0

I am new to this micro controller thingie world so bare with me :)

Let me describe a scenario first. Say I have a linux box for house automation embedded in a wall. For security reasons is the only active access to the box the display mounted to the wall.

Another access would be via network and ssh but ssh is disabled. Unfortunately does the web app sometimes crash and nothing goes. In the wake of that do I have to disassemble quite some stuff to get to the box and to revive it.

My Idea: I can use a nfc or rfid sensor and hook it up to Arduino. Would it be possible to make Arduino log on to the linux box and fire up and shutdown ssh?

I don't want to use Arduino Yun. Is it achievable with an Arduino nano/Mega?

If not, which system would be your first choice to accomplish this task?

Thanks for your patience :)

  • 1
    What hardware is the Linux box? Something similar to a Raspberry Pi? Does it have a serial console? RS-232 or logic level? What logic voltage? – Edgar Bonet Aug 6 at 10:22
  • It has no rs232 but usb so attaching a rs232 to usb converter would be possible – Jan S Aug 6 at 10:34
  • Oh, a full scale micro PC in use. – Jan S Aug 6 at 10:44
  • Why should RFID be more secure, than SSH? If you use key-based authentication and only allow access from the local network or even only from specific devices, that should be plenty security. Or - if it is only the app, thats crashing - maybe you can write a small program, that checks if the app is still alive. I don't see the need for extra hardware, as long as not the whole linux crashes, in which case that might be the real security issue. – chrisl Aug 6 at 10:44
  • There's no reason why you couldn't start agetty on the /dev/ttyUSB0 or /dev/ttyACM0 of an Arduino board's USB interface - then get the Arduino to send the text required to log in and use sudo or su to run the commands to start or stop ssh. Seems very convoluted though. Simpler just to, as @chrisl says, to just run SSH but secure it to the local network. – Majenko Aug 6 at 10:49
1

I will put our comments together in an answer.

You are overthinking the security issue. In my opinion, using RFID to reset the system is a bigger security thread, than using ssh the correct way. Normal RFID chips are susceptible to spoofing (copying an existing chip). Also the intruder could remove the RFID module to directly access the communication lines (depending on how much you will have accessible of the extra hardware). Also you can of course use the Serial interface of an Arduino to execute shell commands on your machine. You need a program on the machine to read the input and execute the commands (Majenko mentioned agetty for this). But is that really the best way? Using an Arduino here is a very hardware-ry way of solving a software issue. It is overly complex to do things this way and there are better options.

Instead you should really just use ssh with key-based authentication (disable password authentication). You can limit the ssh daemon to the local network (though, if you don't have configured corresponding port forwarding in your router, it isn't reachable from the internet either way), or - if you really want the additional security - to one specific device in your network. With a normal ssh key (I think 2048 bit is the standard), brute forcing is not a viable option for intruders. If you keep your private key save, there is very very little chance, that an intruder can get past that. You can also save the private key only on an USB stick, which you only use for resetting the machine. Also you can limit the commands, that the ssh user can execute, to only the resetting (like only allowing rebooting).

Depending on your actual security needs, you can choose, how far you want to go. I personally would just use key-based ssh limited to the local network. That should be plenty enough security and would also give you the possibility to access the machine, that is running in your home easier.


Or, if you really don't want to open ssh for the machine, you can write a simple watchdog program, that can run on the machine. Since the webapp is failing, you can write a simple python program (or any other language you like), which is regularly loading the webapp (how exactly depends largely on the webapp and the exact type of failure - may be a simple HTTP GET request) to check, if it is still alive. If the liveliness test fails for a defined number of times (let's say 3), it will reboot the machine.

This method does not require any access to the machine, but you will have to develop the liveliness test. Writing the program is then really simple.


All that said, it is not a good sign, that the app fails that often. You didn't write, what app that is, and what exactly fails. Maybe you are able to fix that issue directly. Or the developer of the app can, so maybe raise an issue on his platform (where the project is hosted).

  • You recap is nailing it pretty well. I am aware of that this approach is not the best approach for a home network. But it was just a scenario to help me to make the point clear how and what to achieve. I can tell you it is WAN based and the app is not failing that often. It hangs max 1-2 times a year and the ssh approach with certificate works fine. My scenario describes just the worst-case which until now not has happened. This is just a pre-emptive action I am taking for convenience and saving time/money. – Jan S Aug 7 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.