2

I am thinking about creating a linux appliance (probably using xubuntu booting from a USB drive, FYI) and I'm curious about how best to perform remote updates and administration.

The use case I want to support, is to have this box at a remote location out of my control (someone's house or office) and I want to update it remotely to patch something, alter it's configuration, maybe just upgrade the OS or applications on it for example.

At a dead-simple one-by-one situation, I figure that if it's running the entire OS in RAM, I should be able to remotely overwrite the OS image on the USB drive and tell the machine to reboot for the changes to take effect.

However, I got to thinking that I can't be the first guy with this problem. So what software/conifguration is available to manage a remote set of (very similar if not identical) appliances. I'd also love to have a dashboard where I can dive into each box to diagnose problems too -- but the idea of remote updates (especially in bulk) seems like a whole new problem.

Any help?

7 Answers 7

2

For remote access, I'd have each machine establish an OpenVPN tunnel to a central location. This gets around NAT problems, and ensures that any protocol you might have to use that isn't encrypted by default is kept secured.

As far as updates go, I'm going to continue to beat on the Puppet drum. It really is the best way currently in existence to automatically manage and update a number of identical or near-identical machines.

2

If you haven't taken a look at eBox for a dashboard/appliance/remote-admin type situation I would highly recommend it.

http://ebox-platform.com/

https://help.ubuntu.com/community/eBox

As a heads up don't install the packages in the Ubuntu repository. Use the official packages from from the eBox website or use their Ubuntu installation ISO.

2
  • This looks like it's pretty focused on corporate management - things like firewall/communications-server stuff, so I'm not sure it's helpful for what I need. Would it help me to administer a bunch of appliances which I've deployed to customers w/o directing all their traffic through my servers? Jul 9, 2009 at 22:36
  • While it's true that it's more focused on network services, eBox can handle system updates. Also we have a Control Center for partners that can run tasks in different groups of eboxes at once, which seems more appropriate for what you're asking for Jul 30, 2009 at 21:40
1

I think a common technique is to run the image in some sort of chroot. That way you can install a new package containing a new chroot environment with all the updates etc without affecting the "master" OS.

2
  • Wow, I never would have guessed that! I hope that's not the best one can do - still it's definitely a thought. What about remote access to the machine iteself -- it seems like in order to get through NAT the remote machine has to initiate the "ssh" session and script to run to update things somehow. Is that possible? Jul 8, 2009 at 9:00
  • You could go down the "call home" route, but that of course has its own problems. If you have quite a few machines like these and they tend to be offline quite a lot, then pulling rather than pushing makes sense (think windows updates etc). Of course, make sure updates are cryptographically signed and checked.
    – zeroXten
    Jul 8, 2009 at 12:03
1

A few dashboards, off the top of my head:

Webmin

XPanel

HyperVM (Note: recent security problems).

0

Just ssh in. You can do everything from a shell. Ubuntu's aptitude programme is able to upgrade every part of the operating system from a shell.

2
  • 1
    Not in batch - if there are 100s or 1,000s of computers deployed, I am worried about how this scales. Jul 9, 2009 at 22:37
  • clusterssh if you want it do it partially manually. If not, just write a bash script. Jul 13, 2009 at 8:40
0

You can use ssh with x-forwarding. This allows you to run any application on the remote machine to be displayed on your own computer.

0

You can update packages and apply patches without re-install. But if you feel reinstalling is necessary then you can run one OS in virtualized environment. That way you can always update the guest OS. Only thing you may want to update in host OS is the software you use for virtualization support.

Other than this you can use chroot environment and open VPN tunnels to get around NAT as other uses have suggested.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .