1. Installing SSH
First thing that has to be done is to install a SSH (Secure Shell protocol) server. For ubuntu it's easy as writing one command. Just copy-paste the following command and the server will be installed.
sudo apt install openssh-server
If it exists, it might be a good idea to
sudo apt purge openssh-server
before and resinstall to avoid any issues with the installation.
Another good idea might be installing the client too, if you want to test if your server works.
sudo apt install openssh-client
2. Configuring SSH server
Now SSH has to be configured to enable key based authentication for increased security. As the first step here, the original configuration should be backed up, but you could skip this part if you are sure you won't mess it up.
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo chmod a-w /etc/ssh/sshd_config.bak
Now you can use text editor you wish to edit the configuration file. You can use for example gedit, nano or vim as the editor.
sudo <TEXT EDITOR HERE> /etc/ssh/sshd_config
Now that you've opened the configuration file. The first thing that should be done is to change the port. It's usually recommended to change the port of the SSH server to hide it a bit. It also stops most bots from trying to get into your machine.
To change the port
Port <Port number>
Change it to for example
Port 2213
To enable X11 forwarding (remote displaying your PC's screen) change.
X11Forwarding <Value>
to
X11Forwarding yes
Now run this command to restart the server (for the configuration changes to apply.
sudo systemctl restart sshd
Let's check the status. It must be green "active (running)".
sudo systemctl status sshd -l
Now try to connect to your ssh server by using this command.
ssh -p <Port number> <Username>@localhost
3. Setting up the RSA keys
First steps that should be taken is creating the folder for the keys.[1]
mkdir ~/.ssh
Now let's generate the key. Follow the instructions.
ssh-keygen
Encrypted home
If you have an encrypted home directory, SSH cannot access your authorized_keys file because it is inside your encrypted home directory and won't be available until after you are authenticated. Therefore, SSH will default to password authentication.
To solve this, create a folder outside your home named
sudo mkdir /etc/ssh/<username>
This directory must have 755 permissions and be owned by the user. Move the authorized_keys file into it. The authorized_keys file must have 644 permissions and be owned by the user.
Then edit your /etc/ssh/sshd_config and add:
AuthorizedKeysFile /etc/ssh/%u/authorized_keys
After the key is generated, let's copy it to the host.
ssh-copy-id -p <Port number> <User name>@<Host (localhost)>
After that is done. Correct permissions on the key and folder must be set to secure it.
chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
(If you have encrypted home look at that section's folder permissions)
If the permissions are wrong you will most likely encounter errors.
(Source: Ubuntu Wiki)
Now to secure the authentication finally, find these lines.
RSAAuthentication <Value>
PubkeyAuthentication <Value>
PasswordAuthentication <Value>
ChallengeResponseAuthentication <Value>
Change them to.
RSAAuthentication no
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
< optional> Also add/edit these following lines to your configuration file to further secure ("harden") your system. Read more about these lines here or from the man pages of sshd.
TCPKeepAlive no
ClientAliveInterval 60
ClientAliveCountMax 5
UsePrivilegeSeparation yes
PermitEmptyPasswords no
PermitRootLogin no
UseLogin no
UsePAM no
MaxAuthTries 2
Allow compression to be used if client requests it. Use the compression flag in the client to either save bandwidth(yes) or CPU (no).
Compression yes
< /optional>
Finalizing install
Now run this command to restart the server (for the configuration changes to apply.
sudo systemctl restart sshd
Let's check the status with
sudo systemctl status sshd -l
Make sure it's green and "active (running)". If it is not, you need to check the error messages. If all is okay, try to connect to your ssh server by using this command.
ssh -p <Port number> <Username>@localhost
If it fails, starts sshd via command line with debugging enabled. That way it'll print you instantly what's wrong.
4. Setting up a portable USB drive for X11 forwarding
Download PuTTY portable. Then just import the keys, enable x11forwarding. Set your port and username. Then the x server location.
Download Xming X Server for Windows. As Windows does not have a X server by default, you need to download one. It works portably too (it should at least). Start it before connecting to the ssh server with PuTTY.
5. Setting up dynamic DNS.
The first step that should be taken is to select the dynamic dns provider, I, myself chose dynu.com. Now let's install the required software. For that copy-paste this command to your terminal. This time we'll use ddclient.
sudo apt install ddclient
It'll launch a configuration screen, just skip it and let's edit the configuration file ourselves. (Use nano, gedit whatever you wish to edit the file as previously)
sudo <your text editor> /etc/ddclient.conf
Now let's copy the contents from here.
# ddclient configuration for Dynu
#
# /etc/ddclient.conf
daemon=60 # Check every 60 seconds.
syslog=yes # Log update msgs to syslog.
mail=root # Mail all msgs to root.
mail-failure=root # Mail failed update msgs to root.
pid=/var/run/ddclient.pid # Record PID in file.
ssl=yes # Use ssl-support. Works with ssl-library .
use=web, web=my.ip.fi/ # Get ip from hardware interface.
server=api.dynu.com # IP update server.
protocol=dyndns2
login=YOURUSERNAME # Your username.
password=YOURPASSWORD # Your password or MD5 of password.
MYDOMAIN.DYNU.COM # List one or more hostnames one on each line.
Edit the network interface, hostname, username and password line to make it work properly. You also need to have IO::Socket::SSL. You can install it by using this command.
sudo apt install libio-socket-ssl-perl
Now let's set up the ddclient to run in background.[2]
sudo <your text editor> /etc/default/ddclient
Find the lines that say
run_dhclient=<value>
run_ipup=<value>
run_daemon=<value>
Change them to
run_dhclient="false"
run_ipup="false"
run_daemon="true"
Now let's start it
sudo systemctl start ddclient
Let's check if it works properly
sudo systemctl status -l ddclient
Make sure it is green ("Active = active(running)")
Dynamic DNS should now be set up. You can now test it with
ssh -p <Port number> <Username>@<Hostname (your dynamic DNS one)>
It should say
The authenticity of host '[<Dynamic DNS hostname>]:<Port> ([<Your IP address>]:<Port>)' can't be established.
It'll also print the ECDSA key fingerprint, you can use
ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub
To verify if the fingerprints are identical and then write "yes" to continue. NB! It should NEVER again ask the same question on the same machine when you have not cleared the known hosts file and the IP has nto changed (if you use dynamic DNS it will change). If it does absolutely do not proceed unless you can again verify it's the same fingerprint key as yours on the server.
It should now have connected just fine, maybe asking your key's passphrase, but nothing else.
6. Port forwarding
Now that dynamic DNS and server has been set up and you wish to connect to your PC from other networks. Then you must somehow open your router's settings and forward the port you set in the sshd configuration file. Otherwise you can't connect to the PC, because the router will block it. This is highly dependant on the manufacturer of the router so just Google " port forward" or " port forward". You could also read the manual.
If something was left unclear or is wrong, do let me know, please.