Readiness report
AllStarLink ASL3 Repeater Node · 2026-09-03 18:33 · complete · 7 searches, 12 pages fetched
Cybersecurity — software & network: Review before networking · 4 findings
Details in the Cybersecurity section of the report below.
Readiness: AllStarLink ASL3 Repeater Node
Verdict: Ready with caveats · 2026-09-03 · est. parts cost $213–$504 (USB radio interface and optional RTCM unpriced) Cybersecurity — software & network: Review before networking
This is the cold check for this lab — there is no previous report, so the prices and availability below establish the baseline that future checks will measure drift against. Five of the six items on the bill of materials are commodity retail goods, in stock from several sellers at ordinary prices: the Raspberry Pi host, the microSD card, the USB-C power supply, and the FM transceiver can all be bought today. The lab turns on one constrained item, the USB radio interface FOB, and the shopping evidence does not satisfy it — searching for it returns bare C-Media sound-card dongles rather than radio-ready interfaces with push-to-talk and carrier-detect wiring brought out. A documented way forward exists, because AllStarLink's own manual names the purpose-built adapters that do the job, so the lab is not at risk; but no current price or stock could be verified for any of those adapters, and the optional RTCM module's vendor publishes neither, which is why this is caveated rather than clean.
Action required
| Part | Problem | Recommended action |
|---|---|---|
| USB Radio Interface / Audio FOB (C-Media CM108/CM119, VID 0d8c) | Retail search returns only unmodified USB sound cards, which need GPIO soldered on before they can key a radio; none of the listings states the USB vendor/product ID, so ASL3 compatibility is unconfirmed | Buy a purpose-built AllStarLink adapter instead — the Masters Communications RA-series is built on the CM119A chip ASL3 supports natively. Price and stock are not published on the vendor page, so email the vendor for a current quote before budgeting |
| Radio Thin Client Module (RTCM) | Vendor page is live but publishes no price, no stock and no cart; the module has no manufacturer part number to look up at a distributor | Optional part — the USB FOB path is the default and needs no RTCM. If the IP-linked route is wanted, contact Micro-Node directly for price and lead time |
| FM Radio Transceiver or Repeater | Plentiful and cheap, but no listing confirms the accessory connector carries discriminator audio, PTT and COS/COR — the signals the lab actually needs | Check the service manual of the specific model for accessory-connector pinout before ordering; do not assume a modern mobile breaks out discriminator audio |
| Host Power Supply | Listings are ambiguous about current rating, and a Pi 5 host needs 5 V / 5 A USB-PD rather than the 3 A these mostly supply | Match the adapter to the board actually bought; confirm the amperage in the listing rather than the photo |
Cybersecurity — software & network
Review before networking — Debian 13 is current and the one dependency that could be checked came back clean, but the network-facing Asterisk engine and both web administration interfaces are installed unpinned at versions the project's own sources do not agree on, so none of their security state could be verified.
| Component | Version | How known | Support status |
|---|---|---|---|
| Debian GNU/Linux (base appliance OS) | 13 | inferred (stated as "Debian 13 (Trixie)" in the lab's manual_pi_appliance.md (snapshot); no manifest fetched this run pins it) | supported until 2028-08-09 |
| Asterisk LTS with app_rpt channel driver | not determined | not determined (the project's own sources disagree - the fetched README.md says "the current LTS version of Asterisk 20" while manual_pi_appliance.md says "Asterisk 22 LTS" (snapshot) - and the asl3-asterisk package carries no version constraint in the fetched debian/control) | — |
| asl3 (Debian meta-package) | 3.18.2-2 | read from project (top entry of debian/changelog on the develop branch (fetched/02-changelog); this is the packaging tree's current version, not necessarily the version an instructor installs from the AllStarLink apt repository) | — |
| debhelper-compat (build dependency) | 13 | read from project (debian/control Build-Depends: "debhelper-compat (= 13)" (fetched/01-control)) | — |
| asl3-asterisk (AllStarLink Debian repository) | not determined | unpinned (listed in the Depends line of the fetched debian/control with no version constraint) | — |
| asl3-menu (AllStarLink Debian repository) | not determined | unpinned (listed in the Depends line of the fetched debian/control with no version constraint) | — |
| allmon3 web dashboard | not determined | unpinned (listed under Suggests in the fetched debian/control with no version constraint; also named in manual_pi_appliance.md (snapshot)) | — |
| Cockpit web administration interface | not determined | not determined (named in manual_pi_appliance.md (snapshot); it appears in no manifest fetched this run, so no version exists to check) | — |
| Debian archive runtime packages (lsb-release, bind9-dnsutils, uuid, curl, lame, sox, whiptail, python3-serial, python3-requests, ffmpeg) | not determined | unpinned (all ten are listed in the Depends line of the fetched debian/control with no version constraint; the installed versions are whatever Debian 13 ships on build day) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| asl3 (Debian package dependencies) | Dependencies unpinned: 12 of 12 runtime packages in debian/control carry no version constraint, including asl3-asterisk, the telephony engine that carries the node's network traffic, so the node has no checkable security state - what gets installed is whatever the repositories ship on the day the class builds it. | posture | Mitigation only - record the versions actually installed after each build (dpkg -l) so the node has a known baseline, and rebuild classes from that same baseline |
| Asterisk IAX2 inter-node linking | The node's Asterisk instance accepts inbound IAX2 voice-over-IP connections from other repeater nodes over UDP, and the lab's own materials describe enabling port forwarding so outside nodes can connect, which puts the telephony engine directly on the public internet. | posture | Mitigation only - leave inbound port forwarding switched off unless the exercise genuinely requires public inbound node connections, and keep the node on an isolated network segment |
| Asterisk LTS with app_rpt channel driver | The project's own documentation disagrees about which major version of Asterisk ASL3 installs - the repository README says Asterisk 20 and the Pi appliance manual says Asterisk 22 LTS - so an instructor cannot tell from the sources which telephony engine is running on the node or which published vulnerabilities would apply to it. | posture | Mitigation only - read the running version off the node after installation (asterisk -rx "core show version") and track advisories against that version |
| Cockpit and allmon3 web interfaces | The appliance build includes two browser-reachable administration interfaces - Cockpit, which administers the whole host, and the allmon3 dashboard, which monitors and controls the node - and the sources record neither their versions nor whether any authentication is configured on them by default. | posture | Mitigation only - confirm a password is set on both interfaces before the node is reachable by anyone else, and restrict them to the campus LAN or a VPN |
What this means for your lab
This node is a networked appliance, not a standalone bench project. Once it is on your campus network it runs a telephony engine that other AllStarLink nodes connect to over the internet, plus two web pages an administrator can open in a browser: Cockpit, which controls the whole computer, and the allmon3 dashboard, which can monitor traffic and key the repeater. Anyone who can reach those pages and get past their login could transmit on your licensed station or take over the host machine. Nothing in the lab's files records what passwords those interfaces ship with, or whether remote SSH login is switched on, so we could not check them - treat that as unknown rather than safe. The good news is the base operating system: Debian 13 is current and receives security updates until August 2028. The rest of the stack is not version-locked - the build installs whatever the AllStarLink repository is shipping that day, and the project's own documents disagree about which major Asterisk version that is, so nobody can tell you which published vulnerabilities apply to your node. Practical steps before this touches a shared network: put it on its own isolated segment or VLAN, do not forward a public port to it unless the class genuinely needs inbound connections from other nodes, set or change the passwords on Cockpit and allmon3, write down the versions actually installed once the build is done, and raise the deployment with campus IT.
Not checked
- Asterisk (asl3-asterisk): version not determined - the sources give conflicting major versions (README 20 vs manual 22 LTS) and the package is unpinned, so there is no exact version to check against an advisory database
- asl3-menu, asl3-update-nodelist, allmon3: unpinned in debian/control - no version to check
- Cockpit: named only in the lab's documentation; no version stated and it appears in no fetched manifest
- Debian archive runtime packages (lsb-release, bind9-dnsutils, uuid, curl, lame, sox, whiptail, python3-serial, python3-requests, ffmpeg): declared with no version constraint; the installed versions are whatever Debian 13 ships, which the sources do not record
- pandoc (build dependency): unpinned in the debian/control Build-Depends line
- asl3-pi-appliance: appears only as a Breaks constraint (<< 1.8.0), a version range rather than an installed pinned version
- DVSwitch Mobile (Android), RepeaterPhone (iOS), IAXRpt (Windows), Transceive (macOS): external client applications distributed through app stores; no version stated in the sources and no manifest to read
- Default credentials and SSH configuration: not stated anywhere in the uploaded sources, and nothing was fetched this run that establishes them - unknown rather than safe
Parts
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Raspberry Pi 4 Model B (4 GB) | SBC, ~85 × 56 mm; 5.0–5.1 V, ≥ 3.0 A USB-C | Readily available | Listed by several sellers | $55.00 · $61.05 (4 GB kit) | CanaKit.com; Vilros. Note the $55.00 PiShop listing is the 2 GB board — a different variant |
| System storage — microSD card | microSDHC/SDXC, Class 10 / UHS-I, ≥ 8 GB (32 GB planned) | Readily available | Commodity, many sellers | $10.00 · $17.69 (32 GB stated) · $19.99 (32 GB stated) | SanDisk Ultra; Kodak |
| Host power supply | Wall adapter, 100–240 V AC in, 5.0–5.1 V DC out, ≥ 3.0 A, USB-C | Readily available | Listed by several sellers | $8.00 · $8.80 · $19.99 (5.1 V 3 A stated) | Official Raspberry Pi USB-C supplies. Pi 5 hosts need 5 V / 5 A — see the Pi 5 adapter listing, amperage not stated |
| USB Radio Interface / Audio FOB | External USB dongle, C-Media CM108/CM108AH/CM119/CM119A, USB VID 0d8c, GPIO for PTT and COS | Hard to obtain as specified | — | $2.64 · $5.28 (bare sound cards only) | Retail listings are unmodified sound cards, not radio interfaces — see Substitutes |
| Radio Thin Client Module (RTCM) | Standalone IP radio interface / voter, 7–24 V DC in, network port 667 (optional) | Not checked | — | — | Vendor page live at micro-node.com; no price or stock published |
| FM radio transceiver or repeater | VHF/UHF FM mobile or repeater with discriminator RX audio, TX audio, PTT and COS/COR; 13.8 V DC nominal | Readily available | Listed by several sellers | $139.99 · $159.99 · $234.95 · $239.95 · $359.95 | Retevis RT95; TYT TH-9800D Plus; Icom IC-V3500; Yaesu FT-3185R; Yaesu FTM-150R |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| USB Radio Interface / Audio FOB | Masters Communications RA-series radio adapter (RA-40) | Purpose-built AllStarLink adapter rather than a bare dongle. Built on the CM119A chip, which ASL3 supports natively (VID 0x0d8c, PID 0x013a), so it satisfies the udev-rule constraint that disqualifies non-C-Media dongles. CM119 carries four more GPIO lines than CM108 — exceeds the requirement, acceptable. Sold as an unassembled kit or assembled-and-tested, with or without a case; the kit versions need through-hole assembly | Verified: chipset family and ASL3 compatibility (CM119A → VID 0x0d8c / PID 0x013a), from the fetched ASL3 manual pages on radio connections and USB interfaces; vendor page live and accepting PayPal orders. Not verified: current price and stock (the fetched product page shows ordering options but no price or stock figure), the cable/connector match to a specific radio, and the exact PID of the board shipped | Acceptable — budget from a vendor quote, not from this report |
| USB Radio Interface / Audio FOB | Masters Communications DRA-series radio adapter | ASL3's manual describes the DRA-series as plug-and-play with no soldering for radios with a 6-pin Yaesu/Kenwood interface, which removes the assembly burden the RA kits carry | Verified: that ASL3's own manual lists it as a supported interface family. Not verified: the chipset — the evidence states CM119A for the RA-series but says nothing about the DRA-series' chip, so the VID 0d8c requirement is unconfirmed for it; no price, no stock, no product page fetched | Plausible, unverified — confirm the chipset with the vendor before ordering |
| USB Radio Interface / Audio FOB | Kits4Hams SHARI, DMK URI, ClearNode, HotSpotRadios, Techno By George | All are named as AllStarLink interface vendors in ASL3's own manual, in USB and Pi-hat form factors; the integrated node products bundle a radio as well as the interface | Verified: nothing beyond their appearance in ASL3's vendor list. Not verified: chipset, price, stock — no product page was fetched for any of them | Not checked — alternatives to investigate if the RA-series is unavailable |
| USB Radio Interface / Audio FOB | Bare CM108 USB sound card plus DIY GPIO wiring | Same chip family, but the GPIO lines for COS, PTT and CTCSS are not brought out. ASL3's manual is explicit that this route "is not for the faint of heart" and "requires a steady hand and magnification equipment to solder to the tiny leads on the circuit board". None of the retail listings states the USB VID/PID | Verified: that ASL3's manual documents this as a legitimate route. Not verified: the vendor ID of any listed dongle, and therefore whether it matches the ASL3 udev rule at all | Plausible, unverified — a soldering project for an experienced builder, not a drop-in part for a class |
| Radio Thin Client Module (RTCM) | Open-source VOTER board (self-fabricated) | ASL3's manual states the VOTER is the original through-hole design, that it is open-source with Gerber files and BoM available, and that the RTCM "is the commercial version of the VOTER … functionally equivalent … they operate the same, and use the same firmware" | Verified: functional equivalence and open-source availability, both stated on the fetched ASL3 manual RTCM hardware page. Not verified: where the Gerbers and BoM actually live (not fetched), board build cost, and whether its components can still be sourced | Plausible, unverified — a fabrication project rather than a purchase; only worth it if the IP-linked route is essential |
Verify any substitute against its datasheet and against your own radio's accessory-connector pinout before ordering.
Other dependencies
- ASL3 GitHub source repository (https://github.com/AllStarLink/ASL3) — live. Listed this run; the default branch is
developand the Debian packaging directory is present. - ASL3 manual and installation portal (https://allstarlink.github.io) — live. Three of its pages were fetched successfully this run (USB interfaces, radio connections, and RTCM hardware).
- AllStarLink legacy wiki (https://wiki.allstarlink.org/wiki/Radio_Connections and https://wiki.allstarlink.org/wiki/AllStar_Link_Standard_Commands) — retired. The fetched page states: "The legacy Mediawiki found at wiki.allstarlink.org has been retired. Most pages here previously have redirections to the appropriate place in the AllStarLink Manual." Both wiki links in the lab's materials are stale; the equivalent content now lives in the manual and on the ASL Community site. Only the radio-connections URL was fetched, but the retirement notice covers the whole wiki.
- AllStarLink active nodes list (https://stats.allstarlink.org/) — not checked.
- AllStarLink public nodelist (https://www.allstarlink.org/nodelist) — not checked.
- Fabrication — none applicable. The lab records no PCB design files, Gerbers, or board specifications; it is an appliance install onto commercial hardware. The one board that could be fabricated is the optional open-source VOTER, noted under Substitutes.
Watch list
- USB radio interface FOB — the single constrained item in the build, supplied by small specialist vendors who do not publish prices or stock on the pages checked. Most likely thing to block a class.
- Radio Thin Client Module — single-source commercial product with no published price, stock, or cart; worth re-checking that the vendor is still trading before anyone plans a voting/simulcast exercise around it.
- Raspberry Pi 4 Model B — listings are inconsistent about memory capacity, and this board's price and availability have historically swung hard. The lab's wide substitution latitude (Pi 3/4/5/400/Zero 2 W or any x86 machine) is the cushion here.
- AllStarLink documentation URLs — the legacy wiki has already gone; expect further churn as content consolidates into the manual, and re-check any link the lab hands to students.
- FM transceiver interface access — models come and go, and the discriminator-audio and PTT/COS access the lab needs is not a feature retailers advertise. Verify per model, every time.