Dropbear Ssh

2OpenSSH

This article provides a short overview of SSH on Alpine Linux.

Also see Secure Shell (Wikipedia).

Back in 2016, the BlackEnergy cybercriminals group that targeted the Ukrainian electric utilities and media, used a backdoored SSH server called Dropbear. According to the ESET researchers, the attackers deployed a variant of this software on compromised machines that had been pre-configured to accept a hard-coded password and key for SSH. DESCRIPTION dropbearkey generates a RSA, DSS, or ECDSA format SSH private key, and saves it to a file for the use with the Dropbear client or server. Note that some SSH implementations use the term 'DSA' rather than 'DSS', they mean the same thing.

Note: This article describes two popular SSH implementations: OpenSSH and Dropbear. Either can be installed using the setup-sshd script, or by following the below instructions.

OpenSSH is a popular SSH implementation for remote encrypted login to a machine. OpenSSH defines sshd as the daemon, and ssh as the client program.

The openssh package provides OpenSSH on Alpine Linux.

Installation

Install the openssh package:

apk add openssh

Note: To use the ACF-frontend for openssh, install acf-openssh instead (assuming that you have the setup-acf script).

Also see Alpine Linux package management .

Service commands

Enable the sshd service so that it starts at boot:

rc-update add sshd

List services to verify sshd is enabled:

rc-status

Start the sshd service immediately and create configuration files:

/etc/init.d/sshd start

Note: If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See Alpine local backup.

Also see Alpine Linux Init System.

Fine tuning

Dropbear Ssh Config

You may wish to change the default configuration. This section describes some of the configuration options as examples, however it is by no means an exhaustive list. See the manual for full details.

The fine-tuning is done by editing /etc/ssh/sshd_config. Any line starting with '#' will be ignored by sshd.

Other configuration options are shown in /etc/ssh/sshd_config. The file includes comments that explain many of the options.

Firewalling and Port Changes

By default, sshd will communicate on TCP port 22.

Sometimes 22/tcp is blocked by a firewall over which you have no control. Changing the Port option to an unused port number in /etc/ssh/sshd_config may be useful in this situation.

Note: Ensure the port you wish to use is not already in use by running netstat -lnp on the machine running sshd.

Restart sshd after making modifications to the configuration file:

/etc/init.d/sshd restart

Note: If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See Alpine local backup.

Dropbear is another open source SSH implementation.Install dropbear through the Alpine setup scripts, or manually with:

apk add dropbear

Start it:

rc-service dropbear start

Add it to the default runlevel:

Dropbear Ssh Client

rc-update add dropbear

Use the following command to check all available server options:

dropbear -h

The config file is located at /etc/conf.d/dropbear

dropbear also includes an SSH client which in its simplest form can be used like this:

dbclient host.example.com

dbclient x.x.x.x

(where x.x.x.x is the IP address of the remote machine).

Use dbclient -h to see all available options.

OpenSSH (openssh.com)
OpenSSH (wikipedia.org)

Retrieved from 'http://wiki.alpinelinux.org/w/index.php?title=Setting_up_a_ssh-server&oldid=13842'