External SSH

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 22:03, 3 July 2006 (edit)
82.240.59.140 (Talk)
(How to set up SSH access from internet)
← Previous diff
Revision as of 02:58, 29 August 2006 (edit) (undo)
AlReece45 (Talk | contribs)
(Tidy up)
Next diff →
Line 1: Line 1:
-=How to set up SSH access from internet=+= Setup SSH access from Internet =
-To make it possible to access your router from internet by SSH follow these steps:+== DD-WRT v23 SP1 or later ==
-00:14, 1 Jul 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]+=== Ensure SSH Enabled ===
-SSH Web administration has been highly simplified and streamlined in V23SP1; no firewall configuration or scripting is necessary, everything is available through the UI.+# Goto the ''Administration'' tab and the ''Services'' sub-tab on the [[Web_Interface]]
 +# Enable "SSHd" is under the section titled "Secure Shell"
 +# Choose an appropriate port (The default is 22, but is recommended you change to a non-standard port above 1024 because of security)
 +# Apply Settings if needed
-*First make sure the SSH daemon gets started. Goto Adminstration->Services and look for the section titled "Secure Shell", and check to see if "Sshd" is enabled.+''REFERENCES:'' [[Telnet/SSH_and_the_Command_Line#SSH]] or Sections 1.1 and 1.2 of [http://hetos.de/sshtut.html]
-**Refer to http://www.dd-wrt.com/wiki/index.php?title=Telnet/SSH_and_the_Command_Line#SSH or Sections 1.1 and 1.2 of http://hetos.de/sshtut.html+
-*Now we will enable remote access to the ssh daemon. Goto Administration->Management and look for the section titled "Remote Access"+
-**Select "Enable" for the "SSH Management" option in this section+
-**Choose an appropriate port (default port is 22)+
-**Recommend also to change the SSHD port to something non-standard above 1024. The reason for this is, there are MANY brute-force attack tools out there that scan ranges of IP looking on port 22. If they see a response they do a brute-force attempt with a list of passwords. If your password is "admin" you are likely to be in trouble. Easy way to avoid being on their radar is CHANGE THIS DEFAULT PORT. +
-**Scroll to the bottom of this page, and click "Save Settings"+
-*To log into your router from a windows machine you could use Putty (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html). You will have to enter the external ip of your router or the DynDNS name to login from Internet. If you have changed the port on which sshd runs, you will have to fill in that port number.+
 +=== Enable Remote Access ===
-The following instructions apply to DD-WRT V23 or earlier.+# Goto the ''Administration'' tab and the ''Management'' sub-tab on the [[Web_Interface]]
 +# Enable "SSH Management" under the section titled "Remote Access"
 +# Apply Settings
-00:14, 1 Jul 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]+=== Disabling Remote Access ===
 +# Goto the ''Administration'' tab and the ''Management'' sub-tab on the [[Web_Interface]]
 +# Disable "SSH Management" under the section titled "Remote Access"
 +# Apply Settings
-* Enable SSHD on the [[Web_Interface]] (''Administration'' -> ''Management'' or ''Services'') and don't forget to ''Save Settings''.+== DD-WRT v23 or Earlier ==
-* Recommend also to change the SSHD port to something non-standard above 1024. The reason for this is, there are MANY brute-force attack tools out there that scan ranges of IP looking on port 22. If they see a response they do a brute-force attempt with a list of passwords. If your password is "admin" you are likely to be in trouble. Easy way to avoid being on their radar is CHANGE THIS DEFAULT PORT.+ 
-* To allow access to the SSH port from WAN add the following rule as command on the [[Web_Interface]] (''Administration'' -> ''Diagnostics'') and save with ''Save Firewall'':+=== Ensure SSH Enabled ===
- this command is not working /usr/sbin/iptables -I INPUT 1 -p tcp --dport $(nvram get sshd_port) -j logaccept+ 
- the rigth syntahx is /usr/sbin/iptables -I INPUT -p tcp --dport $(nvram get sshd_port) -j logaccept+# Goto the ''Administration'' tab and the ''Services'' sub-tab on the [[Web_Interface]]
-* To log into your router from a windows machine you could use [http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty]. You will have to enter the external ip of your router or the DynDNS name to login from Internet. If you have changed the port on which sshd runs, you will have to fill in that port number.+# Enable "SSHd" is under the section titled "Secure Shell"
 +# Choose an appropriate port (The default is 22, but is recommended you change to a non-standard port above 1024 because of security)
 +# Apply Settings if needed
 + 
 +''REFERENCES:'' [[Telnet/SSH_and_the_Command_Line#SSH]] or Sections 1.1 and 1.2 of [http://hetos.de/sshtut.html]
 + 
 +=== Enable Remote Access ===
 + 
 +# Goto the ''Administration'' tab and the ''Diagnostics'' sub-tab.
 +# Add the following to the text area:
 + 
 + /usr/sbin/iptables -I INPUT -p tcp --dport $(nvram get sshd_port) -j logaccept
 + 
 +# Save as Firewall Script
 + 
 +=== Disabling Remote Access ===
 + 
 +# Goto the ''Administration'' tab and the ''Diagnostics'' sub-tab.
 +# Add the following to the text area:
-* To disable the access from Internet:  
/usr/sbin/iptables -D INPUT 1 /usr/sbin/iptables -D INPUT 1
 +
 +# Save as Firewall Script
=Warning!= =Warning!=

Revision as of 02:58, 29 August 2006

Contents

Setup SSH access from Internet

DD-WRT v23 SP1 or later

Ensure SSH Enabled

  1. Goto the Administration tab and the Services sub-tab on the Web_Interface
  2. Enable "SSHd" is under the section titled "Secure Shell"
  3. Choose an appropriate port (The default is 22, but is recommended you change to a non-standard port above 1024 because of security)
  4. Apply Settings if needed

REFERENCES: Telnet/SSH_and_the_Command_Line#SSH or Sections 1.1 and 1.2 of [1]

Enable Remote Access

  1. Goto the Administration tab and the Management sub-tab on the Web_Interface
  2. Enable "SSH Management" under the section titled "Remote Access"
  3. Apply Settings

Disabling Remote Access

  1. Goto the Administration tab and the Management sub-tab on the Web_Interface
  2. Disable "SSH Management" under the section titled "Remote Access"
  3. Apply Settings

DD-WRT v23 or Earlier

Ensure SSH Enabled

  1. Goto the Administration tab and the Services sub-tab on the Web_Interface
  2. Enable "SSHd" is under the section titled "Secure Shell"
  3. Choose an appropriate port (The default is 22, but is recommended you change to a non-standard port above 1024 because of security)
  4. Apply Settings if needed

REFERENCES: Telnet/SSH_and_the_Command_Line#SSH or Sections 1.1 and 1.2 of [2]

Enable Remote Access

  1. Goto the Administration tab and the Diagnostics sub-tab.
  2. Add the following to the text area:
   /usr/sbin/iptables -I INPUT -p tcp --dport $(nvram get sshd_port) -j logaccept
  1. Save as Firewall Script

Disabling Remote Access

  1. Goto the Administration tab and the Diagnostics sub-tab.
  2. Add the following to the text area:
 /usr/sbin/iptables -D INPUT 1
  1. Save as Firewall Script

Warning!

It's not too secure to set up SSH access like that. Be sure to choose a long and secure password or even better use Public Key Method. Otherwise someone could succeed to hack your router by a Brute Force Attack.

The above method is obsolete at this time: You should only now need to go to Administration->Management->Remote Access->SSH Management and enable it, specifying the port you wish to enable WAN access to.