Moxa Industrial Linux 3.1 (Debian 11)
Manual for Arm-based Computers
Version 1.1, May 2024

www.moxa.com/products© 2024 Moxa Inc. All rights reserved.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based
Computers
The software described in this manual is furnished under a license agreement and may be used only in accordancewith the terms of that agreement.

Copyright Notice© 2024 Moxa Inc. All rights reserved.

Trademarks
The MOXA logo is a registered trademark of Moxa Inc.
All other trademarks or registered marks in this manual belong to their respective manufacturers.

Disclaimer
•
•

•

•

Information in this document is subject to change without notice and does not represent a commitment
on the part of Moxa.
Moxa provides this document as is, without warranty of any kind, either expressed or implied, including,but not limited to, its particular purpose. Moxa reserves the right to make improvements and/orchanges to this manual, or to the products and/or the programs described in this manual, at any time.
Information provided in this manual is intended to be accurate and reliable. However, Moxa assumes noresponsibility for its use, or for any infringements on the rights of third parties that may result from its
use.
This product might include unintentional technical or typographical errors. Changes are periodicallymade to the information herein to correct such errors, and these changes are incorporated into new
editions of the publication.

Technical Support Contact Informationwww.moxa.com/support

Table of Contents
1.

Introduction .........................................................................................................................................6
Moxa Industrial Linux 3 .......................................................................................................................... 6
Secure and Standard Models ................................................................................................................... 6

2.

Eligible Computing Platforms ................................................................................................................... 7
Getting Started .....................................................................................................................................8
Connecting to the Arm-based Computer ................................................................................................... 8Connecting through the Serial Console .............................................................................................. 8Connecting via the SSH ................................................................................................................. 11
Managing User Accounts ....................................................................................................................... 14
Default User Account and Password Policy ....................................................................................... 14
Creating and Deleting User Accounts .............................................................................................. 14
Modifying User Accounts ............................................................................................................... 15
Changing the Password ................................................................................................................. 15
Querying the System Image Version ...................................................................................................... 15
Querying the Device Information ........................................................................................................... 16
Determining Available Drive Space ........................................................................................................ 16

3.

Shutting Down the Device..................................................................................................................... 16
Device Configuration ..........................................................................................................................17
Bootloader Configuration ...................................................................................................................... 17
Accessing the Bootloader Configuration Menu .................................................................................. 17
Production and Developer Mode ..................................................................................................... 17
Boot Management ........................................................................................................................ 18
Installing the System Image .......................................................................................................... 19
Administrator Password................................................................................................................. 21
Login Policy ................................................................................................................................. 23
Clearing the TPM Module ............................................................................................................... 24
Changing the Default Hostname ............................................................................................................ 25
Localizing Your Arm-based Computer ..................................................................................................... 25
Adjusting the Time ....................................................................................................................... 25
NTP Time Synchronization ............................................................................................................. 25

4.

Setting the Time Zone .................................................................................................................. 27
Using and Managing Computer Interfaces ..........................................................................................29
Moxa Computer Interface Manager (MCIM) ............................................................................................. 29
Device Information .............................................................................................................................. 29
LED Indicators ..................................................................................................................................... 30
Storage and Partitions .......................................................................................................................... 31
Serial Port .......................................................................................................................................... 32
Ethernet Interface ............................................................................................................................... 34
Serial Console Interface........................................................................................................................ 34
Digital Input/Output (DIO) .................................................................................................................... 34
Buzzer................................................................................................................................................ 36
Cellular Module Interface ...................................................................................................................... 36
Wi-Fi Module Interface ......................................................................................................................... 37
Socket Interface .................................................................................................................................. 37
CAN Port ............................................................................................................................................ 38
Configuring the Socket CAN Interface ............................................................................................. 38
CAN Bus Programming Guide ......................................................................................................... 38
Push-button ........................................................................................................................................ 40
Getting the Button List and Status .................................................................................................. 40
Customize the Button Action .......................................................................................................... 40
Configuring the Real COM Mode ............................................................................................................. 41
Mapping TTY Ports ........................................................................................................................ 41
Mapping TTY Ports (automatic) ...................................................................................................... 42
Mapping TTY Ports (manual) .......................................................................................................... 42

5.

Removing Mapped TTY Ports .......................................................................................................... 42
Configuring and Managing Networks ..................................................................................................43
Moxa Connection Manager (MCM) .......................................................................................................... 43
Setting Up MCM with GUI Configurator ................................................................................................... 44

GUI Configurator Overview ............................................................................................................ 44
Cellular and Wi-Fi Failover/Failback ................................................................................................ 48
Checking the Network Status ................................................................................................................ 51
Checking the Interface and Connection Status ................................................................................. 51
Cellular Signal Strength ................................................................................................................ 52
Monitoring the Data Usage ............................................................................................................ 53
Upgrading the Cellular Modem Firmware ................................................................................................. 53
Cellular Network Diagnosis.................................................................................................................... 54
6.

Using API to Retrieve the MCM Status .................................................................................................... 54
System Installation and Update ..........................................................................................................55
Installing Moxa Industrial Linux ............................................................................................................. 55
Using a TFTP Server From Bootloader Menu ..................................................................................... 55
Using a USB/SD From Bootloader Menu .......................................................................................... 55
Automatic Installation From a USB or SD ........................................................................................ 55
Updating Moxa Industrial Linux Using SecureApt ..................................................................................... 56
Querying the System Image Version ............................................................................................... 56
Failback Update ........................................................................................................................... 56
Managing the APT Repository ......................................................................................................... 56
Updating Your System .................................................................................................................. 57
Updating the Bootloader ....................................................................................................................... 58
Querying the Current Bootloader Version ........................................................................................ 58
Updating Bootloader With the Firmware Binary ................................................................................ 58

7.

Updating with the Failback Function Enabled .................................................................................... 58
Backup, Decommission, and Recovery ................................................................................................59
Creating a System Snapshot ................................................................................................................. 60
Creating a System Backup .................................................................................................................... 60
Setting the System to the Default .......................................................................................................... 62
Decommissioning the System ................................................................................................................ 62
System Failback Recovery .................................................................................................................... 63

8.

Customize the Boot Up Failure Criteria ............................................................................................ 64
Security Capability ..............................................................................................................................65
Communication Integrity and Authentication ........................................................................................... 65
User Account Permissions and Privileges ................................................................................................. 65
Switching to the Root Privilege ....................................................................................................... 65
Controlling Permissions and Privileges............................................................................................. 66
Linux Login Policy ................................................................................................................................ 67
Invalid Login Attempts .................................................................................................................. 67
Session Termination After Inactivity ............................................................................................... 67
Login Banner Message .................................................................................................................. 67
Bootloader Login Policy ........................................................................................................................ 67
Secure Boot and Disk Encryption ........................................................................................................... 68
Trusted Platform Module (TPM 2.0) ........................................................................................................ 68
Host Intrusion Detection ....................................................................................................................... 69
Default Monitored Files ................................................................................................................. 69
How to Perform Authenticity an Integrity Check on All Files ............................................................... 70
Intrusion Prevention............................................................................................................................. 71
Network Security Monitoring ................................................................................................................. 71
Firewall .............................................................................................................................................. 73
Pre-configured Rule ...................................................................................................................... 73
Common nftable Usage ................................................................................................................. 74
Rate Limiting ............................................................................................................................... 75
Mitigating a NTP Amplification Attack .............................................................................................. 76
Service and Ports................................................................................................................................. 76
Managing Resources ............................................................................................................................ 78
Audit Log ............................................................................................................................................ 80
Linux Audit log ............................................................................................................................. 80
Bootloader Audit Log .................................................................................................................... 82
Audit Failure Response .................................................................................................................. 83
Security Diagnosis Tool (Moxa Guardian) ................................................................................................ 84
Diagnosing Issues in the Current Security Configuration.................................................................... 84

9.

Restoring the Security Configuration to the Default .......................................................................... 86
Security Hardening Guide ...................................................................................................................87
Defense-in-depth Strategy .................................................................................................................... 87
Installation ......................................................................................................................................... 89
Physical Installation ...................................................................................................................... 89
Environment Requirement ............................................................................................................. 89
Access Control ............................................................................................................................. 89
Security Configuration Check ......................................................................................................... 90
Operation ........................................................................................................................................... 90
Maintenance ....................................................................................................................................... 91

10.

Decommissioning................................................................................................................................. 91
Customization and Programming ........................................................................................................92
MIL1 (Debian 9) to MIL3 (Debian 11) Migration ....................................................................................... 92
Building an Application ......................................................................................................................... 93
Introduction ................................................................................................................................ 93
Native Compilation ....................................................................................................................... 93
Cross Compilation ........................................................................................................................ 93
Example Program—hello ............................................................................................................... 94
Example Makefile ......................................................................................................................... 95
Creating a Customized Image ............................................................................................................... 96
Introduction ................................................................................................................................ 96

A.

Using System Snapshots and Backups ............................................................................................ 96
Software Process List .........................................................................................................................97

1. Introduction

Moxa Industrial Linux 3
Moxa Industrial Linux 3 (MIL3) is an industrial-grade Linux distribution developed and maintained by Moxa
to address the security, reliability, and long-term support needs of industrial automation systems such astransportation, energy, oil and gas, and manufacturing.
MIL3 is based on Debian 11 with kernel 5.10 and integrated with several feature sets designed tostrengthen and accelerate user application development as well as ensure system reliability and security.

Secure and Standard Models
MIL3 provides two security levels in the form of standard and secure models. The standard models comewith the default Debian 11 security configuration and is for users who prefer the flexibility to build their own
security solutions. The secure models of Moxa’s Arm-based computers are secure-by-default and certified
for IEC 62443-4-2 SL2 (security level 2). They come with Secure Boot, pre-defined security configuration,
and additional security tools/utilities preinstalled
To identify the security model that you have, use the mx-interface-mgmt deviceinfo command to display the
information. Only the secure models will have SECUREBOOT enabled.

moxa@moxa-tbzkb1090923: ~# mx-interface-mgmt deviceinfo
SERIALNUMBER=TBBBB1182827
MODELNAME=UC-8220-T-LX-US-S
SECUREBOOT=Enabled
The following table compares the main features in the standard and secure models.
Standard Model
IEC 62443-4-2 SL2 Host Device
Certified
Security Configuration
Secure Boot
AppArmor and SELinux Support

Secured Model

N/A

Default Debian configuration
N/A

IEC 62443-4-2 SL-2 Certified

Boot from SD or USBDisk Encryption
Install Image via TFTP
Secure Image Installation
Secure Update

N/A

N/A


N/A (SD/USB is not secure as aboot source)
N/A (TFTP is not a secure protocol)Intrusion Prevention
Network Security Monitoring (AIDE preinstalled without predefined monitoring database) (Fail2ban)
 (Zeek)

Firewall (nftable disabled by default)

Security Diagnosis Tool
(Moxa Guardian)

N/A (Audit service disabled bydefault) (Audit service configured andrunning) (Moxa System Management) (Moxa System Management)

Intrusion Detection

Security Event Audit Log
TPM 2.0
Backup, Decommission andRecovery
Network Management

 (AIDE with security monitoring
database pre-defined) (Fail2ban)
 (Zeek) (nftable with pre-configured
security policy) (Moxa Connection Management)  (Moxa Connection Management)

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

6Computer Interface Management

Standard Model (Moxa Computer Interface
Manager)

Secured Model (Moxa Computer Interface
Manager)

Eligible Computing Platforms
This user manual is applicable to Moxa’s Arm-based computers listed below and covers the complete set of
instructions applicable to all the supported models. Detailed instructions on configuring advanced settings
are covered in Chapter 3 to Chapter 6 of the manual.
You can order Moxa Arm-based computers with MIL3 preinstalled via the Moxa Computer Configuration
System (CCS) using following model names:
Arm-based Computer Series

UC-8200 Series

UC-1200A Series
UC-2200A Series

CTO Model Name
UC-8210-T-LX-S (CTO)
UC-8220-T-LX (CTO)
UC-8220-T-LX-US-S (CTO)
UC-8220-T-LX-EU-S (CTO)
UC-8220-T-LX-AP-S (CTO)
UC-8200 (CTO)
UC-1200A (CTO)
UC-2200A (CTO)

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers7

2. Getting Started

Connecting to the Arm-based Computer
You will need another computer to connect to the Arm-based computer and log on to the command line
interface. There are two ways to connect: locally through serial console or ethernet cable, or remotely via
Secure Shell (SSH). Refer to the Hardware Manual to see how to set up the physical connections.
For default login username and password, please reference the Default Credentials and Password Strength.
The username and password are the same for all serial console and SSH remote log in actions. Root accountlogin is disabled until you manually create a password for the account. The user moxa is in the sudo groupso you can operate system level commands with this user using the sudo command. For additional details,
see the Sudo Mechanism section in Chapter 7.

ATTENTION
For security reasons, we highly recommend that you disable the default user account and create your own
user accounts.

Connecting through the Serial Console
This method is particularly useful when using the computer for the first time. The signal is transmitted overa direct serial connection, so you do not need to know either of its two IP addresses in order to connect to
the Arm-based computer. To connect through the serial console, configure your PC’s terminal software using
the following settings.
Serial Console Port Settings
Baudrate
115200 bps
ParityNone
Data bits
8
Stop bits
1
Flow Control
None
Terminal
VT100
Below we show how to use the terminal software to connect to the Arm-based computer in a Linux
environment and in a Windows environment.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

8Linux Users
NOTE
These steps apply to the Linux PC you are using to connect to the Arm-based computer. Do NOT apply
these steps to the Arm-based computer itself.
Take the following steps to connect to the Arm-based computer from your Linux PC.
1.

Install minicom from the package repository of your operating system.
For Centos and Fedora:

user@PC1:~# yum -y install minicom
For Ubuntu and Debian:2.

user@PC2:~# apt install minicom

Use the minicom –s command to enter the configuration menu and set up the serial port settings.

user@PC1:~# minicom -s

3.

Select Serial port setup.

4.

Select A to change the serial device. Note that you need to know which device node is connected to the
Arm-based computer.

5.

Select E to configure the port settings according to the Serial Console Port Settings table provided.

6.

Select Save setup as dfl (from the main configuration menu) to use default values.

7.

Select Exit from minicom (from the configuration menu) to leave the configuration menu.

8.

Execute minicom after completing the above configurations.

user@PC1:~# minicom

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers9Windows Users
NOTE
These steps apply to the Windows PC you are using to connect to the Arm-based computer. Do NOT apply
these steps to the Arm-based computer itself.
Take the following steps to connect to the Arm-based computer from your Windows PC.
1.

Download PuTTY http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html to set up a serial
connection with the Arm-based computer in a Windows environment. The figure below shows a simple
example of the configuration that is required.

2.

Once the connection is established, the following window will open.

3.

Select the Serial connection type and choose settings that are similar to the Minicom settings.

4.

Enable VT100 line drawing option for the MCM GUI configurator to show correctly.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

10

Connecting via the SSH
The Arm-based computer supports SSH connections remotely or over an Ethernet network. If you areconnecting the computer using an Ethernet cable, refer to the following IP addresses information
Ethernet Port

Configuration

LAN 1 (*)

DHCP (DHCP client)

LAN 2

Static IP

IP Address
Assigned by DHCP server. Link-local IP addresses will be assigned
when DHCP server is not available
192.168.4.127*LAN 1 is by default for DHCP/link-local IP configuration and is managed by Moxa Connection Manger(MCM).

NOTE
Be sure to configure the IP address of your notebook/PC's Ethernet interface on the same subnet as the
LAN port of Arm-based computer you plan to connect to. For example, 192.168.4.126 for LAN2.

Linux Users
NOTE
These steps apply to the Linux PC you are using to connect to the Arm-based computer. Do NOT apply
these steps to the Arm-based computer itself.
Use the ssh command from a Linux computer to access the computer’s LAN2 port.

user@PC1:~ ssh moxa@192.168.4.127
Type yes to complete the connection.

The authenticity of host ‘192.168.4.127’ can’t be established.
RSA key fingerprint is 8b:ee:ff:84:41:25:fc:cd:2a:f2:92:8f:cb:1f:6b:2f.
Are you sure you want to continue connection (yes/no)? yes_
To connect using LAN1, you need to use the IP offered by DHCP server from LAN1.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

11

ATTENTION
Regenerate SSH key regularly
In order to secure your system, we suggest doing a regular SSH-rekey, as shown in the following steps:

Select “keep the local version currently installed” following is prompt during rekey process

For more information about SSH, refer to the following link.
https://wiki.debian.org/SSH

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers12Windows Users
NOTE
These steps apply to the Windows PC you are using to connect to the Arm-based computer. Do NOT apply
these steps to the Arm-based computer itself.
Take the following steps from your Windows PC.
Click on the link http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html to download PuTTY(free software) to set up an SSH console for the Arm-based computer in a Windows environment. The
following figure shows a simple example of the configuration that is required.

Enable VT100 line drawing option for the MCM GUI configurator to show correctly

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

13

Managing User Accounts
Default User Account and Password Policy
The default login username and password of Moxa Industrial Linux are both moxa for the first-time login.
You will be prompted to set a new password before you can continue to login.
•

Default Username: moxa•

Default Password: moxa

Password Strength Requirements:•

At least 8 characters in length•

Dictionary checking is enabled to prevent the use of common passwords

To modify the password strength policy, edit the /etc/security/pwquality.conf.d/00-moxa-standardpwquality.conf file to configure the policy.

NOTE
Click the following link for more information on the password strength configuration.
https://manpages.debian.org/bullseye/libpwquality-common/pwquality.conf.5.en.html
For bootloader administrator password configuration, refers to the bootloader configuration section.

Creating and Deleting User Accounts
ATTENTION
DO NOT disable the default account before creating an alternative user account.
You can use the useradd and userdel commands to create and delete user accounts. Be sure toreference the main page of these commands to set relevant access privileges for the account. Following
example shows how to create a test1 user in the sudo group whose default login shell is bash and hashome directory at /home/test1:

moxa@ moxa-tbzkb1090923:~# sudo useradd -m -G sudo -s /bin/bash test1
To change the password for test1, use the passwd option along with the new password. Retype thepassword to confirm the change.

moxa@moxa-tbzkb1090923:~# sudo passwd test1
New password:
Retype new password:
passwd: password updated successfully
To delete the user test1, use the userdel command.

moxa@ moxa-tbzkb1090923:# sudo userdel test1

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

14

Modifying User Accounts
You can use the usermod commands to create and modify the user account settings. Some examples ofcommonly used settings are listed here, including adding a user to a group, locking an account, activating
an account and setting the password expiration date for the account.
1.

Adding user test1 to the user group Moxa

2.

Disabling or locking the user account test1

moxa@ moxa-tbzkb1090923:# sudo usermod -a -G Moxa test1
moxa@ moxa-tbzkb1090923:# sudo usermod -L test1
3.

Activating the user account test1

moxa@ moxa-tbzkb1090923:# sudo usermod -U test1
4.

Set a password expire date of 2023-11-01 for the user account test1.

moxa@ moxa-tbzkb1090923:# sudo usermod -e 2023-11-01 test1

NOTE
Refers to below link for complete usage of usermod
https://linux.die.net/man/8/usermod

Changing the Password
You can use the passwd commands to change the password of a user account. Changing the password will
not have any impact on other functionalities.
An example of changing the password for user account test1.

moxa@ moxa-tbzkb1090923:# sudo passwd test1
New password:
Retype new password:
passwd: password updated successfully

Querying the System Image Version
Use the mx-ver command to check the system image version on your Arm-based computer.

moxa@moxa-tbzkb1090923:# mx-ver
UC-8220-T-LX-US-S MIL3 version 1.0 Build 22052300
moxa@moxa-tbzkb1090923:# mx-ver -hUsage: mx-ver [OPTION]-a: show product information inline-b: show the build time
-m: show the model name-v: show the image version-A: show all information-M: show the MIL version-o: show the image option code
-h: show the help menu

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

15

Querying the Device Information
Use the # mx-interface-mgmt deviceinfo command to retrieve general information for your Moxa
Arm-based Computer
Command and Usagedeviceinfo

Description
Shows the following device information:•
Serial number (S/N)•
Model name•
SECUREBOOT (Enabled/Disabled)

moxa@moxa-tbbbb1182827:~$ mx-interface-mgmt deviceinfo
SERIALNUMBER=TBBBB1182827
MODELNAME=UC-8220-T-LX-US-S
SECUREBOOT=Enabled

Determining Available Drive SpaceTo determine the amount of available drive space, use the df command with the –h option. The system will
return the amount of drive space broken down by file system. Here is an example:

moxa@moxa-tbzkb1090923:~$ sudo df -hFilesystem
devtmpfs
tmpfs/dev/mmcblk0p2/dev/mmcblk0p3/dev/mmcblk0p4/dev/loop0
overlay/dev/mmcblk0p1
tmpfs
tmpfs
tmpfs
tmpfs

Size
485M
497M
984M
5.9G
240M
147M
5.9G
54M
497M
5.0M
497M
100M

Used
0
7.1M
150M
39M
2.8M
147M
39M
15M
0
0
0
0

Avail
485M
490M
780M
5.5G
221M
0
5.5G
36M
497M
5.0M
497M
100M

Use%
0%
2%
17%
1%
2%
100%
1%
30%
0%
0%
0%
0%

Mounted on
/dev
/run
/boot_device/p2/boot_device/p3/var/log/boot_device/p2/lower//boot_device/p1/dev/shm/run/lock/sys/fs/cgroup/run/user/1000

Shutting Down the Device
To shut down the computer, first disconnect the power source. When the computer is powered off, main
components such as the CPU, RAM, and storage devices are powered off, although an internal clock may
retain battery power.
You can use the Linux command shutdown to close all software running on the device and halt the system.
However, main components such as the CPU, RAM, and storage devices will continue to be powered after
you run this command.

moxa@moxa-tbzkb1090923: ~# sudo shutdown -h now

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

16

3. Device Configuration

In this chapter, we describe how to configure the basic settings of Moxa Arm-based computers, including
using the bootloader menu, configuring the network connections and power-saving settings, and localizing
the computer. The instructions in this chapter cover all functions supported in Moxa Arm-based computers.
Before referring to the sections in this chapter, ensure that they are applicable to and are supported by the
hardware specification of your Arm-based computer.

Bootloader Configuration
Accessing the Bootloader Configuration Menu
To access bootloader menu, you must first connect to Moxa Arm-based computer via its serial console port.
After powering on the Arm-based computer, press Ctrl + Backspace or DEL to enter the bootloader
configuration menu

NOTE
If you cannot enter the bootloader menu by pressing <DEL>, replace the PuTTy tool with the Tera Termterminal console tool (detailed information is available at: https://ttssh2.osdn.jp/index.html.en.)---------------------------------------------------------------------------Model: UC-8220-T-LX-US-S
Boot Loader Version: 3.0.0S04
Build date: May 13 2022 - 14:23:10
Serial Number: TBBBB1182827
LAN1 MAC: 00:90:E8:A6:37:E1
LAN2 MAC: 00:90:E8:A6:37:E2---------------------------------------------------------------------------(0) Boot Management(1) Install System Image(2) Admin Password(3) Advance Setting(4) Exit and Reboot(5) Go To Linux----------------------------------------------------------------------------

Production and Developer Mode
The configurable options and operations in bootloader menu of Standard and Secure model are different for
security consideration. Below is an overview of configuration options provided in Bootloader.
The Secure Model’s bootloader menu has two modes (Production and Developer mode) where theProduction Mode is the default mode with security configuration configured to comply with IEC 62443-4-2
security level 2 standard. Developer Mode provides addition operation and configuration that should only
be used during development stage or maintenance.
For Secure Model, the administrator password to access bootloader menu is set by default. The Default
Administrator Password is the unique Serial Number(S/N) printed on the sticker of Moxa Arm-based
computer1.

To switch to Developer Mode, run mx-bootloader-mgmt mode developer

root@moxa-tbbbb1182827:/# mx-bootloader-mgmt mode developer
Set device into developer mode Done
Mode info: prod_mode=1
root@moxa-tbbbb1182827:/# reboot

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

17

2.

To switch to Production Mode, use mx-bootloader-mgmt mode production

root@moxa-tbbbb1182827:/# mx-bootloader-mgmt mode production
Set device into production mode Done
Mode info: prod_mode=0
root@moxa-tbbbb1182827:/# reboot

3.

Reboot computer for setting to take effect4.

To check the current mode, run mx-bootloader-mgmt mode info

An overview of bootloader configuration options is listed in the following table:
Main Menu

Sub Menu

Main Menu

Sub Menu(0) Set to Default(1) Boot Option(0) Boot Management(2) Advance Boot Option(3) View Current Setting(0) Install System Image from TFTP
(1) Install System Image from SD(1) Install System
Image(2) Install System Image from USB(3) TFTP Settings(0) Set to Default(2) Admin Password(3) Advance Setting(3) Exit & Reboot(4) Go to Linux

Secure Model
Production
Developer
Mode
Mode
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A

N/A





N/A



(1) Enable/Disable Admin Password (enabled) (enabled)(2) Configure Admin Password(3) Configure Admin Password Policy(0) Set to Default(1) Configure Auto Reboot(2) Configure Login Message(3) Configure Invalid Login Attempts(4) Clear TPM(5) View Bootloader log
–
–









 (enabled)


N/A



 (enabled)






N/A

N/A

Standard Model
Production Mode









 (disabled bydefault) (disabled)







Boot Management
Boot Option
By default, Moxa Arm-based computers boot up from the embedded eMMC flash. Some models also provide
an option to boot up from an external SD or USB.
The following is an example of changing first boot priority to SD card and setting the secondary boot option
to SD card if the first option fails to boot.
1.

Select (0) Boot Management > (1) Boot Option

2.

Choose to first boot from an external storage.

3.

Choose if the embedded storage should be disabled.
If the embedded storage is disabled, Moxa Arm-based computers will only attempt to boot from the SD
card. If embedded storage is set to eMMC, the computers will try to boot from SD; if that fails, they willboot from eMMC.

4.

Set the External Storage to the SD card---------------------------------------------------------------------------Model: UC-8220-T-LX-US-S
Boot Loader Version: 3.0.0S04
Build date: May 13 2022 - 14:23:10
Serial Number: TBBBB1182827
LAN1 MAC: 00:90:E8:A6:37:E1
LAN2 MAC: 00:90:E8:A6:37:E2---------------------------------------------------------------------------(0) Boot Management(1) Install System Image(2) Admin Password(3) Advance Setting

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers18

(4) Exit and Reboot(5) Go To Linux---------------------------------------------------------------------------Command>>1
Boot Management : Default
Boot Order : Embedded First
Embedded Storage : eMMC
External Storage : Disabled
Would you like to configure the Boot Option?
0 - No, 1 - Yes (0-1, Enter to abort): 1
Set Boot Order:
0 - Embedded First, 1 - External First (0-1, Enter to abort): 1
Set Embedded Storage:
0 - Disabled, 1 - eMMC (0-1, Enter to abort): 1
Set External Storage:
0 - Disabled ,1 - SD (0-1, Enter to abort): 1
The table below lists all possible combinations of boot options configuration and the corresponding bootactionSet Boot Order
0 – Embedded First
1 – External FirstSet Embedded Storage Set External Storage
1 – eMMC
0 – Disabled
0 – Disabled
1 – SD or 2 – USB

0 – Embedded First

1 – eMMC

1 – SD or 2 – USB

1 – External First

1 – eMMC

1 – SD or 2 – USB

Boot Action
Boot from eMMC
Boot from the external storage
First boot from eMMC; if it fails,boot from the external storage
Boot from the external storage; if
this fails, boot from eMMC

Advance Boot Option
Allow advanced users to edit the bootargs and bootcmd parameters to customize the boot process.
•bootargs: Used to tell the kernel how to configure various device drivers and where to find the root
filesystem.

•bootcmd: Bootloader will execute the commands listed sequentially. Commands should be separated
by semicolons.

Installing the System Image
Installing System Image From TFTP
1.

Prepare a TFTP server2.

Set up a TFTP server.

3.

Make sure the image (*.img) file is in your TFTP server directory.

IMPORTANT!
Use this method to install a system image on your computer if the size of the image file is less than 2 GB.
If the file size is larger than 2 GB, use the SD card or USB to install the system image.
4.

Select Install System Image > TFTP Settings and configure the following: The LAN port to be used for TFTP transfer
 Local IP address of LAN port
 TFTP server IP

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

19

5.

Press ESC to exit and select Install System Image from TFTP.
If you want to change the TFTP IP address, enter 1 to set up the local LAN port IP address and the TFTP
server IP address, and then choose an image (*.img) file.

Current IP Address
Local IP Address : 192.168.1.2
Server IP Address : 192.168.2.3
Using LAN2 to download data.
Do you want to change the ip address?
0 - No, 1 - Yes(0-1, Enter to abort):1
Local IP Address : 192.168.31.134
Server IP Address : 192.168.31.132
Saving Environment to SPI Flash...
Erasing SPI flash...Writing to SPI flash...done
Valid environment: 2
System Image File Name (system image.img): IMG_UC-8200_MIL3_V1.0.img
6.

After the system image installation process is complete, unplug the power supply and reboot thesystem.

7.

After rebooting the system, you can use the following command to check if the system image is up-todate.

moxa@moxa-tbzkb1090923:# sudo mx-ver
UC-8220-T-LX-US-S MIL3 version 1.0 Build 22052300

Installing the System Image From SD or USB
The system image on the Moxa Arm-based computers can be installed through an external SD or USB disk.
Prepare a USB or SD disk in the FAT32 or ext4 format with the system image and plug it into the USB or SD
port of the computer.
1.

Select Install System Image > Install System Image from SD or Install System Image fromUSB

2.

Type in the system image file name.

---------------------------------------------------------------------------Model: UC-8220-T-LX-US-S
Boot Loader Version: 3.0.0S04
Build date: May 13 2022 - 14:23:10
Serial Number: TBBBB1182827
LAN1 MAC: 00:90:E8:A6:37:E1
LAN2 MAC: 00:90:E8:A6:37:E2---------------------------------------------------------------------------(0) Install System Image from TFTP
(1) Install System Image from SD(2) Install System Image from USB(3) TFTP Settings---------------------------------------------------------------------------Command>>2
System Image File Name (system image.img): IMG_UC-8200_MIL3_V1.0.img

NOTE
Make sure to put the hash file of the system image in the same folder as image as integrity validationis required
3.

After the system image installation process is complete, unplug the power supply and reboot thesystem.

4.

After rebooting the system, you can use the following command to check if the system image is up-todate.

moxa@moxa-tbzkb1090923:# sudo mx-ver
UC-8220-T-LX-US-S MIL3 version 1.0 Build 22052300

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

20

Administrator Password
Enabling/Disabling Admin Password
For the Secure Model, the administrator password to access bootloader menu is set by default. The
Default Administrator Password is the unique Serial Number(S/N) printed on the sticker of Moxa Armbased computer.
For Standard Model, the bootloader menu is not protected by password by default. To enhance thesecurity of your Moxa Arm-based computer, it is strongly recommended to setup an administrator password
if there is physical unauthorized access is possible. To setup an administrator password, follow the below
procedures:1.

Select Admin Password > Enable/Disable Admin Password.

2.

Select 1 to setup an administrator password. If 0 (disable) is selected, the currently set password will
be cleared.

3.

Enter the password you would like to set twice; the password strength requirement is at least 8
characters in length.

---------------------------------------------------------------------------Model: UC-8220-T-LX-US-S
Boot Loader Version: 3.0.0S04
Build date: May 13 2022 - 14:23:10
Serial Number: TBBBB1182827
LAN1 MAC: 00:90:E8:A6:37:E1
LAN2 MAC: 00:90:E8:A6:37:E2---------------------------------------------------------------------------(0) Set to Default(1)Enable/Disable Admin Password(2) Configure Admin Password(3)Configure Admin Password Policy---------------------------------------------------------------------------Command>>2
Current Mode: Disabled
0 - Disable, 1 - Enable (0-1, Enter to abort): 1
The current password is empty, please set one.
Enter the Administrator password
Enter current password: ********
Admin Password Policy:- Minimum length: 8Enter new password: ********
Retype password: ********
Password set successfully
Password status : Enabled.
4.

Once Administrator password is set, password authentication is required when accessing bootloader
menu.

DRAM: 1 GiB
MMC:OMAP SD/MMC: 0, OMAP SD/MMC: 1, OMAP SD/MMC: 2
Net:
cpsw0, cpsw1
Non-security model.
Model: 0x02
2.0 TPM (device-id 0x15D1, rev-id 16)
TPM2 Init OK!
TPM2 Startup (1) OK!
Press <DEL> To Enter BIOS configuration SettingEnter the Administrator password
Enter current password: ********

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

21

WARNING
It is important to save the password in a secure location. If the password is lost and access to bootloader
menu is needed, you will have to contact Moxa technical support to send your Arm-based computer to
Moxa for password reset.

Configuring the Admin Password Policy
To change the administrator password, select Admin Password > Configure Admin Password andfollows the on-screen instructions. Changing the password will not have any impact on functionalities.

---------------------------------------------------------------------------Model: UC-8220-T-LX-US-S
Boot Loader Version: 3.0.0S04
Build date: May 13 2022 - 14:23:10
Serial Number: TBBBB1182827
LAN1 MAC: 00:90:E8:A6:37:E1
LAN2 MAC: 00:90:E8:A6:37:E2---------------------------------------------------------------------------(0) Set to Default(1)Enable/Disable Admin Password(2) Configure Admin Password(3)Configure Admin Password Policy---------------------------------------------------------------------------Command>>3
Current setting:
Admin Password Policy:- Minimum length: 8********************************************************************************
Do you want to configure admin password policy setting?
********************************************************************************
0 - No, 1 - Yes (0-1, Enter to abort): 1- Minimum length (6-16, Enter to abort): 6- Minimum numeric numbers (0-16, Enter to abort): 1- Minimum lowercase or uppercase letters combined (0-16, Enter to abort): 1

Minimum Length
Setting
Input from 6 to 16

Description
It allows users to decide the minimum length of thepassword.

Factory Default
8

Minimum Numeric Numbers
Setting
Input from 0 to 16

Description
It allows users to decide the minimum of numeric numberthat the password must contain

Factory Default
0

Minimum Lowercase or Uppercase Letters Combined
Setting
Input from 0 to 16

Description
It allows users to decide the minimum letters (lowercase or
uppercase combined) that the password must contain.

Factory Default
0

Configuring Admin Password
To change the administrator password, select Admin Password > Configure Admin Password andfollows the on-screen instructions

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

22

Resetting the Admin Password to Default
If you lost your password, follow the below steps to reset the password to the factory default
1.

After powering on the Arm-based computer, press Ctrl + Backspace or DEL to enter the Bootloader
configuration menu that prompts for a password.

DRAM: 1 GiB
MMC:OMAP SD/MMC: 0, OMAP SD/MMC: 1, OMAP SD/MMC: 2
Net:
cpsw0, cpsw1
Non-security model.
Model: 0x02
2.0 TPM (device-id 0x15D1, rev-id 16)
TPM2 Init OK!
TPM2 Startup (1) OK!
Press <DEL> To Enter BIOS configuration SettingEnter the Administrator password
Enter current password:2.

Immediately press and hold the FN button on the Moxa Arm-based computer for over 5 seconds will
trigger the password reset process. You must complete this step within 10 seconds after step one forthe reset process to initiate.

Login Policy
Invalid Login Attempts
This determines the maximum consecutive failure login attempts allowed during the specified time
period and the duration to block users from accessing bootloader configuration menu when failure login
attempts and time period is over the defined threshold.
To configure this policy, select Advance Setting > Configure Invalid Login Attempts and follow the onscreen instructions.

---------------------------------------------------------------------------Model: UC-8220-T-LX-US-S
Boot Loader Version: 3.0.0S04
Build date: May 13 2022 - 14:23:10
Serial Number: TBBBB1182827
LAN1 MAC: 00:90:E8:A6:37:E1
LAN2 MAC: 00:90:E8:A6:37:E2---------------------------------------------------------------------------(0) Set to Default(1) Configure Auto Reboot(2) Configure Login Message(3) Configure Invalid Login Attempts(4) View Bootloader log---------------------------------------------------------------------------Command>>3
Current setting: [5] consecutive invalid login within [60] seconds will reboot
and disable access to bootloader menu for [300] seconds.
********************************************************************************
Do you want to configure the invalid login attempts setting?
********************************************************************************
0 - No, 1 - Yes (0-1, Enter to abort): 1
Input 0 to any of the configuration below will disable invalid login check
Consecutive invalid login attempts (0-5, Enter to abort):
Within how many seconds (0-60, Enter to abort):
Disable access for how many seconds (0-900, Enter to abort):

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers23Consecutive Invalid Login Attempts
Configuration

Setting

Consecutive invalid login attempts

Input from 0 to 5

Within how many Seconds

Input from 0 to 60

Disable access for how many seconds

Input from 0 to 900

Factory Default
0 (Standard model)
5 (Secure model)
0 (Standard model)
60 (Secure model)
0 (Standard model)
300 (Secure model)

NOTE
Input 0 to any of the above configuration will disable the invalid login check.

Auto Reboot After Inactivity
This determines the time period for auto reboot when users do not do any action.
To set the time period, select (2) Advance Setting > (1) Configure Auto Reboot and follow the onscreen instructions.
Setting
Input from 0 to 900(seconds)

Description
This determines the time period for auto reboot when users
do not do any action

Factory Default
0 (Standard model)
900 (Secure model)

Login Banner Message
This allows users to customize the login message before prompting the administrator password.
To configure the message, select Advance Setting > Configure Login Message and follow the on-screen
instructions.

U-Boot 2020.04-ga174fe3ef0-dirty (May 13 2022 - 14:23:01 +0800)
DRAM: 2 GiB
PMIC: PFUZE3000 DEV_ID=0x31 REV_ID=0x11
MMC:
FSL_SDHC: 0, FSL_SDHC: 2
Loading Environment from SPI Flash... SF: Detected mx25l12805d with page size
256 Bytes, erase size 64 KiB, total 16 MiB
OK
In:
serialOut:
serialErr:serial
SEC0: RNG instantiatedNet:
eth0: ethernet@30be0000 [PRIME]Get shared mii bus on ethernet@30bf0000
FEC0:1 is connected to ethernet@30be0000. Reconnecting to ethernet@30bf0000, eth1: ethernet@30bf0000
Model: 0x00
Normal Boot
Press <DEL> To Enter BIOS configuration SettingEnter the Administrator password
Enter current password:

Clearing the TPM Module
Clearing the TPM will erases information stored on the TPM. You will lose all created keys and access to dataencrypted by these keys.
To clear the TPM, select Advance Setting > Clear TPM and follow the directions.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers24

Changing the Default Hostname
The default hostname of UC computer with Moxa Industrial Linux 3 is unique for each computer. The
hostname is in a format of moxa-[serial number].
If you would like to change the default hostname, follow the below procedure:
1.

Modify the hostname by editing /etc/hostname

2.

Disable the moxa-hostname service with ‘systemctl disable moxa-hostname’ command. moxahostname is a service designed to execute automatically during system startup, setting the hostname toa default unique value.

3.

Reboot the computer.

Localizing Your Arm-based Computer
Adjusting the TimeThe Arm-based computer has two time settings. One is the system time, and the other is the RTC (RealTime Clock) time kept by the Arm-based computer’s hardware. Use the date command to query the current
system time or set a new system time. Use the hwclock command to query the current RTC time or set a
new RTC time.
Use the date MMDDhhmmYYYY command to set the system time:
MM = Month
DD = Datehhmm = hour and minutemoxa@moxa-tbzkb1090923:# sudo date 102900282021
Fri 29 Oct 2021 12:28:00 AM GMT
Use the following command to set the RTC time to system time:

moxa@moxa-tbzkb1090923:# sudo hwclock –w
moxa@moxa-tbzkb1090923:# sudo hwclock2021-10-28 16:25:04.077432+00:00

NOTE
Click the following links for more information on date and time:https://www.debian.org/doc/manuals/system-administrator/ch-sysadmin-time.html
https://wiki.debian.org/DateTime

NTP Time Synchronization
The Moxa Industrial Linux (MIL) uses Network Time Security (NTS) to secure NTP, which provides ahandshake (TLS) before using a NTP server and authentication of the NTP time synchronization packets
using the results of the TLS handshake.
The default NTP client in MIL is Chrony. MIL disabled NTP server without NTS support by default and uses
the following public NTP servers that support NTS.
•

Cloudflare•

Netnod•System76•

PTB

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

25

The default server list is configured in the /etc/chrony/sources.d/moxa-nts.sources file.

# prefer nts over ntp server
server time.cloudflare.com nts iburst preferserver sth1.nts.netnod.se nts iburst preferserver sth2.nts.netnod.se nts iburst preferserver virginia.time.system76.com nts iburst preferserver ohio.time.system76.com nts iburst preferserver oregon.time.system76.com nts iburst preferserver ptbtime1.ptb.de nts iburst preferserver ptbtime2.ptb.de nts iburst preferserver ptbtime3.ptb.de nts iburst prefer
The configuration file for Chrony is at /etc/chrony/chrony.conf.
The following example show some basic functions to monitor the current status of the Chrony's chronyc tooland make changes if necessary.
1.

Check the time synchronization status between the local system and reference server using thecommand:# chronyc tracking

2.

moxa@moxa-tbbbb1182827:~$ chronyc tracking
Reference ID: A29FC801 (time.cloudflare.com)
Stratum: 4
Ref time (UTC) : Sun Jul 31 18:27:42 2022
System time
: 0.000334575 seconds slow of NTP time
Last offset: +0.000226902 seconds
RMS offset: 0.005672113 seconds
Frequency: 27.766 ppm fast
Residual freq
: -0.065 ppm
Skew: 3.403 ppm
Root delay: 0.203054637 seconds
Root dispersion : 0.006750254 seconds
Update interval : 517.4 seconds
Leap status: NormalCheck the time source configured in the /etc/chrony/chrony.conf file using the # chronyc
sources command.

moxa@moxa-tbbbb1182827:~$ chronyc sources

3.

MS Name/IP address
Stratum Poll Reach LastRx Last sample===============================================================================^+ ohio.time.system76.com
2
9
377
147
+18ms[ +18ms] +/- 141ms^+ oregon.time.system76.com
2
9
377
203
+14ms[ +14ms] +/- 137ms^- ptbtime1.ptb.de
1
921
682 -2780us[-2417us] +/- 166ms^- ptbtime2.ptb.de
1
9
21
674 -5243us[-4882us] +/- 169ms^- ptbtime3.ptb.de
1
9
21
687
+17ms[ +17ms] +/- 192ms^+ sth1-ts.nts.netnod.se
1
9
377
220
-12ms[ -12ms] +/- 162ms^- sth2-ts.nts.netnod.se1
8377
91 -3843us[-3843us] +/- 171ms^* time.cloudflare.com
3
9
377
230
+13ms[ +13ms] +/- 129ms^+ virginia.time.system76.c> 29377
226 -8753us[-8753us] +/- 116ms

Manually synchronize the time using the # chronyc makestep command.

NOTE
For additional details on Chrony, check the following links:
https://linux.die.net/man/8/chronyd
https://linux.die.net/man/1/chronyc

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

26

Setting the Time Zone
There are two ways to configure the Moxa Arm-based computer’s time zone. One is using the TZ variable.
The other is using the /etc/localtime file.

Using the TZ Variable
The format of the TZ environment variable looks like this:
TZ=<Value>HH[:MM[:SS]][daylight[HH[:MM[:SS]]][,start date[/starttime], enddate[/endtime]]]
Here are some possible settings for the North American Eastern time zone:

1. TZ=EST5EDT
2. TZ=EST0EDT
3. TZ=EST0

In the first case, the reference time is GMT and the stored time values are correct worldwide. A simple
change of the TZ variable can print the local time correctly in any time zone.
In the second case, the reference time is Eastern Standard Time and the only conversion performed is forDaylight Saving Time. Therefore, there is no need to adjust the hardware clock for Daylight Saving Time
twice per year.
In the third case, the reference time is always the time reported. You can use this option if the hardware
clock on your machine automatically adjusts for Daylight Saving Time or you would like to manually adjust
the hardware time twice a year.

moxa@Moxa-tbzkb1090923:~$ TZ=EST5EDT
moxa@Moxa-tbzkb1090923:~$ export TZ
You must include the TZ setting in the /etc/rc.local file. The time zone setting will be activated when you
restart the computer.
The following table lists other possible values for the TZ environment variable:
Hours From Greenwich Mean Time (GMT)
0
+1
+2
+2
+3
+3.5
+4
+5
+5.5
+6
+7
+8
+9
+9.5
+10
+11
+12
-11
-10
-9
-8
-7
-7
-6
-5
-5
-4

Value
GMT
ECT
EET
ART
EAT
MET
NET
PLT
IST
BST
VST
CTT
JST
ACT
AET
SST
NST
MIT
HST
AST
PST
PNT
MST
CST
EST
IET
PRT

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

Description
Greenwich Mean Time
European Central Time
European Eastern Time
Saudi Arabia
IranWest Asia
India
Central Asia
Bangkok
China
Japan
Central Australia
Eastern Australia
Central Pacific
New Zealand
Samoa
Hawaii
AlaskaPacific Standard Time
ArizonaMountain Standard Time
Central Standard Time
Eastern Standard Time
Indiana East
Atlantic Standard Time27

Hours From Greenwich Mean Time (GMT)
-3.5
-3
-3
-1

Value
CNT
AGT
BET
CAT

Description
Newfoundland
Eastern South America
Eastern South America
AzoresUsing the localtime File
The local time zone is stored in the /etc/localtime and is used by GNU Library for C (glibc) if no value has
been set for the TZ environment variable. This file is either a copy of the /usr/share/zoneinfo/ file or asymbolic link to it. The Arm-based computer does not provide /usr/share/zoneinfo/ files. You should finda suitable time zone information file and write over the original local time file in the Arm-based computer.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers28

4. Using and Managing Computer
Interfaces

In this chapter, we include more information on the Arm-based computer’s interfaces, such as the serialinterface, storage, diagnostic LEDs, and the wireless module. The instructions in this chapter cover all
functions supported in Moxa’s Arm-based computers. Before referring to the sections in this chapter, makesure that they are applicable to and are supported by the hardware specification of your Arm-based
computer.

Moxa Computer Interface Manager (MCIM)
On many occasions, there isn’t one standard method to access and configure specific interfaces on Moxa
Arm-based computers because the hardware varies. Hence, programing across different Moxa Arm-based
computer models can be difficult and time consuming. The goal of MCIM is to provide a unified softwareinterface to access and configure non-standard computer interfaces. For example, MCIM can change theserial port interface mode (e.g., RS-232, RS-485-2W,RS-422). However, configuring the serial port baudrate is not possible in MCIM because Linux provides a standard method to set the baud rate
MCIM is a command-line interface (CLI) Moxa utility designed to access and manage Moxa Arm-based
computers’ interfaces. Use the # mx-interface-mgmt command to display the menu page.
Configuring the Log Level
To set the log level of MCIM, edit the configuration file/etc/moxa/MoxaComputerInterfaceManager/MoxaComputerInterfaceManager.con
Key

Value

LOG_LEVEL

debug/info/warn/error

Description
The log-level settings for the logs generated by MCIM fordebugging and troubleshooting. The default level is “info”

Device Information
Use the # mx-interface-mgmt deviceinfo command to get information on your Moxa Arm-based
computer.
Command and Usagedeviceinfo

Description
Show the following information:•
Serial number (S/N)•
Model name•
SECUREBOOT (Enabled / Disabled)

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers29

LED Indicators

Use # mx-interface-mgmt led command to get the list of controllable LEDs on your Arm-based computer.
In the following example, the returned NAME “L1” refers to the yellow LED for cellular signal, labeled “L1”on the device. For LEDs with multiple colors such as USR (yellow and green), 2 LED names will appears(USR_Yellow and USR_Green). For this type of LEDs, you must set the state of a color to “off” before setting
another color to “on” or “blinking”.

moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt led
NAME
W3
USR_Yellow
USR_Green
L1
W1
L2
W2
L3

LABEL
W3:yellow:signal
USR:yellow:programmable
USR:green:programmable
L1:yellow:signal
W1:yellow:signal
L2:yellow:signal
W2:yellow:signal
L3:yellow:signal

STATE
off
off
off
off
off
off
off
off

The MCIM commands for LED indicator controls are listed in the following table:
Command and Usageled

led <led_name>led <led_name> get_stateled <led_name> set_state<led_state>

Description
Shows the following information for all controllable LEDs•
Name (as labeled on the device)•
Model series of the device•
Color of the LED•
Description of the LED•
LED state (on/off/heartbeat)Show the above information of a specified LED
Get the current state (on/off/heartbeat) of a specified LED
Set the state of a specified LED. Value of <state> can be on,off, or heartbeat

An example of changing the current state of USR LED from yellow (steady) to yellow (blinking) is given
below:

moxa@moxa-tbzkb1090923:~# sudo mx-interface-mgmt led USR_Yellow
NAME=SYSLABEL= USR_Yellow
STATE=on
moxa@moxa-tbzkb1090923:~# sudo mx-interface-mgmt led USR_Yellow set_stateheartbeatmoxa@moxa-tbzkb1090923:~# sudo mx-interface-mgmt led USR_Yellow get_stateheartbeatMoxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

30

Storage and Partitions
Use # mx-interface-mgmt disk and # mx-interface-mgmt partition commands for managing
the storage device and partitions.
Command and Usage

disk

disk <disk_name>disk <disk_name>set_automount <value>

partition

partition <partition_name>partition <partition_name>mountpartition <partition_name>unmount

Description
Show the following information of all embedded and external storage•
Name (e.g., eMMC, USB, SD)•
Device node (e.g., /dev/mmcblk0)•
System disk (Y/N), if ‘Y’, it is the disk with MIL installed.
•
Number of partitions•
Automount enabled/disabled (Y/N)
Show the following information of a specified storage device•
Name (e.g., eMMC, USB, SD)•
Device node (e.g., /dev/mmcblk0)•
System disk (Y/N), if ‘Y’, it is the disk with MIL installed.
•
Partition name and device node•
Automount enabled/disabled (Y/N)
Set a specified external storage device (e.g., USB, SD) toautomount when attach to device; <value> is true/false
Show the following information for partitions on all embedded andexternal storage devices:•
Name (e.g., eMMC_p1, eMMC_p2, USB_p1)•
Device node (e.g., /dev/mmcblk0p1)•
Partition mounted (Y/N)•
Partition mount point (e.g., /boot_device/p1)•
Filesystem (e.g., ext4, FAT32)
Show the above information of a specified partition
Mount a specified partition
Unmount a specified partition

For example, to query available storage device and set USB storage drive to automount, use the following
command:moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt disk
NAME DEVICESYSTEM_DISK NUMBER_OF_PARTITIONS AUTOMOUNT_SETTING
USB/dev/sdb
N1
false
eMMC /dev/mmcblk0 Y
4false
moxa@moxa-tbzkb1090923:~$ sudo mx-interface-mgmt disk USB set_automount true
To query available partitions and mount the partition 1 of the USB storage drive, use the following
command:moxa@moxa-tbzkb1090923:~# mx-interface-mgmt partition
NAME
DEVICE
IS_MOUNTED FS_TYPE MOUNTPOINT
eMMC_p1/dev/mmcblk0p1 Y
ext4/boot_device/p1
eMMC_p2/dev/mmcblk0p2 Y
ext4/boot_device/p2
eMMC_p3/dev/mmcblk0p3 Y
ext4/boot_device/p3
eMMC_p4/dev/mmcblk0p4 Y
ext4/boot_device/p4
USB_p1/dev/sdb1
N
N/A
N/A
moxa@moxa-tbzkb1090923:~# sudo mx-interface-mgmt partition USB_p1 mountmoxa@moxa-tbzkb1090923:~$ mx-interface-mgmt partition USB_p1
NAME=USB_p1
DEVICE=/dev/sdb1
IS_MOUNTED=YFS_TYPE=vfat
MOUNTPOINT=/media/USB_p1

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

31

WARNING
Setting external storage device to automount may expose your device to cybersecurity risks. It is strongly
recommended that you not automount storage device unless your device is placed is in a highly secureenvironment.

Serial PortThe serial ports support RS-232, RS-422, and RS-485 2-wire operation modes with flexible baudratesettings. The default operation mode is RS-232.
Use the # mx-interface-mgmt serialport command to query and configure the operation mode forthe serial ports.
Command and Usage

serialport

serialport <serialport_name>serialport <serialport_name>get_interface
serialport <serialport_name>
set_interface <serial_interface>

Description
Shows the following information for all serial ports on thedevice:•Name (as labeled on device)•Device node (e.g., /dev/ttyM0)
Shows the following information for a specified serial port:•
Name (as labeled on device)•Device node (e.g., /dev/ttyM0)•
Supported operation modes (e.g., RS-232, RS-485-2W,
RS-422)•
Supported baudrates•
Current operation mode configured
Gets the current operation mode for a specified serial port
Sets the operation mode for a specified serial port.

Changing the Serial Port Operation Mode
For example, to change the mode of COM1 serial port from default RS-232 mode to the RS-422 mode, use
the following command:moxa@moxa-tbzkb1090923:~# mx-interface-mgmt serialport
NAME DEVICE
COM1 /dev/ttyM0
COM2 /dev/ttyM1
moxa@moxa-tbzkb1090923:~# mx-interface-mgmt serialport COM1
NAME=COM1
DEVICE=/dev/ttyM0
SUPPORTED_INTERFACES=RS-232,RS-485-2W,RS-422
SUPPORTED_BAUDRATES=50,300,600,1200,1800,2400,4800,9600,19200,38400,57600,11520
0,230400,460800,921600
INTERFACE=RS-232
moxa@moxa-tbzkb1090923:~# sudo mx-interface-mgmt serialport COM1 set_interface
RS-422moxa@moxa-tbzkb1090923:~# mx-interface-mgmt serialport COM1 get_interface
RS-422root@moxa-tbzkb1090923:~#

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

32

Changing Other Serial Interface Settings with STTY
The stty command is used to view and modify the serial terminal settings.

Displaying All Settings
Use the following example to display all serial terminal settings of COM1 serial port.

moxa@moxa-tbzkb1090923:/# mx-interface-mgmt serialport
NAME DEVICE
COM1 /dev/ttyM0
COM2 /dev/ttyM1
moxa@moxa-tbzkb1090923:/# sudo stty -a -F /dev/ttyM0
speed 9600 baud; rows 0; columns 0; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;
eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R;
werase = ^W; lnext = ^V; flush = ^O; min = 1; time = 0;-parenb -parodd cs8 hupcl -cstopb cread clocal -crtscts-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff-iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt
echoctl echoke

Configuring Serial Settings
The following example changes the baudrate to 115200.

moxa@moxa-tbzkb1090923:~$ sudo stty 115200 -F /dev/ttyM0
Check the settings to confirm that the baudrate has changed to 115200.

moxa@moxa-tbzkb1090923:~$ sudo stty -a -F /dev/ttyM0
speed 115200 baud; rows 0; columns 0; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;
eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R;
werase = ^W; lnext = ^V; flush = ^O; min = 1; time = 0;-parenb -parodd cs8 hupcl -cstopb cread clocal -crtscts-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff-iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt
echoctl echoke

NOTE
Detailed information on the stty utility is available at the following link:
https://manpages.debian.org/bullseye/coreutils/stty.1.en.html

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

33Ethernet Interface
Use # mx-interface-mgmt ethernet command to display information on the Ethernet ports.
Command and Usage

ethernet
ethernet<ethernet_name>

Description
Show the following information of all ethernet ports on the device.
•
Name (as labeled on device)•
Network interface name (eth0, eth1, etc.)
Show the above information of a specified ethernet port

moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt ethernet
NAME DEVICE_NAME
LAN1 eth0
LAN2 eth1
moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt ethernet LAN1
NAME=LAN1
DEVICE_NAME=eth0
moxa@moxa-tbzkb1090923:~$

Serial Console Interface
Use the # mx-interface-mgmt console command to display the serial console port information.
Command and Usage

consoleConsole <console_name>

Description
Show the following information for the console port.
•
Name (as labeled on the device)•Device node (e.g., /dev/ttyS0)
Show the above information of a specified serial console interface

Following is an example of showing the console port device noderoot@moxa-tbzkb1090923:~# mx-interface-mgmt console
NAME
DEVICE
Console /dev/ttyS0
root@moxa-tbzkb1090923:~#

Digital Input/Output (DIO)
Use the # mx-interface-mgmt dio command to query and configure the state for each digital
input/output (DIO) interface, and also configure the hook script.
The predetermined state of the digital output interface is high (open circuit).
Support Version Command and Usagedio
MIL 3.0 andlater

dio <dio_name>dio <dio_name> get_state
dio <dio_name> set_state<dio_state>

Description
Shows the following information of all DIO
interfaces:•
Name (as labeled on device)•
State (high/low)
•
Event
•
Path of falling edge script•
Path of rising edge script
Shows the above information of a specified DI
or DO interface
Gets the current state (high/low) of a specified
DI or DO interface
Sets the state (high/low) of a specified DO
interface

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

34

Support Version Command and Usage

MIL 3.0 only

dio <dio_name> add_hook <edge><path>
dio <dio_name> remove_hook<edge>

Description
Execute a script from a specified path when
the dio state changes.
•<edge>specifies whether the trigger should
react to a "rising" or "falling" edge.
•<path>is the path to the script that should
be executed when the specified edgetransition occurs.
Removes the edge script (rising/falling) of aninterface

Starting with MIL 3.1, we have introduced a more flexible method for configuring the hook script for DIO’sedge transitions. Detailed instructions can be found in the 'README' file located in the directory‘/etc/moxa/MoxaComputerInterfaceManager/dio-scripts’.
An example of setting up the Moxa Computer Interface Manager (MCIM) to automatically execute a script
when the signal of the first digital input (DI1) changes from low to high (rising) or from high to low (falling)is outlined below:
1.

Navigate to ‘/etc/moxa/MoxaComputerInterfaceManager/dio-scripts/’ and create a script
named ‘DI1.script’ :root@moxa-tbzgb1057611:/etc/moxa/MoxaComputerInterfaceManager/dio-scripts#
vim DI1.script2.

Add the following content to DI1.script to log an event whenever DI1 changes:#!bin/bash
echo "The input value of Digital Input 1 (DI1) has changed" >>/var/log/di1.log
3.

Make the script executable

root@moxa-tbzgb1057611:/etc/moxa/MoxaComputerInterfaceManager/dio-scripts#
chmod +x DI1.script
4.

Open ‘peripheral-settings.conf’ located in ‘/etc/moxa/MoxaComputerInterfaceManager/’ andset the event value for [DIO/DI1] to 3 to detect both rising and falling edges:
The event ID corresponds to the following actions: Event=0: none (default)
 Event=1: signal change from high to low (falling) Event=2: signal change from low to high (rising) Event=3: signal change from low to high (rising) or high to low (falling)[DIO/DI1]
Event=3
5.

Apply the changes by restarting the MoxaComputerInterfaceManager service:

root@moxa-tbzgb1057611: systemctl restart MoxaComputerInterfaceManager
6.

Ensure the script is correctly configured and active by checking the settings. The ‘EVENT’ should be set
to 'change' and ‘ACTIVE’ should show 'yes':root@moxa-tbcib1078122: mx-interface-mgmt dio
NAME
DI1
DI2
DI3
DI4
DO1
DO2
DO3
DO4

STATE
high
high
high
high
high
high
high
high

EVENT
change
none
none
none
none
none
none
none

ACTIVE
yes
no
no
no
no
no
no
no

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

35

Buzzer
Use the # mx-interface-mgmt buzzer command to query and set the state for buzzer alarm in Moxa
Arm-based computers with a buzzer.
Command and Usagebuzzerbuzzer <buzzer_name>buzzer <buzzer_name>get_statebuzzer <buzzer_name>set_state

Description
Show the following information of all buzzers•
Name•State (on/off)Show the following information of a specified buzzer•
Name•State (on/off)Get the current state (on/off) of a specified buzzer
Set the state (on/off) of a specified buzzer

Cellular Module Interface
Use # mx-interface-mgmt cellular command to query and manage cellular module(s)Command and Usage

cellularcellular <name>cellular <name> get_power
cellular <name> set_power<power_state>cellular <name> get_sim_slot

Description
Show the following information for all cellular modules.
•
Name (e.g., Cellular1)•
Network interface name (wwan0, wwan1, etc.)•
Cellular module detected (true/false)Show the detail information of a specified cellular module•
Name (e.g., Cellular1)•
Network interface name (wwan0, wwan1)•
Cellular module detected (true/false)•
QMI Port (e.g., /dev/cdc-wdm0)•
AT Port (e.g., /dev/ttyUSB4)•
GPS Port (e.g., /dev/ttyUSB3) if GPS is supported•
Cellular module power status (on/off)•Number of available SIM slots on the device•
The SIM slot # that is currently used by the cellular module
Note: SIM slot # correspond to the labeled slot # on the device
Get the cellular module power status (on/off).
Set the cellular module power status (on/off).
Note: Module will power-on when device reboot

Get the SIM slot # that is currently used by the cellular module
Set the SIM slot # used by cellular module. Module power off/on iscellular <name> set_ sim_slot required for SIM slot changed to take effect.
<sim_slot>
Note: SIM slot # will be set to default (slot 1) when the device
rebootNOTE
1.
2.

Some cellular modules may not support power on/off or SIM slot control.
If you are using Moxa Connection Manager (MCM) to manage the cellular connection, do not use
set_power or sim_slot commands as they might interrupt MCM’s network failover/failback operations.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers36An example of using MCIM to query the cellular module information and changing the SIM slot # use by themodule from slot 1 to 2 is given below:

moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt cellular
NAME
DEVICE_NAME
DEVICE_DETECTED
Cellular1 wwan0
true
moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt cellular Cellular1
NAME=Cellular1
DEVICE_NAME=wwan0
QMI_PORT=/dev/cdc-wdm0
AT_PORT=/dev/ttyUSB4
GPS_PORT=/dev/ttyUSB3
DEVICE_DETECTED=true
POWER=on
SIM_SLOT_NUMBER=2
SIM_SLOT=1
moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt cellular Cellular1 set_sim_slot 2
moxa@moxa-tbzkb1090923:~$ mx-interface-mgmt cellular Cellular1 get_sim_slot 2

Wi-Fi Module Interface
Use the # mx-interface-mgmt wifi command to query and manage Wi-Fi modules.
Command and Usagewifi
wifi <name>wifi <name> get_power
wifi <name> set_power<power_state>

Description
Shows the following information of all Wi-Fi modules.
•
Name (e.g., WiFi1)•
Network interface name (wlan0, wlan1)•
Wi-Fi module detected (true/false)
Shows the above information for a specified Wi-Fi module
Gets the Wi-Fi module power status (on/off).
Set the Wi-Fi module power status (on/off).
Note: The module will power-on when the device reboots.

NOTE
Some Wi-Fi modules may not support power on/off control.

Socket Interface
Use the # mx-interface-mgmt socket command manage the Mini PCI-E sockets on the Moxa Armbased Computer
Command and Usage

socketsocket <socket_name>socket < socket_name>get_power
socket <name> set_power<power_state>

Description
List all the available sockets’ name (e.g., Socket1, Socket2)
Shows the following information for a specified Mini PCI-E socket•
Name (e.g., Socket1, Socket2)•
Power status (on/off)•Number of available SIM slots if a cellular module is insert to thisMini PCI-E socket•
Get the SIM slot # that is currently used by the cellular moduleon this Mini PCI-E socket
Note: SIM slot # correspond to the labeled slot # on the device.
Gets the power status (on/off) for a specified Mini PCI-E socket
Set the power status (on/off) for a specified Mini PCI-E socket.
Note: The socket will power-on when the device reboots.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

37

CAN Port
The CAN ports on Moxa’s Arm-based computers support CAN 2.0A/B standard.

Configuring the Socket CAN Interface
The CAN ports are initialized by default. If any additional configuration is needed, use the ip linkcommand to check the CAN device.
To check the CAN device status, use the ip link command.

# ip link
can0: <NOARP,UP,LOWER_UP,ECHO> mtu 16 qdisc pfifo_fast state UNKNOWN mode
DEFAULT group default qlen 10 link/can
To configure the CAN device, use # ip link set can0 down to turn off the device first# ip link set can0 down
# ip link
can0: <NOARP,ECHO> mtu 16 qdisc pfifo_fast state DOWN mode DEFAULT groupdefault qlen 10 link/canHere’s an example with bitrate 12500:# ip link set can0 up type can bitrate 12500

CAN Bus Programming Guide
The following code is an example of the SocketCAN API, which sends packets using the raw interface.

CAN Write#include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <string.h>#include <net/if.h>#include <sys/types.h>#include <sys/socket.h>#include <sys/ioctl.h>#include <linux/can.h>#include <linux/can/raw.h>
int main(void){
int s;
int nbytes;
struct sockaddr_can addr;
struct can_frame frame;
struct ifreq ifr;
char *ifname = "can1";
if((s = socket(PF_CAN, SOCK_RAW, CAN_RAW)) < 0) {perror("Error while opening socket");return -1;}
strcpy(ifr.ifr_name, ifname);
ioctl(s, SIOCGIFINDEX, &ifr);
addr.can_family = AF_CAN;
addr.can_ifindex = ifr.ifr_ifindex;
printf("%s at index %d\n", ifname, ifr.ifr_ifindex);
if(bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {perror("Error in socket bind");return -2;}

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

38}frame.can_id = 0x123;
frame.can_dlc = 2;
frame.data[0] = 0x11;
frame.data[1] = 0x22;
nbytes = write(s, &frame, sizeof(struct can_frame));printf("Wrote %d bytes\n", nbytes);
return 0;

CAN Read
The following sample code illustrates how to read the data.

#include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <string.h>#include <net/if.h>#include <sys/types.h>#include <sys/socket.h>#include <sys/ioctl.h>#include <linux/can.h>#include <linux/can/raw.h>
Int main(void){
int i;
int s;
int nbytes;
struct sockaddr_can addr;
struct can_frame frame;
struct ifreq ifr;
char *ifname = "can0";if((s = socket(PF_CAN, SOCK_RAW, CAN_RAW)) < 0) {perror("Error while opening socket");return -1;}
strcpy(ifr.ifr_name, ifname);
ioctl(s, SIOCGIFINDEX, &ifr);
addr.can_family = AF_CAN;
addr.can_ifindex = ifr.ifr_ifindex;
printf("%s at index %d\n", ifname, ifr.ifr_ifindex);
if(bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {perror("Error in socket bind");return -2;}
nbytes = read(s, &frame, sizeof(struct can_frame));if (nbytes < 0) {perror("Error in can raw socket read");return 1;}
if (nbytes < sizeof(struct can_frame)) {fprintf(stderr, "read: incomplete CAN frame\n");return 1;}
printf(" %5s %03x [%d] ", ifname, frame.can_id, frame.can_dlc);
for (i = 0; i < frame.can_dlc; i++)printf(" %02x", frame.data[i]);printf("\n");return 0;}
After you use the SocketCAN API, the SocketCAN information is written to the paths:/proc/sys/net/ipv4/conf/can* and /proc/sys/net/ipv4/neigh/can*Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

39

Push-button
Getting the Button List and Status
Use # mx-interface-mgmt button command to display the available buttons and the buttonconfigured actions.
Command and Usage

buttonbutton <name>

Description
Show the following information for all buttons on the device:•
Name (as labeled on device)•
Action (default/user-defined/disabled) Default: Button behavior is default
 User-defined: The button behavior has been customized by the user Disabled: The button has no function when pushedShow the above information for a specified button

Following is an example of using MCIM to query an available button (FN button) of the UC-8200 series.

root@moxa-tbzkb1090923:~# mx-interface-mgmt button
NAME Action
FN
default

Customize the Button Action
You can use the two scripts (default and custom) available in the following path to customize button
actions: /etc/moxa/MoxaComputerInterfaceManager/button-scripts/. For example, in the UC-8200
series, the default script is “uc8200-default.script” and custom script is “custom.script”.
By default, the FN button will load the default script when pressed. The default script will perform designed
tasks based on the actions on the FN button. The following table gives a detailed description of the default
script:FN button Action
Press and hold FN button andrelease within 1s
Press and hold FN button andrelease between 7s to 9s
Press and hold FN button andrelease after 9s

LED Indicator Status

Resulting Action

SYS LED blinks

Device reboot

•
•
•
•
•

SYS LED blinks for 1s to 6s
SYS LED is ON for 7s to 9s
SYS LED blinks for 1s to 6s
SYS LED is ON for 7s to 9s
SYS LED is OFF after 9s

Reset to factory default
Do nothing; cancel action

To customize the FN button action, a configuration file at/etc/moxa/MoxaComputerInterfaceManager/peripheral-settings.conf could be modified. The
device needs to rebooted for the settings to take effect.
The Action parameter in the configuration file can have the following three values:•

0: Disable the button (no action when pressed)•

1: Run the default script•

2: Run the custom script

NOTE
You must reboot the system for the settings to take effect.
An example of the settings in the peripheral-settings.conf file is shown below:[Button/FN]
Action=2[Disk/eMMC]
AutoMount=false[Disk/SD]
AutoMount=false

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

40

[Disk/USB]
AutoMount=true[SerialPort/COM1]
Interface=1[SerialPort/COM2]
Interface=0
If Action is set to 2 (custom script), /etc/moxa/MoxaComputerInterfaceManager/buttonscripts/custom.script should be edited to add the desired actions. To make it easier to configure theactions in the script file, copy the content of the default script to custom script file and then make therequired changes.

root@moxa-tbzkb1090923:/etc/moxa/MoxaComputerInterfaceManager/button-scripts#
cp uc8200-default.script custom.script

Configuring the Real COM Mode
You can use Moxa’s NPort series serial device drivers to extend the number of serial interfaces (ports) on
your UC computer. The NPort comes equipped with COM drivers that work with Windows systems and TTY
drivers for Linux systems. The driver establishes a transparent connection between the host and serial
device by mapping the IP Port of the NPort’s serial port to a local COM/TTY port on the host computer.
Real COM Mode also supports up to 4 simultaneous connections, so that multiple hosts can collect data fromthe same serial device at the same time.
One of the major conveniences of using Real COM Mode is that Real COM Mode allows users to continue
using RS-232/422/485 serial communications software that was written for pure serial communications
applications. The driver intercepts data sent to the host’s COM port, packs it into a TCP/IP packet, and thenredirects it through the host’s Ethernet card. At the other end of the connection, the NPort accepts the
Ethernet frame, unpacks the TCP/IP packet, and then sends it transparently to the appropriate serial device
attached to one of the NPort’s serial ports.
To install Real COM driver, download the driver using apt from Moxa software repository with internet
access. You will be able to view the driver related files in the /usr/lib/npreal2/driver folder after successful
installation.

root@moxa-tbzkb1090923:~# apt install moxa-nport-real-tty-utils> mxaddsvr (Add Server, mapping tty port) > mxdelsvr (Delete Server, unmapping
tty port)> mxloadsvr (Reload Server) > mxmknod (Create device node/tty port)> mxrmnod (Remove device node/tty port)> mxuninst (Remove tty port and driver files)
At this point, you will be ready to map the NPort serial port to the system tty port. For a list of supported
NPort devices and their revision history, click https://www.moxa.com/en/support/search?psid=50278.

Mapping TTY Ports
Make sure that you set the operation mode of the desired NPort serial port to Real COM mode. After logging
in as a super user, enter the directory /usr/lib/npreal2/driver and then execute mxaddsvr to map the target
NPort serial port to the host tty ports. The syntax of mxaddsvr command is as follows:

mxaddsvr [NPort IP Address] [Total Ports] ([Data port] [Cmd port])
The mxaddsvr command performs the following actions:1.

Modifies the npreal2d.cf.

2.

Creates tty ports in the /dev directory with major & minor number configured in npreal2d.cf.

3.

Restarts the driver.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

41

Mapping TTY Ports (automatic)
To map tty ports automatically, execute the mxaddsvr command with just the IP address and the numberof ports, as shown in the following example:# cd /usr/lib/npreal2/driver# ./mxaddsvr 192.168.3.4 16
In this example, 16 tty ports will be added, all with IP 192.168.3.4 consisting of data ports from 950 to 965
and command ports from 966 to 981.

ATTENTION
You must reboot the system after mapping tty ports with mxaddsvr.

Mapping TTY Ports (manual)
To map tty ports manually, execute the mxaddsvr command and specify the data and command ports asshown in the following example:# cd /usr/lib/npreal2/driver# ./mxaddsvr 192.168.3.4 16 4001 966
In this example, 16 tty ports will be added, all with IP 192.168.3.4, with data ports from 4001 to 4016 andcommand ports from 966 to 981.

ATTENTION
You must reboot the system after mapping tty ports with mxaddsvr.

Removing Mapped TTY Ports
After logging in as root, enter the directory /usr/lib/npreal2/driver and then execute the mxdelsvr
command to delete a server. The syntax of mxdelsvr is:

mxdelsvr [IP Address]
Example:# cd /usr/lib/npreal2/driver# ./mxdelsvr 192.168.3.4
The following actions are performed when the mxdelsvr command is executed:
1.

Modify npreal2d.cf.

2.

Remove the relevant tty ports from the /dev directory.

3.

Restart the driver.

If the IP address is not provided in the command line, the program will list the installed servers and total
ports on the screen. You will need to choose a server from the list for deletion.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers42

5. Configuring and Managing Networks

Moxa Connection Manager (MCM)
MCM is a network management utility developed by Moxa to manage the LAN and WAN network on yourMoxa Arm-based computer, including Wi-Fi, cellular, and ethernet interfaces. With MCM, you can easily fill in
the connection profile and priority in the configuration file; then MCM will automatically connect and keep
the connection alive. Following are the major features of MCM:•

Cellular, Ethernet and Wi-fi connection•

Connection auto keep-alive, failover, and failback•

DHCP server•

Data usage monitoring•

Cellular connection diagnosis tool•

Cellular modem and network information•

Cellular modem firmware upgrade with failback

Interface

Default Managed
by MCM

LAN1

Yes

LAN2
Cellular/ Wi-Fi

No
No

Network Configuration
Set as DHCP WAN by default.
After boot up, if LAN1 cannot obtain IP from DHCP server for 20
seconds, then link-local IP addresses is automatically assigned.
Static IPv4, 192.168.4.127
Not configured••

To run MCM, you must use root permission to run # mx-connect-mgmt

MOXA Connection Management Command-line Utility
USAGE:
mx-connect-mgmt [SUBCOMMAND]FLAGS:-h, --help-V, --version

Prints help information
Prints version information

SUBCOMMANDS:GPS
configuredatausagedefault
debug
help
ls
modem
nwk_status
reloadstartstop
unlock_pin
unlock_puk
wifi

Control GPS interface
MOXA Connection Management via GUI dialog
Show interface data usage information and related functions
Reset to default configurationand diagnose cellular connection
Show the help menu
List available network interfaces
Upgrade cellular modem firmware
Show network and modem’s information and connection statusconfiguration files and restart interfaces
to control interfaces
to control interfaces
Unlock SIM PIN for the specified interface
Unlock PUK and reset SIM PIN for the specified interface
Search Wi-Fi AP

NOTE
By default, only LAN1 port is managed by MCM.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

43

There are 2 types of configuration files for MCM. One is main configuration file to manage theinterrelationship between each interface, and one configuration files per each network interfaces available
on Moxa Arm-based computer
Config Type
Main Config.

Interface Config.

Description
Main configuration file which is to configure which
network interface you would like MCM to manage
and set the priority during failover/failback
Per interface configuration file which is toconfigure properties of individual interfaces. Suchas APN, PIN code of cellular connection or SSID
and password of Wi-Fi.

File Location/etc/moxa/MoxaConnectionManager/

MoxaConnectionManager.conf/etc/moxa/MoxaConnectionManager/interfaces/[interfacename].conf

NOTE
When modification is made to configuration file, you must use # mx-connect-mgmt reload to makethe change effective.
Instead of modifying the configuration file directly, we highly recommend you use the GUI Configurator
described in next section to configure MCM.

Setting Up MCM with GUI Configurator
GUI Configurator Overview
To configure the WAN network through ethernet, Wi-Fi or cellular interface on the V2406C computer, you
can use the simple GUI dialog provided by using # mx-connect-mgmt configure command.
If you are using PuTTY, enable VT100 line drawing option under Windows > Translation for the GUI toshow correctly

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

44

1.

Go to the main page.

Figure 5.1 – Main page2.

Option Name
Configure Network
Interface

Description

Configure Log Level••

Set to Default MCM
Configuration

Set all configuration to default

Configure network setting for
Available syslog levels are ERR, WARN, INFO, DEBUG, TRACE
MCM log is save in /var/log/syslog

Configure network type for each interface and set the WAN connection priority for failover/failback.

Figure 5.2 –Configure network interface

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

45

Option Name

Configure Network
Interfaces

Configure WAN Interface
Priority
Enable/Disable Failback
Failback Check Interval
3.

Description
A list of available network interfaces will show, where you can set the
network type for each interface. The options are:•
WAN - When set to WAN, this interface will be added to the default
gateway list and allow MCM to apply automatic keep-alive andfailover/failback control over it•
LAN - When set to LAN, MCM will connect this interface using the
network attributes defined in Profile-1 and DHCP server can be enabled
for this interface•
LAN Bridge - Bridge two or more LAN interfaces to construct a larger
LAN•
Manual - When set to Manual, it allows the user to have total control
over this interface. MCM will connect this interface one-time only
network attributes defined in Profile-1. MCM will not set these interfaces
as the default gateway nor apply connection keep-alive andfailover/failback control over it.
•
None - MCM will not manage this interface
MCM will use the WAN interface set as 1st Priority as the default gateway.
When the 1st priority interface becomes unavailable, MCM will automatically
failover to the next priority interface.
When enabled, the backup connection will automatically failback to thehigher priority connection when it became available again
This value determines how long (in seconds) the higher priority connection
should maintain stability before MCM trigger the failback. The purpose is to
avoid unstable connections causing frequent failover and failback

Configure individual network interface.

Figure 5.3 –Configurable options for WAN interface

Figure 5.4 –Configurable options for LAN interface
Option Name
Select Network Type

Network TypeAll

Enable/Disable
WAN
Connection Keep-alive

Description
Available options are WAN/LAN/LAN Bridge/Manual/None
You can enable this setting if a seamless failover experience isrequired, meaning if a backup interface is set to always keepalive, then MCM can failover to a ready-to-use backup
connection without the initialization downtime.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

46

Option Name

Description
When the 1st priority WAN network’s profile cannot connect orConfigure Network
becomes unavailable, MCM will automatically failover to the
WAN
Profile Priority
next profile in this priority list
Note: network profile failback is currently not supported
This value determines the maximum attempts MCM will try toConfigure Network
WAN
connect using the current WAN network profile before failover
Profile Retry Thresholdto the next profile in the priority list.
This value (in seconds) determines the maximum time MCM
Configure Network
will try to connect using the current network profile before
All
Profile Timeout
determining the connection is unavailable
Bridge IPv4 Address
LAN-bridge
Assign a static IPv4 address for the bridged LAN interfaces
Bridge IPv4 Subnet
Assign a static IPv4 subnet mask for the bridged LAN
LAN-bridge
Maskinterfaces
Enable/Disable DHCP
Configure a specific LAN or bridged LAN interfaces as DHCP
LAN, LAN-bridge
Serverserver•This section displays all network profile in a list with
option to add, modify or remove a profile.
WAN, LAN,
Network Profile•
If network type is set to LAN or Manual, only profile-1 will
Manualbe used because network profile failover is only available
for WAN
4.

Network Type

Configure network profile of an interface.

Figure 5.5 –Network profile setting (cellular interface as an example)
Option Name

Interface
Cellular (WAN)

Configure Modem
Setting
Wi-Fi (WAN)

Configure IP Method

All interfaces

Description
Configure cellular connection parameters including APN, SIM
slot (which SIM slot number to use), PIN Code, Username,
Password
Configure Wi-Fi connection parameters including Mode (only
Wi-Fi client mode is supported), SSID, and Password
Note: make sure to leave the password field empty if you areconnecting to a public Wi-Fi without password
Configure IP related parameters including protocol version(IPv4, IPv6 or IPv4v6) and IP assignment method (DHCP,
auto*, static IP or Link-local)

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

47

Option Name

Interface

Configure Keep-alive
Check Method

All interfaces

Description
Select the method to check connection is alive•
Ping: Connection is only considered alive if pinging thetarget server specified is successful•
Check-ip-exist: As long as an IP is assigned to theinterface (e.g., the base station assigns IP to the cellularmodem or DHCP server assigns IP to LAN port), areconsidered connection is alive* IP assignment method “auto” is for IPv6 only, which support Stateless Address Auto-Configuration(SLACC) and Stateless for DHCPv6.

Cellular and Wi-Fi Failover/Failback
One of the key features in MCM is WAN connection auto-failover, where you can configure multiple backup
WAN networks. When the primary connection becomes unavailable, MCM will automatically fail over to the
backup network depending on the priority you set. You can even configure the connection to fall back to theprimary one when it is back online.
In below example, we will set Wi-Fi interface as the primary WAN network and Cellular(4G/LTE) as the
backup. MCM will automatically switch to using Cellular(4G/LTE) when Wi-Fi is down and back to Wi-Fi when
it is back online.
1.

Run # mx-connect-mgmt configure to launch a simple GUI dialog configurator

root@moxa-tbbbb1182827:/# mx-connect-mgmt configure22.

Select “Configure Network Interfaces”

3.

Set interface Cellular1 and WiFi1 both to WAN, and4.

Set WiFi1 as the 1st priority and Cellular1 as 2nd priority

5.

Make sure Failback is enabled if you would like MCM to automatically switch back to Wi-Fi from cellularwhen it is back online.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

48

6.

Failback Check Interval [30] seconds mean MCM will make sure Wi-Fi connection is alive and stable for
30 seconds before failback to use Wi-Fi as the primary connection (default gateway). The purpose is to
avoid unstable connections causing frequent failover and failback.

3
3

4
5

6

7.

Go to the interface configuration page of WiFi1 and Cellular1 (Figure 5.5 is an example of Cellular)

8.

The option “Enable/Disable Connection Keep-alive” is disabled by default. It means there will be ashort period without network during Wi-Fi to cellular failover process since MCM will only initiate thecellular connection when failover is triggered.
You can enable this setting if a seamless failover experience is desired. When enabled, it allows MCM to
failover to a ready-to-use backup connection without the initialization downtime.

9.

MCM also supports network profile failover. For example, on a Moxa Arm-based computer with dual SIM
slots, you can set up two profiles for cellular interface; each uses a different SIM slot and SIM card.
 Network Profile Priority: in this example, MCM will use profile-1 by default and failover to use
profile-2 when it cannot establish a connection with profile-1.
 Network Profile Timeout and Retry Threshold: in this example, MCM will try to connect withprofile-1 two times, each with a maximum of 90 seconds timeout before switching to profile-2.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers49

10. You can modify the default profile-1 and profile-2 or add/remove a profile.

8
9

10

Figure 5.6 –Interface configuration page of Cellular1
11. Go to profile configuration page.
12. Configure the cellular modem related attribute. In this example, a SIM card in SIM slot 1 with PIN code
“0000” and APN “internet” is used for Profile-1
13. Select the IP protocol generation. IPv4, IPv6, and IPv4v6 are the available options.
14. Select how MCM determine the connection is alive. Currently, only “ping’ method is supported for WAN
network. In this example, following configuration are set for Profile-1 of Cellular1 interface
 MCM will ping the Google DNS once every 700 seconds.
 MCM will try to ping the target host maximum 3 times (Retry Threshold) before concluding profile-1
cannot connect. For each ping attempt, MCM will consider ping fails if server doesn't response in 3
seconds (Ping timeout).
15. Once completed the configuration, exit MCM and select save and reload configuration file for theconfiguration to take effect

12
13

14

Figure 5.7–network profile configuration page of Cellular1 interface

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

50

Checking the Network Status
Checking the Interface and Connection Status•

Use # mx-connect-mgmt nwk_info [Interface name] to check the interface and connection
status•Use # mx-connect-mgmt nwk_info [Interface name]moxa@moxa-tbbbb1182827: # sudo mx-connect-mgmt nwk_info Cellular1-----------------------------------------------Interface Name
: Cellular1
Enabled: trueWAN Priority: 2
Device Name
: wwan0
Device Type: Modem
Network Type: WAN
Mac Address:
IPv4 Method: dhcp
IPv6 Method:-----------------------------------------------Modem State: Connected-----------------------------------------------Radio Access Tech
: UMTS
Signal Strength: PoorOperator Name
: Chunghwa
Unlock Retries: SIM PIN(3)SIM Slot: 1
IMSI: 466924253357038-----------------------------------------------Connection Status: Connected
Default Route: false-----------------------------------------------IPv4 | Address: 10.224.91.86| Netmask: 255.255.255.252| Gateway: 10.224.91.85| Primary DNS: 168.95.1.1| Secondary DNS: 168.95.192.1-----------------------------------------------IPv6 | Address:| Netmask:| Gateway:| Primary DNS:| Secondary DNS:
Figure 5.8 –an example of nwk_info result of interface Cellular1
Most of the data fields and values are self-explanatory. Below are additional details to some of the data
fields:FieldsEnabled
WAN priority
Network Type

Description

Available Interface
Wi-Fi, Ethernet,•
True: This interface is managed by MCM•
False: This interface is not managed by MCM
Cellular
Wi-Fi, Ethernet,
The WAN priority set in Figure 5.2
Cellular
Wi-Fi, Ethernet,
WAN/LAN/Manual/None according to the set value in Figure 5.2
CellularMoxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

51

Fields

Modem StateRadio Access Tech

Signal Strength

SIM Slot

Connection Status

Default Route

Description
Available Interface•
Not Ready: The cellular modem can't be detected, or someconfiguration is not set correctly in MCM configuration files.
•
Initializing: The cellular is initializing•
SIM PIN Locked: SIM PIN is locked; you can unlock with
unlock_pin command•
SIM PUK Locked: SIM PUK is locked; you can unlock with
unlock_puk command•Radio Power Off: The cellular modem is entering flightmode
Cellular only•Radio Power On: The cellular modem is exiting flightmode•
Searching Base Station: The cellular modem has exited
flight mode and searching for base-station•
Attached to Base Station: The cellular modem isregistered with a network provider but without data
connections.
•
Connecting: The cellular modem is connecting•
Connected: The cellular modem is connected•
No SIM: SIM card is missing or malfunctioning
GSM/GSM COMPACT/UMTS/LTE, etc.
Cellular only•
None/Very Poor
•
Poor
•
Fair
Cellular only•Good•
Excellent
Note: see cellular signal strength for defined criteria
The SIM slot number being used
Cellular only•
Initializing: Initializing network connection•
Device Ready: Detected the network interface is ready•Connecting: Connecting according to setting in profile•
Configuration Error: Profile configuration error•
Disabling: Stopping the connection•
Disabled: When an interface is not managed by MCM, or
MCM service is stopped
Wi-Fi, Ethernet,•
Connected: Connection is “working". The criteria for
Cellular“working” are determine by the Keep-alive Check Method in
Figure 5.5. For example, if method is set to ping, theconnection is consider working if ping is successful•
Unable to connect: The network profile is set correctly but
the connection is not working determined by the Keep-alive
Check Method in Figure 5.5•
Reconnecting: Connection is being reconnecting•
True: This interface is currently being used as default route Wi-Fi, Ethernet,•
False: This interface is not the default route
Cellular

Cellular Signal Strength
Below are the criteria that MCM uses to determine the signal strength for 3G(UMTS) and 4G(LTE):
Using 4G(LTE) signal level as an example:•

For the signal level “Excellent”, both RSSI and EC/IO need to meet the defined criteria in below table•

If the RSSI value meets the “Excellent” criteria but EC/IO meets only the “Good” criteria, then the MCM
will show “Good” signal level
3G(UMTS) Signal
Level
Excellent
Good
Fair
Poor
None/Very PoorRSSI (dBm)

EC/IO (db)

>=-77
>=-87
>=-97
>=-107
<-107

>=-6
>=-10
>=-14
>=-20
<-20

4G(LTE) Signal
Level
Excellent
Good
Fair
Poor
None/Very Poor

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

RSRP (dBm)

RSSNR (db)

>=-85
>=-95
>=-105>=-115
<-115

>=13
>=5
>=1
>=-3
<-3

52

Monitoring the Data Usage
Use # mx-connect-mgmt datausage to check the data usage of a specified interface between a specified
start and end datemoxa@moxa-tbbbb1182827:# sudo mx-connect-mgmt datausage -h
mx-connect-mgmt-datausage
Show interface data usage information and related functions
USAGE:
mx-connect-mgmt datausage [FLAGS] [OPTIONS] [interface]
FLAGS:-h, --help
Prints help information-r, --reset
data usage database
OPTIONS:-s, --since <date>
Sets the begin date of data usage cumulative period,
expected date format YYYY-MM-DD HH:MM or YYYY-MM-DD-t, --to <date>
Sets the end date of data usage cumulative period,
expected date format YYYY-MM-DD HH:MM or YYYY-MM-DD
ARGS:<interface>
Below is an example of how to check the data usage of Wi-Fi interface between 2022/7/3 and 2022/7/4

moxa@moxa-tbbbb1182827:# sudo mx-connect-mgmt datausage --since 2022-07-03 --to2022-07-04 WiFi1
moxa@moxa-tbbbb1182827:
rx: 21884544 bytes
tx: 116086 bytes

Upgrading the Cellular Modem Firmware
Use # mx-connect-mgmt modem upgrade [Interface name] will check and install the latest cellularmodem firmware tested by Moxa from Moxa APT server.
••Your cellular network will be down temporary during the upgrade and the connection will bereconnected by MCM after the upgrade is complete
You can also upgrade the firmware locally by specifying a file path following -F or --filepath option•

By default, firmware downgrade is not allowed and not recommended. If you insist to downgrade thefirmware, you can add -f flag to force the downgrade.

•

You can use mx-connect-mgmt nwk_info [interface name] -a command to check the current
cellular modem firmware version•

MCM will perform auto-reinstallation if upgrade fails.

moxa@moxa-tbbbb1182827:/# sudo mx-connect-mgmt modem upgrade -hmx-connect-mgmt-modem-upgradeUpgrade modem FWR
USAGE:
mx-connect-mgmt modem upgrade [FLAGS] [OPTIONS] [interface]
FLAGS:-fforce upgrade FWR-h, --help
Prints help information
OPTIONS:-F, --filepath <filename>Sets the FWR file path
ARGS:
<interface>
An example of automatically updating the cellular modem firmware from Moxa APT server is given below:

moxa@moxa-tbbbb1182827:/# sudo mx-connect-mgmt modem upgrade Cellular1

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers53

An example of manually updating the cellular modem firmware by specifying a firmware file is given below:

moxa@moxa-tbbbb1182827:/# sudo mx-connect-mgmt modem upgrade Cellular1 -F /etc/
firmware/Telit-LE910C4-EU-Info-1.1.0
An example given below indicates how to manually force the cellular modem firmware update even if thecurrent firmware is newer than the provided firmware:

moxa@moxa-tbbbb1182827:/# sudo mx-connect-mgmt modem upgrade Cellular1 -f -F/etc/ firmware/Telit-LE910C4-EU-Info-1.0.0

Cellular Network Diagnosis
Use # mx-connect-mgmt debug to perform diagnosis on the cellular network if you have trouble getting
it to connect. The diagnosis tool can identify common issues such has missing antenna, weak signal
strength, SIM card pin code error, SIM locked, etc.

moxa@moxa-tbbbb1182827:# sudo mx-connect-mgmt debug -hmx-connect-mgmt-debug
Debug and diagnose cellular connection
USAGE:
mx-connect-mgmt debug [SUBCOMMAND]FLAGS:-h, --help
SUBCOMMANDS:
diag
help
listenPrints help information
Perform diagnosis on the cellular interface
Prints this message or the help of the given subcommand(s)Listen to properties changed

Using API to Retrieve the MCM Status
MCM provides C application programming interfaces (APIs) for developer to retrieve various network andinterface status from MCM
Please refers to following link for the C API document
https://moxa.gitlab.io/open-source/linux/gitbook/moxa-connection-manager-api-document/
To integrating your applications securely with the MC C API, you should follow the below guideline:
1.

Confirm that the return value of the API is 0 and the returned struct pointer is not NULL to avoid using
the wrong memory address.

2.

Always free the structure pointer returned by the API to avoid memory leak.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

54

6. System Installation and Update

In this chapter, we will introduce how to install and update Moxa Industrial Linux and the bootloader.

Installing Moxa Industrial Linux
Using a TFTP Server From Bootloader Menu
Refers to instruction in Accessing Bootloader Menu section

NOTE
TFTP update is disabled in Secure model by default due to TFTP is not a secure transmission protocol.

Using a USB/SD From Bootloader Menu
Refers to instruction in Accessing Bootloader Menu section

Automatic Installation From a USB or SD
Beside manually installing the system image from bootloader menu, you can also trigger the image
installation process within the operating system using mx-bootloader-mgmt image_auto_installcommand. Once this process is triggered, the Arm-based computer will automatically install the specified
system image in the USD or SD attached to the system. The new image will be available upon the next
system boot-up.

NOTE
The format supported for USB and SD are FAT32 and ext4, respectively.
Command-d, --disk-f, --file-i, --info-r, --remove-h, --help-v, --version

Description
Display the name of the external storage (e.g., USB, SD) where the image file islocated. You can use the mx-interface-mgmt disk command to query the external
storage name.
Display the name of the image file in the external storage
Display the names of the image file and external storage configured for auto-installupon next boot-up
Remove the auto-installation configuration
Display the available commands with a brief description
Display the version of mx-image-auto-install-tool

Following is an example of the automatic installation of the system image from a USB device:1.

Use mx-interface-mgmt disk command to check the name of available storage device name.

moxa@moxa-tbzkb1090918:~# sudo mx-interface-mgmt disk
NAME
DEVICESYSTEM_DISK NUMBER_OF_PARTITIONS
USB/dev/sda
N1
eMMC/dev/mmcblk0
Y
4

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

AUTOMOUNT_SETTING
false
false

55

2.

Mount the USB if it is not already mounted. Refer to Storage and Partition section for detail.

moxa@moxa-tbzkb1090923:~$ sudo mx-interface-mgmt partition
NAME
EVICE
IS_MOUNTED FS_TYPE MOUNTPOINT
eMMC_p1 /dev/mmcblk0p1
Y
ext4/boot_device/p1
eMMC_p2 /dev/mmcblk0p2
Y
ext4/boot_device/p2
eMMC_p3 /dev/mmcblk0p3
Y
ext4/boot_device/p3
eMMC_p4 /dev/mmcblk0p4
Y
ext4/boot_device/p4
USB_p1/dev/sdb1
N
N/A
N/A
moxa@moxa-tbzkb1090923:~$ sudo mx-interface-mgmt partition USB_p1 mount3.

Configure an auto-installation event in partition 1 of the USB device with the image file IMG_UC8200_MIL3_V1.0_Build_22053011_ImageBuild_220530_133813.img:

moxa@moxa-tbzkb1090918:~# sudo mx-bootloader-mgmt image_auto_install -d USB-f
IMG_UC-8200_MIL3_V1.0_Build_22053011_ImageBuild_220530_133813.img

NOTE
Ensure that the image file and sha256 hash files is available in partition 1 of USB or SD before configuring
the event.
4.

Reboot the system to trigger the auto installation of the system image from the USB device.

moxa@moxa-tbzkb1090918:~# sudo reboot

Updating Moxa Industrial Linux Using
SecureApt
Moxa Arm-based computers support SecureApt, which uses a GPG public key system to ensure theintegrity and authenticity of patches are validated before download, and x.509 certification authentication
for secure transmission via HTTPS. The private key pair of the GPG key for the Moxa APT repository is
stored in an on-premises Sign Server, accessible only by authorized Moxa personnel.

NOTE
Click the following link for more information on how SecureAPT works:
https://wiki.debian.org/SecureApt

Querying the System Image Version
Use the mx-ver command to check the system image version on your Arm-based computers.

moxa@moxa-tbzkb1090923:# mx-ver
UC-8220-T-LX-US-S MIL3 version 1.0 Build 22052300

Failback Update
We strongly recommend enabling the failback function before performing an update. Refer to failback
feature in the Moxa System Manager (MSM) for details.

Managing the APT Repository
The APT Repository is the network server from which APT downloads packages that are installed on yourMoxa Arm-based computer. By default, Moxa Arm-based computers include the following repositories that
contain stable and well-tested packages best suited for ensuring the stability of your project.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

56

Source list

Repository URL

Description
Debian official repository containing the latest
https://deb.debian.org/debianstable Debian 11 release (released about every 2bullseyemonths)https://deb.debian.org/debian Debian official repository containing bug fixes that
/etc/apt/sources.listbullseye-updates
will be included in the upcoming Debian 11 release
Debian official repository containing security
https://deb.debian.org/debianhotfixes that will be included in the upcoming-security/bullseye-security
Debian 11 release
Moxa repository containing Moxa’s proprietary/etc/apt/sources.list.d/ https://debian.moxa.com/mil3 library, tools, utilities, and kernel. Moxa will
moxa.list
maintain security and bug fixes even after Debianbullseye
11 has reached its end of life (EOL).
To add a new repository, you must add the repository URL and official GPG key to the source list andkeyring in your Moxa Arm-based computer.
Here is an example for adding the Docker repository https://docs.docker.com/engine/install/debian/.
1.

Add the repository URL to the source list on your Arm-based computer.

moxa@moxa-tbzkb1090923:# echo "deb https://download.docker.com/linux/debianbullseye stable" > /etc/apt/sources.list.d/docker.list
2.

Add the official GPG public key of the Docker repository to the keyring in your computer for SecureAPT.

moxa@moxa-tbzkb1090923:# curl -fsSL
https://download.docker.com/linux/debian/gpg | gpg --dearmor -o/etc/apt/trusted.gpg.d/docker.gpg
3.

Verify the newly added Docker repository by running an update.

moxa@moxa-tbzkb1090923:# apt update
Get:1 https://download.docker.com/linux/debian bullseye InRelease [43.3 kB]
Hit:2 http://deb.debian.org/debian bullseye InRelease Get:3
http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]
Get:4 https://download.docker.com/linux/debian bullseye/stable amd64
Packages [13.8 kB] Get:5 http://deb.debian.org/debian bullseye-updates
InRelease [44.1 kB] Get:6 http://deb.debian.org/debian-security bullseyesecurity/main amd64 Packages [191 kB] Fetched 341 kB in 1s (356 kB/s)
Reading package lists... Done Building dependency tree... Done Reading state
information... Done 30 packages can be upgraded. Run 'apt list --upgradable'
to see them.

Updating Your System
Preparing a Staging Environment
Since Moxa Arm-based computers are open platforms, you are free to install any software that you would
like to use. However, we highly recommend that you test all new software on a staging platform before
installing them on your production gateways.

Synchronizing the Repository Information
The first and most important step is to synchronize the package index files in your Arm-based computerwith the source repositories specified in the file /etc/apt/sources.list. When you perform thesynchronization, information related to the packages, including versions and dependencies, will also be
downloaded from the repositories.
To perform the synchronization, make sure that your network environment can connect to the APT
repositories, and then run the apt update command with root permission to synchronize the package
index.

moxa@moxa-tbbbb1182827:# sudo apt update

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers57

Updating the Entire System
Use the apt full-upgrade command to upgrade all packages used by your Moxa Arm-based computer tolatest versions.

moxa@moxa-tbbbb1182827:# sudo apt full-upgrade

Updating the Bootloader
When a updated Bootloader firmware is available, Moxa will publish a notification on the Moxa Arm-based
computer product page and upload the new firmware to the Moxa APT repository. You can download thefirmware (.bin format) via SecureAPT so that the authenticity and integrity of the firmware is verified.

NOTE
Click the following link for more information on how SecureAPT
https://wiki.debian.org/SecureApt

Querying the Current Bootloader Version
Use the mx-bootloader-mgmt upgrade -i command to check the current Bootloader version of yourArm-based computer.

root@moxa-tbbbb1182827:# mx-bootloader-mgmt upgrade -i
Current bootloader information:compatible model: UC-8200
bootloader version: 3.0.0S05
sha256sum: 28e2409b9a255e72c5ddd6f8007217be0d49bea21536086f67c2cabb29a9ee05
md5sum: 70199c3b44b37b7e07fecb8df675fd4c

Updating Bootloader With the Firmware Binary
Use the mx-bootloader-mgmt upgrade -f [file path] command to update the Bootloader

root@moxa-tbbbb1182827:# mx-bootloader-mgmt upgrade -f/media/USB_p1/bootloader.bin
The version of bootloader being updated: 3.0.0S07
The version of current bootloader: 3.0.0S07
Your bootloader version is the same as the version of bootloader being updated.
Do you want to continue? (y/N)yStart to upgrade bootloader…
Upgrade /dev/mtd1 bootloader to version 3.0.0S07 successfully

Updating with the Failback Function Enabled
We highly recommend you enable failback before performing the bootloader update due to a power outage
may cause the device to be unable to boot. Refer to failback feature of Moxa System Manager (MSM) tool.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers58

7. Backup, Decommission, and Recovery

In this chapter, we will introduce how to use Moxa System Management (MSM) utility to perform snapshot,
backup, decommission, and recovery of your system. MSM provides an automatic failback mechanism toensure that the device can recover to the last known working and secure state when the device fails after acritical event such as a system update.
Function

Snapshot

BackupAutomatic Failback Recovery

Description•
The snapshot has a smaller footprint as it saves just the differences(partition 3 in Figure 7.1) compared to the out-of-factory rootfs(partition 2 in Figure 7.1).
•
The snapshot is saved in the Moxa Arm-based computer and cannot beexported. Hence, a snapshot can only be used to restore the computerthat the snapshot was taken from.
•
The backup has a larger footprint as it saves the entire system
including the out-of-factory rootfs.
•
The backup can be exported to an external storage.
•
The backup can be used to restore the Moxa Arm-based computer thatthe backup is taken from or another computer of the same model.
•
When failback recovery is enabled, a replica of the system including thesnapshot and bootloader is created.
•
If a boot failure event occurs after failback recovery is enabled, thesystem will automatically use the replica to recover the system•
Failback recovery should be enabled before performing any criticalactions that may potentially result in a device failure (e.g., power loss
during a bootloader update could brick a computer).

Below diagram illustrate an overview of MIL3 system layout:

Figure 7.1 - Layout Overview of Arm-based Computer with MIL3

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

59Creating a System Snapshot
A snapshot preserves the state and data of the Moxa Arm-based computer as a restoration point at a
specific point in time so that you can restore it to that point if something goes wrong. Snapshots only savethe Linux kernel and new and modified files to the out-of-factory rootfs (partition 2). Therefore, the size of asnapshot is much smaller than a backup.
Use the # mx-system-mgmt snapshot <sub-command> <flag> to create restore a system. You mustuse sudo or run the command with root permission.
Sub-commands

deletelnfo

Description
Creates a snapshot of system•
A snapshot includes kernel (partition 1) and rootfs (partition 3)•
Only one snapshot is saved. A new snapshot will overwrite the previous snapshot•
Snapshot is stored in rootfs (partition 3)
Restores the system with the snapshot. System failback will be disabled after a system
is restored from the snapshot.
Deletes the existing snapshot
Displays the create time and size of the existing snapshotFlag-y or --yes

Description
Automatically consent to the prompts during create, restore, and delete processes

createrestoreWARNING
Before initiating the backup or snapshot proces, it is crucial to ensure that all active services involving
customer-developed software, are temporarily disabled. Services that are running during the backup may
lock certain files, preventing them from being copied and resulting in an incomplete backup. This cancompromise the integrity of your backup and the ability to fully restore your system later.

Creating a System Backup
Compares to snapshot, a backup saves Linux kernel and the rootfs on your Moxa Arm-based Computer.
Therefore, a backup can be exported and use to restore a Moxa Arm-based computer of the same modelwith MIL 3.0. For example, if you create a backup on UC-8200 Secure model with MIL3, you can use thebackup to restore another UC-8200 Secure model with MIL3
Use # mx-system-mgmt backup <sub-command> <flag> command to create, delete, and restore abackup. You must use sudo or run the command with the root permission.
Sub-commands

createdeleterestoreinfo-D or --directory

Description
Creates a backup of the system•
The backup includes kernel (partition 1), rootfs (partition 2), and rootfs(partition 3)•
By default, the backup is created in the /boot_device/p3/backup/ directorywith the name backup.tar, together with an info file that contains the backup
information and cryptographic hash of the backup.
•
The backup includes system snapshot. If you would like to reduce the size of
backup, you can delete the snapshot in the system before performing the backup
if the snapshot is not needed.
Deletes the backup from default directory
Restores the system using the backup from default directory.
•
System failback will be disabled after restoration.
•
Existing snapshot on system will be deleted after restoring the system from abackup.
•
The cryptographic hash in the info file will be used to validate the integrity of the
backup file before the restore process begin.
•
A system reboot is required after restoration.
Displays the create time and size of the backup in the default directorySpecifies the directory for create, delete, restore and info commands

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

60

Flag
-y or --yes

Description
Automatically consent to the prompt during create, delete and restore

The following example shows how to back up a system to a USB storage drive with the mounting point/media/USB_p1:

moxa@moxa-tbzkb1090923:# sudo mx-system-mgmt backup create -D /media/USB_p1
Set /media/USB_p1 as backup directory.
Check the backup information...
There is no backup information
Start evaluating space, please wait...
Estimation of Required Space: 628MB
Available Space: 32756MB
Would you like to continue? (y/N)ySynchronize boot files...
00%0.00kB/s
0:00:00 (xfr#0, to-chk=0/2)
Start creating backup file...
628MiB 0:00:57 [11.0MiB/s] [ <=> ]Type: backup
Create Time: 2021.11.06-17:32:29
Size: 628MB
The backup has been created successfully under: /media/USB_p1
The following example shows how to restore a backup from the USB storage drive with the mounting point/media/USB_p1:

moxa@moxa-tbzkb1090923:# sudo mx-system-mgmt backup restore -D /media/USB_p1
Set /media/USB_p1 as backup directory.
Check the backup information...
Type: backup
Create Time: 2021.11.06-17:44:43
Size: 628MB
Start verifying backup file, please wait...
Verified OK!
Start evaluating space, please wait...
Estimation of Required Space: 628MB
Available Space: 5125MB
Would you like to continue? (y/N)yCheck the snapshot information...
Type: snapshot
Create Time: 2021.11.06-15:42:47
Size: 235MB
This will delete the existing snapshot.
Do you want to continue? (y/N)yCheck the snapshot information...
Type: snapshot
Create Time: 2021.11.06-15:42:47
Size: 235MB
The snapshot has been deleted successfully.
To restore the backup file will overwrite current system and factory default
system.
Do you want to continue? (y/N)yStart using the backup file to restore the system...
628MiB 0:01:00 [10.4MiB/s] [============================================>]
100%
Synchronize boot files...
00%0.00kB/s
0:00:00 (xfr#0, to-chk=0/2)
System has been restored successfully. Reboot is required to take effect.
moxa@moxa-tbzkb1090923:# sudo reboot

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

61

WARNING
Before initiating the backup or snapshot proces, it is crucial to ensure that all active services involving
customer-developed software, are temporarily disabled. Services that are running during the backup may
lock certain files, preventing them from being copied and resulting in an incomplete backup. This cancompromise the integrity of your backup and the ability to fully restore your system later.

Setting the System to the Default
Press and hold the FN button for 7 to 9 seconds to reset the computer to the factory default settings. Whenthe reset button is held down, the LED will blink once every second. The LED will become steady when you
hold the button continuously for 7 to 9 seconds. Release the button immediately when the LED become
steady to load the factory default settings. For additional details on the LEDs, refer to the quick installation
guide or the user’s manual for your Arm-based computer

ATTENTION
Reset-to-default will erase all data stored on the boot-up storage
Back up your files before resetting the system to factory defaults. All the data stored in the Arm-based
computer’s boot-up storage will be destroyed after resetting to factory defaults.
You can also use the mx-system-mgmt default restore command to restore the computer to factory
default settings. You must use sudo or run the command with the root permission.

moxa@moxa-tbzkb1090923:/# sudo mx-system-mgmt default restore
If you would like to configure the FN button for a different action (e.g., restore to a snapshot), refer toCustomize the Button Action section.

Decommissioning the System
Compared with the set-to-default function, decommissioning will further erase all data stored in the log
partition to help erase security-sensitive information.

ATTENTION
Decommission will erase all the data including event and audit logs
Please back up your files before resetting the system to factory defaults. All user data including logs inyour Arm-based computer will be destroyed after performing decommissioning. Bootloader configuration,
including administrator password, will also be set to factory default.
You can also use the mx-system-mgmt default decommission command to restore the computer tofactory default. You must use sudo or run the command with the root permission.

moxa@moxa-tbzkb1090923:/# sudo mx-system-mgmt default decommission
The decommissioning process will do the following:
1.

Overwrite the system partition 4 times with shred so that all user files will be deleted and cannot berecovered.

2.

Overwrite the log partition 4 times with shred so that all log files will be deleted and cannot berecovered.

3.

Trigger the bootloader decommissioning function, so all configurations and log messages in thebootloader are also deleted and cannot be recovered.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

62System Failback Recovery
A system bootup failure may occur when critical files are lost or corrupted. A typical and common cause ofboot up failure is power lost during system update. Moxa System Management (MSM) provides system
failback capability which can automatically recovers your system to the last known working state if boot up
failure is detected after critical change(s) are made to the primary system. The boot failure criteria arecustomizable by user.
Before applying critical update or changes to the device, it is recommended to enable system failback first.

Use # mx-system-mgmt system-failback <sub-command> <flag> to enable or disable system
failback. You must use sudo or run the command with the root permission.
Sub-commands

disableinfo
state

Description
Enables system failback and create a replica of the system•
The replica includes Bootloader, kernel (partition 1) and rootfs (partition 3)•
The replica is stored in rootfs (partition 3)•
When the Moxa Arm-based computer fails to boot up, the device will automaticallyreboot and replace the broken system with the working replica.
•
The replica includes a system snapshot. If you would like to reduce the size of thereplica, you can delete the snapshot if you no longer need it.
Disables the system failback and delete the existing system replica
Displays the create time and size of replica
Displays the status of system failback (enabled/disabled)Flag-y or --yes

Description
Automatically consent to the prompts during the enable and disable processes

enableBelow is an example of how to enable system failback and display the information of the system replica:

moxa@moxa-tbzkb1090923:/# sudo mx-system-mgmt system-failback enable
Start evaluating space, please wait...
Estimation of Required Space: 233MB
Available Space: 5333MB
Would you like to continue? (y/N) y
Start processing...
Synchronize boot files...
00%0.00kB/s
0:00:00 (xfr#0, to-chk=0/2)
00%0.00kB/s
0:00:00 (xfr#0, to-chk=0/2)
Start creating replica...
244,670,045 99%
11.94MB/s
0:00:19 (xfr#170, to-chk=0/294)
Type: replica
Create Time: 2021.11.06-14:35:14
Size: 235MB
The system failback has been enabled and the replica has been createdsuccessfully.
moxa@moxa-tbzkb1090923:/# sudo mx-system-mgmt system-failback info
Check the replica information...
Type: replica
Create Time: 2021.11.06-14:35:14
Size: 235MB

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

63

Customize the Boot Up Failure Criteria
If you would like to customize the boot failure criteria, you can edit below script to add criteria you like
Moxa System Manager to check.

/etc/moxa-system-manager/check-hooks.d/99-example.sh

In below example in 99-example.sh, Moxa System Manager will consider the boot up is successful if“moxa-connection-manager.service” start successfully by returning a zero value. If the program returns a
non-zero value, the moxa-system-manager service will not mark this startup as successful, and it will enter
the system-failback process to restore the system.

#systemctl is-active moxa-connection-manager.service && exit 0 || exit 1

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers64

8. Security Capability

In this chapter, we will introduce Moxa Arm-based computers key security functions and a security
hardening guide to deploy and operate Moxa computer in a secure manner

Communication Integrity and Authentication
Below is a list of network communication services and protocols available in the Moxa Arm-based computer
and their data integrity and authentication protection mechanisms.
Service
SSH server and client
SFTP server
SCP serverProtocol
SSH
SSH
SSH

Data Integrity

Data Authentication

HMAC algorithm is used toguarantee data integrity

Uses key signature algorithms
such as ED25519, ECDSA, or
RSA to verify authenticity.

APT client

HTTPS

SecureAPT uses checksum toguarantee data integrity

SecureAPT uses GPG public key
system to validate dataauthenticity

NTP client (NTS support)

TLS/SSL, NTP

NTS guarantees data integrity
NTS provides TLS layer to
via NTS Authenticator andguarantee authenticity
Encrypted EF

ATTENTION
For post-installed communication services and protocols, you must ensure data integrity andauthentication are implemented. If integrity and authentication are not available, you must use additional
compensating countermeasures in system to compensate the risk. For example, physical cable protection
for serial Modbus RTU.

User Account Permissions and Privileges
Switching to the Root Privilege
In Moxa Arm-based computers, the root account is disabled in favor of better security. The default user
account moxa belongs to the sudo group. Sudo is a program designed to let system administrators allow
permitted users to execute some commands as the root user or another user. The basic philosophy is to
give as few privileges as possible but still allow people to get their work done. Using sudo is better (safer)than opening a session as root for a number of reasons, including:•

Nobody needs to know the root password (sudo prompts for the current user's password). Extra
privileges can be granted to individual users temporarily, and then taken away without the need for apassword change.

•

It is easy to run only the commands that require special privileges via sudo; the rest of the time, youwork as an unprivileged user, which reduces the damage caused by mistakes.

•

Some system-level commands are not available to the user moxa directly, as shown in the sample
output below:

moxa@Moxa-tbzkb1090923:~$ sudo ifconfig
eth0
Link encap:Ethernet HWaddr 00:90:e8:00:00:07
inet addr:192.168.3.127 Bcast:192.168.3.255 Mask:255.255.255.0
UP BROADCAST ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

65RX bytes:0 (0.0 B)

TX bytes:0 (0.0 B)

eth1

Link encap:Ethernet HWaddr 00:90:e8:00:00:08
inet addr:192.168.4.127 Bcast:192.168.4.255 Mask:255.255.255.0
UP BROADCAST ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

lo

Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:32 errors:0 dropped:0 overruns:0 frame:0
TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2592 (2.5 KiB) TX bytes:2592 (2.5 KiB)

You can switch to the root account using the sudo -i (or sudo su) command. For security reasons, do
not operate the all commands from the root account.

NOTE
Click the following link for more information on the sudo command.
https://wiki.debian.org/sudo

ATTENTION
You might get the permission denied message when using pipe or redirect behavior with a non-root
account.
You must use ‘sudo su –c’ to run the command instead of using >, <, >>, <<, etc.
Note: The single quotes enclosing the full command are required.

Controlling Permissions and Privileges
Moxa Industrial Linux uses Discretionary Access Control (DAC) based on Access Control Lists (ACLs) to
manage permissions and privileges, which an object has an owner that controls the permissions to accessthe object. Subjects can transfer their access to other subjects. In other words, the owner of the resource
has full access and can determine the access type (rwx: read, write, execute) of other users.
You can use chmod command to configure who (user, group, other) can do what (read, write, execute) to a
file or directory. The access permission is extended by Access Control Lists (ACLs) authorization. ACL
provides a more flexible mechanism that allows multiple users and groups to own an object. You can checkand configure access control lists of a specific file or directory using getfacl and setfacl commands.

NOTE
Click the following link for more information on usages of chmod and Access Control Lists (ACLs)
https://wiki.debian.org/Permissions
Moxa Arm-based computers only provide one account in sudo group by default because it is intended for thesystem integrator to customize and build their applications on top.
The system integrator shall be responsible for setting the appropriate permissions to roles and user
accounts to enforce the concept of least privilege.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

66

Linux Login Policy
Invalid Login Attempts
Moxa Industrial Linux provides the capability to configure allowed invalid login attempts to mitigate against
Denial-of-Service (DoS) and Brute-force attack.
Security Model
Secure modelStandard model

Default Rule[5] consecutive invalid login within [60] seconds will deny access for [300]seconds.
Not setFollowing is the configuration file and variable to configure the setting:Configuration Option
Consecutive invalid login
Within how many seconds
Deny access for how long (in seconds)

Configuration file/etc/security/faillock.conf/etc/security/faillock.conf/etc/security/faillock.conf

Variable to Set
deny
fail_interval
unlock_time

More configurable options can be found in following reference:•login.defs(5) — login — Debian bullseye — Debian Manpages•

faillock.conf(5) — libpam-modules — Debian bullseye — Debian Manpages

Session Termination After Inactivity
This setting automatically terminates the login sessions after a standard period of inactivity. Below is thedefault configuration set in Moxa Arm-based computer.
Security Model
Secure modelStandard model

Default Value•
Automatically logout standard user after 900 second of inactivity•
Automatically terminate root privilege of sudo user after 900 second of inactivity
Not setFollow below instructions to configure the inactivity time:
Login Method

Configuration•
Set the value (in seconds) of variable TMOUT in /etc/profile.d/99-moxa-

Serial Console and •SSH (Secure Shell)•

profile.conf

Apply the same value to variable ClientAliveInterval in/etc/ssh/sshd_config.d/00-moxa-sshd.conf
To apply the rule to sudo user, make sure variable env_keep+="TMOUT" exist in/etc/sudoers.d/00-moxa-sudoers-conf

Login Banner Message
You can set a message banner message to displaying welcome or informational messages or warming
message to un-authorized users. Follow below instructions to add a banner Moxa Industrial Linux 3.0 UM forArm-based Computers Moxa Industrial Linux 3.0 UM for Arm-based Computers.
Login Method
Serial Console

Banner Content/etc/issue

SSH (Secure Shell)/etc/issue.net

Additional Configuration Requiredn/a
Add variable Banner /etc/issue.net is added in/etc/ssh/sshd_config.d/00-moxa-sshd.conf

Bootloader Login Policy
For bootloader login policy management, refers to the bootloader configuration section.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

67

Secure Boot and Disk Encryption
Secure boot and disk encryption are available in Secure model, designed to make platform integration moresecure. Moxa’s secure boot process begins from CPU as hardware root-of-trust to ensure integrity andauthenticity of bootloaders and Linux kernels are validated with Moxa digital signature before execution,
preventing malicious or un-authenticated bootloader and kernels to run on Moxa Arm-based computer.
Next, only after bootloader and kernel have been validated, the LUKS (Linux Unified Key Setup) encryptedroot file system (rtfs) will be decrypted by a key provisioned in TPM during factory production. The disk
encryption prevent confidential data could be read without authorization when the device is stolen or lost.

Public key infrastructure (PKI)
Moxa secure boot use X.509 public key infrastructure (PKI) to validate authenticity and integrity ofbootloader and Linux kernel.

How are private keys protected?
Private keys used to digital sign Moxa software are stored in on-premises tamper and intrusion-resistanthardware security module (HSM), where strict access authorization and 24-hour video surveillance areapplied.

Key lifecycle and revocation
In an unlikely scenario where the private key stored in HSM is compromised, Moxa will announce the news
on Moxa Security Advisory, including instructions to revoke the compromised public key burned in the CPU
via a utility downloadable from Moxa APT repository. Then update the bootloader and system image signed
by a new private key.

ATTENTION
DO NOT arbitrarily replace the kernel or bootloader on Secure models, or the computer will not be able toboot up.

Trusted Platform Module (TPM 2.0)
The Moxa Arm-based computer includes a TPM 2.0 hardware module. TPM provides a hardware-based
approach to manage user authentication, network access, data protection and more that takes security tohigher level than software-based security. It is strongly recommended to manage keys with TPM and also
store digital credentials such as passwords
The TPM can be managed via the tpm2_tools pre-installed in Moxa Industrial Linux(https://github.com/tpm2-software/tpm2-tools).
TPM software stack & tool is maintained by tpm2-software community
https://tpm2-software.github.io/
A good reference of TPM 2.0 introduction
https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_3

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

68

Host Intrusion Detection
Secure model of Moxa Arm-based computer comes with AIDE (Advanced Intrusion Detection
Environment) preconfigured. AIDE is a lightweight but powerful host intrusion detection utility for checking
the integrity of files.
The out-of-factory Moxa Arm-based computer comes with a database created by AIDE at the first timebootup containing all security configurations set by Moxa. You can compare the system's status against thisdatabase to find out if there is any integrity breach. You can also update the database after making changes
to the configuration or adding additional software.

Default Monitored Files
Below are the security configuration files and directories included in the default database created by Moxa.
The database is aide-moxa.db and put under /var/lib/aide/aide-moxa.db•

The configuration file of AIDE is /etc/aide/aide-moxa.conf; you can add additional files anddirectories to the database•

Configuration Type

File

DirectoryPath/etc/adduser.conf/etc/login.defs/etc/logrotate.conf/etc/nftables.conf/etc/profile/etc/rsyslog.conf/etc/sudoers/etc/aide/etc/audit/etc/logrotate.d/etc/moxa/MoxaComputerInterfaceManager/etc/moxa/MoxaConnectionManager/etc/moxa/moxa-guardian/etc/pam.d/etc/security/etc/profile.d/etc/rsyslog.d/etc/ssh/etc/sudoers.d/var/lib/moxa-guardian

To run a comparison between current system against the Moxa AIDE database, run aide --check -c/etc/aide/aide-moxa.conf

moxa@moxa-tbbbb1182827:/# sudo aide --check -c /etc/aide/aide-moxa.conf
Start timestamp: 2022-06-12 13:47:38 +0000 (AIDE 0.17.3)
AIDE found NO differences between database and filesystem. Looks okay!!
Number of entries:
254--------------------------------------------------The attributes of the (uncompressed) database(s):--------------------------------------------------/var/lib/aide/aide-moxa.db
MD5: A8wKxphrNVlWz31AVf3esA==
SHA256: trGvVioXdZf/RISmj3v60mQsmcrqK4kV
sUFm068cLOs=
End timestamp: 2022-06-12 13:47:39 +0000 (run time: 0m 1s)
To update the database after you have make configuration changes, run aide --init -c/etc/aide/aide-moxa.conf

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

69You should see following output which created a new AIDE database aide-moxa.db.new under/var/lib/aidemoxa@moxa-tbbbb1182827:/# sudo aide --init -c /etc/aide/aide-moxa.conf
Start timestamp: 2022-06-12 14:39:30 +0000 (AIDE 0.17.3)
AIDE initialized database at /var/lib/aide/aide-moxa.db.new
Number of entries:
254--------------------------------------------------The attributes of the (uncompressed) database(s):--------------------------------------------------/var/lib/aide/aide-moxa.db.new
MD5: Mb74vEG93jjVfJMGSZa+DA==
SHA256: ENl5QGVgYXuKEwE3FSXRfzxl3vJg0TxU
WsQnHN16E74=
End timestamp: 2022-06-12 14:39:30 +0000 (run time: 0m 0s)
For AIDE to use the new database, you need to rename it to aide-moxa.db

moxa@moxa-tbbbb1182827:/# sudo mv /var/lib/aide/aide-moxa.db.new/var/lib/aide/aide-moxa.db
At this point, you can run aide --check -c /etc/aide/aide-moxa.conf to compare current systemagainst the updated AIDE database

How to Perform Authenticity an Integrity Check on All Files
If you would like to ensure authenticity and integrity of all files in the Moxa Arm-based computer, you cancreate a openSSL signed database containing every single file under the filesystems, then validate theauthenticity of the database before using AIDE to check the integrity of all files in the filesystem. Following
below steps to create such AIDE database.
1.

Create a database using /etc/aide/aide-fs.conf; this configuration file monitors every single filein the filesystem.

2.

Rename the created database to /var/lib/aide/aide-fs-moxa.db

3.

moxa@moxa-tbbbb1182827:/# sudo aide --init -c /etc/aide/aide-fs.conf

Generate a 4096-bit RSA private key.

moxa@moxa-tbbbb1182827:/# sudo openssl genrsa -out aide-key.pem 4096
Generating RSA private key, 4096 bit long modulus (2 primes)...........................................................................++++....................................++++
e is 65537 (0x010001)
Enter pass phrase for aide-key.pem:

ATTENTION
You MUST keep the private key and pass phrase in a secure location.
4.

Generate a public key from the private key:moxa@moxa-tbbbb1182827:~$ sudo openssl rsa -in aide-key.pem -pubout -out
aidekey.pub
Enter pass phrase for aide-key.pem:
writing RSA key
moxa@moxa-tbbbb1182827:~$

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

70

5.

Generate a digital signature of aide-filesystem-moxa.db by the private key.

moxa@moxa-tbbbb1182827:~$ sudo openssl dgst -sha256 -sign aide-key.pem -outaide-filesystem-moxa.db.sha256 /var/lib/aide/aide-fs-moxa.db
Enter pass phrase for aide-key.pem:

6.

Now, you can distribute the database, public key and signed signature to other location, such as acentralized remote system.

7.

Verify the database has been tampered or not.

moxa@moxa-tbbbb1182827:~$ sudo openssl dgst -sha256 -verify aide-key.pub signature aide-filesystem-moxa.db.sha256 /var/lib/aide/aide-fs-moxa.db
Verified OK
8.

After the AIDE database’ authenticity has been validated, you can run a comparison between current
system against the AIDE database using aide --check -c /etc/aide/aide-fs.conf

NOTE
Click the following link for more information on usages of AIDE
https://manpages.debian.org/bullseye/aide-dynamic/aide.1.en.html

Intrusion Prevention
Fail2ban is pre-installed in Moxa Industrial Linux as an intrusion prevention software framework designed
to prevent against brute-force attacks

NOTE
Click the following link for detail instructions of Fail2ban usage
https://www.fail2ban.org/wiki/index.php/Main_Page

Network Security Monitoring
Zeek is pre-installed in Moxa Industrial Linux for network security monitoring. Zeek is a passive network
traffic analyzer. Many operators use Zeek as a network security monitor (NSM) to support investigations ofsuspicious or malicious activity. Zeek also supports a wide range of traffic analysis tasks beyond the security
domain, including performance measurement and troubleshooting. Zeek provides an extensive set of logs
describing network activity. These logs include not only a comprehensive record of every connection seen on
the wire, but also application-layer transcripts
If you have configured cellular(4G/LTE) and ethernet networks in Moxa Connection Manager (MCM).
You can also enable Zeek to monitor the network traffic of these interfaces. Following the simple instruction
below:
1.

2.

Export the Zeek environment.

export PATH=$PATH:/opt/zeek/bin
export ZEEK_PREFIX=/opt/zeek[Required] Configure the interface to monitor by running # vim $ZEEK_PREFIX/etc/node.cfg.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

71

3.

[Required] Modify the interface list according to the interface you like to monitor. For example, add
LAN1, LAN2, and cellular (4G/LTE) in the list.

# This example has a standalone node ready to go except for possibly
changing# the sniffing interface.

4.

# This is a complete standalone configuration.
# only need to change the interface.
[zeek]
type=standalone
host=localhostinterface=eth0,eth1,wwan0

Most likely you will

[Optional] change the MailTo email address to a desired recipient and the

LogRotationInterval to a desired log archival frequency
vim $ZEEK_PREFIX/etc/zeekctl.cfg# Recipient address for all emails sent out by Zeek and ZeekControl.
MailTo = root@localhost5.

# Rotation interval in seconds for log files on manager (or standalone)node.
# A value of 0 disables log rotation.
LogRotationInterval = 3600

[Required] Run $ZEEK_PREFIX/bin/zeekctl to start Zeek

root@moxa-tbbbb1182827:/home/moxa# $ZEEK_PREFIX/bin/zeekctl
Hint: Run the zeekctl "deploy" command to get started.
Welcome to ZeekControl 2.4.0

6.

Type "help" for help.
[ZeekControl] >[Required] For the first-time use of the shell, use install command to perform initial installation of
the ZeekControl configuration.

[ZeekControl] > install7.

creating policy directories ...
installing site policies ...
generating standalone-layout.zeek ...
generating local-networks.zeek ...
generating zeekctl-config.zeek ...
generating zeekctl-config.sh ...
[ZeekControl] >[Required] Start Zeek instance by Start command (Use CTRL+D to exit if initializing successfully).

[ZeekControl] > start

8.

starting zeek ...
(zeek still initializing)

View the Zeek logs under $ZEEK_PREFIX/logs.

root@moxa-tbbbb1182816:/# ls -alh /opt/zeek/logs/current/
total 96K
drwxr-sr-x 2 root zeek 4.0K Jun 19 04:18 .
drwxrws--- 1 root zeek 4.0K Jun 19 04:17 ..
-rw-r--r-- 1 root zeek 250 Jun 19 04:18 capture_loss.log-rw-r--r-- 1 root zeek 128 Jun 19 04:17 .cmdline-rw-r--r-- 1 root zeek 583 Jun 19 04:18 conn.log-rw-r--r-- 1 root zeek 352 Jun 19 04:17 .env_vars-rw-r--r-- 1 root zeek 30K Jun 19 04:17 loaded_scripts.log-rw-r--r-- 1 root zeek 753 Jun 19 04:18 notice.log-rw-r--r-- 1 root zeek 227 Jun 19 04:17 packet_filter.log-rw-r--r-- 1 root zeek
5 Jun 19 04:17 .pid

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers72

-rw-r--r-- 1 root zeek-rw-r--r-- 1 root zeek-rwxr-xr-x 1 root zeek-rw-r--r-- 1 root zeek-rw-r--r-- 1 root zeek-rw-r--r-- 1 root zeek

61 Jun 19 04:17 .startup
686 Jun 19 04:17 stats.log
19 Jun 19 04:17 .status
19 Jun 19 04:17 stderr.log
204 Jun 19 04:17 stdout.log
367 Jun 19 04:18 weird.log

NOTE
Click the following link for Zeek’s detail instruction and also the explanation on log types
https://docs.zeek.org/en/master/quickstart.html
If you prefer not to use ZeekControl (e.g., you don’t need its automation and management features), you
can refer to https://docs.zeek.org/en/master/quickstart.html#zeek-as-a-command-line-utility on how to
directly control Zeek for your analysis activities from the command line for both live traffic and offline
working from traces.

Firewallnftable is the built-in firewall in Moxa Industrial Linux. Secure model of Moxa Arm-based computer has preconfigured rules to further protect your device from network attacks.

NOTE
Click the following link for detail instructions of nftable usages
https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes

Pre-configured Rule
Below is a summary of nftable rules in /etc/nftables.conf set by Moxa in Secure model of Moxa Armbased computer. For Standard model, nftable is not enabled by default.
Rules Set
Location/Parameters
Allowed only ports following port
define tcp_port_allow = { ssh, https };•TCP: SSH (22), HTTPS (443)define udp_port_allow = { 53, ntp };•UDP: NTP (123), DNS (53)Allow all traffic from loopback interface
iifname "lo" accept
Drop all input traffic except for traffic from allowed
chain input { ……}ports and icmp (ping)
Allow related and established traffic by using
ct state invalid drop
conntrack
ct state established,related accept
Drop all forward traffic
chain forward { ……}Accept all output traffic
chain output { ……}flush ruleset
define tcp_port_allow = { 22, 443 };define udp_port_allow = { 53, 123 };table inet filter {# input: drop all traffic
chain input {type filter hook input priority 0; policy drop;
ct state invalid drop
ct state established,related accept# allow icmp

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers73

icmp type {echo-request,
echo-reply,
time-exceeded,
parameter-problem,
destination-unreachable} accept# allow icmp6
icmpv6 type {echo-request,
echo-reply,
time-exceeded,
parameter-problem,
destination-unreachable,nd-neighbor-solicit,
nd-router-advert,nd-neighbor-advert} accept# accept lo
iifname "lo" accept}

tcp dport $tcp_port_allow accept
udp dport $udp_port_allow accept# foward: drop all traffic
chain forward {type filter hook forward priority 0; policy drop;}}# output: accept all traffic
chain output {type filter hook output priority 0; policy accept;}

Common nftable Usage
1.
2.

List the currently loaded nftable rules # nft list ruleset

Debug and tracing if traffic are drop or accept as expected # nft monitor trace

a. Add trace_chain before the existing input chain

nft add chain inet filter trace_chain { type filter hook prerouting
priority -1\; }b. Add nftrace flag

nft add rule inet filter trace_chain meta nftrace set 1
c. Monitor trace (you can use another device with ncat tool to test it)dd nftrace flagmoxa@moxa-tbbbb1182816:/# sudo nft monitor trace
trace id d51bda11 inet filter trace_chain packet: iif "eth0" ether saddr
d8:5e:d3:a5:7b:29 ether daddr 00:90:e8:a6:37:cb ip saddr 192.168.1.102 ip
daddr 192.168.1.107 ip dscp cs0 ip ecn not-ect ip ttl 128 ip id 36481 ip
protocol tcp ip length 52 tcp sport 1142 tcp dport 53 tcp flags == syn
tcp window 64240 trace id d51bda11 inet filter trace_chain rule meta
nftrace set 1 (verdict continue) trace id d51bda11 inet filter
trace_chain verdict continue trace id d51bda11 inet filter trace_chain
policy accept trace id d51bda11 inet filter input packet: iif "eth0"
ether saddr d8:5e:d3:a5:7b:29 ether daddr 00:90:e8:a6:37:cb ip saddr
192.168.1.102 ip daddr 192.168.1.107 ip dscp cs0 ip ecn not-ect ip ttl

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers74

128 ip id 36481 ip protocol tcp ip length 52 tcp sport 1142 tcp dport 53
tcp flags == syn tcp window 64240 trace id d51bda11 inet filter input
verdict continue trace id d51bda11 inet filter input policy drop
d. Once debugging is completed, make sure to remove the debug flag by either method below:

Restart nftable # systemctl restart nftables or

Reload the configuration again # nft -f /etc/nftables.conf

Rate Limiting
Rate limiting is a common strategy to prevent network attacks such as DOS, DDOS, and brute force bylimiting the network traffic within a specified time. As the suitable rate limit configuration depends heavily
on the asset owner's applications, rate limiting is not configured by default in Moxa Industrial Linux.
nftable Rate Limit Usage

rate [over] <value> <unit> [burst <value><unit>]

Example of Rate Limit Configuration
limit rate 400/minutelimit rate 400/hour
limit rate over 40/day
limit rate over 400/week
limit rate over 1023/second burst 10 packets
limit rate 1025 kbytes/second
limit rate 1023000 mbytes/second
limit rate 1025 bytes/second burst 512 bytes
limit rate 1025 kbytes/second burst 1023 kbytes
limit rate 1025 mbytes/second burst 1025 kbytes
limit rate 1025000 mbytes/second burst 1023 mbytes

You can directly add rate limit to existing rule in /etc/nftables.conf:
Below is an example of limiting TCP and UDP network traffic to 4 packets per second#!/usr/sbin/nft -f
flush ruleset
define tcp_port_allow = { ssh, https };define udp_port_allow = { 53, ntp };table inet filter {# input: drop all traffic
chain input {type filter hook input priority 0; policy drop;
ct state invalid drop
ct state established,related accept# allow icmp
ip protocol icmp icmp type {echo-request,
echo-reply,
time-exceeded,
parameter-problem,
destination-unreachable} accept# allow icmp6
ip6 nexthdr icmpv6 icmpv6 type {echo-request,
echo-reply,
time-exceeded,
parameter-problem,
destination-unreachable} accept

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers75

# accept lo
iifname "lo" accept
tcp dport $tcp_port_allow limit rate 4/second accept
udp dport $udp_port_allow limit rate 4/second accept}

Mitigating a NTP Amplification Attack
The default configured NTP servers in Moxa Industrial Linux(MIL) are with NTS support. If you use public
NTP servers without NTS support, it is vulnerable to the NTP amplification attack, in which theattacker could exploit the public NTP servers to overwhelm Moxa Arm-based computer with UDP traffic.
Under such an incident, you can follow the steps to stop the attack:1.

Stop NTP service temporarily with the # systemctl stop systemd-timesyncd command.

2.

Block the tainted NTP server by nftables commanda. Create new firewall table

nft add table inet firewall-filter
b. Create new chain input in firewall table

nft add chain inet firewall-filter input
c. Create new chain input in firewall table

nft add rule inet firewall-filter input tcp dport { ntp } ip saddr <yourip> rejectd. Block NTP server IP

nft add rule inet firewall-filter input tcp dport { ntp } ip saddr <yourip> rejecte. Check the rule set

nft list ruleset...
table inet firewall-filter {chain input {tcp dport { 123 } ip saddr 10.213.123.55 reject}}3.

You can choose to specify another NTP server (modify /etc/systemd/timesyncd.conf) or wait forthis server to finish troubleshooting

4.

Remember to flush the rule after recovery

nft delete chain inet firewall-filter input # delete chain# or
nft delete table inet firewall-filter # delete table

Service and Ports
Only activate protocols that you require to use the system. Below is the list for the protocol and port
numbers used for all external interfaces. Please refer to Firewall section to modify the list of allowed port if
additional port is required.
Protocol
SSH
HTTPS
NTS
DNS

Protocol Type
TCP
TCP
UDP
UDP

Port Number
22
443
123/4460
53

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

76

Disable Unnecessary Protocols, Services, and Ports
You can use #SS to list all the current running processes using with the associated service, protocol, andnetwork port.

moxa@moxa-tbbbb1182827:~$ sudo ss -tulpn
Netid
State
Recv-Q
Send-Q
Peer Address:Port
Process
tcp
LISTEN0128
0.0.0.0:*
users:(("sshd",pid=974,fd=3))
tcp
LISTEN0128[::]:*
users:(("sshd",pid=974,fd=4))

Local Address:Port
0.0.0.0:22[::]:22

You can disable a daemon or service by killing process ID (PID) directly. For example:

moxa@moxa-tbbbb1182827:~$ sudo kill 974
Or you can just stop and disable the service using #systemctl. For example:

moxa@moxa-tbbbb1182827:~$ sudo systemctl stop sshd
moxa@moxa-tbbbb1182827:~$ sudo systemctl disable sshd

Restrict Unnecessary Protocols, Services, and Ports
1.

Protocols:
Use nfables meta to match kind of TCP traffic Matching packet metainformation. Refers to nftables
wiki.

2.

3.

Services:
Use # systemctl list-unit-files to find unused services and disable them by systemctl
disable <service>.

Ports:

Use nftables to add accepted ports in whitelist. Refers to the Firewall section for detail instructions.

Services Enabled by Default
Below is the list for the services enabled by default in the secure model of the Moxa Arm-based computers.
Service Name
auditd.service
dbus.service
fail2ban.service
getty@tty1.service
ifupdown-pre.service
kmod-static-nodes.service
ModemManager.service
moxa-connection-manager.service
moxa-guardian.service
moxa-sys-rdy.service
moxa-system-manager-init.service
moxa-system-manager.service
MoxaComputerInterfaceManager.service

moxa-hostname.service

networking.service
NetworkManager.service
nftables.service
polkit.service
rsyslog.service
serial-getty@ttymxc0.service

Description
Security Audit log service
System Message Bus
Fail2ban IPS (intrusion prevention software)
Getty on tty1
Helper to synchronize boot up for ifupdown
Create list of static device nodes for the current kernel
DBus-activated daemon which controls mobile broadband(2G/3G/4G) devices and connections
Moxa Connection Manager (MCM)
Initializing security configuration for Moxa Industrial LinuxA service the light up the “READY” or “RDY” when the computer
successfully boots up
Moxa System Manager initialization service
Moxa System Manager
Moxa Computer Interface Manager
This service is designed to execute automatically during systemstartup, setting the hostname to a default unique value in theformat moxa-[serial number]. If you prefer to define a custom
hostname, you can disable this service by utilizing the'systemctl disable moxa-hostname.service' command."
Raises or downs the network interfaces
Network Manager
nftableFor controlling system-wide privileges is Moxa Industrial Linux
System Logging Service
Serial Getty on ttymxc0al-getty@ttymxc0.service

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

77Service Namesnmpd.service
ssh.service
sysstat.service
systemd-journal-flush.service
systemd-journald.service
systemd-logind.service
systemd-modules-load.service
systemd-random-seed.service
systemd-remount-fs.service
systemd-sysctl.service
systemd-sysusers.service
systemd-timesyncd.service
systemd-tmpfiles-setup-dev.service
systemd-tmpfiles-setup.service
systemd-udev-trigger.service
systemd-udevd.service
systemd-update-utmp.service
systemd-user-sessions.service
user-runtime-dir@1000.service
user@1000.service
vnstat.service
watchdog.service
wpa_supplicant.service

Description
Linux service for the Simple Network Management Protocol(SNMP)
SSH Server
A collection of performance monitoring tools for Linux.
Flush journal to persistent storage
Journal service
User login management
Early boot service that loads kernel modules
Service that loads an on-disk random seed into the kernel
entropy pool during boot and saves it at shutdown
early boot service that applies mount options listed in fstab(5)An early boot service that configures sysctl(8) kernelparameters
Creates system users and groups, based on the file format andlocation specified in sysusers.d(5)System service that synchronizes the local system clock with aremote Network Time Protocol (NTP) server
Create Static Device Nodes in /dev
Create Volatile Files and Directories
Coldplug all udev devicesd-udev-trigger.service
Listens to kernel uevents
Service that writes SysV runlevel changes to utmp and wtmp, as
well as the audit logs
a service that controls user logins through pam_nologin(8)Default user
Default user
network traffic monitor
Watchdog service
WPA supplicant

Managing Resources
Setting The Process Priority
A process can be manually adjusted to increase or decrease its priority. Use the top or ps commands to findout the process priority.

moxa@moxa-tbbbb1182827:/# sudo top
top - 22:08:43 up 6 min, 1 user, load average: 0.01, 0.04, 0.01
Tasks: 105 total,
1 running, 104 sleeping,
0 stopped,
0 zombie%Cpu(s): 0.2 us, 0.8 sy, 0.0 ni, 98.8 id, 0.1 wa, 0.0 hi, 0.0 si, 0.0 st
KiB Mem : 2068192 total, 1874520 free,
57416 used,
136256 buff/cache
KiB Swap:
0 total,0 free,0 used. 1799712 avail Mem
PID USER
1 root2 root3 root4 root5 root
6 root7 root
...

PR NI
20
0
20
0
20
0
20
0
0 -20
20
0
20
0

VIRT
9492
0
0
0
0
0
0

RES
6220
0
0
0
0
0
0

SHR S %CPU %MEM
5236 S 0.0 0.3
0 S 0.0 0.0
0 S 0.0 0.0
0 S 0.0 0.0
0 S 0.0 0.0
0 S 0.0 0.0
0 S 0.0 0.0

TIME+ COMMAND
0:00.98 systemd
0:00.00 kthreadd
0:00.01 ksoftirqd/0
0:00.02 kworker/0:0
0:00.00 kworker/0:0H
0:00.01 kworker/u2:0
0:00.02 rcu_sched

You can also use the ps command with the -l, long list option to find out the priority of the process.

moxa@moxa-tbbbb1182827:/# sudo ps -efl
F S UID
PID PPID C PRI NI ADDR SZ WCHAN STIME TTY
4 S root
1
0 0 800 - 2373 ep_pol 22:02 ?
/sbin/init

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

TIME CMD
00:00:0178

1 S root[kthrreadd]
1 S root[ksoftirqd/0]
1 S root[kworker/0:0H]
1 S root[kworker/u2:0]
1 S root[rcu_sched]
1 S root[rcu__bh]
...

2

0

0

80

0 -

0 kthrea 22:02 ?

00:00:00

3

2

0

80

0 -

0 smpboo 22:02 ?

00:00:00

52

0

60 -20 -0 worker 22:02 ?

00:00:00

6

2

0

80

0 -

0 worker 22:02 ?

00:00:00

7

2

0

80

0 -

0 rcu_gp 22:02 ?

00:00:00

8

2

0

80

0 -

0 rcu_gp 22:02 ?

00:00:00

The PRI (Priority) or NI (Nice) is the priority of the process. The PRI is adjusted by kernel automatically. The
NI can have a value in the range -20 to 19. A smaller value means that the program could use more CPU
resources.
The nice utility can be given a specific nice value while running a program. This example shows how tolaunch the tar utility with the nice value 5.

moxa@moxa-tbbbb1182827:/# sudo nice -n 20 tar -czvf TheCompressFile.tar /src1/src2 ...
ORmoxa@moxa-tbbbb1182827:/# sudo nice -adjustment 20 tar -czvf
TheCompressFile.tar /src1 /src2 ...
You can use the renice utility to dynamically adjust the nice value of a program. This example uses reniceto adjust the auditd, PID 639, with highest priority as -20.

moxa@moxa-tbbbb1182827:/# sudo renice -n 20 -p 639
moxa@moxa-tbbbb1182827:/# sudo ps -efl|grep auditd
1 S root639
1 0 75 -20 - 1519 poll_s 22:02 ?
/sbin/auditd -n...

00:00:00

NOTE
Click the following link for more information on usages of nice and renicehttps://manpages.debian.org/bullseye/coreutils/nice.1.en.html
https://manpages.debian.org/bullseye/bsdutils/renice.1.en.html

Setting the Process I/O Scheduling Class and Priority
The ionice command can adjust the priority of the program using I/O. The class and priority are
adjustable for a process.

-c class-n classdata-p PID

0: none1: realtime
2: best-effort
3: idleThe realtime and best-effort can set from 0 to 7. A smaller value means the program hasa higher priority.
Process ID

moxa@moxa-tbbbb1182827:/# sudo ps -l
F S
UID
PID PPID C PRI NI ADDR SZ WCHAN TTY
4 S
0
895
886 0 80
0 - 1794 wait
pts/0
4 S
0 1099895 0 80
0 - 1659 poll_s pts/0
4 R
0 1100 1099 0 80
0 - 1850 pts/0
moxa@moxa-tbbbb1182827:/# sudo ionice -c 2 -n 0 -p 895
moxa@moxa-tbbbb1182827:/# sudo ionice -p 895
best-effort: prio 0

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

TIME CMD
00:00:00 bash
00:00:00 sudo
00:00:00 ps

79

NOTE
Click the following link for more information on usages of ionicehttps://manpages.debian.org/bullseye/util-linux/ionice.1.en.html

Limiting the CPU Usage of a Process Using cpulimit
cpulimit is a simple program that attempts to limit the CPU usage of a process (expressed in percentage,
not in CPU time). This is useful to control batch jobs, when you don't want them to eat too much CPU.
This example, use the cpulimit to limit the usage of sshd process CPU limit percentage to 25% inbackground. The -p is the process ID. The -e switch take the executable program file name. The -l is the
CPU limit percentage. The option, -b, to run cpulimit in the background, freeing up the terminal.

moxa@moxa-tbbbb1182827:/# sudo cpulimit -p 895 -l 25 -b

NOTE
Click the following link for more information on usages of cpulimit
https://manpages.debian.org/bullseye/cpulimit/cpulimit.1.en.html

Limiting the Rate
Refer to the Chapter 8 Security Firewall Rate Limiting to customize the network limitation of the firewall
configuration.

Audit Log
In this section, we will introduce the audit event log design in Moxa Industrial Linux and bootloader,including the security event monitored and recommended response and approach for audit processing
failures.

Linux Audit log
Auditd is being used in Moxa Industrial Linux for system administrators to monitor detailed information
about system operation. It provides a way to track and record security-relevant information on the system.
1.

Log partition size: 256MB

2.

Log partition applies Linux Unified Key Setup (LUKS) encryption and restrict non root user from access3.

Logs are stored under /var/log/audit/ and the log format follows auditd standard.
 Below is a reference of where to find the commonly used log data fields in audit log
Common Log Data Fields
timestamp
sourcecategory
type
eventID

4.

5.

Data Fields in auditd log
msg=audit(TIMESTAMP)
proctitle, comm, exec, uid, gid, etc.
key
typepid, ppid

Audit log records are automatically rotated daily and up to 14 achieved logs are kept at a time. Whenlog rotates, the oldest archive will be deleted if 14 achieved logs exist.
 Audit log rotation rule can be modified in /etc/logrotate.d/auditd

The log timestamp is the local system time which synchronize with a remote Network Time Protocol(NTP) server.
 For time synchronization status and configuration, refers to timedatectl(1)Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

80

NOTE
Click the following link for more information on usages of auditd and log searchhttps://manpages.debian.org/bullseye/auditd/auditd.8.en.html
https://manpages.debian.org/bullseye/auditd/ausearch.8.en.html
Below are the security events that Moxa Industrial Linux is pre-configured to monitor in Secure model ofMoxa Arm-based computer
Event Category Event Logged
Access control
Backup andrestoreControl System

Security
configurations

Users logins, logouts, system
events, etc.
Use of Moxa System Manager
tool
Shutdown system
Power off system
Reboot system
Halt system
Use of APT package
management system
Use of aptitude tool
Use of add-apt-repository tool
Use of apt-get tool
Use of dpkg package manager
tool
Add user configuration change
AIDE configuration anddatabase change
Audit configuration and log
changeChrony configuration change
Fail2ban configuration change
and log change
Fail lock configuration change
Login policy change

File or Directory to Monitor

key used for
ausearch/var/run/utmp/var/run/btmp/var/run/wtmp

session/sbin/mx-system-mgmt

system_mgmt/bin/systemctl

control_system/usr/bin/apt

system_package/usr/bin/aptitude/usr/bin/apt-add-repository/usr/bin/apt-get

system_package
system_package
system_package/usr/bin/dpkg

system_package/etc/adduser.conf

adduser/etc/aideaide/etc/audit/var/log/audit/etc/chrony/etc/fail2ban/var/log/fail2ban.log/etc/security/faillock.conf/etc/login.defs/etc/logrotate.conf
Log rotate configuration change/etc/logrotate.d
nftable configuration change/etc/nftables.conf
Moxa Computer Interface/etc/moxa/
Management configuration
MoxaComputerInterfaceManager
changeMoxa Connection Manger/etc/moxa/MoxaConnectionManager
configuration change
Moxa Guardian configurationand log change/etc/moxa/moxa-guardian/var/lib/moxa-guardian

Password policy change/etc/pam.dLinux system wide environment /etc/profile
configuration change/etc/profile.d
pwquality.conf
Password rule change
pwquality.conf.d/etc/rsyslog.conf
Rsyslog configuration change/etc/rsyslog.d
SSH (Secure Shell)/etc/ssh/sshd_config
configuration change/etc/ssh/sshd_config.d
Sudo configuration change/etc/sudoers/etc/sysctl.conf
Kernel parameters change/etc/sysctl.conf.d

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

auditconfig
auditlog
chronyfail2ban
fail2ban-log
faillocklogin
logrotatenftables
mcim
mcm
moxa-guardianmoxa-guardianregistrypamprofilepwquality
rsyslogsshd
sudo
sysctl81

Bootloader Audit Log
1.

Log is stored in SPI flash with 1MB storage size2.

Log can be viewed via (2) Advance Setting > (4) View Bootloader Log in Bootloader menu

3.

Maximum number of logs is 4,000 records, where the oldest log will be overwritten when the maximum
capacity is reached.

4.

The time stamp of the log read from the local Real-time Clock (RTC) which is synchronize with Network
Time Protocol (NTP) server.

5.

Log format and log events are described below

Audit Log Structure
HeaderExplanation

Time

Time stamp of the device

User

Identifies the authenticated user

Category

Event category

Event ID
Event Message

ID of a logged event
Description of the logged event

Possible Values
Format: [YYYY-MM-DDThh:mm:ss]
For example: [2022-06-03T15:54:38]
Admin•
System•Bootcfg (refers to boot configuration)•
Install•
Security
1 ~ 15
See below table for the list of events

Audit Events
Category
SystemSystemSystembootcfg
bootcfg
bootcfg
bootcfg
bootcfg
bootcfg
Install
Install
Install
Install
Install
Install
Install
Install
Install
Install
Install
Install
Install
Install
SecureSecureSecureSecureSecureSecureSecureSecureSecureSecureEvent ID
1
2
3

Secure

13

4
5
6
7

8

9

10

11
12

Event Type
Info
Info
Info
Info
Warning
Info
Warning
Warning
Info
Info
Warning
Warning
Warning
Warning
Warning
Alert
Info
Warning
Warning
Warning
Warning
Warning
Alert
Info
Warning
Warning
Warning
Warning
Warning
Alert
Info
Info
Warning
Alert

Event Message
All bootloader configuration set to default
Exit bootloader and reboot system
Exit bootloader and boot to LinuxSet boot configuration to default ok
Set boot configuration to default failSet boot from SD/USB/eMMC ok
Set boot from SD/USB/eMMC fail
USB is not available on this device
Bootarg and bootcmd changed
Install system image from TFTP ok
Destination net unreachable
Hash/Signature file not find
System image file error
File size is too large
Upgrade system image fail
System image authenticity check failInstall system image from SD ok
SD/USB/eMMC device not findHash/Signature file not find
System image file error
File size is too large
Upgrade system image fail
System image authenticity check failInstall system image from USB ok
SD/USB/eMMC device not findHash/Signature file not find
System image file error
File size is too large
Upgrade system image fail
System image authenticity check fail
TFTP setting changed
Login successlogin failBoot failure due to system image integrity or authenticity
check failMoxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

82

Category
SecureSecureSecureSecureSecureSecureSecureSecureSecureSecureSecureaudit

Event ID
14
15
16
17
18
19
20
21
22
23

Event Type
Info
Info
Info
Info
Info
Info
Info
Info
Info
Info
Warning
Info

Event Message
Admin password disabled
Admin password enabled
Admin password set to default
Admin password changed
Admin password policy changed
Advance settings set to default
Auto reboot threshold changed
Login message changed
Invalid Login Attempts changed
Clear TPM ok
Clear TPM failView bootloader log ok

Audit Failure Response
The section is a guideline for protection of critical system functions in case of audit processing failure.
Without appropriate response to audit processing failure, an attacker's activities can go unnoticed, andevidence of whether the attack led to a breach can be inconclusive. Following are some common
approaches:1.

Log rotation
Log rotation is enabled by default in Moxa Arm-based computer to prevent audit storage capacity full.
Refers to Linux Audit Log and Bootloader Audit log sections for details.
In Linux, configure the logrotate to limit the disk space usage to prevent running out of space. The
logrotate configuration file is at /etc/logrotate.config and all the files in /etc/logrotate.d/* to rotate thelog file.
This example we configure /etc/logrotate.d/rsyslog to rotate /var/log/syslog while it overs the size 2Mwith only 3 rotation.

/var/log/syslog
{

}
2.

{

}

rotate 3
maxsize 2M...

Saving the logs in external storage
 For auditd, change the file path of parameter log_file in /etc/audit/auditd.conf
 For rsyslog, change the default file path /var/log/ in /etc/rsyslog.conf to external storage

3.

Use a centralized log Server
Use a centralized log managements system to collect and store the logs from Log from multiple devices.
Refers to How to Set Up Centralized Logging on Linux with Rsyslog

4.

Assign appropriate action when audit storage space is full, or error occurs
You can configure space_left and space_left_action parameters in /etc/audit/auditd.conf to
specify the remaining space (in megabytes or %) for low disk alert and what action to take. The actions
are ignore, syslog, rotate, exec, suspend, single, and halt.
In example below, warning email will be sent to email account specified in action_mail_acctparameter when the free space in the filesystem containing log files drop below 75 megabytes

space_left = 75
space_left_action = email
Configure disk_full_action and disk_error_action in /etc/audit/auditd.conf to specify what
actions to take when audit storage disk got error or full. The actions are ignore, syslog, rotate (for diskfull only), exec, suspend, single, and halt.
Refers to auditd(8) for detail explanation of each action and parameters.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

83Security Diagnosis Tool (Moxa Guardian)
The secure models of Moxa’s Arm-based computer are secure-by-default and certified to IEC 62443-4-2
SL2. However, on many occasions, the default security settings are unintentionally changed and they nolonger adhere to the standard, especially when conducting customization development on the computer.
Moxa Guardian is a security diagnosis tool that gives you an overview of the gap between the current
security configurations based on the IEC 62443-4-2 Security Level 2 standards and the Moxa recommended
security configurations. You can also use the tool to restore the security configurations to the default out-ofbox secured configurations.
Use the # mx-guardian command to display the menu page.

Moxa Guardian is a cli tool allows users to operate security configs
Moxa Guardian is a CLI security diagnosis tool that gives you an overview ofthe gap between the current security configurations against the IEC 62443-4-2
Security Level 2 host device requirement and the Moxa recommended security
configurations.
Usage:
mx-guardian [command]
Available Commands:
diagnose
Diagnose security settings and output report
help
Help about any commandset
Apply a pre-defined security profile
versionShow Moxa Guardian version and build info
Flags:-f, --force-h, --help--no-color-q, --quiet-v, --verbose--version

force mode
help for mx-guardian
disable color
quiet mode (imply force)verbose modeget version

Use "mx-guardian [command] --help" for more information about a command.

ATTENTIONAs the Moxa computer is an open platform that allows users to install any software they desire, Moxa
Guardian's diagnosis tool only compares the current configurations against the default out-of-box IEC
62443-4-2 compliance configurations. For example, if additional protocols are installed, Moxa Guardian will
not diagnose such protocols' communication integrity and authenticity capabilities. It is the responsibilityof the user to follow the hardening guidelines and the IEC 62443 standard to meet the security
requirements.

Diagnosing Issues in the Current Security Configuration
Use # mx-guardian diagnose <flags> to initiate a diagnosis of the current security configurations
against the default out-of-box secured configuration, which include all IEC 62443-4-2 security level 2
compliance configurations and also additional Moxa recommended security setting not covered in IEC 62443
standard. The diagnosed result are shown in the sequential orders of IEC 62443-4-2 requirement (CR 1.1 toCR 7.8), followed by Moxa's recommended security settings.
Flags-d or –detail-h or –help-o or –output <target filepath>

Description
Show details including the reason and guideline for the failed
requirements
Print the help menu for diagnose command
Output the diagnose result to a fileMoxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

84

The diagnosis result could be one of the following:•

PASS: The device’s security configuration meets the IEC 62443-4-2 security level 2 standard or Moxa
recommended setting.

•

FAIL: The device’s security configuration fails to meet the IEC 62443-4-2 security level 2 standard or
Moxa recommended setting.

•

INFO: The device’s security configuration meet the IEC 62443-4-2 security level 2 standard but
additional configuration can be applied if suitable.

An example of Moxa Guardian’s diagnosis output is given below:

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

85

Restoring the Security Configuration to the Default
Use # mx-guardian set <command> <flags> to restore the Moxa Arm-based security configuration to
the to the default out-of-box IEC 62443-4-2 compliance secured configurations.
CommandsecureDescription
Restore the Moxa Arm-based configuration to a pre-defined security profile

Flags-d or –detail-h or –help

Description
Show details including the reason and guideline for the failed requirements
Print the help menu
The <string> parameter support 2 values (m1 or m2)
Description of each mode is given below :M1: Apply only the IEC 62443-4-2 security level 2 required settings
M2: Apply both M1 and Moxa recommended settings
Note : M2 is the default out-of-box security setting-m or --mode <string>

An example of restoring the computer’s security profile to M2 (IEC 62443-4-2 security level 2 and Moxa
recommended settings) is give below:

moxa@moxa-tbzkb1090923:~$ sudo mx-guardian set secure -m m2
INFO[2022-11-10T05:53:51Z] start setting secure command
INFO[2022-11-10T05:53:51Z] apply all changes withforce=false mode="IEC62443-4-2 and MOXA suggested settings" quiet=false
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/adduser.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/audit/auditd.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/profile.d/99-moxa-profile.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/security/faillock.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/security/pwquality.conf.d/99-moxa-pwquality.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/login.defs
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/logrotate.d/00-moxa-logrotate.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/ssh/sshd_config.d/00-moxa-sshd.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/sysctl.d/99-moxa-sysctl.conf
INFO[2022-11-10T05:53:51Z] no changes
file=/etc/rsyslog.d/99-moxa-rsyslog.conf
Attention : you must reboot your computer for the changes to take effect

ATTENTION
You must reboot your computer for the changes to take effect.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

86

9. Security Hardening Guide

In this chapter, we will provide guidance on how to deploy and operate Secure model of Moxa Arm-based
computer in a secure manner

Defense-in-depth Strategy
Security
Layer

Policy andprocedure

Perimeter
Security

Network
Security

Endpoint
Security

Security Measures

Threat mitigated/handled

Establish policies and procedures Vulnerabilities created due toto guide employee on their role
employee lack of security policies
and responsibilities to for safe use and procedures awarenessof security sensitive assets.
Malicious code attack that could
Refers to Operation andcreate or exploit system
Maintenance section for somevulnerabilities (Threat ID #6)
recommendations
Use LTE service provide with
Unauthorized and malicious
Carrier Grade NAT (CGNAT) andcommunications from untrusted
firewallnetwork
Unauthorized and malicious
Perimeter firewall
communications from untrusted
network
Physical security
Physical modification, manipulation,(Refers to section Physicaltheft, removal, or destruction of
asset
Installation)
Network attacks from various
Network IDS/IPS
sources such as port scanning,
DDOS, etc.
Man-in-the-middle attacks thatallow hackers to intercept andVPN
manipulate network traffic (Threat
ID #4)
Unauthorized and malicious
communications from untrusted
End point Firewall (nftable)
network(Threat ID #2, Threat ID #5)
Trial and error attack attempting toBrute-force attacks IPS (fail2ban) crack login credentials (Threat ID#3)
Automatic network Connection
Radio jamming attack (Threat ID
failover(Refers to MCM failover#1)
configuration)
Vulnerabilities from outdated
Patch management
software could expose to security
breach.
Man-in-the-middle attacks thatallow hackers to intercept andSecure transmission protocol
manipulate network traffic (Threat
ID #4)

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

Responsibility

Asset owner(Essential)

Asset owner(Essential)

Asset owner(Essential)

Asset owner(Recommended)

Provided by Moxa
Arm-based
Computer

Asset owner / Moxa
Arm-based
Computer(Essential)

87Security
Layer

Security Measures

Threat mitigated/handled

Audit processing failure response

Application
Security

IEC 62443-4-1 certified secure
design, implementation,
validation, and defectmanagement process
Host Intrusion Detection System(AIDE)

Access control and login policy
including limit invalid login
Data Security attempts, automatic session
termination and login banner
Disk encryption
Secure bootResponsibility

Audit processing failure without
appropriate response results in theattacker's activities can gounnoticed, and evidence of whether
the attack led to a breach can beinconclusive (Threat ID #7)
Potential vulnerabilities generated
Provided by Moxa
from development and testing
Arm-based
process that doesn’t follow theComputesecurity best practices.
Unexpected changes to important
files that could potentially lead tosecurity breach.
Unauthorize operation to Moxa Armbased computer that could lead toProvided by Moxa
system confidentiality and integrity Arm-based
breach or availability attack.
ComputerAccess to confidential data instorage without authorization.
Tampering of bootloader, OS kernel
and rootFS.

Table 9.1 – Defense-in-Depth Strategy*Essential: Security measure that must be taken by asset owner to ensure secure use of Moxa Arm-based
computer *Recommended: Security measures that need to be taken by the asset owner if the threats apply.

Potential Threats and Corresponding Security Measures
Below is a list of potential security threats that can harm Moxa Arm-based computers and the corresponding
security measures that need to be taken by the asset owner if the threats apply.
ThreatID

Threat mitigated/handled

Security Measures•1

2

Radio jamming attack resulting in
Wi-Fi and cellular connection DOS
Network data flow throughethernet, Wi-Fi, cellular interface
could be potentially interrupted,
crashed or stopped by DOS attack•••

For Moxa Arm-based computer with both Wi-Fi andcellular interface, configure connection failover to use
backup connection when primary connection is attackby radio jamming
Extend the perimeter of physical security to reduce theimpact from radio jamming attack
Setup network monitoring tool to detect abnormal
traffic
Configure rate limiting to limit the network traffic

1.

3

4

5

Following parameters are set in SSH server
configuration file by Moxa as countermeasure.
 MaxSessions: set to 6 to protect a system fromdenial of service due to a large number of concurrent
SSH server could be potentiallysessions
interrupted, crashed or stopped by
 MaxStartups: set to 6:30:60 to protect a system
DOS attackfrom denial of service due to a large number of pending
authentication connection attempts
2. Fail2ban is pre-installed and running in Moxa Armbased computer to automatically ban malicious IP
1. Make sure secure protocol with encryption andData flowing across ethernet may
authentication are used for data transmission (e.g.,be sniffed by an attacker
SSHv2, HTTPS)
2. Install and use VPN for secure data transmission
If a public NTP server without NTS support is used, it is
DOS attack from untrusted NTP
vulnerable to an NTP amplification attack which the attacker
server when Moxa Arm-based
could exploit public NTP servers to overwhelm Moxa Armcomputer attempt to synchronize
based computer with UDP traffic; therefore, refers totime
Mitigate NTP Amplification Attack to mitigate it.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers88ThreatID

Threat mitigated/handled

Security Measures
1.

6

Data read from USB or SD card
could be spoofed

7

Insufficient auditing storage
causing logs to rotate frequently

Use sha256 or other checksums tools to check the
integrity of the file before installing or transferring todevice. If the file is Debian package (.deb), refers to“How to manually check for package's integrity” tovalidate.
2. Scan the file with Clamav before installing ortransferring it to the device
3. Use OpenSSL to verify the signature of the file before
installing or transferring to the device.
Store log in external storage or use a centralized log
managements system to collect and store the logs frommultiple devices. Refers to How to Set Up Centralized
Logging on Linux with Rsyslog

Installation
Physical Installation
1.

Secure model of Moxa Arm-based computer MUST be used to ensure safe use. Refer to Secure andStandard Model for details of model difference.

2.

The secure model of Moxa Arm-based computer MUST be protected by physical security that can include
CCTV surveillance, security guards, protective barriers, locks, access control, perimeter intrusion
detection, etc. The proper form of physical security should apply depending on the environment and thephysical attack risk level.

3.

Moxa Arm-based computer has anti-tamper labels on the enclosures. This allows the administrator totell whether the device has been tampered with.

4.

Moxa Arm-based computer uses security screw on the enclosures as physical tamper resistancemeasure to increase the difficulty of probing the product internals in case of physical security breach.

5.

Moxa Arm-based computer MUST not be used to control the operation of mission-critical IACS
component which failure to maintain control of such device could result in threat to human, safety,
environment or massive financial lost.

Environment Requirement
1.

If Moxa Arm-based computer connects to untrust network (e.g., Internet) via ethernet or Wi-Fi, it MUSTNOT directly connected to the untrust network, which means a firewall must be setup between ethernet
and Wi-Fi connection from Moxa Arm-based computer and the untrust network.

2.

For security-critical applications, we strongly recommend using a private APN for cellular networks.

Access Control
1.

The default user account Moxa of Linux belongs to the sudo group. Before deploying Moxa Arm-based
computer after development, you must disable this default account and create new account(s) following
the least privilege principle, granting only the necessary access right and permission for the intended
operation.

2.

Each account should be assigned the correct privileges. Moxa Industrial Linux uses Discretionary AccessControl (DAC) based on Access Control Lists (ACLs) to manage permissions and privileges. Refers to
Permissions and Privileges Control for details.

3.

The default password policy requires the password to be at least 8 characters in length. We strongly
recommend keeping the default setting, or you can reduce the password length by adding additional
complexity rules to the password, such as special character or numeric character enforcement. Refers to
instructions to configure the policy for Linux and Bootloader, respectively.

4.

Update user passwords on a timely manner. For administrator, we recommend refreshing password atleast every 3 months.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

89

5.

Bootloader configuration menu comes with a single administrator account shared by all users. Assetowner MUST have access and identity records of the personnel who accessed the bootloader to ensure
non-repudiation in case of security breach incidents.

6.

Below is a list of all services in Moxa Arm-based computer uses to connect with external processes andcomponents.
Service

ProtocolInterfaces

SSH server
SFTP server
SCP server
Serial Getty service
APT client
NTP client (NTS
support)

SSH
SSH
SSH
RS-232HTTPS

Ethernet, cellular, Wi-Fi
Ethernet, cellular, Wi-Fi
Ethernet, cellular, Wi-Fi
Serial console port
Ethernet, cellular, Wi-Fi

TLS/SSL, NTP Ethernet, cellular, Wi-Fi

Owner(uid/gid)root/root
root/root
root/root
root/root
root/root

Authorization
Enforcement
Yes
Yes
Yes
Yes
Yes

root/root

Yes

Security Configuration Check
The secure models of Moxa’s Arm-based computer are secure-by-default and certified to IEC 62443-4-2
SL2. However, on many occasions, the default security settings are unintentionally changed and they nolonger adhere to the standard, especially when conducting customization development on the computer.
Moxa Guardian is a security diagnosis tool that gives you an overview of the gap between the current
security configurations based on the IEC 62443-4-2 Security Level 2 standards and the Moxa recommended
security configurations. Make sure you run the security diagnosis before deploying the product. Refer toSecurity Diagnosis Tool section for details usage of Moxa Guardian

Operation
Administrator
1.

Disable default accountUse the passwd command to lock the default user account so that the moxa user cannot log in. Make
sure to create a new account before disable the default accountmoxa@moxa-tbzkb1090923:# sudo passwd –l moxa
2.

Disabled interfaces that are not in use
The interfaces that are not in use should be deactivated. Please refer to Disabled Unused Interface fordetailed instructions.

3.

Periodically regenerate the SSH server key
Periodically regenerate the SSH server key in order to secure your system in case the key iscompromised. Please refer to Rekey SSH

4.

Trusted administrator
Make sure only trusted and reliable persons are registered in the sudo groups for root privilege.

5.

Audit failure response
Refer to Audit Failure Response Guideline to protection of critical system functions in case of audit
processing failure

6.

System integrity validation
 Frequently run system integrity check to protect your system against malware, viruses and detect
unauthorized activities. Refers to Intrusion Detection System for the utility that come with Moxa
Arm-based computer We recommend you reset Moxa Arm-based computer to factory default upon receiving it to avoid
the risk of potential software tampering before the computer reaches your hand.

7.

Only use secure cryptographic
 Moxa Industrial Linux on Moxa Arm-based computer only uses secure cryptographic that arecommonly accepted industry best practices and recommendations as defined in NIST SP 800-57.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers90 Moxa Industrial Linux installed OpenSSL by default but doesn’t disable weak algorithms such as
TLS 1.0/1.1 and SSLv3. It is recommended that your application deployed on Moxa Industrial Linux
only uses secure algorithms defined in NIST SP 800-57. You can disable the weaker cryptographic
algorithm in OpenSSl by setting CipherString = DEFAULT@SECLEVEL=[desired level] in/etc/ssl/openssl.cnf to a higher level. For details, refers to :https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html
8.

Malicious code protection
 Downloading file from untrusted sources is not recommended. If you still want to do it, make sure toverify the file using following recommendation:
Use sha256 or stronger algorithms checksums tools to check the integrity of the file before
installing or transferring to device

If the file is Debian package (.deb), follow “How to manually check for package’s integrity” forthe instruction.

Use OpenSSL to verify the signature of the file before installing or transferring to the device.

Administrator and User
1.

Periodically refresh password
Update user passwords on a timely manner. For administrator, we recommend refreshing password atleast every 3 months

2.

Encrypt confidential file
Use GPG to encrypt confidential file or directory with a password in Linux. You can reference How To
Encrypt And Decrypt Files With A Password for quick instructions.

Maintenance1.

Perform Update Frequently
 Perform software upgrades frequently to enhance features, deploy security patches, or fix bugs.
 We recommend you enable System Failback Recovery before performing critical update.

2.

Perform Backup Frequently
Frequently backup of system on timely manner

3.

Examine Audit Logs Frequently

4.

Report Vulnerability to Moxa

Examine audit logs frequently to detect any anomalies.
To report vulnerabilities of Moxa products, please submit your findings on the following web page:https://www.moxa.com/en/support/product-support/security-advisory/report-a-vulnerability.

Decommissioning
1.

To avoid any sensitive information such as your account password or certificate from being disclosed,
always use the mx-system-mgmt default decommission command to reset the computer tofactory default and further wipe out all user data, including logs, in an unrecoverable manner before
removing the Moxa Arm-based computer from .
You must use sudo or run the command with the root permission.

moxa@moxa-tbzkb1090923:/# sudo mx-system-mgmt default decommission

The decommissioning process will do the following actions：a. Overwrite the system partition 4 times with shred so that all user files will be deleted and cannot berecovered.
b. Overwrite the log partition4 times with shred so that all log files will be deleted and cannot berecovered.
c. Trigger the bootloader decommissioning function, so all configurations and log messages in thebootloader are also deleted and cannot be recovered.
2.

If asset owner key or sensitive data is stored in the TPM, switch to bootloader Developer Mode and thenperform Clear TPM action will clear all data stored in TPM

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

91

10.

Customization and Programming

MIL1 (Debian 9) to MIL3 (Debian 11) Migration
Moxa Arm-based computers with MIL1 (Debian 9) does not support direct upgrade to MIL3 (Debian 11). If
you have such request, contact your regional sales representative.
If you are migrating an application previously developed on MIL1 to MIL3 please reference the below table
for the major changes.
Category

Description
Password change
enforced upon first
Password rule log-in
Password complexity
enforcement
Reinstall a system
image
Create a backup &restoreBackup &Create a snapshot &Restore utilities restore
Automatic system
failback recovery
Reset to factory
default

MIL1 (Debian 9)

MIL3 (Debian 11)

n/a



n/a

At least 8 characters in length
Password dictionary check

Via bootloader menu

Via bootloader menu

n/a
n/a
n/a
Use mx-set-def

Default LAN(ethernet) port
configuration

LAN1(staticIP):192.168.3.127
LAN2(staticIP):192.168.4.127

Cellular connection
utility

Use cell_mgmt

Wi-Fi connection
utility

Use wifi_mgmt

Network
connection
utilities

I/O and
InterfaceManagement
utilities

Moxa System Manager (MSM)
Use mx-system-mgmt

Serial port modechangeUse mx-uart-ctl(RS-232, RS-422, andRS-485 2-wire)
Module control
including power
Use mx-module-ctl orcontrol, module
cell_mgmt for cellulardetection, initialize
module control
setting, and SIM slot
switching
Buzzer control
n/aLAN1: Assigned by DHCP server.
Link-local IP addresses will beassigned when DHCP server is notavailable•
LAN2(static IP):192.168.4.127
Use mx-connection-mgmt
Refers to Moxa Connection Manager(MCM) with additional features added
below:•GUI to configure and manage
network•
Connection keep-alive•
Connection failover/failback•
Cellular, Wi-Fi and ethernet
management•
DHCP server•
Data usage monitoring•
IPv6 support•
Cellular connection diagnosis•
Cellular modem firmware upgrade•
C API for network and connection
status inquiry•

Use mx-interface-mgmt
Refers to serial port in Moxa Computer
Interface Manager (MCIM) section

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

92

Category

Other
Configuration

Description
LED control
Digital I/O control
Mount a SD/USB
storage device
Push button control
Check product serial
numberCheck system image
version

MIL1 (Debian 9)
Use mx-led-ctl
Use moxa-dio-control
Use moxa-automountd.service
n/a
Use fw_printenv
serialnumber

MIL3 (Debian 11)

Use kversion or mx-ver

Use mx-ver

APT repository source All repository in/etc/apt/sources.list
list

API andlibraries

Moxa Platform
LibrariesUse mx-interface-mgmt deviceinfo

3rd party repository in/etc/apt/sources.list
Moxa repository in/etc/apt/sources.list.d/moxa.list
API and libraries not available. Use
mx-interface-mgmt
Refers to Moxa Computer Interface
Manager (MCIM)

Building an Application
Introduction
Moxa’s Arm-based computers support both native and cross-compiling of code. Native compiling is morestraightforward since all the coding and compiling can be done directly on the device. However, Armarchitecture is less powerful and hence the compiling speed is slower. To overcome this, you can crosscompile your code on a Linux machine using a toolchain; the compiling speed is much faster.

Native Compilation
Follow these steps to update the package menu:
1.

Make sure a network connection is available.

2.

Use aptupdate to update the Debian package list.

3.

Install the native compiler and necessary packages.

moxa@Moxa-tbzkb1090923:~$ sudo apt updatemoxa@Moxa-tbzkb1090923:~$ sudo apt install gcc build-essential flex bison
automake

Cross Compilation

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

93

Moxa Industrial Linux (MIL) in Moxa’s Arm-based computers is based on Debian. So, we recommend setting
up a Debian environment on the host device to ensure best compatibility during cross compilation.
The toolchain will need about 300 MB of hard disk space on your PC.
To cross compile your code, do the following:1.

Set up a Debian 11 environment using a VM or Docker.

2.

Open moxa.source.list in the vi editor.

user@Linux:~$ sudo vi /etc/apt/sources.list.d/moxa.sources.list
Add the following line to moxa.source.list:deb http://debian.moxa.com/debian stretch main contrib non-free3.

Update the apt information.

4.

(Optional) During the update process, if you don't want to see messages related to "server certificate
verification failed", you can install Moxa apt keyring. These messages, however, will not affect theoperation.

5.

In order to install non-amd64 packages, such as armhf and u386, add the external architecture.

user@Linux:~$ apt updateuser@Linux:~$ apt install moxa-archive-keyring
In the example, we are adding the armhf architecture.

user@Linux:~$ dpkg --add-architecture armhf
6.

Update the apt information again.

7.

Download the toolchain file from apt server (all Moxa UC series computers use the official Debiantoolchain).

user@Linux:~$ apt update

For UC computer with armhf architecture

user@Linux:~$ apt install crossbuild-essential-armhf
For UC computer with arm64 architecture

user@Linux:~$ apt install crossbuild-essential-arm64
8.

Install dev or lib packages depending on whether Debian or Moxa packages are applicable for theprocedure.
Example for installing an armhf Debian official package:user@Linux:~$ apt install libssl-dev:armhf
You can now start compiling programs using the toolchain.

NOTE
For all available libraries and headers offered by Debian, visit: https://packages.debian.org/index.

Example Program—hello
In this section, we use the standard "hello" example program to illustrate how to develop a program for
Moxa computers. All example codes can be downloaded from Moxa’s website. The "hello" example code isavailable in the hello folder; hello/hello.c:#include <stdio.h>
int main(int argc, char *argv[]){
printf("Hello World\n");return 0;}

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

94Native Compilation
1.

Compile the hello.c code.

moxa@Moxa-tbzkb1090923:~$ gcc -o hello hello.c
moxa@Moxa-tbzkb1090923:~$ strip -s helloor
use the Makefile as follows:

moxa@Moxa-tbzkb1090923:~$ make2.

Run the program.

moxa@Moxa-tbzkb1090923:~$ ./hello
Hello World

Cross Compiling
1.

Compile the hello.c code.

user@Linux:~$ arm-linux-gnueabihf-gcc -o hello \hello.cuser@Linux:~$ arm-linux-gnueabihf-strip -s helloor
use the Makefile as follows:

user@Linux:~$ make CC=arm-linux-gnueabihf-gcc \STRIP=arm-linux-gnueabihf-strip
2.

Copy the program to a Moxa computer:For example, if the IP address of your device used for cross compiling the code is "192.168.3.100" andthe IP address of the Moxa computer is "192.168.3.127", use the following command:

user@Linux:~$ scp hello moxa@192.168.3.127:~3.

Run the hello.c program on the Moxa computer.

moxa@Moxa-tbzkb1090923:~$ ./hello
Hello World

Example Makefile
You can create a Makefile for the “hello" example program using the following code. By default, the Makefile
is set for native compiling.
"hello/Makefile":

CC:=gcc
STRIP:=strip
all:$(CC) -o hello hello.c$(STRIP) -s hello.PHONY: clean
clean:
rm -f hello

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers95

To set the hello.c program for cross compilation, modify the toolchain settings as follows:

CC:=arm-linux-gnueabihf-gcc
STRIP:=arm-linux-gnueabihf-strip

Creating a Customized Image
Introduction
This section introduces how to build a customized image that set the push-button on Moxa Computer toreset to customized environment instead of Moxa out-of-factory setting. This customized image can also be
used for provisioning other Moxa Computers.

Using System Snapshots and Backups
1.

Configure Moxa Arm-based computer and install application

2.

Create a Snapshot

3.

Reference Customize the Button Action section to configure the action of push-button on Moxa Armbased computer to restore Snapshot
 Copy content of default script to custom.script, change to reset-to-default
 Change to set-to-factory-default command ( mx-system-mgmt default restore –y) of button to
restore snapshot (mx-system-mgmt snapshot restore -y)#!/bin/sh
ACTION="${1}"
SECONDS="${2}"if [ "${ACTION}" = "press" ]; then/usr/bin/mx-interface-mgmt led SYS set_state heartbeat
elif [ "${ACTION}" = "hold" ]; thenif [ ${SECONDS} -eq 7 ]; then/usr/bin/mx-interface-mgmt led SYS set_state on
elif [ ${SECONDS} -eq 9 ]; then/usr/bin/mx-interface-mgmt led SYS set_state off
fi
elif [ "${ACTION}" = "release" ]; thenif [ ${SECONDS} -lt 1 ]; then/usr/sbin/reboot
elif [ ${SECONDS} -ge 7 ] && [ ${SECONDS} -lt 9 ]; then/usr/sbin/mx-system-mgmt snapshot restore -y/usr/sbin/reboot
fi/usr/bin/mx-interface-mgmt led SYS set_state onfi4.

Create a Backup Image, the backup will include the snapshot taken in step #2

5.

The Backup Image can now be used for provisioning other Moxa computers of the same model using
backup restore command.

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

96

A. Software Process List

Below is a list of software processes of Moxa Industrial Linux in Moxa Arm-based Computer
Software Process for Adminstrator
addgnupghome
addgroup
add-shell
adduser
agettyapplygnupgdefaults
arp
arpd
audisp-syslog
auditctl
auditdaugenrules
aureport
ausearch
autrace
badblocks
blkdeactivate
blkdiscard
blkid
blkzoneblockdev
bridgecapsh
cfdiskchcpu
chgpasswd
chmem
chpasswd
chronydchrootcpgr
cppw
cracklib-checkcracklib-format
cracklib-packer
cracklib-unpacker
create-cracklib-dictctrlaltdel
debugfsdelgroupdeluser
depmoddevlink
dhclient
dhclient-script
dmsetupdmstatsdnsmasq
docfdisk
doc_loadbios

UID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

GID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

97

Software Process for Adminstrator
dpkg-fsys-usrunmess
dpkg-preconfigure
dpkg-reconfigure
dumpe2fs
e2freefrag
e2fscke2imagee2label
e2mmpstatuse2scrub
e2scrub_all
e2undoe4crypt
e4defrag
faillockfdformatfdisk
filefrag
findfsflashcp
flash_erase
flash_eraseall
flash_lock
flash_otp_dump
flash_otp_info
flash_otp_lock
flash_otp_write
flash_unlock
fsck
fsck.cramfs
fsck.ext2
fsck.ext3
fsck.ext4
fsck.minix
fsfreezefstab-decode
fstrimftl_check
ftl_format
genl
getcapgetpcaps
gettygroupaddgroupdelgroupmems
groupmodgrpck
grpconv
grpunconv
halt
hwclock
iconvconfig
ifconfig
ifdownifquery
ifup
init

UID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

GID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

98

Software Process for Adminstrator
insmodinstallkernel
invoke-rc.d
ip
ipmaddr
iptunnelisosizeiw
jffs2dump
jffs2reader
killall5
ldattachldconfig
locale-gen
logrotatelogsavelosetup
lsmod
lsmtd
lxfp
mcmd
mii-toolmke2fsmkfs
mkfs.bfs
mkfs.cramfs
mkfs.ext2
mkfs.ext3
mkfs.ext4
mkfs.jffs2
mkfs.minix
mkfs.ubifs
mkhomedir_helper
mklost+foundmkswapModemManager
modinfo
modprobe
MoxaComputerInterfaceManager
moxa-telit-firmware-upgrade-tool
mtd_debug
mtdinfomtdpartmx-bootloader-mgmt
mx-connect-mgmt
mx-guardian
mx-guardian-init
mx-system-mgmt
nameifnanddump
nandtest
nandwrite
NetworkManager
newusers
nft
nftldump
nftl_format
nologin

UID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

GID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

99

Software Process for Adminstrator
pam-auth-update
pam_getenv
pam_timestamp_checkpartedpartprobe
pivot_root
plipconfig
poweroff
pwck
pwconv
pwunconv
rarp
raw
readprofile
rebootrecv_image
regdbdump
remove-shell
resize2fs
rfddumprfdformat
rmmod
rmt
rmt-tarroutersyslogd
rtacctrtcwakertmonrunlevelrunuserserve_image
servicesetcapsfdiskshadowconfig
shutdownslattachsshd
start-stop-daemon
sudo_logsrvd
sudo_sendlog
suloginsumtool
swaplabelswapoff
swaponswitch_root
sysctltarcattc
telinittipc
tune2fs
tzconfig
ubiattachubiblockubicrc32

UID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

GID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

100

Software Process for Adminstrator
ubidetachubiformat
ubihealthd
ubimkvolubinfoubinizeubirenameubirmvolubirsvolubiupdatevol
unix_chkpwd
unix_update
update-ca-certificates
update-cracklib
update-locale
update-passwd
update-rc.d
useradd
userdelusermodvalidlocale
vigr
vipw
visudovnstatd
watchdog
wd_identify
wd_keepalive
wipefswpa_action
wpa_cli
wpa_supplicant
zic
zramctl
Software Process for
Non-Adminstrator
addpartaddr2lineaide
apt
apt-cache
apt-cdrom
apt-config
apt-extracttemplates
apt-ftparchive
apt-getapt-key
apt-mark
apt-sortpkgs
ararch
arm-linux-gnueabihf-addr2line
arm-linux-gnueabihf-ar
arm-linux-gnueabihf-as
arm-linux-gnueabihf-c++filt
arm-linux-gnueabihf-dwp
arm-linux-gnueabihf-elfedit

UID
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

GID
root
root
root
root
root
root
root
root
root
root
shadow
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

101Software Process for
Non-Adminstrator
arm-linux-gnueabihf-gold
arm-linux-gnueabihf-gprof
arm-linux-gnueabihf-ld
arm-linux-gnueabihf-ld.bfd
arm-linux-gnueabihf-ld.gold
arm-linux-gnueabihf-nm
arm-linux-gnueabihf-objcopy
arm-linux-gnueabihf-objdump
arm-linux-gnueabihf-ranlib
arm-linux-gnueabihf-readelfarm-linux-gnueabihf-size
arm-linux-gnueabihf-strings
arm-linux-gnueabihf-strip
asasc2logaulastaulastlog
ausyscallauvirtawk
b2sum
base32
base64basenamebasencbash
bashbug
bcmserver
bootctlbusctlcal
canbusload
can-calc-bit-timing
candump
canfdtest
cangencangw
canlogserver
canplayercansendcansequencecansniffer
captoinfo
cat
catchsegv
c++filt
chacl
chage
chattr
chcon
chfn
chgrp
chmod
choom
chown
chronyc
chrt

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
shadow
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

102Software Process for
Non-Adminstrator
chsh
cksum
clear
clear_console
cmp
colcolcrtcolrm
columncommcorelist
cp
cpan
cpan5.32-arm-linux-gnueabihf
cpulimitc_rehashcsplitctstatcurl
cut
cvtsudoers
dash
date
dbus-cleanup-sockets
dbus-daemon
dbus-monitor
dbus-run-session
dbus-senddbus-update-activation-environmentdbus-uuidgendddebconfdebconf-apt-progress
debconf-communicate
debconf-copydb
debconf-escapedebconf-set-selections
debconf-show
debsums
deb-systemd-helper
deb-systemd-invoke
delpartdf
dh_bash-completion
dialog
diff
diff3
dir
dircolors
dirmngrdirmngr-client
dirnamedmesg
dnsdomainname
domainname
dpkg
dpkg-deb

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

103Software Process for
Non-Adminstrator
dpkg-divert
dpkg-maintscript-helper
dpkg-querydpkg-realpath
dpkg-split
dpkg-statoverride
dpkg-trigger
dudumpimagedwp
echo
editoregrep
elfeditenc2xsencguess
env
exexpandexpiryexpr
factorfail2ban-client
fail2ban-python
fail2ban-regex
fail2ban-server
fail2ban-testcases
faillog
fallocate
FALSE
fgrep
file
fincorefindfindmnt
flock
fmt
fold
free
fw_printenv
fw_setenv
getconf
getentgetfaclgetoptgold
gpasswd
gpg
gpg-agent
gpgcompose
gpgconf
gpg-connect-agent
gpgparsemail
gpgsm
gpgsplit
gpgtar
gpgv

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
shadow
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

104Software Process for
Non-Adminstrator
gpg-wks-server
gpg-zip
gprof
grep
groupsgunzip
gzexe
gzip
h2ph
h2xs
hd
head
helpztags
hexdumphostidhostnamehostnamectl
iconv
id
infocmpinfotocap
installinstmodsh
ionice
ip
ipcmk
ipcrm
ipcs
ischroot
isotpdump
isotpperf
isotprecv
isotpsend
isotpserver
isotpsniffer
isotptunj1939acdj1939catj1939spyj1939srjoinjournalctl
jq
json_ppkbxutilkernel-install
kill
kmod
kwbootlast
lastb
lastloglcf
ld
ld.bfdldd
ld.gold

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

105Software Process for
Non-Adminstrator
libnetcfg
link
linux32
linux64ln
lnstatlocalelocalectl
localedef
log2asclog2long
loggerlogin
loginctl
lognamelooklslsattr
lsblk
lscpu
lsipc
lslocks
lslogins
lsmem
lsmod
lsns
lspgpotmawk
mcookie
md5sum
md5sum.textutils
mesg
migrate-pubring-from-classic-gpg
mkdir
mkenvimage
mkfifomkimagemknod
mksunxiboot
mktemp
mmcli
more
mount
mountpoint
mv
mx-interface-mgmt
mx-ver
namei
nawk
ncal
netstatnetworkctl
newgrpnice
nisdomainname
nl
nm

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

106Software Process for
Non-Adminstrator
nmcli
nm-online
nmtui
nmtui-connect
nmtui-edit
nmtui-hostname
nohup
nproc
nsenternstat
numfmtobjcopy
objdumpod
openssl
pager
partx
passwdpaste
pathchk
pdb3
pdb3.9perl
perl5.32.1
perl5.32-arm-linux-gnueabihf
perlbug
perldoc
perlivp
perlthankspgreppiconvpidof
pidwaitpinentrypinentry-curses
ping
ping4
ping6
pinky
pkaction
pkcheck
pkexecpkill
pkttyagent
pl2pm
pldd
pmap
pod2html
pod2manpod2text
pod2usage
podchecker
prprintenv
printfprlimit
prove

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

107Software Process for
Non-Adminstrator
ps
ptar
ptardiff
ptargrep
ptx
pv
pwd
pwdx
py3cleanpy3compile
py3versions
pydoc3
pydoc3.9
pygettext3
pygettext3.9
python3python3.9
ranlibrbash
rcp
rdebsums
rdma
readelf
readlink
realpath
renicereset
resizepartresolvectl
rev
rgrep
rloginrm
rmdir
routefroutelrrsyncrsh
rsync
rsync-ssl
rtstatrunconrun-parts
rview
rvim
savelog
scp
scriptscriptlive
scriptreplay
sdiff
sed
select-editor
sensible-browser
sensible-editor
sensible-pager
seq

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

108Software Process for
Non-Adminstrator
setarchsetfaclsetpriv
setsidsettermsftp
sg
shsha1sum
sha224sum
sha256sum
sha384sum
sha512sumshasum
shred
shuf
size
skill
slabtopslcan_attachslcandslcanpty
sleep
sloginsnice
sortsplainsplit
sssshssh-addssh-agentssh-argv0
ssh-copy-id
ssh-keygenssh-keyscan
statstdbufstreamzip
strings
strip
stty
su
sudo
sudoeditsudoreplay
sum
sync
systemctl
systemd
systemd-analyze
systemd-ask-password
systemd-cat
systemd-cgls
systemd-cgtop
systemd-deltasystemd-detect-virt

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
ssh
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

109Software Process for
Non-Adminstrator
systemd-escapesystemd-hwdb
systemd-id128
systemd-inhibit
systemd-machine-id-setup
systemd-mountsystemd-notify
systemd-path
systemd-resolve
systemd-run
systemd-socket-activate
systemd-stdio-bridge
systemd-sysusers
systemd-tmpfiles
systemd-tty-ask-password-agent
systemd-umount
tabs
tac
tail
tar
tasksettee
tempfile
test
testj1939
tic
timedatectl
timeout
tload
toe
top
touch
tpm2
tpm2_activatecredential
tpm2_certify
tpm2_certifycreation
tpm2_certifyX509certutil
tpm2_changeauth
tpm2_changeeps
tpm2_changepps
tpm2_checkquote
tpm2_clear
tpm2_clearcontrol
tpm2_clockrateadjust
tpm2_commit
tpm2_create
tpm2_createak
tpm2_createek
tpm2_createpolicy
tpm2_createprimary
tpm2_dictionarylockout
tpm2_duplicate
tpm2_ecdhkeygen
tpm2_ecdhzgen
tpm2_ecephemeral
tpm2_encryptdecrypttpm2_eventlog

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

110Software Process for
Non-Adminstrator
tpm2_evictcontrol
tpm2_flushcontext
tpm2_getcap
tpm2_getcommandauditdigest
tpm2_geteccparameters
tpm2_getekcertificate
tpm2_getrandom
tpm2_getsessionauditdigest
tpm2_gettestresult
tpm2_gettime
tpm2_hashtpm2_hierarchycontrol
tpm2_hmac
tpm2_importtpm2_incrementalselftest
tpm2_load
tpm2_loadexternal
tpm2_makecredential
tpm2_nvcertify
tpm2_nvdefine
tpm2_nvextend
tpm2_nvincrement
tpm2_nvread
tpm2_nvreadlock
tpm2_nvreadpublic
tpm2_nvsetbits
tpm2_nvundefine
tpm2_nvwrite
tpm2_nvwritelock
tpm2_pcrallocate
tpm2_pcrevent
tpm2_pcrextend
tpm2_pcrread
tpm2_pcrreset
tpm2_policyauthorize
tpm2_policyauthorizenv
tpm2_policyauthvalue
tpm2_policycommandcode
tpm2_policycountertimer
tpm2_policycphash
tpm2_policyduplicationselecttpm2_policylocality
tpm2_policynamehash
tpm2_policynv
tpm2_policynvwritten
tpm2_policyor
tpm2_policypassword
tpm2_policypcr
tpm2_policyrestart
tpm2_policysecret
tpm2_policysigned
tpm2_policytemplate
tpm2_policyticket
tpm2_print
tpm2_quote
tpm2_rc_decode
tpm2_readclock

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

111

Software Process for
Non-Adminstrator
tpm2_readpublic
tpm2_rsadecrypttpm2_rsaencrypttpm2_selftest
tpm2_send
tpm2_setclock
tpm2_setcommandauditstatus
tpm2_setprimarypolicy
tpm2_shutdown
tpm2_sign
tpm2_startauthsession
tpm2_startup
tpm2_stirrandom
tpm2_testparms
tpm2_unseal
tpm2_verifysignature
tpm2_zgen2phase
tput
tr
TRUE
truncate
tset
tsort
tty
tzselect
ucf
ucfq
ucfr
udevadmulumountuname
uncompress
unexpand
uniq
unlinkunshareupdate-alternatives
uptimeusers
utmpdump
vdir
vi
view
vim
vim.basic
vimdiff
vimtutor
vmstatvnstatw
wall
watch
watchgnupg
wc
wdctl
wget

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
tty
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers

112

Software Process for
Non-Adminstrator
whereiswhich
whiptailwhowhoamiwpa_passphrase
write
write.ul
xargs
xsubppxxd
yes
ypdomainname
zcat
zcmp
zdiff
zdump
zegrepzfgrepzforcezgrep
zipdetails
zless
zmore
znew

UID

GID

root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

root
root
root
root
root
root
root
tty
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root

Moxa Industrial Linux 3.1 (Debian 11) Manual for Arm-based Computers113