Changing SSH Port and Other System Settings

Complex_Username · July 30, 2016 at 10:01 PM

Hi all,

I've just switched from a Raspberry Pi B+ to a ODROID-C2. Prior to that I was running Kodi on a desktop computer as a HTPC. Just setting up my new to me LibreELEC and there's a few things I can't figure out and Google (and this forum) return nothing which is mostly how I configure system settigns such as SSH port, setting up SSH keys and a few other tweaks when / is mounted as read-only please.

I can't find anything relating to this in the wiki either unelss I'm looking for the wrong subject. As a side note anyone have problems posting in Chrome? I've had to blow off the dust and fire-up Firefox just to post this. In Chrome this text entry box appears greyed out.

Thanks

**nickr** · July 31, 2016 at 12:10 AM Official Post

Setting up a ssh auth key is the same as on any other system, keys are stored in ~/.ssh.

Not sure if you can change the ssh port, or why you would want to.

Complex_Username · July 31, 2016 at 8:20 AM

I want to change it because none of my computers run SSH on port 22 and my ISP blocks it. For this reason, none of my computers run SSH on port 22 and it'll be slightly annoying to remember 1 computer that isn't the standard in my house. I'm aware I could use .ssh/config but that doesn't help when I get a new computer.

Eventually I'll want to disable root login too.

Grimson · July 31, 2016 at 1:53 PM

If you want to change the defaults you'll have to build LE yourself: Compile - LibreELEC

**awiouy** · July 31, 2016 at 9:20 PM Official Post

Quote from Complex_Username

Hi all,

I've just switched from a Raspberry Pi B+ to a ODROID-C2. Prior to that I was running Kodi on a desktop computer as a HTPC. Just setting up my new to me LibreELEC and there's a few things I can't figure out and Google (and this forum) return nothing which is mostly how I configure system settigns such as SSH port, setting up SSH keys and a few other tweaks when / is mounted as read-only please.

I can't find anything relating to this in the wiki either unelss I'm looking for the wrong subject. As a side note anyone have problems posting in Chrome? I've had to blow off the dust and fire-up Firefox just to post this. In Chrome this text entry box appears greyed out.

Thanks

Hello Complex_Username,

According to the code, you can pass parameters to sshd of LibreELEC with the SSH_ARGS variable of /storage/.cache/services/sshd.conf, which is writeable. Eg, to have sshd listen on port 789, set SSH_ARGS="-p 789" in /storage/.cache/services/sshd.conf, and then restart sshd (with systemctl restart sshd, or with reboot).

I never used this option, so I cannot confirm that it actually works, but it might be worth a try.

Please let me know if it makes or breaks.

Complex_Username · July 31, 2016 at 10:50 PM

Awiouy, I can confirm it works fine and sustains the settings over a reboot. I'll play with the settings for further customisation.

Thank you very much!

**nickr** · August 1, 2016 at 1:51 AM Official Post

I assume you have a NAT router. You can set it to accept ssh on port (anything) and forward to 22 on the client.

The ISP doesn't have a clue what ports are in use on your LAN.

JonWW · October 23, 2016 at 7:08 PM

Quote from Complex_Username

Awiouy, I can confirm it works fine and sustains the settings over a reboot. I'll play with the settings for further customisation.

Thank you very much!

Although the settings are retained over a reboot, if any services are enabled their .conf files in /storage/.cache/services are over written after the reboot, but not before ssh has had a chance to see which ports it should be listening on.

So first reboot you can log in on your chosen port number.
The second reboot everything is back to the defaults and you can only login on port 22, unless you updated the file after the first reboot.

Ahhhh!

For those interested: I'm running LibreELEC (official) v7.0.2 Raspberry Pi 3 freshly installed.

**chewitt** · October 24, 2016 at 4:12 PM Official Post

You can use /storage/.config/autostart.sh to force values in /storage/.cache/ssh/sshd.conf; autostart is executed early in the boot sequence before networking and things like SSH are started.

pila · July 1, 2018 at 7:06 PM

Quote from awiouy

Hello Complex_Username,

According to the code, you can pass parameters to sshd of LibreELEC with the SSH_ARGS variable of /storage/.cache/services/sshd.conf, which is writeable. Eg, to have sshd listen on port 789, set SSH_ARGS="-p 789" in /storage/.cache/services/sshd.conf, and then restart sshd (with systemctl restart sshd, or with reboot).

Works perfectly (LE 7) and there is even a line to turn on and off password access, should one need that (as I did).

autostart.sh did not work for me. But, as my script runs every 5 minutes, it checks if /storage/.cache/services/sshd.conf contains my argument, and if not, adds it and restarts sshd.

Kiki · May 8, 2021 at 11:58 AM

The other option is to put in /storage/.config/shutdown.sh code like this:

Code

case "$1" in

halt)

# your commands here

;;

poweroff)

# your commands here

;;

reboot)

# your commands here

;;

*)

# your commands here

sed -i 's/SH_ARGS=".*"/SH_ARGS="-p 33322" /g' /storage/.cache/services/sshd.conf

;;

esac

Display More

Everything is retained over the reboot.

Thanks to everyone in this thread, it's the only source of information i found about this issue

stef70 · October 28, 2022 at 12:03 AM

Another way is to create a custom systemd service.

Copy /etc/ssh/sshd_config to /storage/.config/sshd/sshd_config and edit the Port value (or any other settings).

Then create a file /storage/.config/system.d/sshd-custom.service

Code

[Unit]
Description=OpenSSH server daemon 
After=network.target

[Service]
Restart=on-failure
ExecStart=/usr/sbin/sshd -D -f /storage/.config/sshd/sshd_config
ExecReload=/bin/kill -HUP $MAINPID
TimeoutStopSec=1s
RestartSec=2
StartLimitInterval=0

[Install]
WantedBy=multi-user.target

Display More

This is basically a simplified version of /usr/lib/systemd/system/sshd.service

The new service must be enabled with systemctl enable sshd-custom.service and started with systemctl start sshd-custom.service (or reboot).

Once this is working, you can disable the default ssh service on port 22 in the Libreelec gui.