LobiShell: SSH Access to Linux Servers from Android

LobiShell saved SSH connections screen

Sometimes I need to check a Linux server when I’m away from my laptop. For small jobs, an Android SSH client is enough. LobiShell, developed by Lobianco Home Lab, is one option worth looking at.

It runs SSH sessions from an Android phone and also supports Mosh, SCP file transfers, port forwarding and SSH key management. These are useful features when you manage more than one Linux machine.

Advantages: LobiShell supports putty based private key format.

Connecting to your servers

LobiShell lets you save server connections and manage identities. A typical SSH connection needs the server address, SSH port, username and a password or private key. Once connected, you can use the terminal for commands such as:

uptime
free -h
df -h
docker ps
systemctl status nginx

The saved connections screen makes it easier to move between several machines without re-entering their details.

LobiShell connection manager, showing saved hosts and identities.
LobiShell connection manager, showing saved hosts and identities.

Finding devices on your network

LobiShell includes a network scanner that can help find devices on a local network. This is handy when you have several servers, small PCs or other machines in a homelab. You should still verify the host’s SSH fingerprint before trusting a new connection.

LobiShell local network scan and discovered devices.
LobiShell local network scan and discovered devices.

SSH, Mosh and file transfers

Regular SSH works well on a stable connection. LobiShell also supports Mosh, which is designed to cope better with intermittent connections and network changes. Mosh requires server-side setup, so it is not a drop-in replacement on every host.

SCP support lets you upload or download files, while SSH port forwarding can provide access to an internal service through an encrypted connection. For example, that can be useful when a web interface is restricted to the server’s private network.

Authentication and saved commands

The Identity Store manages SSH keys and passwords. LobiShell also advertises FIDO2 authentication with compatible hardware security keys. It has command snippets, too, so commands you frequently run can be saved instead of typed each time.

For sensitive servers, I would still use key-based login, verify host keys, and avoid exposing SSH directly to the public internet when a VPN is available.

Terminal appearance and backups

There are settings for colours, fonts and interface layout. That matters more than it sounds on a small touchscreen, especially when you have to read logs or work in a terminal for a while.

LobiShell app colour and theme settings.
LobiShell app colour and theme settings.
LobiShell terminal appearance and interface options.
LobiShell terminal appearance and interface options.

For moving settings between devices, LobiShell supports WebDAV synchronization, including compatible services such as Nextcloud. It also supports local peer-to-peer synchronization and exportable backups, with optional AES-256-GCM encryption.

LobiShell as SSH Client

If you only open an SSH terminal once in a while, a simple client may be sufficient. LobiShell becomes more interesting if you manage several servers and want saved identities, snippets, file transfers and synchronization in the same app.

The limitations are mostly those of working on a phone. Long commands and detailed configuration work are still easier with a keyboard and larger screen. But for checking a service, reading logs or restarting a container, it is a practical tool to keep installed.

Download: LobiShell on Google Play.

App details and screenshots: Google Play listing by Lobianco Home Lab. Features may change with future releases.

Digitalocean upgraded their Droplets hosting Offering

Good news for those looking for VPS hosting solution. Digitalocean has upgraded their droplet offering by increasing the diskpace and RAM at the same price point.

Here are the new Droplets package from Digitalocean:

The most interesting plan is Flexible droplets where you can resize the droplets at any time choosing between with RAM or vCPU at the same price point.

Benefit for existing customer:

Existing customer can enjoy the new price point by clicking “Resize” option to get the new offering from Digitalocean

Benefit for new customers:

New customer will enjoy USD10 giveaway when signing up with Digitalocean. Remember that Digitalocean charges by hour, so you can test drive their VPS in a few days and can decide whether you want to continue or not with their service without any penalty

Securing SSH port and limiting IP address connection with Firewall in Ubuntu

UFW: Securing SSH
UFW or Uncomplicated Firewall is a firewall package in Ubuntu. UFW can be used to secure SSH ports in Ubuntu server.

In order to secure OpenSSH, we must first disable UFW and allow all SSH rule.

sudo ufw disable
sudo ufw delete allow ssh

Then we add IP Address to be allowed to connect to SSH port. In this case I assume that “192.168.1.10” would be allowed to be connected to the server. You can replace IP Address, with any IP Address that you prefer.

sudo ufw allow from 192.168.1.10 to any port ssh

You can also add other IP Address that can be connected to SSH port. In this case, I chose em>”172.25.100.1″.

sudo ufw allow from 172.25.100.1 to any port ssh

Alternatively, you could also specify port number and protocol

sudo ufw allow from 192.168.1.10 to any port 22 proto tcp

Only allow SSH connections from certain subnets

sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp

Note: Adding firewall rules to only allow SSH connection from certain subnets would increase the server security, further reducing brute-force attack.

Further Reading: Ubuntu Server Administrator Reference

How to send fail2ban notification with Telegram (telegram-cli)

This is a a guide to integrate Telegram messaging service Fail2Ban. With this integration, Fail2Ban notification will be sent through Telegram services.

t_logo

Requirements

  1. You need to have Fail2ban installed in your systems.
  2. Install or compile “telegram-cli”, refer to this guide to compile telegram-cli or install it from *.deb (Ubuntu LTS) AMD64

Setting Up Fail2Ban with Telegram

After installing ‘telegram-cli’ and its requirements, you should proceed to add ‘telegram.conf’ config in /etc/fail2ban/action.d

The content of “telegram.conf“ is as follows.

#
# /etc/fail2ban/action.d/telegram.conf
#
# Author: Toon Ketels
# Modified by: Mohammad Hafiz bin Ismail [mypapit @gmail.com]
#
# $Revision$
#

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = /usr/share/fail2ban/fail2ban-telegram.sh start

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop = /usr/share/fail2ban/fail2ban-telegram.sh stop

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    [ip]  IP address
#          [failures]  number of failures
#          [time]  unix timestamp of the ban time
# Values:  CMD
#
actionban = /usr/share/fail2ban/fail2ban-telegram.sh ban [ip]

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    [ip]  IP address
#          [failures]  number of failures
#          [time]  unix timestamp of the ban time
# Values:  CMD
#
actionunban = /usr/share/fail2ban/fail2ban-telegram.sh unban [ip]

[Init]

init = 'Fail2Ban Telegram plugins activated"


Then, you need to create a script file in “/usr/share/fail2ban/fail2ban-telegram.sh“.

#!/bin/bash
# /usr/share/fail2ban/fail2ban-telegram.sh
#
# Sends text messages using telegram api
# to alert server administrator of ip banning.
#
# Requires one argument, one of the following:
#  start
#  stop
#  ban
#  unban
#
# Optional second argument: IP for ban/unban




#replace this with your own telegram contact

to=Telegram_peer_replace_this

# Display usage information
function show_usage {
  echo "Usage: $0 action [ip]"
  echo "Where action is start, stop, ban, unban"
  echo "and ip is optional passed to ban, unban"
  exit
}



# Actually send telegram messages
# Expects the telegram content (body) to be passed
# as argument.
function send_telegram {

  msg="[`date -Iminutes`] - `hostname`:  Notice: $1 "
  echo "$msg" >> /var/log/fail2ban-telegram.log
 (echo "contact_list";sleep 30;echo "msg $to $msg"; echo "safe_quit") | telegram-cli
  exit
}



# Check for script arguments
if [ $# -lt 1 ]
then
  show_usage
fi



# Take action depending on argument
if [ "$1" = 'start' ]
then
  message="Fail2ban just started."
  send_telegram "$message"
elif [ "$1" = 'stop' ]
then
  message="Fail2ban just stopped."
  send_telegram "$message"
elif [ "$1" = 'ban' ]
then
  message=$([ "$2" != '' ] && echo "Fail2ban just banned $2" || echo 'Fail2ban just banned an ip.' )
  send_telegram "$message"
elif [ "$1" = 'unban' ]
then
  message=$([ "$2" != '' ] && echo "Fail2ban just unbanned $2" || echo "Fail2ban just unbanned an ip." )
  send_telegram "$message"
else
  show_usage
fi

After that, you need to ensure that the script is executable, by running.

sudo chmod a+rwx /usr/share/fail2ban/fail2ban-telegram.sh

Then, you need to edit “/etc/fail2ban/jail.conf” file to hook the action plugin with events. In this case, I choose the ssh and sshd events.

sudo nano -c /etc/fail2ban/jail.conf

Then proceed to find the [ssh] and [ssh-ddos] part. Add ‘telegram’ config in the file. Replace the “webmaster@example.com” email address with your email address.

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
action = mail-whois[name=SSH, dest=webmaster@example.com]
         telegram

Now go to the “ssh-ddos” section, repeat the same step.

[ssh-ddos]

enabled  = true
port     = ssh
filter   = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 4
action = mail-whois[name=SSH, dest=webmaster@example.com]
         telegram

Finishing up: Restart Fail2Ban

Finish up by restarting fail2ban server, and if you done it correctly you will be receiving both telegram messages and email notification regarding fail2ban startup!

sudo service fail2ban restart

Sample Screenshot

telegram-fail2ban

Congratulations!!