Setting up a SSH server

2022-05-29T01:52:39Z

W1nst0n: Improve /* Dropbear */ section

= Overview =

This article provides a short overview of SSH on Alpine Linux.

Also see [https://en.wikipedia.org/wiki/Secure_Shell Secure Shell (Wikipedia)].

{{Note|This article describes two popular SSH implementations: OpenSSH and Dropbear. Either can be installed using the [[Alpine setup scripts#setup-sshd|setup-sshd]] script, or by following the instructions below.}}

= OpenSSH =

[http://www.openssh.com/ OpenSSH] is a popular SSH implementation for remote encrypted login to a machine. OpenSSH defines ''sshd'' as the daemon, and ''ssh'' as the client program.

The {{Pkg|openssh}} package provides OpenSSH on Alpine Linux.

== Installation ==
Install the {{Pkg|openssh}} package:
{{Cmd|apk add openssh}}

{{Note|To use the ACF-frontend for openssh, install {{Pkg|acf-openssh}} instead (assuming that you have the setup-acf script).}}

Also see [https://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management Alpine Linux package management ].

== Service commands ==
Enable the sshd service so that it starts at boot:
{{Cmd|rc-update add sshd}}

List services to verify sshd is enabled:
{{Cmd|rc-status}}

Start the sshd service immediately and create configuration files:
{{Cmd|/etc/init.d/sshd start}}

{{Note|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}}

Also see [https://wiki.alpinelinux.org/wiki/Alpine_Linux_Init_System Alpine Linux Init System].

== Fine tuning ==

You may wish to change the default configuration. This section describes some of the configuration options as examples, however it is by no means an exhaustive list. See [https://www.openssh.com/manual.html the manual] for full details.

The fine-tuning is done by editing '''/etc/ssh/sshd_config'''. Any line starting with "#" is ignored by ''sshd''.

UseDNS no # By setting this to no, connection speed can increase.
PasswordAuthentication no # Do not allow password authentication.

Other configuration options are shown in '''/etc/ssh/sshd_config'''. The file includes comments that explain many of the options.

== Firewalling and Port Changes ==
By default, sshd will communicate on TCP port '''22'''. 

Sometimes '''22/tcp''' is blocked by a firewall over which you have no control. Changing the '''Port''' option to an unused port number in '''/etc/ssh/sshd_config''' may be useful in this situation. 
Port 443 # Use whichever port number fits your needs

{{Note|Ensure the port you wish to use is not already in use by running '''netstat -lnp''' on the machine running ''sshd''.}}

Restart ''sshd'' after making modifications to the configuration file:
{{Cmd|/etc/init.d/sshd restart}}

{{Note|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}}

= Dropbear =

[https://matt.ucc.asn.au/dropbear/dropbear.html Dropbear] is a lightweight SSH client/server alternative to OpenSSH.

=== server ===
{{Tip|You can use {{Path|~/.ssh/authorized_keys}} in the same way as with OpenSSH}}

{{Pkg|dropbear}} can be install through the [[Alpine setup scripts]], or manually with:
{{Cmd|apk add dropbear}}
Start it:
{{Cmd|rc-service dropbear start}}
Add it to the default runlevel:
{{Cmd|rc-update add dropbear}}

Use the following command to check all available server options:
{{Cmd|dropbear -h}}

The config file is located at <code>/etc/conf.d/dropbear</code>

{{Tip|{{Path|<nowiki>DROPBEAR_OPTS="-w -s"</nowiki>}} will forbid root login and password login}}

=== client ===
{{Pkg|dropbear-dbclient}} contains the SSH client and can be installed manually with:
{{Cmd|apk add dropbear-dbclient}}

In its simplest form it can be used like this:
{{Cmd|dbclient <user>@host.example.com}}
{{Cmd|dbclient host.example.com}}
{{Cmd|dbclient x.x.x.x}} (where x.x.x.x is the IP address of the remote machine).

Use <code>dbclient -h</code> to see all available options.

= See also =
* [[Two Factors Authentication With OpenSSH]]

= Further Reading =

[https://www.openssh.com/portable.html OpenSSH (openssh.com)] 
[https://en.wikipedia.org/wiki/OpenSSH OpenSSH (wikipedia.org)]

[[Category:Server]]
[[Category:Networking]]
[[Category:Security]]

Wi-Fi

2022-05-29T01:32:39Z

W1nst0n: Add iwd section

This page describes how to set up a wireless network connection with WPA encryption.

Choose a wireless daemon between {{Pkg|iwd}} and {{Pkg|wpa_supplicant}}

== Prerequisites ==

Working wireless drivers
{{Note|in most cases installing {{Pkg|linux-firmware}} should get you the required drivers}}

If you are using a '''Broadcom chipset''', see the [[#Broadcom_Wi-Fi_Chipset_Users|Broadcom Wi-Fi section]].)

== iwd ==

[https://wiki.archlinux.org/title/Iwd iwd] (iNet wireless daemon) is a wireless daemon written by Intel and aiming at replacing {{Pkg|wpa_supplicant}}. The core goal of the project is to optimize resource utilization by not depending on any external libraries and instead utilizing features provided by the Linux Kernel to the maximum extent possible.

{{Pkg|iwd}} is supported since [https://alpinelinux.org/posts/Alpine-3.10.0-released.html Alpine Linux 3.10].

To get started, install {{Pkg|iwd}}:

{{Cmd|apk add iwd}}

List your available wifi device(s) (you probably have ''wlan0''):

{{Cmd|iwctl device list}}

If you don't know the SSID of your network you can run a scan and retrieve a list of all the detected networks:

{{Cmd|iwctl station wlan0 scan && iwctl station wlp8s0 get-networks}}

To connect to a network:

{{Cmd|iwctl station wlan0 connect <SSID>}}

 

{{Note|iwd automatically stores network passphrases in the /var/lib/iwd directory and uses them to auto-connect in the future. If you run diskless Alpine, make sure to include this directory to the apkovl and commit:
{{Cmd|lbu add /var/lib/iwd && lbu commit -d}}}}

{{Note|Since version 1.10, iwd supports IPv6, but it is disabled by default. To enable it, add the following to the configuration file:
{{Cat|/etc/iwd/main.conf|<nowiki>[Network]
EnableIPv6=true</nowiki>}}}}

 

Finally, configure {{Pkg|iwd}} and its dependency {{Pkg|dbus}} to start automatically on boot:
{{Cmd|rc-update add iwd boot && rc-update add dbus boot}}

 

Add a entry for the desired interface (e.g. {{Path|wlan0}}):
{{Cat|/etc/network/interfaces|auto wlan0
iface wlan0 inet dhcp}}

{{Note|You could instead use the iwd's built-in network configuration by setting {{Path|<nowiki>EnableNetworkConfiguration=true</nowiki>}} in {{Path|/etc/iwd/main.conf}}}}

 

Manually restart '''networking''':

{{Cmd|rc-service networking restart}}

 

Your wifi interface should now be up and have a dedicated IP adress:
{{Cmd|ip a show wlan0}}

 

Useful link: [https://wiki.archlinux.org/title/Iwd#Enable_built-in_network_configuration Archlinux wiki page] if you need more specific configuration.

== wpa_supplicant ==

To get started install {{Pkg|wpa_supplicant}}

{{Cmd|apk add wpa_supplicant}}

 

To list your available network interfaces:
{{Note|if you don't see any wireless interfaces (e.g. {{Path|wlan0}}), you probably need to load and/or install drivers/firmware.}}

 

{{Cmd|ip link}}
or
{{Cmd|ip a}}

 

Bring up the desired interface:
{{Cmd|ip link set wlan0 up}}

{{Note|If this errors with <code>ioctl 0x8914 failed: No error information</code>, that's <code>busybox ip</code>'s way of saying your wireless radio is rfkill'd. See the [[#Rfkill|Rfkill section]] for information on how to unblock your wireless radio.}}

 

Use this command to add your Wi-Fi network to wpa_supplicant:
{{Cmd|wpa_passphrase 'ExampleWifiSSID' 'ExampleWifiPassword' > /etc/wpa_supplicant/wpa_supplicant.conf}}
''(Access point not broadcasting its SSID requires additional line <code>scan_ssid=1</code> in the file <code>wpa_supplicant.conf</code>)''

{{Note|the Wi-Fi SSID and password are case sensitive and the single quote before and after the SSID and password need to be there}}

 

Start wpa_supplicant in the foreground to make sure the connection succeeds.
{{Cmd|wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf}}

 

If all is well, run it as a daemon in the background by setting the {{Path|-B}} option.
{{Cmd|wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf}}

 

Configure the interface with an IP address.
{{Cmd|udhcpc -i wlan0}}

Sanity check: the interface should have a {{Path|inet}} address.
{{Cmd|ip addr show wlan0}}

 

=== Automatic Configuration on System Boot ===

Add a entry for the desired interface (e.g. {{Path|wlan0}}):
{{Cat|/etc/network/interfaces|auto wlan0
iface wlan0 inet dhcp}}

{{Note|Dont remove or comment out the '''auto lo''' entry}}

Sanity check: Make sure {{Path|/etc/wpa_supplicant/wpa_supplicant.conf}} is the correct configuration for the wireless access point you want to connect to.

Bring the interface down.

{{Cmd|ip link set wlan0 down}}

 

Manually restart (or '''start''') '''networking'''.

{{Cmd|/etc/init.d/networking --quiet restart &}}

 

If all is well (feel free to confirm with the sanity checks),

Configure wpa_supplicant to start automatically on boot:

{{Cmd|# rc-update add wpa_supplicant boot}}

 

Also make sure '''networking''' is set to automatically start on boot:

{{Cmd|# rc-update add networking boot}}

 

'''Optional security precaution:'''

By default {{Pkg|wpa_supplicant}} will store your Wi-Fi password in plain text:

{{Cat|(Example) /etc/wpa_supplicant/wpa_supplicant.conf|<nowiki>network={
ssid="<YourSSIDShouldBeHere>"
#psk="<YourPasswordShouldBeHereInPlainText>"
psk=<RandomLettersAndNumbersShouldBeHere>
}</nowiki>}}

this is not necessary and {{Pkg|wpa_supplicant}} should funtion just fine without it, if you dont want your stored password in plain text just delete the line with <code>#psk="<YourPasswordShouldBeHereInPlainText>"</code> on it.

 

== Launching udhcpc through wpa_cli actions ==

{{Todo|Figure out if theses two sections are different or connected to one another}}

With the above configuration, udhcpc will only run once at boot.
If the Wifi isn't available then, or the network changes in between, it needs to be notified.
This is done through the wpa_cli action script in /etc/wpa_supplicant/wpa_cli.sh

== Automatic Reconnection when WIFI signal is lost ==
To enable automatic reconnection when wifi signal is lost add these to config:

{{Cat|/etc/wpa_supplicant/wpa_supplicant.conf|<nowiki>ap_scan=1
autoscan=periodic:10
disable_scan_offload=1
</nowiki>
}}

{{Cmd|rc-update add wpa_cli boot}}

 

== Troubleshooting ==

==== Broadcom Wi-Fi Chipset Users ====

The Broadcom chipset is quite popular among older computers. You will need to compile the firmware manually for this chipset as it is not included.

You can check if you have a Broadcom chipset by using dmesg:

{{Cmd|dmesg {{!}} grep Broadcom}}

First install the SDK and Git:
{{Cmd|apk add alpine-sdk git}}

Then git clone aports from git.alpinelinux.org.

{{Cmd|git clone git://git.alpinelinux.org/aports}}

Change your directory to '''aports/non-free/b43-firmware''', then build it.

{{Tip|You can't be root and must be a user of the group abuild (use groupadd f.e. '''addgroup $(whoami) abuild''')}}
{{Tip|If this is your first time building a package you will need to generate a key for use in signing packages (use '''abuild-keygen -a -i''')}}

{{Cmd|abuild -r}}

Install the generated packge file (it will be in ~/packages/) - make sure to pass '''--allow-untrusted'''

{{Cmd|apk add --allow-untrusted ~/packages/...pkg}}

Now we need fwcutter, which is executed from the firmware package:

{{Cmd|apk add b43-fwcutter b43-firmware}}

Now you need to use modprobe so the device will show up:

{{Cmd|modprobe b43}}

To automate this on startup add it to /etc/modules:

{{Cmd|echo b43 >> /etc/modules}}

Now continue with the normal instructions.

 

==== Rfkill ====

''See Also: [https://wiki.archlinux.org/title/Network_configuration/Wireless#Rfkill_caveat Network configuration/Wireless#Rfkill caveat - ArchLinux Wiki]''

 

Many laptops have a hardware button (or switch) to turn off wireless card, however, the card can also be blocked by kernel. This can be changed using rfkill. To show the current of your Wi-Fi:

{{Cat|(example) $ rfkill list|0: phy0: wlan
Soft blocked: no
Hard blocked: no}}

 

If the card is hard-blocked, use the hardware button or switch to unblock it. If the card is not hard-blocked but soft-blocked, use the following command:

{{Cmd|# rfkill unblock wifi}}

 

== See Also ==

* [[Installation]]
* [[Post installation]]
* [[Alpine setup scripts]]

[[Category:Networking]]

Alpine Linux - User contributions [en]

Setting up a SSH server

Wi-Fi