2

After installing ssh server on my remote machine (which runs embedded Linux), I tried to connect to ssh server from host machine but it failed.

This is because I could not specify user account when connecting to ssh-server (ssh connection requires to enter password of an account) since my target embedded Linux does not have /etc/passwd and /etc is not writable. Thus there are no user accounts on that system.

Do we have alternative ways to connect to ssh-server on remote machine from host machine? I want to log in as the root user.

This question is a follow-up to my previous question How to check my account on embedded linux without "/etc/passwd"?

  • If there are no accounts on the remote machine, what exactly do you expect to happen when you connect? – Andrew Stubbs Jul 30 '14 at 7:39
  • Do you want to log in as root? – lgeorget Jul 30 '14 at 7:48
3

Dropbear calls the getpwnam standard library function to get information about user accounts. On systems with GNU libc (the standard library for non-embedded Linux systems), this function can query several types of databases through the NSS mechanism, including /etc/passwd. Embedded systems may run a variety of libc (uClibc, dietlibc, …), and they tend to have the path /etc/passwd baked in.

Short of patching and recompiling dropbear (or your libc), you're going to have to supply that /etc/passwd file somehow. There are ways to make extra files appear on top of a read-only filesystem, not by modifying the filesystem, but instead by instructing the kernel to supply files from a different filesystem at these locations. The generic mechanism is a union mount, but embedded Linux systems often lack a good union mount feature.

A relatively simply way to override a filesystem location with different content is mount --bind. After running the command mount --bind /else/where /some/where, any access to a file/some/where/somefileactually accesses the file/else/where/somefile; any file in the “true”/else/whereis hidden. However, you cannot directly make a file appear this way: both/else/whereand/some/wherehave to exist (although they don't have to be directories). So you can't make/etc/passwdcome into existence, but you can override/etc`.

  1. Create a directory that will contain your replacement for /etc. Let's say it's /custom/etc.

    mkdir /custom/etc
    
  2. Create a mount point where you'll relocate the original /etc/.

    mkdir /custom/original-etc
    
  3. Create symbolic links in the replacement etc to files in the original.

    cd /etc
    for x in *; do ln -s "../original-etc/$x" "/custom/etc/$x"; done
    
  4. Create a passwd file in your replacement etc hierarchy.

    echo "root:x:0:0:root:/:/bin/sh" >/custom/etc/passwd
    

At boot time, first perform a bind mount to create a view of the original /etc hierarchy at /custom/original-etc, then perform a bind mount to create a view of your replacement /etc at /etc. Put these commands in a script that is executed during startup (the same script where you start the dropbear server, obviously before starting dropbear).

mount --bind /etc /custom/original-etc
mount --bind /custom/etc /etc
  • probably /etc/fstab would be a pretty convenient way of configuring a boottime mount option? – mikeserv Jul 31 '14 at 1:57
  • 1
    @mikeserv Well, yes, if you could modify /etc in the first place. It's the read-only /etc that requires this whole rigmarole. – Gilles 'SO- stop being evil' Jul 31 '14 at 1:59
  • You can - maybe in initramfs. Still, that is not a remark on the quality of this answer - which is excellent. Though, these days there is nothing you can do with a union mount that you cannt do with mount namespaces and private/shared/bind mounts and the rest. – mikeserv Jul 31 '14 at 2:11
  • Before you answered, I first tried to modify dropbear src by writing fake getpwnam. However, dropbear din't work on my device since it additionally requires /etc/group file, which is used by initgroups function in dropbear src. Thus I decided to use your approach, and it works! Thank you so much! – kolar Aug 2 '14 at 3:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.