How to SSH to DM800 with RSA Key Authentication

P

packetstormer

Regular Member
My Satellite Setup
1.1m Triax dish, TM2300 motor. 2 x DM800HD, 1 DM500, 2 x Sly HD. 1 60cm fixed (Astra 2D).
My Location
Ireland
I had been searching everywhere for information on how to disable SSH password prompts and only allow access with a Private Key. There seems to be a lot of information suggesting performing a LOT of unnessacary tasks.

The benifit to running SSH to you Drembox is that you can securly connect (unlike Telnet which sends username/password in cleartext) and tunnel any traffic through the secure tunnel - Streaming etc.

Below is a simpy few steps on how to get this up and running. This was tested on a BH0.12 image. I would image DreamElite is the same, I have that on my other box and will test that too.

There is a good chance other images have slightly different compilations of Dropbear so I can't say this will work on them

  1. Telnet to the Dreambox and login as the root user.
  2. If you have not already done so type: passwd and enter a new root password
  3. type cd /home/root
  4. type mkdir .ssh
  5. Next, leave the Telnet session open and jump to you browser and download PuttyGen (httx://www.chiark.greenend.org.uk/~sgtatham/putty/download.html).
  6. Run PuttyGen, enter a passphrase and click the Generate button. Move the mouse around the screen to randomly generate your key
  7. NOTE: You don't have to use PuttyGen to generate your key, you can use other usual methods such as the CLI on the DM and run dropbearconvert. PuttyGen is by far the easiest
  8. Once PuttyGen has finished generating the key click the "Save Private Key" button and save the ppk file to a safe location - you will need this later to connect via SSH
  9. Jump back to telnet session you have open and type cat > /home/root/.ssh/authorized_keys
  10. When you press enter the screen will jump to the next line and wait for text to be inputted
  11. From the PuttyGen app select all of the private key and then copy
  12. Right click inside the telnet session to paste the contents of the key
  13. Press Return the CTRL+D to exit from the command
  14. Type cat /home/root/.ssh/authorized_keys and check the output to make sure the key pasted correctly.
  15. You can now test the connection - try Putty from Windows making sure you select the SSH->Auth option and pointing the app to the private key you saved away earlier
  16. At this stage you should get connected and prompted for the passphrase you setup earlier.
  17. If the connection works correctly you may now want to disable SSH from accepting any connects that don't use key authentication. This will not effect your telnet connection
  18. From you Windows/Linux box ftp to the Dreambox
  19. cd /etc/init.d
  20. bin
  21. hash
  22. get dropbear
  23. Exit the ftp session
  24. Copy the dropbear file to another file as a backup then open the dropbear file in an editor, I used WinVi
  25. Find the line "DROPBEAR_EXTRA_ARGS=" and make it look like the next line
  26. DROPBEAR_EXTRA_ARGS="-s -g"
  27. Save the file and ftp it back to the Dreambox to the same location
  28. Telnet into the Dreambox and issue this command: /etc/init.d/dropbear restart
  29. You should now configure your ISP router to only allow SSH to your Dreambox, disabling Telnet, HTTP etc.
  30. You can now securly SSH into the Dreambox and tunnel any traffic you might need through the connection.
  31. None of the above changes will change any Telnet session and you should still be able to Telnet from within your LAN
 
Hi @packetstormer,

Excellent work! You have now covered what I could not for the modern boxes. With my how-to for the DM7000 and now yours for the DM800 most people should be able to get a secure shell remote connection to their box.

The one extra thing you have not mentioned is that I recommend not using port 22 as this still attracts a lot of unwanted attention from Asian IP's. They will not get in due to rsa key validation but it puts a lot of traffic, with their log-in attempts, on your router. Since I moved my dropbear ssh port to an obscure high numbered port, my router is as quiet as a mouse!

Here is a link to the main part of my DM7000 write up but there are about 3 pages in the thread that deal with how I got it working plus downloads for DM7000 implementations of dropbear that allow tunneling:
http://www.satellites.co.uk/forums/...72686-remotely-login-dreambox.html#post918566

Best wishes, John.
 
Back
Top