On the Hardware

This post is originally wrote earlier this year, back then I bought an used HP EliteDesk 705 G4 Mini as a cheap NUC alternative. For its price and availability, I choose this model over Intel NUC but it turned out NUC may be the better option.

It comes with a 4 core 8 thread CPU, Ryzen 5 2400GE with 35W TDP. If set it up as a Proxmox server with enough RAM, it can run about 2-3 VMs to run some light services. But now, my plan is to configure it as a remote portal with RustDesk client.

However, it turned out there are some driver issue with the Vega 11 iGPU for most Linux distros. They just can’t boot to the desktop even for a live/installer environment.

I have tested with common builds like Fedora, Ubuntu, Kali, MX AHS with different DEs and kernels. There are only two distros boot normally, Sparky Linux and Q4OS.

The issue with Q4OS/Lubuntu is that RustDesk can’t auto start its service at login screen which is crucial for my use case. So I end up using LXQt amd64 version of Sparky Linux for the setup.

After Sparky Linux is up and running, I have to run sudo systemctl disable tpm2-abrmd.service to prevent error messages while rebooting because I have TPM set as hidden in my BIOS.

Note: The latest Sparky 8 is still unreliable during my test, so currently 7.8 is my preferred version.

Setup RustDesk Client

Installing RuskDesk on DEB distros are simple, just go to their GitHub release and download x86-64 for Ubuntu package to get the .deb file.

run sudo dpkg -i rustdesk-*-x86_64.deb and then sudo apt-get -f install to install the package with all dependencies if needed.

Open fresh installed RuskDesk client, harden the configurations like disable lan discovery, disable ipv6 direct connection and other settings in security page. For the network settings, I have my own RustDesk server to be used.

Note: lately RustDesk has banned the connection via its public server without logged in. Therefore, using a self-hosted server is needed in the case of having difficulty logging in to an account.

Resolution Optimization

Instead of using RustDesk built-in allow linux headless which supports only 1024x768 resolution, install apt install xserver-xorg-video-dummy to get 1920x1080 resolution while remote accessing

and sudo nano /usr/share/X11/xorg.conf.d/xorg.conf

Section "Monitor"
  Identifier "Monitor0"
  HorizSync 28.0-80.0
  VertRefresh 48.0-75.0
  # https://arachnoid.com/modelines/
  # 1920x1080 @ 60.00 Hz (GTF) hsync: 67.08 kHz; pclk: 172.80 MHz
  Modeline "1920x1080_60.00" 172.80 1920 2040 2248 2576 1080 1081 1084 1118 -HSync +Vsync
EndSection

Section "Device"
  Identifier "Card0"
  Driver "dummy"
  VideoRam 256000
EndSection

Section "Screen"
  DefaultDepth 24
  Identifier "Screen0"
  Device "Card0"
  Monitor "Monitor0"
  SubSection "Display"
    Depth 24
    Modes "1920x1080_60.00"
  EndSubSection
EndSection

After reboot without any monitor cable plugged in, everything works as expected!

Encryption

Unlike what I have been doing for other installations, in this setup, the baremetal Linux is not full desk encrypted to prevent lock-out remote access from power loss.

To make it always online even after a power or internet outage, there must be no interruption during its boot process, also it need to setup power-on as after power loss state in BIOS.

Then how to protect sensitive data on the drive? The simpler answer is to use VirtualBox on top of it, where I can setup Disk Encryption for each VM, and/or install Kicksecure/Secureblue with full desk encryption enabled (or Windows with VeraCrypt).

This is necessary even if the device is stay in my friend’s home who I trust. Because during the holiday seasons, there will be people I don’t know could possibly touch this device.

Or in worst case scenario, burglars or other bad actors can raid the house unfortunately this risk has increased considerably recent years. That is why I do encryption for everything at my own place as well. This is not just a paranoid speculation, the recent RAM pricing crisis is real, so do my risks.

Install Virtualbox via package manager or app center to make sure compatibility.

Run sudo usermod -a -G vboxusers <your_username> to ensure permission.

Muon SSH

This is my favorite SSH tool with SFTP built-in that functions well. I need it to access servers and routers within local network and may be repairing things for my friends.

To run muon-ssh on an up-to-date deb distro, install JRE sudo apt install openjdk-21-jre, in my case it’s trixie with 21

Then download portable version and run with java -jar /path/to/.jar (or create a desktop symlink and Open With… - Other Applications - Custom Command - Command line to execute - java -jar)

Note

This may vary on hardware setups and BIOS settings, hibernate/suspend may take down the RustDesk client from being reconnected. So to play safe, disable such functions completely before drop the machine off.