Nextcloud v31 on Ubuntu 22.04 - update php v8.1 to v8.4

If you are running HanssonIT Nextcloud VM with Ubuntu 22.04 and your Nextcloud has version 31 and you want to update to version 32, you are recommended to update to at least php version 8.2. Ubuntus 22.04 default is php v8.1

ernolf (Raphael Gradenwitz - https://github.com/ernolf) published an amazing php updater script: https://help.nextcloud.com/t/php-updater-a-script-to-upgrade-php-in-a-safe-way/180215 

Commands

sudo apt-get update && sudo apt-get install jq
sudo
wget -O /usr/local/bin/php-updater https://global-social.net/script/php-updater sudo chmod +x /usr/local/bin/php-updater


Example

ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$ sudo wget -O /usr/local/bin/php-updater https://global-social.net/script/php-updater
sudo chmod +x /usr/local/bin/php-updater
--2026-03-05 20:15:04--  https://global-social.net/script/php-updater
Resolving global-social.net (global-social.net)... 84.189.141.247
Connecting to global-social.net (global-social.net)|84.189.141.247|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://global-social.net/raw/scripts/php-updater [following]
--2026-03-05 20:15:04--  https://global-social.net/raw/scripts/php-updater
Reusing existing connection to global-social.net:443.
HTTP request sent, awaiting response... 200 OK
Length: 24089 (24K) [text/plain]
Saving to: ‘/usr/local/bin/php-updater’

/usr/local/bin/php-updater                        100%[============================================================================================================>]  23.52K  --.-KB/s    in 0.02s

2026-03-05 20:15:04 (1.25 MB/s) - ‘/usr/local/bin/php-updater’ saved [24089/24089]

ncadmin@nas:/usr/local/bin$ ll
total 32
drwxr-xr-x  2 root root  4096 Mar  5 20:15 ./
drwxr-xr-x 10 root root  4096 Apr 21  2022 ../
-rwxr-xr-x  1 root root 24089 Feb 24 04:07 php-updater*
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$ php-updater

ERROR: 'jq' binary not found.

ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$ sudo apt-get update
Get:1 https://download.docker.com/linux/ubuntu jammy InRelease [48.5 kB]
Hit:2 https://ftp.uni-stuttgart.de/ubuntu jammy InRelease
Get:3 https://ftp.uni-stuttgart.de/ubuntu jammy-updates InRelease [128 kB]
Get:4 http://repository.netdata.cloud/repos/edge/ubuntu jammy/ InRelease [2054 B]
Get:5 https://download.docker.com/linux/ubuntu jammy/stable amd64 Packages [71.5 kB]
Get:6 https://ftp.uni-stuttgart.de/ubuntu jammy-backports InRelease [127 kB]
Get:7 https://ftp.uni-stuttgart.de/ubuntu jammy-security InRelease [129 kB]
Hit:8 http://repository.netdata.cloud/repos/repoconfig/ubuntu jammy/ InRelease
Get:9 https://ftp.uni-stuttgart.de/ubuntu jammy-updates/main amd64 Packages [3285 kB]
Get:10 http://repository.netdata.cloud/repos/edge/ubuntu jammy/ Packages [40.0 kB]
Get:11 https://ftp.uni-stuttgart.de/ubuntu jammy-updates/universe amd64 Packages [1256 kB]
Hit:12 https://download.webmin.com/download/newkey/repository stable InRelease
Fetched 5087 kB in 1s (3587 kB/s)
Reading package lists... Done
E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$ sudo apt-get install jq
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libjq1
The following NEW packages will be installed:
  jq libjq1
0 upgraded, 2 newly installed, 0 to remove and 25 not upgraded.
Need to get 186 kB of archives.
After this operation, 458 kB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 https://ftp.uni-stuttgart.de/ubuntu jammy-updates/main amd64 libjq1 amd64 1.6-2.1ubuntu3.1 [133 kB]
Get:2 https://ftp.uni-stuttgart.de/ubuntu jammy-updates/main amd64 jq amd64 1.6-2.1ubuntu3.1 [52.5 kB]
Fetched 186 kB in 0s (589 kB/s)
Selecting previously unselected package libjq1:amd64.
(Reading database ... 154392 files and directories currently installed.)
Preparing to unpack .../libjq1_1.6-2.1ubuntu3.1_amd64.deb ...
Unpacking libjq1:amd64 (1.6-2.1ubuntu3.1) ...
Selecting previously unselected package jq.
Preparing to unpack .../jq_1.6-2.1ubuntu3.1_amd64.deb ...
Unpacking jq (1.6-2.1ubuntu3.1) ...
Setting up libjq1:amd64 (1.6-2.1ubuntu3.1) ...
Setting up jq (1.6-2.1ubuntu3.1) ...
Processing triggers for man-db (2.10.2-1) ...
Processing triggers for libc-bin (2.35-0ubuntu3.13) ...
Scanning processes...
Scanning linux images...

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$ php-updater
.. loading modules - dependency
  Dependency not met!

  missing dependency:
  ==============================================================================
  Binary          Package         Description
  ------------------------------------------------------------------------------
  ansifilter      ansifilter      parse common (terminal) ANSI codes and remove or convert them
  ------------------------------------------------------------------------------


Q: Do you want to install this package now? ([y]es or [n]o) [yes]: y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  ansifilter
0 upgraded, 1 newly installed, 0 to remove and 25 not upgraded.
Need to get 70.9 kB of archives.
After this operation, 208 kB of additional disk space will be used.
Get:1 https://ftp.uni-stuttgart.de/ubuntu jammy/universe amd64 ansifilter amd64 2.18+dfsg1-1 [70.9 kB]
Fetched 70.9 kB in 0s (230 kB/s)
Selecting previously unselected package ansifilter.
(Reading database ... 154404 files and directories currently installed.)
Preparing to unpack .../ansifilter_2.18+dfsg1-1_amd64.deb ...
Unpacking ansifilter (2.18+dfsg1-1) ...
Setting up ansifilter (2.18+dfsg1-1) ...
Processing triggers for man-db (2.10.2-1) ...
Scanning processes...
Scanning linux images...

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.
.. loading modules - integrity
     First run of php-updater, checking integrity:
     ===================================================================================================================
gpg: directory '/var/tmp/ebtb/.gnupg' created
gpg: keybox '/var/tmp/ebtb/.gnupg/pubring.kbx' created
gpg: /var/tmp/ebtb/.gnupg/trustdb.gpg: trustdb created
gpg:                using RSA key 3EE43A84D2BA635A94E1033B0B145139A170715C
gpg: Good signature from "[ernolf] Raphael Gradenwitz (codesigning) <raphael.gradenwitz@googlemail.com>" [unknown]
     -------------------------------------------------------------------------------------------------------------------
Installing janitor..
.. loading modules - integrity
     First run of janitor, checking integrity:
     ===================================================================================================================
gpg:                using RSA key 3EE43A84D2BA635A94E1033B0B145139A170715C
gpg: Good signature from "[ernolf] Raphael Gradenwitz (codesigning) <raphael.gradenwitz@googlemail.com>" [unknown]
     -------------------------------------------------------------------------------------------------------------------
     Integrity check of janitor passed. The script is authentic.
     ===================================================================================================================

     Integrity check of janitor passed. Please start script again
     The 'janitor' script provides system information. Simply run 'janitor'
     Integrity check of php-updater passed. The script is authentic.
     ===================================================================================================================

     Integrity check of php-updater passed. Please start script again
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$ php-updater
   Distribution check..
                              Privacy Notice
                              ==============

    Please note that use of this service is subject to the following terms and conditions.
    By using this service, you agree to these terms.

    Contribution Requirement:
    -------------------------
    I expect all users to contribute in some way, especially if the service is used for
    commercial or professional purposes.
    Information on how to contribute is provided at the end of this script or can be
    accessed by running:

        - php-updater --contribute

    Data Collection and Use:
    ------------------------
    During execution, non-sensitive system data may be transferred. This data includes,
    but is not limited to:

        - Distribution information
        - Versions of various software components (especially PHP packages)
        - Configured APT sources
        - Installed and active web servers
        - User queries and responses
        - Error stack traces

    The use of this service is logged for reference. You can view this log under:

        /tmp/ebtb/log/php-updater[uid:0].log

    All collected data is used solely to optimize and improve the service. No additional
    information beyond what is contained in the logfiles will be analyzed.

    Anonymization:
    --------------
    Usernames recorded in logfiles are standardized to “root”, “sudo_user”, “www-data”, or
    “unprivileged_user” to ensure anonymity. Additionally, an anonymized fingerprint is
    generated for each computer using the machine ID. This fingerprint associates the data
    with a computer rather than with any individual. No statistical analysis or
    comparisons with previous data are performed.

    Disclaimer:
    -----------
    If you do not agree with these terms, please terminate the script immediately by
    pressing [ q ].
    Use of this script implies acceptance of these terms.

    Note:
    -----
    You are not required to agree to these terms in order to run the
        - php-updater --contribute
    command.



  ==============================================================================
  This is a list of recent ubuntu versions for your information.
  Version Codename  End of support                         LTS  sury-php-repo
  ------------------------------------------------------------------------------
   26.04  resolute  2031-05-29 (in 5 years and 2 months)   [✔️]       [✖️]
   25.10  questing  2026-07-09 (in 4 months)               [✖️]       [✖️]
   25.04  plucky    2026-01-31 (1 month ago)               [✖️]       [✖️]
   24.10  oracular  2025-07-31 (7 months ago)              [✖️]       [✖️]
   24.04  noble     2029-05-31 (in 3 years and 2 months)   [✔️]       [✔️]
   23.10  mantic    2024-07-31 (1 year and 7 months ago)   [✖️]       [✖️]
   23.04  lunar     2024-01-25 (2 years and 1 month ago)   [✖️]       [✖️]
   22.10  kinetic   2023-07-20 (2 years and 7 months ago)  [✖️]       [✖️]
   22.04  jammy     2027-06-30 (in 1 year and 3 months)    [✔️]       [✔️]
   21.10  impish    2022-07-14 (3 years and 7 months ago)  [✖️]       [✖️]
   21.04  hirsute   2022-01-20 (4 years and 1 month ago)   [✖️]       [✖️]
   20.10  groovy    2021-07-22 (4 years and 7 months ago)  [✖️]       [✖️]
   20.04  focal     2025-04-30 (10 months ago)             [✔️]       [✖️]
   19.10  eoan      2020-07-17 (5 years and 7 months ago)  [✖️]       [✖️]
   19.04  disco     2020-01-23 (6 years and 1 month ago)   [✖️]       [✖️]
   18.10  cosmic    2019-07-18 (6 years and 7 months ago)  [✖️]       [✖️]
   18.04  bionic    2023-05-31 (2 years and 9 months ago)  [✔️]       [✖️]
  ------------------------------------------------------------------------------
  You can call this list with:     php-updater --list-ubuntu
  ------------------------------------------------------------------------------

This machine is running Ubuntu 22.04.5 LTS (Jammy Jellyfish), Codename jammy. Good!

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

I: Only one php version (8.1) found, which is the thinkable best possible starting situation for this script.
   Simply follow the instructions and recommendations to install a new PHP version if possible, which then
   will adopt the settings of this PHP version by the means of this script.

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . etx_state() cleanup orphaned entries from extensions state registry .
 . etx_state() fix extensions state registry /var/lib/php/modules .
 . detect actually installed extensions .
 . assign detected extensions to their corresponding package .
 . detect extensions installed by admin .
 . searching packaged versions for php8.1 extensions not installed by dpkg .

  ==============================================================================
  actual PHP related packages installed and managed by dpkg
 X   Package                Version                                       Status
  ------------------------------------------------------------------------------
   - php-common             2:92ubuntu1                                     ha
   - php-json               2:8.1+92ubuntu1                                 ha
DEP  php-mysql              2:8.1+92ubuntu1                                 ha
   - php-pear               1:1.10.12+submodules+notgz+20210212-1ubuntu3    hm
DEP  php-sqlite3            2:8.1+92ubuntu1                                 ha
   - php8.1-bcmath          8.1.2-1ubuntu2.23                               hm
     \included module: bcmath
   - php8.1-bz2             8.1.2-1ubuntu2.23                               hm
     \included module: bz2
SAPI php8.1-cli             8.1.2-1ubuntu2.23                               ha
     \php binary /usr/bin/php8.1 <ACTIVE> linked to generic /usr/bin/php
   - php8.1-common          8.1.2-1ubuntu2.23                               hm
     \included modules: calendar ctype exif ffi fileinfo ftp gettext iconv pdo
       phar posix shmop sockets sysvmsg sysvsem sysvshm tokenizer
   - php8.1-curl            8.1.2-1ubuntu2.23                               hm
     \included module: curl
   - php8.1-dev             8.1.2-1ubuntu2.23                               hm
SAPI php8.1-fpm             8.1.2-1ubuntu2.23                               hm
     \listening on unix socket /run/php/php8.1-fpm.nextcloud.sock <CONNECTED> apache2
   - php8.1-gd              8.1.2-1ubuntu2.23                               hm
     \included module: gd
   - php8.1-gmp             8.1.2-1ubuntu2.23                               hm
     \included module: gmp
   - php8.1-imap            8.1.2-1ubuntu2.23                               hm
     \included module: imap
   - php8.1-intl            8.1.2-1ubuntu2.23                               hm
     \included module: intl
   - php8.1-ldap            8.1.2-1ubuntu2.23                               hm
     \included module: ldap
   - php8.1-mbstring        8.1.2-1ubuntu2.23                               hm
     \included module: mbstring
   - php8.1-mysql           8.1.2-1ubuntu2.23                               ha
     \included modules: mysqli mysqlnd pdo_mysql
   - php8.1-opcache         8.1.2-1ubuntu2.23                               ha
     \included module: opcache
   - php8.1-pgsql           8.1.2-1ubuntu2.23                               hm
     \included modules: pdo_pgsql pgsql
   - php8.1-readline        8.1.2-1ubuntu2.23                               ha
     \included module: readline
   - php8.1-soap            8.1.2-1ubuntu2.23                               hm
     \included module: soap
   - php8.1-sqlite3         8.1.2-1ubuntu2.23                               ha
     \included modules: pdo_sqlite sqlite3
   - php8.1-xml             8.1.2-1ubuntu2.23                               hm
     \included modules: dom simplexml xml xmlreader xmlwriter xsl
   - php8.1-zip             8.1.2-1ubuntu2.23                               hm
     \included module: zip
   - pkg-php-tools          1.42build1                                      ia
  ------------------------------------------------------------------------------
  actual PHP pecl extensions NOT installed and managed by dpkg
  ------------------------------------------------------------------------------
   - php8.1
     \modules installed by admin: igbinary redis smbclient
  ------------------------------------------------------------------------------
  Status: - First letter (Desired Action):    - Second letter (Package Status):
            u=Unknown - i=Install - h=Hold      a=Automatic - m=Manual
  ------------------------------------------------------------------------------
  You can call this list with:     php-updater --list-installed
  ------------------------------------------------------------------------------

 . searching misconfigurations: unused SAPIs .
⚠: There are unnecessary dependency packages (php-mysql and php-sqlite3) installed on this machine.
I: Dependency packages have no other function than to install other packages with the final binaries. For
   example, php-apcu depends on the newest binary package, like php8.4-apcu. The downside is that this can
   lead to an unwanted update to a new version of that package, which can result in difficult-to-debug issues,
   such as internal server errors. It is strongly recommended to remove these packages before updating, as the
   removal will make your system more resilient against unintended changes made without your decision.
 - This script can remove these packages in a safe way.

Q: Do you want to remove the dependency packages php-mysql and php-sqlite3 now? ([y]es or [n]o) [yes]: n
I: You answered [no], nothing changed.
⚠: WARNING: You should absolutely know what you are doing if you do not follow the script's advice, as it may
   result in an unstable system and affect the script's execution down the line! I may not be able to help
   with subsequent errors.
 . searching misconfigurations: meta-packages .
 . check_config() searching known configuration errors .
 . check_config() searching known configuration errors in php8.1: check_invalid_sections .
 . check_config() searching known configuration errors in php8.1: ext_missing_equalsigns .
 . check_config() searching known configuration errors in php8.1: ext_double_definitions .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

   - Double definition detected in /etc/php/8.1/fpm/php.ini:

session.serialize_handler is defined 2 times

info: Extensions that are defined more than once are always a misconfiguration. While PHP itself simply takes
      the last value read for the extension, it interferes with the functionality of this script. The
      extension that defined multiple times will therefore be commented out (not deleted) without further
      prompt, and marked with "# Commented out by php-updater script due to multiple definitions." This makes
      it possible for you to see exactly what happened in case you want to change things later on. The last
      definition is kept, so that PHP's behavior remains unchanged.

R: All double definitions successfully commented out.
 . check_config() searching known configuration errors in php8.1: ext_double_definitions .
 . check_config() searching known configuration errors in php8.1: uncommented priority definitions .
 . check_config() searching known configuration errors in php8.1: checking core .
 . check_config() searching known configuration errors in php8.1: checking bcmath .
 . check_config() searching known configuration errors in php8.1: checking bz2 .
 . check_config() searching known configuration errors in php8.1: checking calendar .
 . check_config() searching known configuration errors in php8.1: checking ctype .
 . check_config() searching known configuration errors in php8.1: checking curl .
 . check_config() searching known configuration errors in php8.1: checking dom .
 . check_config() searching known configuration errors in php8.1: checking exif .
 . check_config() searching known configuration errors in php8.1: checking ffi .
 . check_config() searching known configuration errors in php8.1: checking fileinfo .
 . check_config() searching known configuration errors in php8.1: checking ftp .
 . check_config() searching known configuration errors in php8.1: checking gd .
 . check_config() searching known configuration errors in php8.1: checking gettext .
 . check_config() searching known configuration errors in php8.1: checking gmp .
 . check_config() searching known configuration errors in php8.1: checking iconv .
 . check_config() searching known configuration errors in php8.1: checking igbinary .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 -

   - Malicious configuration lines in /etc/php/8.1/fpm/php.ini:

# igbinary for PHP
info: This line was added by an installation script. Of course, this particular line has no meaning as it is
      commented out, but it will be removed though since the subsequent igbinary related directives will be
      removed there too and placed on their correct place.

session.serialize_handler=igbinary
info: This directive does not belong in /etc/php/8.1/fpm/php.ini. It belongs in
      /etc/php/8.1/mods-available/igbinary.ini. It will be removed from /etc/php/8.1/fpm/php.ini and appendet
      at the end of /etc/php/8.1/mods-available/igbinary.ini.

igbinary.compact_strings=On
info: This directive does not belong in /etc/php/8.1/fpm/php.ini. It belongs in
      /etc/php/8.1/mods-available/igbinary.ini. It will be removed from /etc/php/8.1/fpm/php.ini and appendet
      at the end of /etc/php/8.1/mods-available/igbinary.ini.


Q: Do you want to apply this fixes? ([y]es or [n]o) [yes]: y
R: this step was successfull.
 . check_config() searching known configuration errors in php8.1: checking igbinary .
 . check_config() searching known configuration errors in php8.1: checking imap .
 . check_config() searching known configuration errors in php8.1: checking intl .
 . check_config() searching known configuration errors in php8.1: checking ldap .
 . check_config() searching known configuration errors in php8.1: checking mbstring .
 . check_config() searching known configuration errors in php8.1: checking mysqli .
 . check_config() searching known configuration errors in php8.1: checking mysqlnd .
 . check_config() searching known configuration errors in php8.1: checking opcache .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 -

   - Malicious configuration line in /etc/php/8.1/fpm/php.ini:

opcache.enable_cli=1
info: This directive has absolutely no effect in /etc/php/8.1/fpm/php.ini. It is meant to enable the opcode
      cache for the CLI version of PHP (which is used on the commandline and for cron jobs). For all other
      SAPIs the opcode cache is enabled by default. Although it cannot cause any damage at this location, this
      file is not sourced by the CLI version of PHP and in /etc/php/8.1/mods-available/opcache.ini or
      /etc/php/8.1/cli/php.ini from where the CLI SAPI obtains its directives, this directive is missing. So
      this line will be removed from here and inserted into /etc/php/8.1/cli/php.ini.


Q: Do you want to apply this fixes? ([y]es or [n]o) [yes]:
R: Directive successfully written in /etc/php/8.1/cli/php.ini.
R: removal from /etc/php/8.1/fpm/php.ini was successfull.
 . check_config() searching known configuration errors in php8.1: checking opcache .
 . check_config() searching known configuration errors in php8.1: checking pdo .
 . check_config() searching known configuration errors in php8.1: checking pdo_mysql .
 . check_config() searching known configuration errors in php8.1: checking pdo_pgsql .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 -

[PostgresSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0
info: This block was added by an installation script. These are all exclusively default values and besides
      that, all these lines are already present in the shipped default php.ini for all SAPIs in exact the same
      order. Php does not get better by adding directives multiple times, it only lowers the overview ability
      and makes it difficult for this script. That is why this lines will (should) be removed.


Q: Do you want to remove these lines? ([y]es or [n]o) [yes]:
R: lines successfully removed.
 . check_config() searching known configuration errors in php8.1: checking pdo_pgsql .
 . check_config() searching known configuration errors in php8.1: checking pdo_sqlite .
 . check_config() searching known configuration errors in php8.1: checking pgsql .
 . check_config() searching known configuration errors in php8.1: checking phar .
 . check_config() searching known configuration errors in php8.1: checking posix .
 . check_config() searching known configuration errors in php8.1: checking readline .
 . check_config() searching known configuration errors in php8.1: checking redis .
 . check_config() searching known configuration errors in php8.1: checking shmop .
 . check_config() searching known configuration errors in php8.1: checking simplexml .
 . check_config() searching known configuration errors in php8.1: checking smbclient .
 . check_config() searching known configuration errors in php8.1: checking soap .
 . check_config() searching known configuration errors in php8.1: checking sockets .
 . check_config() searching known configuration errors in php8.1: checking sqlite3 .
 . check_config() searching known configuration errors in php8.1: checking sysvmsg .
 . check_config() searching known configuration errors in php8.1: checking sysvsem .
 . check_config() searching known configuration errors in php8.1: checking sysvshm .
 . check_config() searching known configuration errors in php8.1: checking tokenizer .
 . check_config() searching known configuration errors in php8.1: checking xml .
 . check_config() searching known configuration errors in php8.1: checking xmlreader .
 . check_config() searching known configuration errors in php8.1: checking xmlwriter .
 . check_config() searching known configuration errors in php8.1: checking xsl .
 . check_config() searching known configuration errors in php8.1: checking zip .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  This is the supported architecture on this machine:
architecture: amd64

  This is a list of the effective apt sources on this machine:

No  Label      URI                                               Archive          Component   Arch
--  -----      ---                                               -------          ---------   ----
01  Webmin     download.webmin.com/download/newkey/repository    stable           contrib     all
02  Webmin     download.webmin.com/download/newkey/repository    stable           contrib     amd64
03  Netdata    repository.netdata.cloud/repos/repoconfig/ubuntu  jammy
04  Netdata    repository.netdata.cloud/repos/edge/ubuntu        jammy
05  Docker CE  download.docker.com/linux/ubuntu                  jammy            stable      amd64
06  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-security   multiverse  amd64
07  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-security   universe    amd64
08  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-security   restricted  amd64
09  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-security   main        amd64
10  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-backports  universe    amd64
11  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-backports  main        amd64
12  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-updates    multiverse  amd64
13  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-updates    universe    amd64
14  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-updates    restricted  amd64
15  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy-updates    main        amd64
16  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy            multiverse  amd64
17  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy            universe    amd64
18  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy            restricted  amd64
19  Ubuntu     ftp.uni-stuttgart.de/ubuntu                       jammy            main        amd64
   r=32,

  This is a list of the files containing the apt sources:
01 /etc/apt/sources.list
02 /etc/apt/sources.list.d/docker.list
03 /etc/apt/sources.list.d/webmin.list

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  ==============================================================================
  This is a list of php versions offered by the actual apt sources
  Version  End of life                            Description
  ------------------------------------------------------------------------------
  -> 8.1   2025-12-31 (2 months ago)              <-actually running version
       \   supported by Nextcloud version 24, 25, 26, 27, 28, 29, 30, 31 and 32
  ------------------------------------------------------------------------------

 - Consider adding Ondřej Surý's repo to your Apt sources to expand the range of installable PHP candidates

   Visit Ondřej Surý's website: https://deb.sury.org/ for more details.

   This script can add the right repo to your apt sources.
   If this step fails, you should fix it yourself please. Do not run this step multiple times then. If it
   doesn't work after one attempt, it won't work on the second and subsequent attempts either. It will
   propably be fixed though in a future version of this script, so you can run this script again at a later
   time to try again if it fails now.

Q: Do you want to add sury repo now? ([y]es or [n]o) [yes]:
 .  resynchronizing the APT package index files  .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
   adding apt source was successfull
   After made changes..

  This is the supported architecture on this machine:
architecture: amd64

  This is a list of the effective apt sources on this machine:

No  Label        URI                                               Archive          Component   Arch
--  -----        ---                                               -------          ---------   ----
01  Webmin       download.webmin.com/download/newkey/repository    stable           contrib     all
02  Webmin       download.webmin.com/download/newkey/repository    stable           contrib     amd64
03  PPA for PHP  ppa.launchpadcontent.net/ondrej/php/ubuntu        jammy            main        amd64
04  Netdata      repository.netdata.cloud/repos/repoconfig/ubuntu  jammy
05  Netdata      repository.netdata.cloud/repos/edge/ubuntu        jammy
06  Docker CE    download.docker.com/linux/ubuntu                  jammy            stable      amd64
07  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-security   multiverse  amd64
08  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-security   universe    amd64
09  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-security   restricted  amd64
10  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-security   main        amd64
11  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-backports  universe    amd64
12  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-backports  main        amd64
13  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-updates    multiverse  amd64
14  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-updates    universe    amd64
15  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-updates    restricted  amd64
16  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy-updates    main        amd64
17  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy            multiverse  amd64
18  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy            universe    amd64
19  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy            restricted  amd64
20  Ubuntu       ftp.uni-stuttgart.de/ubuntu                       jammy            main        amd64
   r=0,  - 3 = ok (0)

  This is a list of the files containing the apt sources:
01 /etc/apt/sources.list
02 /etc/apt/sources.list.d/docker.list
03 /etc/apt/sources.list.d/ondrej-sury_php.sources
04 /etc/apt/sources.list.d/webmin.list

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  ==============================================================================
  This is a list of php versions offered by the actual apt sources
  Version  End of life                            Description
  ------------------------------------------------------------------------------
   - 8.5   2029-12-31 (in 3 years and 9 months)
       \   supported by Nextcloud version 33
  ------------------------------------------------------------------------------
   - 8.4   2028-12-31 (in 2 years and 9 months)
       \   supported by Nextcloud version 31, 32 and 33
  ------------------------------------------------------------------------------
   - 8.3   2027-12-31 (in 1 year and 9 months)
       \   supported by Nextcloud version 28, 29, 30, 31, 32 and 33
  ------------------------------------------------------------------------------
   - 8.2   2026-12-31 (in 9 months)
       \   supported by Nextcloud version 26, 27, 28, 29, 30, 31, 32 and 33
  ------------------------------------------------------------------------------
  -> 8.1   2025-12-31 (2 months ago)              <-actually running version
       \   supported by Nextcloud version 24, 25, 26, 27, 28, 29, 30, 31 and 32
  ------------------------------------------------------------------------------
   - 8.0   2022-11-26 (3 years and 3 months ago)
       \   supported by Nextcloud version 21, 22, 23, 24, 25, 26, 27, 28 and 29
  ------------------------------------------------------------------------------
   - 7.4   2021-11-27 (4 years and 3 months ago)
       \   supported by Nextcloud version 18, 19, 20, 21, 22, 23, 24 and 25
  ------------------------------------------------------------------------------
   - 7.3   2020-12-05 (5 years and 3 months ago)
       \   supported by Nextcloud version 15, 16, 17, 18, 19, 20, 21, 22 and 23
  ------------------------------------------------------------------------------
   - 7.2   2019-11-29 (6 years and 3 months ago)
       \   supported by Nextcloud version 13, 14, 15, 16, 17, 18, 19 and 20
  ------------------------------------------------------------------------------
   - 7.1   2018-11-30 (7 years and 3 months ago)
       \   supported by Nextcloud version 11, 12, 13, 14, 15, 16 and 17
  ------------------------------------------------------------------------------
   - 7.0   2017-12-02 (8 years and 3 months ago)
       \   supported by Nextcloud version 10, 11, 12, 13, 14 and 15
  ------------------------------------------------------------------------------
   - 5.6   2017-01-18 (9 years and 1 month ago)
       \   supported by Nextcloud version 9, 10, 11, 12 and 13
  ------------------------------------------------------------------------------

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Q: Do you want to install a new php-version now? ([y]es or [n]o) [yes]:

  ==============================================================================
  This is a list of php versions offered by the actual apt sources
  Version  End of life                            Description
  ------------------------------------------------------------------------------
   - 8.5   2029-12-31 (in 3 years and 9 months)
       \   supported by Nextcloud version 33
  ------------------------------------------------------------------------------
   - 8.4   2028-12-31 (in 2 years and 9 months)
       \   supported by Nextcloud version 31, 32 and 33
  ------------------------------------------------------------------------------
   - 8.3   2027-12-31 (in 1 year and 9 months)
       \   supported by Nextcloud version 28, 29, 30, 31, 32 and 33
  ------------------------------------------------------------------------------
   - 8.2   2026-12-31 (in 9 months)
       \   supported by Nextcloud version 26, 27, 28, 29, 30, 31, 32 and 33
  ------------------------------------------------------------------------------
  -> 8.1   2025-12-31 (2 months ago)              <-actually running version
       \   supported by Nextcloud version 24, 25, 26, 27, 28, 29, 30, 31 and 32
  ------------------------------------------------------------------------------
   - 8.0   2022-11-26 (3 years and 3 months ago)
       \   supported by Nextcloud version 21, 22, 23, 24, 25, 26, 27, 28 and 29
  ------------------------------------------------------------------------------
   - 7.4   2021-11-27 (4 years and 3 months ago)
       \   supported by Nextcloud version 18, 19, 20, 21, 22, 23, 24 and 25
  ------------------------------------------------------------------------------
   - 7.3   2020-12-05 (5 years and 3 months ago)
       \   supported by Nextcloud version 15, 16, 17, 18, 19, 20, 21, 22 and 23
  ------------------------------------------------------------------------------
   - 7.2   2019-11-29 (6 years and 3 months ago)
       \   supported by Nextcloud version 13, 14, 15, 16, 17, 18, 19 and 20
  ------------------------------------------------------------------------------
   - 7.1   2018-11-30 (7 years and 3 months ago)
       \   supported by Nextcloud version 11, 12, 13, 14, 15, 16 and 17
  ------------------------------------------------------------------------------
   - 7.0   2017-12-02 (8 years and 3 months ago)
       \   supported by Nextcloud version 10, 11, 12, 13, 14 and 15
  ------------------------------------------------------------------------------
   - 5.6   2017-01-18 (9 years and 1 month ago)
       \   supported by Nextcloud version 9, 10, 11, 12 and 13
  ------------------------------------------------------------------------------
E: Please enter the version string you want to install (e.g. '8.2'): 8.4
   You entered: 8.4 supported by Nextcloud version 31, 32 and 33

Q: Are you ready to install php8.4? ([y]es or [n]o) [yes]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . detect actually installed extensions .
 . assign detected extensions to their corresponding package .
 . detect extensions installed by admin .
 . searching packaged versions for php8.1 extensions not installed by dpkg .
 . performing thorough review (dry run) of package sources and for candidate availability .
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  php-common php8.4-common php8.4-opcache php8.4-readline
The following NEW packages will be installed:
  php8.4-cli php8.4-common php8.4-fpm php8.4-opcache php8.4-readline
The following held packages will be changed:
  php-common
The following packages will be upgraded:
  php-common
1 upgraded, 5 newly installed, 0 to remove and 58 not upgraded.
Need to get 5358 kB of archives.
After this operation, 23.7 MB of additional disk space will be used.
Get:1 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php-common all 2:101~+ubuntu22.04.1+deb.sury.org+1 [17.7 kB]
Get:2 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-common amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [819 kB]
Get:3 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-opcache amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [491 kB]
Get:4 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-readline amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [13.7 kB]
Get:5 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-cli amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [2000 kB]
Get:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-fpm amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [2016 kB]
Fetched 5358 kB in 5s (1175 kB/s)
(Reading database ... 154410 files and directories currently installed.)
Preparing to unpack .../0-php-common_2%3a101~+ubuntu22.04.1+deb.sury.org+1_all.deb ...
Unpacking php-common (2:101~+ubuntu22.04.1+deb.sury.org+1) over (2:92ubuntu1) ...
Selecting previously unselected package php8.4-common.
Preparing to unpack .../1-php8.4-common_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-common (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-opcache.
Preparing to unpack .../2-php8.4-opcache_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-opcache (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-readline.
Preparing to unpack .../3-php8.4-readline_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-readline (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-cli.
Preparing to unpack .../4-php8.4-cli_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-cli (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-fpm.
Preparing to unpack .../5-php8.4-fpm_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-fpm (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php-common (2:101~+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-common (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/calendar.ini with new version

Creating config file /etc/php/8.4/mods-available/ctype.ini with new version

Creating config file /etc/php/8.4/mods-available/exif.ini with new version

Creating config file /etc/php/8.4/mods-available/fileinfo.ini with new version

Creating config file /etc/php/8.4/mods-available/ffi.ini with new version

Creating config file /etc/php/8.4/mods-available/ftp.ini with new version

Creating config file /etc/php/8.4/mods-available/gettext.ini with new version

Creating config file /etc/php/8.4/mods-available/iconv.ini with new version

Creating config file /etc/php/8.4/mods-available/pdo.ini with new version

Creating config file /etc/php/8.4/mods-available/phar.ini with new version

Creating config file /etc/php/8.4/mods-available/posix.ini with new version

Creating config file /etc/php/8.4/mods-available/shmop.ini with new version

Creating config file /etc/php/8.4/mods-available/sockets.ini with new version

Creating config file /etc/php/8.4/mods-available/sysvmsg.ini with new version

Creating config file /etc/php/8.4/mods-available/sysvsem.ini with new version

Creating config file /etc/php/8.4/mods-available/sysvshm.ini with new version

Creating config file /etc/php/8.4/mods-available/tokenizer.ini with new version
Setting up php8.4-opcache (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/opcache.ini with new version
Setting up php8.4-readline (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/readline.ini with new version
Setting up php8.4-cli (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/cli/php.ini with new version
Setting up php8.4-fpm (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/fpm/php.ini with new version
NOTICE: Not enabling PHP 8.4 FPM by default.
NOTICE: To enable PHP 8.4 FPM in Apache2 do:
NOTICE: a2enmod proxy_fcgi setenvif
NOTICE: a2enconf php8.4-fpm
NOTICE: You are seeing this message because you have apache2 package installed.
Created symlink /etc/systemd/system/multi-user.target.wants/php8.4-fpm.service → /lib/systemd/system/php8.4-fpm.service.
Processing triggers for man-db (2.10.2-1) ...
Processing triggers for php8.4-cli (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Processing triggers for php8.4-fpm (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
NOTICE: Not enabling PHP 8.4 FPM by default.
NOTICE: To enable PHP 8.4 FPM in Apache2 do:
NOTICE: a2enmod proxy_fcgi setenvif
NOTICE: a2enconf php8.4-fpm
NOTICE: You are seeing this message because you have apache2 package installed.
packages have been installed but needrestart is suspended
Scanning processes...
Scanning linux images...

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 - If everything looks good so far, the migration of the settings from php-8.1 to php-8.4 can be started. If
   you answer [ no ] here or abort the migration process on some point (with Ctrl-C), you can always call and
   start this step again with

ncadmin@nas.redacted.local:~$ php-updater 8.1 8.4

   to finalize or redo the migration.

 - Please be aware that a malicious configuration under php-8.1 will also be migrated. This script does not
   yet check for all thinkable wrong configurations. This will change step by step in future.

Q: Proceed with next step? ([y]es or [n]o) [yes]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . etx_state() cleanup orphaned entries from extensions state registry .
 . etx_state() fix extensions state registry /var/lib/php/modules .
 . detect actually installed extensions .
 . assign detected extensions to their corresponding package .
 . detect extensions installed by admin .
 . searching packaged versions for php8.1 extensions not installed by dpkg .
 . searching packaged versions for php8.4 extensions not installed by dpkg .

  ==============================================================================
  actual PHP related packages installed and managed by dpkg
 X   Package                Version                                       Status
  ------------------------------------------------------------------------------
   - php-common             2:101~+ubuntu22.04.1+deb.sury.org+1             im
DEP  php-json               2:8.1+92ubuntu1                                 hm
DEP  php-mysql              2:8.1+92ubuntu1                                 hm
   - php-pear               1:1.10.12+submodules+notgz+20210212-1ubuntu3    hm
DEP  php-sqlite3            2:8.1+92ubuntu1                                 hm
   - php8.1-bcmath          8.1.2-1ubuntu2.23                               hm
     \included module: bcmath
   - php8.1-bz2             8.1.2-1ubuntu2.23                               hm
     \included module: bz2
SAPI php8.1-cli             8.1.2-1ubuntu2.23                               hm
     \php binary /usr/bin/php8.1 <ACTIVE> linked to generic /usr/bin/php
   - php8.1-common          8.1.2-1ubuntu2.23                               hm
     \included modules: calendar ctype exif ffi fileinfo ftp gettext iconv pdo
       phar posix shmop sockets sysvmsg sysvsem sysvshm tokenizer
   - php8.1-curl            8.1.2-1ubuntu2.23                               hm
     \included module: curl
   - php8.1-dev             8.1.2-1ubuntu2.23                               hm
SAPI php8.1-fpm             8.1.2-1ubuntu2.23                               hm
     \listening on unix socket /run/php/php8.1-fpm.nextcloud.sock <CONNECTED> apache2
   - php8.1-gd              8.1.2-1ubuntu2.23                               hm
     \included module: gd
   - php8.1-gmp             8.1.2-1ubuntu2.23                               hm
     \included module: gmp
   - php8.1-imap            8.1.2-1ubuntu2.23                               hm
     \included module: imap
   - php8.1-intl            8.1.2-1ubuntu2.23                               hm
     \included module: intl
   - php8.1-ldap            8.1.2-1ubuntu2.23                               hm
     \included module: ldap
   - php8.1-mbstring        8.1.2-1ubuntu2.23                               hm
     \included module: mbstring
   - php8.1-mysql           8.1.2-1ubuntu2.23                               hm
     \included modules: mysqli mysqlnd pdo_mysql
   - php8.1-opcache         8.1.2-1ubuntu2.23                               hm
     \included module: opcache
   - php8.1-pgsql           8.1.2-1ubuntu2.23                               hm
     \included modules: pdo_pgsql pgsql
   - php8.1-readline        8.1.2-1ubuntu2.23                               hm
     \included module: readline
   - php8.1-soap            8.1.2-1ubuntu2.23                               hm
     \included module: soap
   - php8.1-sqlite3         8.1.2-1ubuntu2.23                               hm
     \included modules: pdo_sqlite sqlite3
   - php8.1-xml             8.1.2-1ubuntu2.23                               hm
     \included modules: dom simplexml xml xmlreader xmlwriter xsl
   - php8.1-zip             8.1.2-1ubuntu2.23                               hm
     \included module: zip
SAPI php8.4-cli             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \php binary /usr/bin/php8.4 <<INACTIVE not linked
   - php8.4-common          8.4.18-2+ubuntu22.04.1+deb.sury.org+1           ia
     \included modules: calendar ctype exif ffi fileinfo ftp gettext iconv pdo
       phar posix shmop sockets sysvmsg sysvsem sysvshm tokenizer
SAPI php8.4-fpm             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \listening on unix socket /run/php/php8.4-fpm.sock <<NOT CONNECTED
   - php8.4-opcache         8.4.18-2+ubuntu22.04.1+deb.sury.org+1           ia
     \included module: opcache
   - php8.4-readline        8.4.18-2+ubuntu22.04.1+deb.sury.org+1           ia
     \included module: readline
   - pkg-php-tools          1.42build1                                      im
  ------------------------------------------------------------------------------
  actual PHP pecl extensions NOT installed and managed by dpkg
  ------------------------------------------------------------------------------
   - php8.1
     \modules installed by admin: igbinary redis smbclient
  ------------------------------------------------------------------------------
  Status: - First letter (Desired Action):    - Second letter (Package Status):
            u=Unknown - i=Install - h=Hold      a=Automatic - m=Manual
  ------------------------------------------------------------------------------
  You can switch the <ACTIVE> and <CONNECTED> version with:
                                   php-updater --switch-version
  ------------------------------------------------------------------------------
  You can call this list with:     php-updater --list-installed
  ------------------------------------------------------------------------------

 . searching misconfigurations: unused SAPIs .
⚠: There are unnecessary dependency packages (php-json, php-mysql and php-sqlite3) installed on this machine.
I: Dependency packages have no other function than to install other packages with the final binaries. For
   example, php-apcu depends on the newest binary package, like php8.4-apcu. The downside is that this can
   lead to an unwanted update to a new version of that package, which can result in difficult-to-debug issues,
   such as internal server errors. It is strongly recommended to remove these packages before updating, as the
   removal will make your system more resilient against unintended changes made without your decision.
 - This script can remove these packages in a safe way.

Q: Do you want to remove the dependency packages php-json, php-mysql and php-sqlite3 now?
   Make your choice: ([y]es or [n]o) [yes]: n
I: You answered [no], nothing changed.
⚠: WARNING: You should absolutely know what you are doing if you do not follow the script's advice, as it may
   result in an unstable system and affect the script's execution down the line! I may not be able to help
   with subsequent errors.
 . searching misconfigurations: meta-packages .
 . check_config() searching known configuration errors .
 . check_config() searching known configuration errors in php8.1: check_invalid_sections .
 . check_config() searching known configuration errors in php8.1: ext_missing_equalsigns .
 . check_config() searching known configuration errors in php8.1: ext_double_definitions .
 . check_config() searching known configuration errors in php8.1: uncommented priority definitions .
 . check_config() searching known configuration errors in php8.1: checking core .
 . check_config() searching known configuration errors in php8.1: checking bcmath .
 . check_config() searching known configuration errors in php8.1: checking bz2 .
 . check_config() searching known configuration errors in php8.1: checking calendar .
 . check_config() searching known configuration errors in php8.1: checking ctype .
 . check_config() searching known configuration errors in php8.1: checking curl .
 . check_config() searching known configuration errors in php8.1: checking dom .
 . check_config() searching known configuration errors in php8.1: checking exif .
 . check_config() searching known configuration errors in php8.1: checking ffi .
 . check_config() searching known configuration errors in php8.1: checking fileinfo .
 . check_config() searching known configuration errors in php8.1: checking ftp .
 . check_config() searching known configuration errors in php8.1: checking gd .
 . check_config() searching known configuration errors in php8.1: checking gettext .
 . check_config() searching known configuration errors in php8.1: checking gmp .
 . check_config() searching known configuration errors in php8.1: checking iconv .
 . check_config() searching known configuration errors in php8.1: checking igbinary .
 . check_config() searching known configuration errors in php8.1: checking imap .
 . check_config() searching known configuration errors in php8.1: checking intl .
 . check_config() searching known configuration errors in php8.1: checking ldap .
 . check_config() searching known configuration errors in php8.1: checking mbstring .
 . check_config() searching known configuration errors in php8.1: checking mysqli .
 . check_config() searching known configuration errors in php8.1: checking mysqlnd .
 . check_config() searching known configuration errors in php8.1: checking opcache .
 . check_config() searching known configuration errors in php8.1: checking pdo .
 . check_config() searching known configuration errors in php8.1: checking pdo_mysql .
 . check_config() searching known configuration errors in php8.1: checking pdo_pgsql .
 . check_config() searching known configuration errors in php8.1: checking pdo_sqlite .
 . check_config() searching known configuration errors in php8.1: checking pgsql .
 . check_config() searching known configuration errors in php8.1: checking phar .
 . check_config() searching known configuration errors in php8.1: checking posix .
 . check_config() searching known configuration errors in php8.1: checking readline .
 . check_config() searching known configuration errors in php8.1: checking redis .
 . check_config() searching known configuration errors in php8.1: checking shmop .
 . check_config() searching known configuration errors in php8.1: checking simplexml .
 . check_config() searching known configuration errors in php8.1: checking smbclient .
 . check_config() searching known configuration errors in php8.1: checking soap .
 . check_config() searching known configuration errors in php8.1: checking sockets .
 . check_config() searching known configuration errors in php8.1: checking sqlite3 .
 . check_config() searching known configuration errors in php8.1: checking sysvmsg .
 . check_config() searching known configuration errors in php8.1: checking sysvsem .
 . check_config() searching known configuration errors in php8.1: checking sysvshm .
 . check_config() searching known configuration errors in php8.1: checking tokenizer .
 . check_config() searching known configuration errors in php8.1: checking xml .
 . check_config() searching known configuration errors in php8.1: checking xmlreader .
 . check_config() searching known configuration errors in php8.1: checking xmlwriter .
 . check_config() searching known configuration errors in php8.1: checking xsl .
 . check_config() searching known configuration errors in php8.1: checking zip .
 . searching for php8.4 packages yet to be installed .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 - You entered "8.1" as old and "8.4" as new version. Although php8.4 is installed, some php8.4 packages are
   still missing compared to php8.1 and the minimum packages that are needed to run a server like Nextcloud.
   These are the missing ones:
   php8.4-apcu, php8.4-bcmath, php8.4-bz2, php8.4-curl, php8.4-dev, php8.4-gd, php8.4-gmp, php8.4-igbinary,
   php8.4-imap, php8.4-intl, php8.4-ldap, php8.4-mbstring, php8.4-mysql, php8.4-pgsql, php8.4-redis,
   php8.4-smbclient, php8.4-soap, php8.4-sqlite3, php8.4-xml and php8.4-zip
   If you answer [ no ] here, the script will continue without installing these packages.

Q: Do you want to install these packages? ([y]es or [n]o) [yes]: y
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . detect actually installed extensions .
 . assign detected extensions to their corresponding package .
 . detect extensions installed by admin .
 . searching packaged versions for php8.1 extensions not installed by dpkg .
 . performing thorough review (dry run) of package sources and for candidate availability .
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libabsl20210324 libavif13 libde265-0 libgav1-0 libgd3 libheif1 libimagequant0 libyuv0
Suggested packages:
  libgd-tools dh-php
The following NEW packages will be installed:
  libabsl20210324 libavif13 libde265-0 libgav1-0 libheif1 libimagequant0 libyuv0 php8.4-apcu php8.4-bcmath php8.4-bz2 php8.4-curl php8.4-dev php8.4-gd php8.4-gmp php8.4-igbinary php8.4-imap
  php8.4-intl php8.4-ldap php8.4-mbstring php8.4-mysql php8.4-pgsql php8.4-redis php8.4-smbclient php8.4-soap php8.4-sqlite3 php8.4-xml php8.4-zip
The following packages will be upgraded:
  libgd3
1 upgraded, 27 newly installed, 0 to remove and 57 not upgraded.
Need to get 4551 kB of archives.
After this operation, 18.9 MB of additional disk space will be used.
Get:1 https://ftp.uni-stuttgart.de/ubuntu jammy-updates/main amd64 libabsl20210324 amd64 0~20210324.2-2ubuntu0.3 [386 kB]
Get:2 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-apcu amd64 5.1.28-1+ubuntu22.04.1+deb.sury.org+1 [50.7 kB]
Get:3 https://ftp.uni-stuttgart.de/ubuntu jammy/universe amd64 libgav1-0 amd64 0.17.0-1build1 [336 kB]
Get:4 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-igbinary amd64 3.2.16-6+ubuntu22.04.1+deb.sury.org+1 [38.2 kB]
Get:5 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-imap amd64 3:1.0.3-2+ubuntu22.04.1+deb.sury.org+1 [39.3 kB]
Get:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-redis amd64 6.3.0-2+ubuntu22.04.1+deb.sury.org+1 [210 kB]
Get:7 https://ftp.uni-stuttgart.de/ubuntu jammy/universe amd64 libyuv0 amd64 0.0~git20220104.b91df1a-2 [154 kB]
Get:8 https://ftp.uni-stuttgart.de/ubuntu jammy/universe amd64 libavif13 amd64 0.9.3-3 [69.5 kB]
Get:9 https://ftp.uni-stuttgart.de/ubuntu jammy-updates/universe amd64 libde265-0 amd64 1.0.8-1ubuntu0.3 [290 kB]
Get:10 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-smbclient amd64 1.1.2-4+ubuntu22.04.1+deb.sury.org+1 [25.9 kB]
Get:11 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 libgd3 amd64 2.3.3-13+ubuntu22.04.1+deb.sury.org+1 [148 kB]
Get:12 https://ftp.uni-stuttgart.de/ubuntu jammy/universe amd64 libheif1 amd64 1.12.0-2build1 [196 kB]
Get:13 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-bcmath amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [28.4 kB]
Get:14 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-bz2 amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [11.6 kB]
Get:15 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-curl amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [43.1 kB]
Get:16 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-dev amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [594 kB]
Get:17 https://ftp.uni-stuttgart.de/ubuntu jammy/main amd64 libimagequant0 amd64 2.17.0-1 [34.6 kB]
Get:18 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-gd amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [40.1 kB]
Get:19 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-gmp amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [23.5 kB]
Get:20 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-intl amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [177 kB]
Get:21 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-ldap amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [35.8 kB]
Get:22 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-mbstring amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [546 kB]
Get:23 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-mysql amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [133 kB]
Get:24 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-pgsql amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [79.1 kB]
Get:25 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-soap amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [137 kB]
Get:26 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-sqlite3 amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [38.5 kB]
Get:27 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-xml amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [655 kB]
Get:28 https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy/main amd64 php8.4-zip amd64 8.4.18-2+ubuntu22.04.1+deb.sury.org+1 [31.6 kB]
Fetched 4551 kB in 3s (1746 kB/s)
Selecting previously unselected package php8.4-apcu.
(Reading database ... 154526 files and directories currently installed.)
Preparing to unpack .../00-php8.4-apcu_5.1.28-1+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-apcu (5.1.28-1+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-igbinary.
Preparing to unpack .../01-php8.4-igbinary_3.2.16-6+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-igbinary (3.2.16-6+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-imap.
Preparing to unpack .../02-php8.4-imap_3%3a1.0.3-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-imap (3:1.0.3-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-redis.
Preparing to unpack .../03-php8.4-redis_6.3.0-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-redis (6.3.0-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-smbclient.
Preparing to unpack .../04-php8.4-smbclient_1.1.2-4+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-smbclient (1.1.2-4+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package libabsl20210324:amd64.
Preparing to unpack .../05-libabsl20210324_0~20210324.2-2ubuntu0.3_amd64.deb ...
Unpacking libabsl20210324:amd64 (0~20210324.2-2ubuntu0.3) ...
Selecting previously unselected package libgav1-0:amd64.
Preparing to unpack .../06-libgav1-0_0.17.0-1build1_amd64.deb ...
Unpacking libgav1-0:amd64 (0.17.0-1build1) ...
Selecting previously unselected package libyuv0:amd64.
Preparing to unpack .../07-libyuv0_0.0~git20220104.b91df1a-2_amd64.deb ...
Unpacking libyuv0:amd64 (0.0~git20220104.b91df1a-2) ...
Selecting previously unselected package libavif13:amd64.
Preparing to unpack .../08-libavif13_0.9.3-3_amd64.deb ...
Unpacking libavif13:amd64 (0.9.3-3) ...
Selecting previously unselected package libde265-0:amd64.
Preparing to unpack .../09-libde265-0_1.0.8-1ubuntu0.3_amd64.deb ...
Unpacking libde265-0:amd64 (1.0.8-1ubuntu0.3) ...
Selecting previously unselected package libheif1:amd64.
Preparing to unpack .../10-libheif1_1.12.0-2build1_amd64.deb ...
Unpacking libheif1:amd64 (1.12.0-2build1) ...
Selecting previously unselected package libimagequant0:amd64.
Preparing to unpack .../11-libimagequant0_2.17.0-1_amd64.deb ...
Unpacking libimagequant0:amd64 (2.17.0-1) ...
Preparing to unpack .../12-libgd3_2.3.3-13+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking libgd3:amd64 (2.3.3-13+ubuntu22.04.1+deb.sury.org+1) over (2.3.0-2ubuntu2.3) ...
Selecting previously unselected package php8.4-bcmath.
Preparing to unpack .../13-php8.4-bcmath_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-bcmath (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-bz2.
Preparing to unpack .../14-php8.4-bz2_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-bz2 (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-curl.
Preparing to unpack .../15-php8.4-curl_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-curl (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-dev.
Preparing to unpack .../16-php8.4-dev_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-dev (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-gd.
Preparing to unpack .../17-php8.4-gd_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-gd (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-gmp.
Preparing to unpack .../18-php8.4-gmp_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-gmp (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-intl.
Preparing to unpack .../19-php8.4-intl_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-intl (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-ldap.
Preparing to unpack .../20-php8.4-ldap_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-ldap (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-mbstring.
Preparing to unpack .../21-php8.4-mbstring_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-mbstring (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-mysql.
Preparing to unpack .../22-php8.4-mysql_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-mysql (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-pgsql.
Preparing to unpack .../23-php8.4-pgsql_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-pgsql (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-soap.
Preparing to unpack .../24-php8.4-soap_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-soap (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-sqlite3.
Preparing to unpack .../25-php8.4-sqlite3_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-sqlite3 (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-xml.
Preparing to unpack .../26-php8.4-xml_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-xml (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Selecting previously unselected package php8.4-zip.
Preparing to unpack .../27-php8.4-zip_8.4.18-2+ubuntu22.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php8.4-zip (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-ldap (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/ldap.ini with new version
Setting up php8.4-imap (3:1.0.3-2+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-dev (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-mbstring (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/mbstring.ini with new version
Setting up php8.4-mysql (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/mysqlnd.ini with new version

Creating config file /etc/php/8.4/mods-available/mysqli.ini with new version

Creating config file /etc/php/8.4/mods-available/pdo_mysql.ini with new version
Setting up php8.4-curl (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/curl.ini with new version
Setting up php8.4-pgsql (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/pgsql.ini with new version

Creating config file /etc/php/8.4/mods-available/pdo_pgsql.ini with new version
Setting up php8.4-sqlite3 (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/sqlite3.ini with new version

Creating config file /etc/php/8.4/mods-available/pdo_sqlite.ini with new version
Setting up php8.4-bcmath (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/bcmath.ini with new version
Setting up php8.4-gmp (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/gmp.ini with new version
Setting up libimagequant0:amd64 (2.17.0-1) ...
Setting up php8.4-zip (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/zip.ini with new version
Setting up libabsl20210324:amd64 (0~20210324.2-2ubuntu0.3) ...
Setting up php8.4-smbclient (1.1.2-4+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-bz2 (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/bz2.ini with new version
Setting up php8.4-apcu (5.1.28-1+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-igbinary (3.2.16-6+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-xml (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/dom.ini with new version

Creating config file /etc/php/8.4/mods-available/simplexml.ini with new version

Creating config file /etc/php/8.4/mods-available/xml.ini with new version

Creating config file /etc/php/8.4/mods-available/xmlreader.ini with new version

Creating config file /etc/php/8.4/mods-available/xmlwriter.ini with new version

Creating config file /etc/php/8.4/mods-available/xsl.ini with new version
Setting up libde265-0:amd64 (1.0.8-1ubuntu0.3) ...
Setting up php8.4-soap (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/soap.ini with new version
Setting up libyuv0:amd64 (0.0~git20220104.b91df1a-2) ...
Setting up php8.4-intl (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/intl.ini with new version
Setting up php8.4-redis (6.3.0-2+ubuntu22.04.1+deb.sury.org+1) ...
Setting up libheif1:amd64 (1.12.0-2build1) ...
Setting up libgav1-0:amd64 (0.17.0-1build1) ...
Setting up libavif13:amd64 (0.9.3-3) ...
Setting up libgd3:amd64 (2.3.3-13+ubuntu22.04.1+deb.sury.org+1) ...
Setting up php8.4-gd (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...

Creating config file /etc/php/8.4/mods-available/gd.ini with new version
Processing triggers for php8.4-fpm (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
NOTICE: Not enabling PHP 8.4 FPM by default.
NOTICE: To enable PHP 8.4 FPM in Apache2 do:
NOTICE: a2enmod proxy_fcgi setenvif
NOTICE: a2enconf php8.4-fpm
NOTICE: You are seeing this message because you have apache2 package installed.
Processing triggers for libc-bin (2.35-0ubuntu3.13) ...
Processing triggers for man-db (2.10.2-1) ...
Processing triggers for php8.4-cli (8.4.18-2+ubuntu22.04.1+deb.sury.org+1) ...
packages have been installed but needrestart is suspended
Scanning processes...
Scanning candidates...
Scanning linux images...

Running kernel seems to be up-to-date.

Restarting services...
 systemctl restart php8.1-fpm.service

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 - If everything looks good so far, the migration of the settings from php-8.1 to php-8.4 can be started. If
   you answer [ no ] here or abort the migration process on some point (with Ctrl-C), you can always call and
   start this step again with

ncadmin@nas.redacted.local:~$ php-updater 8.1 8.4

   to finalize or redo the migration.

 - Please be aware that a malicious configuration under php-8.1 will also be migrated. This script does not
   yet check for all thinkable wrong configurations. This will change step by step in future.

Q: Proceed with next step? ([y]es or [n]o) [yes]: y
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . etx_state() cleanup orphaned entries from extensions state registry .
 . etx_state() fix extensions state registry /var/lib/php/modules .
 . detect actually installed extensions .
 . assign detected extensions to their corresponding package .
 . detect extensions installed by admin .
 . searching packaged versions for php8.1 extensions not installed by dpkg .
 . searching packaged versions for php8.4 extensions not installed by dpkg .

  ==============================================================================
  actual PHP related packages installed and managed by dpkg
 X   Package                Version                                       Status
  ------------------------------------------------------------------------------
   - php-common             2:101~+ubuntu22.04.1+deb.sury.org+1             im
DEP  php-json               2:8.1+92ubuntu1                                 hm
DEP  php-mysql              2:8.1+92ubuntu1                                 hm
   - php-pear               1:1.10.12+submodules+notgz+20210212-1ubuntu3    hm
DEP  php-sqlite3            2:8.1+92ubuntu1                                 hm
   - php8.1-bcmath          8.1.2-1ubuntu2.23                               hm
     \included module: bcmath
   - php8.1-bz2             8.1.2-1ubuntu2.23                               hm
     \included module: bz2
SAPI php8.1-cli             8.1.2-1ubuntu2.23                               hm
     \php binary /usr/bin/php8.1 <ACTIVE> linked to generic /usr/bin/php
   - php8.1-common          8.1.2-1ubuntu2.23                               hm
     \included modules: calendar ctype exif ffi fileinfo ftp gettext iconv pdo
       phar posix shmop sockets sysvmsg sysvsem sysvshm tokenizer
   - php8.1-curl            8.1.2-1ubuntu2.23                               hm
     \included module: curl
   - php8.1-dev             8.1.2-1ubuntu2.23                               hm
SAPI php8.1-fpm             8.1.2-1ubuntu2.23                               hm
     \listening on unix socket /run/php/php8.1-fpm.nextcloud.sock <CONNECTED> apache2
   - php8.1-gd              8.1.2-1ubuntu2.23                               hm
     \included module: gd
   - php8.1-gmp             8.1.2-1ubuntu2.23                               hm
     \included module: gmp
   - php8.1-imap            8.1.2-1ubuntu2.23                               hm
     \included module: imap
   - php8.1-intl            8.1.2-1ubuntu2.23                               hm
     \included module: intl
   - php8.1-ldap            8.1.2-1ubuntu2.23                               hm
     \included module: ldap
   - php8.1-mbstring        8.1.2-1ubuntu2.23                               hm
     \included module: mbstring
   - php8.1-mysql           8.1.2-1ubuntu2.23                               hm
     \included modules: mysqli mysqlnd pdo_mysql
   - php8.1-opcache         8.1.2-1ubuntu2.23                               hm
     \included module: opcache
   - php8.1-pgsql           8.1.2-1ubuntu2.23                               hm
     \included modules: pdo_pgsql pgsql
   - php8.1-readline        8.1.2-1ubuntu2.23                               hm
     \included module: readline
   - php8.1-soap            8.1.2-1ubuntu2.23                               hm
     \included module: soap
   - php8.1-sqlite3         8.1.2-1ubuntu2.23                               hm
     \included modules: pdo_sqlite sqlite3
   - php8.1-xml             8.1.2-1ubuntu2.23                               hm
     \included modules: dom simplexml xml xmlreader xmlwriter xsl
   - php8.1-zip             8.1.2-1ubuntu2.23                               hm
     \included module: zip
   - php8.4-apcu            5.1.28-1+ubuntu22.04.1+deb.sury.org+1           im
     \included module: apcu
   - php8.4-bcmath          8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: bcmath
   - php8.4-bz2             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: bz2
SAPI php8.4-cli             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \php binary /usr/bin/php8.4 <<INACTIVE not linked
   - php8.4-common          8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included modules: calendar ctype exif ffi fileinfo ftp gettext iconv pdo
       phar posix shmop sockets sysvmsg sysvsem sysvshm tokenizer
   - php8.4-curl            8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: curl
   - php8.4-dev             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
SAPI php8.4-fpm             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \listening on unix socket /run/php/php8.4-fpm.sock <<NOT CONNECTED
   - php8.4-gd              8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: gd
   - php8.4-gmp             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: gmp
   - php8.4-igbinary        3.2.16-6+ubuntu22.04.1+deb.sury.org+1           im
     \included module: igbinary
   - php8.4-imap            3:1.0.3-2+ubuntu22.04.1+deb.sury.org+1          im
     \included module: imap
   - php8.4-intl            8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: intl
   - php8.4-ldap            8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: ldap
   - php8.4-mbstring        8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: mbstring
   - php8.4-mysql           8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included modules: mysqli mysqlnd pdo_mysql
   - php8.4-opcache         8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: opcache
   - php8.4-pgsql           8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included modules: pdo_pgsql pgsql
   - php8.4-readline        8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: readline
   - php8.4-redis           6.3.0-2+ubuntu22.04.1+deb.sury.org+1            im
     \included module: redis
   - php8.4-smbclient       1.1.2-4+ubuntu22.04.1+deb.sury.org+1            im
     \included module: smbclient
   - php8.4-soap            8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: soap
   - php8.4-sqlite3         8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included modules: pdo_sqlite sqlite3
   - php8.4-xml             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included modules: dom simplexml xml xmlreader xmlwriter xsl
   - php8.4-zip             8.4.18-2+ubuntu22.04.1+deb.sury.org+1           im
     \included module: zip
   - pkg-php-tools          1.42build1                                      im
  ------------------------------------------------------------------------------
  actual PHP pecl extensions NOT installed and managed by dpkg
  ------------------------------------------------------------------------------
   - php8.1
     \modules installed by admin: igbinary redis smbclient
  ------------------------------------------------------------------------------
  Status: - First letter (Desired Action):    - Second letter (Package Status):
            u=Unknown - i=Install - h=Hold      a=Automatic - m=Manual
  ------------------------------------------------------------------------------
  You can switch the <ACTIVE> and <CONNECTED> version with:
                                   php-updater --switch-version
  ------------------------------------------------------------------------------
  You can call this list with:     php-updater --list-installed
  ------------------------------------------------------------------------------

 . searching misconfigurations: unused SAPIs .
⚠: There are unnecessary dependency packages (php-json, php-mysql and php-sqlite3) installed on this machine.
I: Dependency packages have no other function than to install other packages with the final binaries. For
   example, php-apcu depends on the newest binary package, like php8.4-apcu. The downside is that this can
   lead to an unwanted update to a new version of that package, which can result in difficult-to-debug issues,
   such as internal server errors. It is strongly recommended to remove these packages before updating, as the
   removal will make your system more resilient against unintended changes made without your decision.
 - This script can remove these packages in a safe way.

Q: Do you want to remove the dependency packages php-json, php-mysql and php-sqlite3 now?
   Make your choice: ([y]es or [n]o) [yes]: n
I: You answered [no], nothing changed.
⚠: WARNING: You should absolutely know what you are doing if you do not follow the script's advice, as it may
   result in an unstable system and affect the script's execution down the line! I may not be able to help
   with subsequent errors.
 . searching misconfigurations: meta-packages .
 . check_config() searching known configuration errors .
 . check_config() searching known configuration errors in php8.1: check_invalid_sections .
 . check_config() searching known configuration errors in php8.1: ext_missing_equalsigns .
 . check_config() searching known configuration errors in php8.1: ext_double_definitions .
 . check_config() searching known configuration errors in php8.1: uncommented priority definitions .
 . check_config() searching known configuration errors in php8.1: checking core .
 . check_config() searching known configuration errors in php8.1: checking bcmath .
 . check_config() searching known configuration errors in php8.1: checking bz2 .
 . check_config() searching known configuration errors in php8.1: checking calendar .
 . check_config() searching known configuration errors in php8.1: checking ctype .
 . check_config() searching known configuration errors in php8.1: checking curl .
 . check_config() searching known configuration errors in php8.1: checking dom .
 . check_config() searching known configuration errors in php8.1: checking exif .
 . check_config() searching known configuration errors in php8.1: checking ffi .
 . check_config() searching known configuration errors in php8.1: checking fileinfo .
 . check_config() searching known configuration errors in php8.1: checking ftp .
 . check_config() searching known configuration errors in php8.1: checking gd .
 . check_config() searching known configuration errors in php8.1: checking gettext .
 . check_config() searching known configuration errors in php8.1: checking gmp .
 . check_config() searching known configuration errors in php8.1: checking iconv .
 . check_config() searching known configuration errors in php8.1: checking igbinary .
 . check_config() searching known configuration errors in php8.1: checking imap .
 . check_config() searching known configuration errors in php8.1: checking intl .
 . check_config() searching known configuration errors in php8.1: checking ldap .
 . check_config() searching known configuration errors in php8.1: checking mbstring .
 . check_config() searching known configuration errors in php8.1: checking mysqli .
 . check_config() searching known configuration errors in php8.1: checking mysqlnd .
 . check_config() searching known configuration errors in php8.1: checking opcache .
 . check_config() searching known configuration errors in php8.1: checking pdo .
 . check_config() searching known configuration errors in php8.1: checking pdo_mysql .
 . check_config() searching known configuration errors in php8.1: checking pdo_pgsql .
 . check_config() searching known configuration errors in php8.1: checking pdo_sqlite .
 . check_config() searching known configuration errors in php8.1: checking pgsql .
 . check_config() searching known configuration errors in php8.1: checking phar .
 . check_config() searching known configuration errors in php8.1: checking posix .
 . check_config() searching known configuration errors in php8.1: checking readline .
 . check_config() searching known configuration errors in php8.1: checking redis .
 . check_config() searching known configuration errors in php8.1: checking shmop .
 . check_config() searching known configuration errors in php8.1: checking simplexml .
 . check_config() searching known configuration errors in php8.1: checking smbclient .
 . check_config() searching known configuration errors in php8.1: checking soap .
 . check_config() searching known configuration errors in php8.1: checking sockets .
 . check_config() searching known configuration errors in php8.1: checking sqlite3 .
 . check_config() searching known configuration errors in php8.1: checking sysvmsg .
 . check_config() searching known configuration errors in php8.1: checking sysvsem .
 . check_config() searching known configuration errors in php8.1: checking sysvshm .
 . check_config() searching known configuration errors in php8.1: checking tokenizer .
 . check_config() searching known configuration errors in php8.1: checking xml .
 . check_config() searching known configuration errors in php8.1: checking xmlreader .
 . check_config() searching known configuration errors in php8.1: checking xmlwriter .
 . check_config() searching known configuration errors in php8.1: checking xsl .
 . check_config() searching known configuration errors in php8.1: checking zip .
 . searching for php8.4 packages yet to be installed .
 . searching changed ini- and conf-files for php8.1 to be adapted into php8.4 .

 = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Q: Do you want to migrate the values for the Command Line Interpreter SAPI from the php.ini for php8.1-cli
   into the corresponding php.ini for php8.4-cli?
   Make your choice: ([y]es or [n]o) [yes]: y
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/cli/php.ini with /etc/php/8.1/cli/php.ini .
 - The value for "error_reporting" is "E_ALL & ~E_DEPRECATED & ~E_STRICT" in the php.ini of php8.1-cli in the
   php.ini of php8.4-cli it is "E_ALL & ~E_DEPRECATED"
   the value defaults to "NULL"
I: The directive "error_reporting" will not be changed by this script for the moment. If you want to set this
   directive to a specific value for the Command Line Interpreter SAPI, you will have to edit the file
   /etc/php/8.4/cli/php.ini with an editor of your choice.
   Refer to https://www.php.net/manual/errorfunc.configuration.php#ini.error_reporting for further information
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/cli/php.ini with /etc/php/8.1/cli/php.ini .
 - Directive "mysqli.reconnect" with value "Off" not found in /etc/php/8.4/cli/php.ini
   the value defaults to "0"
   this is the changelog of this directive:
   - "Removed as of PHP 8.2.0"
 Tip: do  not  integrate this directive into the new config if it got removed as off the new version.
NOTE: The default answer here is [no]. You should always accept the default answer (press ENTER) when [no] is
      given, unless you are absolutely sure what you are doing.

Q: Do you want to append "mysqli.reconnect" with value "Off" at the end of the [MySQLi]  section?
   Make your choice: ([y]es or [n]o) [no]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/cli/php.ini with /etc/php/8.1/cli/php.ini .
 - The value for "opcache.enable_cli" is "1" in the php.ini of php8.1-cli and is not set in the php.ini of
   php8.4-cli
   the value defaults to "0"
   this is the changelog of this directive:
   - "Between PHP 7.1.2 and 7.1.6 inclusive, the default was 1"

Q: Do you want to assign "1" to "opcache.enable_cli"? ([y]es or [n]o) [yes]:
R: Added "opcache.enable_cli = 1" after line 1674 in /etc/php/8.4/cli/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/cli/php.ini with /etc/php/8.1/cli/php.ini .
 - Directive "session.sid_bits_per_character" with value "5" not found in /etc/php/8.4/cli/php.ini
   the value defaults to "4"
   this is the changelog of this directive:
   - "Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0"
 TIP: consider to  not  integrate this directive into the new config if it got marked as deprecated as off the
      new version.
NOTE: The default answer here is [no]. You can simply accept the default answer (press ENTER) when [no] is
      given, unless you know what you are doing.

Q: Do you want to append "session.sid_bits_per_character" with value "5" at the end of the [Session]  section?
   Make your choice: ([y]es or [n]o) [no]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/cli/php.ini with /etc/php/8.1/cli/php.ini .
 - Directive "session.sid_length" with value "26" not found in /etc/php/8.4/cli/php.ini
   the value defaults to "32"
   this is the changelog of this directive:
   - "Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0"
 TIP: consider to  not  integrate this directive into the new config if it got marked as deprecated as off the
      new version.
NOTE: The default answer here is [no]. You can simply accept the default answer (press ENTER) when [no] is
      given, unless you know what you are doing.

Q: Do you want to append "session.sid_length" with value "26" at the end of the [Session]  section?
   Make your choice: ([y]es or [n]o) [no]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/cli/php.ini with /etc/php/8.1/cli/php.ini .

 = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Q: Do you want to migrate the values for the FastCGI Process Manager SAPI from the php.ini for php8.1-fpm into
   the corresponding php.ini for php8.4-fpm?
   Make your choice: ([y]es or [n]o) [yes]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "max_execution_time" is "3500" in the php.ini of php8.1-fpm in the php.ini of php8.4-fpm it
   is "30"
   the value defaults to "30"

Q: Do you want to set "max_execution_time" to "3500"? ([y]es or [n]o) [yes]:
R: Changed max_execution_time from "30" to "3500"
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "max_input_time" is "3600" in the php.ini of php8.1-fpm in the php.ini of php8.4-fpm it is
   "60"
   the value defaults to "-1"

Q: Do you want to set "max_input_time" to "3600"? ([y]es or [n]o) [yes]:
R: Changed max_input_time from "60" to "3600"
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "memory_limit" is "2048M" in the php.ini of php8.1-fpm in the php.ini of php8.4-fpm it is
   "128M"
   the value defaults to "128M"

Q: Do you want to set "memory_limit" to "2048M"? ([y]es or [n]o) [yes]:
R: Changed memory_limit from "128M" to "2048M"
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "error_reporting" is "E_ALL & ~E_DEPRECATED & ~E_STRICT" in the php.ini of php8.1-fpm in the
   php.ini of php8.4-fpm it is "E_ALL & ~E_DEPRECATED"
   the value defaults to "NULL"
I: The directive "error_reporting" will not be changed by this script for the moment. If you want to set this
   directive to a specific value for the FastCGI Process Manager SAPI, you will have to edit the file
   /etc/php/8.4/fpm/php.ini with an editor of your choice.
   Refer to https://www.php.net/manual/errorfunc.configuration.php#ini.error_reporting for further information
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "post_max_size" is "5000M" in the php.ini of php8.1-fpm in the php.ini of php8.4-fpm it is
   "8M"
   the value defaults to "8M"

Q: Do you want to set "post_max_size" to "5000M"? ([y]es or [n]o) [yes]:
R: Changed post_max_size from "8M" to "5000M"
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 \  . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "upload_max_filesize" is "5000M" in the php.ini of php8.1-fpm in the php.ini of php8.4-fpm it
   is "2M"
   the value defaults to "2M"

Q: Do you want to set "upload_max_filesize" to "5000M"? ([y]es or [n]o) [yes]:
R: Changed upload_max_filesize from "2M" to "5000M"
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "date.timezone" is "Europe/Berlin" in the php.ini of php8.1-fpm and is not set in the php.ini
   of php8.4-fpm
   the value defaults to "UTC"
   this is the changelog of this directive:
   - "From PHP 8.2, a warning is emitted when setting this to an invalid value or an empty string"

Q: Do you want to assign "Europe/Berlin" to "date.timezone"? ([y]es or [n]o) [yes]:
R: Added "date.timezone = Europe/Berlin" after line 971 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - Directive "mysqli.reconnect" with value "Off" not found in /etc/php/8.4/fpm/php.ini
   the value defaults to "0"
   this is the changelog of this directive:
   - "Removed as of PHP 8.2.0"
 Tip: do  not  integrate this directive into the new config if it got removed as off the new version.
NOTE: The default answer here is [no]. You should always accept the default answer (press ENTER) when [no] is
      given, unless you are absolutely sure what you are doing.

Q: Do you want to append "mysqli.reconnect" with value "Off" at the end of the [MySQLi]  section?
   Make your choice: ([y]es or [n]o) [no]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "opcache.enable" is set to "1" in the php.ini of php8.1-fpm but it is commented out in the
   php.ini of php8.4-fpm
   the value defaults to "1"

Q: Do you want to uncomment the line "opcache.enable=1" in the new php.ini as well? ([y]es or [n]o) [yes]:
R: Uncommented directive "opcache.enable = 1" at line 1677 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "opcache.interned_strings_buffer" is "24" in the php.ini of php8.1-fpm and is not set in the
   php.ini of php8.4-fpm
   the value defaults to "8"

Q: Do you want to assign "24" to "opcache.interned_strings_buffer"? ([y]es or [n]o) [yes]:
R: Added "opcache.interned_strings_buffer = 24" after line 1686 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "opcache.max_accelerated_files" is set to "10000" in the php.ini of php8.1-fpm but it is
   commented out in the php.ini of php8.4-fpm
   the value defaults to "10000"

Q: Do you want to uncomment the line "opcache.max_accelerated_files=10000" in the new php.ini as well?
   Make your choice: ([y]es or [n]o) [yes]:
R: Uncommented directive "opcache.max_accelerated_files = 10000" at line 1691 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "opcache.memory_consumption" is "256" in the php.ini of php8.1-fpm and is not set in the
   php.ini of php8.4-fpm
   the value defaults to "128"

Q: Do you want to assign "256" to "opcache.memory_consumption"? ([y]es or [n]o) [yes]:
R: Added "opcache.memory_consumption = 256" after line 1683 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "opcache.revalidate_freq" is "1" in the php.ini of php8.1-fpm and is not set in the php.ini
   of php8.4-fpm
   the value defaults to "2"

Q: Do you want to assign "1" to "opcache.revalidate_freq"? ([y]es or [n]o) [yes]:
R: Added "opcache.revalidate_freq = 1" after line 1710 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "opcache.save_comments" is set to "1" in the php.ini of php8.1-fpm but it is commented out in
   the php.ini of php8.4-fpm
   the value defaults to "1"

Q: Do you want to uncomment the line "opcache.save_comments=1" in the new php.ini as well?
   Make your choice: ([y]es or [n]o) [yes]:
R: Uncommented directive "opcache.save_comments = 1" at line 1718 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "opcache.validate_timestamps" is set to "1" in the php.ini of php8.1-fpm but it is commented
   out in the php.ini of php8.4-fpm
   the value defaults to "1"

Q: Do you want to uncomment the line "opcache.validate_timestamps=1" in the new php.ini as well?
   Make your choice: ([y]es or [n]o) [yes]:
R: Uncommented directive "opcache.validate_timestamps = 1" at line 1705 in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - Directive "session.sid_bits_per_character" with value "5" not found in /etc/php/8.4/fpm/php.ini
   the value defaults to "4"
   this is the changelog of this directive:
   - "Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0"
 TIP: consider to  not  integrate this directive into the new config if it got marked as deprecated as off the
      new version.
NOTE: The default answer here is [no]. You can simply accept the default answer (press ENTER) when [no] is
      given, unless you know what you are doing.

Q: Do you want to append "session.sid_bits_per_character" with value "5" at the end of the [Session]  section?
   Make your choice: ([y]es or [n]o) [no]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - Directive "session.sid_length" with value "26" not found in /etc/php/8.4/fpm/php.ini
   the value defaults to "32"
   this is the changelog of this directive:
   - "Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0"
 TIP: consider to  not  integrate this directive into the new config if it got marked as deprecated as off the
      new version.
NOTE: The default answer here is [no]. You can simply accept the default answer (press ENTER) when [no] is
      given, unless you know what you are doing.

Q: Do you want to append "session.sid_length" with value "26" at the end of the [Session]  section?
   Make your choice: ([y]es or [n]o) [no]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .
 - The value for "session.serialize_handler" is set to "php" in the php.ini of php8.4-fpm but it is commented
   out in the php.ini of php8.1-fpm
   the value defaults to "php"

Q: Do you want to comment out the key "session.serialize_handler" in the new php.ini as well?
   Make your choice: ([y]es or [n]o) [yes]:
R: Setting "session.serialize_handler = php" commented out in /etc/php/8.4/fpm/php.ini
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php.ini with /etc/php/8.1/fpm/php.ini .

 = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Q: Do you want to migrate the values for the IMAP module for PHP from the imap.ini for php8.1-imap into the
   corresponding imap.ini for php8.4-imap?
   Make your choice: ([y]es or [n]o) [yes]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/mods-available/imap.ini with /etc/php/8.1/mods-available/imap.ini .

 = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Q: Do you want to migrate the values for the Zend OpCache module for PHP from the opcache.ini for
   php8.1-opcache into the corresponding opcache.ini for php8.4-opcache?
   Make your choice: ([y]es or [n]o) [yes]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/mods-available/opcache.ini with /etc/php/8.1/mods-available/opcache.ini .

 = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Q: Do you want to migrate the values for the FastCGI Process Manager SAPI from the php-fpm.conf for php8.1-fpm
   into the corresponding php-fpm.conf for php8.4-fpm?
   Make your choice: ([y]es or [n]o) [yes]:
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php-fpm.conf with /etc/php/8.1/fpm/php-fpm.conf .
 - The value for "emergency_restart_interval" is "1m" in the php-fpm.conf of php8.1-fpm and is not set in the
   php-fpm.conf of php8.4-fpm
   This script could not find any information about this directive on php.net

Q: Do you want to assign "1m" to "emergency_restart_interval"? ([y]es or [n]o) [yes]:
R: Added "emergency_restart_interval = 1m" after line 76 in /etc/php/8.4/fpm/php-fpm.conf
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php-fpm.conf with /etc/php/8.1/fpm/php-fpm.conf .
 - The value for "emergency_restart_threshold" is "10" in the php-fpm.conf of php8.1-fpm and is not set in the
   php-fpm.conf of php8.4-fpm
   This script could not find any information about this directive on php.net

Q: Do you want to assign "10" to "emergency_restart_threshold"? ([y]es or [n]o) [yes]:
R: Added "emergency_restart_threshold = 10" after line 68 in /etc/php/8.4/fpm/php-fpm.conf
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php-fpm.conf with /etc/php/8.1/fpm/php-fpm.conf .
 - The value for "process_control_timeout" is "10" in the php-fpm.conf of php8.1-fpm and is not set in the
   php-fpm.conf of php8.4-fpm
   This script could not find any information about this directive on php.net

Q: Do you want to assign "10" to "process_control_timeout"? ([y]es or [n]o) [yes]:
R: Added "process_control_timeout = 10" after line 84 in /etc/php/8.4/fpm/php-fpm.conf
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . comparing /etc/php/8.4/fpm/php-fpm.conf with /etc/php/8.1/fpm/php-fpm.conf .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 - The default fpm pool [www] for php8.1-fpm is deactivated (the file /etc/php/8.1/fpm/pool.d/www.conf has
   been renamed to /etc/php/8.1/fpm/pool.d/www.conf.backup) but a custom created pool [Nextcloud] was found

Q: Do you want to migrate this pool from php8.1-fpm to php8.4-fpm? ([y]es or [n]o) [yes]:
R: Successfully moved /etc/php/8.4/fpm/pool.d/www.conf to /etc/php/8.4/fpm/pool.d/www.conf.backup
R: Successfully created poolfile /etc/php/8.4/fpm/pool.d/nextcloud.conf
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 . searching other changed files for php8.1 to be adapted into php8.4 .
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 - The migration of the settings from php-8.1 to php-8.4 is now completed, unless you have deliberately left
   out files or settings. These can be made up at any time with:

ncadmin@nas.redacted.local:~$ php-updater 8.1 8.4

 - You now can switch the php version from php-8.1 to php-8.4 for the commandline and your webserver.
   Therefore call:

ncadmin@nas.redacted.local:~$ php-updater --switch-version

  or run it now:

Q: Do you want to switch the php version now? ([y]es or [n]o) [yes]:

  ======================================================================================================================

 - Here you can switch the default php version linked to the generic /usr/bin/php with the means of the Debian
   alternatives system.
   All php related packages maintained by the alternatives system will get switched to manual mode instead of
   automatic. That will prevent php from changing its version without your dessision.
   In this step there is no test, if all required php packages to run a server like Nextcloud are present in
   the version you choose. So it is recommended to first run php-updater $old $new, where $old should be the
   version that you know exactly that everything has been installed correctly and $new should be the version
   that you want to switch to here and now.

   this is how the alternatives system is configured at present:

    - phar                           manual   /usr/bin/phar8.1
    - phar.phar                      manual   /usr/bin/phar.phar8.1
    - php                            manual   /usr/bin/php8.1
    - php-config                     manual   /usr/bin/php-config8.1
    - php-fpm.sock                   auto     /run/php/php8.4-fpm.sock
    - phpize                         manual   /usr/bin/phpize8.1

  ======================================================================================================================

 - In the subsequent next step it will switch the webservers to connect to the new php version as well.
   However, in some rare special cases, this step may fail though. In such a case you will have to edit the
   web server's configuration files yourself to connect it to the PHP socket of your choice.

   this is how php is connected to the httpd at present:

 - php8.1-fpm
     `-listening on unix socket /run/php/php8.1-fpm.nextcloud.sock <CONNECTED> apache2
 - php8.4-fpm
     `-listening on unix socket /run/php/php8.4-fpm.nextcloud.sock <<NOT CONNECTED

  ======================================================================================================================

 - Switch the default alternatives version for php to:

          [1] - php8.1 supported by Nextcloud version 24, 25, 26, 27, 28, 29, 30, 31 and 32


          [2] - php8.4 supported by Nextcloud version 31, 32 and 33


          [q] - do nothing, quit

 - Please make your choice:

        You selected option [2] Is this correct?

Confirm your choice: [ y ] for yes, [ n ] for no, [q] to quit

 - Confirmed choice [2]: php8.4
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
   alternatives system is now switched to:

    - phar                           manual   /usr/bin/phar8.4
    - phar.phar                      manual   /usr/bin/phar.phar8.4
    - php                            manual   /usr/bin/php8.4
    - php-config                     manual   /usr/bin/php-config8.4
    - phpize                         manual   /usr/bin/phpize8.4

   Please consider: if some alternatives listed here are not switched to the selected version, then either the
   package that provides the binaries for that version is not installed or – in case of php-fpm.sock – the
   default fpm-pool [www] has been deactivated in the selected version but not in the version that it shows
   here.

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
I: Detected httpd (webserver): apache2 (status active)
I: Successfully switched the SetHandler FastCGI configuration in apache2 from PHP-FPM version 8.1 to 8.4

 . . .  searching for other configuration files that may have to be switched . . .

   I:  These are systemwide the configured fpm pools:

    - 8.1 [Nextcloud]
    - 8.4 [Nextcloud]

   I:  This is the only fpm pool configured for the version you selected:

    - 8.4 [Nextcloud]

   Processing pool: [Nextcloud]...

   I: The apache2 server is connected to a PHP-FPM unix-socket, bypassing the usual SetHandler configuration
      mechanism.

    - this is the old socket: /run/php/php8.1-fpm.nextcloud.sock
    - this is the new socket: /run/php/php8.4-fpm.nextcloud.sock

 - These are the PHP-FPM socket configurations:

Configfile: /etc/apache2/sites-enabled/adminer.conf -> /etc/apache2/sites-available/adminer.conf
Unix socket: /run/php/php8.1-fpm.nextcloud.sock|fcgi://localhost"
Line-Nr. 33:     <FilesMatch "\.php$">
Line-Nr. 34:         SetHandler "proxy:unix:/run/php/php8.1-fpm.nextcloud.sock|fcgi://localhost"
Line-Nr. 35:     </FilesMatch>

Configfile: /etc/apache2/sites-enabled/nas.redacted.local.conf -> /etc/apache2/sites-available/nas.redacted.local.conf
Unix socket: /run/php/php8.1-fpm.nextcloud.sock|fcgi://localhost"
Line-Nr. 13:     <FilesMatch "\.php$">
Line-Nr. 14:         SetHandler "proxy:unix:/run/php/php8.1-fpm.nextcloud.sock|fcgi://localhost"
Line-Nr. 15:     </FilesMatch>

    IMPORTANT:  A backup-file /etc/apache2/sites-available/adminer.conf.backup was created with the previous
                state. Don't forget to remove that file if everything runs fine.
    IMPORTANT:  A backup-file /etc/apache2/sites-available/nas.redacted.local.conf.backup was created with the
                previous state. Don't forget to remove that file if everything runs fine.

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

   This is how php is connected to the httpd now:

 - php8.1-fpm
     `-listening on unix socket /run/php/php8.1-fpm.nextcloud.sock <<NOT CONNECTED
 - php8.4-fpm
     `-listening on unix socket /run/php/php8.4-fpm.nextcloud.sock <CONNECTED> apache2

  ======================================================================================================================

   You can allways run

ncadmin@nas.redacted.local:~$ php-updater --list-installed

   .. again, to scan once more for possible configuration errors. The script is constantly updated and often
   new tests are added.
   If everything looks good and is working well, you should strongly consider to completely remove unused old
   php versions, to free up system resources.
   To completely remove a php version php$old (eg. php8.0) from your server, run

ncadmin@nas.redacted.local:~$ sudo apt-get purge '*php8.0*'

   .. (where, as said, the 8.0 here is just as an example placeholder)

   NOTE: The single quotes are important here, to prevent globing.

  ======================================================================================================================



________________________________________________________________________________________________________________________

                       This is how YOU can contribute

 * If your problem has [ NOT ] been resolved with this script:

       Please open an issue at https://github.com/ernolf/ebtb/issues and
       describe what you expected and where that expectation was not met.
       Your feedback is invaluable and helps improve the project for everyone.

 * If you've found value in this work, please consider supporting its continued
   development. Your contribution, whether through a donation or other means,
   helps keep this service available and evolving.

   .;mmmmn;,       you can
   XMMMMMMMMW0c           … buy me a coffee:
  'MMMMMMMMMMMM;   Paypal:
  dMMMMMMMMMMMW'd   @ernolf https://paypal.me/ernolf use Family & Friends option
  NMMMMMMMMMMX:0M;
 ,MMMNkxxxxxdxWMN.        … become a sponsor:
 xMMM;0MMMMMMMWx.
 WMMW.MMMX;,'.     Github Sponsors:
:000ooMMMc          @ernolf https://github.com/sponsors/ernolf
     x00O.
                          … transfer crypto:
      )
     ( (           Bitcoin: bc1qwlcqc7zsak45vwqk0dt7hnxlrta7syzstgf7t8
      ) )
   ........        Ethereum, BNB Smart Chain, Polygon:
   |      |]                0x72b7901b3daa45a7266A77Aa3B3552aB686d0D0D
   \°     /
    `----'         Solana:  E7e13hBB7rmhY2N1MqAY88TKobBktJA7rSpTZWAPec6Y

 * Don't want to spend money? you can
  … spread the word e.g. via a blog post or on social media
  … leave some love (a ❤️, 🙏, 👍 or other emoji and/or interaction) on
    https://help.nextcloud.com/t/php-updater-a-script-to-upgrade-php-in-a-safe-way/180215
  … rating the project ★★ on https://github.com/ernolf/ebtb
  … or in any way you see fit!

  much love, peace and good luck!
  yours truely,         _  __
   ___ _ __ _ __   ___ | |/ _|
  / _ \ '__| '_ \ / _ \| | |_
 (  __/ |  | | | | (_) | |  _|
  \___|_|  |_| |_|\___/|_|_|

________________________________________________________________________________________________________________________

Do you already know the ebtb bash scripts for nextcloud admins?

Here a selection. Simply select the script you want to test:


  installed  php-updater             update PHP on your ubuntu/debian based server and switch back and forth
                                     between versions without much hassle

     [ 2 ] - nc-who                  follow live on the command line who is logged in on your nextcloud
                                     server, with a “GOD MODE” to selectively unvalidate cookies

     [ 3 ] - nc-sql                  commandline client for the nextcloud MySQL/MariaDB or PostgreSQL database

     [ 4 ] - nc-occ                  interactively create and execute OCC commands with favorites for your
                                     most used occ commands

     [ 5 ] - nc-apps                 (not only) an appstore browser/client for the commandline

     [ 6 ] - nc-shares               list shares with lots of information and selection options

     [ 7 ] - nc-integrity-fix        resolve “Some files have not passed the integrity check” warnings

     [ 8 ] - nc-mimecheck            check for files without or with wrong file extension. For use with “Flow
                                     external script”

     [ 9 ] - nc-subscribed-calendar  gives you the means to set an individual refreshrate per subscribed
                                     calendar

     [ q ] - quit


Please make your choice:
exiting php-updater script.
the janitor can provide extensive system informations and more. simply run: janitor
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$ php -v
PHP 8.4.18 (cli) (built: Feb 13 2026 15:59:43) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.18, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.18, Copyright (c), by Zend Technologies
ncadmin@nas:/usr/local/bin$
ncadmin@nas:/usr/local/bin$
 

Proxmox Update 8 to 9 does not boot anymore - black screen

Problem

After I updated my Asus/Intel NUC from proxmox v8.4.14 to 9.1.6, it did not boot anymore. I followed the instructions of https://pve.proxmox.com/wiki/Upgrade_from_8_to_9 and used the update checker tool:
  1. Update checker with pve8to9 
    --> all green ✅
  2. Updated from 8.4.14 to 9.1.6 complete using this 
    --> GUI & CLI showed new version ✅
    --> VMs and Containers continued to run normally ✅
  3. Reboot 
    --> does not boot anymore ❌
  4. BIOS Update of the Asus/Intel NUC did not help ❌


Solution

I found Dustin Rues awesome blog entry: https://dustinrue.com/2025/12/recovering-from-a-failed-proxmox-upgrade/

1. Boot from live linux via USB stick (in my case linux mint)

2. In the live linux terminal, run the following commands:

mount /dev/mapper/pve-root /mnt
mount /dev/sda2 /mnt/boot/efi
mount --bind /dev /mnt/dev
mount --bind /sys /mnt/sys
mount --bind /proc /mnt/proc
mount --bind /dev/pts /mnt/dev/pts
chroot /mnt
mount -t efivarfs efivarfs /sys/firmware/efi/efivars
grub-install --target x86_64-efi --no-floppy --bootloader-id proxmox /dev/sda
grub-install --target x86_64-efi --no-floppy --bootloader-id proxmox --removable /dev/sda
echo 'grub-efi-amd64 grub2/force_efi_extra_removable boolean true' | debconf-set-selections -v -u
apt install --reinstall grub-efi-amd64
update-initramfs -u -k all

Once this finished I did the following

umount /mnt/dev/pts
umount /mnt/proc
umount /mnt/dev
umount /mnt/sys/firmware/efi/efivars
umount /mnt/sys
umount /mnt/boot/efi
umount /mnt/
reboot

Example

root@mint:~#
root@mint:~#
root@mint:~# mount /dev/mapper/pve-root /mnt
root@mint:~# mount /dev/sda2 /mnt/boot/efi/
root@mint:~# mount --bind /dev /mnt/dev
root@mint:~# mount --bind /sys /mnt/sys
root@mint:~# mount --bind /proc /mnt/proc
root@mint:~# mount --bind /dev/pts /mnt/dev/pts
root@mint:~#
root@mint:~# chroot /mnt
root@mint:/#
root@mint:/# mount -t efivarfs efivarfs /sys/firmware/efi/efivars/
root@mint:/#
root@mint:/# grub-install --target x86_64-efi --no-floppy --bootloader-id proxmox /dev/sda
Installing for x86_64-efi platform.
Installation finished. No error reported.
root@mint:/#
root@mint:/# grub-install --target x86_64-efi --no-floppy --bootloader-id proxmox --removable /dev/sda
Installing for x86_64-efi platform.
Installation finished. No error reported.
root@mint:/#
root@mint:/#
root@mint:/# echo 'grub-efi-amd64 grub2/force_efi_extra_removable boolean true' | debconf-set-selections -v -u
info: Trying to set 'grub2/force_efi_extra_removable' [boolean] to 'true'
info: Loading answer for 'grub2/force_efi_extra_removable'
root@mint:/#
root@mint:/# apt install --reinstall grub-efi-amd64
The following packages were automatically installed and are no longer required:
  bsdmainutils                    libdav1d6               libllvm15               libpython3.9-stdlib  perl-modules-5.32                   python3-soupsieve
  gcc-12-base                     libdns-export1110       libmpdec3               librav1e0            perl-modules-5.36                   python3-talloc
  libabsl20220623                 libdrm-nouveau2         libnsl-dev              libsubid4            proxmox-kernel-6.8.12-1-pve-signed  python3-tempita
  libapt-pkg6.0                   libdrm-radeon1          libnumber-compare-perl  libsvtav1enc1        pve-kernel-5.15                     python3-tz
  libavif15                       libfile-find-rule-perl  libopts25               libtext-glob-perl    pve-kernel-5.15.126-1-pve           python3-waitress
  libboost-context1.74.0          libflac12               libperl5.32             libthrift-0.17.0     pve-kernel-5.15.158-2-pve           python3-webtest
  libboost-coroutine1.74.0        libfmt9                 libperl5.36             libtiff5             python3-bs4                         python3.11
  libboost-filesystem1.74.0       libglusterd0            libprocps8              libtirpc-dev         python3-jaraco.classes              python3.11-minimal
  libboost-iostreams1.74.0        libicu67                libprotobuf23           liburing1            python3-ldb                         python3.9
  libboost-program-options1.74.0  libicu72                libpython3.11           libwebp6             python3-paste                       python3.9-minimal
  libboost-thread1.74.0           libisc-export1105       libpython3.11-minimal   libx265-199          python3-pastedeploy                 sgml-base
  libbpf0                         libjs-sencha-touch      libpython3.11-stdlib    libxcb-dri2-0        python3-pastedeploy-tpl             telnet
  libcbor0                        libldap-2.5-0           libpython3.9            libzpool5linux       python3-pytz                        usrmerge
  libcbor0.8                      libleveldb1d            libpython3.9-minimal    lua-lpeg             python3-singledispatch
Use 'apt autoremove' to remove them.

Installing:
  grub-efi-amd64

REMOVING:
  grub-pc

Summary:
  Upgrading: 0, Installing: 1, Removing: 1, Not Upgrading: 0
  Download size: 46.7 kB
  Freed space: 349 kB

Continue? [Y/n]
Get:1 http://download.proxmox.com/debian/pve trixie/pve-no-subscription amd64 grub-efi-amd64 amd64 2.12-9+pmx2 [46.7 kB]
Fetched 46.7 kB in 0s (398 kB/s)          
Preconfiguring packages ...
(Reading database ... 119801 files and directories currently installed.)
Removing grub-pc (2.12-9+pmx2) ...
Selecting previously unselected package grub-efi-amd64.
(Reading database ... 119792 files and directories currently installed.)
Preparing to unpack .../grub-efi-amd64_2.12-9+pmx2_amd64.deb ...
Unpacking grub-efi-amd64 (2.12-9+pmx2) ...
Setting up grub-efi-amd64 (2.12-9+pmx2) ...
Installing for x86_64-efi platform.
File descriptor 3 (pipe:[43286]) leaked on vgs invocation. Parent PID 3806: grub-install.real
File descriptor 3 (pipe:[43286]) leaked on vgs invocation. Parent PID 3806: grub-install.real
Installation finished. No error reported.
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-6.17.13-1-pve
Found initrd image: /boot/initrd.img-6.17.13-1-pve
Found linux image: /boot/vmlinuz-6.8.12-17-pve
Found initrd image: /boot/initrd.img-6.8.12-17-pve
Found linux image: /boot/vmlinuz-6.8.12-1-pve
Found initrd image: /boot/initrd.img-6.8.12-1-pve
Found linux image: /boot/vmlinuz-5.15.158-2-pve
Found initrd image: /boot/initrd.img-5.15.158-2-pve
Found linux image: /boot/vmlinuz-5.15.126-1-pve
Found initrd image: /boot/initrd.img-5.15.126-1-pve
Found linux image: /boot/vmlinuz-5.4.203-1-pve
Found initrd image: /boot/initrd.img-5.4.203-1-pve
Found linux image: /boot/vmlinuz-5.4.73-1-pve
Found initrd image: /boot/initrd.img-5.4.73-1-pve
Found memtest86+ 64bit EFI image: /boot/memtest86+x64.efi
Found memtest86+ 32bit EFI image: /boot/memtest86+ia32.efi
Found memtest86+ 64bit image: /boot/memtest86+x64.bin
Found memtest86+ 32bit image: /boot/memtest86+ia32.bin
Warning: os-prober will not be executed to detect other bootable partitions.
Systems on them will not be added to the GRUB boot configuration.
Check GRUB_DISABLE_OS_PROBER documentation entry.
Adding boot menu entry for UEFI Firmware Settings ...
done
Processing triggers for man-db (2.13.1-1) ...
root@mint:/#
root@mint:/#
root@mint:/# 
root@mint:/# 
root@mint:/# 
root@mint:/# 
root@mint:/# update-initramfs -u -k all
update-initramfs: Generating /boot/initrd.img-6.17.13-1-pve
Running hook script 'zz-proxmox-boot'..
Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount namespace..
No /etc/kernel/proxmox-boot-uuids found, skipping ESP sync.
update-initramfs: Generating /boot/initrd.img-6.8.12-17-pve
Running hook script 'zz-proxmox-boot'..
Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount namespace..
No /etc/kernel/proxmox-boot-uuids found, skipping ESP sync.
update-initramfs: Generating /boot/initrd.img-6.8.12-1-pve
Running hook script 'zz-proxmox-boot'..
Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount namespace..
No /etc/kernel/proxmox-boot-uuids found, skipping ESP sync.
update-initramfs: Generating /boot/initrd.img-5.15.158-2-pve
Running hook script 'zz-proxmox-boot'..
Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount namespace..
No /etc/kernel/proxmox-boot-uuids found, skipping ESP sync.
update-initramfs: Generating /boot/initrd.img-5.15.126-1-pve
Running hook script 'zz-proxmox-boot'..
Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount namespace..
No /etc/kernel/proxmox-boot-uuids found, skipping ESP sync.
update-initramfs: Generating /boot/initrd.img-5.4.203-1-pve
W: zstd compression (CONFIG_RD_ZSTD) not supported by kernel, using gzip
Running hook script 'zz-proxmox-boot'..
Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount namespace..
No /etc/kernel/proxmox-boot-uuids found, skipping ESP sync.
update-initramfs: Generating /boot/initrd.img-5.4.73-1-pve
W: zstd compression (CONFIG_RD_ZSTD) not supported by kernel, using gzip
Running hook script 'zz-proxmox-boot'..
Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount namespace..
No /etc/kernel/proxmox-boot-uuids found, skipping ESP sync.
root@mint:/#
root@mint:/#
root@mint:/#
root@mint:/# exit
exit
root@mint:~#
root@mint:~# ls /mnt
bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
root@mint:~#
root@mint:~# umount /mnt/dev/pts
root@mint:~# umount /mnt/proc
root@mint:~# umount /mnt/dev
root@mint:~# umount /mnt/sys/firmware/efi/efivars
root@mint:~# umount /mnt/sys
root@mint:~# umount /mnt/boot/efi
root@mint:~# umount /mnt/
root@mint:~#
root@mint:~# reboot



Azure Linux Ubuntu not fully upgraded

Using apt-get update && apt-get upgrade -y on your Ubuntu VM in Azure sometimes does not upgrade all packages:

root@hostname6:~#
root@hostname6:~#
root@hostname6:~# apt-get update && apt-get upgrade -y
Hit:1 https://packages.microsoft.com/ubuntu/22.04/prod jammy InRelease
Hit:2 http://azure.archive.ubuntu.com/ubuntu jammy InRelease
Hit:3 http://azure.archive.ubuntu.com/ubuntu jammy-updates InRelease
Hit:4 http://azure.archive.ubuntu.com/ubuntu jammy-backports InRelease
Hit:5 http://azure.archive.ubuntu.com/ubuntu jammy-security InRelease
Reading package lists... Done
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
libnss-systemd libpam-systemd libsystemd0 libudev1 linux-azure linux-cloud-tools-azure linux-headers-azure linux-image-azure linux-tools-azure
systemd systemd-sysv udev
0 upgraded, 0 newly installed, 0 to remove and 12 not upgraded.
root@hostname6:~#


Solution

sudo apt-get install aptitude -y
sudo aptitude safe-upgrade

aptitude safe-upgrade
Upgrades installed packages to their most recent version. Installed packages will not be removed unless they are unused [...] Packages which are not currently installed may be installed to resolve dependencies unless the --no-new-installs command-line option is supplied.


Example

root@hostname6:~#
root@hostname6:~# sudo aptitude safe-upgrade
Resolving dependencies...
The following NEW packages will be installed:
linux-azure-6.8-cloud-tools-6.8.0-1041{a} linux-azure-6.8-headers-6.8.0-1041{a} linux-azure-6.8-tools-6.8.0-1041{a}
linux-cloud-tools-6.8.0-1041-azure{a} linux-headers-6.8.0-1041-azure{a} linux-image-6.8.0-1041-azure{a} linux-modules-6.8.0-1041-azure{a}
linux-tools-6.8.0-1041-azure{a}
The following packages will be upgraded:
libnss-systemd libpam-systemd libsystemd0 libudev1 linux-azure linux-cloud-tools-azure linux-headers-azure linux-image-azure linux-tools-azure
systemd systemd-sysv udev
12 packages upgraded, 8 newly installed, 0 to remove and 0 not upgraded.
Need to get 67.2 MB of archives. After unpacking 269 MB will be used.
Do you want to continue? [Y/n/?]

[..]
Current status: 0 (-12) upgradable.
root@hostname6:~#
root@hostname6:~# apt-get update
Hit:1 http://azure.archive.ubuntu.com/ubuntu jammy InRelease
Hit:2 http://azure.archive.ubuntu.com/ubuntu jammy-updates InRelease
Hit:3 http://azure.archive.ubuntu.com/ubuntu jammy-backports InRelease
Hit:4 http://azure.archive.ubuntu.com/ubuntu jammy-security InRelease
Hit:5 https://packages.microsoft.com/ubuntu/22.04/prod jammy InRelease
Reading package lists... Done
root@hostname6:~#
root@hostname6:~# apt-get upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@hostname6:~#
root@hostname6:~#

Disabled Transparent Huge Pages with created systemd service

In some applications (e.g. Splunk) you need to disable Transparent Huge Pages THP

When your systems are running in a managed environment (e.g. the public cloud - like Microsoft Azure) with cloud images (like "0001-com-ubuntu-server-jammy" or "0001-com-ubuntu-confidential-vm-jammy" (both Ubuntu22.04 LTS)), you may not be able to use the GRUB Edit to disable THP, because the cloud image ignores the GRUB edits. A possible solution can be a custom systemd service:

Example Disable Transparent Huge Pages once (not reboot-persistent💢):

user@devazubu227:~$
user@devazubu227:~$
user@devazubu227:~$ sudo cat /sys/kernel/mm/transparent_hugepage/enabled
[always] madvise never
user@devazubu227:~$
user@devazubu227:~$
user@devazubu227:~$ echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
never
user@devazubu227:~$
user@devazubu227:~$ sudo cat /sys/kernel/mm/transparent_hugepage/enabled
always madvise [never]
user@devazubu227:~$



Example Disable Transparent Huge Pages with custom systemd service (reboot-persistent ✅):


Commands:

sudo tee /etc/systemd/system/disable-thp.service > /dev/null <<EOF
[Unit]
Description=Disable Transparent Huge Pages
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash -c "echo never > /sys/kernel/mm/transparent_hugepage/enabled && echo never > /sys/kernel/mm/transparent_hugepage/defrag"

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable disable-thp
sudo systemctl start disable-thp
sudo systemctl status disable-thp
cat /sys/kernel/mm/transparent_hugepage/enabled
cat /sys/kernel/mm/transparent_hugepage/defrag



Example

user@devazubu227:~$
user@devazubu227:~$
user@devazubu227:~$ sudo tee /etc/systemd/system/disable-thp.service > /dev/null <<EOF
[Unit]
Description=Disable Transparent Huge Pages
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash -c "echo never > /sys/kernel/mm/transparent_hugepage/enabled && echo never > /sys/kernel/mm/transparent_hugepage/defrag"

[Install]
WantedBy=multi-user.target
EOF
user@devazubu227:~$
user@devazubu227:~$ cat /etc/systemd/system/disable-thp.service
[Unit]
Description=Disable Transparent Huge Pages
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash -c "echo never > /sys/kernel/mm/transparent_hugepage/enabled && echo never > /sys/kernel/mm/transparent_hugepage/defrag"

[Install]
WantedBy=multi-user.target
user@devazubu227:~$
user@devazubu227:~$
user@devazubu227:~$ sudo systemctl daemon-reexec
user@devazubu227:~$ sudo systemctl daemon-reload
user@devazubu227:~$ sudo systemctl enable disable-thp
Created symlink /etc/systemd/system/multi-user.target.wants/disable-thp.service → /etc/systemd/system/disable-thp.service.
user@devazubu227:~$ sudo systemctl start disable-thp

user@devazubu227:~$ sudo systemctl status disable-thp
○ disable-thp.service - Disable Transparent Huge Pages
Loaded: loaded (/etc/systemd/system/disable-thp.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Thu 2025-08-07 11:01:42 UTC; 11s ago
Process: 4394 ExecStart=/bin/bash -c echo never > /sys/kernel/mm/transparent_hugepage/enabled && echo never > /sys/kernel/mm/transparent_hugepage/defra>
Main PID: 4394 (code=exited, status=0/SUCCESS)
CPU: 2ms

Aug 07 11:01:42 devazubu227 systemd[1]: Started Disable Transparent Huge Pages.
Aug 07 11:01:42 devazubu227 systemd[1]: disable-thp.service: Deactivated successfully.
user@devazubu227:~$
user@devazubu227:~$
user@devazubu227:~$ cat /sys/kernel/mm/transparent_hugepage/enabled
always madvise [never]
user@devazubu227:~$
user@devazubu227:~$ cat /sys/kernel/mm/transparent_hugepage/defrag
always defer defer+madvise madvise [never]
user@devazubu227:~$
user@devazubu227:~$

Surface 2 Pro Install Linux Ubuntu 24.04 LTS

Windows 10 support ended. Microsoft Surface 2 Pro devices can't officially be updated to Windows 11. This guide shows how to switch to Linux Ubuntu 24.04 LTS instead:

Installation steps 

  1. Download Rufus https://github.com/pbatard/rufus
  2. Download Linux, e.g. Ubuntu 24 https://ubuntu.com/download/desktop
  3. Format USB stick with Rufus
    - Select the USB stick (all files on it will be erased)
    - Select image file
    - Select MBR
    - Select BIOS or UEFI
    - Select Fix for older BIOSe
    - Select FAT32
    - Press Start
    Rufus Linux Ubuntu 24 USB bootable stick

  4. Shutdown Surface 2 device
  5. Hold Volume-Up & hold Home-Button until Surface logo appears
  6. Disable Secure Boot --> Red background around Surface logo on boot
  7. Shutdown Surface 2 device
  8. Insert USB Stick into Surface 2
  9. Hold Volume-Down & press Home-Button until Surface logo appears 
  10. Select Install Ubuntu in GRUB loader 
  11. Optional: For additional security (using encryption@rest) use lvm with encryption and use a long unique passphrase. 

Result 


Other Microsoft Surface devices might use: https://github.com/linux-surface/linux-surface/wiki/Installation-and-Setup
 

Powershell Website "Ping" using the winsystems web proxy

If you want to monitor/check (every 10s) continuesly if a website (in this exampe http://www.google.de) is reachable using powershell and also using the configured webproxy in your windows system, then you can use the following example:


while ($true) {
    $webClient = New-Object System.Net.WebClient
    $proxy = [System.Net.WebRequest]::GetSystemWebProxy()
    $proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
    $webClient.Proxy = $proxy

    $proxyUri = $proxy.GetProxy([System.Uri]::new("http://www.google.de"))
    $proxyIp = $proxyUri.Host
    $proxyPort = $proxyUri.Port

    $startTime = Get-Date
    try {
        $response = $webClient.DownloadString("http://www.google.de")
        $endTime = Get-Date
        $latency = ($endTime - $startTime).TotalMilliseconds
        $statusCode = 200 # WebClient doesn't expose status code directly, assuming success here
        Write-Output "[$startTime] Latency: ${latency}ms, HTTP Status Code: $statusCode, Proxy:         $proxyIp :$proxyPort"
    } catch {
        $endTime = Get-Date
        $latency = ($endTime - $startTime).TotalMilliseconds
        $errorMessage = $_.Exception.Message
        Write-Output "[$startTime] Latency: ${latency}ms, Error: $errorMessage, Proxy: $proxyIp :$proxyPort"
    }

Start-Sleep -Seconds 10
}


powershell "ping" of website using proxy


Ansible Remote Shell Examples

To execute remote commands or get access to a remote server using ansible, you can do:

source =prdeu4spl002 
destination = prdus1ans105 
auth = ssh-keys already installed (not part of the example)
command1 = pwd
command2 = ls -lah
command3 = /usr/local/sbin/schedule-downtime -s "now" -d 1 -r "Test Downtime"

Example


[spluser@prdeu4spl002 ansible]$
[spluser@prdeu4spl002 ansible]$
[spluser@prdeu4spl002 ansible]$ ansible all -i ,prdus1ans105 -b -m shell -a 'pwd'
prdus1ans105 | CHANGED | rc=0 >>
/home/spluser
[spluser@prdeu4spl002 ansible]$
[spluser@prdeu4spl002 ansible]$ ansible all -i ,prdus1ans105 -b -m shell -a 'ls -lah'
prdus1ans105 | CHANGED | rc=0 >>
total 16K
drwx------. 5 spluser spluser 130 Jul 25 2024 .
drwxr-xr-x. 12 root root 183 May 8 15:20 ..
drwx------ 3 spluser spluser 17 Jun 25 2024 .ansible
-rw------- 1 spluser spluser 182 Jun 4 12:55 .bash_history
-rw-r--r--. 1 spluser spluser 18 Jun 20 2022 .bash_logout
-rw-r--r--. 1 spluser spluser 141 Jun 20 2022 .bash_profile
-rw-r--r--. 1 spluser spluser 376 Jun 20 2022 .bashrc
drwxr-x--- 5 spluser spluser 39 Jun 25 2024 .puppetlabs
drwx------. 2 spluser spluser 29 Jun 25 2024 .ssh
[spluser@prdeu4spl002 ansible]$
[spluser@prdeu4spl002 ansible]$
[spluser@prdeu4spl002 ansible]$ ansible all -i ,prdus1ans105 -b -m shell -a '/usr/local/sbin/schedule-downtime -s "now" -d 1 -r "Test Downtime"'
prdus1ans105 | CHANGED | rc=0 >>

Now scheduling a downtime from 14:59:02 until 15:00:02 for prdus1ans105 in Mon01 and nIcinga because of "Test Downtime" on behalf of user ROOT.

contacting the Mon01 satellite REST API...
OK

contacting the nIcinga REST API...
OK
[spluser@prdeu4spl002 ansible]$
[spluser@prdeu4spl002 ansible]$



Add a CA certificate to GitLab running in a podman container

Adding a CA certificate to GitLab which is running in a podman container (also works with docker containers, just replace podman with docker):

  1. Login to the podman container 
  2. Copy/install the CA certificates (in this case Digi-Issuing-CA01-G3.pem & Digi-Root-CA01-G3.pem)
  3. Restart the podman container

Example

euprdgitlab655:~ #
euprdgitlab655:~ # podman exec -it gitlab /bin/bash
root@ad24f5df0102:/#
root@ad24f5df0102:/#
root@ad24f5df0102:/# ls /etc/gitlab/
gitlab-secrets.json gitlab.rb ssh_host_ecdsa_key ssh_host_ecdsa_key.pub ssh_host_ed25519_key ssh_host_ed25519_key.pub ssh_host_rsa_key ssh_host_rsa_key.pub ssl trusted-certs
root@ad24f5df0102:/#
root@ad24f5df0102:/# ls /etc/gitlab/trusted-certs/
07ac5923.0 Digi-Issuing-CA01-G2.pem Digi-Root-CA-G2.pem e0c0effb.0
root@ad24f5df0102:/#
root@ad24f5df0102:/# ls -lah /etc/gitlab/trusted-certs/
total 8.0K
drwxr-xr-x 2 root root 101 Mar 27 12:44 .
drwxrwxr-x 4 root root 250 Oct 15 2024 ..
lrwxrwxrwx 1 root root 19 Mar 27 12:44 07ac5923.0 -> Digi-Root-CA-G2.pem
-rw-r--r-- 1 root root 2.6K Sep 14 2021 Digi-Issuing-CA01-G2.pem
-rw-r--r-- 1 root root 2.3K Sep 14 2021 Digi-Root-CA-G2.pem
lrwxrwxrwx 1 root root 24 Mar 27 12:44 e0c0effb.0 -> Digi-Issuing-CA01-G2.pem
root@ad24f5df0102:/#
root@ad24f5df0102:/#
root@ad24f5df0102:/# vi /etc/gitlab/trusted-certs/Digi-Root-CA-G3.pem
root@ad24f5df0102:/# vi /etc/gitlab/trusted-certs/Digi-Issuing-CA-G3.pem
root@ad24f5df0102:/#
root@ad24f5df0102:/# ls -lah /etc/gitlab/trusted-certs/
total 16K
drwxr-xr-x 2 root root 158 Jul 14 10:16 .
drwxrwxr-x 4 root root 250 Oct 15 2024 ..
lrwxrwxrwx 1 root root 19 Mar 27 12:44 07ac5923.0 -> Digi-Root-CA-G2.pem
-rw-r--r-- 1 root root 2.3K Jul 14 10:16 Digi-Issuing-CA-G3.pem
-rw-r--r-- 1 root root 2.6K Sep 14 2021 Digi-Issuing-CA01-G2.pem
-rw-r--r-- 1 root root 2.3K Sep 14 2021 Digi-Root-CA-G2.pem
-rw-r--r-- 1 root root 1.9K Jul 14 10:16 Digi-Root-CA-G3.pem
lrwxrwxrwx 1 root root 24 Mar 27 12:44 e0c0effb.0 -> Digi-Issuing-CA01-G2.pem
root@ad24f5df0102:/#
root@ad24f5df0102:/# exit
exit
euprdgitlab655:~ #
euprdgitlab655:~ #
euprdgitlab655:~ #
euprdgitlab655:~ # podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ad24f5df0102 reg.subdomain.domain.tld/gitlab/gitlab-ee:18.0.3-ee.0 /assets/wrapper 3 months ago Up 3 weeks (healthy) 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:2222->22/tcp gitlab
aa22bdf8c33a docker.io/library/nginx:1.27.5 nginx -g daemon o... 3 months ago Up 3 weeks 0.0.0.0:8443->8443/tcp nginx
euprdgitlab655:~ #
euprdgitlab655:~ # podman stop gitlab
WARN[0010] StopSignal SIGTERM failed to stop container gitlab in 10 seconds, resorting to SIGKILL
gitlab
euprdgitlab655:~ # podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ad24f5df0102 reg.subdomain.domain.tld/gitlab/gitlab-ee:18.0.3-ee.0 /assets/wrapper 3 months ago Up 2 seconds (starting) 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:2222->22/tcp gitlab
aa22bdf8c33a docker.io/library/nginx:1.27.5 nginx -g daemon o... 3 months ago Up 3 weeks 0.0.0.0:8443->8443/tcp nginx
euprdgitlab655:~ #
euprdgitlab655:~ #

[...] *wait* [...]

euprdgitlab655:~ #
euprdgitlab655:~ # podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ad24f5df0102 reg.subdomain.domain.tld/gitlab/gitlab-ee:18.0.3-ee.0 /assets/wrapper 3 months ago Up 7 minutes (healthy) 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:2222->22/tcp gitlab
aa22bdf8c33a docker.io/library/nginx:1.27.5 nginx -g daemon o... 3 months ago Up 3 weeks 0.0.0.0:8443->8443/tcp nginx
euprdgitlab655:~ #

Backup GitLab running in a Container and encrypt the backup

Many Gitlab instances run in a docker or podman container. The following is a bash script which 

  1. fetches the gitlab-configs and the gitlab-data from inside of the container, 
  2. then creates a key (symmetric), 
  3. which is again encrypted with a asymmetric key (certificate)
  4. and encrypted the gitlab-config & data with that
  5. And it deletes old backup data which is older then 7 days

 

gitlab040:/srv/gitlab # cat gitlab-backup.sh
#!/bin/bash
# remove tmp files 
rm -rf /srv/gitlab/tmp

# create tmp directory
mkdir -p /srv/gitlab/tmp

# generate backups
docker exec -t gitlab /bin/sh -c 'umask 0077; tar cfz /secret/gitlab/backups/$(date +"%Y-%m-%d-%H-%M")_config_gitlab_backup.tgz -C / etc/gitlab'
docker exec -t gitlab gitlab-backup create CRON=1 BACKUP=$(date +"%Y-%m-%d-%H-%M")_data

# locate backup files
BACKUPCONFIG=$(ls -Art /srv/gitlab/backup-config/*config_gitlab_backup.tgz | tail -n 1)
BACKUPDATA=$(ls -Art /srv/gitlab/backup-data/*data_gitlab_backup.tar | tail -n 1)

# generate symmetric key
openssl rand -base64 32 > /srv/gitlab/tmp/symmetric_keyfile.key

# encrypt symmetric key with asm-key
openssl rsautl -encrypt -inkey /srv/gitlab/public_key.pem -pubin -in /srv/gitlab/tmp/symmetric_keyfile.key -out /srv/gitlab/tmp/symmetric_keyfile.enc

# generate hashes
sha1sum $BACKUPCONFIG >> /srv/gitlab/tmp/$(basename $BACKUPCONFIG).sha1sum
sha1sum $BACKUPDATA >> /srv/gitlab/tmp/$(basename $BACKUPDATA).sha1sum

# encrypt backup files
openssl enc -in $BACKUPCONFIG -out /srv/gitlab/tmp/$(basename $BACKUPCONFIG).enc -e -aes256 -kfile /srv/gitlab/tmp/symmetric_keyfile.key
openssl enc -in $BACKUPDATA -out /srv/gitlab/tmp/$(basename $BACKUPDATA).enc -e -aes256 -kfile /srv/gitlab/tmp/symmetric_keyfile.key

# archive backup files
cd /srv/gitlab/tmp
tar -cvzf /backup/gitlab-backup-$(date +"%Y-%m-%d-%H-%M").tgz *.enc *.sha1sum 1>/dev/null

# remove tmp files
rm -rf /srv/gitlab/tmp

# delete old config backups
find /srv/gitlab/backup-config -type f -mtime +7 -name '*config_gitlab_backup.tgz' -delete
find /srv/gitlab/backup-data -type f -mtime +7 -name '*data_gitlab_backup.tar' -delete
find /backup -type f -mtime +30 -name 'gitlab-backup-*.tgz' -delete 

Splunk Version 9.4.4 shows error while starting - VM CPU Flags are missing

Problem 

When you update your Splunk to e.g. version 9.4.4 and get this error while starting splunk:

Migrating to:
VERSION=9.4.4
BUILD=f627d88b766b
PRODUCT=splunk
PLATFORM=Linux-x86_64

********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION **********

-> Currently configured KVSTore database path="/opt/splunk/var/lib/splunk/kvstore"
CPU Vendor: GenuineIntel
CPU Family: 15
CPU Model: 6
CPU Brand: \x
AVX Support: No
SSE4.2 Support: No
AES-NI Support: No

-> isSupportedArchitecture=0
-> isKVstoreDisabled=0
-> isKVstoreDatabaseFolderExist=0
-> isKVstoreDiagnosticsFolderExist=0
-> isKVstoreVersionFileFolderExist=1
-> isKVstoreVersionFileFolderEmpty=0
-> isKVstoreVersionFileMatched=1
-> isKVstoreVersionFromBsonMatched=0
-> isSupportedArchitecture=0
* Active KVStore version upgrade precheck FAILED!
  -- This check is to ensure that KVStore version 4.2 been in use.
  -- In order to fix this failed check, re-install the previous Splunk version, and follow the KVStore upgrade documentation: https://docs.splunk.com/Documentation/Splunk/9.3.0/Admin/MigrateKVstore#Upgrade_KV_store_server_to_version_4.2 .
Some upgrade prechecks failed!
ERROR while running splunk-preinstall.
 

Cause

This might be related to missing CPU features AVX, SSE4.2 and AES-NI to the Splunk VM, which are necessary for the new kvstore mongodb version, which is introduced in Splunk version 9.4: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/administer-the-app-key-value-store/upgrade-the-kv-store-server-version#Upgrade_the_KV_store_server_version

You can check inside your VM using:
splnonroot@devubu22h102:/opt/splunk$
splnonroot@devubu22h102:/opt/splunk$
splnonroot@devubu22h102:/opt/splunk$ grep -o -w 'sse4_2\|avx\|aes' /proc/cpuinfo | sort -u
splnonroot@devubu22h102:/opt/splunk$

Solution 

In your VM hypervisor (VMware ESXi, Microsoft Hyper-V, Proxmox, etc..) --> give the Splunk VMs the necessary CPU flags/features.

Example for proxmox:

  1. Check inside your VM: grep -o -w 'sse4_2\|avx\|aes' /proc/cpuinfo | sort -u
  2. Edit /etc/pve/qemu-server/*Your VM ID*.conf and add CPU: Host - so all the Host CPU Hardware flags are forwarded to the VM
  3. Reboot the VM 
  4. Check inside your VM again: grep -o -w 'sse4_2\|avx\|aes' /proc/cpuinfo | sort -u
  5. Start Splunk 

Before Proxmox VM has CPU features: 

root@proxmox1:~#
root@proxmox1:~#
root@proxmox1:~# cat /etc/pve/qemu-server/*Your VM ID*.conf
boot: order=scsi0;ide2;net0
cores: 2
ide2: local:iso/ubuntu-22.04-live-server-amd64_2.iso,media=cdrom
memory: 8192
name: devubu22h102
net0: virtio=CA:*redacted*:CC,bridge=vmbr0,firewall=1
[...]

[snapshot-pre-splunkupdate]
boot: order=scsi0;ide2;net0
cores: 2
ide2: local:iso/ubuntu-22.04-live-server-amd64_2.iso,media=cdrom
memory: 8192
name: devubu22h102
net0: virtio=CA:*redacted*:CC,bridge=vmbr0,firewall=1
[...]
root@proxmox1:~#
root@proxmox1:~# 

After Proxmox VM has CPU features:


1.
root@proxmox1:~#
root@proxmox1:~#
root@proxmox1:~# cat /etc/pve/qemu-server/*Your VM ID*.conf
boot: order=scsi0;ide2;net0
cores: 2
cpu: host
ide2: local:iso/ubuntu-22.04-live-server-amd64_2.iso,media=cdrom
memory: 8192
name: devubu22h102
net0: virtio=CA:*redacted*:CC,bridge=vmbr0,firewall=1
[...]

[snapshot-pre-splunkupdate]
boot: order=scsi0;ide2;net0
cores: 2
cpu: host
ide2: local:iso/ubuntu-22.04-live-server-amd64_2.iso,media=cdrom
memory: 8192
name: devubu22h102
net0: virtio=CA:*redacted*:CC,bridge=vmbr0,firewall=1
[...]
root@proxmox1:~#
root@proxmox1:~#


2. Reboot the VM

3. Then inside your VM the CPU flags are visible:
splnonroot@devubu22h102:/opt/splunk$
splnonroot@devubu22h102:/opt/splunk$ grep -o -w 'sse4_2\|avx\|aes' /proc/cpuinfo | sort -u
aes
avx
sse4_2
splnonroot@devubu22h102:/opt/splunk$
splnonroot@devubu22h102:/opt/splunk$ 


4. Start Splunk again

Update Nginx ProxyManager docker container guide

Commands

  1. Backup your container
  2. Check which version your Nginx ProxyManager is currently running by:
    docker exec -it nginx_app_1 /bin/bash

  3. Check which docker containers are currently running
    docker ps

  4. Stop the Nginx ProxyManager application and database containers by:
    docker stop nginx_app_1
    docker stop nginx_db_1


  5. Pull the latest (or a specific) version of the image by:
    docker pull jc21/nginx-proxy-manager:latest

  6. Start the Containers
    docker-compose -f nginx.yml up -d

  7. Check the logs of the containers
    docker logs --follow nginx_app_1

  8. Check which version your Nginx ProxyManager is currently running by:
    docker exec -it nginx_app_1 /bin/bash

  9. Check your monitoring solution & test your applications


Example

user@container-nginx:~#
user@container-nginx:~# docker ps
CONTAINER ID   IMAGE                      COMMAND             CREATED         STATUS         PORTS                                                                                  NAMES
1a74a14bc3ab   9c3f57826a5d               "/init"             18 days ago   Up 4 minutes   0.0.0.0:80-81->80-81/tcp, :::80-81->80-81/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp   nginx_app_1
02372069f98d   jc21/mariadb-aria:latest   "/scripts/run.sh"   18 days ago   Up 4 minutes   3306/tcp                                                                               nginx_db_1
user@container-nginx:~#
user@container-nginx:~#
user@container-nginx:~# docker stop nginx_app_1
nginx_app_1
user@container-nginx:~# docker stop nginx_db_1
nginx_db_1
user@container-nginx:~#
user@container-nginx:~# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
user@container-nginx:~#
user@container-nginx:~# docker pull jc21/nginx-proxy-manager:latest
latest: Pulling from jc21/nginx-proxy-manager
7cf63256a31a: Pull complete
191fb0319d69: Pull complete
9ace5189354c: Pull complete
e4db5efc926a: Pull complete
[...]
be35f3c3bf02: Pull complete
Digest: sha256:e5eecad9bf040f1e7ddc9db6bbc812d690503aa119005e3aa0c24803746b49ea
Status: Downloaded newer image for jc21/nginx-proxy-manager:latest
docker.io/jc21/nginx-proxy-manager:latest
user@container-nginx:~#
user@container-nginx:~#
user@container-nginx:~# ls -lah
total 676K
[...]
-rw-r--r--  1 user    user    607K May 14 02:55 cron-auto-update.log
drwxr-xr-x  7 user    user    4.0K Nov  5  2023 data
drwxr-xr-x  8 user    user    4.0K May 14 19:07 letsencrypt
drwxr-xr-x  5 postfix crontab 4.0K May 14 19:14 mysql
-rw-r--r--  1 user    user    1.1K Aug 11  2024 nginx.yml
user@container-nginx:~#
user@container-nginx:~#
user@container-nginx:~#
user@container-nginx:~#
user@container-nginx:~# docker-compose -f nginx.yml up -d
Starting nginx_db_1 ... done
Recreating 
nginx_app_1 ... done
user@container-nginx:~#
user@container-nginx:~#
user@container-nginx:~# docker exec -it nginx_app_1 /bin/bash
 _   _       _            ____                      __  __
| \ | | __ _(_)_ __ __  _|  _ \ _ __ _____  ___   _|  \/  | __ _ _ __   __ _  __ _  ___ _ __
|  \| |/ _` | | '_ \\ \/ / |_) | '__/ _ \ \/ / | | | |\/| |/ _` | '_ \ / _` |/ _` |/ _ \ '__|
| |\  | (_| | | | | |>  <|  __/| | | (_) >  <| |_| | |  | | (_| | | | | (_| | (_| |  __/ |
|_| \_|\__, |_|_| |_/_/\_\_|   |_|  \___/_/\_\\__, |_|  |_|\__,_|_| |_|\__,_|\__, |\___|_|
       |___/                                  |___/                          |___/
Version 2.12.3 (c5a319c) 2025-03-12 00:21:07 UTC, OpenResty 1.27.1.1, debian 12 (bookworm), Certbot certbot 3.2.0
Base: debian:bookworm-slim, linux/amd64
Certbot: nginxproxymanager/nginx-full:latest, linux/amd64
Node: nginxproxymanager/nginx-full:certbot, linux/amd64

[yp@docker-9a056abb3b01:/app]#

 

This also works fine if the docker container is within an LXC container. It should also work fine with podman instead of docker.

Splunk SearchHead Cluster Artifact Proxying - Splunk internally sharing cached search results

When the same search is run twice in a splunk cluster, is it using a cache for the results or searching the data a second time?

A splunk search head search artifact means the results and metadata from a completed splunk search job (see: https://docs.splunk.com/Splexicon:Searchartifact)

So an artifact is a complete search which is cached for 10minutes.

In a search head cluster the search artifacts are replicated. However this takes a few seconds. What happens, if a search is run again on another search head and the artifact isnt replicated yet to that search head?

The search head captain, which streers those requests uses artifact proxying so the artifact is proxied from the search head which already has completed the search to the other search head.

See also: https://docs.splunk.com/Documentation/Splunk/9.4.0/DistSearch/SHCarchitecture#How_the_cluster_handles_search_artifacts

Example

  • 15 May 2025 11:21:01am - User1 starts the search "index=abc sourcetype=def" @04.May 2025 05:00:00am to 06:00:00am on SH1
  • 15 May 2025 11:21:03am - The search "index=abc sourcetype=def" @04.May 2025 05:00:00am to 06:00:00am on SH1 is complete
  • 15 May 2025 11:21:13am - User2 searches "index=abc sourcetype=def" @04.May 2025 05:00:00am to 06:00:00am on SH2
  • The search head cluster captain will proxy the search artifact (search results) from SH2 to SH1, so the search mustnt run a second time

SPL query for Splunk proxied artifacts

index=_internal host IN (searchhead01*,searchhead02*,searchhead03*) sourcetype=splunkd_access uri_path="/services/search/jobs*" isProxyRequest=true | stats count by method host file

Splunk SearchHead Cluster Artifact Proxying - Splunk internally sharing cached search results


Splunk UseCase for attacks against FortiGate Firewall management interfaces

If you are using Splunk as your SIEM you can try to detect attacks against your FortiGate firewalls by using the following SPL query:


index=firewall type=event subtype=system msg IN ("Failed to match community*", "Message authentication or checking failed*", "Negotiation failed: no matching*", "Negotiation failed: Broken pipe*")
| stats earliest(_time) as FirstEvent count by devname,msg,result,logdesc
| eval FirstEvent=strftime(FirstEvent,"%Y-%m-%d %H:%M:%S")

Splunk UseCase FortiGate Firewall Management Interface Attacks


Additionally: It is imperative that you protect your FortiGate interfaces with TrustedHosts AND Local-In-Policies. Only using TrustHosts protects HTTPS, SSH, etc but not other protocols like SIP, IPsec, CAPWAP, BGP, OSPF, SSLVPN etc which are also local services running on the FortiGate, which need to be protected, too.
See https://how2itsec.blogspot.com/2022/10/fortigate-admin-interface.html

Splunk alert for buckets which are not correctly replicated

The following shows a splunk savedsearch/alert which searches for Splunk buckets which are not correctly replicated to all indexers. 

Example

For example if you have a multisite cluster having 2 sites and each site should contain 2 copies of a bucket: 

splunk_server_clustering_available_sites: "site1,site2"
splunk_server_clustering_site_replication_factor: 'origin:1, site1:2, site2:2, total:4'
splunk_server_clustering_site_search_factor: 'origin:1, site1:2, site2:2, total:4'


Then the following SPL or savedsearch/alert might help identify if multiple buckets of an index are only replicated once:

| dbinspect index=* ```<-- show all buckets of all indexes ``` 
|search NOT state=hot ```<-- only warm & cold buckets ``` 
|eventstats count by bucketId  ```<-- list all bucket-ids only once, count how often they occur ``` 
|search count<2 ```<-- filter for all buckets that occur only once and are not replicated 4 times ``` 
|stats count by index ```<-- show all indexes that have buckets which were replicated only once ``` 
|search count>10 ```<-- show all indexes that have more than 10 buckets which were replicated only once```
``` All buckets should be replicated 4 times according to the search/replication factor of the Splunk multisite cluster. This alert shows if there are indexes with over 10 buckets that are only present once instead of being replicated on 4 indexers``` 


Screenshot:

Splunk bucket only once replicated dbinspect

Explaining screenshot:

Splunk bucket only once replicated dbinspect


How to bring relatives & friends to use a password manager

After about two years of effort, here's my personal experience report on "How do I get my relatives/friends to use a password manager?"

  • It helps to use a free product (e.g., KeePass, Bitwarden, etc.), so there is no price argument against it
  • It helps to use a widely audited open-source product (e.g., KeePass, Bitwarden, etc.), to establish trust in the provider/solution
  • It's important to convince relatives/friends with convenience. Unfortunately, most people are not very interested in security. Convenience motivates long-term use. Prerequisites for convenience include:
    • Access to the same vault from PC, tablet, and phone (usually via vault-in-cloud)
    • Auto-Type for automatic password entry on all devices (PC/laptop & tablet/phone)
    • Detection of new/changed manual typed in credentials with one-click saving to the password manager.
    • Support for passkeys/cert-based-auth for automatic login
    • Biometric or simple (but secure) unlocking of the password manager (personally, I only trust devices with an audited secure enclave chip for storing biometric data + a biometric scanner which isnt bypassed by simply showing a picture + protection against brute force/abuse + remote-wipe/remote-lock capability; but many people already use their fingerprint/faceprint on their phone, which can then be used).

3 Phases

I have had the best experiences with a migration/integration divided into three phases:

  1. Force people to use it - it's important to set up the password manager on their PC, tablet, and phone, with automatic password entry and detection when new credentials are manually entered, so they can be saved directly in the password manager.
  2. Collect all accounts over a few weeks/months and convince people of the convenience (automatic login/auto-type) of the password manager. (A bit like the initial discovery phase of an asset inventory or a CMDB)
  3. By now, people don't care about the password anymore. So, I can introduce complex, unique passwords. This starts especially with email accounts, etc.
  4. (The fourth phase would be to set up MFA everywhere, possibly integrating it into the password manager if possible, and changing all passwords to unique & strong ones.)

Notes

a) Depending on the age or willingness to try new things, I also set up MFA for email accounts right in Phase 1. For some, setting up a password manager and MFA at the same time leads to overwhelm, so take it slowly step by step, first the password manager, then MFA a few weeks later. Besides, MFA is great, but for email, one factor (username+password) usually still works via POP3/IMAP/SMTP/ActiveSync, so a strong password is still important (email accounts are among the most important accounts because of the password reset option of all the accounts).

b) It's worth enabling the automatic check on haveibeenpwnd and similar services in a password manager if such a feature is available. Often, it reveals that passwords, which have never been changed, have been compromised for years.

c) A password manager also needs to be hardened, e.g., by increasing KDF iterations, etc.

d) Have a backup from the beginning (e.g., Recovery Key, Master Password on paper in a safe/folder, in case it is forgotten, etc.). This ensures that if people make a mistake, you still have access to your password manager vault. For example, I once had a case where a user accidentally deleted their MFA entry. I had set up a backup for the MFA app (it was Microsoft Authenticator in this case), but the backup only protects against device loss, not manual deletion of entries. So, we needed a recovery key, which I had also set up. So, think about misuse and have a backup for it.

e) For IT/IT-Sec folks, I recommend giving them YubiKeys. Just gift them one or two (backup) and force them to use them for their own good :-) It quickly takes off once the first account is set up.

f) This takes time. For example, last week, I visited close friends (both mid-30s) for dinner, so I could push Phase 3 on them. It took another 2 hours, but all questions were answered, and they now love using Bitwarden and recommend it themselves. But you need the time. Confused users won't use it, which would be sad 😊.

Using this method, I have now got a small double-digit number of people to use Bitwarden permanently. And they, in turn, have started getting others to use it. Many small steps. I think it's great ☺️.

 

German / Deutsch:

Nach ca 2Jahren Bemühungen mein persönlicher  Erfahrungsbericht zu „Wie kriege ich meine Verwandten/Freunde dazu einen Passwort-Manager zu verwenden?“

  • Hilfreich ist es auf einen kostenloses Produkt zu setzen (zB KeePass, Bitwarden,..), dann kommt kein Preis Gegenargument
  • Hilfreich ist es auf ein mehrfach auditiertes OpenSource Produkt zu setzen (zB KeePass, Bitwarden,..), damit Vertrauen zum Anbieter/zur Lösung hergestellt werden kann
  • Wichtig ist, dass man die Verwandten/Freunde mit Komfort überzeugt. Sicherheit interessiert leider die meisten wenig/nicht genug. Komfort motiviert, dass es langfristig genutzt wird. Für Komfort ist Voraussetzung:
  • Zugriff von PC, Tablet und Handy auf ein und den selben Vault (i.d.R. via Vault-in-Cloud)
    • Auto-Type für automatische Eingabe der Passwörter auf allen Geräten (PC/Notebook & Tablet/Handy)
    • Erkennung von neuen/geänderten manuellen Credentials mit-1-Klick-Speichern-in-PW-Manager
    • Support von Pass-Keys/ Zert-Based-Auth für automatische Anmeldung
    • Biometrische bzw einfache (aber sichere) Entsperrung des Passwort-Managers (wobei ich persönlich da nur bei Geräten mit auditierter SecureEnclave als Speicherort für Biometrische Daten vertraue + wenn nicht nur ein normales Bild zum entsperren reicht + Schutz vor BruteForce/Abuse + RemoteWipe/RemoteLock; Aber viele nutzen ja auf ihrem Handy bereits ihren Fingerprint/Faceprint, das kann dann mitgenutzt werden)

3 Phasen

Ich habe die besten Erfahrungen gemacht durch eine Migration/Integration, die ich in drei Phasen eingeteilt habe:

  1. Zuerst mal die Leute überhaupt zwingen - wichtig ist, den PW-Manager auf deren PC, Tablet und Handy einzurichten, mit automatischer PW-Eingabe sowie Erkennung, wenn neue Credentials irgendwo manuell eingegeben werden, dass man diese direkt im PW-Manager speichern kann
  2. Dadurch ein paar Wochen/Monate alle Accounts sammeln und die Leute vom Komfort (automatische Anmeldung/Auto-Type) das Passwort-Managers überzeugen. (Ein bisschen wie die erste Discovery-Phase eins Asset-Inventorys beziehungsweise einer CMDB)
  3. Den Leuten ist mittlerweile das Passwort egal geworden. Also kann ich auch komplexe unique Passwörter einführen. Da beginnt man vor allem bei den Mailaccounts, usw.
  4. (Die vierte Phase wäre dann überall MFA einzurichten, gegebenenfalls diesen auch in den Passwort-Manager mit zu integrieren, falls das möglich ist, sowie alle Passwörter auf unique & starke PWs zu ändern)

Anmerkungen


a) Je nach Alter bzw Bereitschaft-auf-Neues habe ich ihn Phase1 auch gleich MFA für die Mail-Accounts mit eingerichtet. Bei manchen führt PW-Manager & MFA gleichzeitig einrichten zur Überforderung, da dann iterativ Stück für Stück langsam vorgehen, und erst den PW-Manager, ein paar Wochen später MFA. Außerdem ist MFA super, aber bei Mail geht ja meistens trotzdem ein Faktor (Username+Password) via POP3/IMAP/SMTP/ActiveSync weiterhin, d.h. da ist ein starkes PW weiterhin wichtig (Mail-Accounts gehören zu den wichtigsten Accounts gehören, wegen der Passwort-Reset-Option für Accounts)

b) Es lohnt sich ein Passwort Manager gleich die Funktion automatischer Abgleich auf haveibeenpwnd und Co zu aktivieren, falls es eine solche Funktion gibt. Da kommt oft genug raus, dass nie geänderte Passwörter seit Jahren kompromittiert sind

c) Auch ein PW-Manager muss gehärtet werden, dh zB KDF-Iterations hochsetzen, usw.

d) Von Anfang an überall ein Backup haben (zb Recovery Key, Master-PW auf Zettel in Tresor/Ordner, falls es vergessen wird,.. Notfallzugriff eben), so dass man sich sicher sein kann, dass wenn die Leute etwas falsch machen,  man trotzdem noch Zugriff auf seinen Passwort-Manager Vault hat. ZB hatte ich zu Beginn einmal den Fall, dass ein Benutzer versehentlich dein MFA Eintrag gelöscht hat. Ich hatte extra dazu ein Backup für die MFA-App (war Microsoft Authenticator in dem Fall) eingerichtet, das Backup schützt aber nur bei Geräteverlust, nicht bei manuellen Löschen von Einträgen. Da haben wir also einen Recovery-Key gebraucht, den ich auch eingerichtet hatte. Also auch an Fehlbenutzung denken und ein Backup dafür haben.

e) Für IT/IT-Sec‘ler empfehle ich ihnen YubiKeys aufzudrücken. Einfach einen bzw zwei (Backup) schenken und sie zu ihrem Glück zwingen :-) Startet dann schnell von alleine, wenn der erste Account eingerichtet ist.

f) Das kostet Zeit. ZB war ich letzte Woche bei einem gut befreundeten Paar (ca Mitte 30) zum Abendessen, damit ich ihnen danach noch Phase3 aufs Auge drücken durfte/wollte. Hat wieder 2 Stunden gekostet, aber so waren alle Fragen geklärt und die beiden benutzen Bitwarden mittlerweile total gern und empfehlen es selber. Aber die Zeit braucht man. Verwirrte Benutzer nutzen es sonst nicht, wäre ja schade drum 😊

Ich habe mit dieser Methode mittlerweile eine kleine zweistellige Anzahl an Leuten dauerhaft zu Bitwarden gekriegt. Und die wiederum haben angefangen andere darauf zu kriegen. Viele kleine Schritte. Find ich gut ☺️

Windows Persistence Map v0.1

Mitres Att&ck framework writes about persistence TA0003: "The adversary is trying to maintain their foothold.

There are multiple ways to get persistence in a Microsoft Windows operating system. Pepe Berba has created a nice overview of linux persistence techniques as a map, so I tried to do the same thing for Windows. This is version v0.1 of it:

Windows Persistence Map v0.1


 
 

Edge browser internal debug tools - example network traffic

 Microsoft Edge browser has some internal tools: edge://edge-urls/

Example usage net-export - debugging network traffic

  1. edge://net-export/ 


  2. Start & set file location (edge-net-export-log.json)
  3. Reproduce the issue in a new tab
  4. Stop recording
  5. The recording can be viewed via: https://netlog-viewer.appspot.com/#import
    → See Privacy: https://chromium.googlesource.com/catapult/+/master/netlog_viewer/
    "This app loads NetLog files generated by Chromium's chrome://net-export. Log data is processed and visualized entirely on the client side (your browser). Data is never uploaded to a remote endpoint."
  6. Select and load the file
  7. For example, Proxy/ProxyPAC Configuration: https://netlog-viewer.appspot.com/#proxy


  8. For example, detailed Event Timeline: https://netlog-viewer.appspot.com/#events


  9. For example, detailed DNS Events:


  10. Detailed Socket overview: https://netlog-viewer.appspot.com/#sockets
  11. Detailed HTTP/2 overview: https://netlog-viewer.appspot.com/#http2
  12. Detailed QUIC overview: https://netlog-viewer.appspot.com/#quic

Update Nextron Aurora lite EDR Agent

To manually update Nextrons Aurora Lite EDR agent, follow the steps: https://aurora-agent-manual.nextron-systems.com/en/latest/usage/upgrade-and-updates.html

  1. Download Aurora Lite files & license: https://www.nextron-systems.com/aurora/
  2. Unzip the files into a folder
  3. Copy the license file into that folder
  4. Start a PowerShell with Admin rights
  5. Execute aurora-agent-util.exe upgrade --restart-service

Example

PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1>
PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1> aurora-agent-util.exe upgrade --restart-service
Aug 10 19:30:37 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: License file found OWNER: some@address.com VALID: true VALID_FROM: 2024/04/15 VALID_TO: 2025/02/21
Aug 10 19:30:37 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Checking for new version PRODUCT: aurora-agent-lite-win
Aug 10 19:31:08 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Stopped installed Aurora Agent service
Aug 10 19:31:08 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Installing downloaded package INSTALL_PATH: C:\Program Files\Aurora-Agent
Aug 10 19:31:13 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Started installed Aurora Agent service
Aug 10 19:31:13 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Updated Aurora Agent NEW: 1.2.1 OLD: 1.1.5
PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1>
PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1>  

 

To debug aurora you can use aurora-agent-64.exe --debug

Nextron Aurora EDR agent shows \Pr Error

Problem

During start of Nextrons Aurora EDR lite agent the programm shows the following error message:

PS C:\Program Files\Aurora-Agent> aurora-agent-64.exe --dashboard
      ___                                  __    _ __
     /   | __  ___________  _________ _   / /   (_) /____
    / /| |/ / / / ___/ __ \/ ___/ __ `/  / /   / / __/ _ \
   / ___ / /_/ / /  / /_/ / /  / /_/ /  / /___/ / /_/  __/
  /_/  |_\__,_/_/   \____/_/   \__,_/  /_____/_/\__/\___/


  Aurora Agent Lite Version 1.2.1 (9da9fbf29275c), Signature Revision 2024/08/10-134221 (Sigma r2024-07-17-29-gace902b68)
  (C) Nextron Systems GmbH, 2022

Aug 10 19:51:16 clw11c493 AURORA: Error MODULE: EventDistributor MESSAGE: Could not parse process exclude ERROR: error parsing regexp: invalid character class range: `\Pr` LINE: error parsing regexp: invalid character class range: `\Pr`
Aug 10 19:51:16 clw11c493 AURORA: Error MODULE: EventDistributor MESSAGE: Could not parse process exclude ERROR: error parsing regexp: invalid character class range: `\Pr` LINE: error parsing regexp: invalid character class range: `\Pr`
Aug 10 19:51:16 clw11c493 AURORA: Error MODULE: EventDistributor MESSAGE: Could not parse process exclude ERROR: error parsing regexp: invalid character class range: `\Pr` LINE: error parsing regexp: invalid character class range: `\Pr`


Solution

Your "process-excludes.cfg" (C:\Program Files\Aurora-Agent\config\process-excludes.cfg) configurations probably has a missing escaping "\" in the process-path (aurora searches for those process paths using regular expression):

Wrong:
^"C:\Program Files (x86)\

Correct:
^"C:\\Program Files (x86)\\
 

Azure Managed Identities (technical service accounts)

Explaination

  • Azure Managed Identities = technical service accounts
  • Password is automatically managed, as it was the case in managed service accounts in OnPrem ActiveDirectory
  • Managed Identity types:
    • System Managed Idendity ==> strictly assigned to a single Azure system (like a VM), cant be shared with another system
    • User Managed Identity ==> for example for HA-clusters, in which all HA-nodes need the same user

Managed Identities dont use a password, instead they use OAuth2 and its token --> https://169.254.169.254/metadata/identity/oauth2/token 

Source https://medium.com/@siddiquimohammad0807/azure-managed-identity-types-and-importance-c64f6292577d

Source: https://medium.com/@siddiquimohammad0807/azure-managed-identity-types-and-importance-c64f6292577d


Example

  • When using PowerShell Connect-AzAccount --> a new window for username+password+mfa is opened --> these will be used as credentials


  • When using PowerShell Connect-AzAccount - Identity --> no new window is opened, instead the managed identity is used --> Powershell sends HTTPS OAuth2 Query to Azure IMDS "Instance Meta Data Service" and received a token, which is then used

Windows PowerShell
Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Users\Administrator20>
PS C:\Users\Administrator20>
PS C:\Users\Administrator20> Install-Module Az 
NuGet provider is required to continue 
PowerShellGet requires NuGet provider version '2.8.5.201' or newer to interact with NuGet-based repositories. The NuGetprovider must be available in 'C:\Program Files\PackageManagement\ProviderAssemblies'  or 'C:\Users\Administrator20\AppData\Local\PackageManagement\ProviderAssemblies'. You can also install the NuGet provider by running 'Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force'. Do you want PowerShellGet to install
 and import the NuGet provider now?
[Y] Yes[N] No[S] Suspend[?] Help (default is "Y"): y
 
Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its
InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from
'PSGallery'?
[Y] Yes[A] Yes to All[N] No[L] No to All[S] Suspend[?] Help (default is "N"): y
PS C:\Users\Administrator20>
PS C:\Users\Administrator20>
PS C:\Users\Administrator20> Connect-AzAccount -Identity
 
Subscription name Tenant
----------------- ------
274102ec-cd24-4af2-a4c2-832941ce526f
 
 
PS C:\Users\Administrator20>
PS C:\Users\Administrator20>


Proxmox Intel NUC crashes - Detected Hardware Unit Hang

Problem  If you are running proxmox (e.g. proxmox v 8.4.14) on a Intel NUC and it sporadically crashes with the following entries in the log...