Configure SSH access

The LR54's default configuration has SSH access enabled, and allows SSH access to the device from authorized users within the Internal firewall zone. If this configuration is sufficient for your needs, no further configuration is required. See Allow remote access for web administration and SSH for information about configuring the SSH service to allow access from remote devices.

Required configuration items

Additional configuration items

See Set the idle timeout for LR54 users for information about setting the inactivity timeout for the SSH service.

 

The SSH service is enabled by default. To disable the service, or enable it if it has been disabled:

  Web

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Services > SSH.
  4. Click Enable.
  5. Click Apply to save the configuration and apply the change.

  1. Select the device in Remote Manager and click Actions > Open Console, or log into the LR54 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:
    > config
(config)>
  3. Enable or disable the SSH service:
    • To enable the service:
      (config)> service ssh enable true
(config)>
    • To disable the sevice:
      (config)> service ssh enable false
(config)>
  4. Save the configuration and apply the change
    (config)> save
Configuration saved.
>
  5. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Services > SSH.
  4. (Optional) For Port, enter the port number for the service. Normally this should not be changed.
    • To limit access to specified IPv4 addresses and networks:
      1. Click IPv4 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv4 address or network that can access the device's SSH service. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 192.168.1.0/24.
        • any: No limit to IPv4 addresses that can access the SSH service.
      4. Click again to list additional IP addresses or networks.
    • To limit access to specified IPv6 addresses and networks:
      1. Click IPv6 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv6 address or network that can access the device's SSH service. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 2001:db8::/48.
        • any: No limit to IPv6 addresses that can access the SSH service.
      4. Click again to list additional IP addresses or networks.
    • To limit access to hosts connected through a specified interface on the device:
      1. Click Interfaces.
      2. For Add Interface, click .
      3. For Interface, select the appropriate interface from the dropdown.
      4. Click again to allow access through additional interfaces.
    • To limit access based on firewall zones:
      1. Click Zones.
      2. For Add Zone, click .
      3. For Zone, select the appropriate firewall zone from the dropdown.

        See Firewall configuration for information about firewall zones.

      4. Click again to allow access through additional firewall zones.
  6. Multicast DNS (mDNS) is enabled by default. mDNS is a protocol that resolves host names in small networks that do not have a DNS server. To disable mDNS, or enable it if it has been disabled, click Enable mDNS.
  7. For Private key, type the private key in PEM format. If Private key is blank, the device will use an automatically-generated key.
  8. To create custom SSH configuration settings:
    1. Click to expand Custom configuration.
    2. Click Enable.
    3. For Override:
      • If Override is enabled, entries in Configuration file will be used in place of the standard SSH configuration.
      • If Override is not enabled, entries in Configuration file will be added to the standard SSH configuration.
    4. For Configuration file, type configuration settings in the form of an OpenSSH sshd_config file.

      For example, to enable the diffie-helman-group-sha-14 key exchange algorithm:

      1. Click Enable to enable SSH custom configuration.

      2. Leave Override disabled.

      3. For Configuration file, type the following:

        KexAlgorithms +diffie-hellman-group14-sha1

  9. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the LR54 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:
    > config
(config)>
  3. Configure access control:
    • To limit access to specified IPv4 addresses and networks:
      (config)> add service ssh acl address end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 192.168.1.0/24.
      • any: No limit to IPv4 addresses that can access the SSH service.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to specified IPv6 addresses and networks:
      (config)> add service ssh acl address6 end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 2001:db8::/48.
      • any: No limit to IPv6 addresses that can access the SSH service.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to hosts connected through a specified interface on the LR54 device:
      (config)> add service ssh acl interface end value
(config)>

      Where value is an interface defined on your device.

      Use ... network interface ? to display interface information:

      (config)> ... network interface ?

Interfaces

Additional Configuration
-------------------------------------------
 defaultip              Default IP  
 defaultlinklocal       Default Link-local IP
 lan1                   LAN1
 loopback               Loopback 
 wan1                   WAN1 
 wwan                   WWAN

(config)>

      Repeat this step to list additional interfaces.

    • To limit access based on firewall zones:
      (config)> add service ssh acl zone end value
(config)>

      Where value is a firewall zone defined on your device, or the any keyword.

      Type ... firewall zone ? at the config prompt:

      (config)> ... firewall zone ?

Zones: A list of groups of network interfaces that can be referred to by packet
filtering rules and access control lists.

 Additional Configuration
 -------------------------------------------------------------------------------
  any
  dynamic_routes
  edge
  external
  hotspot
  internal
  ipsec
  loopback
  setup

(config)>

      Repeat this step to include additional firewall zones.

  4. (config)> service ssh key key.pem
(config)>

  5. mDNS is a protocol that resolves host names in small networks that do not have a DNS server. mDNS is enabled by default. To disable mDNS, or enable it if it has been disabled:

    • To enable the mDNS protocol:
      (config)> service ssh mdns enable true
(config>
    • To disable the mDNS protocl:
      (config)> service ssh mdns enable false
(config)>

  6. The default setting of 22 normally should not be changed.

    (config)> service ssh port 24
(config)>

  7. To create custom SSH configuration settings:

    1. Enable custom configurations:

      (config)> service ssh custom enable true
(config)>

    2. To override the standard SSH configuration and only use the config_file parameter:

      (config)> service ssh custom override true
(config)>

      • If override is set to true, entries in Configuration file will be used in place of the standard SSH configuration.
      • If override is set to false, entries in Configuration file will be added to the standard SSH configuration.

        • The default is false.

    3. Set the configuration settings:

      (config)> service ssh custom config_file value
(config)>

      where value is one or more entires in the form of an OpenSSH sshd_config file. For example, to enable the diffie-helman-group-sha-14 key exchange algorithm:

      (config)> service ssh custom config_file "KexAlgorithms +diffie-hellman-group14-sha1"
(config)>

  8. Save the configuration and apply the change
    (config)> save
Configuration saved.
>
  9. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.