-
Notifications
You must be signed in to change notification settings - Fork 12
Bricked device: allow patching of DNS servers and SSH keys from inside the container #544
Comments
Also related? balena-io/docs#1122 |
Setting dns servers, sshkeys and udev rules via supervisor are on the todo list.
There was a subtle change in the default behaviour at one point. See balena-os/meta-balena@fa3de69 The static ip address for vpn is an interesting one. I'll raise it internally. And I'll raise the docs concern as well. The firewall docs should mention Thanks |
We have that. The problem is that editing the |
@magiconair indeed Until the supervisor updates, we have a few repos that are slightly safer then open heart surgery
Don't have a ready to use one for dnsServer but should be possible to use those as a base |
The other day I was thinking of adding a bash script in the OS for config.json updates. Something that makes a copy of config.json. allows edits. and only saves if it passes some ⏳ |
Interesting idea. Would using JSON Schema for additional validation be overkill and / or too inflexible? |
At this point, keeping it lightweight and just using |
Made this balena-os/meta-balena#1697 |
There are some issues that need to be sorted out for the
|
You probably want the EDIT: And maybe it's worth running |
We have several Balena OS devices with default configuration going onto a customer network which blocks DNS to
8.8.8.8
and the IT department cannot change that rule. This is the default DNS server for balenaOS and is not documented onhttps://www.balena.io/docs/faq/troubleshooting/faq/#what-network-ports-are-required
My assumption is that this is a non-issue if you are using
NetworkManager
since it will update thednsmasq
config with the DNS servers from the DHCP response.However, we need both Client and AP mode for WiFi simultaneously which
NetworkManager
does not support. We have to unmanage the WiFi interface and usewpa_supplicant
directly. Because of this we cannot set the DNS server for the host OS which prevents Balena from establishing the tunnel, basically bricking the device.Additionally, our devices do not have a removable SD card so patching
/mnt/boot/config.json
with additional DNS servers was not possible. Switching the device and re-flashing were also not possible or too time consuming because of where the device was installed.Eventually, I've worked around this is by creating a WiFi access point on an RPi with forwarding and masquerading which also spoofs a DNS server on
8.8.8.8
(configure8.8.8.8
on the loopback interface and rundnsmasq
as proxy on thewlan0
interface).Having a way to patch the
dnsServers
variable of theconfig.json
from inside a container would be very helpful. The same goes for adding an ssh key so that someone can login asroot
on port22222
. This looks like a good place: https://www.balena.io/docs/reference/supervisor/supervisor-api/#patch-v1devicehost-configHowever, this only helps if you have thought about this problem beforehand. If the device is already in the field Balena should try very hard to establish a tunnel. I think the current approach can be improved:
8.8.8.8
as a last resort./etc/hosts
and add them as additionalremote
options to the OpenVPN configuration. There should be a hard-coded static list in the OS image and the OS should cache the response fromhost vpn.balena-cloud.com
also in/etc/hosts
whenever it is online. Best to use names which do not resolve on the internet, e.g.vpn-static1
, ... and so forth.This would increase the chance that the device establishes a tunnel so that it can be managed remotely again.
The text was updated successfully, but these errors were encountered: