Difference between revisions of "Install SSH"

From AwkwardTV
Jump to: navigation, search
m
(Note serious problem with kerb framework, fix coming soon)
Line 8: Line 8:
  
 
For the following steps you need to remove the Apple TV's hard drive and mount it using some sort of firewire or usb enclosure, or use a USB-to-PATA adapter such as the one sold by OWC. Perform these steps, and then reinstall the drive.  It is not necessary to disable the firewall (see [[Disable Firewall]]).
 
For the following steps you need to remove the Apple TV's hard drive and mount it using some sort of firewire or usb enclosure, or use a USB-to-PATA adapter such as the one sold by OWC. Perform these steps, and then reinstall the drive.  It is not necessary to disable the firewall (see [[Disable Firewall]]).
 +
 +
=WARNING=
 +
I've just discovered that copying over the Kerberos framework from OS X (which is my solution to the problem with ssh v2 not working) causes other problems. In particular, mount_afp fails with "Illegal instruction". If you're running a hacked kernel with SSE3 emulation, this probably won't affect you, but otherwise, it's a major issue.
 +
 +
I've got a rather gross fix already (hacking launchd's sshd plist, and keeping both frameworks around), but I'll try to come up with something better after dinner, probably involving the DYLD_ env vars... Until then, be warned- if you need to mount AFP volumes, don't do the Kerberos step (section 3.4).
  
 
=How to install SSHD=
 
=How to install SSHD=

Revision as of 18:17, 3 June 2007

<Google>WIKI</Google>

Introduction

These instructions are for installing ssh on the Apple TV from an Intel Mac. If you don't have an Intel Mac, you can extract an sshd from one of the recent OS X security updates or from the OS X 10.4.9 update, which you can download from Apple's web site. (If someone wants to put in a link to an explanation of how to do this, that'd be cool.) Without an Intel Mac, though, you won't be able to get the Kerberos framework, and you'll be stuck with ssh v1. You can NOT use the sshd or Kerberos framework from a PPC Mac (G3, G4, or G5).

  • Changed 2007-06-01: You also can use ssh v2 now. (This was formerly a problem; see #Notes.)
  • Changed 2007-06-02: Fixed up the rest of the page a bunch. Eliminated significant errors in first half of last section. Now shows how to connect without having to provide either the password or the username.

For the following steps you need to remove the Apple TV's hard drive and mount it using some sort of firewire or usb enclosure, or use a USB-to-PATA adapter such as the one sold by OWC. Perform these steps, and then reinstall the drive. It is not necessary to disable the firewall (see Disable Firewall).

WARNING

I've just discovered that copying over the Kerberos framework from OS X (which is my solution to the problem with ssh v2 not working) causes other problems. In particular, mount_afp fails with "Illegal instruction". If you're running a hacked kernel with SSE3 emulation, this probably won't affect you, but otherwise, it's a major issue.

I've got a rather gross fix already (hacking launchd's sshd plist, and keeping both frameworks around), but I'll try to come up with something better after dinner, probably involving the DYLD_ env vars... Until then, be warned- if you need to mount AFP volumes, don't do the Kerberos step (section 3.4).

How to install SSHD

Preparations

Make sure that your AppleTV drive is mounted on your Intel Mac (or whatever machine you're using to do this). It should be in your filesystem at /Volumes/OSBoot. If it's not, you'll need to modify the instructions below accordingly.

Copy the SSHD Binary

Copy sshd from your Mac to your AppleTV. For example:

cp -p /usr/sbin/sshd /Volumes/OSBoot/usr/sbin/

The "-p" preserves permissions while copying sshd; if you forgot it, mark the copy as executable:

chmod +x /Volumes/OSBoot/usr/sbin/sshd

Creating an automatic startup file

Make sshd start automatically on boot. If you have the AppleTV disk mounted on a Mac, it's easy:

cp -p /System/Library/LaunchDaemons/ssh.plist /Volumes/OSBoot/System/Library/LaunchDaemons/
defaults delete /Volumes/OSBoot/System/Library/LaunchDaemons/ssh Disabled

Otherwise, create a text file /Volumes/OSBoot/System/Library/LaunchDaemons/ssh.plist containing:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.openssh.sshd</string>
        <key>Program</key>
        <string>/usr/libexec/sshd-keygen-wrapper</string>
        <key>ProgramArguments</key>
        <array>
                <string>/usr/sbin/sshd</string>
                <string>-i</string>
        </array>
        <key>SessionCreate</key>
        <true/>
        <key>Sockets</key>
        <dict>
              <key>Listeners</key>
                <dict>
                        <key>Bonjour</key>
                        <array>
                                <string>ssh</string>
                                <string>sftp-ssh</string>
                        </array>
                        <key>SockServiceName</key>
                        <string>ssh</string>
                </dict>
        </dict>
        <key>StandardErrorPath</key>
        <string>/dev/null</string>
        <key>inetdCompatibility</key>
        <dict>
                <key>Wait</key>
                <false/>
        </dict>
</dict>
</plist>

Installing the Kerberos framework (optional)

  • This step is not possible if you do not use an Intel machine.

Copy over the Kerberos framework, so sshd will be able to use the ssh v2 protocol (without this step, you're limited to v1).

cp -pr /System/Library/Frameworks/Kerberos.framework /Volumes/OSBoot/System/Library/Frameworks/

The reason ssh v2 did not work for other people when using the 10.4.x sshd binary is that sshd is trying to use the Kerberos framework, but the AppleTV only comes with some sort of stub framework.

If you already have ssh v1 working, and your AppleTV disk is back in the AppleTV, you can also do this over the network. The following will copy the framework from your Intel Mac to the right place on your AppleTV (again, it's all one line):

tar cf - /System/Library/Frameworks/Kerberos.framework | ssh -1 frontrow@appletv.local "(cd / ; tar xf -)"

You can of course also use ftp, sftp, or afp/smb filesharing if you already have those set up, too.

Logging in

The basics are done, and you can now log in:

ssh frontrow@appletv.local

The password, as shipped from Apple, is frontrow. If your box doesn't support Bonjour (that's most machines that aren't Macs, though you can install it on Windows, Linux, etc.), you'll have to connect to it by IP address, or put it in your local DNS or your /etc/hosts file (or analogue). In that case, figure out its IP address, and use that instead of "appletv.local".

  • If you are on a windows machine, use Putty or other ssh clients to connect.
  • The user "frontrow" has complete sudo privileges. To be root, do sudo -s and put in the password again (frontrow by default, remember?).

Logging in without a username or password

The previous contents of this section were terribly confusing. They recommended taking the ATV's private host key and using it as your personal key on your Mac (or perhaps as the host key on your Mac, it wasn't clear). Someone else later provided an "Alternate Method" which was correct, and this is mostly a light edit of that.

Everything here is done on your Mac, unless explicitly stated otherwise.

Checking for an existing identity

First, check to see if you have an identity already; if not, make one:

cd ; ls .ssh/id_rsa

If you see a file called id_rsa, then you already have an identity, and you can skip the next step.

Creating a new identity

Do this step only if you have no id_rsa file. (Don't worry if you have other files in .ssh- they don't matter, and we won't disturb them.)

To create a new identity file, type:

ssh-keygen

It'll ask for input three times, with lines that begin with "Enter". Just hit return each time. (You can use a passphrase if you're comfortable that you know what you're doing. Leave the filename alone.) It'll look like this, though the username and fingerprint will be different:

Generating public/private rsa key pair.
Enter file in which to save the key (/Users/alexis/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /Users/alexis/.ssh/id_rsa.
Your public key has been saved in /Users/alexis/.ssh/id_rsa.pub.
The key fingerprint is:
ef:3a:22:12:30:8e:37:7f:b5:0e:47:d4:e8:2f:9b:e9 alexis@alexis

Make SSH use username "frontrow" automatically

Do this on your Mac. It will only affect connections from your Mac to the AppleTV:

cat >>.ssh/config
Host appletv.local
 User frontrow
^D

"^D" means you must hit the Control and D button synchronously.

Once this is done, you can just do "ssh appletv.local" instead of "ssh frontrow@appletv.local". Or, if you're really lazy (like me), this (instead of the above) will let you do just "ssh atv" to connect!

cat >>.ssh/config
Host appletv.local atv
 HostName appletv.local
 User frontrow
^D

Installing the ssh key on the AppleTV

  • Copy your public key to your AppleTV. You'll need to enter the password, but you no longer need to specify a username:
scp .ssh/id_rsa.pub appletv.local:~/
  • ssh to your AppleTV (still using password "frontrow", but you no longer have to give a username):
ssh appletv.local
  • Now, while still connected to the AppleTV, make an .ssh directory on your AppleTV, create an "authorized_keys" file and move your public key into it.
mkdir .ssh
mv id_rsa.pub .ssh/authorized_keys

You're done. Exit the ssh session, and try it again. This time, you can connect to the AppleTV without having to enter a password (or by using your passphrase, if you chose to use one).

For more information, see the man pages for ssh, ssh-keygen, and sshd.

Notes

  • The old Step 5 described how to make ssh keys. You won't have to create those, as OS X will create them the first time you connect to its sshd if they don't already exist. Thus, this section was removed.
  • The previous author of this page suggested getting sources for OpenSSL and OpenSSH. This method might be easier if you don't know how to extract files from packages such as the OS or Security updates.)