Can this be used to enforce “screen time” for laptops given to children, hopefully in a more effective way than the equivalent systems on iOS and Android?
Show HN: Bor – Open-source policy management for Linux desktops
11–20 of 31 posts
Re: Show HN: Bor – Open-source policy management for Linux desktops
#12Can this be used to enforce “screen time” for laptops given to children, hopefully in a more effective way than the equivalent systems on iOS and Android?
Not directly. This might be somehow configured with PAM. It's a good use case, thanks for the idea!
It could easily block porn, enforcing DNS over HTTPS in the web browsers, using providers with adult content protection.
Re: Show HN: Bor – Open-source policy management for Linux desktops
#13Nice work on the mTLS/gRPC push design — the inotify drift-catch on parent dirs is a clean answer to the "revert happens before the user notices" problem, and I like that the audit trail
is server-side.
Question on the policy model: how do you handle conflicting policies across sources — say a package postinstall rewrites a managed file while a newer policy is mid-sync from the server, or
two policy types touch the same file? Does the agent queue and reconcile revisions, or last-write-wins?
Also curious: with LDAP-only auth, how do non-domain single-user laptops fit in? I manage a few personal machines that I'd love to centralize but they aren't LDAP-joined — is there a lightweight path, or is the temp-token enrollment strictly for domain boxes?
Re: Show HN: Bor – Open-source policy management for Linux desktops
#14Nice work on the mTLS/gRPC push design — the inotify drift-catch on parent dirs is a clean answer to the "revert happens before the user notices" problem, and I like that the audit trail is server-side. Question on the policy model: how do you handle conflicting policies across sources — say a package postinstall rewrites a managed file while a newer policy is mid-sync from the server, or two policy types touch the s…
The default enrollment is based on temporary (5 min lifetime)tokens, generated from the UI. Domain-joined machines use Kerberos, but this is optional. Using the temporary tokens, the admin have to execute the agent with a command-line option for enrollment.
About the files, most of the bor-managed files are not defaults, coming from the system packages. If a given file is overridden by a package, the Bor agent will immediately rollback the managed version.
Also, there is a priority value on each policy, if several policies have the same property.
Re: Show HN: Bor – Open-source policy management for Linux desktops
#15This is fantastic! I'd really love to see support for SCAP so it could be used to enforce DISA STIGs.
Re: Show HN: Bor – Open-source policy management for Linux desktops
#16Very nice. Can you elaborate why you chose mTLS authentication vs. SSH as a mean to deploy the policies.
Regarding the docs, the diagrams should really be replaced with something more familiar and readable such as Mermaid (currently it looks like a mixture of ad-hoc ASCII charts).
Re: Show HN: Bor – Open-source policy management for Linux desktops
#17Very nice. Can you elaborate why you chose mTLS authentication vs. SSH as a mean to deploy the policies. Regarding the docs, the diagrams should really be replaced with something more familiar and readable such as Mermaid (currently it looks like a mixture of ad-hoc ASCII charts).
The general documentation is something that definitely needs a lot of improvement, but it's currently under active development.
Policies are delivered over a persistent gRPC stream, secured with mTLS, where each node gets it's own cert from Bor's built-in CA at enrollment - so there's no SSH key sprawl and no credentials on the server that could log into machines. Since agents connect outbound to the server, it works through NAT and firewalls without opening any inbound ports on desktops, and policy changes propagate in seconds over the already-open stream. SHH-push would have meant maintaining an inventory of searchable hosts and a server that can shell into the whole fleet - a much bigger attach surface for less capability.
Re: Show HN: Bor – Open-source policy management for Linux desktops
#18Very nice. Can you elaborate why you chose mTLS authentication vs. SSH as a mean to deploy the policies. Regarding the docs, the diagrams should really be replaced with something more familiar and readable such as Mermaid (currently it looks like a mixture of ad-hoc ASCII charts).
Some orgs might not want ssh running on user laptops/workstations, so I think that it's a plus to not have that requirement.
Re: Show HN: Bor – Open-source policy management for Linux desktops
#19Nice, the scope here feels right - a lot of policy management tools
try to do too much and end up being their own attack surface. Are you
handling policy conflicts (two rules touching the same resource) at
apply-time or just documenting "last write wins" and leaving it to
the admin?
Re: Show HN: Bor – Open-source policy management for Linux desktops
#20This looks really close to what I need. I manage a few laptops for a non-profit. For now, it is all done by hand, since I haven't found a good solution for Linux and I will kill myself before using Windows and Intune again. I would love to see configurations for Linux Mint's Cinnamon. Is there a way to execute custom scripts? How does the user mapping work exactly? Could I create a user in Authentik with a laptop-per…
Is there a reason you cannot use samba group policy objects, sssd or one of the other solutions out there?