This article provides an overview of how to use the SSH server after postmarketOS was installed. It is aimed at beginners, who have possibly installed postmarketOS for the first time through the on-device installer or pmbootstrap.
- 1 Start the SSH Daemon
- 2 Find the IP of your phone
- 3 First login
- 4 Hardening
- 5 Create backup of your home directory
- 6 Automatically retrieve phone's IP to SSH in to
- 7 Cool things to do with SSH
Start the SSH Daemon
If you are running postmarketOS from a pre-built image, the SSH daemon is disabled. Open a terminal on your phone and type the following to start it. Your sudo password is your PIN (
147147 in pre-built images):
$ sudo rc-service sshd start
Enable the service on every boot:
$ sudo rc-update add sshd
Find the IP of your phone
When connecting your phone via USB Network, then the IP of the phone is
In Phosh, you can find the IP in the "Settings" app, by clicking on the cogwheel next to the Wi-Fi network you are connected too, then "More details".
In any user interface, you can open a terminal and type
ip a to display the Wi-Fi IP.
Make sure your phone is on the same Wi-Fi network as your PC, or connect your phone via USB to your PC. Then type:
$ ssh firstname.lastname@example.org
username with the username you chose in the installer and adjust the IP.
If you have trouble connecting, see USB Network for a more detailed guide and for troubleshooting instructions.
Enabling SSH if it was disabled in the installer
Open the file
/etc/ssh/sshd_config with a text editor, for example
$ sudo vi /etc/ssh/sshd_config
Then enable password authentication for your user by removing the following section from the end of the file (in
vi: arrow keys or
k to navigate up/down, press
d twice to delete a line,
:w to write,
:q to quit).
Match User user PasswordAuthentication no Match all
Save and close the file and start the SSH service:
$ sudo rc-service sshd start $ sudo rc-update add sshd
Replace password with SSH key
If the SSH server is enabled in postmarketOS (in the on-device installer, one can decide at install-time), it listens to USB networking, Wi-Fi and cellular network. This provides a big attack surface, so it's highly recommended to install an SSH key and disable password login.
In order to do so, you need to generate a keypair on your client machine.
$ ssh-keygen -t rsa
Now you will be asked a few questions. You can hit 'Enter' to chose the default location for the keys. Set a passphrase you can remember. After the successful generation of the keys, the public key is now located in /home/user/.ssh/id_rsa.pub. The public key needs to be transferred to the phone.
$ ssh-copy-id email@example.com
You will have to enter your phones password. Now make sure everything worked by using ssh with your passphrase:
$ ssh firstname.lastname@example.org
If you were asked for the passphrase and successfully logged in, everything worked as expected. The next step is to only allow logging in via the ssh keys. To do so, edit the file /etc/ssh/sshd_config. If you have nano installed the command is:
$ sudo nano /etc/ssh/sshd_config
In this file, set:
Save and close the file. You might have to restart the ssh server for the changes to take effect.
Enable specific network interfaces only
You might want to disable SSH access over cellular network, Wi-Fi and/or USB.
(TODO: add instructions here, please help with filling in)
Create backup of your home directory
See instructions at Upgrade release.
Automatically retrieve phone's IP to SSH in to
WARN: Not battle-tested, worst case it doesn't magically work. ifdata returns only the first address (usually the most local, ipv4 first).
On the phone:
$ sudo apk add syncthing moreutils # Get syncthing, ifdata (for lazy asses, lightweight asses might want to use something else) $ sudo rc-update add syncthing # Start on startup $ sudo rc-service syncthing start # ..or now Setup syncthing, if using GUI, I'd recommend changing listen to 0.0.0.0:8384, but use https and set a pass! $ sudo -u syncthing crontab -e * * * * * echo $(ifdata -pa wlan0) > /var/lib/syncthing/wm/wlan0-ip.pinenode # wlan0 being the interface, wm is a synced directory, every minute might be too often. :wq $ sudo rc-update add crond $ sudo rc-service crond start
On the ssh-er
Let's humbly assume we have syncthing set up on this machine. Add to .whatever_aliases, .whateverrc .profile, or whatever: $ alias pine="mosh $(cat ~/c/wm/wlan0-ip.pinenode)" # There's nothing really to explain. I use byobu, but I definitely recommend it, tmux, screen, or something else! mosh is just self-reconnecting shell (won't work if the target changes it's address).