XCP-ng 8.3 updates announcements and testing

psafont

@rzr said:

Hi @andrew, thank you for your feedback, the fallback option you're suggesting will work but it will downgrade the security of your system, we suggested to update clients:

If users need to take action, I would rather recommend users to do something that raises the security floor, like generating new keys with newer, future-looking ciphers, like ed25519:

ssh-keygen -t ed25519 -C "<email>"
for server in $servers do ; ssh-copy-id $server; done

gb.123

Hello,
After updating I get this:

This seems harmless as I don't have and scsi drive attached. But these messages were not there before.

Other than that, the server seems to boot fine.

Regards,

PS:
I have updated once for several updates (not one by one) so this messages may also be there in previous updates and may not be related to this particular update.

rzr

@gb.123 said:

Wrong diagnostic page; asked for 1 got 8
Failed to get diagnostic page 0x1
Failed to bind enclosure -19

be there in previous updates and may not be related to this particular update.

I think you're right because the issue you are facing is reported by kernel itself (which was not updated), Can you please share more details about the hardware you're using (is any USB device involved ? try smartmon tools too) eventually post details in other sections of forum.

gb.123

@rzr said:

I think you're right because the issue you are facing is reported by kernel itself (which was not updated), Can you please share more details about the hardware you're using (is any USB device involved ? try smartmon tools too) eventually post details in other sections of forum.

@rzr
CPU is AMD Ryzen 7 7840HS in a mini pc.

No USB involved in boot, but I do have an external USB HDD connected which is passed through to a VM (this should not effect boot)

What details are you looking for and where so you want me to post them ?

Update: I also tried on a AMD Ryzen 9 7945HX, which does not seem to have this message.

Do you think its USB related or motherboard/bios driver related ?

fohdeesha

@gb.123 those scsi messages can be expected and ignored when a USB enclosure is connected, some USB enclosures do not emulate SCSI Enclosure Services (SES) very well, so the kernel complains when it queries them and gets nonsense back. USB passthrough devices are still visible and enumerated by dom0's kernel. If you remove the drive the messages will go away, but they can be safely ignored.

flakpyro

I took the opportunity to swap out the ssh keys on my hosts yesterday from the default rsa keys over to ed25519 keys. I used Ansible to copy the new key over before running another playbook to remove the old key. Having the ability to use Ansible to mange your hosts at scale is very slick!

gduperrey

Thank you everyone for your tests and your feedback!

The updates are live now: https://xcp-ng.org/blog/2026/03/10/march-2026-maintenance-updates-for-xcp-ng-8-3-lts/

MajorP93

@gduperrey On my pool master there are no updates available in yum repository (checked via "yum check-update").
Will it take some more time?

bnerickson

Just a heads up that the updates to net-snmp-libs will break the lldpd package from epel. I know packages from epel aren't supported and are discouraged, but XCP-ng 9 can't come soon enough . Time to boot up an ancient CentOS 7 VM and create a custom lldpd spec/rpm.

gduperrey

@MajorP93 the diffusion of RPMs across different repositories around the world can take some time depending on your geographical location.

Sometimes a yum clean metadata can also help to clear the cache and better detect updates that have just arrived on certain repositories.

MajorP93

@gduperrey After running "yum clean metadata && yum check-update" the package updates are shown. Thanks.

manilx

@gduperrey Updated 2 pools/2 hosts @home (via cli). 3 pools/5 hosts @office (via RPU).
No issue.

acebmxer

Updated work servers 3 pools 6 host with Rolling Pool Update.

Mitchel-APD

Just updated 1 pool with 3 hosts.
SNMP did not work anymore, config file was not changed.
Got the following error: Authorization Error (SNMP error # 16)
Did a yum downgrade net-snmp*

From:

net-snmp.x86_64 1:5.9.3-8.1.xcpng8.3
net-snmp-agent-libs.x86_64 1:5.9.3-8.1.xcpng8.3
net-snmp-libs.x86_64 1:5.9.3-8.1.xcpng8.3

To:

net-snmp.x86_64 1:5.7.2-52.1.xcpng8.3
net-snmp-agent-libs.x86_64 1:5.7.2-52.1.xcpng8.3
net-snmp-libs.x86_64 1:5.7.2-52.1.xcpng8.3

After a service restart, SNMP worked immediately.

rzr

@Mitchel-APD said:

Just updated 1 pool with 3 hosts.
SNMP did not work anymore, config file was not changed.
Got the following error: Authorization Error (SNMP error # 16)

Thank you for your feedback, we're going to investigate, I see that there are many changes between both versions:

https://github.com/net-snmp/net-snmp/compare/v5.7.2...v5.9.3

semarie

@Mitchel-APD how do you auth on SNMP ? v1, v2, v3 ? and if v3, which authProtocol/privProtocol do you use ?

Mitchel-APD

@semarie Hi,

We are using SNMPv3 with SHA AES

semarie

@Mitchel-APD SHA1 ? I am looking if it is still supported/activated-by-default. I saw that 5.8 added SHA-2 family for RFC-7860 compliance

semarie

SHA`is SHA1. so I assume it is that.
And it seems to be still accepted in authProtocol parameter.

semarie

after testing (with net-snmp-utils 5.9.3), I have no problem with snmpv3 and SHA/AES.

On my testing host, snmpd server (OpenBSD):

User: user1
auth: AES with password123
priv: AES with 321drowssap

From XCP-ng 8.3, with net-snmp-utils 5.9.3:
$ snmpbulkwalk -v3 -a SHA -A password123 -l authPriv -x AES -X 321drowssap -u user1 192.168.1.80

so the net-snmp client itself seems fine with SHA/AES.

could you share more elements ?