<div class="bbWrapper">Hi there good people,<br />
<br />
i have a remote Truenas system for backups it is reachable via SSH.<br />
And usually also via a VPN for the GUI. But the VPN system seems to have failed. But the SSH is still reachable.<br />
So i thought i could make a dynamic port forward through the ssh connection. <br />
But certain settings in the truenas sshd configuration are blocking this unfortunately. <br />
Changing the sshd_config file in truenas does not survie the reboot and i cannot access the gui to change the configuration.<br />
<br />
After googling and searching here the only thread with my problem i found was this one:<br />
<div class="bbCodeBlock bbCodeBlock--unfurl js-unfurl fauxBlockLink"
data-unfurl="true" data-result-id="9956" data-url="https://www.truenas.com/community/threads/is-it-possible-to-restart-the-sshd-service-in-command-line.69754/" data-host="www.truenas.com" data-pending="false">
<div class="contentRow">
<div class="contentRow-main">
<h3 class="contentRow-header js-unfurl-title">
<a href="https://www.truenas.com/community/threads/is-it-possible-to-restart-the-sshd-service-in-command-line.69754/"
class="link link--internal fauxBlockLink-blockLink"
target=""
rel=""
data-proxy-href="">
Is it possible to restart the sshd service in command line ?
</a>
</h3>
<div class="contentRow-snippet js-unfurl-desc">I'm in vacation and I try to activate the ssh tunneling in my FreeNas. So I've uncomment the "AllowTcpForwarding yes" option to the sshd_config file but now I try restart the service to make the changes active. (I don't have access to the WebUI). I've tested "service sshd restart" and I got...</div>
<div class="contentRow-minor contentRow-minor--hideLinks">
<span class="js-unfurl-favicon">
<img src="https://www.truenas.com/community/data/assets/logo/FORUMSFAVICON.png" alt="www.truenas.com" class="bbCodeBlockUnfurl-icon"
data-onerror="hide-parent"/>
</span>
www.truenas.com
</div>
</div>
</div>
</div>
<br />
But i could not find a solution.<br />
<br />
So maybe someone here can help me avoid the drive to the remote location? O<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite1" alt=":smile:" title="Smile :smile:" loading="lazy" data-shortname=":smile:" /><br />
Is there a CLI way to change the sshd configuration?<br />
Or does this not work as the absence of google results suggest :(</div>
<div class="bbWrapper">Hi,<br />
<br />
All you need to do is to change that setting from the WebUI... Using your SSH connection, forward local port 8443 to 127.0.0.1:443. Then you point your browser to your own local port 8443 (<a href="https://127.0.0.1:8443" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://127.0.0.1:8443</a>) and you will see your WebUI, forwarded and secured by SSH.<br />
<br />
ssh -l root your.nas.ip.addr -L 8443:127.0.0.1:443<br />
<br />
<div>
<a href="https://127.0.0.1:8443"
class="link link--external"
target="_blank"
rel="nofollow ugc noopener"
data-proxy-href="">
https://127.0.0.1:8443
</a>
</div></div>
<div class="bbWrapper">thank you for your answer! :)<br />
<br />
Unfortunately that is exactly what i want to change because this does not work.<br />
When i try what you mentioned, and try to connect via browser, it says in the terminal:<br />
"channel 3: open failed: administratively prohibited: open failed".<br />
That is why i thought i need to add "AllowTcpForwarding yes" to the sshd_config.</div>
<div class="bbWrapper">Since i cannot get to the UI on the remote truenas, even via ssh port forwarding as suggested because of above error.<br />
i wanted to see if the port forwarding works on my local truenas system where i can get to the UI and change the sshd configuration.<br />
Long story short, same error "channel X: open failed: administratively prohibited: open failed".<br />
Even after i add the "AllowTcpForwarding yes" to the sshd configuration on the local truenas via the the GUI.</div>
<div class="bbWrapper">Hi,<br />
<br />
Indeed, you need to activate TCP Port Forwarding once in the config file using CLI.<br />
<br />
But once you did it, you forward the socket to reach the WebUI and then you activate it from the WebUI. (Service ; SSH ; Allow TCP Forwardind ; put a check mark there). After that it wlll survive the reboots.</div>
<div class="bbWrapper">Oooh, there is an option in the ServiceGui. Oh my, am i blind<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite11" alt=":rolleyes:" title="Roll Eyes :rolleyes:" loading="lazy" data-shortname=":rolleyes:" />. I completely overlooked that one when trying it out on the local system. Thank you! :)<br />
<br />
As for the the remote system, i will try as you suggested and report back. Thank you so much!</div>
<div class="bbWrapper">In the sshd_config i commented in the "AllowTcpForwarding yes".<br />
<br />
<ul>
<li data-xf-list-type="ul">Then i tried to restart the sshd with "service sshd restart" -> "Cannot 'restart' sshd. Set sshd_enable to YES in /etc/rc.conf or use 'onerestart' instead of 'restart'."</li>
<li data-xf-list-type="ul">With onerestart -> "Performing sanity check on sshd configuration.No host key files found"</li>
<li data-xf-list-type="ul">So i did "ssh-keygen -A". After that the onerestart worked -> "Performing sanity check on sshd configuration.Stopping sshd.<br />
Waiting for PIDS: 1902.<br />
Performing sanity check on sshd configuration.<br />
Starting sshd."</li>
<li data-xf-list-type="ul">My current session did not end. And i could not open a new ssh connection. -> "Connection refused".</li>
<li data-xf-list-type="ul">Since my old connection was still open, i rebooted the system to reset everything. Now i can connect again, but still am at a loss.</li>
</ul>Do you have any thoughts on that? I probably did sth wrong. <br />
Sorry for all the questions! <br />
On the other hand i am learning a lot <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite6" alt=":cool:" title="Cool :cool:" loading="lazy" data-shortname=":cool:" /></div>
<div class="bbWrapper"><a href="https://www.truenas.com/community/members/101891/" class="username" data-xf-init="member-tooltip" data-user-id="101891" data-username="@Samuel Tai">@Samuel Tai</a> There must be an API or midclt call to enable TCP port forwarding, right? Can you help from the top of your head?</div>
<div class="bbWrapper">Up? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite1" alt=":smile:" title="Smile :smile:" loading="lazy" data-shortname=":smile:" /><br />
Last try, before i jump in the car tomorrow and drive there :D<br />
Thanks for all the help one way or the other! :)</div>
<div class="bbWrapper">Way too late to help you, but here's what I got to work in a similar situation. Note that the service name (in Truenas 12) is openssh, not sshd, which I discovered by trial and error. Also the config file is /usr/local/etc/ssh/sshd_config, not in /etc. So,<br />
<br />
<ol>
<li data-xf-list-type="ol">I changed AllowTcpForwarding from "no" to "yes" in /usr/local/etc/ssh/sshd_config. Removing it probably works as well since "yes' should be the default</li>
<li data-xf-list-type="ol">I reloaded the config with "service openssh reload". </li>
<li data-xf-list-type="ol">Then I started a new ssh session with: "ssh -L 4433:my.truenas.lan.ip:443 my.router.wan.ip". (My router ssh port is forwarded to TrueNAS.)</li>
<li data-xf-list-type="ol">Then I could connect to local port 4433 to get to the truenas GUI and properly change the setting under Services -> SSH so nothing weird happens on a restart.</li>
</ol>I was then able to forward any local ports into my LAN.</div>
<div class="bbWrapper">Great, awesome, thank you!<br />
It is too late for me, but i learned something new <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite6" alt=":cool:" title="Cool :cool:" loading="lazy" data-shortname=":cool:" /><br />
And it will help someone when having the same problem :)</div>
<div class="bbWrapper">Thank you <a href="https://www.truenas.com/community/members/77752/" class="username" data-xf-init="member-tooltip" data-user-id="77752" data-username="@fizassist">@fizassist</a> ! May have been too late for <a href="https://www.truenas.com/community/members/100585/" class="username" data-xf-init="member-tooltip" data-user-id="100585" data-username="@brutkruemel">@brutkruemel</a> but very on time for me. Worked like a charm.</div>
<div class="bbWrapper"><blockquote data-attributes="member: 77752" data-quote="fizassist" data-source="post: 654310"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=654310"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-654310">fizassist said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Also the config file is /usr/local/etc/ssh/sshd_config
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote>That's pretty much normal for FreeBSD--anything that isn't part of the base system goes in /usr/local/.</div>
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
