Feature Suggestion - Including Dropbear and Network by default

[sm-tradeboox]

Hello.

I would like to suggest that you include Dropbear in ZBM builds by default. Dropbear and network could be enabled/configured via the commandline. If the ZBM EFI also includes gdisk (not needed if the disk is already formatted), then installing any new OS via chroot would be a breeze. And pretty much makes all the complicated installation instructions provided by OpenZFS redundant.

[ahesford]

The ZFSBootMenu recovery image includes basic networking, including dhclient. A case could be made for inclusion of an SSH client, but including Dropbear in a release or recovery image is a different matter. To be useful and somewhat secure, an SSH server should have host keys that are machine specific and not widely publicized. A means to authenticate access is also required. We don't intend to ship images with unlocked root accounts, making key-based authentication the only advisable approach; it is obviously not possible to make key-based authentication feasible in publicly distributed images.

For remote access via SSH, a custom ZBM image will always be required.

[sm-tradeboox]

Perhaps directions on how users could add their own keys, etc. or add dropbear/tinyssh to the image? I've managed to set it up but I just get a feeling I'm not doing it correctly.

[ahesford]

https://github.com/zbm-dev/zfsbootmenu/wiki/Remote-Access-to-ZBM

[ahesford]

Cf. https://github.com/zbm-dev/zfsbootmenu/blob/master/contrib/remote-ssh-build.sh

[emad-elsaid]

Sorry for reviving this discussion.

• Thank you for the script it simplified the steps significantly. the documentation page was a bit cryptic for me and this is how I found this page.
• I tried the script and so far I see the SSH server is running on port 222 and accepts public key auth but the public key in /dropbear/authorized_keys is not working.
• When I ssh to the server ssh -vvvv [email protected] -p 222 I'm getting unauthorized response [email protected]: Permission denied (publickey). .
• When I inspected the log I noticed the public key is sent but then I'm getting debug3: receive packet: type 51 which I believe code for unauthorized

Here is the full log

OpenSSH_9.3p1, OpenSSL 3.1.1 30 May 2023
debug1: Reading configuration data /home/<username>/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: resolve_canonicalize: hostname 192.168.8.2 is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/<username>/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/<username>/.ssh/known_hosts2'
debug3: ssh_connect_direct: entering
debug1: Connecting to 192.168.8.2 [192.168.8.2] port 222.
debug3: set_sock_tos: set socket 3 IP_TOS 0x48
debug1: Connection established.
debug1: identity file /home/<username>/.ssh/id_rsa type -1
debug1: identity file /home/<username>/.ssh/id_rsa-cert type -1
debug1: identity file /home/<username>/.ssh/id_ecdsa type -1
debug1: identity file /home/<username>/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/<username>/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/<username>/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/<username>/.ssh/id_ed25519 type -1
debug1: identity file /home/<username>/.ssh/id_ed25519-cert type -1
debug1: identity file /home/<username>/.ssh/id_ed25519_sk type -1
debug1: identity file /home/<username>/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/<username>/.ssh/id_xmss type -1
debug1: identity file /home/<username>/.ssh/id_xmss-cert type -1
debug1: identity file /home/<username>/.ssh/id_dsa type -1
debug1: identity file /home/<username>/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.3
debug1: Remote protocol version 2.0, remote software version dropbear_2022.83
debug1: compat_banner: no match: dropbear_2022.83
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.8.2:222 as 'root'
debug3: put_host_port: [192.168.8.2]:222
debug3: record_hostkey: found key type ECDSA in file /home/<username>/.ssh/known_hosts:157
debug3: load_hostkeys_file: loaded 1 keys from [192.168.8.2]:222
debug1: load_hostkeys: fopen /home/<username>/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],ecdsa-sha2-nistp256
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: [email protected],curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: [email protected],ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,[email protected]
debug2: host key algorithms: ecdsa-sha2-nistp256,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes256-ctr
debug2: ciphers stoc: [email protected],aes128-ctr,aes256-ctr
debug2: MACs ctos: hmac-sha1,hmac-sha2-256
debug2: MACs stoc: hmac-sha1,hmac-sha2-256
debug2: compression ctos: [email protected],none
debug2: compression stoc: [email protected],none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:Gc0Cn3foP3sXVy37Y2oyXCV13qpAJq2vZTUPny4AolA
debug3: put_host_port: [192.168.8.2]:222
debug3: put_host_port: [192.168.8.2]:222
debug3: record_hostkey: found key type ECDSA in file /home/<username>/.ssh/known_hosts:157
debug3: load_hostkeys_file: loaded 1 keys from [192.168.8.2]:222
debug1: load_hostkeys: fopen /home/<username>/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '[192.168.8.2]:222' is known and matches the ECDSA host key.
debug1: Found key in /home/<username>/.ssh/known_hosts:157
debug3: send packet: type 21
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug3: ssh_get_authentication_socket_path: path '/run/user/1000/ssh-agent.socket'
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 1 keys
debug1: Will attempt key: /home/<username>/.ssh/id_rsa RSA SHA256:3duiJcZnryzgTvZ9WxE4ih+BcApvnpOfd5Q2wDssPMc agent
debug1: Will attempt key: /home/<username>/.ssh/id_rsa
debug1: Will attempt key: /home/<username>/.ssh/id_ecdsa
debug1: Will attempt key: /home/<username>/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/<username>/.ssh/id_ed25519
debug1: Will attempt key: /home/<username>/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/<username>/.ssh/id_xmss
debug1: Will attempt key: /home/<username>/.ssh/id_dsa
debug2: pubkey_prepare: done
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],rsa-sha2-256,ssh-rsa,ssh-dss>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/<username>/.ssh/id_rsa RSA SHA256:3duiJcZnryzgTvZ9WxE4ih+BcApvnpOfd5Q2wDssPMc agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/<username>/.ssh/id_rsa
debug3: no such identity: /home/<username>/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /home/<username>/.ssh/id_ecdsa
debug3: no such identity: /home/<username>/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/<username>/.ssh/id_ecdsa_sk
debug3: no such identity: /home/<username>/.ssh/id_ecdsa_sk: No such file or directory
debug1: Trying private key: /home/<username>/.ssh/id_ed25519
debug3: no such identity: /home/<username>/.ssh/id_ed25519: No such file or directory
debug1: Trying private key: /home/<username>/.ssh/id_ed25519_sk
debug3: no such identity: /home/<username>/.ssh/id_ed25519_sk: No such file or directory
debug1: Trying private key: /home/<username>/.ssh/id_xmss
debug3: no such identity: /home/<username>/.ssh/id_xmss: No such file or directory
debug1: Trying private key: /home/<username>/.ssh/id_dsa
debug3: no such identity: /home/<username>/.ssh/id_dsa: No such file or directory
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey).

• authorized_keys file looks like so

ssh-rsa <public-key> root@homeserver

• I'm using the EFI image from a USB stick. not sure if this makes a difference.

any pointers is appreciated. I spent a couple of hours already trying to figure out what's wrong but I'm running out of ideas.

[ahesford]

What are the permissions on /root, /root/.ssh and /root/.ssh/authorized_keys? Is there a possibility that SELinux is involved? https://unix.stackexchange.com/questions/709054/ssh-publickey-authentication-failure-receive-packet-type-51-sshd-is-not-accep

[emad-elsaid]

• I dropped into a recovery shell to inspect the permissions

/root drwxr-xr-x
/root/.ssh drwxr-xr-x
/root/.ssh/authorized_keys -rw-r--r--

• I see /root/.ss/authorized_keys contains my public key as expected
• also permissions for /etc/dropbear files are -rw-------
• I'm not sure if there is any logs inside I can follow that gives me a bit more information
• I was able to kill dropbear process. but running it with dropbear -F doesn't dhow any output and the port is not open. when I try to ssh to it from another machine. maybe I can run dropbear in the foreground and follow the logs?

[emad-elsaid]

I was able to run dropbear with this command

dropbear -F -E -a -s -g -p 222

• when I ssh it shows this error

/root/.ssh/authorized_keys must be owned by user or root, and not writable by group or others

so permissions error. the authorized_keys is owned by user 1000 which is also my user id in the machine that generated the EFI image. I guess then I must add something to the script to chown.

I tried to change the file ownership in the recovery shell and sshing worked

chown root:0 /root/.ssh/authorized_keys

thanks for the help. I'm wondering what can I add to the script to change the owner. maybe after copying the file I should run chown or even chown it manually on my machine?

[emad-elsaid]

Changing the file ownership on my machine and rebuilding the EFI image worked. thanks for the help really appreciate it