Linux (Debian) fahclient will not connect to FAHControl running on Arch Linux

[Fldngbob]

I have been folding with FAH for years with WU running on CPU slots viewing the web page at [ip address]:7396/ to check progress, etc. These clients run headless without my interference. I am venturing into adding GPU slot folding but, first I have to get my Debian OS (headless) client to connect to FAHControl running on my Arch Linux desktop. I have tried many adjustments to client 'config.xml' file and all have failed to connect. FAHControl status shows "client002" (in my case) 'Connecting' and nothing else. (Previous configurations yielded 'Connecting' and 'Online' alternating flashing between but, no connection.)

I'll remind very one I am new to utilizing FAHControl. I have noticed that various changes via FAHControl gui to the expert tab on the localhost (my Arch Linux) machine restart will apply changes (such as adding "cpus v=16") to the localhost config.xml file. (Clarity to remind other readers and myself: the FAHClient process running on the same machine as FAHControl are two (2) separate linux OS processes. Restarting the localhost FAHClient does not restart the FAHControl linux OS running process.)

Again, I'm new to utilizing FAHControl, I believe(?) FAHControl sends "config.xml" changes to the clients when clients connect to it? However, as I cannot get my Debian OS (tried D11, Bullseye and D12, Bookworm versions) clients to connect to FAHControl on Arch Linux but, cannot confirm the action. I have learned how to insert various flags into the client config.xml file. Restarted the client and the change remains in the (client) config.xml but, at some restart point, the client config.xml file is overwritten by a very simple config.xml configuration and my file changes disappear reverting back to cpu slot folding only (loosing my gpu slot additions.)

This all seems like a very complicated set of problems to solve and yes, that is true but, I want to solve ONLY one (1) issue at this time, that is the Debian FAHClient connection to FAHControl on Arch Linux? Seems to me that the OS version should not matter but forum searching show no one having the same issues I am experiencing, connecting my linux (Debian OS) client to FAHControl thereby FAHControl can make adjustments to any client config.xml file. Only references to Windows FAHControl and/or MacOS FAHClients or vs versa.

So, one issue at a time. How to connect linux clients to FAHControl? I have tried many settings including Remote Command Server, command-allow-no-pass, command-enable. etc . . . to name a few.

As I cannot find anything similar mentioned in the forums, what am I doing wrong?

[bikeaddict]

Here is an old post with remote control setup instructions.

viewtopic.php?p=357186#p357186

FAHControl connects to FAHClient on port 36330. If the machine running FAHClient has a firewall set up, the port needs to be open.

The Debian client config.xml needs to allow the IP address of the Arch box running FAHControl.

[Fldngbob]

Do the commands in viewtopic.php?t=37513 apply to all fahclients running on any OS's? I ask because I cannot find a "/usr/libexec/PlistBuddy" (a Windows directory I think). I am unable to find any linux directory location that contains any files referenced.

Now to continue my testing, all telnet, nc commands, nmap port testing commands, and nping tests on my fahclient tell me port 36330 is open on my control server. But yet no connection from fahclient to control server.

I am absolutely puzzled!

[bikeaddict]

The easiest way to configure the Debian clients is to temporarily run xorg on them with a monitor, keyboard and mouse attached and run FAHControl there to set up the fields on the Remote Access tab. You may have to restart the FAHClient service afterward to refresh config changes for remote access.

[calxalot]

The post with PlistBuddy commands is only for macOS.

You do not not need to modify the allow options if you just set a password.

All allow options need to include 127.0.0.1

If you want allow settings respected on v7 when you have set a password, you MUST also set deny 0.0.0.0/0

I strongly discourage you from changing command-allow-no-pass

Anything in command-allow-no-pass must also appear in allow

If you want to allow remote web control, which is passwordless, you must also modify web-allow

[calxalot]

See also

Code: Select all

FAHClient  --help

That’s a double dash

[calxalot]

You should generally only need to restart the client if you modify allow/deny options

They are only processed on client launch

[calxalot]

Do not directly modify config.xml while the client is running. Your changes may be overwritten.

The config is loaded on launch and written whenever there is a config change (in Web Control, FAHControl, or internal state change)

Pausing or resuming folding is also a config change.

[Fldngbob]

Thank you calxalot. Your suggestions helped but, I am still stuck.

I have multiple headless machines running fahclient. I have sorted and created a list (for me and future readers) the proper sequence to manually change the 'config.xml' file on a client. That being (again, for me and future readers) access webcontrol on client via [ipaddress];7396/ and "STOP FOLDING" and then "STOP NOW", then stop the fahclient service on the client (with systemctl stop FAHClient.service), confirm the FAHClient.service is no longer running (with systemctl status FAHClient.service). Here, I also check 'htop' to confirm all FAH folding has stopped. Make manual changes to my clients config.xml then restart the FAHCLient.service, confirm proper status of FAHClient.service and now return to the webcontrol page [ipaddess]:7396/ and "START FOLDING".

When running FAHClient on a headless machine, is it suggested to install fahclient, fahviewer, and fahcontrol even though the machine has no gui desktop? I ask because on THIS one (1) headless machine is the only machine I have installed all three FAH programs and this is the only machine that I can get to flash between "Connecting" and "Updating" on my remote FAHControl server. Here are some test results:

On the Remote Control Server:

Code: Select all

[bob@wrkstn6 ~]$ telnet 192.168.242.124 36330
Trying 192.168.242.124...
Connected to 192.168.242.124.
Escape character is '^]'.
Welcome to the FAHClient command server.
> q
Connection closed by foreign host.
[bob@wrkstn6 ~]$ nmap -p 36330 192.168.242.124
Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-28 11:55 EST
Nmap scan report for fah004.wdnhome.us (192.168.242.124)
Host is up (0.00027s latency).

PORT      STATE SERVICE
36330/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds
[bob@wrkstn6 ~]$ nc -vz 192.168.242.124 36330
fah004.wdnhome.us [192.168.242.124] 36330 open
[bob@wrkstn6 ~]$ nping -c 5 --tcp -p 36330 192.168.242.124
Mode TCP requires root privileges.
[bob@wrkstn6 ~]$ sudo nping -c 5 --tcp -p 36330 192.168.242.124
[sudo] password for bob: 

Starting Nping 0.7.94 ( https://nmap.org/nping ) at 2023-12-28 11:56 EST
SENT (0.0466s) TCP 192.168.242.146:26435 > 192.168.242.124:36330 S ttl=64 id=15004 iplen=40  seq=1799616902 win=1480 
RCVD (0.0470s) TCP 192.168.242.124:36330 > 192.168.242.146:26435 SA ttl=64 id=0 iplen=44  seq=4231365797 win=64240 <mss 1460>
SENT (1.0469s) TCP 192.168.242.146:26435 > 192.168.242.124:36330 S ttl=64 id=15004 iplen=40  seq=1799616902 win=1480 
RCVD (1.0471s) TCP 192.168.242.124:36330 > 192.168.242.146:26435 SA ttl=64 id=0 iplen=44  seq=4246992708 win=64240 <mss 1460>
SENT (2.0482s) TCP 192.168.242.146:26435 > 192.168.242.124:36330 S ttl=64 id=15004 iplen=40  seq=1799616902 win=1480 
RCVD (2.0485s) TCP 192.168.242.124:36330 > 192.168.242.146:26435 SA ttl=64 id=0 iplen=44  seq=4262639073 win=64240 <mss 1460>
SENT (3.0494s) TCP 192.168.242.146:26435 > 192.168.242.124:36330 S ttl=64 id=15004 iplen=40  seq=1799616902 win=1480 
RCVD (3.0497s) TCP 192.168.242.124:36330 > 192.168.242.146:26435 SA ttl=64 id=0 iplen=44  seq=4278283475 win=64240 <mss 1460>
SENT (4.0508s) TCP 192.168.242.146:26435 > 192.168.242.124:36330 S ttl=64 id=15004 iplen=40  seq=1799616902 win=1480 
RCVD (4.0511s) TCP 192.168.242.124:36330 > 192.168.242.146:26435 SA ttl=64 id=0 iplen=44  seq=4293929585 win=64240 <mss 1460>
 
Max rtt: 0.231ms | Min rtt: 0.148ms | Avg rtt: 0.178ms
Raw packets sent: 5 (200B) | Rcvd: 5 (230B) | Lost: 0 (0.00%)
Nping done: 1 IP address pinged in 4.10 seconds

On the FAHClient:

Code: Select all

root@fah004:~# telnet 192.168.242.146 36330
Trying 192.168.242.146...
Connected to 192.168.242.146.
Escape character is '^]'.

Welcome to the FAHClient command server.
> q
Connection closed by foreign host.
root@fah004:~# nmap -p 36330 192.168.242.146
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-28 16:50 UTC
Nmap scan report for wrkstn6.wdnhome.us (192.168.242.146)
Host is up (0.00015s latency).

PORT      STATE SERVICE
36330/tcp open  unknown
MAC Address: 34:17:EB:BD:1A:DA (Dell)

Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
root@fah004:~# nc -vz 192.168.242.146 36330
wrkstn6.wdnhome.us [192.168.242.146] 36330 (?) open
root@fah004:~# nmap -p 36330 192.168.242.146
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-28 16:51 UTC
Nmap scan report for wrkstn6.wdnhome.us (192.168.242.146)
Host is up (0.00020s latency).

PORT      STATE SERVICE
36330/tcp open  unknown
MAC Address: 34:17:EB:BD:1A:DA (Dell)

Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds
root@fah004:~# nping --tcp -p 36330 192.168.242.146

Starting Nping 0.7.93 ( https://nmap.org/nping ) at 2023-12-28 16:52 UTC
SENT (0.0209s) TCP 192.168.242.124:39308 > 192.168.242.146:36330 S ttl=64 id=37881 iplen=40  seq=3291865286 win=1480 
RCVD (0.0212s) TCP 192.168.242.146:36330 > 192.168.242.124:39308 SA ttl=64 id=0 iplen=44  seq=996578781 win=64240 <mss 1460>
SENT (1.0213s) TCP 192.168.242.124:39308 > 192.168.242.146:36330 S ttl=64 id=37881 iplen=40  seq=3291865286 win=1480 
RCVD (1.0217s) TCP 192.168.242.146:36330 > 192.168.242.124:39308 SA ttl=64 id=0 iplen=44  seq=1012209307 win=64240 <mss 1460>
SENT (2.0229s) TCP 192.168.242.124:39308 > 192.168.242.146:36330 S ttl=64 id=37881 iplen=40  seq=3291865286 win=1480 
RCVD (2.0231s) TCP 192.168.242.146:36330 > 192.168.242.124:39308 SA ttl=64 id=0 iplen=44  seq=1027858194 win=64240 <mss 1460>
SENT (3.0242s) TCP 192.168.242.124:39308 > 192.168.242.146:36330 S ttl=64 id=37881 iplen=40  seq=3291865286 win=1480 
RCVD (3.0245s) TCP 192.168.242.146:36330 > 192.168.242.124:39308 SA ttl=64 id=0 iplen=44  seq=1043504346 win=64240 <mss 1460>
^C 
Max rtt: 0.394ms | Min rtt: 0.202ms | Avg rtt: 0.257ms
Raw packets sent: 4 (160B) | Rcvd: 4 (184B) | Lost: 0 (0.00%)
Nping done: 1 IP address pinged in 3.84 seconds
root@fah004:~# nping -c 5 --tcp -p 36330 192.168.242.146

Starting Nping 0.7.93 ( https://nmap.org/nping ) at 2023-12-28 16:52 UTC
SENT (0.0279s) TCP 192.168.242.124:37340 > 192.168.242.146:36330 S ttl=64 id=1401 iplen=40  seq=1739683205 win=1480 
RCVD (0.0281s) TCP 192.168.242.146:36330 > 192.168.242.124:37340 SA ttl=64 id=0 iplen=44  seq=467300781 win=64240 <mss 1460>
SENT (1.0282s) TCP 192.168.242.124:37340 > 192.168.242.146:36330 S ttl=64 id=1401 iplen=40  seq=1739683205 win=1480 
RCVD (1.0285s) TCP 192.168.242.146:36330 > 192.168.242.124:37340 SA ttl=64 id=0 iplen=44  seq=482930111 win=64240 <mss 1460>
SENT (2.0297s) TCP 192.168.242.124:37340 > 192.168.242.146:36330 S ttl=64 id=1401 iplen=40  seq=1739683205 win=1480 
RCVD (2.0300s) TCP 192.168.242.146:36330 > 192.168.242.124:37340 SA ttl=64 id=0 iplen=44  seq=498578737 win=64240 <mss 1460>
SENT (3.0303s) TCP 192.168.242.124:37340 > 192.168.242.146:36330 S ttl=64 id=1401 iplen=40  seq=1739683205 win=1480 
RCVD (3.0306s) TCP 192.168.242.146:36330 > 192.168.242.124:37340 SA ttl=64 id=0 iplen=44  seq=514214060 win=64240 <mss 1460>
SENT (4.0317s) TCP 192.168.242.124:37340 > 192.168.242.146:36330 S ttl=64 id=1401 iplen=40  seq=1739683205 win=1480 
RCVD (4.0320s) TCP 192.168.242.146:36330 > 192.168.242.124:37340 SA ttl=64 id=0 iplen=44  seq=529859601 win=64240 <mss 1460>
 
Max rtt: 0.293ms | Min rtt: 0.154ms | Avg rtt: 0.225ms
Raw packets sent: 5 (200B) | Rcvd: 5 (230B) | Lost: 0 (0.00%)
Nping done: 1 IP address pinged in 4.07 seconds

So, this leads me to believe that I need to install all three 7.6.21 versions of FAH programs (fahclient, fahviwere, & fahcontrol) on all headless client machines. Is this incorrect?

As a reminder, this is the only client that appears to be making an attempt to connect to the Remote Control Server with flashing between 'Connecting' and 'Updating' on the gui of the FAHControl remote server.

With all these tests confirming access to port 36330 between server and client? Why won't these connect? Suggestions of what to look for?

[calxalot]

FAHControl and FAHViewer are optional and useless on a headless machine, unless you want to use them via VNC.

If a password is set, the first command you send to a remote via telnet should be
auth yourpassword
If it has spaces or special chars, put single quotes around password.
auth ‘my unencrypted secret’

Please post your config.xml for the client FAHControl cannot reach. Redact password and passkey if they are not “”

As an aside, the client does not make the connection to FAHControl. It accepts a connection.

[calxalot]

The FAHClient init.d script has also been problematic.
If your FAHClient.service was auto-generated on install, you may be inheriting those problems. Mainly:
- service client runs as root
- service client will not start
- service client will not stop

If FAHClient is not running,
you may need to make a custom systemd service file.
This may help:
viewtopic.php?p=359791#p359791

[Fldngbob]

##################################################
My hope is that this detailed explanation will help others.
Please remember that this procedures are based on v7.6.21.
This is my way of giving back. Thank you Linux and everyone.
##################################################

READERS BE WARNED!!! The use of 'root' user can seriously damage your system.

######### Original post begins here. ##############

I UNDERSTAND HOW THIS WORKS NOW!!!!!!!!!!!!!!!!

I started folding with (I think) FAH v5. All the habits and manual changes that worked and got amended through v5 to v6 to v7.0 version evolution DO NOT APPLY ANYMORE.

I re-installed Debian 12 Bookworm fresh. Down loaded fahclient program:

Code: Select all

wget https://download.foldingathome.org/releases/public/release/fahclient/debian-stable-64bit/v7.6/fahclient_7.6.21_amd64.deb

Then ran:

Code: Select all

sudo dpkg -i --force-depends fahclient_7.6.21_amd64.deb

Just before this 'dpkg' installation ended, the final question asked by the FAH installer was weather or not I wanted to have FAHClient begin folding on OS startup? I answered (don't remember exactly) that it was not to start.

Then I accessed '/etc/fahclient/config.xml' with my favorite editor and saw this:

Code: Select all

<config>
  <!--
    This is a sample XML configuration file for the Folding@home
    console client.  This configuration file format is explained
    in detail in the Client User's Guide.

    Copy this file to 'config.xml' and edit.

    To set your user name, team and passkey just edit the text
    in quotes below.
  -->

  <!-- User Information -->
  <user value="Anonymous"/> <!-- Enter your user name here -->
  <team value="0"/>         <!-- Your team number -->
  <passkey value=""/>       <!-- 32 hexadecimal characters if provided -->

  <power value="light"/>
  <gpu value="false"/>      <!-- If set "true", FAH will attempt to autoconfigure GPUs -->
  <fold-anon value="true"/>

  <!-- Folding Slots
    No folding slot configuration is necessary.  The client will
    automaticlaly choose a good configuration for you.  However, here
    are some examples:
  
      	<slot id="0" type="CPU"/>

    or
    
     	<slot id="0" type="CPU"/>
     	<slot id="1" type="GPU"/>

    All slots in a configuration MUST have unique ids.
   -->

  <!-- Granting Remote FAHControl Access
    To grant remote access to FAHControl and the remote command server add
    the following:

     <allow>127.0.0.1 x.x.x.x</allow>
     <password>PASS</password>

    Where x.x.x.x is the IP address of the computer which should be granted
    remote access and PASS is you choose to further secure the connection.
  -->

  <!-- Granting Remote Web Access
    If you would like to grant remote Web access then you need these two
    configuration lines:

      	<deny>0.0.0.0/0</deny>
      	<allow>127.0.0.1 x.x.x.x</allow>
      	<web-allow>127.0.0.1 x.x.x.x</web-allow>

    Where x.x.x.x is the IP address of the computer which should be granted
    remote access.  You may also need to open port 7396 on your firewall.

    You can then access the Web interface remotely by going to this address:

      	http://y.y.y.y:7396/

    Where y.y.y.y is the IP address of this computer.
  -->
</config>

And made the following changes:
These characters (without the single quotes) tell FAH coding to start ignoring the following comment '<!--' This is equal to bashs use of the pound sign (#).
The following three (3) characters (without the single quotes) tell FAH program to stop ignoring and begin processing code '-->'

Under "<!-- User Information -->" I changed "Anonymous" to my_user_name keeping the double quotes around "my_user_name".
Also changed the "0" to my team number "554433", again keeping the double quotes around it.
Inserted my passkey value with the 32 hexadecimal passkey I got from https://apps.foldingathome.org/getpasskey
Changed the <gpu value="false"/> to <gpu value="true"/> .

Next, because "<!-- Folding Slots" starts a block of un-commented instructions you have to change the following:

Code: Select all

<slot id="0" type="CPU"/>
<slot id="1" type="GPU"/>

to the following:

Code: Select all

-->    
<slot id="0" type="CPU"/>
<slot id="1" type="GPU"/>
<!--

Notice the "-->" ending the comment above allowing the "slot id" entry to be recognized by the FAH program.
And the "<!--" telling FAH program to ignore the comments after (below) the "slot ids" entry.

Then did the same with the "<!-- Granting Remote FAHControl Access" line changing the code:

Code: Select all

<allow>127.0.0.1 x.x.x.x</allow>
<password>PASS</password>

To the following changes "ip address range" and "my_password" :

Code: Select all

-->
<allow>127.0.0.1 192.168.xxx.0/24</allow>
<password>my-password</password>
<!--

Almost done.
Now changed "<!-- Granting Remote Web Access' to the following:

Code: Select all

-->
<deny>0.0.0.0/0</deny>
<allow>127.0.0.1 192.168.xxx.0/24</allow>
<web-allow>127.0.0.1 192.168.xxx.0/24</web-allow>
<!--

Adding the "-->" end comment at the before the "<!-- Grant Remote . . ." and the "<!--" at the end of the code to start ignoring the following (below) comment. Now changing the ip address range form "x.x.x.x" to your ip range.

I started the FAHClient with :

Code: Select all

systemctl start FAHClient.service
systemctl status FAHClient.service

Using the "status" option to confirm proper program start.

After I started FAHClient service and added 'client001' including the "Remote Access" password THE CLIENT CONNECTED TO FAHControl!!!!!

When I went and looked the FAH program had re-written my 'in progress' config.xml to look like this :

Code: Select all

<config>
  	<!-- Client Control -->
  	<fold-anon v='true'/>

  	<!-- HTTP Server -->
  	<allow v='127.0.0.1 192.168.xxx.0/24'/>

  	<!-- Remote Command Server -->
  	<password v='12345fah'/>

  	<!-- Slot Control -->
  	<power v='light'/>

  	<!-- User Information -->
  	<passkey v='my-secret-passkey-hexadecimal-number'/>
  	<team v='000000'/>
  	<user v='username'/>

  	<!-- Web Server -->
  	<web-allow v='127.0.0.1 192.168.xxx.0/24'/>

  	<!-- Folding Slots -->
  	<slot id='0' type='CPU'/>
</config>

The original "config.xml" file I created BEFORE I started FAHClient (with systemctl start FAHClient.service) did not appear within the new program generated config.xml file rather some of the new configuration appeared under the "Expert" tab of the client configure, This appearance over on my FAHControl Server, The "fold-anon", "gpu", and "Web-allow" values I had included in my initial "config.xml" file appeared under the "Expert" tab, and Other FAH program generated values appear here, also. See the image:https://drive.google.com/file/d/1w2qCKo ... drive_link

This working configuration told me a lot about where what ends up within the directory structure. Facts that are good to know.

So, I am depreciating ALL my old FAH configuration notes and moving on. Life gets better.

Thank you, calxalot

[calxalot]

If you want your allow to be meaningful on v7, you also need

Code: Select all

<deny v=“0.0.0.0/0”/>

[calxalot]

Your clear explanation of the resolution is appreciated. Thanks!

[calxalot]

Does all this resolve viewtopic.php?t=38458 ?