Readiness report

PiKVM v2 DIY IP-KVM Remote Management Console · 2026-09-03 03:58 · complete · 26 searches, 30 pages fetched

Download PDF

Cybersecurity — software & network: Do not place on an open network · 4 findings

Details in the Cybersecurity section of the report below.

Readiness: PiKVM v2 DIY IP-KVM Remote Management Console

Verdict: Ready with caveats · 2026-09-02 · est. parts cost $119–$137 for the priced core Cybersecurity — software & network: Do not place on an open network

This is the first readiness check for this lab, so it establishes the baseline — every price and stock level below is recorded for the next check to measure drift against. The recommended build is sourceable today: the Raspberry Pi 4 Model B 2 GB is Active at $55.00, the official PiKVM USB Power/Data Splitter is in stock at three shops around $14.42–$14.95, the official 15.3 W power supply is an exact match at $8.00, and the HDMI-to-CSI capture bridge sells at $26–$43. Four things keep it off a clean "Ready": the snapshot's part number for the primary board (RPI4-MODBP-2GB) cannot be ordered anywhere checked and must be ordered as SC0193 instead; the capture bridge's required Toshiba TC358743 chip could not be confirmed on any page that permits automated checking; the optional ATX controller has one obsolete option and one that is stocked only in a surface-mount package unusable on the specified breadboard; and the two alternative power wiring variants each contain a part that could not be sourced at spec. The cost estimate covers the priced core only — the microSD card, HDMI cable, Ethernet cable and camera ribbon were identified at Pi specialist retailers but their pages do not expose a price to an automated check.

Action required

Part Problem Recommended action
Raspberry Pi 4 Model B 2 GB The snapshot's MPN RPI4-MODBP-2GB is not orderable: no DigiKey listing, and both authorized distributors carrying it (Newark, Mouser) show 0 stock Order the same board as SC0193 — $55.00, 1210 in stock at DigiKey. Update the lab's parts list to SC0193
HDMI-to-CSI-2 bridge (Waveshare 19222) The lab requires the Toshiba TC358743 chip specifically, but no fetchable product page states it; Waveshare's own store blocks automated checking Buy only from a listing that names TC358743 in the description, and confirm the chip on arrival before the class runs
ATX controller — OMRON G3VM-61A1 Obsolete, no stock Substitute G3VM-61AY1 (manufacturer-recommended, $3.62), or better, use PC817X2NSZ9F at $0.29
ATX controller — TLP241BF Stocked only as 4-SMD gull-wing; will not plug into the breadboard the lab specifies Use PC817X2NSZ9F (through-hole 4-DIP) instead
USB-A power blocker (Power Variant 2) Most retail "USB data blockers" do the opposite of what this lab needs — they block data and pass power Source a power/VBUS blocker, or use the snapshot's own fallback: tape over pin 1 of a standard USB-A plug (free)
5 V / 3 A USB-A supply (Power Variant 3) Could not be confirmed at spec; the closest fetchable part (Adafruit, 5.25 V 2 A) falls short of the required ≥ 3.0 A Use Power Variant 1 (official 15.3 W supply + splitter) instead, which avoids this part entirely

Cybersecurity — software & network

Do not place on an open network — Published default credentials and 2FA off on a device whose web, SSH, VNC and IPMI services all grant complete control of the attached server, with no version-level security check possible on any of its unpinned components.

Component Version How known Support status
PiKVM OS (Arch Linux ARM base) not determined not determined (Distributed as a pre-built raw disk image; the lab materials state no image version and the base is a rolling release, so no version exists to check.) —
kvmd (main PiKVM daemon) 4.213 read from project (pkgver=4.213 in the fetched kvmd PKGBUILD (saved as fetched/01-PKGBUILD).) —
Python (kvmd runtime) 3.14 inferred (kvmd PKGBUILD constrains python>=3.14 and python<3.15, which bounds the runtime to the 3.14 series; it is a range, not an exact pin.) supported until 2030-10-31
ustreamer (video streaming server) not determined unpinned (kvmd PKGBUILD requires ustreamer>=6.47, a lower bound with no upper bound; the installed build is whatever the PiKVM pacman repository currently ships.) —
nginx-mainline (web front end for the PiKVM UI/API) not determined unpinned (kvmd PKGBUILD requires nginx-mainline>=1.25.1, a lower bound only.) —
OpenSSH (remote administration) not determined unpinned (Listed as an unversioned dependency 'openssh' in the kvmd PKGBUILD.) —
kvmd-webterm (browser terminal service) not determined not determined (Ships as part of the kvmd package suite; no independent version is stated in the lab materials or the fetched PKGBUILD.) —
kvmd-htpasswd / kvmd-totp (authentication utilities) not determined not determined (CLI utilities bundled with the kvmd package; no separate version stated.) —
kvmd-auth-server (optional central authentication) not determined not determined (Repository listing for pikvm/kvmd-auth-server returned no manifest or lockfile (server.py and config.yaml only), so no version could be read.) —
Angry IP Scanner / arp-scan (client diagnostic tools) not determined not determined (Auxiliary tools run on the student's own desktop; no version stated in the lab materials.) —
Google Authenticator (optional 2FA app) not determined not determined (Mobile application installed from an app store; no version stated in the lab materials.) —
Component Finding Severity Fix available?
kvmd (main PiKVM daemon) The lab documents a switch that turns authentication off entirely (kvmd.auth.enabled: false in /etc/kvmd/override.yaml), which would leave total control of the attached server open to anyone who can reach the device. posture Mitigation only - leave authentication enabled; never set kvmd.auth.enabled: false on a network students or others share.
kvmd (main PiKVM daemon) Dependencies unpinned: 64 of 64 in the kvmd PKGBUILD carry no exact version (only lower bounds such as nginx-mainline>=1.25.1 and ustreamer>=6.47), so the software actually installed varies with the build date and has no fixed, checkable security state. posture Mitigation only - record the output of pacman -Q on a known-good build so the class can rebuild the same versions, and re-run this check after each update.
PiKVM OS (Arch Linux ARM base) The device ships with published default passwords - root/root for the Linux account reached over SSH, and admin/admin for the web interface, REST API and VNC - with two-factor authentication switched off, so anyone who knows the documentation can log in until a student changes them. posture Mitigation only - change both passwords during the build (passwd root and kvmd-htpasswd set admin) before the device is ever connected to a shared network, and enable TOTP 2FA.
PiKVM OS (Arch Linux ARM base) Every remote-access service is enabled out of the box - the web UI and REST API on ports 80/443, SSH on port 22, a VNC server, and IPMI/Redfish BMC emulation - and each one grants full control of the attached server, including its power, BIOS and emulated keyboard and virtual drive. posture Mitigation only - put the device on an isolated management VLAN or lab-only network segment and involve campus IT before connecting it to any shared network.

What this means for your lab

A PiKVM is, by design, a remote key to the server it is plugged into: whoever can reach it can power the server on and off, watch and drive its screen and keyboard from boot onward, enter the BIOS, and mount a virtual drive to boot the machine from their own disk image. As flashed from the project's image it answers on the network immediately - web interface, SSH, VNC and IPMI are all on - and the passwords are the ones printed in the public documentation: root/root for the Linux login and admin/admin for the web interface, with two-factor authentication off. Anyone on the same network who recognises the device could therefore take over the attached server outright. Treat changing both passwords as part of the build, not as a later step, and keep the device on an isolated lab or management network rather than the campus network; talk to campus IT before connecting it to anything shared. Note also that we could not verify the security state of the software itself: the PiKVM image is a rolling release whose components are unpinned, and the kvmd daemon is distributed through a repository no vulnerability database tracks, so this check can say nothing about whether known flaws are present - it is unknown, not clean.

Not checked

  • PiKVM OS (Arch Linux ARM base): Rolling release with no image version stated in the lab materials; endoflife.date has no dated cycle for a rolling distribution, so its support status could not be established.
  • kvmd 4.213: Distributed through PiKVM's own pacman repository, which no vulnerability database indexes - absence of advisories here is not evidence that there are none.
  • The 64 Arch package dependencies of kvmd (python-aiohttp, nginx-mainline, openssh, python-paramiko, ipmitool and the rest): All unpinned in the PKGBUILD, so no exact version exists to match against OSV.
  • ustreamer: Version not pinned (kvmd requires only ustreamer>=6.47) and the repository carries no manifest, so no exact version could be checked.
  • kvmd-webterm, kvmd-htpasswd, kvmd-totp: Ship inside the kvmd package with no independent version to look up.
  • kvmd-auth-server: Optional component; its repository has no manifest or lockfile, so no version could be read.
  • Angry IP Scanner and arp-scan: Client-side desktop diagnostic tools, version not stated in the lab materials.
  • Google Authenticator: Mobile application, version not stated in the lab materials.

Parts

Base single-board computer

Part Spec/Package Status Stock Price Source
Raspberry Pi 4 Model B 2 GB (SC0193) SBC, 85.00 × 56.00 mm, 40-pin GPIO, 15-pin CSI Readily available — but not under the snapshot's RPI4-MODBP-2GB 1210 $55.00 DigiKey, Active
— same board as RPI4-MODBP-2GB — Unobtainable under that MPN 0 $55.00 listed Newark 0 stock, Mouser 0 stock (ECIA)
Raspberry Pi Zero 2 W (snapshot says SC0510) Ultra-compact SBC, 65 × 30 mm Available at Pi retail; vendor page states the model as SC1146, not SC0510. No distributor match for SC0510 — not captured PiShop.us
Raspberry Pi 5 (SC1111 / SC1112) SBC, 85.60 × 56.50 mm Not required — the lab documents the Pi 5 as unsuitable (no hardware H.264 encoder). No exact match for either MPN 0 $422.62 listed, RS 0 stock ECIA; DigiKey stocks Pi 5 8 GB under the different MPN SC1432

Operating system storage

Part Spec/Package Status Stock Price Source
MicroSD card, ≥ 16 GB, Class 10 SanDisk Ultra MicroSDHC 32 GB, Class 10 / UHS-I, 100 MB/s Readily available — not captured PiShop.us

Video capture

Part Spec/Package Status Stock Price Source
HDMI-to-CSI-2 bridge (TC358743, Waveshare 19222) Module, HDMI-A female + 15-pin 1.0 mm FPC Available — chip identity not verified — $26.24–$70.18 (8 listings; Waveshare-branded $26.24 and $43.00) Google Shopping; The Pi Hut page does not name the chip (SKU WAV-19137)
Camera ribbon, Pi 4 (15-pin, 1.0 mm, 15 cm) 15-way 150 mm flat-flex Readily available — not captured The Pi Hut
Camera ribbon, Pi Zero 2 W (22-pin 0.5 mm → 15-pin 1.0 mm) Asymmetric FPC Available at retail; the snapshot's "B085RW9K13" is an Amazon ASIN, not an MPN — $0.99–$20.99 Google Shopping (Arducam/UCTronics pages unreadable to an automated check)
USB HDMI capture dongle (UVC) HDMI-A female to USB-A male Readily available — $14.99–$161.17; usable UVC units $14.99–$24.95 Google Shopping
Active VGA-to-HDMI converter (optional) VGA in, HDMI out, USB 5 V powered Readily available — check direction — $12.99–$56.36 Google Shopping (the same search also returns HDMI-to-VGA units, which are useless here)

Power and USB data path

Part Spec/Package Status Stock Price Source
USB-C Power/Data Splitter (Variant 1, recommended) Breakout PCB, 3 USB ports, breaks host VBUS Readily available; VBUS isolation confirmed on the vendor page in stock at 3 shops $14.42–$14.95 PiShop.ca / PiShop.us / HiPi.io; official page
USB-C to USB-C cable (Variant 1) C male–C male, 0.3–1.0 m, ≥ 3 A Readily available (1 m; exact 0.3 m not found at a checkable vendor) in stock $9.95 Adafruit, USB 3.1 with E-Mark
USB-A to USB-C cable (Variants 1–3) A male–C male, 1–2 m Readily available in stock $4.95 Adafruit, ~1 m
USB-A power blocker (Variant 2) Inline A male–A female, VBUS pin 1 cut, data kept Available — but most retail "data blockers" are the opposite device — $4.55–$22.95 Google Shopping; snapshot's free fallback is taping pin 1
Dual USB-A Y-splitter (Variant 2) 1× A female → 2× A male Readily available — $2.67–$19.99 Google Shopping
Donor USB cable for splicing (Variant 3) USB-A male, ≥ 24 AWG conductors Readily available (any donor cable) in stock $0.95 Adafruit solder-tab shell — a different form factor from a pre-wired pigtail; conductor gauge not verified
Raspberry Pi 15.3 W USB-C supply (SC0216) 90–264 VAC in; 5.1 V, 3 A, 15 W out Readily available — exact match 1292 $8.00 DigiKey, Active
Raspberry Pi 12.5 W micro-USB supply (SC0211) 5.1 V, 2.5 A out, micro-USB Available at Pi retail; no authorized distributor lists SC0211 (the ECIA hit is an unrelated SMC Corporation part) — not captured PiShop.us, 5.1 V 2.5 A confirmed
5 V / 3 A supply with USB-A socket (Variant 3) Regulated 5.0–5.2 V, ≥ 3.0 A, USB-A female Not confirmed at spec — $10.99–$36.84, none confirmed as 5 V/3 A with a USB-A socket Google Shopping; Adafruit's USB-A unit is 2 A — under-spec

Pi Zero 2 W host connection

Part Spec/Package Status Stock Price Source
USB-A to micro-USB cable (modified) A male–micro-B male, VBUS disconnected by the student Readily available in stock $2.95 Adafruit, 3 ft

ATX motherboard control interface (optional feature)

The lab's own parts list was retrieved from the project documentation: four optocouplers, four 390 Ω resistors, two 4.7 kΩ resistors, ten or more male-male dupont wires and a breadboard. That page warns verbatim: "Don't use random relay modules or random optocouplers!"

Part Spec/Package Status Stock Price Source
Optocoupler ×4 — PC817X2NSZ9F Through-hole, 4-DIP (0.300", 7.62 mm), CTR ≥ 50 % @ 5 mA, 80 V Readily available — best choice 26442 $0.29 DigiKey, Active (observe input polarity)
Optocoupler ×4 — OMRON G3VM-61AY1 Through-hole, 4-DIP (0.300", 7.62 mm), SSR SPST-NO Readily available 6600 $3.62 DigiKey, Active
Optocoupler ×4 — OMRON G3VM-61A1 Through-hole, 4-DIP (0.300", 7.62 mm) Obsolete 0 $1.8922 listed DigiKey
Optocoupler ×4 — TLP241BF 4-SMD gull-wing only at DigiKey Active but wrong package for a breadboard build 7648 $2.55 DigiKey
390 Ω ×4 and 4.7 kΩ ×2 resistors, dupont wires, breadboard Through-hole commodity not checked — — Ubiquitous commodity stock; not individually looked up

Cabling to target and network

Part Spec/Package Status Stock Price Source
HDMI Type-A male–male cable 1–2 m, HDMI 1.4/2.0 Readily available — not captured PiShop.us, 6 ft
Cat5e/Cat6 patch cable RJ-45, 1–3 m, gigabit Readily available — not captured PiShop.us, Cat6 UTP 24 AWG 7 ft

Substitutes

For part Substitute Differences Verified Judgment
Raspberry Pi 4 2 GB (SC0193) SC0194, 4 GB, $100.00 Identical board otherwise; the extra RAM is unused by PiKVM. Nearly double the price Verified: board outline 85.00 × 56.00 mm identical across SC0193/94/95 (DigiKey parametrics); Active, stock 12270. Not verified: connector-level pinout (not in parametrics) — relied on the snapshot's own statement that these substitute directly Acceptable — a fallback on availability, not on value
Raspberry Pi 4 2 GB (SC0193) SC0195, 8 GB, $165.00 As above; three times the price Verified: board outline 85.00 × 56.00 mm (DigiKey parametrics); Active, stock 5244. Not verified: connector-level pinout Acceptable but poor value for this lab
OMRON G3VM-61A1 (obsolete) OMRON G3VM-61AY1, $3.62 Same manufacturer and SSR family; same body and pitch. Price rises from $1.89 to $3.62 Verified: package and lead spacing both match — 4-DIP (0.300", 7.62 mm) on both, from DigiKey parametrics; DigiKey returned it as "MFR Recommended"; Active, stock 6600. Not verified: LED trigger current and on-resistance (no such parametrics returned) Acceptable — check the datasheet against 3.3 V GPIO drive before ordering
PC817X2NSZ9F LTV-816 (Lite-On), $0.82 Same 4-DIP optoisolator class, 5 kV isolation; about 3× the price Verified: package family 4-DIP on both (DigiKey descriptions); DigiKey classified it "Direct"; stock 30930. Not verified: lead spacing/pitch — a lookup on LTV-816 returned only the surface-mount LTV-816S family, so no parameters block for the through-hole part was obtained. Also not verified: CTR rank Electrically equivalent on the evidence available; footprint not verified. Do not order the LTV-816S variants — those are surface-mount
TLP241BF — Every package DigiKey stocks is 4-SMD gull-wing; the lab specifies a breadboard Verified: mounting type and package (DigiKey parametrics, all four stocked variants) Hard stop on footprint — use PC817X2NSZ9F
5 V / 3 A USB-A supply (Variant 3) Adafruit 5 V 2 A, $7.95 5.25 V at 2 A against a required ≥ 3.0 A Verified: output rating read from the fetched Adafruit product page Rejected — falls short of the current rating; under-current causes exactly the under-voltage throttling the lab warns about

Verify any substitute against its datasheet before ordering — the checks above are only as good as the parametrics the distributor published.

Other dependencies

  • **https://pikvm.org** and **https://docs.pikvm.org** — both live this run; /flashing_os, /v2/ and /_diy_parts_atx/ all retrieved successfully.
  • **https://archlinuxarm.org** — live; the page confirms the rolling-release model the lab depends on ("New software versions are packaged as they are released").
  • **https://pikvm.org/buy/** — live; supplies the splitter availability table used above.
  • PiShop US — live; the splitter, Pi Zero 2 W, power supply, microSD, HDMI and Cat6 product pages all responded.
  • Tindie (8086net USB-C/PWR splitter) — not checked: the page could not be downloaded this run (blocked, timed out, or gone). Status unknown; the same board is available from PiShop.
  • BuyAPI Canada — responded, serving the 8086 splitter product description.
  • 3mdeb (Poland) — live; sells assembled PiKVM kits at €140,00–€192,00 ex. VAT, but no standalone splitter appeared in the retrieved text.
  • GitHub repositories — pikvm/kvmd, pikvm/ustreamer and pikvm/kvmd-auth-server all responded to a directory listing (23, 17 and 10 entries). pikvm/pikvm was not checked this run.
  • YouTube DIY Y-splitter soldering tutorial — not checked.
  • Hardware fabrication — none required. The lab ships no CAD files, Gerbers or board outlines; it is built from commercial modules plus a breadboard and hand-soldered harnesses.

Watch list

  • Raspberry Pi 4 2 GB (SC0193) — the board is the single most drift-prone line here. One of its two DigiKey variants already reports no stock figure, and the RPI4-MODBP-2GB channel has gone to zero across two distributors. Re-check stock and price before each cohort.
  • HDMI-to-CSI-2 bridge — the hardest requirement in the lab (the TC358743 chip is not substitutable) and the least verifiable: sold mostly through marketplaces that block automated checking, with near-identical boards from 52Pi, Geekworm and others that may or may not carry the same silicon.
  • ATX optocouplers — one of the four documented options is already obsolete and another is package-unusable. The remaining through-hole options are what keep this optional feature buildable; watch PC817X2NSZ9F in particular.
  • Raspberry Pi Zero 2 W and its 12.5 W supply — neither the snapshot's SC0510 nor SC0211 matches anything at an authorized distributor, so this alternative build path rests entirely on specialist Pi retailers whose stock is not machine-checkable.
  • Power Variants 2 and 3 — the USB-A power blocker (widely confused with the opposite product) and the 5 V/3 A USB-A supply (not confirmed at spec) are the weakest lines in the BOM. Both disappear if the class standardises on Variant 1.