Termux Shell over ADB+PuTTY

[lars18th]

READ MORE: The connection problem is (partially) solved. This connection works! #2565 (reply in thread)

Hi,

I want to share with you my research about this objective:

Connect to the Termux environment from a PuTTY client, with these restrictions:

• No previous launch of the Termux App.
• Connect using the ADB protocol.
• Client is PuTTY with all of the SSH protocol functionalities active.

First of all why all of these restrictions?

1. Launching the Termux it's a pain in several scenearios. And having it running in the background consumes energy. So, if you can simple connect to it when you want it's preferable. This can be done using ADB and the run-as command.
2. Using the ADB protocol you don't need to open any listening socket (even if you could use it over TCP). So only using one USB cable you can connect to your target device fast and clean.
3. When using the PuTTY client you have all of the useful functionalities provided by the SSH protocol. In particular, you don't need to set any fake password (stored in your filesystem) or run any daemon. The ADB security applies, and it could be sufficient for you.

Then, how you can do all of this? Here the example command:

plink -ssh-connection adb -proxycmd "adb shell -e none 'run-as' 'com.termux' '/data/data/com.termux/files/usr/bin/psusan'"

If you don't know anything about this line, then this topic is not for you (sorry!). In any other case, let me to explain more about:

• You need to install a recent version of Termux from the github compiled in debug mode. That's mandatory to use the run-as command.
• Inside your Termux environment you require to have the psusan tool. You can install it with pkg install putty-tools after adding the "x11" repository with pkg install x11-repo (don't worry, even it's inside the X11 repo, you don't need to install any graphical library).
• This works on Linux and Windows too, so if you change to plink.exe and adb.exe it will work as well.
• And this works too with the graphical PuTTY client, however it's more easy to check it in the command line with the console only plink tool. But the final goal is to use the PuTTY client, and it works identical as the command line version (tested!).

And how it works?

• You are launching the new psusan tool inside the Termux environment. This works clean over the ADB protocol launching the tool with the run-as mode. So it's as request. You don't need to run anything special in the device. Just access to the console. And this new tool from PuTTY it's just encapsulating the upper-layer SSH protocol without encryption over the ADB chain opened. On top of this communication you could launch terminal sessions, redirect ports and use scp commands.

However, whats the problem?

• The first advise is that all communication is clean. So you need to know that if you capture the traffic (you could enable it with -sshrawlog) then you will see all what you type, including passwords. So it's more or less like the ancient TELNET protocol. Be aware!
• The second problem is that the communication seems to be not perfectly clean. After I start to type in the new shell, the communication is lost. However, if I open a Socks4 server (Dynamic forward), then I can connect to it, and it seems to start to work... but after some packets it seems to stall the data. So, finally you receive the error Event Log: Invalid packet length received and the communication is lost.
  • I have done an additional test with plink -ssh-connection adb -proxycmd "adb shell -e none 'run-as' 'com.termux' '/data/data/com.termux/files/usr/bin/bash' '-c' 'export SHELL=/data/data/com.termux/files/usr/bin/bash; /data/data/com.termux/files/usr/bin/psusan'", because I feel the default shell launched by the psusan tool is the $SHELL one. And it works, but the problem continues.

The log of the communication indicates that at some point the low level RAW data interchanged over the ADB tunnel seems to be stalled. And I can't go further. So I ask if you want to help me to advance in this objective.

So please, post what you want/test/feel about this.
Regards.

[lars18th]

Hi,

In the meantime if you want to do what I've described but without the SSH extensions (port forwarding, scp, etc.) you can do it now:

• Just configure all as described and configure the pterm.exe tool with this command: "C:\Program Files\PuTTY\pterm.exe" -e "C:\ADB\adb.exe" "shell" "-e" "none" "-t" "-t" "run-as" "com.termux" "/data/data/com.termux/files/usr/bin/bash"
  This will start the Bash shell of Termux directly without touching anyting in your device, and using the good PuTTY interface.

Regards.

[lars18th]

Hi,

Finally I discovered that the problem is the ADB.EXE binary. This version for Windows seems to be not very clean passing 8-byte data. So changing the ADB from the Windows version to a WSL version (I'm using the lightweight version from Alpine in WSL-1) then I can connect using the SSH protocol. 😄

Here my command line using the PuTTY graphical terminal:

"C:\Program Files\PuTTY\putty.exe" -ssh-connection -proxycmd "wsl -d Alpine /usr/bin/adb shell -e none 'run-as' 'com.termux' '/system/bin/sh' '-i' '/data/data/com.termux/termux.login'" adb

And the file /data/data/com.termux/termux.login contais this:

export SHELL=/data/data/com.termux/files/usr/bin/bash
exec /data/data/com.termux/files/usr/bin/psusan

I need to use this helper script termux.login because the psusan tool launches the PTY using the SHELL environment variable. So, we need to set it before calling to it. This is the objective of this script. Without this variable changed the default Android shell will be launched (/system/bin/sh).

Futhermore, if you want to execute your ~/.bashrc file automatically. Please, take note that the Termux ADB Shell "run-as com.termux" environment is using the HOME /data/data/com.termux/, but the bash binary from Termux is looking inside HOME /data/data/com.termux/files/home. So I recommend to link the first to the last. Then you can share this file between your regular Termux App Shell and the Termux ADB Shell (run-as version).

In a future version perhaps this Termux ADB Shell may become official. Then some scripts will be provided in stock. And you can use the tool without any modification/change from your side.

Also, at time the use of the SFTP seems to be broken. I'll check more for it.
Regards.

[lars18th]

I forgot to mention it: If someone found a version of the ADB.EXE binary for Windows without this error, then please share it.

And another advise: When you want to run the adb from WSL, you need to know that: 1) Use only WSL-1, because WSL-2 is not sharing the same network. 2) You need to first launch the daemon from Windows. So start the Windows version with adb.exe devices. And after that the adb from WSL-1 will work connecting to your devices until you close your Windows session.

And finally, if you want to check the new SSH connection try this:

• Connect to your smarphone using this technique from PuTTY. Remember that the connection is done using ADB only .
• In the PuTTY configuration open the forwarding ports and create a dynamic port (i.e.1080).
• Configure in your Windows Browser the Socks4 port 127.0.0.1:1080 as your PROXY.
• Disable the WIFI in your smartphone and check from the Browser your IP Address.
  😆 😆 😆

And remember: You aren't running servers/daemons in your Android device. And you don't need to set passwords or certificates.

[lars18th]

Hi,

I need more info from you. Who is setting the environment vars like SHELL, LD_PRELOAD, TERMUX_*, etc. when we open the Termux App?

At time I have this data in my /data/user/0/com.termux/.bashrc:

export PATH=/data/data/com.termux/files/usr/bin:$PATH
export LD_PRELOAD=/data/data/com.termux/files/usr/lib/libtermux-exec.so

And then the content of env in the Termux App terminal shell and the ADB shell is different.

So I want to know if I can call to some script to set standard vars directly, or in contrast I need to copy the vars manually from the Termux App terminal to this file.

[lars18th]

It won't be imported by the app itself. It would only be for script usage, do what you want with it.

Hi @agnostic-apollo ! Any advance on this?

[agnostic-apollo]

It's on the to-do list and will probably be done before next release. Currently, other things are being worked on.

[lars18th]

Hi @agnostic-apollo ,

That's more than sufficient for me! Thank you for the work done on this amazing project of Termux. 👍

[agnostic-apollo]

You are welcome.

[agnostic-apollo]

@lars18th Check 03e1d14

You can grab latest github build from https://github.com/termux/termux-app/actions/runs/2509680073

https://github.com/termux/termux-app#Installation

[lars18th]

Hi @agnostic-apollo ,

After reading your comments at https://www.reddit.com/r/termux/comments/ynfpat/adb_shell_to_termux_directory/
I want to improve the connection to the Termux environment (using the last working support of source /data/data/com.termux/files/usr/etc/termux/termux.env) using the ADB+PSUSAN mode. I feel it very robust and powerful. Mainly because you don't need to enable any password or listening server. Therefore the security is the stock Android over ADB access.

However, I need you help about some questions:

• When running run-as com.termux from the ADB shell, the default shell in Termux is launched (bash). Any option to pass an specific shell? My objective is to execute the source script. And I want to do this not in all cases with the same default, but selecting the target shell+script.
• It will be possible to accept/reject the command run-as com.termux based on the current state of the lock screen? This is what the Android USB access does. So only when the device is unlocked you can access to the storage. What do you think about support something similar to this?
• Another question is if the non-debug releases will support some type of the run-as com.termux command. Any idea?

Please take note that my objective is to provide another mainstream Remote Access (https://wiki.termux.com/wiki/Remote_Access) using the combination of stock ADB plus the PSUSAN protocol.

[lars18th]

Hi @agnostic-apollo ,

Thank you for the explanation. I think the future suport for ssh will be useful. More or less because it will be controlled by the user. For example, I have the assumption that you will enable the starting of the ssh daemon (/data/data/com.termux/files/usr/bin/sshd) only over certains circunstances. For example, if the user has opened the App; of if the user has launched a Quick Panel button; or if he has started a background service. That's the idea?

However, I have the suggestion to not support only the sshd daemon. For example, in order to support the PSUSAN protocol, the Termux requires to launch this process over a PIPE. Regarding the psusan protocol, think on it as SSH-without-security. That's no password and no encryption. This is interesting if: the authentication is done using other techniques (the ADB access could be controlled); and the channel is secure (it could be or not, you decide: for example, you can enable it on-top using ssh without autentication). But over the wire you don't really need it. So then it's more fast and less complex. Therefore, what you need to provide is some access like run-as com.termux '/data/data/com.termux/files/usr/bin/psusan'. In this mode I'm connecting using PuTTY over ADB to my Termux environment.

I hope you want to support this alternative access mode.
Regards.

[agnostic-apollo]

All that will be run is a main.sh shell script in a background app shell in Application class before any activity or services are started. Do whatever custom things you want in it. App won't run ssh itself.

[lars18th]

Hi @agnostic-apollo ,

I've tested about using custom compiled static version of psusan. So, I need to know if some update exists related to the main.sh shell script. Could you please comment on this? Thank you.

[agnostic-apollo]

That will be pushed along with rest of the changes and is still being worked on, more broken stuff came up to fix before release.

[lars18th]

Ok. Don't worry. Thank you for the feedback.