Skip to Content

Wiki source code of Remote Access Gateway

Version 19.17 by Xiaoling on 2022/07/14 14:16
Show last authors
1 **Table of Contents:**
2
3 {{toc/}}
4
5
6
7 = **1.  Use Remote.it service** =
8
9
10 Remote.it for remote access is available in the latest Dragino firmware for gateway. For security concern, the remote.it only available base on end user demand.
11
12 (% style="color:red" %)**Important Notice:**
13
14 (% style="color:red" %)* **Remote.it access will give full control of your device to remote support.**
15 ~* **The Remote.it allow Dragino Support to remote access to the device, If user want to access himself, it need to sign up for an remote.it account.**
16
17 For how to use remoteit, please see : [[Remoteit user instruction for Dragino Gateway>>url:https://www.dragino.com/downloads/index.php?dir=LoRa_Gateway/&file=Dragino-Remoteit_User_Manual.pdf]].
18
19
20 = **2.  RSSH Introduction** =
21
22
23 Reverse SSH for remote access is available in the latest Dragino firmware for gateway. For security concern, the RSSH only available base on end user demand.
24
25 (% style="color:red" %)**Important Notice:**
26
27 (% style="color:red" %)* **RSSH access will give full control of your device to remote support. Please remove sensitivity info before perform this**
28 ~* **This RSSH allow Dragino Support to remote access to the device, If user want to access himself, he need to set up the RSSH server himself.**
29
30 Below gateway support reverse SSH access:
31
32 * Firmware Version > LG02_LG08-5.3.1580178039 [[Firmware Download>>url:http://www.dragino.com/downloads/index.php?dir=LoRa_Gateway/LPS8/Firmware/Release/]]
33 * LG01N, OLG01N (Note: LG01-P LG01-S doesn't support)
34 * LG02, OLG02
35 * LG308, DLOS8
36 * LPS8
37 * LIG16
38 * MS14 series if installed with the same firmware.
39
40
41 == **2.1  For Firmware Version lower than lgw~-~-build-v5.4.1616478814-20210323-1355** ==
42
43
44 === **2.1.1  End User Guide to use SSH access** ===
45
46
47 Go to this the Reverse SSH page as below:
48
49 [[image:image-20220527102348-1.png]]
50
51 Get the RSSH configure page
52
53
54 [[image:image-20220527103251-2.png]]
55
56 Connection OK.
57
58 * (% style="color:#4f81bd" %)**Login ID**(%%):  Input (% style="color:#4f81bd" %)**sshuser**
59 * (% style="color:#4f81bd" %)**Host Address**(%%):  Input** (% style="color:#4f81bd" %)support.dragino.com(%%)**
60 * (% style="color:#4f81bd" %)**Host Port**(%%):  Please email to support @ dragino.com to get a valid host port.
61 * (% style="color:#4f81bd" %)**Connect at Startupt**(%%): Choose to enable connect once device is powered.
62 * (% style="color:#4f81bd" %)**Network Keys:          **(%%)Click the Generate keys to generate the keys and download / mail it to Dragino support so Dragino can prepare the remote access to
63
64 (((
65 After doing above, please download and mail the public keys to Dragino support and wait for our mail for the valid host port. Input the valid host port got from our support and click connect so we can remote access to your gateway.
66 )))
67
68
69
70 === **2.1.2  How to Ser up a Reverse SSH access** ===
71
72
73 Advance administrator can config a SSH server to provide support their end user themselves. Instruction is as below:
74
75 1. Prepare a Linux server with public IP. The gateways need to be able to create SSH connection to this server. We recommend to use a server that performs no other function than to support the RSSH access, and to have no additional accounts active, and no access from the Internet that uses ID/password authentication.
76 1. In the gateway settings, The (% style="color:#4f81bd" %)**Login ID**(%%) will be the SSH user for this server and the (% style="color:#4f81bd" %)**Host Address**(%%) is the server address.
77 1. Ask your end user to send you the key generate in the gateway and put them in /home/<Login ID>/.ssh/authorized_key file.
78 1. Give a free port to the user and ask them to configure RSSH page in the gateway.
79 1. In your server or other machine, you will able to access to the end user device by below command:
80
81 (% class="box" %)
82 (((
83 $ ssh   -p <End User Host Port>   root@<Host Address>
84 )))
85
86 (((
87 (% style="color:red" %)**Remote RSSH Access allow the gateway to connect to SSH server as well. This will create risk to the RSSH server. Please make sure the account use for Gateway Access has the lowest access right.**
88 )))
89
90
91
92 ==== **2.1.2.1  Note for set up RSSH server** ====
93
94 If gateway reboot or the connection is incidentely close by end node. The port in SSH server will still be occupy for a long time. Administrator can use below commands to release the port.
95
96 (% class="box" %)
97 (((
98 [root@iZt4n22vqvm7ajogrfiif6Z ~~]# lsof -i :9102 ~-~-> check the port 9102 process status (change 9102 to the actually port for your gateway.
99 COMMAND   PID    USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
100 sshd    21430 sshuser   15u  IPv4 47567059      0t0  TCP localhost:bacula-fd (LISTEN)
101 [root@iZt4n22vqvm7ajogrfiif6Z ~~]# kill 21430   ~-~-> Kill PID of this process.
102 [root@iZt4n22vqvm7ajogrfiif6Z ~~]# lsof -i :9102        
103 [root@iZt4n22vqvm7ajogrfiif6Z ~~]#
104 )))
105
106
107 == **2.2  For Firmware Version higher than lgw~-~-build-v5.4.1618196981-20210412-1111** ==
108
109 Below gateway support reverse SSH access:
110
111 (% class="box" %)
112 (((
113 Firmware Version >lgw~-~-build-v5.4.1618196981-20210412-1111 Firmware Download
114 LG01N, OLG01N (Note: LG01-P LG01-S doesn't support)
115 LG02, OLG02
116 LG308, DLOS8
117 LPS8
118 LIG16
119 )))
120
121
122 === **2.2.1  End User Guide to use SSH access** ===
123
124
125 ==== **2.2.1.1  Install the SSH service for server** ====
126
127
128 ===== (% style="color:blue" %)**Step 1 : Download the SSH service code**(%%) =====
129
130
131 **1).  **git clone [[https:~~/~~/github.com/dragino/rssh-server.git>>url:https://github.com/dragino/rssh-server.git]] rssh-server
132
133 [[image:image-20220527105447-1.png]]
134
135 git clone rssh-server
136
137
138 **2). ** cd rssh-server; sudo make ~-~--> to Generate the execute file：rssh_serv
139
140 [[image:image-20220527105511-2.png]]
141
142 Generate the execute file
143
144
145 **Debug** :
146
147 (% class="box" %)
148 (((
149 if you git fail.  ~-~->    (% style="color:#4f81bd" %)**sudo: git: command not found.**(%%)
150 please install git.  ~-~->  (% style="color:#4f81bd" %)**yum install git -y  or  apt-get install git -y.**
151 )))
152
153 (% class="box" %)
154 (((
155 if you make error 127,it** (% style="color:#4f81bd" %)lack of gcc.(%%)**
156 please install gcc.    ~-~->(% style="color:#4f81bd" %)**yum install gcc.**
157 )))
158
159 [[image:image-20220527105856-3.png]]
160
161 lack of gcc
162
163 (% class="box" %)
164 (((
165 if you make a fatal error : sqlite3.h,it (% style="color:#4f81bd" %)**lack of sqlite3.**(%%)
166 please insatell (% style="color:#4f81bd" %)**sqlite3**.
167 )))
168
169 [[image:image-20220527105918-4.png]]
170
171 lack of sqlite3
172
173
174 (% style="color:blue" %)**How to install Sqlit3:**
175
176 (% class="box" %)
177 (((
178 **Step1:** Download the SQLit3 installation package
179 sudo wget [[https:~~/~~/www.sqlite.org/2021/sqlite-autoconf-3350400.tar.gz>>url:https://www.sqlite.org/2021/sqlite-autoconf-3350400.tar.gz]]
180
181 **Step2:** tar the SQLit3 installation package
182 sudo tar -zxvf sqlite-autoconf-3350300.tar.gz
183
184 **Step3:** Generate the makefile
185 cd sqlite-autoconf-3350300/;./configure
186
187 **Step4:** Compile makefile
188 sudo make
189
190 **Step5: **Install makefile
191 sudo make install
192
193 **Check:**
194 cd /usr/local/bin;ls -al                             ~-~->    Check to see if there is a file for sqlite3
195 cd sqlite-autoconf-3350300/;./sqlite3 test.db        ~-~->    Test whether the sqlite3 was installed successfully
196
197 **debug:**
198 If you get the imformation that is SQLite header and source version mismatch, when you execute./sqlite3 test.db.
199 Please execute the command /sbin/ldconfig.
200 After that execute the command ./sqlite3 test.db again.
201 )))
202
203
204
205 ===== (% style="color:blue" %)**Step 2 : Install and run the RSS service**(%%) =====
206
207
208 **1):**  intall database for /var/rsshdb.sqlite3 and Server development port for 3721(The default is 3721)
209
210 user must enter the root account and run the following commands
211
212 (% class="box" %)
213 (((
214 $ ./create_sqlite3_db.sh
215 $ ./rssh_serv -p  3721 2>&1 &
216 $ ps -ef | grep rssh_serv check 3721 port
217 )))
218
219 [[image:image-20220527110436-6.png]]
220
221 intall database and server development port
222
223
224 **Debug:**
225
226 (% class="box" %)
227 (((
228 Check /var/rsshdb.sqlite3 ~-~->(% style="color:#4f81bd" %)** ls /var/rsshdb.sqlite3**(%%)
229 Check ls /var/rsshdb.sqlite3 ~-~-> (% style="color:#4f81bd" %)**sudo chmod 777 rssh_serv**
230 )))
231
232 (% class="box" %)
233 (((
234 if** fail to open dpvlry or to bind to it**
235 please kill rssh_serv,and run (% style="color:#4f81bd" %)** ./rssh_serv -p  3721 2>&1 &** (%%) again
236 )))
237
238
239
240 ===== (% style="color:blue" %)**Step 3 : Create a minimal SSH user (reverse SSH proxy for the gateway)**(%%) =====
241
242
243 **1): (% style="color:#4f81bd" %)sudo useradd XXXXX(%%)** (custom user name)
244
245 **2):** (% style="color:#4f81bd" %)**sudo passwd xxxxxx**
246
247 **3):** (% style="color:#4f81bd" %)**cp /bin/bash /bin/rbash**
248
249 **4):** (% style="color:#4f81bd" %)**sudo nano /etc/passwd**(%%) ~-~-> Change /bin/bash to /bin/rbash
250
251 **5):** (% style="color:#4f81bd" %)**sudo nano /home/xxxxx/.bashrc**(%%) **empty it,and input export PATH=$HOME/bin**
252
253 **6):** (% style="color:#4f81bd" %)**sudo nano /home/xxxxx/.bash_profile**(%%) **empty it,and input export PATH=$HOME/bin**
254
255
256 (% style="color:red" %)**Now user "XXXXX" is the user with limited permissions of the current system**
257
258
259
260 === **2.2.2  How does user get the gateway to connect to a user's private server** ===
261
262
263 ===== (% style="color:blue" %)**Step 1 : Come bace the gateway web UI for get the gateway Public key**(%%) =====
264
265
266 **1) **in the system ~-~-> (% style="color:#4f81bd" %)**Remote Mgmt**
267
268 [[image:image-20220527110531-7.png]]
269
270 Remote Mgmt
271
272
273
274 ===== (% style="color:blue" %)**Step 2 : Authorization server**(%%) =====
275
276
277 copy the Gateway Publickey into user's private server "/home/XXXXX/.ssh/authorized_keys" file.
278
279 [[image:image-20220527110625-8.png]]
280
281 Publickey
282
283
284
285 ===== (% style="color:blue" %)**Step 3 : connecte private server**(%%) =====
286
287
288 in the gateway web UI
289
290 [[image:image-20220527110700-9.png]]
291
292 gateway web UI
293
294
295 (% class="box" %)
296 (((
297 (% style="color:#4f81bd" %)**Connection Type **(%%) :  If user's least privileged user with private server uses a password, select (% style="color:#4f81bd" %)**Public Key**(%%)
298 (% style="color:red" %)**Note: if user's least privileged user no uses a password,choose from both is fine**(%%)
299 (% style="color:#4f81bd" %)**Login ID**(%%) :  Input user name "eg : "XXXXX"
300 (% style="color:#4f81bd" %)**Host Address**(%%)  :  Input user's private server address
301 (% style="color:#4f81bd" %)**Connect at Startupt**(%%):  Choose to enable connect once device is powered.
302 Click Save and then Connect
303 )))
304
305
306
307 ===== (% style="color:blue" %)**Step 4 : Cheak is fine**(%%) =====
308
309
310 Rssh Host connection Ok
311
312 [[image:image-20220527111009-10.png]]
313
314 Rssh Host connection Ok
315
316
317 user can use common ps | grep ssh to check it in the gateway.
318
319 [[image:image-20220527111041-11.png]]
320
321 Check the gateway
322
323
324
325 ===== (% style="color:blue" %)**Step 5 : Create an authorization key file**(%%) =====
326
327
328 **1):**  sudo mkdir /home/xxxxx/.ssh; sudo touch /home/xxxxx/.ssh/authorizedkey
329
330 **Debug:**
331
332 (% class="box" %)
333 (((
334 **~ check: sudo ls /home/xxxxx/.ssh/authorizedkey**
335 )))
336
337
338 === **2.2.3  How to Ser up a Reverse SSH access** ===
339
340
341 ==== (% style="color:blue" %)**Step 1 : Log into the server system**(%%) ====
342
343
344 [[image:image-20220527111145-12.png]]
345
346 Loging server
347
348
349
350 ==== (% style="color:blue" %)**Step 2 : access the gateway**(%%) ====
351
352
353 (% class="box" %)
354 (((
355 **$ cd rssh-server/**
356 )))
357
358 Check the gateway linking to the server $ ./connect-gw.sh -l
359
360 [[image:image-20220527111219-13.png]]
361
362 Check the gateway linking to the server
363
364
365
366 access the gateway $ ./connect-gw.sh <GWID>
367
368 [[image:image-20220527111300-14.png]]
369
370 reverse ssh access the gateway
371
372