Disclaimer 1: I ran all of this from an iPhone 8 Plus with the following specs
- iOS 15.4
- Alpine 13.4
- Version 1.2.3
Disclaimer 2: ssh server will not run on iSH while the app is closed/running in the background.
Setup - iSH as ssh server on your local network
When you first install iSH, you begin as root. If you wish to create a new user:
adduser -g "Your Full Name" <username>
then enter a password.
As root, you add a password by running
echo ‘yourpassword’ | chpasswd
Assuming you wish to give doas (like sudo) privileges to your new non-root user:
as root...
apk add doas
modify the /etc/doas.conf file with the line:
permit _yourusername_
close and reopen the app, then login as user
alternatively you can uncomment the line
permit persist :wheel
then add your user to the wheel group
adduser <username> wheel
To make your host keys, run the following as root:
ssh-keygen -A
At this point, modify your /etc/ssh/sshd_config file to prevent root login. Ensure you have the lines (uncommented)
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication yes
Disclaimer 3: if you fail to login as your non-root user, thenPermitRootLogin yes and troubleshoot with the following:
ssh username@localhost -vvv
Alpine uses openrc as its init program, which will manage the startup of your sshd service for each new iSH session.
check to see that your sshd daemon is running
rc-status default
To find your IP, go into your iPad's Wi-Fi settings, tap the 'i' info circle next to your network name, and find your IPv4 address.
Now from your client device
ssh iSHusername@iSHipaddress
You can setup key-based authentication for more secure access
ssh-keygen -t ed25519
_enter an absolute path to your client .ssh folder and a passphrase (optional)_
- Copy the public key to your host machine.
ssh-copy-id -i *pathtopubkey* iSHusername@iSHipaddress
- Reload sshd service
rc-service sshd reload
Confirm the service is running
rc-status default
_you should do this everytime you make changes to the config files_
iSH as ssh-client (localhost)
In your iPhone settings, make sure iSH has access to the local network, then
ssh hostuser@hostipaddress
Setup - ssh from WAN (open internet)
_Setup port forwarding on your router
- Something like:
- Source Port: 22 (port of client device, unless modified)
- Forwarding port: 443 (many routers allow ssh traffic via this port)
- Destination port: 22 (port where ssh server is listening)
Configure your firewall on the server machine if necessary
- in ufw
- sudo ufw allow from clientipaddress to any app OpenSSH
- sudo ufw reload
Connect using dynamic port forwarding
ssh -D 443 username@routeripaddress
rerun the command with -vvv option to debug in the event of failure
Sources:
https://wiki.alpinelinux.org/wiki/OpenRC
https://github.com/ish-app/ish/wiki/Running-an-SSH-server
https://www.youtube.com/watch?v=AtuAdk4MwWw
man pages for ssh-keygen, ssh, sshd, sshd_config, ssh-copy-id