3

I have used ssh to access remote computers/servers where they provided me a username, a password, and an IP address (like xxx:xxx:xx.xx). What I need to do is:

ssh [email protected]

and then it will ask for the password. After entering the password, it gives me the terminal control where I can control everything from the terminal of this remote server.

I want something exactly like this but to access my own computer. I run my ubuntu pc 24/7. I want to host my pc so that from another pc/mobile terminal I can access this. How to setup my pc as a server?

I saw several answers about openssh-server. I installed it and then did the following:

sudo systemctl enable ssh
sudo ufw allow ssh
sudo systemctl start ssh

But I cannot understand how I can access my computer. What is the IP address from my computer? I am looking for a step-by-step guide or some reference on how to enable such thing and how I can access my computer terminal remotely.

Here are my PC details:

I am using Ubuntu Desktop 20.04.6 LTS (Focal Fossa).

I downloaded the ubuntu-20.04.6-desktop-amd64.iso from releases.ubuntu.com.

I am not sure about my IP address. When I checked it through https://whatismyipaddress.com/, it shows that I have a Likely static IP. However, when I connect to a different router, my IP address changed. So, probably it is dynamic.

Addition: I have followed the steps in this answer provided by Aleff below. However, since the router I am using is a public router (university dorm router), I don't have access to its configuration page. So, I cannot enable port forwarding. I am looking for a workaround in this step.

6
  • @guiverc I have updated my question with some of your requested details. Could you tell me if there is a definitive way to know what type of IP addressing I am using from the command line? Commented May 30, 2023 at 23:28
  • 2
    You can find the IP address of the server with the command ip address (look for the value immediately after inet in the output). Connect the other computer in the same network, and, run the command [email protected] in the other computer. If they are connect to different networks, then you will have to enable port forwarding in the server Commented May 30, 2023 at 23:49
  • 2
    At this point you have two options: set up port forwarding on your router, which may or may not work depending on the actual network configuration of your ISP (e.g., if your router is itself behind a NAT in the ISP's network), or use one of those services which run a program on your system allowing it to be remotely accessed.
    – muru
    Commented May 31, 2023 at 0:19
  • @muru I tried the first option which didn't work. Could you name some of the programs that allow my system to be remotely accessed as you mentioned? Commented May 31, 2023 at 7:22
  • 1
    @AbdulMuhaymin If you wish to automate your access slightly you could add ‘sshpass’: sshpass -p PASSWORD ssh USER@IP_Address Send a command: sshpass -p PASSWORD ssh USER@IP_Address "COMMAND" The ‘USER’ and ‘PASSWORD’ are those to access the remote computer. Barry Commented Jun 7, 2023 at 0:28

3 Answers 3

3

If you don't have access to the router to do port forwarding, BUT you do have a ssh access to some server that is outside your local network and is accessible from the Internet, you can use that server as a "middleman" to access your PC.

First, you need to establish a ssh tunnel between your PC and that server, by using on your PC a command like:

ssh -R portnumber:localhost:22 [email protected]

where username is your username at external.server and portnumber is any unused port number on that server that you will choose (for example, 9922). "localhost" is literally the word localhost.

You should leave this connection active permanently. You have to ensure somehow that this connection is kept up all the time and does not disconnect (you can for example write some script that checks periodically if the connection is active and reconnects if it's not).

As a next step, if the ssh server on external.server is configured to accept outside connections to tunneled ports (this requires the option GatewayPorts yes to be present in /etc/ssh/sshd_config file on external.server; the default is no), you can connect directly to your PC from outside by connecting to portnumber on external.server, like below:

ssh -p portnumber [email protected]

where localuser is your username on your PC (not the external server!)

However, if the external server is not configured to accept outside connections to tunneled ports (which is far more common as this is the default), you need to make the connection in two steps.

First, log in to the external server as you would normally:

ssh [email protected]

Once logged in to external.server, type the following command (on the server):

ssh -p portnumber localuser@localhost

where localuser is your username on your PC, and "localhost" is literally localhost. You should be logged in to your PC now.

5
  • This works perfectly. I just have one small question. What is the name of this process that you just described? Is it called reverse SSH? Commented Jun 1, 2023 at 15:10
  • 1
    Technically it is called "ssh remote port forwarding", but I have seen many different names applied to it ("reverse SSH" being among them). I call it ssh tunneling, but tunneling is a wider term for all cases when you "embed" one connection inside another (not only using SSH - for example VPNs are also a kind of tunneling). You can also do ssh tunneling in reverse direction, for example to access computers in local network where your server is, when only server is externally accessible. This is local port forwarding.
    – raj
    Commented Jun 1, 2023 at 15:15
  • Excellent answer! To keep the reverse SSH tunnel alive, couldn’t autossh be used as in this example? Persistent Reverse SSH Tunnel
    – mpboden
    Commented Jun 1, 2023 at 15:59
  • @mpboden Probably yes. I have never used autossh, so can't say anything for sure. I was using similar solution a few years ago and I wrote my own script that was keeping the ssh connection up.
    – raj
    Commented Jun 1, 2023 at 21:01
  • I have implemented this scenario (with a certificate-based login that is confined to running an entrypoint script on the middleman server that checks for "liveness" of the connection), in sshrew.
    – zwets
    Commented Jun 7, 2023 at 10:03
2

To access your Ubuntu PC's terminal from another computer, you can set up Secure Shell (SSH) server on your Ubuntu machine. SSH allows you to remotely connect to your computer and access the terminal over a secure connection. Here's how you can set it up:

  1. Install SSH server: On your Ubuntu PC, open a terminal and run the following command to install the OpenSSH server:
sudo apt update
sudo apt install openssh-server
  1. Configure SSH: Once the installation is complete, you can modify the SSH server configuration if needed. The configuration file is located at /etc/ssh/sshd_config. You can use a text editor like nano to make changes:
sudo nano /etc/ssh/sshd_config

By default, SSH should work fine, but you may want to check if password authentication is enabled (PasswordAuthentication yes) or if you want to allow root login (PermitRootLogin).

  1. Enable SSH service: To start and enable the SSH service, run the following command:
sudo systemctl enable ssh
sudo systemctl start ssh
  1. Find the IP address of your Ubuntu PC: To connect to your PC remotely, you need to know its IP address. Run the following command to find the IP address:
ip addr show | grep inet

Look for the line that starts with "inet" and contains your IP address (e.g., inet 192.168.0.100). Note down this IP address.

  1. Configure port forwarding on your router: Access your router's configuration page. This is typically done by entering your router's IP address (e.g., 192.168.0.1) in a web browser and logging in with your router's credentials. The specific steps may vary depending on your router model, but you're looking for the "Port Forwarding" or "Virtual Servers" section.

    • Create a new port forwarding rule with the following information:
      • External (WAN) port: Choose a port number of your choice (e.g., 2222).
      • Internal (LAN) IP address: Enter the internal IP address of your Ubuntu PC (e.g., 192.168.0.100).
      • Internal (LAN) port: Here you will have to choose whether to leave the default value 22 or change the default port. For security reasons it would be best to change the default port as described at the end of this answer.
    • Save the configuration and exit the router settings.
  2. Find your public IP address: To connect to your Ubuntu PC from another computer, you need to know your public IP address. Open a web browser on the Ubuntu PC or any other device and search for "What is my IP address" Note down the public IP address displayed.

  3. Connect from another computer: (Apparently you are already clear on this aspect but for completeness I am writing it down) On the remote computer or mobile device, open a terminal or SSH client and run the following command:

ssh username@public-ip-address -p port-number

Replace username with your Ubuntu PC's username and public-ip-address with your router's public IP address, and port-number with the port number you chose in step 5.

  1. Authenticate and connect: When prompted, enter your Ubuntu PC's password to authenticate. Once authenticated, you will have access to your Ubuntu PC's terminal from the remote computer.

Note: Make sure your Ubuntu PC has a static IP address or a DHCP reservation to ensure the IP address doesn't change over time. This will help you maintain a consistent connection.

Please note that exposing your SSH server to the internet carries some security risks. Ensure you have strong passwords, consider using key-based authentication, change the default SSH port (22) to a different port, and monitor your server's logs for any suspicious activity.

6
  • 3
    If you are exposing SSH server to the Internet, I suggest you install fail2ban. This is a service that blocks access for computers that try to login to your SSH server after a predefined number of login failures. You can tweak the configuration, but even the default one does a pretty good job in protecting against bots that try to guess passwords. But you may want to exclude your local network from being monitored by fail2ban.
    – raj
    Commented Jun 1, 2023 at 9:45
  • @Aleff, +1 for the detailed answer. I followed steps 1-4, and I am sure the rest will be easy once I can get over step 5. But I cannot follow step 5 since I don't have a personal router. It is the router provided by the university. As far as I understand by searching on the internet, it has NAT enabled or something like this. So I cannot access the router config page. Any workaround for this? And as for the security issue, I don't have any actually. It's okay if my computer is compromised. I just want to know how I can connect to my computer remotely regardless of the security issues. Commented Jun 1, 2023 at 14:05
  • 2
    @AbdulMuhaymin unfortunately there is no workaround for that, if you can't forward the ports then you can only SSH into your PC from within the university's network. For that you just use the IP address you found in step 4.
    – Esther
    Commented Jun 1, 2023 at 14:12
  • @Esther, I will actually use this from the same network. For example, the PC is on the study table, but I want to access the terminal from my Android (ConnectBot ssh) from the bed! The workaround by raj given here worked pretty well. If that fails for some reason in the future, I will try this! Commented Jun 1, 2023 at 15:13
  • 2
    If you use it from the same network, you should not need that workaround. You should be able to connect just using ssh to your PC's local IP address.
    – raj
    Commented Jun 1, 2023 at 15:17
2

I have wrapped the solution described in the accepted answer (with automatic reconnect and strictly confined SSH login on the middleman server) in a small packaged solution that I have been using for a while.

sshrew runs as a service on the client, which connects, using certificate authentication, to a restricted shell on the "middleman SSH server".

On the server, the incoming connection (a) opens a reverse tunnel back to the client (or any machine in the client network), and (b) enters a bash script (the 'entry point'), where it goes to sleep and periodically wakes up to check that the client is still reachable through the tunnel.

When the tunnel appears shut, the entry point script terminates, which terminates the client's SSH connection. This is eventually detected by the client (note that interruptions in an SSH connection aren't immediately obvious to either end), which will then attempt to reconnect to the server

2
  • You should provide at least some instructions on how to install or use this software in the answer, so that people can judge from the answer itself whether or not to visit links in them.
    – muru
    Commented Jun 7, 2023 at 13:09
  • @muru thanks, have added a little extra description
    – zwets
    Commented Jun 9, 2023 at 20:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .