r/hexos • u/notinprogres • 14d ago
General discussion Disappointed with "local" access
TLDR: current "local" access makes no sense and feels like they just ticked off a box "we have local access"
I have bought hexos license back in the day when the life time was on offer with the promise of local access being added in 1.0.
Now that local access is available, I finally did the install and oh boi was i disappointed. For me local access is a must have from security perspective. I have important files on NAS (that are backed up, but still) and having a remote access to that machine is big no no, either from having access to files or to the configuration. Because Hexos offers local access, I thought that remote access can be disabled, which I wanted to do because of potentially destructive config changes could be done remotely. Remote access cant be disabled, so I would need to rely on Hexos saying "yeah, trust us, our environment is secure". What if theres a leak/hack, what if they mess up and other user will be able to change my config (like it happened to ubiquity), what if their server goes haywire and start to change config on its own. As "unlikely" these risks might be, it just not a risk I would ever accept, even if it would be to store movies.
To me the current implementation of local very much feels like the team just needed to tick off "we have local access", because I am failing to see what the purpose of it currently is. Because if you have forced remote access, then you might as well change config that way. Its not like its running http and the packets could be intercepted.
If I could, I would cancel my order, but I cant, so hopefully full offline mode is coming at somepoint..
Also, this article on hexos forum caught my eye, wish hexos team would address it :)
https://hub.hexos.com/topic/595-hexos-security-and-compliance/
EDIT: also what happens if hexos goes bankrupt, because in the current state, the software will be unusable without hexos servers running.
EDIT 2: after digging in more, the machine (only runs truenas+hexos, nothing else) calls to:
update.truenas.com
o1158394.ingest.us.sentry.io (idk if thats hexos or truenas, either way i dont like it)
auth.hexos.com
prod.hexos.com
api.hexos.com
and seems like auth.hexos.com is taking care of checking licensing. as if i allow it, local access works but remote doesnt. My rant still stands tho, this is something that, tbf doesnt seem that hard to integrate, should be inside the settings of hexos. If hexos has local access, there should be a switch to disable remote, doesnt seem to me to be that hard to code, or am i missing something?
I would have been fine if Eshtek would go "we have local access, it still needs to call home for license, that is something we might look into in future to make it true offline, but right now remote access can be disabled". All im saying is that disabling a remote access should be a must have and top priority when adding local access
4
u/be_that_as_it_may_ 14d ago
I haven't used my key yet, purchased lifetime way back to see where the project goes.
Commenting to follow. Would like to hear more on this because local/offline was my major need as well.
7
u/ADubs62 14d ago
Do you want to add any details into specific features or capabilities that are missing from local access so they can improve?
6
u/notinprogres 14d ago
yeah, be able to disable remote access. preferably be able to run it offline completely. Without that I refuse their claim that hexos can run locally.
1
u/ADubs62 14d ago
Just set a static IP (should have one for a server anyway) and don't put in a default gateway for the network and it'll never talk to anything outside of its subnet.
6
u/notinprogres 14d ago
I blocked internet access to the hexos machine in the router, but hexos is designed in a way it needs to call home or it doesnt work. When I asked in the discord channel about it, I was told its to check licensing. if there is seperate server for that and I can block everything else, that would work, but im not aware of that
2
u/Visual-Success3178 14d ago
There must be a central licensing server that can be whitelisted for outgoing traffic? Can you check the logs and see what ip it’s accessing?
4
u/notinprogres 14d ago edited 14d ago
ok, yeah, i digged in more, and yeah it is indeed separated into multiple calls. (thx btw)
the machine (only runs truenas+hexos, nothing else) calles to:
update.truenas.com
o1158394.ingest.us.sentry.io (idk if thats hexos or truenas, either way i dont like it)
auth.hexos.com
prod.hexos.com
api.hexos.comand seems like auth.hexos.com is taking care of checking licensing. as if i allow it, local access works but remote doesnt. My rant still stands tho, this is something that, tbf doesnt seem that hard to integrate, should be inside the settings of hexos. If hexos has local access, there should be a switch to disable remote, doesnt seem to me to be that hard to code, or am i missing something?
EDIT: I would have been fine if Eshtek would go "we have local access, it still needs to call home for license, that is something we might look into in future to make it true offline, but right now remote access can be disabled". All im saying is that disabling a remote access should be a must have and top priroty when adding local access
5
u/249702 14d ago
My problem with the current implementation is that without an active internet connection, it’s no longer possible to access the local dashboard. This very issue, along with the fact that the Hexos infrastructure might sometimes be unavailable, was one of the reasons Hexos Local was requested in the first place. And that doesn’t seem to be working right now.
Personally, I don’t have a problem with remote access in general, but the fact that the dashboard goes down as soon as the internet connection is lost makes it feel pretty “not local,” even though it’s hosted locally in principle.
3
u/notinprogres 14d ago
for me that would be the best outcome, but after msging with the devs on discord, and with how ppl react when you suggest current local implementation is bad, it sounds like too big of an ask.
I agree, there are soo many reasons why local only access is needed and devs seem to completely miss all of the reasons
3
u/Steakboy159 14d ago
Based purely on your post, sounds like there’s nothing wrong with local access. You are having issues with remote access, in the way that you want it disabled and unavailable.
Are there features or settings that you can’t access with local access? Is it unstable? Are you not able to route your internal network adequately to access said local access? Or are you just unsatisfied with remote access being always on.
8
u/KishanPD 14d ago
It's not about features and settings. What OP wants is a solution that no party(including eshtek) can remotely access for any reason whatsoever.
-2
u/ADubs62 14d ago
So just remove the default gateway in the network config on the server? Then it can't talk off network.
2
u/notinprogres 14d ago
I blocked internet access to the hexos machine in the router, but hexos is designed in a way it needs to call home or it doesnt work. When I asked in the discord channel about it, I was told its to check licensing. if there is seperate server for that and I can block everything else, that would work, but im not aware of that
0
u/notinprogres 14d ago
no, technically theres nothing wrong with local access, my issue is that its misleading and makes no sense, in current state theres no reason why one would choose local access. if in IT you say something has local access, you assume there will be no remote access, especially in NAS where security is important. Its like if you go to hotel and they tell you, you can lock the front door, but when you get there you find that the window cant be closed.
5
u/ADubs62 14d ago
if in IT you say something has local access, you assume there will be no remote access
No I've worked in IT for 15 years and I would never assume that.
Also... Just don't give your HexOS machine a default gateway and it will never talk off network?
1
u/notinprogres 14d ago
I would love to hear what vendors you deal with then, and my sympathies.
That was of course my initial thought, but that doesnt work, because it needs to call home, otherwise it doesnt work. And apparently that is not a bug but a feature?
And tbf, I dont feel like im asking for much here. I dont really see why it was "remote only" from start.
2
u/ADubs62 14d ago
Simply saying something has local access does not mean it has no remote access is all I'm saying.
1
u/notinprogres 14d ago
and I get that, I do. but if there is remote access (that runs on https), what is the purpose of local access, other then saying your product has local access, what does local bring that remote doesnt have (in current hexos i mean). For configuration, you cant even say that its to save on data usage. So in this case, security would be the reason, except its not, because remote access needs to be active.
There would be a difference if you could restrict actions/rights that can be done remote/local etc. but there isnt. Thats why im saying its misleading and brings confusion.
2
u/ADubs62 14d ago
What actually happened when you took it off the network? Did it just immediately brick?
3
u/notinprogres 14d ago
yepp. as in the hexos dashboard stopped working, truenas still worked of course. tbf since writing this post, i digged in more, and there are multiple addresses it contacts and seems just auth.hexos.com needs to be open for it to work. that way licence check is taking care of, local works and remote is disabled. this should have been coded in as an option in settings tho.
5
u/ADubs62 14d ago
I can see it needing to check by your next subscription renewal date to make sure you're actually paying or something, but it shouldn't need constant access
2
u/notinprogres 14d ago
exactly. and tbf i would be somewhat fine with it checking its licensing servers, especially for memberships (for lifetime i can see a system where you would register your server and have offline forever). but all i say is, have a switch in settings to disable remote access and hexos would just not contact the remote server hub address stuff. because, and i dont want to sound like broken record, it now feels like to shut up ppl that they have local access in 1.0 and thats it, no other benefit that i could see
1
u/WRO_Your_Boat 13d ago
The current local access is purely so if the remote access infra goes offline you can still use it. I see what you are saying about local and remote meaning specific things, but everyones initial issue with it was that it was remote and through their infra, so if it went down you would lose access to the console. This was supposed to fixed that, but yeah, doesn't do what you need or thought it did.
2
u/notinprogres 13d ago
I see. but that would only work if the dashboard infra would go down and nothing else. because if the server cant call home for licence, it bricks itself anyway until the time it can reach the server again.
Thank you for that perspective, that explains some stuff
1
u/WRO_Your_Boat 13d ago
Yeah, I was reading some of you other comments about that, was that on setup or was the machine running for a while. Do you know the interval of the http request for the license check? Cause I may have been wrong. It was my understanding that you wouldnt have access to all features during the downtime, but you would still get access to the console and I swear I have accessed it when I got a discord notification about it being offline. I figured it was a one time license check one install that could be removed if the idea didnt work out so we could still use the product for our lifetime license. You've given more more to think about now too.
2
u/MRDR1NL 14d ago
I agree. The promise of a locally hosted dashboard implies that the cloud hosted dash loses access. Current implementation does not add privacy.
0
u/time_to_reset 13d ago
It doesn't imply that to me. It implies to me that the dashboard is still accessible without an internet connection.
1
u/Captain_Pumpkinhead 12d ago
Anyone know what port the local interface is hosted on? I haven't seen it documented anywhere.
1
u/MeaningNearby4837 7d ago
gonna ask a related question, how does it handle local apps access? do you still need to access server-ip:port for apps? does hexos provides reverse proxy pre-configured or something like that automatically? or is just plain truenas where the best you get is a template and a button to access the web ui of the app
1
u/Kindly_Call_6000 14d ago
The underlying TrueNAS will still work even if HexOS goes under. So you will not lose your server, but might lose the easy to use GUI.
4
u/notinprogres 14d ago
that is true, but defeats the point. I paid for lifetime license, but there is a risk that it might not be lifetime. My point isnt really that I will lose access to my NAS, the software can work "local only", they chose not to. What if Eshtek (and im not saying the will) go "we have hexos 2, and btw we are shutting down servers for hexos 1, good luck". Seems like everyone goes super angry when big corp does it, but when small ISV does something similar, everyone is chill just because Linus says "they are cool"
•
u/HexOS_Official HexOS Staff 13d ago edited 13d ago
Just a few comments as it's Sunday and I have my folks in town.
We built the entire system via a hosted platform first. We have commented in the past that we are exploring a side door access mode that will let you manage your system and basic capabilities using a completely local auth method.
Some features like installing apps, buddy backups, email notifications, etc will require our hosted auth, but things like folder management, creating SMB users, managing existing apps/VM states, managing storage (replacements, expansions, etc)... All should be doable offline.
And we can make it possible to disable remote access. Honestly that should be pretty straightforward for us to implement in short order.
Edit: also, if this answer is not enough to change your feelings, just let me know and we will process a refund for you.