diddyWHAT IT IS
Remote Linux Manager Web Edition turns a spare Raspberry Pi, or any Debian-based machine, into an always-on manager for a small Linux fleet. It sits between doing everything by hand over SSH and learning Ansible, and is aimed at one person looking after up to about 20 machines at home or in a small office.
It's agentless: nothing is installed on the machines you manage. Each one only needs OpenSSH and a user with sudo. It grew out of my desktop Remote Linux Manager, and the battle-tested SSH, snapshot and clone code from that app runs unchanged underneath the new web interface.
What this isn't
This isn't intended to replace Ansible, Puppet, Salt, Cockpit or enterprise fleet-management systems.
It's deliberately aimed at the smaller end of the scale: a handful of Linux machines where installing and maintaining a full configuration-management system feels like overkill.
WHAT IT DOES
- Dashboard: shows which PCs are online, which have updates waiting, and which have drifted from their snapshot. It includes a 24-hour chart and a live, colour-coded activity log, and each tile shows what that PC is doing right now, such as "Rebooting: waiting for it to come back".
- Fleet actions: select one or more PCs, then check status, install updates, install software, run commands (with a list of common ones), send files or scripts, wake, reboot or shut down. Reboots are monitored until the PC comes back.
- Adding PCs: scan the network for machines answering on SSH and add them with one click, or add them by address.
- Snapshots and drift: record the apps you installed plus local users and groups, then see what has changed since. Remove unwanted extras after reviewing the list, or clone one PC's software onto another, with a simulate-first option.
- Monitoring: a quick online check runs every 30 seconds and a full check every 5 minutes, even with no browser open. Wake-on-LAN happens automatically before an action on a sleeping PC.
- History: charts of PCs online and pending updates over 24 hours, 7 days or 30 days, plus a timeline of when each PC was up or down. Every chart exports as CSV or as a PNG image.
- Phone alerts: using the free ntfy app, with no account or phone number, you get one alert when a PC has been offline for 10 minutes and one when it's back. PCs you shut down yourself, and ones you mark as "don't alert", stay quiet.
- Backup and restore: one encrypted file holds the whole fleet: PCs, saved passwords, snapshots and history. You can restore it, or merge it into a new server.
- Security: HTTPS with the server's own certificate authority, or your company's certificate. Anyone on the network can see a read-only monitor view, while managing the fleet needs the admin login. Repeated wrong passwords lock the login out, and the admin view locks itself when idle. SSH passwords are stored encrypted, and SSH host keys are remembered so an impostor machine is refused.
HOW IT'S BUILT
It's a Python 3 web application with a deliberately small, Debian-packaged stack, so the installer can get everything from apt and nothing needs compiling on a Pi.
- Web server: a Flask app served by Cheroot, a lightweight production web server that handles the HTTPS encryption itself, limited to TLS 1.2 and 1.3. There's no Apache or nginx.
- SSH: Paramiko, running my desktop app's original connection, snapshot and clone code.
- Database: SQLite, holding the fleet, snapshots, history and settings in one file.
- Encryption: the Python cryptography library. SSH passwords are stored with Fernet, and backups are sealed with AES-256-GCM using a key derived from your passphrase with scrypt.
- Front end: plain HTML, CSS and JavaScript with the fonts bundled, so there are no frameworks and nothing loads from the internet. The charts are drawn directly in the browser, and the page works on a network with no internet access.
- Service: it runs under systemd as its own unprivileged user.
REQUIREMENTS
- Server: a Debian-based Linux system with systemd, such as Debian 11 or newer, Ubuntu 22.04 or newer, Linux Mint 21 or newer, or Raspberry Pi OS. A Raspberry Pi 4 with an ordinary SD card is plenty; history is recorded sparingly to spare the card.
- Managed PCs: Linux with OpenSSH server and a sudo user. Updates, software installs and snapshots use apt, so they suit Debian-family systems such as Debian, Ubuntu, Mint, Pop!_OS, Zorin and Raspberry Pi OS.
WHAT THE INSTALLER INSTALLS AND CHANGES
- Packages from apt, nothing from pip: python3, python3-flask, python3-cheroot (the web server), python3-paramiko (SSH), python3-cryptography and openssl. It records which ones it added, so uninstalling can remove exactly those.
- A system user called rlm-web, which can't log in. The web server runs as this user, not as root.
- Files:
/opt/rlm-web - the app, replaced on each update
/etc/rlm-web - the settings, the admin login (stored as a hash, not the password itself) and the HTTPS certificates
/var/lib/rlm-web - your fleet database, the encryption key, SSH host keys, and safety copies made before any restore
- A systemd service, rlm-web.service, locked down so it can only write to its own data folder. It can use ports below 1024 without root.
- Optionally, a firewall rule for its port, if the ufw firewall is switched on.
INSTALLER WALKTHROUGH
1. Start it. Copy the zip to the server, unzip it, and run:
sudo ./install.sh
then choose 1) Install.
2. HTTPS. Answer yes (the default) to have the server create its own certificate.
3. Port. With HTTPS on, the web server uses port 443, so addresses need no port number, such as https://limac.local. If 443 is already taken, it suggests 8443 instead. It refuses any port already in use, for example by Apache or Pi-hole. Port 80 is only used if you agree to one extra question: whether plain http:// addresses should be redirected to HTTPS. It only asks if port 80 is free, and a redirect is all port 80 ever does. (If you install without HTTPS, the server uses port 80 instead, or 8080 if that's taken.)
4. Start at boot. Yes runs it as a system service all the time.
5. Admin login. Choose a username (default admin) and a password of at least 8 characters, typed twice. This is the login for the web page, separate from the server's own Linux passwords.
6. Setup runs. It installs the packages, creates the user and folders, copies the app, writes the settings and sets up the service.
7. Certificate. It lists the names and addresses the certificate will cover, such as limac, limac.local and the server's IP. You can add extra names for the server if people reach it another way. It then creates the certificate authority (valid 10 years) and the server certificate (valid 825 days).
8. Done. It starts the service and prints the addresses to open, the certificate authority's fingerprint, and how to trust it on Windows, macOS, Linux and Firefox.
Then open the address, log in, and use Scan network on the Fleet page to add your PCs. Trust the certificate authority once on each computer to stop browser warnings; it can also be downloaded from the Settings page.
THE MENU
Running sudo ./install.sh again brings up the menu:
1) Update the app files, keeping your fleet, port and login
2) Change the port
3) Turn start-at-boot on or off
4) Change the admin username and password
5) Start, stop, restart, see the status or view the recent log
6) Import your fleet from the desktop Remote Linux Manager
7) Uninstall
8) HTTPS: turn it on or off, reissue the certificate after a name or IP change, or use your company's certificate
Most options also work as direct commands, for example:
sudo ./install.sh update
sudo ./install.sh status
sudo ./install.sh logs
UNINSTALLING
Menu option 7 removes the service, app files and settings. It asks separately whether to delete your fleet data and whether to remove the packages it added. Keep the data, and a later reinstall picks your fleet straight back up.