Difference between revisions of "SSH"
(new installations will not have the dedicated ssh user anymore)
|Line 33:||Line 33:|
Adjust the IP as necessary.
Adjust the IP as necessary. <code></code> .
, see [[USB Network]] for a more detailed guide and troubleshooting instructions.
=== Hardening ===
=== Hardening ===
Revision as of 22:34, 17 June 2021
This article provides an overview of how to use the SSH server after postmarketOS was installed. It is aimed at beginners, who have possibly installed postmarketOS for the first time through the on-device installer or pmbootstrap.
Start the SSH Daemon
If you are running postmarketOS from a pre-built image, the SSH daemon is disabled. Open a terminal on your phone and type the following to start it. Your sudo password is your PIN (
147147 in pre-built images):
$ sudo rc-service sshd start
Note that in SXMO, you can type the minus (
-) character after long-pressing the dot (
Enable the service on every boot:
$ sudo rc-update add sshd
Find the IP of your phone
When connecting your phone via USB Network, then the IP of the phone is
In Phosh, you can find the IP in the "Settings" app, by clicking on the cogwheel next to the Wi-Fi network you are connected too, then "More details".
In any user interface, you can open a terminal and type
ip a to display the Wi-Fi IP.
|Password authentication with a short password is unsafe! Leave it in this state not longer than necessary by following replace password with SSH key below.|
Make sure your phone is on the same Wi-Fi network as your PC, or connect your phone via USB to your PC. Then type:
$ ssh email@example.com
Adjust the IP as necessary. The password is your user's password or PIN,
147147 in pre-built images.
If you cannot login as
user, see the troubleshooting instructions below.
If that doesn't help it either, see USB Network for a more detailed guide and more troubleshooting instructions.
Replace password with SSH key
If the SSH server is enabled in postmarketOS (in the on-device installer, one can decide at install-time), it listens to USB networking, Wi-Fi and cellular network. This provides a big attack surface, so it's highly recommended to install an SSH key and disable password login.
In order to do so, you need to generate a keypair on your client machine.
$ ssh-keygen -t rsa
Now you will be asked a few questions. You can hit 'Enter' to chose the default location for the keys. Set a passphrase you can remember. After the successful generation of the keys, the public key is now located in /home/user/.ssh/id_rsa.pub. The public key needs to be transferred to the phone.
$ ssh-copy-id firstname.lastname@example.org
You will have to enter your phones password. Now make sure everything worked by using ssh with your passphrase:
$ ssh email@example.com
If you were asked for the passphrase and successfully logged in, everything worked as expected. The next step is to only allow logging in via the ssh keys. To do so, edit the file /etc/ssh/sshd_config. If you have nano installed the command is:
$ sudo nano /etc/ssh/sshd_config
In this file, set:
Save and close the file. You might have to restart the ssh server for the changes to take effect.
Enable specific network interfaces only
New installations have a
nftables as firewall configured that limits incoming SSH connections to Wi-Fi and USB. As mentioned in the linked article, you can add your own rules too if you want to lock it down even more.
Login with username "user" fails
In postmarketOS v21.03 and earlier, as well as postmarketOS edge before 2021-06, the on-device installer asked if a dedicated SSH user should be created. While the original idea was to ensure that the SSH user always has a stronger password than just a numeric PIN that would be used for the main user at the time, this made the installation process more complicated and it's more complex to use the dedicated user to access files from / start applications for the regular user. So this was removed in favor of having SSH always disabled and following the (relatively simple) steps to enable and secure it on this wiki page. So if you are currently running a postmarketOS installation that was set up like this, do the following to make it possible to login as the regular user. And then make sure that you copy over your SSH key and disable password authentication again, as described above in this article.
Open the file
/etc/ssh/sshd_config with a text editor, for example
$ sudo vi /etc/ssh/sshd_config
Then enable password authentication for your user by removing the following section from the end of the file (in
vi: arrow keys or
k to navigate up/down, press
d twice to delete a line,
:w to write,
:q to quit).
Match User user PasswordAuthentication no Match all
Save and close the file and restart (or start if not running) the SSH service:
$ sudo rc-service sshd restart