ELS Howto: Dropbear SSH


Synopsis

This document describes how to add a Secure SHell (SSH) service to an Elemental Linux Server (ELS) host by compiling and installing Dropbear.


Prerequisites

These instructions assume you have networking configured for the ELS host and can connect to the internet to download files. For instructions on how to set up networking, see the Installation Instructions for ELS.

You will also need to complete the steps in the ELS Howto: Build From Source.


Installation

Dropbear needs to be configured and installed from source code. The steps below will guide you through the process.

  1. Create a partition for /usr/local. If you don't have the disk space for another partition, you can create a symbolic link for /usr/local that points to /opt.
  2. Download the latest source code .tar.gz file from http://matt.ucc.asn.au/dropbear/.
  3. Extract the source archive into /usr/local/src/.
  4. Configure and build the source code.
  5. Install the dropbear binaries.

Example

The following steps show how to install Dropbear SSH on a typical ELS server using a symlink pointing to /opt for /usr/local instead of creating a new partition.

mount -o remount,rw /usr
ln -s /opt /usr/local
mount -o remount,ro /usr

mkdir /usr/local/src
cd /usr/local/src
wget http://matt.ucc.asn.au/dropbear/dropbear-2012.55.tar.gz

tar -zxf dropbear-2012.55.tar.gz

cd dropbear-2012.55

./configure
make

make install

Configuration

Once the binaries are installed, you will need to set up server keys and configure inetd to start dropbear.

  1. Create the directory /etc/dropbear to hold the server keys.
  2. Generate RSA and DSA server keys.
  3. Add a line to inetd.conf for dropbear and restart inetd.

Example

The example below shows the configuration of dropbear on an ELS server.

mkdir /etc/dropbear

cd /etc/dropbear
dropbearkey -t rsa -f dropbear_rsa_host_key
dropbearkey -t dss -f dropbear_dss_host_key

vi /etc/inetd.conf
ssh     stream  tcp     nowait  root    /usr/local/sbin/dropbear dropbear -i

killall -HUP inetd

Testing

To test the Dropbear SSH service, try to connect to your ELS host using either ssh (on a Linux client) or PuTTY (on a Windows client).

If the connection is not successful, here are some things to check.

  1. Use netstat -tln to make sure that port 22 is listening on the server.
  2. Verify that the server's firewall is set up to allow incoming connections on port 22. iptables -L -n should show an ACCEPT target for tcp dpt:22 (or as an alternative, there may be an ACCEPT target for the entire local network.)
  3. Check to see if you can ping the server or access other services on it like http.

There is also a README file that comes in the Dropbear source code that can be helpful for getting things set up.