Skip to content

Security

How a device connects

  • Its own key. Each device has a 64-character API key, shown once when you add the device. The service stores only a SHA-256 hash of it. Deleting the device makes the key stop working at once.
  • Encrypted, verified connections. The agent talks to the API over HTTPS (back.kinuxota.com) and keeps a live MQTT connection over TLS (mqtt.kinuxota.com:27202). It checks the servers' certificates. There is no unencrypted mode.
  • Only its own messages. On MQTT a device signs in with its ID and key and may use only its own topics; there is no broadcast topic. MQTT only tells the device that work is waiting; the device then fetches the work over HTTPS with its key.
  • Signed packages. The agent is installed and updated from https://apt.kinuxota.com, whose index is signed. apt checks it with the key in /usr/share/keyrings/kinuxota.gpg, which the package ships.

What the agent can do

The agent runs as root, as the systemd service kinuxota. It runs what your account sends it:

  • shell commands and scripts (as root);
  • apt package installs, updates and removals;
  • its own updates through apt;
  • health and package-list reports.

Anyone who can sign in to your account can run anything on your devices. Protect the account like a root password: a strong, unique password, and Sign out everywhere (Settings > Security) if you think someone else has signed in.

A device's key lets a program act as that device (report results, fetch its commands), not run commands on other devices or sign in to the dashboard. Keep it secret; it is stored readable by root only in /etc/kinuxota/config.json.

Your account

  • Passwords have at least 12 characters (at most 72 bytes) and may not be your username or email; the server checks this when you sign up, change or reset it. A few unrelated words make a good one. Passwords are stored as bcrypt hashes. Your email and name are stored encrypted.
  • Sign-in uses cookies only (httpOnly, SameSite=Lax): a 15-minute access token and a refresh token that lasts 24 hours, or 7 days with Remember me.
  • After 3 failed sign-ins for the same account from the same address in 15 minutes, further attempts are refused for a while.
  • Changing or resetting your password signs out your other sessions. A reset link is valid for 1 hour; a verification link for 24 hours.

Data handling

Data Kept
Commands and their output until you delete the device or the account
Script runs and their output until you delete the account (also after the script is deleted)
Script files no script uses any more removed after 1 day
Secret parameter values not kept once the devices have received them; ****** in output
Health reports not stored; shown when you ping a device
Usage analytics raw events 90 days, daily counts 13 months

Settings > Profile > Download my data exports your account's data as JSON. Settings > Deletion > Delete Account deletes the account and its devices, commands, output, package lists, scripts, runs and files.

Report a problem

Found a security problem? Email [email protected] and do not publish it before it is fixed.