14:55 <niobos> Hi, I have a perfectly functioning Armbian Bullseye box, but I notice that the most recent version on the website in Bookworm. I would like to avoid having to fully re-install the box, so I was looking how to upgrade. On the docs website I read that "Userspaces distribution upgrades are neither tested nor supported". Is there a supported way to get my box to Bookworm without reinstalling it?

14:58 <niobos> (I am fairly familiar with Debian upgrades, so I may go down the unsupported route, but I prefer to use supported routes if available)

14:59 <DC-IRC> <viraniac> We don't generally test upgrades as testing the same takes time and resources that we don't have. But a lot of people have successfully performed the upgrade

15:00 <DC-IRC> <rpardini> bullseye -> bookworm has a known issue ref. `base-files` package that is being handled / tested in beta repo. So expect problems with stable

15:01 <DC-IRC> <viraniac> There is another one, for some boards armbian-bsp-cli package doesn't get updated and new package has to be installed manually

15:01 <niobos> Do you have any time frame (estimate) when the `base-files` issue will be fixed in stable? Should I hold off my upgrade for a while?

15:02 <niobos> If it helps, I'm running on a Nanopi R4S (Rockchip64)

15:03 <DC-IRC> <rpardini> no estimates

15:04 <DC-IRC> <viraniac> I will suggest to get a spare sd card and experiment with the update. If everything works fine then go with it

15:05 <niobos> I have both filesystem backups and SD disk image, so I'm fairly confident that I will get everything back in to working order

15:05 <niobos> But the box is my main internet router; so any downtime is very inconvenient and I'm willing to go to greath lengts to maximize my chances of everything going well on the first try

15:06 <DC-IRC> <viraniac> Still testing on a different cloned card might be safer. Also will reduce your downtime cause you can just see if upgrade works, if it doesn't you can swap the card right back in

15:07 <niobos> But I'll just try the "userspace upgrade" route and either prepare an SD with a copy of the current one, or (as you suggest) do the upgrade on a cloned one

15:07 <DC-IRC> <viraniac> best of luck 🙂

15:07 <niobos> thank you for the quick answer to my question

15:08 <niobos> you people rock!

18:32 <DC-IRC> <sleepwalking42> So, I'm preparing an image that will run on an SBC inside a device we're going to sell. The board runs a custom program that communicates with a PC program over an ethernet interface (either directly connected or through a LAN) via GRPC. I'd like to limit any sort of unnecessary vulnerability to malicious actors over the network interface, but I'm mostly a linux noob. Right now, <clipped message>

18:32 <DC-IRC> <sleepwalking42> I'm turning off ssh in the final image, and I'm running it with overlayroot, which should prevent any disk writes from being saved to flash (though this could be disabled if someone had root access). Are there any other things I could do to lock down network access?

18:34 <archetech> close all ports using a firewall on the device except the one it needs

18:51 <DC-IRC> <sleepwalking42> good idea, thanks

19:09 <DC-IRC> <viraniac> Disable the root account if its not needed, run your program with a normal user account. Also add apparmor or selinux rules depending on what you are using and the list will go on and on

19:10 <DC-IRC> <viraniac> really depends on your use case. If you need professional help with this, I will suggest to book consulation meeting for the same using https://calendly.com/armbian/consultation?month=2023-10