Ssh tunnel : permission denied

Legato Application Framework
41

You mean if you just use the unmodified source code and “make wp76xx”, it will still reset with the legato.cwe?

42

Yes. We built the unmodified source within the leaf shell from $LEGATO_ROOT, using make clean followed by make wp76xx. Then installed the legato.cwe produced in ~/leafproj/leaf-data/current/wp76-legato/build/wp76xx (which was 8.4 MB in size vs 6.8 in ~/leafproj/leaf-data/current/wp76-image/legato - don’t know whether that mean anything). Then it starts resetting.

43

You need to check if this is due to legato partiton size

You can check by at!Partition?

Btw, which fw are you using

44

ssh reverse tunnel… working in sandbox app on FX30, without modified legato. Solved.

Hi folks, took a while… but we have got our FX30 making ssh client connections to our ssh-server, with working reverse tunnels.

Using this, we can now open a console on the FX30 from our ssh-server; this is not normally possible when working on the public internet.
We SMS the “start-tunnel” command, which triggers an ssh session; that creates a local port on the ssh-server linked to the FX30 port 22.

The two important details involved (1) how to fix SMACK errors on connection to the reverse tunnel, and (2) the ssh command parameters to specify.

(1) Reverse tunnels and SMACK: the reverse tunnel parameter was -R 22:127.0.0.44:22
The important part was the 127.0.0.44; this address is not intercepted by SMACK. “localhost” and “127.0.0.1” are both SMACK protected… but other 127.0.0.* addresses are not.
See (and understand) the /legato/smack/netlabel file if you want to know why.

(2) Invoking ssh: below are the parameters that worked.
I used “le_proc_Execute”, rather than system().
Theoretically similar, but system() made it difficult to track the PID of the ssh process… necessary for the subsequent rc = kill(ssh_pid,SIGINT) command used to close the connectcion.
“le_proc_Execute” returns the PID of the ssh process; system() returns the PID of an sh process, within which the ssh process runs as a child. Nested PID was annoying, and not necessary.
BTW… this code runs in a thread, as the wait() is blocking.

int status = 0;
char *argumentsPtr[20];
int i = 0;
argumentsPtr[i++] = "/bin/ssh";
argumentsPtr[i++] = myuser@my.sshserver.com;
argumentsPtr[i++] = "-y";
argumentsPtr[i++] = "-y";
argumentsPtr[i++] = "-N"; // magic bullet
argumentsPtr[i++] = "-i";
argumentsPtr[i++] = "/bin/xxx.ppk";
argumentsPtr[i++] = "-R";
argumentsPtr[i++] = "22:127.0.0.44:22";

argumentsPtr[i++] = NULL;

// don't use detach=true.  
// never worked out exactly what it is MEANT to do, but what it DOES... is start 2 ssh sessions instead of 1, which is not valid because of remote-tunnel-port restrictions
le_proc_Parameters_t ssh_process =
{
    .executableStr   = argumentsPtr[0],
    .argumentsPtr    = argumentsPtr,
    .environmentPtr  = NULL,
    .detach          = false, 
    .closeFds        = LE_PROC_NO_FDS,
    .init            = NULL,
    .userPtr         = NULL
};

ssh_pid = le_proc_Execute(&ssh_process);
LE_DEBUG("ssh_pid=%d" , ssh_pid);

// Wait allows us to clean up the ssh_pid when done; if ssh_pid isn't 0, then ssh is already/still running.
// It also stops the thread from finishing, so it's visible in [inspect threads `pidof myAppName`]
if (waitpid(ssh_pid, &status, 0) > 0)
{
    LE_DEBUG("%s[%d] returned status=%d", ssh_process.executableStr, (int) ssh_pid, status);
}

ssh_pid = 0;

There were other steps we needed to resolve, but these were the tough ones. I’m open to further discussion if I’ve kept this too brief.