Installing openssh-server
would enable you to access your entire drive securely over the internet or from devices in your home, as long as they support sFTP. If any don't for any reason, a Samba share could supplement that as detailed in another answer. Here's how I set mine up:
Install OpenSSH Server: apt-get install openssh-server
Open up port 22: There are a number of ways of doing this, I use gufw
(you might need to install it, I'm not certain if it's default). If you want to open it up to the internet at a later stage, you'll need to forward port 22 to the server from your router. You can normally do this via a web interface on the router. If you can, assign the server a static ip there too (ie turn DHCP off for the server).
Edit the ssh config settings: Back up and open the file /etc/ssh/sshd_config
and change/add the settings
PermitRootLogin no
AllowUsers guarav_java other_user_if_necessary
For maximum security, you can set up key-based logins as detailed here https://help.ubuntu.com/community/SSH/OpenSSH/Keys, but it would suffice if you just set up a really strong password and saved it on each client machine.
You might like to create a user for each person connecting. If you do that, you can add them all to the same group (ssh_users, say) and allow everyone in that group to connect using AllowGroups ssh_users
. (For more information see http://knowledgelayer.softlayer.com/learning/how-do-i-permit-specific-users-ssh-access)
Check the settings are valid: You can check if you've made any syntax error in the config file with sshd –t
Connect from the server to itself: At this point you should be able to connect to the machine from itself in a terminal by ssh localhost
(assuming you already have openssh-client
). Then try it from another machine on your network, ssh <ip-address>
.
If the server's ip is static on your home network, you can add an entry to /etc/hosts
on an Ubuntu computer connecting to it with the line
server_ip_address theserver
This will mean you can connect with simply ssh theserver
, or whatever you called it. You can do the same for Windows (see here: http://helpdeskgeek.com/windows-7/windows-7-hosts-file/)
Connecting via sFTP: If you can connect to the server from another machine on your home network in a terminal, you can connect to it via sFTP and browse and transfer files securely. Personally, I set up a keyboard shortcut so I can mount/unmount my server with keyboard commands (on Ubuntu):
gvfs-mount sftp://user@ipaddress
gvfs-mount -u sftp://user@ipaddress
(The -u
flag is the umount command)
Put those into the "Command:" box of System Settings > Keyboard > Shortcuts > Custom Shortcuts > + (New shortcut), give it a name, click Apply, then click the right column and enter a key combination (CTRL+SHFT++
and CTRL+SHFT+-
respectively seem logical).
You can replace the ip address with what is in /etc/hosts
. This will mount the server as a drive in Nautilus and you can browse the folders just like those on your local computer. In Windows, you could connect using FTP software (Filezilla etc.). I've not tried it but I'm sure there is probably sFTP integration in Windows Explorer itself too.
Another advantage of key-based logins at this point is that you aren't prompted for a password each time you connect (unless you set one up to protect the key). You might like to look into it after you've got it working with password logins (and before opening up it to the outside).
Connecting from outside: The final step would be to see if you can connect from the internet, ie next door or whatever. If you haven't got a static ip address for your home, it could be tricky keeping up with what your ip address is. I use a dynamic dns service (http://afraid.org/ is a free one) personally, but you might find another solution better. Then you would replace the ipaddress in the above mount commands with the dynamic web address which points to your home network.
One final security hint, keep tabs on your SSH log if you go for this (/var/log/auth.log
), just to make sure nothing untoward is happening. If you find it is, Fail2Ban is one solution (http://www.fail2ban.org/wiki/index.php/Main_Page and https://help.ubuntu.com/community/Fail2ban). To minimize the risk you can change the port SSHD listens on to something non-standard like 500, and changing the corresponding port forwarding rules on your router and the firewall of the server (Why: https://serverfault.com/questions/189282/why-change-default-ssh-port) though I haven't personally tested that with gvfs-mount
.