Telnet/SSH and the command line

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 09:59, 28 February 2008 (edit)
Soulstace (Talk | contribs)
m (Requirements)
← Previous diff
Revision as of 10:04, 28 February 2008 (edit) (undo)
Soulstace (Talk | contribs)
m (Requirements)
Next diff →
Line 72: Line 72:
=====Requirements===== =====Requirements=====
-*DD-WRT v24 RC7+ (not sure if v23 supported this feature)+*DD-WRT v24 RC7+
*SSHd and SSH TCP Forwarding must be enabled under Services -> Secure Shell *SSHd and SSH TCP Forwarding must be enabled under Services -> Secure Shell
*Remote SSH Management should be enabled as well, under Administration -> Management *Remote SSH Management should be enabled as well, under Administration -> Management

Revision as of 10:04, 28 February 2008

Contents

Using Telnet

  1. Open your favorite Telnet client (On Windows, you can use Start > Run > telnet <Router_LAN_IP>)
  2. connect to <Router_LAN_IP> e.g. 192.168.1.1
  3. When asked for the username, enter root (even if you changed username in web interface)
  4. When asked for the password, enter your router's password

SSH

Overview

SSH, or Secure Shell, is an encrypted protocol and associated program intended to replace telnet. It can also be used for creating secure tunnels, somewhat akin to Virtual Private Networks. Unless changed, everything SSH operates on port 22.

SSH operates just as telnet with a user/password combination or on a Public/Private key infastructure. For the latter to work, a small public key is given to the server and the server gives your client its public key. Your client encrypts information to the server using the servers public key and the server encrypts information sent to you using your public key. Private keys are never exchanged, and are used to decrypt the information encrypted with the associated public key.

The DD-WRT firmware can use user/pass logon or only allows connections from clients whose public keys are manually entered via the web interface. Multiple keys can be entered by placing them on seperate lines.
If you want to use user/password to login using SSH use user "root" with the password you set in the webinterface

Actually you can manually set (via telnet or ssh) the sshd_authorized_keys nvram variable. ie nvram set sshd_authorized_keys=key1 key2 key3 etc

You can also manually edit /tmp/root/.ssh/authorized_keys and add keys (although these will dissapear on a reboot unless you have a startup script altering them).

It is worth pointing out ssh keys are quite long strings of characters so if you paste them in you have to be careful that you don't get any line breaks (ie it is one Long continuous line). or they will not work.

Setting Up

Public key method

First you should generate a Public/Private key pair on your desktop machine. This can be done through the "Puttygen" utility if you're using either Putty or WinSCP as clients. Copy the public key to the clipboard and save the private key somewhere on your computer. There is no need to save the public key. If you forget it, you can instruct Puttygen to open your private key file rather than generating a new key pair and it will tell you your public key. It is recommended that you don't secure your key pair with a password, as this will make things easier for you, although somewhat less secure.

  1. Using the Web Interface goto the Administration tab.
  2. Under the Services sub-tab, Enable SSHd in the Secure Shell section. If new options don't appear, Save Settings
  3. Paste your public key in the authorized key of the SSHD section that has now expanded. You will need to generate this on your desktop if you don't have one yet.
  4. Save Settings

NOTE: The format of the public key when pasted has to be "ssh-rsa", space, key, space, comment. Here is an example: (please note that there should be no line feed at the end)

 ssh-rsa AAAAB4NfaC3yc5AAAPEAqvM ... NC+j4jZfYmBTi7Q== user@domain

Password Login method

If you don't want the hassle of generating ssh keys, you may use the password logon method.

  1. Using the [Web Interface] goto the Administration tab.
  2. Under the Services sub-tab, Enable SSHd in the Secure Shell section. If new options don't appear, Save Settings
  3. Enable Password Login to enable the password login

After this you may login as user "root" with the password you set for the webinterface

SSH Shell Client

Provides a secure alternative to standard telnet.
A good Windows Client to use is Putty
Configure the client to use the Private Key you saved earlier.
Most Linux distros have telnet and SSH clients by default.

SSH Remote Forwarding

Remote forwards are the ability to create a tunnel to pass traffic through. If you issue the following with ssh

ssh2 -R 1234:client:23 username@host

all traffic which comes to port 1234 on the server (host) will be forwarded to port 23 on the client (client). This is useful to tunnel things like rdp(remote desktop) through an encrypted ssh tunnel over the internet.

If you had

clientA <-> router <-> internet <-> clientB

clientB, which is running rdp on port 3389, issues ssh -R 5555:clientBip:3389 username@router

clientA can use his rdp client to connect to port 5555 on the router and this would create a ssh tunnel which will connect clientA to port 3389 on clientB.

Requirements
  • DD-WRT v24 RC7+
  • SSHd and SSH TCP Forwarding must be enabled under Services -> Secure Shell
  • Remote SSH Management should be enabled as well, under Administration -> Management
Setup

Setting up a remote port forward is relatively straightforward when using the PuTTY utility under Windows. See Connections -> SSH -> Tunnels. Make sure your configuration includes parameters as illustrated above.

SCP

Secure Copy (SCP) allows one to copy files to and from the router and a remote host--usually a desktop machine.
A good Windows client to use is WinSCP
Configure the client to use the Private Key you saved earlier, or use "root" and the webinterface password
Remember: only the /tmp and /jffs partitions are writable!

Drop Bear

DropBear is an SSH client/server installed by default on the WRT54G. DropBear allows one to connect from the WRT54G to a remote SSH server for scp, etc. I don't believe SSHD needs to be enabled through the Web Interface in order to use the client portion of DropBear.

If you have an SSH server on your desktop machine (such as OpenSSH) you pull files from your desktop machine using the scp command. This can be used to copy files from your desktop machine in a Startup Script

The DD-WRT Command Line

aka the DD-WRT Linux shell

This is an 'ash' shell. Ash is a version of sh, literally 'A SHell' (A command Interpreter)

Basic Syntax

The Linux Command Shell (Ash) is not the same as the Windows/DOS command prompt.

/ (and not \) is used to seperate directories in a path, just like the interweb.

In order to execute a command, the path for that command must be provided. This may either be a full path or a relative path.

Relative Path Operators

There are two relative path operators.

.        The current path
..       One directory above the current path

Examples

1) If you are in the /jffs/usr/bin directory and wish to run the /jffs/usr/bin/noip command use:

/jffs/usr/bin # /jffs/usr/bin/noip

or

/jffs/usr/bin # ./noip


2) If you are in the /jffs/usr/bin directory and wish to run the /jffs/usr/kismet command use:

/jffs/usr/bin # /jffs/usr/kismet

or

/jffs/usr/bin # ../kismet

or

/jffs/usr/bin # cd ..
/jffs/usr # ./kismet


3) Relative paths can also be used as arguments. If you installed the noip package, you'd notice that the command is installed as /jffs/usr/bin/noip but its configuration file is installed as /jffs/etc/no-ip.conf When running noip, it is thus required to give it the path to its configuration file with the -c command. This can be done like:

/jffs/usr/bin # ./noip -c /jffs/etc/no-ip.conf

or

/jffs/usr/bin # ./noip -c ../../etc/noip.conf

notice that the first ../ brings us to /jffs/usr/. The second ../ brings us to /jffs/, and then the rest of the path can be appended.


4) While the other examples all showed how to save typing, you can also really screw around with relative paths. To launch the noip command in example 1, you could also use

/jffs/usr/bin # ../../../jffs/./usr/./bin/././../bin/././noip

Here we browse all the way back to the root / directory, then climb back up to /jffs/usr/bin, drop back down to /jffs/usr and then climb back up to /jffs/usr/bin.
Current path references of /./ are thrown in sporadically just to mix things up. Notice how /./ always references the then current path, not the original path of the shell when the command was entered.

Pipes and Redirects

The output of commands can be piped through other commands or redirected to devices and files.

< and > are the redirect operators.   < Takes input from a device or file and routes it as input to the command given.   > Takes output from a command and redirects it as input for a device or file. Ex: If you don't want to see the output of a command, redirect it to the null device:

command > /dev/null

| is the pipe character, and pipes the output through another command (for formatting, etc) Ex: the most command use of the pipe is to limit the output of a command:

command | more

This is extremely useful for commands like nvram show which list some 800-1200 lines. nvram show | more will list the results 1 page at a time.

Background processes

It is possible to run programs in the background (returning you to the command prompt immediately) by terminating your command with the & character. ex:

command &

Make sure you add a space between your command and the ampersand or you will result with a File not found error.

Basic Commands

<command> -h                 The -h flag almost always provides help on a command. Use it!
ls                           List the contents of the current directory
cd <directory or full path>  Change to that directory or path
cp <source> <destination>    Copy the source file to the destination
mv <source> <destination>    Move the source file to the destination
mkdir <directory name>       Create a new directory
wget <URI>                   Download the file at the given URI to the current path
tar -xz -f <file>            un-gzip and un-tar the given *.tgz or *.tar.gz file
rm <file>                    Delete the file
rm -r <directory>            Delete the directory and all contents
killall <program name>       Kill all running processes of the program
ps                           Show running processes
top                          Show running processes in a graphical frontend


More Advanced Commands

These commands warrant their own wikis:

See also

Script Examples
Startup Scripts
Tunnel all traffic over ssh using remote windows machine and Putty

External Links

Wikipedia's SSH article
Linux Shell Scripting Tutorial
Configuring FTP/Telnet
Increasing number of Telnet sessions allowed