Difference between revisions of "Replace ssh with Qnapware OpenSSH"

From QNAPedia
Jump to navigation Jump to search
(Fleshing out instructions a bit, adding an init script (based on login.sh), and describing how to get authorized_keys support for normal users)
Line 3: Line 3:
 
Recommend changing QNAP system sshd to use any port other than 22.  (Like 2222 or something)
 
Recommend changing QNAP system sshd to use any port other than 22.  (Like 2222 or something)
  
−
#Install Entware for opkg support (Note that this replaces the older non-supported as of Dec-2014 Optware)
+
#Install QNAPware for opkg support (Note: This replaces both Entware and Optware)
 
#opkg install openssh-server
 
#opkg install openssh-server
−
#ssh-keygen -t rsa -f ssh_host_rsa_key
+
#echo 'export PATH=/Apps/opt/bin:/Apps/opt/sbin:$PATH' >> /etc/profile # Optional, but recommended
−
#ssh-keygen -t dsa -f ssh_host_dsa_key
+
#ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_rsa_key -N ''-t rsa''
−
#Add sshd user to /etc/passwd and sshd group to /etc/group
+
#ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_dsa_key -N ''-t dsa''
−
#*echo sshd:x:74:>>/etc/group
+
#ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_ecdsa_key -N ''-t ecdsa''
−
#*echo sshd:x:74:74:Priviledge-separated SSH:/var/empty/sshd:/sbin/nologin>>/etc/passwd
+
#ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_ed25519_key -N ''-t ed25519''
−
#..
+
#useradd --system --no-create-home sshd
 +
#ln -s ../init.d/openssh.sh /etc/init.d/S86openssh
 +
#ln -s ../init.d/openssh.sh /etc/rcK.d/K34openssh
 +
#Create /etc/init.d/openssh.sh
 +
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><nowiki>#!/bin/sh
 +
 
 +
SSH=/Apps/opt/sbin/opensshd
 +
SSHD_CONF=/Apps/opt/etc/ssh/sshd_config
 +
 
 +
/sbin/test -f $SSHD || exit 0
 +
 
 +
[ -f "/bin/cmp" ] || ln -sf /bin/busybox /bin/cmp
 +
 
 +
DEFAULT_SSH_PORT=`/sbin/getcfg LOGIN "SSH Port" -d 22`
 +
SSH_PORT=22
 +
SSHKEY_CONFIG_DIR=/etc/config/ssh
 +
case "$1" in
 +
    start)
 +
        /bin/chmod 0640 /etc/config/shadow* /etc/default_config/shadow
 +
        if [ `/sbin/getcfg LOGIN "SSH Enable" -u -d TRUE` != FALSE ]; then
 +
                echo -n "Starting OpenSSH (opensshd) service: "
 +
                /sbin/daemon_mgr opensshd start "$SSH -f ${SSHD_CONF} -p $SSH_PORT"
 +
                echo "OK"
 +
                touch /var/lock/subsys/opensshd
 +
        fi
 +
 
 +
        ;;
 +
    stop)
 +
        echo -n "Shutting down OpenSSH (opensshd) service: "
 +
        /sbin/daemon_mgr opensshd stop $SSH
 +
        /usr/bin/killall opensshd 2>/dev/null
 +
        rm -f /var/lock/subsys/opensshd
 +
        echo "OK"
 +
        ;;
 +
 
 +
    restart)
 +
        $0 stop
 +
        $0 start
 +
        ;;     
 +
    *)
 +
        echo "Usage: /etc/init.d/openssh.sh {start|stop|restart}"
 +
        exit 1
 +
esac
 +
 
 +
exit 0
 +
</nowiki>
 +
</div>
 +
Optionally, if you'd like users other than admin to log in with authorized_keys:
 +
 
 +
#Edit /Apps/opt/etc/ssh/sshd_config, set&nbsp;AuthorizedKeysFile to /opt/home/%u/.ssh/authorized_keys
 +
#mkdir -p /opt/home/someuser/.ssh
 +
#<span style="line-height: 20.8px;">mkdir -p /opt/home -m 755</span>
 +
 
 +
<span style="line-height: 20.8px;">Run these for every user you want to be &nbsp;(replace someuser with your actual username):</span>
 +
 
 +
#mkdir -m 700&nbsp;-p /opt/home/someuser/.ssh
 +
#touch&nbsp;<span style="line-height: 20.8px;">/opt/home/someuser/.ssh/authorized_keys</span>
 +
#<span style="line-height: 20.8px;">chmod 600&nbsp;/opt/home/someuser/.ssh/authorized_keys</span>
 +
 
 +
​
 
[[Category:SSH]]
 
[[Category:SSH]]

Revision as of 23:26, 31 December 2015

Note: Work in progress.

Recommend changing QNAP system sshd to use any port other than 22.  (Like 2222 or something)

  1. Install QNAPware for opkg support (Note: This replaces both Entware and Optware)
  2. opkg install openssh-server
  3. echo 'export PATH=/Apps/opt/bin:/Apps/opt/sbin:$PATH' >> /etc/profile # Optional, but recommended
  4. ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_rsa_key -N -t rsa
  5. ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_dsa_key -N -t dsa
  6. ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_ecdsa_key -N -t ecdsa
  7. ssh-keygen -f /Apps/opt/etc/ssh/ssh_host_ed25519_key -N -t ed25519
  8. useradd --system --no-create-home sshd
  9. ln -s ../init.d/openssh.sh /etc/init.d/S86openssh
  10. ln -s ../init.d/openssh.sh /etc/rcK.d/K34openssh
  11. Create /etc/init.d/openssh.sh
#!/bin/sh SSH=/Apps/opt/sbin/opensshd SSHD_CONF=/Apps/opt/etc/ssh/sshd_config /sbin/test -f $SSHD || exit 0 [ -f "/bin/cmp" ] || ln -sf /bin/busybox /bin/cmp DEFAULT_SSH_PORT=`/sbin/getcfg LOGIN "SSH Port" -d 22` SSH_PORT=22 SSHKEY_CONFIG_DIR=/etc/config/ssh case "$1" in start) /bin/chmod 0640 /etc/config/shadow* /etc/default_config/shadow if [ `/sbin/getcfg LOGIN "SSH Enable" -u -d TRUE` != FALSE ]; then echo -n "Starting OpenSSH (opensshd) service: " /sbin/daemon_mgr opensshd start "$SSH -f ${SSHD_CONF} -p $SSH_PORT" echo "OK" touch /var/lock/subsys/opensshd fi ;; stop) echo -n "Shutting down OpenSSH (opensshd) service: " /sbin/daemon_mgr opensshd stop $SSH /usr/bin/killall opensshd 2>/dev/null rm -f /var/lock/subsys/opensshd echo "OK" ;; restart) $0 stop $0 start ;; *) echo "Usage: /etc/init.d/openssh.sh {start|stop|restart}" exit 1 esac exit 0

Optionally, if you'd like users other than admin to log in with authorized_keys:

  1. Edit /Apps/opt/etc/ssh/sshd_config, set AuthorizedKeysFile to /opt/home/%u/.ssh/authorized_keys
  2. mkdir -p /opt/home/someuser/.ssh
  3. mkdir -p /opt/home -m 755

Run these for every user you want to be  (replace someuser with your actual username):

  1. mkdir -m 700 -p /opt/home/someuser/.ssh
  2. touch /opt/home/someuser/.ssh/authorized_keys
  3. chmod 600 /opt/home/someuser/.ssh/authorized_keys

​

Retrieved from "https://wiki.qnap.com/mediawiki/index.php?title=Replace_ssh_with_Qnapware_OpenSSH&oldid=1152"