /><span></span><font size="3" color="#2a2a2a">Common status values:</font><br /><span></span><font size="3" color="#2a2a2a">- NotStarted</font><br /><span></span><font size="3" color="#2a2a2a">- InProgress</font><br /><span></span><font size="3" color="#2a2a2a">- Updated</font><br /><span></span><font size="3" color="#2a2a2a">If the status is InProgress, allow the servicing process to continue and reboot again if required.</font><br /><span></span><font size="3" color="#2a2a2a">If an error is shown, record:</font><br /><span></span><font size="3" color="#2a2a2a">- UEFICA2023Error</font><br /><span></span><font size="3" color="#2a2a2a">- UEFICA2023ErrorEvent</font><br /><span></span><font size="3" color="#2a2a2a">- Any related Windows Event Viewer entries</font><br /><span></span><font size="3" color="#2a2a2a">Step 8 - Re-Enable BitLocker Protection</font><br /><span></span><font size="3" color="#2a2a2a">After confirming that Windows boots normally and Secure Boot servicing is complete, re-enable BitLocker protection.</font><br /><span></span><font size="3" color="#2a2a2a">Command-line option:</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -protectors -enable C:</font><br /><span></span><font size="3" color="#2a2a2a">PowerShell option:</font><br /><span></span><font size="3" color="#2a2a2a">Resume-BitLocker -MountPoint "C:"</font><br /><span></span><font size="3" color="#2a2a2a">Verify status:</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -status</font><br /><span></span><font size="3" color="#2a2a2a">Confirm that protection is enabled again.</font><br /><span></span><font size="3" color="#2a2a2a">Step 9 - Final Validation</font><br /><span></span><font size="3" color="#2a2a2a">Perform the following checks:</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Windows boots normally.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] No BitLocker recovery prompt appears.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] BitLocker protection is enabled again.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Secure Boot remains enabled.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Windows Secure Boot servicing status shows Updated, if applicable.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Applications/services start normally.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Event Viewer does not show new Secure Boot or BitLocker errors.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Backup system recognizes the VM normally after the change.</font><br /><span></span><font size="3" color="#2a2a2a">[ ] Change-control ticket is updated with results.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><u><strong>Rollback / Recovery Notes</strong></u></font><br /><span></span><font size="3" color="#2a2a2a">If the VM fails to boot after certificate enrollment:</font><br /><span></span><font size="3" color="#2a2a2a">1. Do not repeatedly force power off the VM without capturing the error.</font><br /><span></span><font size="3" color="#2a2a2a">2. Record the exact boot error message.</font><br /><span></span><font size="3" color="#2a2a2a">3. Confirm whether the VM is using OVMF/UEFI and Secure Boot.</font><br /><span></span><font size="3" color="#2a2a2a">4. Confirm whether the EFI disk is present.</font><br /><span></span><font size="3" color="#2a2a2a">5. Confirm whether the correct VMID was used for CLI enrollment.</font><br /><span></span><font size="3" color="#2a2a2a">6. Attempt boot repair only after confirming a valid backup exists.</font><br /><span></span><font size="3" color="#2a2a2a">7. If BitLocker recovery appears, enter the documented recovery key.</font><br /><span></span><font size="3" color="#2a2a2a">8. If necessary, restore the VM from backup, including the EFI disk.</font><br /><span></span><font size="3" color="#2a2a2a">Change-Control Summary</font><br /><span></span><font size="3" color="#2a2a2a">Enroll updated Microsoft UEFI 2023 Secure Boot certificates for Windows VM running on Proxmox VE and verify Windows Secure Boot servicing status.</font><br /><span></span><font size="3" color="#2a2a2a"><br />Risk:</font><br /><span></span><font size="3" color="#2a2a2a">Secure Boot certificate/key changes may alter TPM measured-boot values and trigger BitLocker recovery if BitLocker protection is not suspended first.</font><br /><span></span><font size="3" color="#2a2a2a"><br />Mitigation:</font><br /><span></span><font size="3" color="#2a2a2a">- Confirm current VM backup.</font><br /><span></span><font size="3" color="#2a2a2a">- Confirm BitLocker recovery key.</font><br /><span></span><font size="3" color="#2a2a2a">- Suspend BitLocker protection before certificate enrollment.</font><br /><span></span><font size="3" color="#2a2a2a">- Enroll updated Proxmox EFI certificates while VM is powered down.</font><br /><span></span><font size="3" color="#2a2a2a">- Verify Windows Secure Boot servicing status.</font><br /><span></span><font size="3" color="#2a2a2a">- Resume BitLocker after successful validation.</font><br /><span></span><font size="3" color="#2a2a2a"><br /><u><strong>Commands Summary</strong></u></font><br /><span></span><font size="3" color="#2a2a2a">Check BitLocker:</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -status</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -protectors -get C:</font><br /><span></span><font size="3" color="#2a2a2a">Suspend BitLocker:</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -protectors -disable C: -RebootCount 0</font><br /><span></span><font size="3" color="#2a2a2a">Alternative:</font><br /><span></span><font size="3" color="#2a2a2a">Suspend-BitLocker -MountPoint "C:" -RebootCount 0</font><br /><span></span><font size="3" color="#2a2a2a">Enroll Proxmox EFI keys:</font><br /><span></span><font size="3" color="#2a2a2a">qm enroll-efi-keys &lt;VMID&gt;</font><br /><span></span><font size="3" color="#2a2a2a">Set Windows Secure Boot update registry value:</font><br /><span></span><font size="3" color="#2a2a2a">Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" `</font><br /><span></span><font size="3" color="#2a2a2a">-Name AvailableUpdates `</font><br /><span></span><font size="3" color="#2a2a2a">-Type DWord `</font><br /><span></span><font size="3" color="#2a2a2a">-Value 0x5944</font><br /><span></span><font size="3" color="#2a2a2a">Run Windows Secure Boot update task:</font><br /><span></span><font size="3" color="#2a2a2a">Start-ScheduledTask -TaskPath "\Microsoft\Windows\PI\" -TaskName "Secure-Boot-Update"</font><br /><span></span><font size="3" color="#2a2a2a">Verify Windows Secure Boot servicing:</font><br /><span></span><font size="3" color="#2a2a2a">Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" `</font><br /><span></span><font size="3" color="#2a2a2a">-Name UEFICA2023Status,UEFICA2023Error,UEFICA2023ErrorEvent</font><br /><span></span><font size="3" color="#2a2a2a">Resume BitLocker:</font><br /><span></span><font size="3" color="#2a2a2a">manage-bde -protectors -enable C:</font><br /><span></span><font size="3" color="#2a2a2a">Alternative:</font><br /><span></span><font size="3" color="#2a2a2a">Resume-BitLocker -MountPoint "C:"</font><br /><span></span><font size="3" color="#2a2a2a"><br /><u><strong>Source References</strong></u></font><br /><span></span><font size="3" color="#2a2a2a">Proxmox forum - UEFI 2011 certificates expire in June 2026:</font><br /><span></span><a target="_self" href="https://forum.proxmox.com/threads/uefi-2011-certificates-expire-in-june-2026.183799/"><font size="3" color="#2a2a2a">https://forum.proxmox.com/threads/uefi-2011-certificates-expire-in-june-2026.183799/</font></a><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Proxmox VE 9.2 release announcement:</strong></font><br /><span></span><a target="_self" href="https://forum.proxmox.com/threads/proxmox-virtual-environment-9-2-available.183742/"><font size="3" color="#2a2a2a">https://forum.proxmox.com/threads/proxmox-virtual-environment-9-2-available.183742/</font></a><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Microsoft - Secure Boot troubleshooting guide:</strong></font><br /><span></span><a target="_self" href="https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d"><font size="3" color="#2a2a2a">https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d</font></a><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Microsoft - Registry key updates for Secure Boot Windows devices with IT-managed updates:</strong></font><br /><span></span><a target="_self" href="https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d"><font size="3" color="#2a2a2a">https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d</font></a><br /><span></span><font size="3" color="#2a2a2a"><br /><strong>Microsoft - manage-bde protectors command:</strong></font><br /><span></span><a target="_self" href="https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors" style=""><font size="3" style="" color="#2a2a2a">https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors</font></a><br /><span></span></div>]]></content:encoded></item><item><title><![CDATA[Proxmox Networking Linux Bridge vs OVS Bridge]]></title><link><![CDATA[https://www.akzium.com/akziumblog/proxmox-networking-linux-bridge-vs-ovs-bridge]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/proxmox-networking-linux-bridge-vs-ovs-bridge#comments]]></comments><pubDate>Mon, 01 Jun 2026 17:06:03 GMT</pubDate><category><![CDATA[Proxmox]]></category><category><![CDATA[Proxmox Linux Bridge]]></category><category><![CDATA[Proxmox Linux VLAN]]></category><category><![CDATA[Proxmox Networking]]></category><category><![CDATA[Proxmox OVS Bridge]]></category><category><![CDATA[Proxmox VLANs]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/proxmox-networking-linux-bridge-vs-ovs-bridge</guid><description><![CDATA[         Proxmox virtual switches and networking demystified: Trunk-mode Ports and Access-mode PortsOne common question regarding Proxmox network setup is WHICH of the options to use when creating Proxmox network interfaces when you need to pass multiple VLANs across a Trunk-mode switch port versus simple access-mode port setups. Here's a quick cheat sheet:Trunk mode required: Linux VLAN interfaces (eno1.10, bond0.20)Physical NIC (eno1)&#9492;&#9472;&#9472; VLAN interface (eno1.10)&#9492;&#9472; [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/proxmox-network-01_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3" color="#2a2a2a">Proxmox virtual switches and networking demystified: Trunk-mode Ports and Access-mode Ports<br /><br />One common question regarding Proxmox network setup is WHICH of the options to use when creating Proxmox network interfaces when you need to pass multiple VLANs across a Trunk-mode switch port versus simple access-mode port setups. <br /><br />Here's a quick cheat sheet:<br /><br /><u><strong>Trunk mode required:</strong></u> <br /><br />Linux VLAN interfaces (eno1.10, bond0.20)<br />Physical NIC (eno1)<br />&#9492;&#9472;&#9472; VLAN interface (eno1.10)<br />&#9492;&#9472;&#9472; Linux Bridge (vmbr10)<br />&#9492;&#9472;&#9472; VM vNICs<br /><br />VLAN-tagged OVS IntPorts<br />Physical NIC (eno1)<br />&#9492;&#9472;&#9472; OVS Bridge (ovsbr0)<br />&#9500;&#9472;&#9472; OVS Port (eno1) &larr; uplink, trunk to switch<br />&#9492;&#9472;&#9472; OVS IntPort (vlan10) &larr; internal port, tagged VLAN 10<br />&#9492;&#9472;&#9472; Linux Bridge (vmbr10) &larr; optional, for VM attachment<br />&#9492;&#9472;&#9472; VM vNICs<br /><br /><u><strong>Trunk mode optional</strong></u> These can run as simple access bridges or VLAN-aware bridges depending on how you configure them:<br /><br /><strong>Linux Bridges</strong><br />Physical NIC (eno1) &larr; trunk port on switch<br />&#9492;&#9472;&#9472; Linux Bridge (vmbr0) &larr; VLAN-aware bridge<br />&#9500;&#9472;&#9472; eno1 (uplink port, trunk)<br />&#9500;&#9472;&#9472; VM vNIC (VLAN 10) &larr; tagged or untagged per port config<br />&#9492;&#9472;&#9472; VM vNIC (VLAN 20) &larr; tagged or untagged per port config<br /><br /><strong>OVS Bridges</strong><br />Physical NIC (eno1) &larr; trunk port on switch<br />&#9492;&#9472;&#9472; OVS Bridge (ovsbr0) &larr; single bridge, all VLANs<br />&#9500;&#9472;&#9472; eno1 (uplink port, trunk)<br />&#9500;&#9472;&#9472; VM vNIC (port tagged VLAN 10)<br />&#9500;&#9472;&#9472; VM vNIC (port tagged VLAN 20)<br />&#9492;&#9472;&#9472; VM vNIC (trunk port, multiple VLANs)<br /><br />Access-mode switch port connections:<br /><br />A <strong>Linux Bridge</strong> itself can have multiple IP addresses (small configuration with management and corosync on the same bridge for example).<br /><br />Physical NIC (eno1) &larr; access port on switch (single VLAN)<br />&#9492;&#9472;&#9472; Linux Bridge (vmbr0) &larr; simple bridge, no VLAN awareness<br />&#9500;&#9472;&#9472; eno1 (uplink port)<br />&#9500;&#9472;&#9472; VM vNIC (VM1)<br />&#9492;&#9472;&#9472; VM vNIC (VM2)<br /><br />vmbr0 &larr; bridge interface itself gets IPs<br />&#9500;&#9472;&#9472; 192[.]168[.]10[.]1/24 &larr; primary IP (host management)<br />&#9492;&#9472;&#9472; 192[.]168[.]10[.]2/24 &larr; secondary IP (additional host service)<br /><br />An <strong>OVS Bridge </strong>is different than a Linux Bridge in that while OVS is just a Layer-2 virtual switch, you can't assign an IP directly to the OVS bridge itself, you need an OVS IntPort for that.<br /><br />Physical NIC (eno1) &larr; access port on switch (single VLAN)<br />&#9492;&#9472;&#9472; OVS Bridge (ovsbr0) &larr; single broadcast domain<br />&#9500;&#9472;&#9472; eno1 (uplink port)<br />&#9500;&#9472;&#9472; OVS IntPort (ovsbr0-mgmt) &larr; internal interface exposed to kernel<br />&#9474;&nbsp;&nbsp;&nbsp;&nbsp;&#9500;&#9472;&#9472; 192[.]168[.]10[.]1/24 &larr; primary IP<br />&#9474;&nbsp;&nbsp;&nbsp;&nbsp;&#9492;&#9472;&#9472; 192[.]168[.]10[.]2/24 &larr; secondary IP alias<br />&#9500;&#9472;&#9472; VM vNIC (VM1)<br />&#9492;&#9472;&#9472; VM vNIC (VM2)<br /><br />A <strong>Linux Bond</strong> or an <strong>OVS Bond</strong> can connect using Access Mode or Trunk Mode.<br /><br />Get this one decision right before you touch anything else, and the rest of your Proxmox network config starts to make a lot more sense.</font><br /></div>]]></content:encoded></item><item><title><![CDATA[CISA SCuBA Goggles and SCuBA Gear]]></title><link><![CDATA[https://www.akzium.com/akziumblog/cisa-scuba-goggles-and-scuba-gear]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/cisa-scuba-goggles-and-scuba-gear#comments]]></comments><pubDate>Fri, 24 Apr 2026 20:30:26 GMT</pubDate><category><![CDATA[CISA]]></category><category><![CDATA[SCuBA Gear]]></category><category><![CDATA[SCuBA Goggles]]></category><category><![CDATA[Secure Baseline 365 GWS]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/cisa-scuba-goggles-and-scuba-gear</guid><description><![CDATA[         In 2023 the Cybersecurity and Infrastructure Security Agency (CISA[.]gov) introduced their Secure Cloud Business Applications (SCuBA) project with two sub-projects: SCuBA Gear for M365 and SCuBA Goggles for Google Workspace.These secure configuration baselines (SCBs) for Microsoft 365 (M365) and Google Workspace (GWS) provide easily adoptable recommendations that complement an organization&rsquo;s unique requirements and risk tolerance levels. The baselines include automation features t [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/scubagoggles_orig.png" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3"><span style="color:rgba(0, 0, 0, 0.9)">In 2023 the Cybersecurity and Infrastructure Security Agency (CISA[.]gov) introduced their Secure Cloud Business Applications (SCuBA) project with two sub-projects: SCuBA Gear for M365 and SCuBA Goggles for Google Workspace.</span><br /><br /><span style="color:rgba(0, 0, 0, 0.9)">These secure configuration baselines (SCBs) for Microsoft 365 (M365) and Google Workspace (GWS) provide easily adoptable recommendations that complement an organization&rsquo;s unique requirements and risk tolerance levels. The baselines include automation features to help federal agencies, businesses and organizations rapidly assess their M365 and GWS services.</span><span style="color:rgba(0, 0, 0, 0.9)"> </span><br /><br /><span style="color:rgba(0, 0, 0, 0.9)">ScubaGear&nbsp;is a no-cost assessment tool that verifies M365 tenant configuration alignment to the policies described in SCuBA&rsquo;s secure configuration baselines. CISA has made this tool and the baselines available to all agencies and private sector organizations seeking security improvements.&#8239;Visit CISA&rsquo;s&#8239;GitHub&nbsp;and&#8239;PowerShell Gallery&nbsp;to view the M365 baselines and download the ScubaGear assessment tool.</span><br /><br /><span style="color:rgba(0, 0, 0, 0.9)">ScubaGoggles&nbsp;is a no-cost assessment tool that verifies a GWS organization&rsquo;s configuration conforms to the policies in SCuBA&rsquo;s secure configuration baselines. ScubaGoggles provides a breakdown of security vulnerabilities in GWS, allowing organizations to see where changes should be made to their configuration. CISA has made this tool and the baselines available to all agencies and private sector organizations seeking security improvements. Visit CISA&rsquo;s&nbsp;GitHub&nbsp;or&nbsp;Python Package Index page&nbsp;to view the GWS baselines and download the ScubaGoggles assessment tool.</span><br /><br /><span style="color:rgba(0, 0, 0, 0.9)">Source: CISA[.]gov:&nbsp;</span><a href="https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project" target="_blank">https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project</a></font><span style="color:rgba(0, 0, 0, 0.9)"></span></div>]]></content:encoded></item><item><title><![CDATA[Deploying IBM Virtual HMC (vHMC) 11 on Proxmox]]></title><link><![CDATA[https://www.akzium.com/akziumblog/deploying-ibm-virtual-hmc-vhmc-11-on-proxmox]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/deploying-ibm-virtual-hmc-vhmc-11-on-proxmox#comments]]></comments><pubDate>Sat, 11 Apr 2026 19:22:32 GMT</pubDate><category><![CDATA[IBM vHMC 11]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/deploying-ibm-virtual-hmc-vhmc-11-on-proxmox</guid><description><![CDATA[    IBM Virtual Hardware Management Console 11 (vHMC-11) Dashboard Example     IBM only provides instructions for deploying the Virtual Hardware Management Console on KVM running on Red Hat or Ubuntu, neither of which will probably be running in most datacenters that have an IBM Power system.So, we undertook the task of figuring out how to deploy the new vHMC version 11 on Proxmox and the IBM instructions for KVM deployment are of no help for this endeavor. After downloading the ~6.8GB IBM vHMC  [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image10-header_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">IBM Virtual Hardware Management Console 11 (vHMC-11) Dashboard Example</div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3" color="#2a2a2a">IBM only provides instructions for deploying the Virtual Hardware Management Console on KVM running on Red Hat or Ubuntu, neither of which will probably be running in most datacenters that have an IBM Power system.<br /><br />So, we undertook the task of figuring out how to deploy the new vHMC version 11 on Proxmox and the IBM instructions for KVM deployment are of no help for this endeavor. After downloading the ~6.8GB IBM vHMC tar.gz file, you'll need to unzip to a folder, resulting in a nearly 13GB .tar file. Don't try to expand this file unless you have about 510GB (yes, gigabytes) of extra disk space on your PC. If you DO have that extra space, the .tar file expands into a 500GB disk1.img file and four other files (see image below)</font></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-kvmtararchive_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">Files in the IBM vHMC 11 for KVM tar archive</div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font color="#2a2a2a" size="3">If you have the extra disk space on the PC to expand the .tar file you can then use WinSCP to secure copy the file over to the Proxmox server, again taking care to make sure you have enough disk space (510GB EXTRA Gigabytes) to /tmp or /var/tmp. <br /><br />In our case, we needed a "bridge" to park the expanded tar archive so we elected to use a NAS storage device that supported both SMB/CIFS as well as NFS 4.x. <br /><br />&#8203;Then, on the Proxmox server we mounted the shared folder as an NFS mount on the Proxmox server (see image below) which created three subfolders: images, import, and template . After mounting the shared folder on the NAS to the PC and using an archive extraction tool we unzipped the files to the shared folder's subfolder named IMPORT.</font></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image2_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">Proxmox - mount NFS storage</div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font color="#2a2a2a" size="3">Next, you need to create a virtual machine definition on the Proxmox server, but on the tab for Disk you remove the default disk, creating a VM definition with CPU, RAM and networking but no pre-provisioned disk space. Now that the VM is created, notate the VM ID number, in our example here the ID is 101.<br /><br />Now, we will use the QM IMPORTDISK command to convert the disk1.img file into a Proxmox QEMU disk image file. <br /><br />&#8203;Select the Proxmox server node you want to use for the import, click on &gt;SHELL to get a command line, and navigate to the mounted NFS share:<br /><br />cd /mnt/pve/vz/INSERT_NFS_NAME_HERE/import<br /><br />If you do a ls -la command you will see the files extracted from the .tar file</font></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image3_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">List of files from vHMC .tar archive</div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font color="#2a2a2a" size="3">The syntax for the import command is as follows:<br /><br />qm importdisk VMID /LOCATION_OF_img_FILE/disk1.img TargetStorageName<br /><br />In our example the command is as follows, which places the converted .img file onto our internal ZFS storage array:<br /><br />qm importdisk 101 /mnt/pve/synnas01/import/disk1.img pxmxsvr1ZFS<br /><br /><strong>***(remember, do NOT leave the SHELL environment until the import is COMPLETE or it will abort the command)***</strong></font></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image4_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">qm import disk command example to import .img file</div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3" color="#2a2a2a">Once the disk1.img file has been imported you can go back to the Proxmox manager and select your VM and go to the Hardware tab. You will see a device name Unused Disk 0.</font></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image5_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3" color="#2a2a2a">Click on the Unused Disk 0 and select EDIT from the top menu, which will initiate the Add Unused Disk wizard. Click on ADD and the imported disk will now be added to the new vHMC virtual machine.</font></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image6_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><span style="color:rgba(0, 0, 0, 0.9)"><font size="3">Once this process is complete, you can edit any other VM hardware items as needed. The base vHMC image configures four (4) network adapters within the virtual machine. Eth0 is intended to be the management interface and Eth1 is the primary interface for the HMC port vLAN. In smaller environments your vHMC and the Power System HMC port may be configured on the same VLAN. Adjust the quantity of network adapters as needed. IBM's default recommendation is for (4) virtual CPUs and 16GB of RAM. <br /><br />Once these items are modified as necessary, there is one more order of business to tend to: adjusting the BOOT ORDER of the devices so that the VM will boot when you start it. <br /><br />&#8203;Navigate to Options -&gt; Boot Order, and check the box for Enabled next to the scsi0 disk, then grab the hamburger menu next to the #3 and drag the scsi0 device to the top of the boot order list. Then click OK.</font></span></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image7_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">Change VM virtual disk boot order</div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font color="#2a2a2a" size="3">Click on START to power on your new vHMC virtual machine and then &gt;Console to watch the boot process. Once the boot cycle completes (yes, it takes FOREVER to boot) then you can log into the management GUI (hscroot / abc123) and begin the configuration process for setting up the network(s) devices. <br /><br />&#8203;Your mouse will NOT work on the two initial setup questions that pop up, you will need to use the keyboard arrow keys and the TAB key.<br />&#8203; </font><br /><font color="#2a2a2a" size="3">*note: network changes will not take effect until the vHMC is rebooted.</font></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image8_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">IBM vHMC 11 login screen</div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0px;margin-right:0px;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/ibm-hmc-image9_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%">IBM vHMC 11 Main Dashboard</div> </div></div>]]></content:encoded></item><item><title><![CDATA[Multiple DHCP Scopes in Windows Server DHCP]]></title><link><![CDATA[https://www.akzium.com/akziumblog/multiple-dhcp-scopes-in-windows-server-dhcp]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/multiple-dhcp-scopes-in-windows-server-dhcp#comments]]></comments><pubDate>Thu, 05 Feb 2026 22:52:05 GMT</pubDate><category><![CDATA[DHCP]]></category><category><![CDATA[DHCP Scopes]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/multiple-dhcp-scopes-in-windows-server-dhcp</guid><description><![CDATA[         If you're using a Windows server as a DHCP server, you can configure multiple DCHP scopes for different VLANs.&nbsp;There are two main concepts to understand for this setup:&nbsp;1) Each scope needs a route to reach the intended VLAN via the route setting in the scope;&nbsp;2) Your core switch that controls your VLAN settings needs to have a "helper IP" set to know where to route DHCP requests on each VLAN. In addition to these settings, the DCHP server's assigned VLAN and static IP add [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/dualdhcpscopes101_orig.png" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="wsite-spacer" style="height:50px;"></div>  <div class="paragraph"><font size="3" color="#2a2a2a">If you're using a Windows server as a DHCP server, you can configure multiple DCHP scopes for different VLANs.&nbsp;</font><br /><br /><br /><font size="3" color="#2a2a2a">There are two main concepts to understand for this setup:&nbsp;</font><br /><br /><br /><font size="3" color="#2a2a2a">1) Each scope needs a route to reach the intended VLAN via the route setting in the scope;&nbsp;</font><br /><br /><br /><font size="3"><font color="#2a2a2a">2) Your core switch that controls your VLAN settings needs to have a "helper IP" set to know where to route DHCP requests on each VLAN. In addition to these settings, the DCHP server's assigned VLAN and static IP address must have the ability to reach each VLAN segment that it is serving via inter-VLAN routing if the DCHP server only has a single network interface.<br /><br />So, don't put your DCHP server on a VLAN with other servers or devices that should not be reachable by endpoint devices that it is servicing for DCHP requests. For example, don't put your DCHP server on your servers VLAN and have it serve up DCHP requests for your Guest Wifi VLAN.<br /><br />Also, just a quick note about the Filters setting. <strong style="">Filters are applied to the entire DHCP server instance, not on a per-scope basis</strong>. If you enable ALLOW filtering, only those MAC addresses listed in the Allow filter list will get an IP address via DCHP. All other DHCP requests will be denied. If you enable DENY filtering, any MAC address in the Deny filter list will be denied an IP address while all other devices will be assigned an IP.</font><br /></font><br /></div>]]></content:encoded></item><item><title><![CDATA[Installing Uptime Kuma on Ubuntu 24.04]]></title><link><![CDATA[https://www.akzium.com/akziumblog/installing-uptime-kuma-on-ubuntu-2404]]></link><comments><![CDATA[https://www.akzium.com/akziumblog/installing-uptime-kuma-on-ubuntu-2404#comments]]></comments><pubDate>Mon, 05 May 2025 15:27:06 GMT</pubDate><category><![CDATA[Uptime Kuma]]></category><category><![CDATA[Uptime Kuma Ubuntu Install]]></category><guid isPermaLink="false">https://www.akzium.com/akziumblog/installing-uptime-kuma-on-ubuntu-2404</guid><description><![CDATA[       These instructions assume the installation of Ubuntu 24.04 has already been done. The example USERID for the Ubuntu login will be UbuntuUser. The example USERID for the Uptime Kuma admin screen will be KumaAdmin. Adjust instructions accordingly.Log in to the Ubuntu instance and launch a terminal window.In our example, this will put us in the /home/UbuntuUser folder.Verify your folder ID by typing pwd at the terminal command promt&nbsp;sudo apt-get update -ysudo apt-get upgrade -ysudo apt- [...] ]]></description><content:encoded><![CDATA[<div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/uptime-kuma-howto-18_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="paragraph"><font color="#2a2a2a" size="3">These instructions assume the installation of Ubuntu 24.04 has already been done. The example USERID for the Ubuntu login will be UbuntuUser. The example USERID for the Uptime Kuma admin screen will be KumaAdmin. Adjust instructions accordingly.<br /><br />Log in to the Ubuntu instance and launch a terminal window.<br />In our example, this will put us in the /home/UbuntuUser folder.<br />Verify your folder ID by typing pwd at the terminal command promt&nbsp;<br /><br />sudo apt-get update -y<br /><br />sudo apt-get upgrade -y<br /><br />sudo apt-get install nodejs -y<br /><br />sudo node -v to check the nodejs installed version<br /><br />sudo apt-get install git -y<br /><br />sudo git clone https://github.com/louislam/uptime-kuma.git<br /><br />You can verify the git clone process by typing ls -l at the prompt which should now show an uptime-kuma folder<br /><br />sudo apt-get install npm --no-install-recommends<br /><br />at the /home/InsertUserIDHere prompt type: cd uptime-kuma<br /><br />sudo npm run setup<br />*this will install uptime-kuma<br /><br />sudo npm install pm2 -g</font><br /><br /><span style="color:rgb(42, 42, 42)">**PM2 is a production process manager for Node.js applications with a built-in load balancer. It allows you to keep applications alive forever, to reload them without downtime, and to facilitate common system admin tasks.</span><br /><br /><font color="#2a2a2a" size="3">sudo pm2 install pm2-logrotate</font><br /><br />*You should see output similar to the image below:&#8203;</div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/pm2logrotateinstallscreen1_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="paragraph"><font color="#2a2a2a"><font size="3">Verify your location is still /home/InsertUserIDhere</font><br /><br /><font size="3">cd uptime-kuma</font><br /><font size="2">*type pwd to verify location is /home/InsertUserIDHere/uptime-kuma</font><br /><br /><font size="3">sudo pm2 start server/server.js --name uptime-kuma</font></font><br /><br /><font color="#626262" size="2">*You should see output similar to the image below:</font></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/startuptimekumapm2_orig.jpg" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>  <div class="paragraph"><font color="#2a2a2a" size="3">If you do not see this output, then type:<br /><br />sudo pm2 status<br /><br />Now, type:<br /><br />sudo pm2 startup<br /><br />sudo pm2 save<br /><br />cd /etc/systemd/system<br /><br />sudo nano pm2-root.service<br /><br />find the line labeled Environment=PATH=....<br /><br />go to the end of the line<br /><br />add the following:&nbsp; :/home/InsertUserIDHere/uptime-kuma/server</font><br />*note: be sure to include the : and do not put a space after the end of the previous entry on the line<br /><br /><font color="#2a2a2a"><font size="3">Ctrl+O to write file edits to disk. Ctrl+X to exit nano editor</font><br /><br /><font size="3">Now, we'll install the Nginx web server:</font><br /><br /><font size="3">sudo apt-get install nginx -y</font><br /><br /><font size="3">sudo nano /etc/nginx/conf.d/kuma.conf</font><br /><br /><font size="3">Add the following lines:<br />&#8203;<br />server {<br />&nbsp; &nbsp;listen 80;<br />&nbsp; &nbsp;servername kuma.example.com;<br />&nbsp; &nbsp;location / {<br />&nbsp; &nbsp; &nbsp; &nbsp; proxy_pass&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; http://localhost:3001;<br />&nbsp; &nbsp; &nbsp; &nbsp; proxy_http_version&nbsp; 1.1;<br />&nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header&nbsp; &nbsp; &nbsp;Upgrade $http_upgrade;<br />&nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header&nbsp; &nbsp; &nbsp;Connection "upgrade";<br />&nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header&nbsp; &nbsp; &nbsp;Host $host;<br />&nbsp; &nbsp;}</font></font><br /><font color="#2a2a2a" size="4">}</font><br /><br />Ctrl+O to write file to disk. Ctrl+X to exit nano editor.<br /><br /><font color="#2a2a2a" size="3">Now, copy the kuma.conf file to /etc/nginx/sites-available folder by typing:<br /><br />sudo cp /etc/nginx/conf.d/kuma.conf /etc/nginx/sites-available/kuma</font><br />*note: leave the .conf off of the target filename<br /><br /><font color="#2a2a2a"><font size="3">Now, create a symbolic link in the /etc/nginx/sites-enabled folder to the kuma file in the /etc/nginx/sites-available folder<br /><br />sudo ln -s /etc/nginx/sites-available/kuma /etc/sites-enabled/kuma<br /><br />Verify the link by:<br />cd /etc/nginx/sites-enabled<br />sudo ls -la<br />There should be a kuma symbolic link file in the /etc/nginx/sites-enabled folder<br /><br />Remove the Nginx default website link<br />cd /etc/nginx/sites-enabled<br />sudo rm /etc/nginx/sites-enabled/default<br />sudo ls -la&nbsp;<br /><br />Reboot the host:<br />sudo reboot&nbsp;<br /><br />Now, you should be able to navigate within the Kuma host linux system using a browser to:<br />http://localhost:3001<br /><br />This will bring up the initial setup Kuma administrator login screen.<br /><br />**NOTE:&nbsp; Be careful in choosing your admin USERID here as there is not a simple process for changing this ID once it is created and written into the SQLlite database.</font></font></div>  <div><div class="wsite-image wsite-image-border-none " style="padding-top:10px;padding-bottom:10px;margin-left:0;margin-right:0;text-align:center"> <a> <img src="https://www.akzium.com/uploads/6/5/1/1/6511561/kumainitilaloginscreen1_orig.png" alt="Picture" style="width:auto;max-width:100%" /> </a> <div style="display:block;font-size:90%"></div> </div></div>]]></content:encoded></item></channel></rss>