Instruction Guide How to hardening your ssh access to MoOde HW

[How to do instruction] How to hardening your ssh access to MoOde HW - Printable Version

+- Moode Forum (https://moodeaudio.org/forum)
+-- Forum: moOde audio player (https://moodeaudio.org/forum/forumdisplay.php?fid=3)
+--- Forum: FAQ and Guides (https://moodeaudio.org/forum/forumdisplay.php?fid=9)
+--- Thread: [How to do instruction] How to hardening your ssh access to MoOde HW (/showthread.php?tid=3244)

How to hardening your ssh access to MoOde HW - UpsiUps - 12-11-2020

I assume you allready have enabled ssh by a file called "ssh" on your SD-card ( File could be empty and easy generated with

Code:
touch /<mountpoint of SD Card/ssh

Now you could log into MoOde with the standard password as user pi
To harden the ssh entrance you won't allow passwords in the future. Instead you use a pair of keys taht you generate with ssh-keygen. E.G like

Code:
host% ssh-keygen

Generating public/private rsa key pair.

Enter file in which to save the key (/home/testuser/.ssh/id_rsa): 

Created directory '/home/testuser/.ssh'.

Enter passphrase (empty for no passphrase): 

Enter same passphrase again: 

Your identification has been saved in /home/testuser/.ssh/id_rsa.

Your public key has been saved in /home/testuser/.ssh/id_rsa.pub.

The key fingerprint is:

SHA256:0iyhDvjC0OMEo4Y6FrDcGpW114Bk6yql3MXp76oK3B0 testuser@host.example.com

The key's randomart image is:

+---[RSA 2048]----+

|    .+..         |

|    +.o o        |

|+  o o.. .       |

|=*o o.o+         |

|*==o.Eo S        |

|B+O+= .o         |

|=Oo+.o           |

|oo.   .          |

| .....oo         |

+----[SHA256]-----+

host% ls -al .ssh

drwx------  2 testuser  testuser     4 10 Dez. 16:38 .

drwxr-xr-x  3 testuser  testuser    10 10 Dez. 16:38 ..

-rw-------  1 testuser  testuser  1843 10 Dez. 16:38 id_rsa

-rw-r--r--  1 testuser  testuser   412 10 Dez. 16:38 id_rsa.pub

host%

Now you have two types of the same key: the one with ending .pub is the public key and the other the private key. The last should never been exposed. So ensure that only you could read taht key. The other is the "give-away" to encrypt messages to you and to challange you to ensure that "you are you" Big Grin

As you currently logged in to your MoOde HW as user pi with the password, you could now copy the public key to your MoOde HW:

Code:
host% cd .ssh

host% scp id_rsa.pub pi@moode: 

The authenticity of host 'moode.example.com

ECDSA key fingerprint is SHA256:LhpGH5k3ASMKEyNA1MN5tSmFX0RfBQ0dxUbdkHDM7vQ.

No matching host key fingerprint found in DNS.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added 'moode.example.com' (ECDSA) to the list of known hosts.

pi@moode.example.com's password: 

id_rsa.pub                                                                                        100%  412   327.2KB/s   00:00    

host%

Short explanation for ssh newbees:
When you never ssh'ed the MoOde HW, ssh will ask you , if that HW is really the HW you want to contact and will show you a fingerprint of the host-key. In my case ssh is also asking the DNS system for a so called host-key of the ssh daemon running on the MoOde HW. When you are sure that it is your HW, the host-key will be stored in your ~/.ssh/known_hosts file so that you won't be bothered next time ( as long as the host-key has not changed - but that is a different story )
The password you need to enter is the password you use for user pi
Now the key is copied to the root directory of your moOde HW. and it is time to log in to the MoOde HW:
The first step is to move the key into ther right place

Code:
host% ssh pi@moode.example.com

pi@moode.example.com's password: 

RaspiOS 10.3 | 5.4.51-v8+ #1325 | aarch64 (64-bit)

                          ____     __

              __ _  ___  / __ \___/ /__

             /  ' \/ _ \/ /_/ / _  / -_)

            /_/_/_/\___/\____/\_,_/\__/

                 moOde audio player

              Release 6.7.1 2020-07-22

                (C) 2014 Tim Curtis

The programs included with moOde are free software; the

exact distribution terms for each program are described

in the individual files in /usr/share/doc/*/copyright.

Moode comes with absolutely no warranties expressed or

implied, or any other guarantees.

Last login: Fri Dec 11 11:00:01 2020 from 10.0.0.13

pi@moode:~ $ ls

id_rsa.pub  piano.sh

pi@moode:~ $ mkdir .ssh

pi@moode:~ $ mv id_rsa.pub .ssh/authorized_keys

Here I assume that you have never created ssh keys on the moOde HW - so it is like a fresh MoOde HW
Now you could allready login without a password to your moOde HW. Lets try it:

Code:
pi@moode:~ $ exit

logout

Connection to moode.example.com closed.

host% ssh pi@moode.example.com

RaspiOS 10.3 | 5.4.51-v8+ #1325 | aarch64 (64-bit)

                          ____     __

              __ _  ___  / __ \___/ /__

             /  ' \/ _ \/ /_/ / _  / -_)

            /_/_/_/\___/\____/\_,_/\__/

                 moOde audio player

              Release 6.7.1 2020-07-22

                (C) 2014 Tim Curtis

[...deleted to save space ... ]

Last login: Fri Dec 11 11:11:36 2020 from 10.0.0.140

pi@moode:~ $

Now you need to prevent that others still could login with a password. To do so , you need to edit /etc/ssh/sshd_config
You need to change the following keywords:

ChallengeResponseAuthentication no
UsePAM no

After saving the file you also need to restart the ssh daemon:

Code:
pi@moode:~ $ sudo vi /etc/ssh/sshd_config

pi@moode:~ $ sudo service sshd restart

That's it !

Now you could only login from host to your moode system. You could verify this by using a diffrent user or system and try to login to your moode system. You will see
Permission denied (publickey).
as a return to your try..

Addition: if you want to login from other systems via ssh to your MoOde HW, you need to repeat this procedure with one diffrence: instead of copiing the public key into the authorized_keys file, you need to add the key: mv id_rsa.pub >>.ssh/authorized_keys

[2nd Addition]
E.g. if our user name on the host is BestDJ a simple ssh moode.example.com will not allow you to login as ssh tries to do BestDJ@moode.example.com instead of pi@moode.example.com. To allow you to shortcut the ssh command, do the following

Code:
cd

echo "Host moode moode.example.com" >.ssh/config

echo "  User pi" >>.ssh/config