Upgrading old TPLink 1043nd with latest Open WRT

Main purpose is to have SSH tunel to my remote home network.

Update
root@OpenWrt:/tmp# wget http://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/generic/openwrt-15.05.1-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin
Connecting to downloads.openwrt.org (78.24.191.177:80)
openwrt-15.05.1-ar71 100%

 root@OpenWrt:/tmp# ls -la
-rw-r--r--    1 root     root       3473412 Feb 17 10:11 openwrt-15.05.1-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin

root@OpenWrt:/tmp# md5sum openwrt-15.05.1-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin
f5f073251dd3b191e9ed806cb95de029  openwrt-15.05.1-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin
Unlocking firmware ...

 Writing from openwrt-15.05.1-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin to firmware ...
Rebooting ...

Turning router into access point

I've edited network config file:
config interface 'lan'
        option ifname 'eth0.1'
        option force_link '1'
        option type 'bridge'
        option proto 'dhcp'
#       option proto 'static'
#       option ipaddr '192.168.1.1'
#       option netmask '255.255.255.0'
#       option ip6assign '60'

And enabled WiFi to have better WiFi coverage:
config wifi-device  radio0
        option type     mac80211
        option channel  11
        option hwmode   11g
        option path     'platform/ath9k'
        option htmode   HT20
        # REMOVE THIS LINE TO ENABLE WIFI:
#       option disabled 1

config wifi-iface
        option device   radio0
        option network  lan
        option mode     ap
        option ssid     Mrowla83b
        option encryption psk2
        option key *********



...
It turned out that Dropbear is very limited, so I've switched to OpenSSH:
root@OpenWrt:/etc/config# cat dropbear
config dropbear
        option PasswordAuth 'on'
        option RootPasswordAuth 'on'
        option Port         '2222'

 root@OpenWrt:/etc/config# opkg install openssh-server

Installing openssh-server (7.1p2-1) to root...

Note that I do not disable Dropbear. The reason is that in case I screw up the OpenSSH, I will still be able to access remotely my OpenWrt device (via Dropbear).

Comments

Post a Comment

Popular posts from this blog

Hardening OpenWRT - adding non-root user account

I have at home an OpenWRT on TP-Link 1043ND. As I'm most of the time out of my home, I use this for two functions:  - as reliable WiFi Access Point  - as last resort remote access device  - as a box used to wake up other Ethernet enabled devices @ home. As this box is exposed to Internet via IPv6 address, I decided to harden it a little. 1. Adding extra non privileged user account: root@OpenWrt:~# opkg update root@OpenWrt:~# opkg install shadow-useradd root@OpenWrt:~# mkdir /home root@OpenWrt:~# useradd -D GROUP=100 HOME=/home INACTIVE=-1 EXPIRE= SHELL= SKEL=/etc/skel CREATE_MAIL_SPOOL=no root@OpenWrt:~# useradd -m -s /bin/ash bart root@OpenWrt:~# cat /etc/passwd root:x:0:0:root:/root:/bin/ash daemon:*:1:1:daemon:/var:/bin/false ftp:*:55:55:ftp:/home/ftp:/bin/false network:*:101:101:network:/var:/bin/false nobody:*:65534:65534:nobody:/var:/bin/false bart:x:1000:1000::/home/bart:/bin/ash root@OpenWrt:~# passwd bart Changing password for bart New passw
Read more

Dropbear SSH keys and autossh on OpenWRT

Image
I have a box on Amazon EC2. And I want to have my OpenWRT that is behind IPv4 CGN and have public IPv6 to be reachable from IPv4 Internet. The best idea is to use ssh reverse tunnel connected with autossh to keep connection going. The very first think is to test if I can connect to my Amazon instance from my OpenWRT: root@OpenWrt:~# ssh 54.111.111.111 Host '54.111.111.111' is not in the trusted hosts file. (ssh-rsa fingerprint md5 0f:51:11:11:11:11:11:11:11:11:11:11:11:11:11:11) Do you want to continue connecting? (y/n) y root@54.111.111.111's password: At this point the public key of remote host will be added to .ssh/known_hosts. It is important as we can't have autossh to interact with console in future. root@OpenWrt:~# cat .ssh/known_hosts 2001:1111:1111:1111::1111:1111 ssh-rsa AAAAB3N....... 54.111.111.111 ssh-rsa AAAAB3N.......... Now we need to generate public/private key pair we will be using to connect to our Amazon instance. Invoke fol
Read more

SSH Tunel with OpenWRT

You need to install OpenSSH client: root@OpenWrt:~# opkg update root@OpenWrt:~# opkg install openssh-client Now OpenSSH client replaced DropBear client: root@OpenWrt:~# ls -l /usr/bin/ssh -rwxr-xr-x    1 root     root        590667 May 24 14:54 /usr/bin/ssh root@OpenWrt:~# ls -l /rom/usr/bin/ssh lrwxrwxrwx    1 root     root            16 Aug 19  2016 /rom/usr/bin/ssh -> ../sbin/dropbear root@OpenWrt:~# ls -l /overlay/upper/usr/bin/ssh -rwxr-xr-x    1 root     root        590667 May 24 14:54 /overlay/upper/usr/bin/ssh Can you spot a difference: root@OpenWrt:~# ssh usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]            [-D [bind_address:]port] [-E log_file] [-e escape_char]            [-F configfile] [-I pkcs11] [-i identity_file]            [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]            [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]            [-S ctl_path] [-W ho
Read more