ssh configuration

[jbrodriguez]

how do you configure ssh, so that you can authenticate with a public/private key ?

 

openssh is now built in, just not sure how to configure /etc/ssh/sshd_config and make it persist across boots.

 

thanks in advance !

[ntrlsur]

all the kety files for ssh are in /boot/config/ssh .  you should be able to grab the key files from there. 

[Dmtalon]

So, do we not generate our own key pair?  are we supposed to copy the private key from unRAID?  seems odd.

 

 

Is there an unraid 6 ssh key setup how-to?  Maybe I'm dense but its not working for me currently.

[jphipps]

you normally generate your public/private key pair on your client and then copy the public key to the ~/.ssh directory on your server.( The .ssh directory in your home directory )  You will probably have to put your public key somewhere in the /boot/config directory and have the go script copy the key into the users home directory so it will persist after a reboot.

[Dmtalon]

Thanks,

 

This was where I was confused... I wasn't sure if unRAID was special or if I just needed to created a .ssh and put my stuff there.  I went ahead and generated a key pair and installed it normally and it worked.

 

 

I created a small script to create the .ssh, chmod the dir, copy the authorized_keys (stored in /boot/config/ssh) to the .ssh dir and also chmod 700 it.

 

This lived through a reboot.  I'll go ahead and put my script here in case others want to see it.

 

 

gossh.txt

[jbrodriguez]

yeah, i ended up doing pretty much the same

[pinion]

Dmtalon: Thanks for that gossh. It works nicely. But can anyone figure out how to get it to work as a symlink? I'd like to be able to be able to do this and it just write to the file in /boot/config/ssh so it stays up to date.

cat .ssh/id_rsa.pub | ssh root@unraid 'cat >> /boot/config/ssh/authorized_keys'

 

 

I'd also love it if there was a way to persist the home directory but besides copying stuff around at shutdown and startup I don't know how to do that.

[Dmtalon]

Dmtalon: Thanks for that gossh. It works nicely. But can anyone figure out how to get it to work as a symlink? I'd like to be able to be able to do this and it just write to the file in /boot/config/ssh so it stays up to date.

cat .ssh/id_rsa.pub | ssh root@unraid 'cat >> /boot/config/ssh/authorized_keys'

 

 

I'd also love it if there was a way to persist the home directory but besides copying stuff around at shutdown and startup I don't know how to do that.

 

 

I think with any other directory that would work, but .ssh is a special directory with special permissions.  The link would be to a file on flash that has 777 permissions (rwxrwxrwx) on the flash drive

 

 

I can play with it and see unless someone already knows.

 

 

But the link creation would be just to "ln -s /boot/config/ssh /root/.ssh"  (.ssh can't already exist)  Just not sure how all the permissions would work off the top of my head.

 

 

 

 

 

[pinion]

Dmtalon: Thanks for that gossh. It works nicely. But can anyone figure out how to get it to work as a symlink? I'd like to be able to be able to do this and it just write to the file in /boot/config/ssh so it stays up to date.

cat .ssh/id_rsa.pub | ssh root@unraid 'cat >> /boot/config/ssh/authorized_keys'

 

 

I'd also love it if there was a way to persist the home directory but besides copying stuff around at shutdown and startup I don't know how to do that.

 

 

I think with any other directory that would work, but .ssh is a special directory with special permissions.  The link would be to a file on flash that has 777 permissions (rwxrwxrwx)

 

 

I can play with it and see unless someone already knows.

 

 

But the link creation would be just to "ln -s /boot/config/ssh /root/.ssh"  (.ssh can't already exist)  Just not sure how all the permissions would work off the top of my head.

 

I definitely didn't have a problem with the link creation. I even changed it in the script. But as you said, I think there is a permissions issue there.

[alphazo]

Thanks for the tiny script. I also added a line to the script to copy my custom sshd_config to /etc/ssh/ since I usually disable any kind of password access over SSH.

[tokra]

1) generate SSH keys on your client machine:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

 

2) add generated key to your client:

eval "$(ssh-agent -s)"

ssh-add ~/.ssh/id_rsa

 

3) copy generated public key to your UNRAID server using:

ssh-copy-id -i ~/.ssh/id_rsa.pub root@tower

 

Then login to your UNRAID over SSH and:

4) Copy authorized_keys from root user home to flash using:

cp /root/.ssh/authorized_keys /boot/config/ssh/

 

5) edit /boot/config/go on flash and add this line:

mkdir /root/.ssh/
cp /boot/config/ssh/authorized_keys /root/.ssh/authorized_keys
chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys

 

By this method you will have accessible SSH connection to your UNRAID over keys you generated even after UNRAID restarts.

 

Hope this helped 

[willbg]

On 18/12/2016 at 11:50 PM, tokra said:

By this method you will have accessible SSH connection to your UNRAID over keys you generated even after UNRAID restarts.

 

Hope this helped 

 

It did, very much so.  Thanks!

[JOduMonT]

Works perfectly !

On 12/18/2016 at 2:50 PM, tokra said:

By this method you will have accessible SSH connection to your UNRAID over keys you generated even after UNRAID restarts.

 

Hope this helped 

 

but I would like to say it will be safer to not using root or any well-known user name such as rescue, admin, adm, ...

because who known when they will find another way to brute force ssh

https://blog.sucuri.net/2013/07/ssh-brute-force-the-10-year-old-attack-that-still-persists.html

[ken-ji]

Well, unRAID is not meant to be facing a hostile network. So don't place it in a DMZ, or the internet, where it would be subject to brute force attacks.

The root password cannot be super strong because some symbols cannot be used by the web ui properly