ssh?

[MeneerJansen]

I use a Debian 11 "Bullseye" chroot via Crouton.

I installed ssh server and client like I always do via my package manager. Always works out of the box. And I can connect from the Chromebook to another computer running an ssh server just fine.

However, I can't connect to the Chr.b. from another computer. Usually, if there's no ssh server installed you get the error "No route to host" within a few seconds. But to the Chr.b. the connection times out (after a very long time). That makes me think that there indeed is an ssh server running on the Chr.b. but something's wrong.

As far as I know I do not have a firewall running on the Chromebook.

Does anybody have experience in running an ssh server in a chroot?

[TomTravis]

yes ssh -l if the USID if not the same
you may need to install it not installed normally
cli
sudo apt install ssh

mime works just fine the ports(tcp-ip) on both chroot and chromeOS need to be open ssh ftp
security may have shut the ports off
I use sftp all the time in caja or dolphin point and click file transfers not working yet in bookworm cli works

FTP for bulk transfers no graphics

[MeneerJansen]

Every single tutorial on the internet requires us to use systemctl from systemd. But that outright refuses to run on a chromebook. Error:

$ sudo systemctl status ssh

Running in chroot, ignoring command 'status' 

You need that command to check if the sshd is active or not. It may be "enabled" but not "active" (???).

This is driving me completely nuts.

[TomTravis]

who is us ?

ssh runs and listens to port 20..24 if i remember correct
same with sftp when connected the task start per USID
systemd is not used and systemctl does not work by design in chroot
sysvinit does work. the ports on CB ChromeOS are normally closed you have to open the ports for inbound connections this is the firewall
https://chromeos.dev/en/web-environment/port-forwarding

the iptables in the chroot also need to be open for inbound connections if not it does not connect
https://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/
https://linux.die.net/man/8/iptables
https://www.rebex.net/kb/secure-ftp/
https://www.ssh.com/academy/ssh/port

Enabling SSH access via iptables

Iptables is a host firewall built into the Linux kernel. It is typically configured to protect the server by preventing access to any ports that have not been expressly opened.

If iptables is enabled on the server, the following commands can be used to permit incoming SSH access. They must be run as root.

iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

If you want to save the rules permanently, on some systems that can be done with the command:

service iptables save

once connected you can read and write outbound or inbound

[TomTravis]

Every single tutorial on the internet requires us to use systemctl from systemd. But that outright refuses to run on a chromebook. Error:

$ sudo systemctl status ssh

Running in chroot, ignoring command 'status' 

You need that command to check if the sshd is active or not. It may be "enabled" but not "active" (???).

This is driving me completely nuts.

well if you get ssh to work inbound i have done this before , i have a x org task for you NVIDIA integration great fun!!!!

[MeneerJansen]

ssh runs and listens to port 20..24 if i remember correct same with sftp when connected the task start per USID systemd is not used and systemctl does not work by design in chroot sysvinit does work. the ports on CB ChromeOS are normally closed you have to open the ports for inbound connections this is the firewall https://chromeos.dev/en/web-environment/port-forwarding

Unfortunately my Chrb. is too old to have Crostini so the mentioned method for port forwarding does not work. Neither do I have the item "Developer options" in the ChromeOS Settings screen, nor can I find anything in the Settings screen using the search term "Port".

Question is: are ports closed on my Chromebook by ChromeOS? I don't know how to check...

the iptables in the chroot also need to be open for inbound connections if not it does not connect https://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/ https://linux.die.net/man/8/iptables https://www.rebex.net/kb/secure-ftp/ https://www.ssh.com/academy/ssh/port

Enabling SSH access via iptables

Iptables is a host firewall built into the Linux kernel. It is typically configured to protect the server by preventing access to any ports that have not been expressly opened.

If iptables is enabled on the server, the following commands can be used to permit incoming SSH access. They must be run as root.

iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

If you want to save the rules permanently, on some systems that can be done with the command:

service iptables save

once connected you can read and write outbound or inbound

Thanks for the tips and links. Iptables isn't used anymore by modern Debian distro's like Bullseye, which is what I'm on. It's replaced by nftables. I did not consciously install a firewall but maybe Debian has one activated one per default. As far as I know one can check what nft does with:

nft list ruleset

Which outputs nothing. So I think Debian has not activated a firewall...

[dnschneid]

https://github.com/dnschneid/crouton/wiki/Running-servers-in-crouton

[TomTravis]

yes usual the IP tables are old and the new tools wish you to convert the tables update format
legacy table work fine if you choose not to convert
example
Warning: iptables-legacy tables present, use iptables-legacy to see them
iptables v1.8.7 (nf_tables): Could not fetch rule set generation id: Invalid argument

the manpage has lots of options and discussion
do not recall having to init sshd for the connection to work inbound openssh and sftp
the ssh task in listen in a wait state on port 22 for data connection then spawn task if good connection

[TomTravis]

https://github.com/dnschneid/crouton/wiki/Running-servers-in-crouton
running IPtables via rc.local every boot is not needed,, this seems a security issue also
man iptables

iptab.txt

iptables-save will save the table and no need to run the commands each startup

SEE ALSO
iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-ex-
tensions(8),

[MeneerJansen]

https://github.com/dnschneid/crouton/wiki/Running-servers-in-crouton

David, thanks for the Wiki tip. The Wiki's advice is to use the Secure Shell Chrome app/extension. Unfortunately it is deprecated (can't install it). The other tip there (mkdir etc.) also does't work, unfortunately.

I can distinctly remember that I could connect to my Chrb. via ssh (via sftp) to my Chromebook when it ran Ubunty 14 Trusty, years ago. Might that have something to do with the fact that Ubuntu 14 does not use systemd but Upstart?

About my systemctl (from systemd) problems: I read that systemctl cannot run in a chroot I don't understand why and my computer knowledge is too small to ever understand. But is that indeed the case? Won't systemd never, ever run in a chroot?

[MeneerJansen]

[update] I restored my old Trusty chroot. Started it up. And now I can ssh into my chromebook. But I ssh into... my new Debian Bulleye chroot filesystem, not Ubunty Trusty's. So it looks like Trusty openend port 22. I'm gonna study how to do that in Bullseye with nft. The Debian Wiki on this doesn't help. Because... it needs systemctl! Driving me nuts!

Aaaaaaaaaaarrghhhhhhhhhhhhhhh.

[TomTravis]

ya okay here is my filter connection refused
2ip.txt
port 22 rules added
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
i went thru this before chromeOS is blocking port 22 ssh you have to create a port and forward as i remember
or my rules are wrong

nope this is how i got to start
(bullseye)z@localhost:$ sudo service ssh start
Starting OpenBSD Secure Shell server: sshd.
(bullseye)z@localhost:$ sudo service ssh status
sshd is running.
(bullseye)z@localhost:~$ ssh 10.0.0.12
The authenticity of host '10.0.0.12 (10.0.0.12)' can't be established.
ECDSA key fingerprint is SHA256:7tsk1IXcDPf/Nu2+HLXCYaL7MwZTkMCQvOC7EVjEI+w.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.0.0.12' (ECDSA) to the list of known hosts.
[email protected]'s password:
Linux localhost 4.19.254-13653-ga5ef616743fe #1 SMP PREEMPT Thu Oct 13 19:09:54 PDT 2022 aarch64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

[TomTravis]

i dont normal use this so sftp via caja or dolphin work just fine read and write to from machines or server m900, the image is loopback
i guess you can start via .bashrc if you like it

[TomTravis]

(bullseye)z@localhost:$ ps -ax |grep ssh #it a method to status the demon
24402 pts/4 S+ 0:00 grep ssh
32009 ? Ss 0:00 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups
(bullseye)z@localhost:$

[MeneerJansen]

@TomTravis : you were on the right track. However, Debian distro's as of ver. 10 'Buster' no NOT use y'e ol' iptables anymore. It uses nftables. Fortunately it still supports some sort of backward compatibility. Again, the problem is that services are usually started with a systemctl command (from systemd). But systemd will NOT work in a chroot.

To make a long story short, I tried to install firewalld because that's recommended on the Debian wiki. And, again, that program (with a GUI) probably uses systemctl to start the firewall because it refuses to startup. It hangs. But the program firewalld brings in some iptables stuff. I tried the command that you recommended to open up port 22, but it complained. Didn't work.

Turns out that you have to use iptables-legacy instead of iptables. The command iptables is installed, but doesn't work like you expect or something. I replaced iptables in your command with iptables-legacy and lo and behold port 22 was opened and I could ssh into my chromebook! Command was (like you said):

iptables-legacy -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

This systemctl not working in a chroot is getting harder and harder to workaround.

[TomTravis]

it not broken man, lol the nft table need to created then ufw and a lot of programs can use the tables
it is linux you have to play with it
not nearly as bad as npm or yarn

i super happy git hub dev uses vscode

[MeneerJansen]

it not broken man, lol the nft table need to created then ufw and a lot of programs can use the tables it is linux you have to play with it not nearly as bad as npm or yarn

I guess you're talking about the Wiki now stating that iptables-nft is broken or not working in Debian 11 or in a chroot??

You state that: "the nft table need to created". As far as I know the command iptables-nft is meant for just that and it returns the following error on which I've googled for days but none of the suggested "solutions" work:

$ sudo iptables-legacy -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

iptables v1.8.7 (nf_tables): unknown option "--dport"

[edit: in the command above I mistakenly wrote iptables-legacy where it should be iptables-nft; this might have confused the authour of the reply to this post]The same command, however, works without problems in my Ubunu 20.04 computer. So either iptables-nft in Debian 11/Crouton is broken or won't work in a chroot.

If you have Debian 11 on your Chromebook and you get iptables-nft working then I'd love to hear how.

[TomTravis]

-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
use a editor and the idea is
iptables-legacy-save > 1ip.txt
iptables-legacy-restore < 1tp,.txt
you need to add
filter* # TOF
COMMIT # EOF
for restore to accept input

save text file should transfer between vendors

ya i know what you mean i have played with this before on a another activity sockets for streams of digital wave forms from a sin wave. It(Debian) does not Like your spacing and the syntax is not correct , These commands where cut and pasted from the web (the ones i used)
Debian show how to convert the tables on the wiki They may have started with Jessie or earlier but the older table was installed via
sudo apt install ssh #(BSD unix)

$ sudo iptables-legacy -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT #was

$ sudo iptables-legacy -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT #is a data
$ sudo iptables-legacy-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT #is a Signal

-m tcp #is missing in you sytax so --dport22 is not understood
sudo iptables-legacy -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT #was

The security folks are not helpful never have been. The nft tables are not included by Debian maybe so with Ubuntu I really have not looked or cared to look

if you want to assist install jammy and work on systemD, snapd installs do not work , you cannot install a webrowser without systemD working SnapD using it to start(systemD) , the service demon start idea does not kick the process off SystemD does manage the process

Video is also a issue Xorg Xiwi also need update

[MeneerJansen]

Oops. I made a typo in my last post. Where I wrote the command:

$ sudo iptables-legacy -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

iptables v1.8.7 (nf_tables): unknown option "--dport"

I should have written:

$ sudo iptables-nft -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

iptables v1.8.7 (nf_tables): unknown option "--dport"

Notice that I mistakenly wrote iptables-legacy instead of iptables-nft. The "legacy" command does work, the "nft" one doesn't.

@TomTravis : I don't know what you mean exactly, nor what you advise me to to. I've stumbled upon the advice to insert - m tcp between the -p tcp and the --dport options too. Doesn't work. Error message:

Couldn't load match `tcp': No such file or directory

I went down a rabbit hole trying to determine how that can be solved to no avail. If all those error messages don't prove that iptables-ntp is broken in Debian 11 (or doesn't work in a chroot) then I don't know what will. I'm not going to invest more time and energy trying to determine if it's the chroot or Debian 11. Would require me to install Debian 11 on another computer: don't have the resources for that.

I consider this topic closed.

P.S. I don't know if you want me to install Debian 8 Jessie, but I'm not going to. It's too old. Not gonna use it or troubleshoot a distro that isn't supported or used anymore.

[TomTravis]

man use files
and save / restore the cli command get to long
install kali and assist the systemd effort
I did not include many of the steps to get it working you good at doing this

[TomTravis]

i guess you could ssh to read and write audio streams
no more USB , tcp-ip is much faster