0

I discovered the joys of ssh through school. I can connect to the school computers writing [email protected], which prompts me for password and bam, I'm in. No setup was necessary on my part.

Anyway, I'd like it to be possible to connect to my main computer this way as well, i.e. if I'm on my laptop and would like to run stuff on my desktop computer I could just write ssh username@mydesktop or something and then I'm in. As far as I gather, I need to set up an ssh server.

I've googled some articles on setting up an ssh server and trying it out on my laptop (for now), here's one such article and here's another. As for the first link, I've done all the parts stated except the AllowUsers part, which puzzles me. What would a username look like? There's a macbook next to me, in the terminal it says Petes-macbook-pro; is that the username or what? Also, if Pete wants to connect to me, what would he write? I never gave out or even defined a nice "address" such as the above @siegbahn.it.uu.se.

As stated I've been trying to find answers to this but all the articles about ssh seem to assume that you've done steps 1-10 and only guide you on steps 11-20.

What I've done: sudo apt-get install openssh-server in sshd_config, change port number and set PermitRootLogin to no.

Thanks for your advice.

EDIT: Connection at home is a cable from the wall into a router. Fiber optic I guess? I live in an apartment but the Internet is not provided by the apartment. Well, the jack in the wall is...

2 Answers 2

5

Don't get fancy to start. Before fiddling around with setttings, changing the port, I'd make sure it works as intended. If you can, put everything back the way it was and see if it works. I don't think any user configuration is necessary to get the basic thing working. You don't need to enable ssh for particular users. Just do the basics, then add modifications later. Maybe you could remove the package (and settings) and reinstall.

After that:

  1. Is the sshd server process running.

On Ubuntu systems, installing the package typically starts the ssh process that answers requests from other systems.

Check if sshd is running. In shell, run

ps aux | grep ssh

I see this, which means it is running:

root   1144  0.0  0.0  67824  5448 ? Ss   Dec06   0:00 /usr/sbin/sshd -D

If it is not running, again, I'm surprised because the packaging scripts will usually turn that on in Ubuntu. You can turn it on. The steps are written out on the basic page. https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

  1. Check if you can log in FROM THE SAME system

Open a terminal, and try to ssh into your own account. Try

ssh localhost

You can also try "ssh [email protected]" as well. If you can't do it from your own system, then you know the ssh service is not turned on or configured correctly.

  1. Bring your laptop and sit next to the trouble server system. If ssh works on same system, but not from other systems, then you have a different problem to find. If you have been fiddling with firewalls and such, then you've probably outsmarted yourself. I sometimes have settings in /etc/hosts.deny and /etc/hosts.allow that are contradictory.

You can monitor your system logs on the server while you try to log in from your laptop. Sometimes you can see the trouble. I think the right file to watch is /var/log/auth.log. That may give you some hints.

You don't mention what firewall settings you might have, but I would turn off the firewall entirely for a few minutes to test out the ssh server. Of course, you turn that back on.

In my experience, this is one way in which running Ubunutu is a little bit more frustrating than other linuxes, so be patient.

After all that, then go someplace else to try. If there is trouble

  1. It may be that the network administrators in your system are blocking access. Administrators at my place have become very strict and now filter all incoming ssh requests, NO MATTER WHAT PORT! If you are in that unhappy situation, you will need to get the administrators to set up a VPN for you.

Or it may be your own configuration has blocked your access. Sometimes you can see that while tracking auth.log or "dmesg" output more generally. If you get to that stage, you should write back. Somebody here who is better at iptables will help you, I expect.

In summary, don't start changing settings until you know what works out of the box. Later on, after it works, fiddle with settings. Change one thing at a time. I always turn on X11 forwarding. You were wise to change the root password setting in /etc/sshd_config. Changing the port seems, well, not highly beneficial.

18
  • Thank you! Points 1 and 2 worked fine. As for point 3, that's partly my problem: how do I even attempt to connect Pete's laptop that's next to me, to the computer where I'm trying to set this all up? Googling "my ip" gives that both computers have the same IP. I tried ssh ip@ip from Pete's computer and it timed out. Should I write petescomp@ip, or what do I write for username? Dec 11, 2016 at 21:40
  • I forgot; Regarding firewall settings they are whatever is the default, if any. Dec 11, 2016 at 22:07
  • 1
    @ErikVesterlund, if you and Pete are both on the same private local segment behind a NAT'ing router, then you use the local IP addresses to connect from one to the other. To see the local addresses of each machine issue ip -4 addr on the ubuntu box and ifconfig on the Mac. Then on the mac you should be able to ssh username@${IP_OF_UBUNTU_BOX}, and similarly to ssh from the ubuntu machine to the Mac. Dec 11, 2016 at 22:21
  • 1
    @ErikVesterlund, home networks typically use local addresses in the 192.168.x.y range. 127.0.0.1 should show up as your lo interface (loopback), which is only for internal connections, not to connect to the machine from another machine. You don't need Pete's username, you need the username of any account existing on the machine. If there is an account erik on the ubuntu machine, for example, then ssh erik@${IP_ADDR}. You can always add another account for Pete, but adding additional users is a matter of system management, not ssh per se. Dec 11, 2016 at 22:35
  • 1
    I do not mean to open /sbin/ifconfig as if it were a file. Run it, it is a program. It shows the IP address. Example, within my home, where I have a wireless router, I get "wlp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.0.110 netmask 255.255.255.0 broadcast 192.168.0.255". See where it says "inet". That is the number I'd use to connect "into" this system. Test that in my step 3. Suppose that works. Then to figure out step 4, open web browser from target system and browse to "whatismyip.com". From inside home router, that will tell the IP you have now.
    – pauljohn32
    Dec 13, 2016 at 3:38
2

Everything you need to know is on the Ubuntu wiki.

https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

To address some of your specific questions:

You will need to forward a port in your router to your server, to allow access from outside your home network. Some suggest using a different port than the standard, to minimize the number of bot attacks. You can still use the standard port on your server, which is recommended. Simply forward the non standard port in the router to the standard port in your server. You would then access it by ssh servername:nonstandardportnumber

IMHO it is more secure to set up key based logins than to allow userid/password logins. This topic is covered in the wiki I linked to.

3
  • The answers may well be in that link but I don't recognize them. How does one forward a port in the router? I will keep X11forwarding yes, but there is no AllowTcpForwarding entry, there is a TCPKeepAlive though? As for ssh servername, that's just my problem, what is the servername? How do I set it? Again, the answer may be in your link but if so I don't recognize it. (Not a CS guy.) Dec 11, 2016 at 21:57
  • 1
    Don't get carried away with this yet. It assumes you are in a small home network and you do control the router. I'm not sure this applies to the problem you described. I can explain author's idea, though. All computers inside a home router (that has 1 IP address) are behind the router. The router has an address that is available to outside, but incoming SSH connections die at that address. However, the router can be configured to pass along the incoming SSH to a particular internal ID. In the original post, I had the idea you were at work with a target machine that is on the internet.
    – pauljohn32
    Dec 11, 2016 at 23:02
  • 1
    If your machine does not have a publicly available address, and you don't control the router setup, then you are stuck unless admin will help. On the other hand, if you are in a home network, you can usually find settings in the ROUTER software to give incoming connections on port 22 (maybe other ports) to a particular laptop. I used to have D-link router and they made that super easy. Now I have a router that makes it super difficult. Key point here is that this is a ROUTER configuration, not an Ubuntu setting. Router has to allow the SSH messages through to the target server.
    – pauljohn32
    Dec 11, 2016 at 23:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .