ccgx:root_access
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| ccgx:root_access [2023-09-12 21:13] – mvader | ccgx:root_access [2025-07-25 08:32] (current) – [5.2 Read-only rootfs and available disk space] mvader | ||
|---|---|---|---|
| Line 9: | Line 9: | ||
| Do note that, while we try to maintain to provide all mentioned functionality in this document, the used commands and functionality may change with future updates. | Do note that, while we try to maintain to provide all mentioned functionality in this document, the used commands and functionality may change with future updates. | ||
| - | ===== 2. Warning about modifying | + | ===== 2. Understanding |
| - | __1. Your changes can be lost during | + | The chapters below refer to the rootfs, data partition, /data and so forth. Before getting into that, first a short explanation. |
| - | Changes made to the rootfs will be lost in case of a firmware update. | + | The disk on a GX device, as well as the SD-card of a RaspberryPi after installing Venus OS on that, is split in to multiple partitions: |
| + | |||
| + | - **boot**. Normally invisible, except for RaspberryPi when inserting it in another computer | ||
| + | - **rootfs1**. First copy of Venus OS, when active, mounted at ''/'' | ||
| + | - **rootfs2**. Second copy of Venus OS, when active, mounted at ''/'' | ||
| + | - **data**. User settings and log files, mounted at ''/ | ||
| + | |||
| + | Why are there two rootfs-es? | ||
| + | |||
| + | Venus OS employs a so-called dual boot system. This is to allow for safe and reliable software updates. It works by maintaining two copies of the operating system, one active and one standby. For example, when rootfs1 is the active one, and an update of Venus OS is executed, then the new version is installed on the other partition, rootfs2. And once completed, that one is marked as the active one, GX device is rebooted " | ||
| + | |||
| + | ===== 3. Warning about modifying Venus OS ===== | ||
| + | |||
| + | __1. Changes can be lost during an update of Venus OS__ | ||
| + | |||
| + | Changes made to the rootfs will be lost in case of a firmware update. | ||
| Of course it is always possible to disable automatic firmware updates. Also there is a data partition (/data), which will be left alone in the image updates, and as such can be used to, upon boot, (re-)install certain changes onto the active rootfs. More details on that below. | Of course it is always possible to disable automatic firmware updates. Also there is a data partition (/data), which will be left alone in the image updates, and as such can be used to, upon boot, (re-)install certain changes onto the active rootfs. More details on that below. | ||
| Line 30: | Line 45: | ||
| - if you remove the files in / | - if you remove the files in / | ||
| - | ===== 3. Root access ===== | + | ===== 4. How to obtain root access ===== |
| + | |||
| + | ==== 4.1 Set access level to Superuser ==== | ||
| + | To set the root password, first set the access level to Superuser. | ||
| - | ==== 3.1 Set access level to Superuser ==== | ||
| - | To set the root password, first set the access level to Superuser: | ||
| - Go to Settings, General | - Go to Settings, General | ||
| - Set the Access Level to User and installer, the password is '' | - Set the Access Level to User and installer, the password is '' | ||
| - Highlight Access Level (don't open the select page, ie. make sure you are in the General Page, not the Access Level page) | - Highlight Access Level (don't open the select page, ie. make sure you are in the General Page, not the Access Level page) | ||
| - | - Press and hold the right button of the center pad until you see the Access Level change to Superuser. Note: when working from the Remote Console, you need to use the right key on your keyboard. Pressing and holding the right button with your mouse won't work. | + | - Press and hold the right button of the center pad until you see the Access Level change to Superuser. Note: when working from the Remote Console |
| Now you have access to the super user features. | Now you have access to the super user features. | ||
| Line 43: | Line 59: | ||
| Note that on a touchscreen, | Note that on a touchscreen, | ||
| - | ==== 3.2 Create a temporary root password ==== | + | ==== 4.2 Create a temporary root password ==== |
| Go to //Settings -> General -> Set root password//. And create a temporary root password. | Go to //Settings -> General -> Set root password//. And create a temporary root password. | ||
| - | Note that, for firmware version v2.00 and later, | + | Note that the root password will be reset by a firmware update. The reason is that the passwd file is on the rootfs, which is fully replaced by an update. More info [[https:// |
| + | |||
| + | Our advice is to create a complex root password. But use it to login only the first time, and then install a public ssh key(s). Thereafter login with the keys. If key authentication works, you can | ||
| + | safely disallow root logins with a password with '' | ||
| + | |||
| + | The password needs to be 6 characters long, minimum. | ||
| + | |||
| + | Note that the root password is stored on the rootfs, causing it to be marked as modified. This is normal, and visible in the UI like this: | ||
| - | Our advice is to create a complex root password. But use it to login only the first time, and then install a public ssh key(s). Thereafter login with the keys. If key authentication works, you can also | + | {{ : |
| - | safely delete the root password afterwards ('' | + | |
| - | ==== 3.3 Enable sshd and log in ===== | + | ssh keys are installed on the data partition, and therefore don't require having a rootfs that is marked as modified. |
| + | ==== 4.3 Enable sshd and log in ===== | ||
| - | To login via ssh, enable SSH on LAN (//Settings -> General//). On Venus versions before v2.40, you need to enable Remote Support, which also enables sshd. More info on Remote Support [[ccgx:ccgx_faq#what_is_the_functionality_behind_the_menu_item_remote_support_ssh_in_the_ethernet_menu|here]]. | + | To login via ssh, enable SSH on LAN (//Settings -> General//). On Venus versions before v2.40, you need to enable Remote Support, which also enables sshd. More info on Remote Support [[https:// |
| To the login, enter the ip address of the GX device in a ssh client. Most Linux and Mac users will simply do this from the command line: | To the login, enter the ip address of the GX device in a ssh client. Most Linux and Mac users will simply do this from the command line: | ||
| Line 62: | Line 85: | ||
| And a very commonly used client for Windows is [[http:// | And a very commonly used client for Windows is [[http:// | ||
| - | ==== 3.4 Installing ssh keys ==== | + | ==== 4.4 Installing ssh keys ==== |
| Using a ssh key for authentication, | Using a ssh key for authentication, | ||
| Line 75: | Line 98: | ||
| The third file contains the keys we use for Remote Support login. | The third file contains the keys we use for Remote Support login. | ||
| - | ==== 3.5 Play time! Start executing commands ==== | + | ==== 4.5 Play time! Start executing commands ==== |
| - | https://www.victronenergy.com/live/open_source: | + | [[https://github.com/victronenergy/venus/ |
| - | ===== 4. Customizing a GX device ===== | + | ===== 5. Customizing a GX device ===== |
| - | ==== 4.1 Hooks to install/run own code at boot ==== | + | ==== 5.1 Hooks to install/run own code at boot ==== |
| Everything, except for information on ''/ | Everything, except for information on ''/ | ||
| Line 89: | Line 112: | ||
| If the files ''/ | If the files ''/ | ||
| - | Also if '' | + | Also if '' |
| That venus-data file has one extra feature: if the archive contains '' | That venus-data file has one extra feature: if the archive contains '' | ||
| + | |||
| + | You can draw further inspiration from [[https:// | ||
| You can test the ' | You can test the ' | ||
| Line 100: | Line 125: | ||
| https:// | https:// | ||
| - | ==== 4.2 Partitions, read-only rootfs | + | **User setting that enables |
| + | ** | ||
| - | On a GX Device, there are three partitions that matter: | + | In the Settings -> General -> Modification checks menu, there is an option called " |
| - | * rootfs partition one | + | When set to disabled, |
| - | * rootfs partition two | + | |
| - | * the data partition | + | |
| - | === 4.2.1 One active rootfs at a time === | + | Here is a screenshot that section of the menu: |
| - | Only one of the two rootfs partitions will be in use at time. During a firmware update, the new firmware is installed on the other one; and once finished the subsequent reboot will reboot the device onto that other partition. | + | {{ : |
| + | ==== 5.2 Read-only rootfs and available disk space ==== | ||
| - | The data partition is not touched during a firmware update, except maybe some migration scripts that run at boot. | + | === 5.2.1 Read-only rootfs === |
| - | === 4.2.2 Read-only rootfs === | + | By default, the rootfs is mounted read only. Also, by default, it only has 5% of free space, while the partition in which its installed is actually larger. |
| - | By default, the rootfs is mounted | + | The recommended method to **(a)** mount it as read/write, and **(b)** expand |
| - | The solution | + | Here is a short overview of the three ways mount the rootfs as read/write: |
| - | Further details in the next section. | + | * // |
| + | * // | ||
| + | * // | ||
| - | === 4.2.3 Always prevent running out of diskspace === | + | === 5.2.2 Always prevent running out of diskspace === |
| When doing modifications, | When doing modifications, | ||
| Line 142: | Line 169: | ||
| Note that a firmware update will replace all of the rootfs, as also explained above. Which implies that you'll need to run '' | Note that a firmware update will replace all of the rootfs, as also explained above. Which implies that you'll need to run '' | ||
| - | ==== 4.3 Creating a patch file ==== | + | In the New UI, you can see available disk space on the data partition in the Settings -> General -> Modification checks menu. |
| + | ==== 5.3 Creating a patch file ==== | ||
| As mentioned before, the recommended way of customising Venus OS is by applying patch files. This section describes how to make and apply a patch. | As mentioned before, the recommended way of customising Venus OS is by applying patch files. This section describes how to make and apply a patch. | ||
| Line 156: | Line 184: | ||
| For more advanced features please check the manual page of [[https:// | For more advanced features please check the manual page of [[https:// | ||
| - | ==== 4.4 Adding or modifying services ==== | + | In this thread, there is an example of how to make a patch file to change a certain setting in the GX, and how to apply that at boot. To make it survive a firmware update: |
| + | https:// | ||
| + | |||
| + | ==== 5.4 Adding or modifying services ==== | ||
| Changes made to ''/ | Changes made to ''/ | ||
| Line 165: | Line 196: | ||
| ''/ | ''/ | ||
| - | By default the root filesystem of Venus is read-only. There are three ways to change that: | + | Further details here: https://github.com/victronenergy/venus/wiki/howto-add-a-driver-to-Venus# |
| - | + | ||
| - | * // | + | |
| - | * //semi-permanent//: issue the command ''/ | + | |
| - | * // | + | |
| - | ===== 5. Hardening a GX device ===== | + | ===== 6. Hardening a GX device ===== |
| - | ==== 5.1 Limit physical access to the device ==== | + | ==== 6.1 Limit physical access to the device ==== |
| The first thing to keep in mind is that we as Victron Energy always want an | The first thing to keep in mind is that we as Victron Energy always want an | ||
| Line 191: | Line 218: | ||
| access to the device. | access to the device. | ||
| - | ==== 5.2 Disable touch on the attached screen ==== | + | ==== 6.2 Disable touch on the attached screen ==== |
| - | Per Venus OS version v3.00, we are introducing | + | There is a feature that allows disabling the touch feature on the GX Touch display. |
| This allows mounting the GX Touch where it is visible by the operators of the system; and at the same time prevent them from using that to elevate their access. | This allows mounting the GX Touch where it is visible by the operators of the system; and at the same time prevent them from using that to elevate their access. | ||
| Line 207: | Line 234: | ||
| Note that this setting only disables touch/mouse control. On the remote console you are still able to control the device with keyboard input. That is also true if you plugin an external USB keyboard. With the keyboard it is also possible to toggle the ''/ | Note that this setting only disables touch/mouse control. On the remote console you are still able to control the device with keyboard input. That is also true if you plugin an external USB keyboard. With the keyboard it is also possible to toggle the ''/ | ||
| - | ==== 5.3 Limiting digital access | + | ==== 6.3 Limiting digital access |
| When securing the device, it is also advised to disable the Wi-Fi access point, | When securing the device, it is also advised to disable the Wi-Fi access point, | ||
| Line 255: | Line 282: | ||
| that. | that. | ||
| - | ==== 5.4 Installing a tamper alarm ==== | + | ==== 6.4 Installing a tamper alarm ==== |
| By using the digital input(s) of the GX device, you can set the digital | By using the digital input(s) of the GX device, you can set the digital | ||
| Line 270: | Line 297: | ||
| * If a logical low input (0V) should be considered a positive condition, set //Inverted alarm logic// to on. | * If a logical low input (0V) should be considered a positive condition, set //Inverted alarm logic// to on. | ||
| - | ==== 5.5 Hardening multiple devices ==== | + | ==== 6.5 Hardening multiple devices ==== |
| If you have a lot of Venus devices to modify, probably the easiest way is to | If you have a lot of Venus devices to modify, probably the easiest way is to | ||
| Line 280: | Line 307: | ||
| Later replace that by something more strong and store it in your vault. Use the USB stick to put your public ssh keys on the GX device so you can gain remote access. | Later replace that by something more strong and store it in your vault. Use the USB stick to put your public ssh keys on the GX device so you can gain remote access. | ||
| - | ===== 6. Connecting on the serial console ===== | + | ===== 7. Connecting on the serial console ===== |
| The serial console offers a straight connection from your computer. Not relying on TCP or anything else. | The serial console offers a straight connection from your computer. Not relying on TCP or anything else. | ||
| Line 290: | Line 317: | ||
| The serial consoles on all GX devices are configured to 115200 baud. | The serial consoles on all GX devices are configured to 115200 baud. | ||
| - | ==== 6.1 Color Control GX ==== | + | ==== 7.1 Color Control GX ==== |
| All GX Devices have a dedicated serial console, except for the CCGX. Therefor its documented on a separate page: | All GX Devices have a dedicated serial console, except for the CCGX. Therefor its documented on a separate page: | ||
| Line 296: | Line 323: | ||
| [[https:// | [[https:// | ||
| - | ==== 6.2 Cerbo GX ==== | + | ==== 7.2 Cerbo GX ==== |
| The serial console is located on the CPU board, header JP201. GND is pin 1, RX and TX are pins 4 and 5. Here is a picture showing a [[https:// | The serial console is located on the CPU board, header JP201. GND is pin 1, RX and TX are pins 4 and 5. Here is a picture showing a [[https:// | ||
| Line 304: | Line 331: | ||
| {{ : | {{ : | ||
| - | ==== 6.3 Venus GX ==== | + | ==== 7.3 Venus GX ==== |
| The serial console is located on the base-board, and can be accessed through the slot between that board and the Ethernet connector on the beaglebone-board. | The serial console is located on the base-board, and can be accessed through the slot between that board and the Ethernet connector on the beaglebone-board. | ||
| - | White: TX of the Beaglebone - connect to RX on your cable | + | * White: TX of the Beaglebone - connect to RX on your cable |
| - | Black: ground | + | |
| - | Green: RX of the Beaglebone - connect to TX on your cable | + | |
| Make sure not to connect the red wire. | Make sure not to connect the red wire. | ||
| Line 318: | Line 345: | ||
| {{ : | {{ : | ||
| - | ==== 6.4 GX Card / Nanopi ==== | + | ==== 7.4 GX Card / Nanopi ==== |
| The GX Card is the PCBA inside the MultiPlus-II GX and EasySolar-II GX product ranges. This photo shows the card, when unmounted from these inverter/ | The GX Card is the PCBA inside the MultiPlus-II GX and EasySolar-II GX product ranges. This photo shows the card, when unmounted from these inverter/ | ||
| Line 329: | Line 356: | ||
| - | ==== 6.5 Octo GX ==== | + | ==== 7.5 Octo GX ==== |
| The serial console is located on the base-board, and can be accessed with the top-board unmounted. With the serial console cable connected the top-board can be put back on again. | The serial console is located on the base-board, and can be accessed with the top-board unmounted. With the serial console cable connected the top-board can be put back on again. | ||
| Line 343: | Line 370: | ||
| {{ : | {{ : | ||
| + | |||
| + | ==== 7.6 Ekrano GX ==== | ||
| + | |||
| + | Getting to console on the Ekrano GX is not that easy. The pins are located between the network and USB connector on the back of the device. | ||
| + | |||
| + | - Black: ground | ||
| + | - NC | ||
| + | - NC | ||
| + | - Green: RX of the Ekrano GX - connect to TX on your cable | ||
| + | - White: TX of the Ekrano GX - connect to RX on your cable | ||
| + | - NC | ||
| + | |||
| + | {{ : | ||
ccgx/root_access.1694546015.txt.gz · Last modified: by mvader