- Sample SSH Config File Example. Now I can just do SSH for one of these servers and the respective configuration option will be used for the connection (Here I have not defined any server1 in /etc/hosts and this mapping is working due to the SSH configuration file) deepak@client $ ssh server1 root@ 192.168.43.154 's password: Welcome to server1 This file was created on 2020-02-01 Go away if.
- Setting this option to 'yes' in the global client configuration file /etc/ssh/sshconfig enables the use of the helper program ssh-keysign(8) during HostbasedAuthentication. The argument must be 'yes' or 'no'. The default is 'no'. This option should be placed in the non-hostspecific section. See ssh-keysign(8) for more information.
- Sshdconfig is the OpenSSH server configuration file. How to configure and troubleshoot. Avoid getting accidentally locked out of remote server.
Enable UDM SSH Access
If you don’t have remote access enabled, you will need to be connected locally to the UDM, and navigate to it’s IP address in a web browser.
If you have remote access enabled, you can navigate to unifi.ui.com and access the SSH setting there.
If you don't have an SSH key pair, open a bash shell or the command line and type in: ssh-keygen -t rsa -b 2048 This will generate the SSH key. Press Enter at the following prompt to save the key in the default location (under your user directory as a folder named.ssh).
Enable SSH in the UDM Device settings:
Click on the gear icon to access the UDM device settings
Click on Advanced
Enable SSH and set your SSH password
SSH into the UDM with the username of “root” and the password you just set
Open your terminal application of choice. There are many applications that you can use, but some quick recommendations based on your OS:
macOS = built-in Terminal application. I also like Termius.
Windows = PuTTY, or enable the new built-in Windows Terminal in Windows 10.
Linux = You should already know this!
If your IP address is 192.168.1.1, you’d type ssh root@192.168.1.1 and hit enter. Replace the IP, but the username is always root.
If this is your first time accessing the device, accept the authenticity of the host key by typing yes and hit enter
Access the UniFi OS shell by typing unifi-os shell and hit enter
What You Can Do With SSH Access
Windows Ssh Config File Missing
If you’re not familar with SSH, Ubiquiti has a good help page which introduces what SSH is and how it works. The one sentence summary is that SSH allows for a safe way to read and write the configuration, access logs, and troubleshoot problems.
The “configuration” part doesn’t really apply to the UDM, though. With the UDM, you have to make your permanent configuration changes through the web UI. The UDM doesn’t have a configuration shell, you will only have direct Linux shell access. The Unifi service or a firmware update will overwrite most things you can change.
UbiOS/UniFi OS is based on Buildroot Linux, and is Ubiquiti’s custom implementation. You are not allowed to install packages or modify things like you might be used to on other Linux-based devices. With that said, there’s still a few things you can do.
Available commands
Typing “help” shows an incomplete list of the commands that are available:
Built-in commands available to root user:
. : [ [[ alias bg break cd chdir
command continue echo eval exec
exit export false fg getopts
hash help history jobs kill let
local printf pwd read readonly
return set shift source test times
trap true type ulimit umask
unalias unset wait
Standard Linux commands like ifconfig, tcpdump, netstat, whoami and cat are also available. There are also some commands and files that are unique to the UDM and not well documented by Ubiquiti. This reddit thread shows a good list of these unique commands, file locations, and what they are good for. Refer to the commands on the right side of the table
Retrieve Log Files
This is Ubiquiti's help article for how to retrieve log files. You can use view the specific logs you’re interested in by using the cat command, or view live logs with tail.
Show UniFi server logs with: cat /mnt/data/unifi-os/unifi/logs/server.log
Show UniFi system logs with: cat /mnt/data/unifi-os/unifi-core/logs/system.log
Refer to Ubiquiti’s help page and this Reddit thread for more examples.
Manual Firmware Upgrade
One of the most common uses of SSH is firmware upgrades, especially for beta firmware. You can SSH into any of your UniFi devices, and run the ubnt-upgrade command with the proper file URL. This requires the device to be online and able to reach the internet.
ubnt-upgrade https://fw-download.ubnt.com/<insertfilepathhere>.bin
The best source to find the firmware URL is Ubiquiti’s community forums. Search for your device on this software releases page, and get the link to the firmware you want to install.
Another way to do this is by using the web interface. Under the devices tab, select your device, and click on the gear-shaped config icon. Paste the URL and hit the “custom upgrade” button. You don’t need the “ubnt-upgrade” command before the URL, that is only needed when you are using the command line.
Sources and Links
/etc/ssh/sshd_config Missing
-Help article showing commands for retrieving log files.
-Ubiquiti’s SSH intro help article.
-Ubiquiti’s software releases page.
-Reddit thread with useful commands for the UDM and UDM-Pro.
I will continue to update this guide as I find more information about SSH access on the UDM and UDM-Pro. Until then, I have a lot of other posts where I talk about UniFi hardware and software:
Other Ubiquiti Guides and Reviews
If you have more questions about Ubiquiti or anything in this post, leave a comment or contact me. I will do my best to point you in the right direction, or help in any way I can.
-->This topic covers the Windows-specific configuration for OpenSSH Server (sshd).
OpenSSH maintains detailed documentation for configuration options online at OpenSSH.com, which is not duplicated in this documentation set.
Configuring the default shell for OpenSSH in Windows
The default command shell provides the experience a user sees when connecting to the server using SSH.The initial default Windows is the Windows Command shell (cmd.exe).Windows also includes PowerShell and Bash, and third party command shells are also available for Windows and may be configured as the default shell for a server.
To set the default command shell, first confirm that the OpenSSH installation folder is on the system path.For Windows, the default installation folder is SystemDrive:WindowsDirectorySystem32openssh.The following commands shows the current path setting, and add the default OpenSSH installation folder to it.
| Command shell | Command to use |
|---|---|
| Command | path |
| PowerShell | $env:path |
Configuring the default ssh shell is done in the Windows registry by adding the full path to the shell executable to ComputerHKEY_LOCAL_MACHINESOFTWAREOpenSSH in the string value DefaultShell.
As an example, the following Powershell command sets the default shell to be PowerShell.exe:
Windows Configurations in sshd_config
In Windows, sshd reads configuration data from %programdata%sshsshd_config by default, or a different configuration file may be specified by launching sshd.exe with the -f parameter.If the file is absent, sshd generates one with the default configuration when the service is started.
The elements listed below provide Windows-specific configuration possible through entries in sshd_config.There are other configuration settings possible in that are not listed here, as they are covered in detail in the online Win32 OpenSSH documentation.
AllowGroups, AllowUsers, DenyGroups, DenyUsers
Controlling which users and groups can connect to the server is done using the AllowGroups, AllowUsers, DenyGroups and DenyUsers directives.The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.All account names must be specified in lower case.See PATTERNS in ssh_config for more information on patterns for wildcards.
When configuring user/group based rules with a domain user or group, use the following format: user?domain*.Windows allows multiple of formats for specifying domain principals, but many conflict with standard Linux patterns.For that reason, * is added to cover FQDNs.Also, this approach uses '?', instead of @, to avoid conflicts with the username@host format.
Work group users/groups and internet-connected accounts are always resolved to their local account name (no domain part, similar to standard Unix names).Domain users and groups are strictly resolved to NameSamCompatible format - domain_short_nameuser_name.All user/group based configuration rules need to adhere to this format.
Examples for domain users and groups
Examples for local users and groups
AuthenticationMethods
For Windows OpenSSH, the only available authentication methods are 'password' and 'publickey'.
AuthorizedKeysFile
The default is '.ssh/authorized_keys .ssh/authorized_keys2'. If the path is not absolute, it is taken relative to user's home directory (or profile image path). Ex. c:usersuser. Note that if the user belongs to the administrator group, %programdata%/ssh/administrators_authorized_keys is used instead.
ChrootDirectory (Support added in v7.7.0.0)
This directive is only supported with sftp sessions. A remote session into cmd.exe wouldn't honor this. To setup a sftp-only chroot server, set ForceCommand to internal-sftp. You may also set up scp with chroot, by implementing a custom shell that would only allow scp and sftp.
HostKey
The defaults are %programdata%/ssh/ssh_host_ecdsa_key, %programdata%/ssh/ssh_host_ed25519_key, %programdata%/ssh/ssh_host_dsa_key, and %programdata%/ssh/ssh_host_rsa_key. If the defaults are not present, sshd automatically generates these on a service start.
Match
Note that pattern rules in this section. User and group names should be in lower case.
PermitRootLogin
Not applicable in Windows. To prevent administrator login, use Administrators with DenyGroups directive.
SyslogFacility
If you need file based logging, use LOCAL0. Logs are generated under %programdata%sshlogs.For any other value, including the default value, AUTH directs logging to ETW. For more info, see Logging Facilities in Windows.
Not supported
The following configuration options are not available in the OpenSSH version that ships in Windows Server 2019 and Windows 10 1809:
- AcceptEnv
- AllowStreamLocalForwarding
- AuthorizedKeysCommand
- AuthorizedKeysCommandUser
- AuthorizedPrincipalsCommand
- AuthorizedPrincipalsCommandUser
- Compression
- ExposeAuthInfo
- GSSAPIAuthentication
- GSSAPICleanupCredentials
- GSSAPIStrictAcceptorCheck
- HostbasedAcceptedKeyTypes
- HostbasedAuthentication
- HostbasedUsesNameFromPacketOnly
- IgnoreRhosts
- IgnoreUserKnownHosts
- KbdInteractiveAuthentication
- KerberosAuthentication
- KerberosGetAFSToken
- KerberosOrLocalPasswd
- KerberosTicketCleanup
- PermitTunnel
- PermitUserEnvironment
- PermitUserRC
- PidFile
- PrintLastLog
- RDomain
- StreamLocalBindMask
- StreamLocalBindUnlink
- StrictModes
- X11DisplayOffset
- X11Forwarding
- X11UseLocalhost
- XAuthLocation