Cobalt Qube

2025-4-9

Back in the late 1990s, when Linux was becoming popular and "Computer Server Appliances" were basically new paradigm, a small company named Cobalt released their Qube appliance.  It was a neat little device and kind of fun to play around with, but it was insecure as heck, as were so many systems back then.

The Qube was a neat little box.  It was a "cute' size and would have made a great desktop.  It was a great desktop size.  They were ahead of their time with this form factor. (HP had their Proliant Microservers later that were about this size.)  Their first model was MIPS based and was decently powerful for the time.  T1 lines were still a thing and DSL hadn't become mainstream yet, so these boxes were more than sufficient for that.

It was definitely much better than someone's hacked together quarter rack server box that had purple panels with an SGI Indy inside, and maybe a switch or router, and sold as a appliance.  I forget the company that made that, but SGIs were not secure at all and that quarter rack box was huge, larger than a mini-fridge.  (I don't remember that company name, and I'm not sure what to search for to find them anymore.)  The Qube basically shrunk that down to this itsy bitsy box in comparison.  It was also much cheaper than that repackaged SGI Indy.

I was given one to set up and I found out how to easily they could be hacked.  They had written software for the non-techincal people to use to manage the system.  This made it quite easy for non-technical users to use and manage the system.  They could set up user accounts for email and they could easily set up web pages.  Anybody could easily set this up and configure this, although most people still hired IT even if it was "easy to use" for an average user.  It was quite ahead of its time.  I played around with adding accounts through the web interface, but GUI was always slower for creating multiple accounts.

Since I was a command line user, I was creating accounts quickly, only to find that it didn't show up on their web interface.  I went back to the web page to find out I couldn't add those same users since they already existed or even delete them because they weren't on the web page.  They had created a secondary database to access all the configurations and store them separately from the Linux configuration files.  I don't know why they made separate configuration files for their web interface, while also editing the Linux configs, but not display any of the actual changes to the Linux configs.  If any changes were made directly from Linux, it would not show up in their database for display to the web interface.  You could add accounts from the command line and they would be "invisible" to the regular Web user.  I had to go back to the GUI and do this one at a time.  It was quite obnoxious, until I dug through their system and basically found where they put the 2nd database to display the added accounts.  It's like a hidden accounting ledger, 1 real, and 1 for the auditors.

If I was a malicious individual, I could have backdoored multiple Qubes and had free reign on their systems, without the owners knowing, because they weren't technical enough to understand Linux.  The idea was great, but the implementation sucked.  This meant that anyone that remotely hacks into the system would have total free reign on the system if they had no Linux admin to manage the system.  Whenever I had to work on one of these, one of the first things I did was to verify that there was no infiltration and no extraneous accounts.  I didn't trust these things to be safe.

Other than the insecurity, these were nice little devices. They were basically a groundbreaking form factor that predated the Apple Mac Mini.