4

I want to install a number of raspberry pis at remote locations and be able to log in to them remotely. (Will begin with 30-40 boxes and hopefully grow to 1000 individual raspberry pis soon.)

I need to be able to remotely manage these boxes. Going the easier route, forwarding a port on the router and setting a DHCP reservation, requires either IT support from the company we'll be doing the install for (many of which don't have IT), or it will require one of our IT people physically installing each box.

My tentative solution is to have each box create a reverse SSH tunnel to our server. My question is: How feasible would this be? How easy would it be to manage that many connections? Would it be an issue for a small local server to have 1000+ concurrent SSH connections? Is there an easier solution to this problem?

My end goal is to be able to ship someone a box, have them plug it in, and be able to access it.

Thanks,

w

2
  • How about using your own hosting / free aws t2 server ? I've a couple of pi (about 5 - 10) deployed in the same manner. (reverse tunneled to my website) and it handles all the connections pretty well. But for connections > 1000, you will have to see how it performs. I don't think given a decent internet connection, it should be a problem. Hope it helps. Apr 29, 2015 at 16:23
  • I haven't worked with AWS T2 before, but it's worth looking into. I still feel like this might be more complex than I'd like at the moment.
    – William
    Apr 30, 2015 at 19:35

3 Answers 3

0

An alternate solution would be to:

  1. Install OpenVPN server on your server machine. How to install OpenVPN Server on the PI. Additionally, add firewall rules that block everything but traffic directed for the client's ssh and other services ports (if desired), from administrating machine(s).
  2. Run OpenVPN clients on your Raspberry PI client machines. They will connect back to your VPN server. On a side note, the VPN server and administrating machine(s) need not be the same machine if resources are limited on the VPN server. How to install OpenVPN on the client Raspberry PIs.
  3. SSH from administrating machine(s) to each client machine. Optionally, you could use RSA authentication to simplify authentication.

Benefits include encryption for the tunnel including ssh encryption for administrating, as well as being able to monitor other services on their respective ports.

3
  • Interesting. I also need the boxes to connect to the internet individually. Would this interfere with that use? Reading up on it, it seems that all traffic would then be routed to my server, which would be a huge waste of bandwidth.
    – William
    Apr 30, 2015 at 19:33
  • Also, running this as a VPN, would I need to access the local router at all? That's what I'm trying to prevent.
    – William
    Apr 30, 2015 at 19:36
  • You have a default route for getting to the internet and a static route for accessing your VPN network. No, you would not need to make any changes on your clients home / small office routers. May 21, 2015 at 5:51
0

I made a WebApp to manage this exact same setting in about 60 minutes with my java web template. All I can share are some scripts that I use to list the connection and info about them. You can use those to build your own app, it is really simple to display this in some fancy way in a fast web.

Take a look at my scripts: https://unix.stackexchange.com/a/625771/332669

Those will allow you to get the listening port, as well as the public IPs they're binded from. With that you can easilly plan a system where everything is easilly identificable with a simple BBDD.

-1

You might find this docker container useful https://hub.docker.com/r/logicethos/revssh/

enter image description here

1
  • 2
    The link to docker is broken
    – karlacio
    Sep 5, 2019 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.