question

5teve avatar image
5teve asked

[Feature Request] - Remote SSH ability

Hi Guys

For those of us running Venus OS devices on board boats and in remote locations that are not manned, it strikes me that a key missing part of the maintenance of these devices is SSH remotely. For those of us not blessed with a clever brain, I cant seem to find a way of accessing my PI via an LTE (4g) connection that resides on the boat due to CGnat. The LTE router that I have only does OPENVPN server, not client (which is useless behind CGnat) so unless i'm on the boat with the laptop I have no access.

Now the like of Freenas have a built in 'terminal' or Shell.. It strikes me that would be a mightily useful thing to include in either the remote console (via VRM) or via VRM itself? It would certainly make life a little easier for doing the things that require SSH..

I know I could just get a router that supports a VPN client, hook it up to my home VPN server and access that way.. but it just seems like a nice touch having remote SSH...

I'm sure being a heathen.. I am ignoring security concerns and a million other things.. but I live in a simplistic bubble.. my brain hurts less that way ;O)

Steve

Venus OSremote console
3 comments
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

11 Answers
mvader (Victron Energy) avatar image
mvader (Victron Energy) answered ·

Hey @XZv I looked into that a bit further, and tailscale looks like the best solution.


Here is why:

to make all of it work well, also when installed behind various types of firewalls, then you need some cloud hosted service / server. Where all devices connect to and where the user can connect to as well.

And security is critical.

To host & offer such service for free, support it, maintain it, have it pentested and so forth by ourselves is a step to far.

The other route, totally open source / developer would be a rc.Local script that enables Wireguard on GX device + a (dockerised?) server that is the pivot. Nice but nerdy and complex.

Enter tailscale. All of it done and they offer a free service.


So, hereby the invitation to you and the rest of Community: can someone work on a script to get tailscale up and running on a GX device + instructions?

And in the interim do it with a one time self compiled tailscale binary - use our SDK to do that. Should be pretty simple.

If that works well, one of our guys can take care of having the binary included as a standard plus having it as enableable daemon which is watched over by Daemontools like all other services on the GX.

And the configuration/provisioning will need to be solved. If all that is needed is some long key, then perhaps gui-v2 allows cut & paste so solves that problem as well.


Note to myself for when including this into the normal Venus OS builds: https://github.com/ChristophHandschuh/meta-tailscale/


And wrt the other solutions:

- wireguard is a protocol; with implementations; tailscale is built in top of that

- zerotier is closed source solution (so I prefer wireguard, but in the end its jusr a choice

- setting up port forwarding, or having to setup and maintain anything at all, is too complex for most of intended user group.

- ngrok is an alternative solution; tailscale seems to be the more popular one after reading around a bit.

8 comments
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

mvader (Victron Energy) avatar image
mvader (Victron Energy) answered ·

Hi, one available solution is zero tier:

https://community.victronenergy.com/questions/81273/remote-access-to-venusos-zerotier-one-installation.html

I will need some self compiling and such. It shouldn't take you more than a few hours of work.


And, for sure it would be great to have a solution natively in Venus OS; but its not something we'll be focussing on anytime soon I'm afraid.

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

Warwick Bruce Chapman avatar image
Warwick Bruce Chapman answered ·

Put a Mikrotik router in-front of the GX-device and use one of its tunnelling features. I setup a Wireguard server on a Hetzner cloud container that cost a couple Euro and tunnel from the Mikrotik to that server. I can then port forward the Mikrotik to the GX-device and SSH to the GX-device from the cloud container.

2 comments
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

Kevin Windrem avatar image
Kevin Windrem answered ·

A huge security hole, but you can forward port 22 to your Venus device to allow SSH from the outside world.

The VPN solution is much more secure and the one I'd recommend.

2 comments
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

mvader (Victron Energy) avatar image
mvader (Victron Energy) answered ·

This looks like a really promising solution to me /

https://community.victronenergy.com/questions/205323/venus-os-ngrok.html

3 comments
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

pau1phi11ips avatar image
pau1phi11ips answered ·

Another option: I have a Teltonika 4G router in front of the Cerbo. You can tunnel SSH through their remote management (RMS) portal very easy.

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

iv4n avatar image
iv4n answered ·

This is another solution, using Wireguard as a VPN.

I just put together this quick guide:

https://community.victronenergy.com/articles/211164/howto-venus-os-setting-up-wireguard.html

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

xzv avatar image
xzv answered ·

@mvader (Victron Energy) Any chance to put a Victron SSH port forwarding onto the midterm roadmap? Like the one you already have for your R&D for customers and can be enabled with the "Remote support" switch? That would be a great benefit and service for many. Thanks!

2 comments
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

Kees Oomen avatar image
Kees Oomen answered ·

Wow, keep on the good work to support Tailscale as embedded in VenusOS soon! Will definitely following this topic to see the progress.

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

Randy Goodman avatar image
Randy Goodman answered ·

to me this is a BIG feature for customers. I would use this all the time in my development and deploy\troubleshooting. When can we have it?

i am not a net guru and dont follow all being said above and on the threads linked to, so, the idea of a customer just needing to run a script is perfect! make sure you include windows as one of the customer platforms. THX!

1 comment
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

iv4n avatar image
iv4n answered ·

@mvader (Victron Energy) Just came in to check this post and went to review the script I contributed for installing wireguard in Venus OS and it no longer exists. It says to contact the administrator if I believe it's a mistake: https://community.victronenergy.com/articles/211164/howto-venus-os-setting-up-wireguard.html


Would you know why was that post deleted? I find it sad that it would be deleted without any notice and also quite discouraging to contribute further things after putting effort and time putting the script and the post together for the community.


2 comments
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.