HN Explorer

Show HN: Bor – Open-source policy management for Linux desktops (getbor.dev)

197 points by eniac111 ↗ HN
Hi HN! I've been working on Bor, an open-source system for centralized Linux desktop management.

Bor consists of a lightweight Go agent and a central server. Policies are streamed to clients over mTLS/gRPC in real time—no polling—and currently support Firefox, Chrome, KDE, dconf, polkit and package management, with more coming.

Version 0.8 introduces several new policy types - Thunderbird, Microsoft Edge for Business and FirewallD zones, along with a number of improvements and fixes.

I'd love feedback on the architecture, policy model, and whether this is something you'd consider for managing Linux workstations.

14 comments

[ 0.27 ms ] story [ 18.8 ms ] thread
stasiu
This is cool. I’m getting into this type of management for the first time after being in software development for a long time. What other open source or enterprise solutions is this potentially competing with? What made you write your own, as in, what you weren’t able to do or didn’t like about existing solutions?
V__
This looks really close to what I need. I manage a few laptops for a non-profit. For now, it is all done by hand, since I haven't found a good solution for Linux and I will kill myself before using Windows and Intune again.

I would love to see configurations for Linux Mint's Cinnamon. Is there a way to execute custom scripts? How does the user mapping work exactly? Could I create a user in Authentik with a laptop-permission and this would map to a Linux user account?

Nonetheless, this is really great work so far, and if you keep it as nice and tidy as it currently looks, then you might make a nice niche for yourself. I can't wait to try it out.

d3Xt3r
How is configuration drift / policy enforcement handled if there's no polling interval? Like suppose a user changes a setting, does it revert back to the enforced setting, if so, when and how?
cyberge99
I asked OP if he could integrate this with something like wazuh for governance. That would be a useful combination.
jimmcslim
Can this be used to enforce “screen time” for laptops given to children, hopefully in a more effective way than the equivalent systems on iOS and Android?
teddzfr
Nice work on the mTLS/gRPC push design — the inotify drift-catch on parent dirs is a clean answer to the "revert happens before the user notices" problem, and I like that the audit trail is server-side. Question on the policy model: how do you handle conflicting policies across sources — say a package postinstall rewrites a managed file while a newer policy is mid-sync from the server, or two policy types touch the same file? Does the agent queue and reconcile revisions, or last-write-wins?

Also curious: with LDAP-only auth, how do non-domain single-user laptops fit in? I manage a few personal machines that I'd love to centralize but they aren't LDAP-joined — is there a lightweight path, or is the temp-token enrollment strictly for domain boxes?

evanjrowley
This is fantastic! I'd really love to see support for SCAP so it could be used to enforce DISA STIGs.
manbash
Very nice. Can you elaborate why you chose mTLS authentication vs. SSH as a mean to deploy the policies.

Regarding the docs, the diagrams should really be replaced with something more familiar and readable such as Mermaid (currently it looks like a mixture of ad-hoc ASCII charts).

mangudai
Nice, the scope here feels right - a lot of policy management tools try to do too much and end up being their own attack surface. Are you handling policy conflicts (two rules touching the same resource) at apply-time or just documenting "last write wins" and leaving it to the admin?
cyberge99
Have you considered bolting this frontend on something like Wazuh for fleet governance?