Initramfs: install sshd to remote access

A topic that might seem obvious and is generally associated with the possibility of “remote unlocking a LUKS encrypted hdd”, but from experience with my servers, it’s better to adopt this solution regardless.

Disclaimer: Be careful about what we are about to do. Any mistakes can cause serious malfunctions to your server or pc, so proceed with great caution!

In the simplest way possible, I’ll leave you a procedure that you’ll first need to test on some VM.

Let’s assume we’ve already updated our system and proceed with installing busybox and dropbear:

apt-get install dropbear busybox

Verify and check that the file /etc/initramfs-tools/initramfs.conf contains something like the following, otherwise add it

...
BUSYBOX=y
DROPBEAR=y

...

Let’s sort out the keys

mkdir -pv /etc/initramfs-tools/root/.ssh
dropbearkey -t rsa -f /etc/initramfs-tools/root/.ssh/id_rsa.dropbear
/usr/lib/dropbear/dropbearconvert dropbear openssh /etc/initramfs-tools/root/.ssh/id_rsa.dropbear /etc/initramfs-tools/root/.ssh/id_rsa
touch /etc/initramfs-tools/root/.ssh/id_rsa.pub
chmod ogu+rw /etc/initramfs-tools/root/.ssh/id_rsa.pub
dropbearkey -y -f /etc/initramfs-tools/root/.ssh/id_rsa.dropbear | grep "^ssh-rsa " > /etc/initramfs-tools/root/.ssh/id_rsa.pub
touch /etc/initramfs-tools/root/.ssh/authorized_keys
chmod ogu+rw /etc/initramfs-tools/root/.ssh/authorized_keys
cat /etc/initramfs-tools/root/.ssh/id_rsa.pub >> /etc/initramfs-tools/root/.ssh/authorized_keys

Let’s make sure that dropbear doesn’t start with the main system, so that openssl is the one providing ssh access

...
NO_START=0

...

Let’s update our initrd-image and permanently disable dropbear

update-initramfs -u
systemctl disable dropbear

Configure the network card with a static IP. Edit the file by adding or modifying the following line

IP=192.168.1.111::192.168.1.1:255.255.255.0::eth0:off

The network card must be reset in case you proceed beyond the initramfs, which is why you’ll need to edit the file /usr/share/initramfs-tools/scripts/init-bottom/dropbear as follows

...
ifconfig eth0 0.0.0.0 down

I recommend adding a simple script that brings the network card back up anyway, to be placed in /etc/initramfs-tools/scripts/local-top/, perhaps calling it network_up.

#!/bin/sh
. /scripts/functions
configure_networking

Remember to make the file executable: chmod a+x /etc/initramfs-tools/scripts/local-top/network_up

Final update of the initial initrd

update-initramfs -u

Copy the id_rsa key to the system you’ll use to access your remote system in case of need

scp /etc/initramfs-tools/root/.ssh/id_rsa you@remotehost:~/.ssh/dropbear_id_rsa

Ok, done! If you run into problems you’ll be able to access your server via ssh and maybe clean up a corrupted filesystem 😅