Either from my laptop or my andoid tablet I thought first Port forwarding and the pair of keys for SSH would be good but no avail I lost myself.. Thinking that it's easier I tried also Openvpn but I did not succeed either. Moreover Openvpn seems much for my personal use ? I am looking for an advice Thank you
OpenSSH is designed to be the most secure way to tunnel into your machine.
When I say tunnel, I mean connect into the console via an encrypted tunnel, where you can also connect using SFTP over port 22, reroute local ports into you machine to make it look as if you were at the machine while surfing somewhere else in the world, redirect X application but in its simplest form, log into the console as root or another user.
It depends what you want to to connect to the raspi? View webpages as if you were inside the LAN? So no port 80 forwarded to the internet? It takes some configuring but look at this tutorial. Basically the client creates a proxy at your local(outside from home) and anything you want to access your remote(the machine at home) goes via the poxy, into the tunnel and get routed on the Pi.
At the least you need to open port 22 to the Pi and it would be recommended to use keys but if you use a good password, that is enough too.
Using ssh to securely access your Raspbery Pi
ssh is a client that interacts with
ssh servers. OpenSSH is used on many Linux distributions to act as the server.
Really, this should already be installed.
sudo apt-get install openssh-server#debian
sudo pacman -S openssh#archlinux
Set up the client
The client will use a pair of public/private keys for authentication. It is important that you safeguard the key. You will provide others with your public key.
ssh-keygen -t rsa -b 4096
You will be asked what to name this keypair. In this example, we will use
pi-rsa, which will create
pi-rsa.pub. It is important to understand that the file without any extention is to be kept private, while the .pub must be given to others.
[meLon@freyja] ~$ ssh-keygen -t rsa -b 4096 Generating public/private rsa key pair. Enter file in which to save the key (/home/meLon/.ssh/id_rsa): /home/meLon/.ssh/pi-rsa Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/meLon/.ssh/pi-rsa. Your public key has been saved in /home/meLon/.ssh/pi-rsa.pub.
Next, you'll define a Host and how to connect to it (your pi).
Host rpi Hostname 192.168.1.115 User pi PubKeyAuthentication yes IdentityFile /home/meLon/.ssh/pi-rsa ForwardX11 yes IdentitiesOnly yes ForwardAgent no
Setting up your key as your credentials
Now, you'll need to give the public key to the server on which you wish to authenticate. This is done by adding the public key to the remote server's
authorized_keys for the user. It is found in
~/.ssh/authorized_keys. Each key is a single-line, and can be edited manually, or via
ssh-copy-id -i /home/meLon/.ssh/pi-rsa.pub rpi
Because we set up and defined
rpi in our
~/.ssh/config file, it will connect to the Raspberry Pi.
Removing PasswordAuthentication from your server
It is recommended that you use keys to authenticate over ssh, and it is very easy to disable passwords now that you've set up your key. Remember, this is back on the Raspberry Pi itself.
sudo vim /etc/ssh/sshd_config
Find PasswordAuthentication and make sure it says:
Connect to your Raspberry Pi
Send a file to your Raspberry Pi
scp ~/Downloads/download.iso rpi:# To home directory
scp ~/Downloads/download.iso rpi:Downloads/# To Downloads in home
scp ~/Downloads/download.iso rpi:/home/meLon/Downloads/# Full path
scp -r ~/Downloads/ rpi:# Recursively send the directory
- Make sure you've changed the
piaccount's password. This can be done via a terminal with
- This should be good for a LAN, but if you're going to be accessing this from the Internet, you might want to learn a little more to secure your pi.
I think setting up VPN may be an overkill. But it also depends on what you want to do. If you let us know what your purpose is, we may be able to help better.
With SSH I am able to do most things I want do remotely on my RPi. Just to expand on ppumkin's answer, here is a quick work flow for you (of course you may already know this but may help others):
- Setup SSH on RPi (I recommend changing the default SSH port 22 to something else for security). We will call it ZZZZ.
- If you have not already done so, change the username and especially password to something strong. Many RPi distros come with default usernames and passwords.
- Restart your RPi.
- Setup port forwarding on your router or gateway - direct the SSH port number to Raspberry Pi's internal ip address
- If you have a domain name pointed towards your network's external IP you can use that host or use the external IP. Connect through SSH using host (domain or external IP), SSH port number, username and password. On Windows you could use PuTTY. To access files, you could do SFTP through Filezilla.
If you want to be paranoid you can have 2 factor authentication using Google Authenticator app.
Read more here http://www.raspberrypi.org/forums/viewtopic.php?f=29&t=61993
Maybe not the simplest way - but I found certificates more difficult.
I can also report that I have detected the scanners are now occasionally using user 'pi' when attempting ssh to my webserver. Unfortunately I cannot change the port number there, but I do block the source IP after two failed attempts.