Either from my laptop or my andoid tablet I thought first Port forwarding and the pair of keys for SSH would be good but no avail I lost myself.. Thinking that it's easier I tried also Openvpn but I did not succeed either. Moreover Openvpn seems much for my personal use ? I am looking for an advice Thank you
OpenSSH is designed to be the most secure way to tunnel into your machine.
When I say tunnel, I mean connect into the console via an encrypted tunnel, where you can also connect using SFTP over port 22, reroute local ports into you machine to make it look as if you were at the machine while surfing somewhere else in the world, redirect X application but in its simplest form, log into the console as root or another user.
It depends what you want to to connect to the raspi? View webpages as if you were inside the LAN? So no port 80 forwarded to the internet? It takes some configuring but look at this tutorial. Basically the client creates a proxy at your local(outside from home) and anything you want to access your remote(the machine at home) goes via the poxy, into the tunnel and get routed on the Pi.
At the least you need to open port 22 to the Pi and it would be recommended to use keys but if you use a good password, that is enough too.
Using ssh to securely access your Raspbery Pi
ssh
is a client that interacts with ssh
servers. OpenSSH is used on many Linux distributions to act as the server.
Installing openssh-server
Really, this should already be installed.
sudo apt-get install openssh-server
#debiansudo pacman -S openssh
#archlinux
Set up the client
Creating Keys
The client will use a pair of public/private keys for authentication. It is important that you safeguard the key. You will provide others with your public key.
ssh-keygen -t rsa -b 4096
You will be asked what to name this keypair. In this example, we will use pi-rsa
, which will create pi-rsa
and pi-rsa.pub
. It is important to understand that the file without any extention is to be kept private, while the .pub must be given to others.
[meLon@freyja] ~$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/home/meLon/.ssh/id_rsa): /home/meLon/.ssh/pi-rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/meLon/.ssh/pi-rsa.
Your public key has been saved in /home/meLon/.ssh/pi-rsa.pub.
Configuring ssh
Next, you'll define a Host and how to connect to it (your pi).
vim ~/.ssh/config
>
Host rpi
Hostname 192.168.1.115
User pi
PubKeyAuthentication yes
IdentityFile /home/meLon/.ssh/pi-rsa
ForwardX11 yes
IdentitiesOnly yes
ForwardAgent no
Setting up your key as your credentials
Now, you'll need to give the public key to the server on which you wish to authenticate. This is done by adding the public key to the remote server's authorized_keys
for the user. It is found in ~/.ssh/authorized_keys
. Each key is a single-line, and can be edited manually, or via ssh-copy-id
.
ssh-copy-id -i /home/meLon/.ssh/pi-rsa.pub rpi
Because we set up and defined rpi
in our ~/.ssh/config
file, it will connect to the Raspberry Pi.
Removing PasswordAuthentication from your server
It is recommended that you use keys to authenticate over ssh, and it is very easy to disable passwords now that you've set up your key. Remember, this is back on the Raspberry Pi itself.
sudo vim /etc/ssh/sshd_config
Find PasswordAuthentication and make sure it says:
PasswordAuthentication no
Connect to your Raspberry Pi
ssh rpi
ssh some_user@rpi
Send a file to your Raspberry Pi
scp ~/Downloads/download.iso rpi:
# To home directoryscp ~/Downloads/download.iso rpi:Downloads/
# To Downloads in homescp ~/Downloads/download.iso rpi:/home/meLon/Downloads/
# Full pathscp -r ~/Downloads/ rpi:
# Recursively send the directory
Notes
- Make sure you've changed the
pi
account's password. This can be done via a terminal withpasswd
. - This should be good for a LAN, but if you're going to be accessing this from the Internet, you might want to learn a little more to secure your pi.
A simple way to enable secure Web or SSH access to your Raspberry Pi without port forwarding is using a relay service like https://ngrok.com/ or https://pagekite.net/ or https://yaler.net/
-
If I understand it correctly then these relay services need a client software running behind the firewall, which keeps a tunnel open to the relay server operated by the service provider. Incoming requests to the machine behind the firewall (i.e. requests from the public internet) are routed from this relay server to the client software running behind the firewall. – user1364368 Jul 27 '16 at 10:01
-
Exactly. The "client software" on the device is quite small and the initial handshake between it and the relay is transparent to the local server listening to localhost. – tamberg Jul 28 '16 at 16:42
I think setting up VPN may be an overkill. But it also depends on what you want to do. If you let us know what your purpose is, we may be able to help better.
With SSH I am able to do most things I want do remotely on my RPi. Just to expand on ppumkin's answer, here is a quick work flow for you (of course you may already know this but may help others):
- Setup SSH on RPi (I recommend changing the default SSH port 22 to something else for security). We will call it ZZZZ.
- If you have not already done so, change the username and especially password to something strong. Many RPi distros come with default usernames and passwords.
- Restart your RPi.
- Setup port forwarding on your router or gateway - direct the SSH port number to Raspberry Pi's internal ip address
- If you have a domain name pointed towards your network's external IP you can use that host or use the external IP. Connect through SSH using host (domain or external IP), SSH port number, username and password. On Windows you could use PuTTY. To access files, you could do SFTP through Filezilla.
-
Thank you both for your answers It’s helping me a lot My purpose is simple. My Raspi is taking every day a video on a far away site and sending it to me via Dropbox. It’s working well. But I wish to be able from my main place outside through internet to intervene from time to time to change certain parameters and view other snapshots taken by the Raspi. My Raspi would be the server and my laptop and tablet the only clients. I think I don’t need OpenVpn for that. But through SSH changing the port and with strong password as you suggest will it be secure enough? – user3315730 Apr 7 '14 at 14:25
-
Well the best would be with SSH keys and with a strong passcode too. That in my opinion will give you the strongest protection. But I have had a just a strong password with no keys on my home server for 6 years now without any security issues. – SmartHomeBeginner Apr 7 '14 at 16:00
If you want to be paranoid you can have 2 factor authentication using Google Authenticator app.
Read more here http://www.raspberrypi.org/forums/viewtopic.php?f=29&t=61993
Maybe not the simplest way - but I found certificates more difficult.
I can also report that I have detected the scanners are now occasionally using user 'pi' when attempting ssh to my webserver. Unfortunately I cannot change the port number there, but I do block the source IP after two failed attempts.