EBC Exercise 16a ssh port number

If you leave your Beagle on a publicly exposed network (like Rose's) long you'll soon see login attempts from all over the world.

Here you'll learn how to see those attempts and how to change your ssh port number to avoid them.

journalctl
A quick way to see if anyone's been trying to access your Beagle is: bone$ journalctl | grep ssh Jul 22 14:17:11 pocket sh[936]: generic-board-startup: ssh Jul 22 14:17:13 pocket sshd[964]: Server listening on 0.0.0.0 port 22. Jul 22 14:17:13 pocket sshd[964]: Server listening on :: port 22. Jul 22 14:24:02 pocket sshd[2328]: Connection closed by authenticating user debian 192.168.7.1 port 47886 [preauth] Jul 22 14:24:02 pocket sshd[2330]: Accepted publickey for debian from 192.168.7.1 port 47888 ssh2: RSA SHA256:kkATqhiwy+v8EzXzJSV3jSrVEam/L+NF2yl8GFdvOBI Jul 22 14:24:02 pocket sshd[2330]: pam_unix(sshd:session): session opened for user debian by (uid=0)

Here you see normal activity. I logged in as debian using the publickey that was setup with.

Now try logging in as an invalid user. Here I tried  from the host. bone$ journalctl | grep ssh Jul 22 15:38:10 pocket sshd[2507]: Failed password for invalid user yoder from 192.168.7.1 port 47942 ssh2 Jul 22 15:38:16 pocket sshd[2507]: Connection closed by invalid user yoder 192.168.7.1 port 47942 [preauth]

The login is rejected. One time I left a Beagle running with an externally accessible IP address. Within a day there were dozens of login attempts. A quick way to see them is: bone$ journalctl | grep -i invalid Jul 22 15:38:04 pocket sshd[2507]: Invalid user yoder from 192.168.7.1 port 47942 Jul 22 15:38:10 pocket sshd[2507]: Failed password for invalid user yoder from 192.168.7.1 port 47942 ssh2 Jul 22 15:38:16 pocket sshd[2507]: Connection closed by invalid user yoder 192.168.7.1 port 47942 [preauth]

Make sure you don't use an easy to guess password. You know they'll try debian as a user.

Changing the port the ssh server listens on
You can easily change the port the ssh server listens on. By default it on port 22, so everyone will try it. Change the port using:

bone$ sudo vi /etc/ssh/sshd_config Scroll to around line 13 and you'll see: #Port 22 Remove the # and change the 22 to something greater than 1000, say 1022. Then bone$ sudo systemctl restart sshd Now, what you login from your host you'll have to say which port to use: host$ ssh -p1022 bone

Changing the port ssh uses
If you forget to add the -p1022 you'll get an error. But you can change which port ssh will used. Edit the file ~/.ssh/config and add the following:

Host   192.168.7.2 Port   1022 User   debian UserKnownHostsFile /dev/null StrictHostKeyCHecking no Host    bone Port   1022 User   debian UserKnownHostsFile /dev/null StrictHostKeyCHecking no The first entry says if the does: host$ ssh 192.168.7.2 then use port 1022 and user name debian The second entry is the same for host$ ssh bone