{"id":5034,"date":"2026-08-30T03:40:38","date_gmt":"2026-08-29T18:40:38","guid":{"rendered":"https:\/\/donguri3.net\/server-tech\/diy-pikvm-v1-vpn-monitoring-2\/"},"modified":"2026-08-30T03:40:43","modified_gmt":"2026-08-29T18:40:43","slug":"diy-pikvm-v1-vpn-monitoring","status":"publish","type":"post","link":"https:\/\/donguri3.net\/en\/diy-repair\/diy-tools-devices\/diy-pikvm-v1-vpn-monitoring\/","title":{"rendered":"Building a PiKVM with Raspberry Pi 3, Pico, and a Budget USB Capture Board \u2013 Part 4: VPN Monitoring Edition"},"content":{"rendered":"

So far, through the hardware, software, and case design installments, we have successfully built our own DIY PiKVM using a Raspberry Pi 3, a Pico-compatible board, and an HDMI-USB capture board. In this article, we will explain the configuration for PiKVM’s monitoring functions and remote management using Tailscale VPN. This setup allows you to build a reliable environment where, even if an unexpected server issue occurs, you can perform reboots and troubleshooting remotely with peace of mind.<\/p>\n

\n

Current Status and Issues with the Browser Terminal<\/h2>\n

Web Terminal Login Status<\/h3>\n

When you access the terminal via the PiKVM web UI, you are logged in by default as the “kvmd-webterm” user.
However, for some reason, the password for the “kvmd-webterm” user is not set by default, preventing you from switching from this user to the root user (using the su command) or changing the password, which creates operational inconveniences.<\/p>\n

Checking sudoers Configuration<\/h3>\n

Even when checking the following file (\/etc\/sudoers.d\/99_kvmd):<\/p>\n

kvmd-pst ALL=(ALL) NOPASSWD: \/usr\/bin\/kvmd-helper-pst-remount<\/pre>\n
It only contains the above entry, meaning no sudo privileges are granted to the kvmd-webterm user.<\/p>\n
\n
Solution: Setting a Password for the kvmd-webterm User<\/h2>\n
Configuration Changes via Root Login over SSH<\/h3>\n
Therefore, first log in to the PiKVM via SSH as the root user (initial password: root).
Follow the steps below to set a password for the kvmd-webterm user.<\/p>\n
    \n
  1. \n
    Switch the filesystem to Read-Write mode
    \n<\/strong><\/p>\n
    [root@pikvm ~]# rw\n+ mount -o remount,rw \/\n+ mount -o remount,rw \/boot\n+ set +x\n=== PiKVM is in Read-Write mode ===<\/pre>\n
     <\/strong><\/p>\n<\/li>\n
  2. \n
    Set a new password for the kvmd-webterm user
    \n<\/strong><\/p>\n
    [root@pikvm ~]# passwd kvmd-webterm\nNew password:\nRetype new password:\npasswd: password updated successfully<\/pre>\n
     <\/strong><\/p>\n<\/li>\n
  3. \n
    Switch the filesystem back to Read-Only mode
    \n<\/strong><\/p>\n
    [root@pikvm ~]# ro\n+ mount -o remount,ro \/\n+ mount -o remount,ro \/boot\n+ set +x\n=== PiKVM is in Read-Only mode ===<\/pre>\n
     <\/strong><\/p>\n<\/li>\n<\/ol>\n
    With this configuration, you can now switch to root privileges from the browser terminal by running the su command and entering the root user’s password (initial value: root).<\/p>\n
    \n
    Configuring Remote Management via Tailscale VPN<\/h2>\n
    Installing and Configuring Tailscale<\/h3>\n
    To manage PiKVM remotely, we will introduce Tailscale VPN. Please refer to the official installation instructions here<\/a>. Below are the basic installation steps:<\/p>\n
      \n
    1. \n
      Update PiKVM<\/strong>
      Run the latest pikvm-update to update the system.<\/p>\n<\/li>\n
    2. \n
      Install the Tailscale Client
      \n<\/strong><\/p>\n
      [root@pikvm kvmd-webterm]# rw\n+ mount -o remount,rw \/\n+ mount -o remount,rw \/boot\n+ set +x\n=== PiKVM is in Read-Write mode ===\n[root@pikvm kvmd-webterm]# pacman -S tailscale-pikvm\nresolving dependencies...\nlooking for conflicting packages...\n\nPackages (2) tailscale-1.82.0-1 tailscale-pikvm-0.9-1\n\nTotal Download Size: 9.97 MiB\nTotal Installed Size: 36.80 MiB\n\n:: Proceed with installation? [Y\/n] Y\n:: Retrieving packages...\ntailscale-1.82.0... 10.0 MiB 2.55 MiB\/s 00:04 [########################] 100%\ntailscale-pikvm-... 3.4 KiB 2.74 KiB\/s 00:01 [########################] 100%\nTotal (2\/2) 10.0 MiB 1820 KiB\/s 00:06 [########################] 100%\n(2\/2) checking keys in keyring [########################] 100%\n(2\/2) checking package integrity [########################] 100%\n(2\/2) loading package files [########################] 100%\n(2\/2) checking for file conflicts [########################] 100%\n(2\/2) checking available disk space [########################] 100%\n:: Processing package changes...\n(1\/2) installing tailscale [########################] 100%\n(2\/2) installing tailscale-pikvm [########################] 100%\n:: Running post-transaction hooks...\n(1\/2) Reloading system manager configuration...\n(2\/2) Arming ConditionNeedsUpdate...<\/pre>\n<\/li>\n
    3. \n
      Enable the Tailscale Service
      \n<\/strong><\/p>\n
      [root@pikvm kvmd-webterm]# systemctl enable --now tailscaled\nCreated symlink '\/etc\/systemd\/system\/multi-user.target.wants\/tailscaled.service' -> '\/usr\/lib\/systemd\/system\/tailscaled.service'.<\/pre>\n<\/li>\n
    4. \n
      Start the Tailscale Connection<\/strong><\/p>\n
      [root@pikvm kvmd-webterm]# tailscale up\n\nTo authenticate, visit:\n\nhttps:\/\/login.tailscale.com\/a\/a456xxx\n\nSuccess.<\/pre>\n
      Starting Tailscale will display a URL for authentication. Access that URL and log in to complete the connection.<\/p>\n<\/li>\n
    5. \n
      Configure Tailscale (Optional)
      \n<\/strong>If necessary, consider configuring the expiration to never expire by using the “Disable key expiry” option. Select Machines > click the … next to pikvm > Disable key expiry
      \n\"Tailscale<\/a><\/p>\n<\/li>\n<\/ol>\n
      Remote Connection via Smartphone<\/h3>\n
        \n
      1. \n
        Install the Tailscale app on your smartphone (available for both iOS and Android).<\/p>\n<\/li>\n
      2. \n
        Turn on the VPN connection within the app and connect to the Tailscale network that the PiKVM belongs to.
        \n        \"PiKVM<\/a><\/p>\n<\/li>\n
      3. \n
        You can access the PiKVM from your smartphone’s browser by entering the IP address assigned to the PiKVM by Tailscale.
        \n        \"Remote<\/a><\/p>\n<\/li>\n<\/ol>\n
        This ensures that even if a server issue occurs, you can remotely restart the PiKVM or check logs, achieving a stable remote management environment.<\/p>\n
        \n
        Conclusion<\/h2>\n
        In this article, we explained the measures to set up PiKVM’s monitoring functions and remote management environment.<\/p>\n
          \n
        • \n
          Resolved the issue where the password for the “kvmd-webterm” user, which is used for default login to the browser terminal, was not set, by modifying settings via SSH.<\/p>\n<\/li>\n
        • \n
          Enabled remote access and management from smartphones through the introduction of Tailscale VPN, establishing a framework to handle unexpected troubles with peace of mind.<\/p>\n<\/li>\n<\/ul>\n
          With these configurations, the system has become a secure and responsive setup that can be handled remotely and promptly at all times, even for monitoring purposes with the ASRock Beebox. We will continue to implement further updates aimed at achieving a comfortable operational experience.<\/p>\n
           <\/p>\n
           <\/p>\n","protected":false},"excerpt":{"rendered":"
          So far, through the hardware, software, and case design installments, we have successfully built our own DIY P […]<\/p>\n","protected":false},"author":4,"featured_media":1437,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/donguri3.net\/?p=1142","footnotes":""},"categories":[1164],"tags":[9,52,461,476,488,485,24,10,275,467,278],"class_list":["post-5034","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-diy-tools-devices","tag-diy","tag-https","tag-pikvm","tag-ssh","tag-tailscale","tag-vpn","tag-server","tag-275","tag-467","tag-278","en-US"],"_links":{"self":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5034","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/comments?post=5034"}],"version-history":[{"count":1,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5034\/revisions"}],"predecessor-version":[{"id":5037,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5034\/revisions\/5037"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media\/1437"}],"wp:attachment":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media?parent=5034"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/categories?post=5034"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/tags?post=5034"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}