AutoSSH on Odriod XU4 running Kali Linux 2

In my last blog, SSH into Kali 2.0 on ARM (Odroid, Banana Pi, etc), I configured SSH with RSA public/private keys so that I could securely connect the Odroid with certificates instead of a username and password.

In this blog I am going to install autossh and setup the Odriod to automatically create an SSH tunnel to my Digital Ocean CentOS virtual server on boot. Why would you want to do this? Sometimes you want to leave the Odriod at a site and access it later. Having a tunnel that automatically comes up on boot and reconnects if the tunnel drops means you can always log in.

Install autoSSH

AutoSSH is in the Kali repository so no repositories need to be added.

root@kali:~# apt-get install autossh ssh

This will install autossh and the latest version of the SSH client.

Generate a new set of RSA keys

These keys will be created WITHOUT a pass phrase. We can't have a pass phrase on this set of keys because the Odroid needs to be able to automatically connect without any user intervention.

root@kali:~# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): /root/.ssh/nopwd
Enter passphrase (empty for no passphrase): LEAVE This Blank
Enter same passphrase again:
Your identification has been saved in /root/.ssh/nopwd.
Your public key has been saved in /root/.ssh/nopwd.pub.
The key fingerprint is:
SHA256:7ZmIPa2zD0YMtkvBpm9/juu5mjL98nrpG8nGurwmWFY root@kali

Review the keys

root@kali:~# ls ~/.ssh
authorized_keys  id_rsa  id_rsa.pub  known_hosts  nopwd  nopwd.pub

root@kali:~/.ssh# cat nopwd.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqsWLWXwoafVWsXAyNtZsnhYzn6PO2t5Ryr0U1JfQzVYwbmLB/MkUXTP57bwSGZ7XiljrsayrJwQny08Wxj11WYl74un1lsvBk+75HNiHC76F9iIF0jN12N0OgybdKymWGEIV5u9q7oqAw41ZXJDqgMA+ZglvGeyH9Ge2OWHyzSKSlGLl4bV51ww/FH0ZtPxXFKgoRSmQ8C7AP7IIFRLZJXJm1fSMdC+TpvUx68baCGo91PwZcdHY9dPnKaYZxcUlzRc0ou4pph3kr+b9beZsrJh/DGlrQC1uRy4HljKOGH4Bq1daf5GkrZQZNvfrXofT4WVyYWgzJ6u7Cs42/29tP root@kali

Copy the new keys to the Digital Ocean VPS

root@kali:~# ssh-copy-id -i .ssh/nopwd.pub -p 22 mhubbard@VPS-IP-Address
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/nopwd.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Enter passphrase for key '/root/.ssh/id_rsa':

Number of key(s) added: 1

Test that the key was copied

Note that we have to use the SSH parameter -i to explicitly use our now password key. This is because I have disabled passwords on my VPS.

root@kali:~# ssh -p 22 -i /root/.ssh/nopwd  mhubbard@VPS-IP-Address
Last login: Mon Sep  5 11:12:07 2016 from xxx-xxx-xxx-xxx-static.rvsd.ca.charter.com

mwhubbard.blogspot.com

This is a private system. Unless you have explicit
permission from Michael Hubbard logout immediately!

AutoSSH parameters

-M 10984 - autoSSH monitoring port. Used to keep the connection up
-o "PubkeyAuthentication=yes" Authenticate with SSH Keys instead of passwords.
-o "PasswordAuthentication=no" Explicitly disable password authentication
-i /root/.ssh/nopwd Explicitly use our no password key
-R 2223:localhost:22: reverse tunnel. forward all traffic on port 2223 on the VPS to port 22 on the Odriod.

Run autossh to connect to the Digital Ocean VPS

root@kali:~/.ssh# autossh -M 10984 -o "PubkeyAuthentication=yes" -o "PasswordAuthentication=no" -i /root/.ssh/nopwd -R 2223:localhost:22 mhubbard@107.170.203.230 -p 22
Last login: Sun Sep  4 21:52:16 2016 from xxx-xxx-xxx-xxx-static.rvsd.ca.charter.com

mwhubbard.blogspot.com

This is a private system. Unless you have explicit
permission from Michael Hubbard logout immediately!

Enable the tunnel on boot

These steps come straight from the "Persistent Reverse (NAT Bypassing) SSH tunnel" site listed in the references. It was the piece that I  didn't know how to do and the blog was excellent.

Here is a screen shot of my /etc/rc.local file

References
Persistent reverse (NAT bypassing) SSH tunnel access with autossh - This is a great site for system admins. I am really glad I found it.
autossh – Automatically restart SSH sessions and tunnels
Bypassing corporate firewall with reverse ssh port forwarding
SSH TUNNELLING FOR FUN AND PROFIT: AUTOSSH

SSH into Kali 2.0 on ARM (Odroid, Banana Pi, etc)

My latest pen testing tool is an Odroid UX4 from Ameridriod.com. The XU4 is an 8 core ARM based Single Board Computer (SBC). The team at Offensive Security have ported Kali 2.0 to run on the Odroid. I flashed Kali 2.0 onto the eMMC card and the image works great. My next step was to setup SSH for remote access.

Kali 2.0 follows the Debian model of not allowing Root logins without a key.  This is definitely the most secure way to use SSH for remote access and it easy to set up.

If you are running headless you will need to use the USB/UART that Hardkernel sells for the UX4. I have found the Logitech MK620 wireless keyboard/mouse works great with the Odroid XU4. The wireless keyboard does have security issues (see Keysniffer.net) but I don't use it anywhere but in my lab.

Generating the RSA private/pubic keys

If you need to create RSA keys on Windows please see my blog Authenticating to Cisco devices using SSH and your RSA Public Key on using puttygen to create the keys.

On a Linux box

You should always move the default SSH keys on your distribution to a backup folder and create new keys before using SSH. See Duplicate SSH Keys Everywhere
If you need to generate an RSA key pair:
ssh-keygen
select the default location
enter a pass phrase to protect the keys.

Here's what it looked like on my Ubuntu laptop:

mhubbard@1S1K-SYS76:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/mhubbard/.ssh/id_rsa):
Created directory '/home/mhubbard/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/mhubbard/.ssh/id_rsa.
Your public key has been saved in /home/mhubbard/.ssh/id_rsa.pub.
The key fingerprint is:
3a:1f:82:3a:60:b5:99:e0:4e:9e:91:92:12:05:4d:fc mhubbard@1S1K-SYS76

Here are the keys in the hidden .ssh folder:
mhubbard@1S1K-SYS76:~$ ls -la ~/.ssh
total 20
drwx------  2 mhubbard mhubbard 4096 Aug 30 11:13 .
drwxr-xr-x 18 mhubbard mhubbard 4096 Aug 30 11:13 ..
-rw-------  1 mhubbard mhubbard 1766 Aug 30 11:05 id_rsa
-rw-r--r--  1 mhubbard mhubbard  401 Aug 30 11:05 id_rsa.pub
-rw-r--r--  1 mhubbard mhubbard  222 Aug 30 11:13 known_hosts

To display the fingerprint in the future:
mhubbard@1S1K-SYS76:~$ ssh-keygen -lf ~/.ssh/id_rsa
2048 3a:1f:82:3a:60:b5:99:e0:4e:9e:91:92:12:05:4d:fc  mhubbard@1S1K-SYS76 (RSA)

This pass phrase will be required the first time you connect to a device but is it much safer than not using one. If you lose control of your private key and didn't have a pass phrase set it could be used to log into any device you set up.

Once you have the key pair generated you need to copy the public key and paste it into the authorized_keys file on the Odroid.

mhubbard@1S1K-SYS76:cd ~/.ssh
mhubbard@1S1K-SYS76:~/.ssh$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUUfkp+xPLQDmGaPokHXxK6yhxG1a+pmdCHDzHFBSqsGJIMuVSSwzUksfJU7XG5PEcE8Yt9qU2WVieZXsjMcdZDphhNzdT4RSW63m12ov7jo35KBGFEHnNGv/m6cUEOq9oGfRD5sE7g2wF+QQh74Y4m1ld5VnOicGaR/qyYSazpBJlZKHP2lYfb2coDhHHsnoyBedZbtFxNK3lPKggd4mywmJ19XSZ9Bm2/HurcibYJodHdDn0BoP9Qlvc5vRiZqT6XAS9tIhzeydgkmhYQ8UnAYeclo/WiTR98FYEXzm+aGV0/bH4IZB6mlth53YyR/hxeeKzn7WqTc6/WKx9qrSB mhubbard@1S1K-SYS76

Copy the entire key including the ssh-rsa and username@system

On the Odriod

cd ~
mkdir .ssh
nano /root/.ssh/authorized_keys


ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUUfkp+xPLQDmGaPokHXxK6yhxG1a+pmdCHDzHFBSqsGJIMuVSSwzUksfJU7XG5PEcE8Yt9qU2WVieZXsjMcdZDphhNzdT4RSW63m12ov7jo35KBGFEHnNGv/m6cUEOq9oGfRD5sE7g2wF+QQh74Y4m1ld5VnOicGaR/qyYSazpBJlZKHP2lYfb2coDhHHsnoyBedZbtFxNK3lPKggd4mywmJ19XSZ9Bm2/HurcibYJodHdDn0BoP9Qlvc5vRiZqT6XAS9tIhzeydgkmhYQ8UnAYeclo/WiTR98FYEXzm+aGV0/bH4IZB6mlth53YyR/hxeeKzn7WqTc6/WKx9qrSB mhubbard@1S1K-SYS76

CTRL+x to exit. Be sure to answer y and save the file.

Note: Make sure the key is on one line! This isn't an issue on Linux/Mac OX but if you copy the key from a Windows box it will probably have line feeds in it. MS can never follow the standards set by Unix decades ago!

On your favorite ssh client 

I use Perl Auto Connect (PAC) on Linux and Putty on Windows. If you are a Windows user my previous blog covers using an RSA key pair with Putty.

On PAC
Create a new connection
Click the Private Key Radio button
Browse to the ~/.ssh folder and select your private key
Enter root as the user:
Enter the pass phrase for the private key.
Click "Save and Close".

You can now log into Kali with your RSA key pair.

References
Kali Linux 2.0 Top 10 Post Install Tips
Kali SSH problems

PathTest for Kali Linux

You can read about how to use PathTest in the "PathTest on Windows" blog post. Here I explain how to get it working on Kali.

Download Pathtest to the tmp folder.
unzip Linux_32-bit.zip

root@kali-32:/tmp# unzip Linux_32-bit.zip
Archive:  Linux_32-bit.zip
   creating: Linux_32-bit/
  inflating: Linux_32-bit/pathtest
root@kali-32:/tmp# ls
Linux_32-bit

Run PathTest
root@kali-32:~/Linux_32-bit# ./pathtest -c 192.168.10.138

If you get an error:
"./pathtest: error while loading shared libraries: libcrypto.so.4: cannot open shared object file: No such file or directory" 

it's because Kali's crypto lib is named libcrypto.so.1.0.0 but Pathtest is expecting libcrypto.so.4 so we need to create a link between them.

First run "locate" to find libcrypto:
root@kali-32:/tmp/Linux_32-bit# locate libcrypto
/usr/lib/libcrypto++.so.9
/usr/lib/libcrypto++.so.9.0.0
/usr/lib/libcryptopp.so.9
/usr/lib/i386-linux-gnu/libcrypto.so.1.0.0

Now we can create the Link:

root@kali-32:/tmp/Linux_32-bit# cd /usr/lib/i386-linux-gnu/
root@kali-32:/usr/lib/i386-linux-gnu# ln -s libcrypto.so.1.0.0 libssl.so.4
root@kali-32:/usr/lib/i386-linux-gnu# ln -s libcrypto.so.1.0.0 libcrypto.so.4
root@kali-32:/usr/lib/i386-linux-gnu# cd /
root@kali-32:/# cd /tmp
root@kali-32:/tmp# cd Linux_32-bit/
root@kali-32:/tmp/Linux_32-bit# ./pathtest -s
PathTest (TM) v.4.6.0 build 4639
Copyright (c) 2011, AppNeta Inc. All Rights Reserved.

Success!