What is the simplest way to securely access my Raspi from internet?

Question

Either from my laptop or my andoid tablet I thought first Port forwarding and the pair of keys for SSH would be good but no avail I lost myself.. Thinking that it's easier I tried also Openvpn but I did not succeed either. Moreover Openvpn seems much for my personal use ? I am looking for an advice Thank you

Answer 1

OpenSSH is designed to be the most secure way to tunnel into your machine.

When I say tunnel, I mean connect into the console via an encrypted tunnel, where you can also connect using SFTP over port 22, reroute local ports into you machine to make it look as if you were at the machine while surfing somewhere else in the world, redirect X application but in its simplest form, log into the console as root or another user.

It depends what you want to to connect to the raspi? View webpages as if you were inside the LAN? So no port 80 forwarded to the internet? It takes some configuring but look at this tutorial. Basically the client creates a proxy at your local(outside from home) and anything you want to access your remote(the machine at home) goes via the poxy, into the tunnel and get routed on the Pi.

At the least you need to open port 22 to the Pi and it would be recommended to use keys but if you use a good password, that is enough too.

Answer 2

Using ssh to securely access your Raspbery Pi

ssh is a client that interacts with ssh servers. OpenSSH is used on many Linux distributions to act as the server.

Installing openssh-server

Really, this should already be installed.

• sudo apt-get install openssh-server #debian
• sudo pacman -S openssh #archlinux

---

Set up the client

Creating Keys

The client will use a pair of public/private keys for authentication. It is important that you safeguard the key. You will provide others with your public key.

• ssh-keygen -t rsa -b 4096

You will be asked what to name this keypair. In this example, we will use pi-rsa, which will create pi-rsa and pi-rsa.pub. It is important to understand that the file without any extention is to be kept private, while the .pub must be given to others.

[meLon@freyja] ~$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/home/meLon/.ssh/id_rsa): /home/meLon/.ssh/pi-rsa
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/meLon/.ssh/pi-rsa.
Your public key has been saved in /home/meLon/.ssh/pi-rsa.pub.

Configuring ssh

Next, you'll define a Host and how to connect to it (your pi).

• vim ~/.ssh/config

>

Host rpi
Hostname 192.168.1.115
User pi
PubKeyAuthentication yes
IdentityFile /home/meLon/.ssh/pi-rsa
ForwardX11 yes
IdentitiesOnly yes
ForwardAgent no

Setting up your key as your credentials

Now, you'll need to give the public key to the server on which you wish to authenticate. This is done by adding the public key to the remote server's authorized_keys for the user. It is found in ~/.ssh/authorized_keys. Each key is a single-line, and can be edited manually, or via ssh-copy-id.

• ssh-copy-id -i /home/meLon/.ssh/pi-rsa.pub rpi

Because we set up and defined rpi in our ~/.ssh/config file, it will connect to the Raspberry Pi.

---

Removing PasswordAuthentication from your server

It is recommended that you use keys to authenticate over ssh, and it is very easy to disable passwords now that you've set up your key. Remember, this is back on the Raspberry Pi itself.

• sudo vim /etc/ssh/sshd_config

Find PasswordAuthentication and make sure it says:

PasswordAuthentication no

Connect to your Raspberry Pi

• ssh rpi
• ssh some_user@rpi

Send a file to your Raspberry Pi

• scp ~/Downloads/download.iso rpi: # To home directory
• scp ~/Downloads/download.iso rpi:Downloads/ # To Downloads in home

• scp ~/Downloads/download.iso rpi:/home/meLon/Downloads/ # Full path

• scp -r ~/Downloads/ rpi: # Recursively send the directory

Notes

1. Make sure you've changed the pi account's password. This can be done via a terminal with passwd.
2. This should be good for a LAN, but if you're going to be accessing this from the Internet, you might want to learn a little more to secure your pi.

Answer 3

A simple way to enable secure Web or SSH access to your Raspberry Pi without port forwarding is using a relay service like https://ngrok.com/ or https://pagekite.net/ or https://yaler.net/

Answer 4

I think setting up VPN may be an overkill. But it also depends on what you want to do. If you let us know what your purpose is, we may be able to help better.

With SSH I am able to do most things I want do remotely on my RPi. Just to expand on ppumkin's answer, here is a quick work flow for you (of course you may already know this but may help others):

1. Setup SSH on RPi (I recommend changing the default SSH port 22 to something else for security). We will call it ZZZZ.
2. If you have not already done so, change the username and especially password to something strong. Many RPi distros come with default usernames and passwords.
3. Restart your RPi.
4. Setup port forwarding on your router or gateway - direct the SSH port number to Raspberry Pi's internal ip address
5. If you have a domain name pointed towards your network's external IP you can use that host or use the external IP. Connect through SSH using host (domain or external IP), SSH port number, username and password. On Windows you could use PuTTY. To access files, you could do SFTP through Filezilla.

Answer 5

If you want to be paranoid you can have 2 factor authentication using Google Authenticator app.

Read more here http://www.raspberrypi.org/forums/viewtopic.php?f=29&t=61993

Maybe not the simplest way - but I found certificates more difficult.

I can also report that I have detected the scanners are now occasionally using user 'pi' when attempting ssh to my webserver. Unfortunately I cannot change the port number there, but I do block the source IP after two failed attempts.