Editing SSH

'''OpenSSH''' is a suite of programs that make remote access to servers secure, encrypted, and simple. An SSH server runs on the remote machine, and an SSH client runs on the accessor.

* '''Secure Shell''' <code>ssh</code> - Client for Shell access to a remote machine.
* '''Secure Shell Server''' <code>sshd</code> - Server for remote Shell access to the current machine.
* '''sftp''' - An FTP-style server to copy files between computers.

== Installation ==

If you're using Raspbian on the RPi, the SSH server is automatically set up. Otherwise, you must install it.

Make sure [https://help.ubuntu.com/community/UFW to install <code>ufw</code>] as the primary firewall and allow it with this command:

<pre>sudo ufw allow ssh</pre>
Next, install openssh:

<pre>sudo apt-get install openssh-server </pre>
Configure SSH by editing the SSH config file:

<pre>sudo nano /etc/ssh/sshd_config (use CTRL + x to save and exit)</pre>
* [https://help.ubuntu.com/community/SSH/OpenSSH/Configuring Ubuntu - SSH/OpenSSH/Configuring]

== SFTP ==

The SSH server provides a secure, easy-to-use alternative to FTP transfer. Just install SSH, and the server works out of the box, through the SSH port.

Then, on [https://it.unh.edu/sftp/filezilla.html a FTP Client such as Filezilla], just set SFTP and connect, and you're done.

Of course, since encrypted data is sent a bit slower, good ol' FTP connection might be worth the trouble for unclassified files. Or you can try [https://barracudadrive.com/RaspberryPi.lsp Barracuda Drive WebDAV.]

* [http://www.raspberrypi.org/documentation/remote-access/ssh/sftp.md Raspberry Pi Documentation - SFTP]

== SSH Tunneling ==

SSH Tunneling makes it possible to use your home network as a secure proxy server.

This way, you can use it to bypass network restrictions (such as anti-torrent policies), or access the internet in a safe, encrypted manner (to keep your browsing packets secret at Starbucks unsecured WiFi).

On the SSH Server, edit the <code>/etc/ssh/sshd_config</code> and add this line at the end to enable SSH Tunneling:

<pre>AllowTcpForwarding  yes</pre>
Run this command in a Linux terminal to start SSH Tunneling (add your own username and server address):

<pre>ssh -D 9999 YourUsername@YourServerOrIP.domain </pre>
Login to the SSH session, and a terminal session will begin. SSH Tunneling has also been enabled.

To use SSH Tunneling, point your browser's SOCKS proxy settings at <code>127.0.0.1:9999</code>. On Firefox, for example:

[[File:http://i.kinja-img.com/gawker-media/image/upload/s--_iCqi1I---/c_fit,fl_progressive,q_80,w_320/18s04c2psx9lkpng.png|frame|none]]

To tunnel other programs (torrent clients, Skype, etc.) you can also set their SOCKS proxy settings to <code>127.0.0.1:9999</code>.

== X11 Forwarding ==

SSH has a little known feature that allows it to transmit a graphical X11 session over SSH as well, so you can run graphical applications (only if you're using Linux or Mac).

First, on your SSH server, edit the <code>/etc/ssh/sshd_config</code> file, and uncomment the following line:

<pre>   X11Forwarding Yes</pre>
Now, as a client session, add the <code>-X</code> argument to the SSH command to access the server with X11 privileges.

<pre>   ssh -X user@example.org</pre>
Check that the X11 transmission is actually working by looking at the <code>$DISPLAY</code> variable

<pre>   echo $DISPLAY</pre>
You should receive output stating something like <code>localhost:10.0</code>. If not, check your server's configuration.

You can now send a command to run any X11 application and it will appear on your computer. Such as <code>xclock</code>. Though it might not be feasible to transmit gigantic applications, such as Firefox, so try lighter browsers such as Midori.

I usually do SSH X11 Forwarding to access the local network's router administration console, which is not accessible to the public internet. However, this can be horrifically slow if you are far away from the router, so SSH Tunneling is strongly recommended instead.

* [http://itg.chem.indiana.edu/inc/wiki/software/openssh/200.html ITG Indiana - Configuring OpenSSH with X11 Support]

== Reverse SSH Tunneling ==

If your server is behind a NAT or firewall and you are unable to port forward it (such as in college, or anywhere where there is no administrative access to the router), you can build a reverse SSH tunnel to administer the server instead. (Of course, make sure that your admin is alright with it...)

To keep the reverse SSH tunnel alive on the go, you can use [http://superuser.com/a/37768 Autossh], [http://www.clingmarks.com/setup-a-unbreakable-ssh-tunnel/21 steps here.]

* [https://www.marksanborn.net/howto/bypass-firewall-and-nat-with-reverse-ssh-tunnel/ Mark Sanborn - Bypass Firewall and NAT with Reverse SSH Tunnel]
* [http://askubuntu.com/questions/15716/ssh-without-opening-the-ports AskUbuntu - SSH without opening the ports]

== Port Knocking ==

Leaving an SSH server out in the open can be problematic, One method sysadmins use to obscure the SSH port is to change it to something that isn't 22. But security through obscurity is no security at all.

A better solution is to require the user to provide a secret &quot;knock&quot;: meaning, a procedure, such as sending packets to certain ports within 4 seconds. This way, an ordinary SSH client trying to ping port 22 would not even know that the service existed there.

The major downside is that SSH clients that do not support this procedure, such as mobile clients and PuTTY, will not work anymore.

https://www.marksanborn.net/linux/add-port-knocking-to-ssh-for-extra-security/

[[Category:Home Servers]]