SSH available for another machines

User Support
1

Hi all, I would like to ask you for help how to make AppVM accessible via SSH.

I would like to sync some files via local network via cronjob. I created one new AppVM based on Debian, where will be running SSH service. I need to make this AppVM and SSH service accessible from LAN, so I need to open port in firewall (on AppVM, or Sys-Firewall, or Sys-Net?), after that it should probably works. I try to find some resources here on forum, but I am not sure that I understand it correctly, could anyone help me please?

Thank you very much!

2

I won’t go into detail on how to set up an ssh server. I am assuming that you know how to do that.

As for the firewall, there is a script from @unman that does all the heavy lifting for you!

Download it, make sure that unman does not plant a reverse shell in your dom0 by reading it, copy it into your dom0 by

qvm-run -p <qube-that-has-the-script> "cat <location-of-script>" | cat > openport

make it executable

chmod +x openport

and open the port

./openport add <target-qubes> tcp 22

This is volatile! Meaning, you have to run it every restart of your dom0, or create an autostart functionality.

3 Likes
3

Thank you very much!!!

4

This is exactly what I need, but the script by @unman did not work for me in Qubes OS 4.2.
Looking into why it is failing, it is because none of the VMs have the ‘nat’ or ‘filter’ nft tables.
Since I am new to Qubes OS, I don’t know if this is because of a change in the OS that requires fixing the script, or a misconfiguration on my part (although the network seems to be working, so I am guessing the NAT is working even though there are not ‘nat’ tables; my guess is that something has changed there).

It would be great to get any pointers on how this could be fixed, since this is a feature I need pretty badly.

Thanks!

5

If you want to understand how this work, it’s explained in the documentation

you need to add NAT rules so port 22 on sys-net is redirected to port 22 on sys-firewall which redirects it to the AppVM which should accept connection on this port.

1 Like
6

Thanks a lot!

I ended up following the forum thread you started on this first (Qubes OS 4.2 nftables / nft firewall guide), and then the documentation made a lot more sense, Now it seems pretty obvious. :slight_smile:

I am leaving this with a link to the thread in case it is useful for someone who may be a bit stumped at first by the documentation.

2 Likes