Disclaimer 1: I ran all of this from an iPhone 8 Plus with the following specs
- iOS 15.4
- Alpine 13.4
- Version 1.2.3
Disclaimer 2: ssh server will not run on iSH while the app is closed/running in the background.
Setup - iSH as ssh server on your local network
When you first install iSH, you begin as root. If you wish to create a new user:
adduser -g "Your Full Name" then enter a password.
As root, you add a password by running
echo ‘yourpassword’ | chpasswd
Assuming you wish to give doas (like sudo) privileges to your new non-root user:
as root...
apk add doas
- modify the /etc/doas.conf file with the line:
permit yourusername
- close and reopen the app, then login as user
- alternatively you can uncomment the line
permit persist :wheel
- then add your user to the wheel group
adduser wheel
To make your host keys, run the following as root:
ssh-keygen -A
At this point, modify your /etc/ssh/sshd_config file to prevent root login. Ensure you have the lines (uncommented)
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication yes
Disclaimer 3: if you fail to login as your non-root user, thenPermitRootLogin yes and troubleshoot with the following:
ssh username@localhost -vvv
Alpine uses openrc as its init program, which will manage the startup of your sshd service for each new iSH session.
if you need to download openrc:
apk add openrc
as root/sudo user, run
rc-update add /usr/sbin/sshd default
then
rc-service sshd start
check to see that your sshd daemon is running
rc-status default
To find your IP, go into your iPad's Wi-Fi settings, tap the 'i' info circle next to your network name, and find your IPv4 address.
Now from your client device
ssh iSHusername@iSHipaddress
You can setup key-based authentication for more secure access
ssh-keygen -t ed25519
_enter an absolute path to your client .ssh folder and a passphrase (optional)_
- Copy the public key to your host machine.
ssh-copy-id -i *pathtopubkey* iSHusername@iSHipaddress
- Reload sshd service
rc-service sshd reload
Confirm the service is running
rc-status default
_you should do this everytime you make changes to the config files_
iSH as ssh-client (localhost)
In your iPhone settings, make sure iSH has access to the local network, then
ssh hostuser@hostipaddress
Setup - ssh from WAN (open internet)
_Setup port forwarding on your router
- Something like:
- Source Port: 22 (port of client device, unless modified)
- Forwarding port: 443 (many routers allow ssh traffic via this port)
- Destination port: 22 (port where ssh server is listening)
Configure your firewall on the server machine if necessary
- in ufw
- sudo ufw allow from clientipaddress to any app OpenSSH
- sudo ufw reload
Connect using dynamic port forwarding
ssh -D 443 username@routeripaddress
rerun the command with -vvv
option to debug in the event of failure
Sources:
https://wiki.alpinelinux.org/wiki/OpenRC
https://github.com/ish-app/ish/wiki/Running-an-SSH-server
https://www.youtube.com/watch?v=AtuAdk4MwWw
man pages for ssh-keygen, ssh, sshd, sshd_config, ssh-copy-id