I have used different guides which I combined together to make a reverse SSH tunnel which works with 2 factor authentication for extra security.
Automatic wifi on boot:
with netctl: http://www.linuxandubuntu.com/home/how-to-setup-a-wifi-in-arch-linux-using-terminal
Client here means the computer that is behind a firewall and needs to be reached from the VPS.
Server here means the VPS that has ports that can be opened.
I have a server with one user where there can be only logged in with 2-factor authentication. This is not practical for an automatic SSH reverse tunnel, so I made a extra user which gives no shell back if you log into it, but just runs /bin/false when you log in.
Now follow the instructions of the heading “Setting up SSH Environment” from this guide: https://cnly.github.io/2018/08/16/setting-up-autossh-to-maintain-a-reverse-tunnel-ssh-server-having-a-dynamic-ip-address.html
Add this line in /etc/pam.d/sshd:
auth [success=done default=ignore] pam_succeed_if.so user ingroup skip2factorauth
This line has to be pasted before the @include common-password line and the lines that auth requires for the 2factor authentication!
usermod -a -G skip2factorauth sshtunuser
We are now going to make sure that the new user can make a connection **from the VPS: **
VPS as root:
sudo -u sshtunuser bash
We can now manually input the public SSH key from the client that is going to be SSH reverse tunneled:
VPS as sshtunuser:
cd .ssh/``` ```bash touch authorized_keys
chmod 600 authorized_keys
chmod 700 sshtunuser/.ssh
and place the public key in the file.
To log in with the new user. This user has minimal access to the rest of the system. It does not have root and has a custom home directory.
This user will be added to a group that does not need 2 factor authentication to get logged in, but don’t worry because this user has almost no rights.
Now that should work. Test if there can be a connection made to sshtunuser, it should return nothing and exit the SSH session.
Now for the client computer we set this up:
Log in with the user of the client computer where connections may go to from the server. Then:
mkdir -p .config/systemd/user/default.target.wants
But making the file in this folder did not work, so I created the same file in the parent directory.
And make a file in the default.target.wants folder and the systemd/user folder called autossh.service with the following content:
[Unit] Description=Autossh [Service] ExecStartPre=/bin/sleep 10 ExecStart=/usr/bin/autossh -M 0 -N -o "ServerAliveInterval 15" -o "ServerAliveCountMax 3" -o "ConnectTimeout 10" -o "ExitOnForwardFailure yes" -i /home/[user]/.ssh/id_rsa sshtunuser@[ipaddress_of_server] -R 24553:localhost:22 Restart=always RestartSec=10 [Install] WantedBy=default.target
Before the SSH reverse tunnel works, the server has to be in the authorized_keys file of the client as well! and in the known_hosts.
Make sure that the server and client computers can SSH into each other without using 2FA auth (ultimately with only a normal user, so root can not log in directly)!
The system service can be tested by closing all connections to the server and running this command:
systemctl --user start --now autossh
Now, if the system service work, there can be logged in into the client via another computer with SSH connected to the server with:
ssh [username of client server]@localhost -p 24553
If this works, the system service can be activated and the system can be rebooted. The SSH reverse tunnel should work immediately on boot.
systemctl --user enable --now autossh
systemctl --user status
I hope this helps!