From postmarketOS
Jump to: navigation, search

This article provides an overview of how to use the SSH server after postmarketOS was installed. It is aimed at beginners, who have possibly installed postmarketOS for the first time through the on-device installer or pmbootstrap.

First login

Connect your phone via USB to your PC, then type:

$ ssh username@

Replace username with the username you chose in the installer. If your phone is in the same network as your PC (e.g. via Wi-Fi), you can replace the IP with the Wi-Fi IP and it should work as well.

If you have trouble connecting, see USB Network for a more detailed guide and for troubleshooting instructions.


Replace password with SSH key

If the SSH server is enabled in postmarketOS (in the on-device installer, one can decide at install-time), it listens to USB networking, Wi-Fi and cellular network. This provides a big attack surface, so it's highly recommended to install an SSH key and disable password login.

In order to do so, you need to generate a keypair on your client machine.

$ ssh-keygen -t rsa

Now you will be asked a few questions. You can hit 'Enter' to chose the default location for the keys. Set a passphrase you can remember. After the successful generation of the keys, the public key is now located in /home/user/.ssh/ The public key needs to be transferred to the phone.

$ ssh-copy-id username@

You will have to enter your phones password. Now make sure everything worked by using ssh with your passphrase:

$ ssh username@

If you were asked for the passphrase and successfully logged in, everything worked as expected. The next step is to only allow logging in via the ssh keys. To do so, edit the file /etc/ssh/sshd_config. If you have nano installed the command is:

$ sudo nano /etc/ssh/sshd_config

In this file, set:

PasswordAuthentication no

Save and close the file. You might have to restart the ssh server for the changes to take effect.

Enable specific network interfaces only

You might want to disable SSH access over cellular network, Wi-Fi and/or USB.

(TODO: add instructions here, please help with filling in)

Cool things to do with SSH