SSH SBC remote control

[Albert464]

Hello,
I wanted your advice, I have to distribute Raspberry Pi with SBC installed (all PBXs are in the cloud) to some customers and control them remotely from our office in case of need. How do you advise me to do? Because exposing SSH access on the internet publicly is not safe.

 

[Alphabetic]

You might want to refer to this post

https://www.3cx.com/community/threa...ccess-phone-gui-behind-sbc.82130/#post-380359

 

[VasilisV_3CX]

Hi @Albert464,

The only reason you'd need to access the machine with the SBC installed would be to get log files for troubleshooting. From the Management Console you can manage updates, we can push settings to the device, get statistics and more. I suggest managing the SBC via the Management Console. What is your use case for needing to connect to the machines with SBC installed themselves?

 

[Albert464]

Hi @Albert464,

The only reason you'd need to access the machine with the SBC installed would be to get log files for troubleshooting. From the Management Console you can manage updates, we can push settings to the device, get statistics and more. I suggest managing the SBC via the Management Console. What is your use case for needing to connect to the machines with SBC installed themselves?

Hi @VasilisV_3CX

Accessing the customer's network allows us to:
- Check if the phones are connected
- In case of need, intervene directly on the phones
- Restart the SBC safely
- Carry out Speetest if the customer complains of problems
- Update the DECT bases
- Check all devices connected in that vlan
- Keep the temperature of the Raspberry monitored

Having direct access allows us to offer a pro-active service, reducing the number of calls to our customer service.

 

[VasilisV_3CX]

Hi @Albert464,

Noted. Why not connect with SSH using a private key?

 

[Albert464]

Hi @Albert464,

Noted. Why not connect with SSH using a private key?

Hi @VasilisV_3CX

It has often happened to me that some providers (which provide Cisco modem / router) reserve port 22 for their access. So we can't actually use that. I also thought about a VPN tunnel only on the SSH service, but I'm not sure if it can work or how it can behave. I'm afraid it's going to trouble phones.
What do you think about it?

 

[Alphabetic]

Hi @VasilisV_3CX

It has often happened to me that some providers (which provide Cisco modem / router) reserve port 22 for their access. So we can't actually use that. I also thought about a VPN tunnel only on the SSH service, but I'm not sure if it can work or how it can behave. I'm afraid it's going to trouble phones.
What do you think about it?

You can use port redirection to get to 22 behind NAT.

 

[VasilisV_3CX]

Hi @Albert464,

Avoid installing VPNs at all cost, as it could cause a number of problems. Leave the Pi in a 3CX default installation state. It would be best practice to use some 3rd party application to access a machine that is local to the Pi, and then accessing it from that local machine.

 

[Albert464]

Hi @VasilisV_3CX

Do as @kieferschild says? Could this be a good practice?

You can use port redirection to get to 22 behind NAT.

 

[VasilisV_3CX]

Hi @Albert464,

As above, the best practice is to connect via a machine local to the SBC.

 

[MichelA]

Dear @Albert464,

You can solve this in different ways depending on the client's setup (with local firewall or without).
You can change the ssh port in /etc/ssh/sshd_config.
If the SBC is connected to the internet without a firewall, you can also use iptables rules
For example, to allow traffic from x.x.x.x/32 and otherwise drop the traffic (to port 22).
You can also use SSH Public Key Authentication.
The possibilities to solve this depend on the situation the client's network is in.
I am also in favour of not connecting the device directly to the Internet via SSH - port 22 - but as I wrote above, there are many possibilities to significantly reduce the risks.
What I have personally experienced with the Pi 3 (haven't tested the Pi 4 yet) is that they are very sensitive to SSH brute force attacks (load goes up spectacularly).

Anyway, good luck with your project!