FreeNAS : how to access jails in SSH WITH certificate pairs (/etc/ssh/sshd_config entries not considered in jail)

[Phil1295]

Hi,

I need help enabling SSH in the jail with the key pair + disable the password login option for SSH

I tried to customize ssh access in one of my jails:
- I wanted to disable password authentication and enable only the certificate mode
- I wanted to change the default 22 port

I edited the /etc/ssh/sshd_config

Code:

Port 15270
ChallengeResponseAuthentication no

I added the proper rc.ipfw.conf entries for ssh and the new port allow rules:

Code:

# Allow anything outbound from this address.
add allow all from 192.168.5.33 to any out

# Deny anything outbound from other addresses.
add deny log all from any to any out

# Allow TCP through if setup succeeded.
add allow tcp from any to any established

# Allow IP fragments
add allow all from any to any frag

# Allow inbound ssh
add allow tcp from 192.168.5.0/24 to 192.168.5.33 15270 setup

# Everything else is denied and logged.
add deny log all from any to any

I enabled the firewall and restarted the services:

Code:

sysrc firewall_type="/etc/rc.ipfw.conf
sysrc firewall_enable="YES"
service ipfw start
service sshd restart

I still could access the sshd on port 22 with a password, the new port was not enabled
This command showed the sshd service still listening on port 22:

Code:

sockstat -4 -l

To prove it is the sshd_config not being processed and that my setup is fine:
- I stopped the sshd service and manually started it using teh custom port number I opened in firewall:

Code:

service sshd stop
/sbin/sshd -p 15270

I could login to the jail using ssh on the new port and port 22 was properly disabled when checking the "sockstat -4 -l" command

This is really annoying. I ended up disabling the SSH service for the jail and using GUI shell with all its limitations (copy/paste, size...) as I do not want to enable password authentication only and the 22 port on that jail

Is there any way to make the sshd service aware of some config file location in the jails or to properly setup SSH with key pairs in the jail ?

Best regards

 

[Phil1295]

Edited title and made it more clear
Hope to get some help

 

[sretalla]

Are you 100% positive that the sshd_config file you edited is in the jail and not on the host system?

I was able to log in (just used password auth to be quick) on port 22 in a jail after editing the config file in that jail and starting the service.

I then changed the config to port 15270 and restarted the service and was able to log on correctly on that port and not on 22.

 

[Phil1295]

So many thanks
After your post, I tried again: I was editing by mistake/inattention the ssh_config file instead of the sshd_config

I would have never looked at it again as I was sure I was editing the sshd_config, as you see in my first post. I made a typo and spent hours trying to debug it without noticing I was on the bad file (thanks to bash history use...)

Thank you again, yes, editing the good file works now
That was so silly from my part, but happens when working late in the night...