Saturday 19 January 2013

Setting up QNAP to accept ssh connection from different users

This is a pain to do, and I always seem to forget one switch to turn on 1 file to set up 1 permission to configure. Always the same every time I need to do it. Well I have put together a few links that I have found useful and a few procedures I have found helpful to understand why a connection fails. :-)

So the steps and links I used are:

  1. For setting up new ssh software on the QNAP NAS I used this link: http://blog.jameslick.com/?p=1090 brilliant, excellent! worked for me and my model. I imagine it would be a slight tweak for other models if they have different names for equivalent mounts.
  2. Then I set up the users paths in /etc/passwd on the NAS box of the users.
  3. Setting up the ssh keys, omg! I used this link: http://superuser.com/questions/8077/how-do-i-set-up-ssh-so-i-dont-have-to-type-my-password. So I worked out the public key goes on the NAS box in the authorized_keys file in the user .ssh directory of the user, e.g. /home/JoeBloggs/.ssh/authorized_keys  <-- This user home path should be the same as what you specified in the /etc/passwd file. BE CAREFUL - When copying the public key that it doesn't gain spaces on the copy paste route, it needs to be as it is in the generated file (from point 1) You can add more than one key to this file for this user, if the same user connects from different machines, you can generate another key from the other machine and add the public key of that one to the same authorized_keys file. You press ENTER after the first one and then paste in the new one.
  4. Configure the sshd_config file this is in the location(s) specified in the link 1, don't forget to update both configs otherwise on reboot you will get your old one back. You can set up the config file with the users that are required to access via ssh.
    1. So there is a section to describe where to find the authorized keys file, and you can configure it to go to the home path of the user that tries to connect, using (I believe %h means the home directory of the user connecting, but I am not 100% sure): 
      • AuthorizedKeysFile %h/.ssh/authorized_keys
    2. There is also a section to allow certain users: 
      • AllowUsers JoeBloggs Fred
  5. There are also special permissions allowed only to the authorized_keys files which I found in this link: http://recursive-design.com/blog/2010/09/14/ssh-authentication-refused/
  6. Any problems that occur, when you test to connect to ssh JoeBloggs@<yourIP> you can run the ssh with a -v that can output much information that can give clues in why it fails.
  7. Also you can run the QNAP sshd manually with sshd -d and then connect from the client and watch the debug output that can give clues also :-). To do this I would stop the ssh service in the QNAP web client. Then locate the sshd on the QNAP, it is usually at /usr/sbin/sshd, so you will have to execute with full path specified e.g. /usr/sbin/sshd -d and this should then start up the daemon ready for connections.
  8. One more thing! If you want to map a network drive on a linux box to your QNAP, you will need to turn on the sftp option when turning on your ssh option in the web client of your QNAP box. You can also do this drive mapping nicely with sshfs JoeBloggs@<YourIP>:<Directory you want to go too on the QNAP> <Directory you want to map too on local computer> The "Directory you want to go too on the QNAP" default is your home directory of that user, so if you need somewhere out of that (and make sure you have permisions for the user set up on the QNAP), you have to specify a relative path from your home directory, e.g. sshfs JoeBloggs@<YourIP>:../../SomeSpecialData /home/JoeBloggs/SomeSpecialData
Ok I think that's it for now.

Hope it will help someone, again it will help me when I need to do this again :-)

3 comments:

  1. It does not like the default key type, I had to tell it to use dsa ssh-keygen -t dsa
    Thanks for the useful hint about -v on the ssh login

    ReplyDelete