Setting up a SSH server: Difference between revisions
(Improve →Dropbear: section) |
(1. →Further Reading: Added: Remote Desktop Server; 2. Style/grammar amendments, including correcting header level styling.) |
||
| (6 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
= Overview = | == Overview == | ||
This article provides a short overview of SSH on Alpine Linux. | This article provides a short overview of SSH on Alpine Linux. | ||
| Line 7: | Line 7: | ||
{{Note|This article describes two popular SSH implementations: OpenSSH and Dropbear. Either can be installed using the [[Alpine setup scripts#setup-sshd|setup-sshd]] script, or by following the instructions below.}} | {{Note|This article describes two popular SSH implementations: OpenSSH and Dropbear. Either can be installed using the [[Alpine setup scripts#setup-sshd|setup-sshd]] script, or by following the instructions below.}} | ||
= OpenSSH = | == OpenSSH == | ||
[ | [https://www.openssh.com/ OpenSSH] is a popular SSH implementation for remote encrypted login to a machine. OpenSSH defines ''sshd'' as the daemon, and ''ssh'' as the client program. | ||
The {{Pkg|openssh}} package provides OpenSSH on Alpine Linux. | The {{Pkg|openssh}} package provides OpenSSH on Alpine Linux. | ||
== Installation == | === Installation === | ||
Install the {{Pkg|openssh}} package: | Install the {{Pkg|openssh}} package: | ||
{{Cmd|apk add openssh}} | {{Cmd|apk add openssh}} | ||
| Line 19: | Line 19: | ||
{{Note|To use the ACF-frontend for openssh, install {{Pkg|acf-openssh}} instead (assuming that you have the setup-acf script).}} | {{Note|To use the ACF-frontend for openssh, install {{Pkg|acf-openssh}} instead (assuming that you have the setup-acf script).}} | ||
Also see [ | Also see [[Alpine_Package_Keeper|Alpine Linux package management]]. | ||
== Service commands == | === Service commands === | ||
Enable the sshd service so that it starts at boot: | Enable the sshd service so that it starts at boot: | ||
{{Cmd|rc-update add sshd}} | {{Cmd|rc-update add sshd}} | ||
| Line 29: | Line 29: | ||
Start the sshd service immediately and create configuration files: | Start the sshd service immediately and create configuration files: | ||
{{Cmd| | {{Cmd|rc-service sshd start}} | ||
{{Note|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}} | {{Note|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}} | ||
Also see [ | Also see [[OpenRC|Alpine Linux Init System]]. | ||
== Fine tuning == | === Fine tuning === | ||
You may wish to change the default configuration. This section describes some of the configuration options as examples, | You may wish to change the default configuration. This section describes some of the configuration options as examples. However, this is by no means an exhaustive list. See [https://www.openssh.com/manual.html the manual] for full details. | ||
The fine | The fine tuning is done by editing {{Path|/etc/ssh/sshd_config}}. Any line starting with "#" is ignored by ''sshd''. | ||
UseDNS no # By setting this to no, connection speed can increase. | UseDNS no # By setting this to no, connection speed can increase. | ||
PasswordAuthentication no # Do not allow password authentication. | PasswordAuthentication no # Do not allow password authentication. | ||
Other configuration options are shown in | Other configuration options are shown in {{Path|etc/ssh/sshd_config}}. The file includes comments that explain many of the options. | ||
== Firewalling and Port Changes == | === Firewalling and Port Changes === | ||
By default, sshd will communicate on TCP port '''22'''.<BR> | By default, sshd will communicate on TCP port '''22'''.<BR> | ||
Sometimes '''22/tcp''' is blocked by a firewall over which you have no control. Changing the '''Port''' option to an unused port number in | Sometimes '''22/tcp''' is blocked by a firewall over which you have no control. Changing the '''Port''' option to an unused port number in {{Path|/etc/ssh/sshd_config}} may be useful in this situation.<BR> | ||
Port 443 # Use whichever port number fits your needs | Port 443 # Use whichever port number fits your needs | ||
| Line 55: | Line 55: | ||
Restart ''sshd'' after making modifications to the configuration file: | Restart ''sshd'' after making modifications to the configuration file: | ||
{{Cmd| | {{Cmd|rc-service sshd restart}} | ||
{{Note|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}} | {{Note|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}} | ||
= Dropbear = | == Dropbear == | ||
[https://matt.ucc.asn.au/dropbear/dropbear.html Dropbear] is a lightweight SSH client/server alternative to OpenSSH. | [https://matt.ucc.asn.au/dropbear/dropbear.html Dropbear] is a lightweight SSH client/server alternative to OpenSSH. | ||
=== | === Server === | ||
{{Tip|You can use {{Path|~/.ssh/authorized_keys}} in the same way as with OpenSSH}} | {{Tip|You can use {{Path|~/.ssh/authorized_keys}} in the same way as with OpenSSH.}} | ||
{{Pkg|dropbear}} can be install through the [[Alpine setup scripts]], or manually with: | {{Pkg|dropbear}} can be install through the [[Alpine setup scripts]], or manually with: | ||
{{Cmd|apk add dropbear}} | {{Cmd|apk add dropbear}} | ||
Start it: | Start it: | ||
{{Cmd|rc-service dropbear start}} | {{Cmd|rc-service dropbear start}} | ||
| Line 76: | Line 77: | ||
{{Cmd|dropbear -h}} | {{Cmd|dropbear -h}} | ||
The config file is located at | The config file is located at {{Path|/etc/conf.d/dropbear}} | ||
{{Tip | {{Tip|<code>DROPBEAR_OPTS{{=}}"-w -s"</code> will forbid root login and password login}} | ||
=== | === Client === | ||
{{Pkg|dropbear-dbclient}} contains the SSH client and can be installed manually with: | {{Pkg|dropbear-dbclient}} contains the SSH client and can be installed manually with: | ||
{{Cmd|apk add dropbear-dbclient}} | {{Cmd|apk add dropbear-dbclient}} | ||
In its simplest form it can be used like this: | In its simplest form, it can be used like this: | ||
{{Cmd|dbclient <user>@host.example.com}} | {{Cmd|dbclient <user>@host.example.com}} | ||
{{Cmd|dbclient host.example.com}} | {{Cmd|dbclient host.example.com}} | ||
| Line 91: | Line 92: | ||
Use <code>dbclient -h</code> to see all available options. | Use <code>dbclient -h</code> to see all available options. | ||
= See also = | == See also == | ||
* [[Two | * [[HOWTO OpenSSH 2FA with password and Google Authenticator|Two Factor Authentication With OpenSSH]] | ||
= Further Reading = | == Further Reading == | ||
[https://www.openssh.com/portable.html OpenSSH (openssh.com)]<BR> | * [https://www.openssh.com/portable.html OpenSSH (openssh.com)]<BR> | ||
[https://en.wikipedia.org/wiki/OpenSSH OpenSSH (wikipedia.org)] | * [https://en.wikipedia.org/wiki/OpenSSH OpenSSH (wikipedia.org)] | ||
* [[Remote Desktop Server]] | |||
[[Category:Server]] | [[Category:Server]] | ||
[[Category:Networking]] | [[Category:Networking]] | ||
[[Category:Security]] | [[Category:Security]] | ||
Latest revision as of 20:39, 10 January 2026
Overview
This article provides a short overview of SSH on Alpine Linux.
Also see Secure Shell (Wikipedia).
Note: This article describes two popular SSH implementations: OpenSSH and Dropbear. Either can be installed using the setup-sshd script, or by following the instructions below.
OpenSSH
OpenSSH is a popular SSH implementation for remote encrypted login to a machine. OpenSSH defines sshd as the daemon, and ssh as the client program.
The openssh package provides OpenSSH on Alpine Linux.
Installation
Install the openssh package:
apk add openssh
Note: To use the ACF-frontend for openssh, install acf-openssh instead (assuming that you have the setup-acf script).
Also see Alpine Linux package management.
Service commands
Enable the sshd service so that it starts at boot:
rc-update add sshd
List services to verify sshd is enabled:
rc-status
Start the sshd service immediately and create configuration files:
rc-service sshd start
Note: If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See Alpine local backup.
Also see Alpine Linux Init System.
Fine tuning
You may wish to change the default configuration. This section describes some of the configuration options as examples. However, this is by no means an exhaustive list. See the manual for full details.
The fine tuning is done by editing /etc/ssh/sshd_config. Any line starting with "#" is ignored by sshd.
UseDNS no # By setting this to no, connection speed can increase. PasswordAuthentication no # Do not allow password authentication.
Other configuration options are shown in etc/ssh/sshd_config. The file includes comments that explain many of the options.
Firewalling and Port Changes
By default, sshd will communicate on TCP port 22.
Sometimes 22/tcp is blocked by a firewall over which you have no control. Changing the Port option to an unused port number in /etc/ssh/sshd_config may be useful in this situation.
Port 443 # Use whichever port number fits your needs
Note: Ensure the port you wish to use is not already in use by running netstat -lnp on the machine running sshd.
Restart sshd after making modifications to the configuration file:
rc-service sshd restart
Note: If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See Alpine local backup.
Dropbear
Dropbear is a lightweight SSH client/server alternative to OpenSSH.
Server
Tip: You can use ~/.ssh/authorized_keys in the same way as with OpenSSH.
dropbear can be install through the Alpine setup scripts, or manually with:
apk add dropbear
Start it:
rc-service dropbear start
Add it to the default runlevel:
rc-update add dropbear
Use the following command to check all available server options:
dropbear -h
The config file is located at /etc/conf.d/dropbear
Tip:
DROPBEAR_OPTS="-w -s" will forbid root login and password loginClient
dropbear-dbclient contains the SSH client and can be installed manually with:
apk add dropbear-dbclient
In its simplest form, it can be used like this:
dbclient <user>@host.example.com
dbclient host.example.com
dbclient x.x.x.x
(where x.x.x.x is the IP address of the remote machine).
Use dbclient -h to see all available options.