2

After installing ssh server on my remote machine (which runs embedded Linux), I tried to connect to ssh server from host machine but it failed.

This is because I could not specify user account when connecting to ssh-server (ssh connection requires to enter password of an account) since my target embedded Linux does not have /etc/passwd and /etc is not writable. Thus there are no user accounts on that system.

Do we have alternative ways to connect to ssh-server on remote machine from host machine? I want to log in as the root user.

This question is a follow-up to my previous question How to check my account on embedded linux without "/etc/passwd"?

2
  • If there are no accounts on the remote machine, what exactly do you expect to happen when you connect? Jul 30, 2014 at 7:39
  • Do you want to log in as root?
    – lgeorget
    Jul 30, 2014 at 7:48

1 Answer 1

4

Dropbear calls the getpwnam standard library function to get information about user accounts. On systems with GNU libc (the standard library for non-embedded Linux systems), this function can query several types of databases through the NSS mechanism, including /etc/passwd. Embedded systems may run a variety of libc (uClibc, dietlibc, …), and they tend to have the path /etc/passwd baked in.

Short of patching and recompiling dropbear (or your libc), you're going to have to supply that /etc/passwd file somehow. There are ways to make extra files appear on top of a read-only filesystem, not by modifying the filesystem, but instead by instructing the kernel to supply files from a different filesystem at these locations. The generic mechanism is a union mount, but embedded Linux systems often lack a good union mount feature.

A relatively simply way to override a filesystem location with different content is mount --bind. After running the command mount --bind /else/where /some/where, any access to a file/some/where/somefileactually accesses the file/else/where/somefile; any file in the “true”/else/whereis hidden. However, you cannot directly make a file appear this way: both/else/whereand/some/wherehave to exist (although they don't have to be directories). So you can't make/etc/passwdcome into existence, but you can override/etc`.

  1. Create a directory that will contain your replacement for /etc. Let's say it's /custom/etc.

    mkdir /custom/etc
    
  2. Create a mount point where you'll relocate the original /etc/.

    mkdir /custom/original-etc
    
  3. Create symbolic links in the replacement etc to files in the original.

    cd /etc
    for x in *; do ln -s "../original-etc/$x" "/custom/etc/$x"; done
    
  4. Create a passwd file in your replacement etc hierarchy.

    echo "root:x:0:0:root:/:/bin/sh" >/custom/etc/passwd
    

At boot time, first perform a bind mount to create a view of the original /etc hierarchy at /custom/original-etc, then perform a bind mount to create a view of your replacement /etc at /etc. Put these commands in a script that is executed during startup (the same script where you start the dropbear server, obviously before starting dropbear).

mount --bind /etc /custom/original-etc
mount --bind /custom/etc /etc
4
  • probably /etc/fstab would be a pretty convenient way of configuring a boottime mount option?
    – mikeserv
    Jul 31, 2014 at 1:57
  • 1
    @mikeserv Well, yes, if you could modify /etc in the first place. It's the read-only /etc that requires this whole rigmarole. Jul 31, 2014 at 1:59
  • You can - maybe in initramfs. Still, that is not a remark on the quality of this answer - which is excellent. Though, these days there is nothing you can do with a union mount that you cannt do with mount namespaces and private/shared/bind mounts and the rest.
    – mikeserv
    Jul 31, 2014 at 2:11
  • Before you answered, I first tried to modify dropbear src by writing fake getpwnam. However, dropbear din't work on my device since it additionally requires /etc/group file, which is used by initgroups function in dropbear src. Thus I decided to use your approach, and it works! Thank you so much!
    – kolar
    Aug 2, 2014 at 3:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .