OpenWrt Forum Archive

Topic: OpenSSH on OpenWRT : how do I add users?

The content of this topic has been archived on 31 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi,

After a first misplaced topic, here is my question again!

I have searched for some time now and since I cannot find anything on it, I try the topic here!

Context is the following : at work, there is a very annoying proxy that keeps me from accessing some sites (yes, porn among those but I actually do not attempt to access them from work wink ) including FTP and some I could use accessing.
So, I tested a SSH tunnel to a friend's machine running a SSH server (under Cygwin) and, using his connection at home, I can access everything using PuTTY.

Problem is, for this to work it needs my friend's PC running and I use his connection.
So, I bought an integrated controller card at Omnima that can run OpenWRT, and I intend to use this device to connect from work and use my own connection.

I made OpenWRT run on the board using the Squidge distribution and I installed what was required for OpenSSH to work, Zlib and OpenSSL library, then OpenSSH-server and OpenSSH-client.

Then, I ran ssh-keygen, and it went well.
But when I try "ssh localhost" :

root@OpenWrt:/# ssh localhost
ssh: connect to host localhost port 22: Connection refused
root@OpenWrt:/#

And I do know what to do next. I guess I have to add users but I could not find any tutorial about this simple task, and I could not find any topic on this forum about that.

Could anyone help me?

By the way, I entered the commands using HyperTerminalon RS232 link, so the network part is detached from the command prompt.

And the command "netstat -l" gives me the following :

root@OpenWrt:/# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN

netstat: no kernel support for AF INET6 (tcp)
netstat: no kernel support for AF INET6 (udp)
netstat: no kernel support for AF INET6 (raw)
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
root@OpenWrt:/#

... So I guess there is a problem here? I tested this command with a RJ45 cable connected to each port of the card running Linux, but things won't change a bit.

What am I supposed to do?

Apperently, there is no ssh-daemon running on your system, only a telnet daemon (port 23) and a webserver (port 80).
Did you enable and start the ssh daemon?

e. g.
/etc/init.d/sshd enable
/etc/init.d/sshd start

On a standard openwrt installation the ssh service is provided by dropbear, not by openssh-server.

No, I did not start the daemon.
I tried /etc/init.d/sshd enable and /etc/init.d/sshd start, and I get no message.
When I run then netstat, it appears to be the same.

What is that thing about dropbear? Am I supposed to have both installed?

Usually, you would use dropbear to enable ssh on your board. If dropbear is not currently installed, look for it in  /www/squidge/packages. Once installed, you set the root password. This will enable SSH, but it will also disable telnet.

All right, I tried to install dropbear, and I get the following messages :

root@OpenWrt:/www/squidge/packages# opkg install dropbear_0.51-1_mipsel.ipk
Installing dropbear (0.51-1) to root...
Collected errors:
 * Package dropbear wants to install file /usr/bin/scp
        But that file is already provided by package  * openssh-client
 * Package dropbear wants to install file /usr/bin/ssh
        But that file is already provided by package  * openssh-client
root@OpenWrt:/www/squidge/packages#

So it appears that the required files have been installed already. How do I set the root password?

It looks like those files are being provided by openssh and not dropbear. Openssh might work, but I've never tried it. You probably will need to do something like '/etc/init.d/sshd enable' to make sure openssh starts on boot. To change the root password use 'passwd'.

Ah, great, it seems that wether having changed the root password or trying to install dropbear made things change, now while typing netstat -l I get :

root@OpenWrt:~# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN

netstat: no kernel support for AF INET6 (tcp)
netstat: no kernel support for AF INET6 (udp)
netstat: no kernel support for AF INET6 (raw)
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path

Next questions : how do I change my local IP? Because whgile typing /sbin/ifconfig I get 192.168.1.1 and I want the IP to be 192.168.0.x... Moreover, how can I know the Internet (and not local network) address of my card, so to connect from outside?
And how do I add user accounts to SSH, so I not have to log in with root all the time?


Thanks again!

(Last edited by Shinkel on 6 Aug 2009, 14:49)

Hi,

I tried the following solution to get my internet IP : connect to mu SSH server and then going to www.whatismyip.com, that should give me the internet IP of the SSH server.
Knowing that my server's IP is 192.168.1.1 on the LAN,, I tried to connect to it with PuTTY.
Unfortunately, I get nothing and the connection times out.

netstat -l gives me :

root@OpenWrt:/# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN

netstat: no kernel support for AF INET6 (tcp)
netstat: no kernel support for AF INET6 (udp)
netstat: no kernel support for AF INET6 (raw)
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
root@OpenWrt:/#

and /sbin/ifconfig :

root@OpenWrt:/# /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr 22:DA:E2:A8:86:2A
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:180 (180.0 B)  TX bytes:1043 (1.0 KiB)
          Interrupt:17

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

root@OpenWrt:/#

Why won't I access my server?

Thank you!

Shinkel wrote:

Knowing that my server's IP is 192.168.1.1 on the LAN,, I tried to connect to it with PuTTY.
Unfortunately, I get nothing and the connection times out.

If your servers subnet is different than that of your PC running putty, you will need a router to route traffic between those two subnets.
Otherwise you can reconfigure either the subnet on your server or that on your PC, so that both are the same.

To reconfigure it with openwrt, edit the file /etc/config/network

OK, thank you very much, I tried and it worked!
Now, err, how am I supposed to add users , so do not have to log on as root all the time? I have been told to try useradd or adduser, but both won't work.
Any idea?

Thanks again!

OK, it so appears that OpenWRT has never been designed to be a multiuser system, and this for security reasons. So, the commandes adduser or useradd has not been implemented and will not be.

So, to make it clear, I have to remain with my root user and that is all.

Hoping it will help some in the same case as mine!

Actually adduser or useradd commands are implemented, you can enable them in busybox configuration if you are building custom firmware from sources. Otherwise you can still edit /etc/passwd and /etc/group files to add users manually.

Ah, never too late to learn things, it seems! Well, thank you Krotus!

The discussion might have continued from here.