3

I am looking for a solution that would let me remotely access multiple devices from a central server.

The devices are preinstalled with custom software but their network conditions will be unknown and probably under 3G or NAT restricted WiFi environments.

The first thing that I thought of is using reverse SSH connections (either with ssh -R through a systemd service, or autoSSH) although that implies having one redirected port for each device. This is not really a problem and I doubt I'll have more than ~50K devices running at the same time.

However, I am looking for a more easy to manage infrastructure, and more scalable, just in case. I tried looking into other questions and I can't find an answer on this problem. I see that some people recommend using VPN tunnels, connecting each device to the central one. If someone just could explain how it works it would be great, I don't really understand how would that work, where do I setup each device ID/name, and how do I start a remote connection once it is all running.

Any other approach or solution is also welcome.

Note 1: One by one remote access is enough I think, but if all where available (so as to send commands to group of devices) will also be helpful (but don't stop answering if one at a time solution is in your mind).

Note 2: Systems are debian based. (Raspbian. it could also be Ubuntu if needed)

1
  • Is configuration management an option? puppet, etc?
    – mzhaase
    Sep 22, 2016 at 10:54

1 Answer 1

3

With the fashionable buzz-word term the "Internet of Things" we regularly get these kind of questions. I'll add a longish answer with some considerations and invite others to edit and improve.

  • Abandon the idea of interactive access to any specific device. You'll want an agent on the device that picks up instructions/commands from the management server and that will post back it's health and any results/collected data. It would be useful for an on-site operator to have confirmation the device is indeed communicating with your management server or in error.

  • Your devices need to phone home.
    You'll want your devices to connect to your management server(s) and not the other way around. With IPv4 still in use by many consumers and businesses there is also still quite a lot of NAT where establishing a connection from the device to your server will work much more smoothly than the other way around (that would require setting up port forwarding etc.).
    The default behaviour of most consumer/small business firewalls is to allow all outgoing traffic and since those are often not really managed that means phoning home will often simply work without further setup.
    Even many managed networks prefer to allow outgoing connections over opening up incoming connections.

  • The protocol needs to be HTTP or rather HTTPS. That runs over normal TCP/IP and even when no direct internet access is allowed your devices can still easily be configured to use a web proxy.

  • Your management server needs to listen on the default web ports i.e. 80 (HTTP) and/or 443 (HTTPS). There is a lot to be said for following the horde...

  • Your devices need to be able to configure themselves with DHCP but you will also need to offer an on-site operator a method to set up a static IP configuration and/or a proxy server.

  • Your devices will need to support both IPv6 and IPv4.

  • Automatic enrollement - with a larger number of devices you probably don't want to (manually) register each device on the management server before deploying it, instead a device should probably register itself when powered on and connected.

  • The agent should not run on a fixed schedule, you don't want thousands of agents to all phone home at exactly the same moment.

You might want to take a look existing configuration management tooling which already offer a lot of such functionality.

If you decide to roll your own, consider leveraging frameworks such as the Azure IoT gateway SDK, Google Compute IoT or AWS IoT

3
  • Thank you!, we ended up using saltstack, which makes minions connect home and let us select group of devices. There is also a 'hack' which we can use to make a reverse shell in case we need a root console to a single device. Sep 27, 2016 at 11:44
  • Is the answer still relevant? With cloudflare access, it's possible. You install agent (cloudflared) on target devices which connect to cloudflare backbone. Clients (warp) will connect to cloudflare access, you have freedom to choose idP of your choice to control RBAC & all is well you tunnel ssh connection to target Server from Client over https.
    – harshavmb
    Aug 14, 2023 at 14:19
  • Although that 7 year old answer doesn't specifically name a solution that didn't exist 7 years ago, isn't what you're suggesting not exactly what my answer also suggests: rather then find a way to connect directly to your device, find a solution allows your device to establish an outgoing connection (which is usually easier to implement) and once that connection is established, use that to control the device?
    – HBruijn
    Aug 14, 2023 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .