Image Raspbian Gladys 4: security & ease of use

Development
1

Hello everyone,

I was wondering about the update of the raspberry with gladys v4.
Since v4 will be based on docker, which relies on the host kernel, upgrading the components in the docker will be quite simple. However, what is planned for the raspberry itself?

If the « raspberry version » will be distributed via an image, this can be integrated into it without much thought for the moment, a script for update/upgrade launched by a cron.

Personally, I’m not a big fan of the automatic method, you’re never safe from a problem during an upgrade. And if this happens to a user who is not familiar with the command line, they would only see a raspberry (gladys) that no longer works without knowing why, and will probably have to start over with a new installation, losing their data and configuration.

I know LXC much better than Docker; but in logic, a CT runs on the host and should not communicate with it. I’m not sure if it’s possible at the level of gladys to plan an upgrade of the raspberry with an ssh key between the docker and the raspberry to launch remote commands or if this would not be possible with a node module?

The ssh key also raises another problem if it is generated directly in the image. Suppose we have a gladys at home, and we find another instance of gladys open on the internet, with the ssh key that would be generated in the image, we could connect to the other instance open on the internet… which would be bad.

In continuation of an upgrade problem and the user loses their data and configuration, is there a module planned that allows exporting gladys data/configuration to an external media?

2

Thank you for creating a topic to discuss this!

I don’t think it’s Gladys’s responsibility to manage this. It’s up to us to find:

  • either a distribution that updates itself with an automatic security update system, and has mechanisms in place to ensure these updates are non-breaking. I’m thinking of what CoreOS does, for example.

  • or to implement automatic security updates like what Ubuntu can do, for example. Millions of servers run this, and as far as I know, it’s going rather well ^^

It’s already the case! I propose in Gladys Plus an automatic end-to-end encrypted backup system. With one click, you can restore your Gladys installation to any point in time :slight_smile:

3

I created a GitHub issue to list the requirements I think necessary for Gladys 4:

I added 2 points:

  • Add the possibility for the user (or even force the user) to change the default Raspbian password directly in Gladys.
  • Allow the user to extend the partition from Gladys

The goal here is clear: the user should never have to log in via SSH

4

In addition to being secure, it’s practical.

5

If anyone can investigate this, or propose a PR, I’m interested! :slight_smile:

6

Can you assign me the issue