Step 1: Sign up for a NoPorts free trial

Go to noports.com and sign up for a 30-day free trial.

Step 2: Download the NoPorts desktop application

Download the NoPorts desktop app using one of the links below:

Link to Apple Store

Link to Windows Store

Step 3: Log into the NoPorts desktop application

1. Launch the NoPorts desktop app and click Get Started.

2. Enter your client atSign into the text field (e.g., @pluto83_client), leave the root domain as is, and then click Next.

3. A one-time password (OTP) will be sent to you via email. Enter this OTP into the app and then click Confirm.

Step 4: Save a copy of your atKeys

Your atKeys (cryptographic keys) will be used to pair your atSign with this and other devices in future. You can learn more about these keys here.

1. Click on Save atKeys

2. Select a location on your device and save your keys.

Step 5: Set up a test connection

1. Download the NoPorts test connection profile. This is a json file containing connection details for a test profile we have created.

2. Return to the NoPorts app Dashboard.

3. Click Import and select the test connection profile that you just downloaded.

4. Click the Connect Icon ▶️ to establish a connection.

5. Open a web browser and navigate tohttp://localhost:8080.

Congratulations! You're connected to a hidden webpage via NoPorts!

Desktop App Installation

If this is your first time using NoPorts, we recommend you start here:

CLI Client Installation

If you are more comfortable with the CLI, you can follow this guide to install the binaries:

Device Installation

If you want to setup access to your MacOS device, follow this guide:

Get Started

Before you can use NoPorts, you need to have it installed! All of our installation guides can be found here:

Use-cases

NoPorts has endless use-cases. We've provided a list of the most common ones:

Usage

If you don't understand how something works, or want to see the full configuration options, checkout the usage section:

Step 1: Download the NoPorts desktop application

Link to Apple Store

Step 2: Log into the NoPorts desktop application

1. Launch the NoPorts desktop app and click 'Get Started'.

2. Enter your client atSign into the text field (e.g., @pluto83_client), leave the root domain as is, and then click 'Next'.

3. A one-time password (OTP) will be sent to you via email. Enter this OTP into the app and then click 'Confirm'.

Step 3: Back up your atKeys

Your atKeys (cryptographic keys) will be used to pair your atSign with this and other devices in future. You can learn more about these keys here.

1. Click on the Settings Icon in the top right corner of the app.

2. Click on 'Back Up Your Keys' in the left navigation panel.

3. Select a location on your device and save your keys.

Step 4: Prepare a Profile to establish a NoPorts connection

1. Return to the Dashboard

2. Click the 'Add New' button to create a new Profile

   1. Enter the details for the new profile
3. Or, connect using our test profile.

   1. Download the NoPorts test connection profile. This is a json file containing connection details for a test profile we have created.

   2. Return to the NoPorts app Dashboard.

   3. Click 'Import' and select the test connection profile that you just downloaded.

   5. Open a web browser and navigate tohttp://localhost:8080to confirm you successfully connected to our hidden webpage.

Step 1: Download the Installer

Step 2: Run the Installer

Step 3: Activate your client atSign

Client Only Installation

If you want to setup a Linux client, use this guide:

Device Only Installation

If you want to setup a Linux device, use this guide:

Installation Overview

To complete an installation of NoPorts and set up remote access from a client to a remote device, we must perform an installation on both the client and device machines. We will also obtain two atSigns during registration: one client atSign and one device atSign. Once we have the client and device atSigns, we are ready to begin installation.

1. Obtain your NoPorts license from noports.com You can start with a 30-day evaluation license, no credit-card required

2. Install NoPorts software on your devices

   1. Install the NoPorts client typically on your desktop

      1. Activate both management keys on your desktop

   2. Install the NoPorts daemon onto the device(s) you want to connect to, repeat for each device

      1. Use our enrollment tool to activate your device

3. Use NoPorts!

4. Reach out to us We want to hear about your use-cases. We take all feedback into consideration, it helps us make the best tool we possibly can.

The Client is defined as the machine where we are launching the remote access from. The Device is defined as the remote device that we are connecting to.

• Client installation has two options: Desktop App or CLI

• Device installation is CLI only

In summary, Installing and using NoPorts consists of the following steps:

1. Obtain NoPorts License and atSigns

2. Install the NoPorts Client on the client machine

   1. Register the client atSign

   2. Register device atSign

3. Install the NoPorts Daemon on the remote device

   1. Repeat for multiple devices

Once NoPorts is installed you will be able to utilize it for any TCP connections such as remote access via SSH and RDP etc! Please see the complete instructions below:

1. Obtain NoPorts License and atSigns

To begin, you will need a NoPorts subscription or Free Trial

1. Purchase NoPorts

2. Or, Activate a Free Trial

2. Install the NoPorts Client on the client machine

MacOS: Choose Desktop App or CLI installation for the client

Linux: CLI only

Windows: Choose Desktop App or CLI installation for the client

3. Install the NoPorts Daemon on the remote device

MacOS

Linux:

Windows:

This concludes the installation instructions and you are now ready to use NoPorts for secure remote access!

Use NoPorts

Start by exploring the use-cases available in the side bar such as SSH, RDP, SFTP, Web Server, and SMB. We also provide in-depth usage information here:

Other Installation Guides:

We have additional installation guides below if you are looking for more advanced/custom installations, or installing NoPorts as part of creating a new virtual machine.

Manual Installation Guides

These are supplementary guides, which involve some manual work.

Cloud Installation Guides

These guides will show you how to install NoPorts as part of creating a new VM.

Choose the operating system which is running on your CLIENT machine:

Step 1: Download the NoPorts desktop application

Step 2: Log into the NoPorts desktop application

1. Launch the NoPorts desktop app and click 'Get Started'.

2. Enter your client atSign into the text field (e.g., @pluto83_client), leave the root domain as is, and then click 'Next'.

3. A one-time password (OTP) will be sent to you via email. Enter this OTP into the app and then click 'Confirm'.

Step 3: Back up your atKeys

1. Click on the Settings Icon in the top right corner of the app.

2. Click on 'Back Up Your Keys' in the left navigation panel.

3. Select a location on your device and save your keys.

Step 4: Prepare a Profile to establish a NoPorts connection

1. Return to the Dashboard

2. Click the 'Add New' button to create a new Profile

   1. Enter the details for the new profile
3. Or, connect using our test profile.

   2. Return to the NoPorts app Dashboard.

   3. Click 'Import' and select the test connection profile that you just downloaded.

   5. Open a web browser and navigate tohttp://localhost:8080to confirm you successfully connected to our hidden webpage.

Step 1: Download the Installer

Step 2: Run the Installer

Step 3: Activate your client atSign

Step 1: Download the Installer

Step 2: Activate your client Atsign

Step 2.1 Open the Windows installer and click "Activate atSign"

Step 2.2 Enter the atSign you wish to activate and click "Submit"

Step 2.3 Wait for the OTP (One time pincode) then enter it and press "Generate"

Step 2.4 Wait for the keys to generate, then go home

Step 3: Install the Device Software

3.1 Click "Device Install"

3.2 Enter both of your atSigns into the associated fields, then pick a device name, and click "Next"

3.3 If you wish to add additional arguments to pass sshnpd enter them, then click "Next"

3.4 Wait for the installation to complete, then click "Next", and continue through the rest of the installation. Once installation has completed, it will look like this:

Desktop App Installation

If this is your first time using NoPorts, we recommend you start here:

CLI Client Installation

If you are more comfortable with the CLI, you can follow this guide to install the binaries:

Device Installation

If you want to setup access to your Windows device, follow this guide:

Step 1: Download the Installer

Step 2: Client Install

Launch the NoPortsInstaller.exe program and allow it administrative permissions:

Step 3: Activate your client Atsign

Step 3.1 Open the Windows installer and click "Activate atSign"

Step 3.2 Enter the atSign you wish to activate and click "Submit"

Step 3.3 Wait for the OTP (One time pincode) then enter it and press "Generate"

Step 3.4 Wait for the keys to generate, then you may either exit the program or go home

Choose the operating system which is running on your CLIENT machine:

1. Run the installer

cd sshnp

./install.sh sshnpd

sudo ./install.sh sshnpd

cd sshnp

./install.sh sshnpd

sudo ./install.sh sshnpd

2. Setup the installer

You are on your own for setting up the background service to start sshnpd. See our other options if you need help setting this up.

3. All Done!

You can now proceed to installing your client, or if you've already done that, checkout our usage guide.

The first time you activate, this set of keys that gets generated is a set of management keys. These keys have full permissions to your atServer, the personalized service which powers your atSign.

We recommend cutting the management keys on the client for a few reasons:

1. It's extremely important that you don't lose these keys:

   1. They are less likely to get lost on your client machine than on your device.

   2. If a device is stolen you still have your management keys to recover from the theft.

2. For each device we can issue it's own set of cryptographic keys which has a few perks:

   1. This allows us to limit the permissions of those keys to the bare minimum required for NoPorts.

   2. If a device gets compromised, we can safely revoke that set of cryptographic keys, and limit the impact to your other devices.

1. Run the installer

cd sshnp

sudo ./install.sh systemd sshnpd

2. Configure the service file

After installing the systemd unit, we must configure it. This requires root privileges.

sudo vi /etc/systemd/system/sshnpd.service

You'll then be greeted with a file that looks like this:

Replace <username> with the linux user running sshnpd (we suggest creating service account not running as root)

Replace <@device_atsign> with the device address

Replace <@manager_atsign> with the client address

Replace <device_name> with your own custom **unique ** identifier for this device. You will need this value later, so don't forget it.

Add any additional config to the end of the line where sshnpd is run, some useful flags you should consider adding:

• -u : "unhide" the device, sharing the username and making it discoverable by sshnp --list-devices

• -s : "ssh-public-key", allow ssh public keys to be shared by sshnp and automatically authorized by sshd, saves you from dealing with ssh public key management. If multiple people use the device, we recommend leaving this off and managing ssh public keys yourself.

• To see the rest of the available options run sshnpd to see the usage.

3. Activate your device address

3.a. First time activating your address

We will now activate the device address, you only need to activate the device address now. The client address will be activated later during the client installation.

./at_activate -a @my_noports_device

./at_activate -a @my_noports_device

Enter the One Time Password (OTP) & Check your SPAM/PROMOTIONS folders

The application will pause and wait for the input of a one time pin (OTP) before you can continue. You should receive this pin to the contact information associated with the registration of your noports address (i.e. email or text message).

***If you are using a gmail.com account we have seen that sometimes the OTP gets stuck in the SPAM or PROMOTIONS folder. If you do not see the OTP check those folders.

Once you receive the message, enter the pin into the application and press enter to continue. The application should proceed to create the cryptographic keys and store them at ~/.atsign/keys/@my_noports_device_key.atKeys.

An address can only be activated once, to install this address to future devices, you must copy this file to the device (see 3.b.).

3.b. Activated this address before

The address will be located at ~/.atsign/keys/@my_noports_device_key.atKeys. Copy this file from your other machine to the same location on the machine that you are installing sshnpd on.

4. Enable the service

Using systemctl we can enable and start the sshnpd service.

sudo systemctl enable sshnpd.service
sudo systemctl start sshnpd.service

Observing the service

If you need to verify the status of the service:

sudo systemctl status sshnpd.service

If you want to follow the logs of the service you can with

sudo journalctl -u sshnpd.service -f

5. Check your environment.

There are a number of fiddly things to get in place for ssh to work. The first is the ~/.ssh/authorized_keysfile of the user being used to run the systemd unit.

The file needs to owned by the user running the systemd unit. Currently there is a bug in the script and this sets the user to root, which needs to be corrected if not running as root. You can do this with the following command substituting debain for your username and group.

The file also needs to be only writable by the owner, else the sshd will not allow logins. This can be checked with ls -l and corrected with the chmod command.

debian@beaglebone:~$ ls -l ~/.ssh/
total 0
-rw-r--r-- 1 root root 0 Feb 18 00:28 authorized_keys
debian@beaglebone:~$ sudo chown debian:debian ~/.ssh/authorized_keys
debian@beaglebone:~$ ls -l ~/.ssh/
total 0
-rw-r--r-- 1 debian debian 0 Feb 18 00:28 authorized_keys
debian@beaglebone:~$ chmod 600 ~/.ssh/authorized_keys

Once complete it should look like this.

debian@beaglebone:~$ ls -l ~/.ssh/
total 0
-rw------- 1 debian debian 0 Feb 18 00:28 authorized_keys
debian@beaglebone:~$

Running sshnpd at root special steps (not recommended)

If you decided to use the root user in the service setup you have a futher couple of steps.

sudo mkdir -p ~root/.ssh
sudo touch ~root/.ssh/authorized_keys
sudo chmod 600 ~root/.ssh/authorized_keys

Then you need to make sure that the root user is allowed to login via sshd. Whist this is not recommended you can get it working by editing the /etc/ssh/sshd_config file and removing the # on this line.

# PermitRootLogin prohibit-password

Once removed you will need to restart the sshd daemon. How to do this varies from distribution/OS so check on how to do it or reboot.

6. All Done !

Your systemd service is ready to go, you can now proceed to installing your client, or if you've already done that, checkout our usage guide.

Overview

The NoPorts daemon (a.k.a. sshnpd) is installable as a background service in many ways. Choose the best option for your environment. The service may be installed as a systemd unit, docker container, tmux session, or as a background job using cron and nohup. The binaries can also be installed standalone so that you can install your own custom background service.

On windows, we strongly recommend sticking to our automated installation process on Windows. This is because properly installing NoPorts as a Windows service requires making entries in the registry. If you want to create a custom installer for your organization, please speak to us directly at info@noports.com.

1. Download

1.a. Download from GitHub

You can download a release from GitHub, or see the table below to download the latest release for your platform.

1.b. Download using curl

Alternatively, if you want to download from the command line, you can do so with curl.

curl -fSL https://github.com/atsign-foundation/noports/releases/latest/download/sshnp-linux-x64.tgz -o sshnp.tgz

curl -fSL https://github.com/atsign-foundation/noports/releases/latest/download/sshnp-linux-arm64.tgz -o sshnp.tgz

curl -fSL https://github.com/atsign-foundation/noports/releases/latest/download/sshnp-linux-arm.tgz -o sshnp.tgz

curl -fSL https://github.com/atsign-foundation/noports/releases/latest/download/sshnp-linux-riscv.tgz -o sshnp.tgz

curl -fSL https://github.com/atsign-foundation/noports/releases/latest/download/sshnp-macos-x64.zip -o sshnp.zip

curl -fSL https://github.com/atsign-foundation/noports/releases/latest/download/sshnp-macos-arm64.zip -o sshnp.zip

2. Unpack the Archive

If you downloaded from GitHub, the file name may be slightly different.

tar -xf sshnp.tgz

unzip sshnp.zip

3. Install sshnpd

See the links in the table below to continue with the installation process.

Device Side

Client Side

1. Run the installer

cd sshnp

./install.sh headless sshnpd

sudo ./install.sh headless sshnpd

cd sshnp

./install.sh headless sshnpd

sudo ./install.sh headless sshnpd

2. Configure the startup script

After installing the startup script, we must configure it.

vi ~/.local/bin/sshnpd.sh

You'll then be greeted with a file that looks like this:

Replace $user with the linux user running sshnpd

Replace $device_atsign with the device address

Replace $manager_atsign with the client address

Replace $device_name with your own custom **unique ** identifier for this device. You will need this value later, so don't forget it.

Add any additional config to the end of the line where sshnpd is run, some useful flags you should consider adding:

• -u : "unhide" the device, sharing the username and making it discoverable by sshnp --list-devices

• -s : "ssh-public-key", allow ssh public keys to be shared by sshnp and automatically authorized by sshd, saves you from dealing with ssh public key management. If multiple people use the device, we recommend leaving this off and managing ssh public keys yourself.

• To see the rest of the available options run sshnpd to see the usage.

3. Activate your device address

3.a. First time activating your address

We will now activate the device address, you only need to activate the device address now. The client address will be activated later during the client installation.

./at_activate -a @my_noports_device

./at_activate -a @my_noports_device

Enter the One Time Password (OTP) & Check your SPAM/PROMOTIONS folders

The application will pause and wait for the input of a one time pin (OTP) before you can continue. You should receive this pin to the contact information associated with the registration of your noports address (i.e. email or text message).

***If you are using a gmail.com account we have seen that sometimes the OTP gets stuck in the SPAM or PROMOTIONS folder. If you do not see the OTP check those folders.

Once you receive the message, enter the pin into the application and press enter to continue. The application should proceed to create the cryptographic keys and store them at ~/.atsign/keys/<address_name>_key.atKeys.

An address can only be activated once, to install this address to future devices, you must copy this file to the device (see 3.b.).

3.b. Activated this address before

The address will be located at ~/.atsign/keys/<address_name>_key.atKeys. Copy this file from your other machine to the same location on the machine that you are installing sshnpd on.

4. Start the service

The headless service will automatically be started by the cron @reboot directive when your machine restarts. If you would like to start it immediately, note that you must make sure to disown the process so that it doesn't hangup when you logout.

Run the following command to start it immediately:

nohup $HOME/.local/bin/sshnpd.sh > $HOME/.sshnpd/logs/sshnpd.log 2> $HOME/.sshnpd/logs/sshnpd.err &

Observing the service

The service should already be running in the background, to observe the logs:

tail -f $HOME/.sshnpd/logs/sshnpd.log
tail -f $HOME/.sshnpd/logs/sshnpd.err

5. All done!

Your headless job is ready to go, you can now proceed to installing your client, or if you've already done that, checkout our usage guide.

1. Run the installer

[[ -n $(command -v tmux) ]] && echo 'Good to go!' || echo 'Uh oh! Install tmux before continuing...'

cd sshnp

./install.sh tmux sshnpd

sudo ./install.sh tmux sshnpd

[[ -n $(command -v tmux) ]] && echo 'Good to go!' || echo 'Uh oh! Install tmux before continuing...'

[[ -n $(command -v brew) ]] && brew install tmux || echo 'brew not installed, first install brew at https://brew.sh, then run this command again.'

cd sshnp

./install.sh tmux sshnpd

sudo ./install.sh tmux sshnpd

2. Configure the startup script

After installing the startup script, we must configure it, with nano or vi depending on your preference.

nano ~/.local/bin/sshnpd.sh

or

vi ~/.local/bin/sshnpd.sh

You'll then be greeted with a file that looks like this:

Replace $user with the linux user running sshnpd

Replace $device_atsign with the device address

Replace $manager_atsign with the client address

Replace $device_name with your own custom **unique ** identifier for this device. You will need this value later, so don't forget it.

Add any additional config to the end of the line where sshnpd is run, some useful flags you should consider adding:

• -u : "unhide" the device, sharing the username and making it discoverable by sshnp --list-devices

• -s : "ssh-public-key", allow ssh public keys to be shared by sshnp and automatically authorized by sshd, saves you from dealing with ssh public key management. If multiple people use the device, we recommend leaving this off and managing ssh public keys yourself.

• To see the rest of the available options run sshnpd to see the usage.

3. Activate your device address

3.a. First time activating your address

We will now activate the device address, you only need to activate the device address now. The client address will be activated later during the client installation.

./at_activate -a @my_noports_device

./at_activate -a @my_noports_device

Enter the One Time Password (OTP) & Check your SPAM folder!

The application will pause and wait for the input of a one time pin (OTP) before you can continue. You should receive this pin to the contact information associated with the registration of your noports address (i.e. email or text message). ***If you are using a gmail.com account we have seen that sometimes the OTP gets stuck in the SPAM or PROMOTIONS folder. If you do not see the OTP check those folders.

Once you receive the message, enter the pin into the application and press enter to continue. The application should proceed to create the cryptographic keys and store them at ~/.atsign/keys/<address_name>_key.atKeys.

An address can only be activated once, to install this address to future devices, you must copy this file to the device (see 3.b.).

3.b. Activated this address before

The address will be located at ~/.atsign/keys/<address_name>_key.atKeys. Copy this file from your other machine to the same location on the machine that you are installing sshnpd on.

4. Start the service

The tmux service will automatically be started by the cron @reboot directive when your machine restarts. If you would like to start it immediately, note that you must make sure to disown the tmux process so that it doesn't hangup when you logout.

Run the following command to start it immediately:

nohup &>/dev/null tmux new-session -d -s sshnpd && tmux send-keys -t sshnpd $HOME/.local/bin/sshnpd.sh C-m

Observing the service

You can use regular tmux commands to observe the service:

tmux a -t sshnpd

5. All done!

Your tmux session is ready to go, you can now proceed to installing your client, or if you've already done that, checkout our usage guide.

Important Notes

This is an engineering guide, not a definitive solution, as every production environment is different. Feel free to borrow what is useful and ignore what is not. If you have better ideas or ways, please let us know!

Other considerations

Each atSign has a reasonable maximum of 25 devices that it can manage, so keep that in mind as you use this script to roll out devices. By default, the hostname is used as the -dDEVICE_NAME. Your hostnames may not match the requirements of the DEVICE_NAME flag.

• Lowercase Alphanumeric max 15 Characters Snake Case before version 5.0.3

• Case insensitive Alphanumeric max 36 Chars Snake Case from version 5.0.3 onwards.

  • allows UUID snake cased device names.

Install.sh

Cut and paste this script and tailor it to your needs. Do not forget to chmod 500 or else it will not run! More details below on how to set things up, and a demo run, too, using Docker.

Set up your environment.

Each atSign has its own set of keys that are "cut" with at_activate. This will cut the keys for the atSign and place them in ~/.atsign/keys. Each machine requires the atKeys file to run sshnpd, so, we need to have a way to get them to each device. It is possible to ssh/scp them, but that becomes very cumbersome at scale. Instead, we encrypt the keys with AES256 and place them on a webserver. When the install script is run, it knows both the URL and the encryption password and can pull the atKeys file to the right place.

The steps are to (1) get the atKeys file as normal using at_activate, then (2) encrypt them using a command like this:

This command will ask you for a password which you will put in the install.sh file as ATKEY_PASSWORD.

You can then set up a simple http (the file is encrypted) server to serve the keys with. For example, a Python single line of code:

python3 -m http.server 8080 --bind 0

Alternatively, you can put the keys file on filebin.net and it will locate the file in a random URL which you can put into the install.sh file. For example:

https://filebin.net/s2w5r6gwemmz5kvi/_ssh_1_key.atKeys.aes

It is worth noting that the @ gets translated to a _ but that does not effect the script. Using this site has the advantage that the URL is hidden, and it uses TLS—plus you can delete the files once completed.

At this point you can derive the URL of the encrypted atKeys file and put it in the install.sh file headers.

The other variables should be straightforward enough.

The other variables set up the atSigns for the manager and device and for the device name itself. The device name by default uses the hostname using the shell command $(hostname) , but that only works if the hostname is compliant with the -d format of sshnpd. You can pick another way to identify the host or just make sure the hostname is compliant.

Running the install.sh (Note: Has to be run as root)

This is a simple matter now of getting the install.sh to the target device and running it. The needed files will be installed, the username name created, cronjobs put in place, and the 'sshnpd' will be started.

How you get the install.sh file to the target machine is going to vary depending on your environment. Using scp is a good option, as is using ssh or curl and pulling the file (using the same encryption method perhaps).

Scaling things up

The install.sh script works fine on individual machines, but if you want to install on, say, 25 machines, this is how you do it.

First, you need to have ssh root access to the machines you want to install on. This SSH access will be removed as you do the install with this line uncommented:

If you pass 8 arguments into the install.sh they will be used rather than the hardcoded values. This allows you to pass in the values needed as the script is run QED.

For example:

./install.sh ubuntu changeme https://raw.githubusercontent.com/cconstab/sshnpd_config/main/config/sshnpd.sh http://192.168.1.61:8080/@ssh_1_key.atKeys.aes helloworld @cconstab @ssh_1 $(hostname)

To test this

Using Docker is the simple way to test any options first before moving to production.

Something like this will mount the script and start a basic Linux build:

docker run -it -v ./install.sh:/root/install.sh debian:trixie-slim

You can then cd and run the install.sh script. For example:

After the install has completed, you can su - to the USERNAME you chose and see tmux/sshnpd running.

On another machine, you can log in to the container using the select MANAGER_ATSIGN, remembering to give the daemon a ssh key and the username.

You are now logged into the container. If you need root access, you can use the password you chose to sudo -s

Feel free to adapt this outline to your specific needs and share your improvements back with the community.

Upgrade the sshnpd binary

Upgrading to the latest version of sshnpd is identical to the installation process.

Verify the Upgrade

To check the current version of sshnpd installed on your machine simply execute the binary:

Reload the sshnpd service

After upgrading the sshnpd binary, we must restart the sshnpd service so that it runs using the new version. How you proceed is dependent on the original installation method you used:

Systemd unit

The universal.shinstaller script will automatically restart the sshnpd.serviceunit.

Any existing config will be preserved.

Tmux session

The installer automatically restarts your tmux session, no other steps required!

Headless (cron + nohup)

Retrieve the Process ID

To safely restart the headless service, we must be slightly more careful with the headless installation. First we must grab the process id of sshnpd:

You should get a single number as output, this is the process ID of the sshnpd process.

Example:

Verify the Process ID

Before we continue, it is good practice to make sure that we have the correct ID:

Example:

As you can see, under CMD we have /home/atsign/.local/bin/sshnpd -a @atsign_device -m @atsign_client -d mydevice -suv. This is the command inside our sshnpd.sh service which used to start sshnpd. This is the correct process that we want to kill in order to restart sshnpd.

Killing the process

Now that we have retrieved and verified the process ID, we can use the kill command to kill the process:

Example:

Verify the Process has been killed

Use the same verification command from before:

Example:

As you can see, there are no entries anymore. This means process 289 has been killed, sshnpd should automatically restart under a new process ID.

Overview

The SSH No Ports client (a.k.a. sshnp) is available as a command line application or desktop application (alpha). This guide is for installing the command line application, the desktop application installation guide will be made available upon official release.

1. Download

1.a. Download from GitHub

1.b. Download using curl

2. Unpack the Archive

If you downloaded from GitHub, the file name may be slightly different.

3. Install sshnp

4. Add bin folder to the path

This step is optional, but highly recommended.

5. Activate your client address

3.a. First time activating your address

We will now activate the client address, you only need to activate the client address now. The device address should be activated during the device installation.

Enter the One Time Password (OTP) & Check your SPAM/PROMOTIONS folders

The application will pause and wait for the input of a one time pin (OTP) before you can continue. You should receive this pin to the contact information associated with the registration of your noports address (i.e. email or text message).

***If you are using a gmail.com account we have seen that sometimes the OTP gets stuck in the SPAM or PROMOTIONS folder. If you do not see the OTP check those folders.

Once you receive the message, enter the pin into the application and press enter to continue. The application should proceed to create the cryptographic keys and store them at ~/.atsign/keys/@my_noports_client_key.atKeys.

An address can only be activated once, to install this address to future devices, you must copy this file to the device (see 3.b.).

3.b. Activated this address before

The address will be located at ~/.atsign/keys/@my_noports_client_key.atKeys. Copy this file from your other machine to the same location on the machine that you are installing sshnpd on.

All Done!

Upgrade sshnp

Upgrading to the latest version of sshnp is identical to the installation process.

Verify the Upgrade

To check the current version of sshnp installed on your machine simply execute the binary:

Troubleshooting the Upgrade

If you continue to get an old version number, it's likely that there's an old binary which wasn't replaced on the machine. Try the following to debug your binary location:

When starting a VM on OCI first click the Show advanced options button having selected the usual options above that.

Then (in the Management tab) select Paste cloud-init script

And paste your customised script into the Cloud-init script box:

The VM is now ready for Create

After a few minutes the APKAM key can be approved:

If the VM isn't quite ready you'll see:

Waiting a little longer and retrying should produce a successful approval:

The VM is now ready for connection with the NoPorts client.

In the Azure Portal select Virtual machines and hit the + Create button.

Choose your preferred options for each sub-page of the Create a virtual machine process.

On the Advanced sub-page there's a Custom data and cloud init section where your customised script can be pasted:

It should look like this:

Once that's complete the VM is ready for Review + create then if all looks well hit Create

After a few minutes the APKAM key can be approved:

If the VM isn't quite ready you'll see:

Waiting a little longer and retrying should produce a successful approval:

The VM is now ready for connection with the NoPorts client.

When launching an instance on EC2 choose settings as usual for the instance type etc.

A security group with no external ports open can be created or reused.

Expand the Advanced details section at the bottom of the Launch an Instance page:

Scroll down to the User data - optional box and paste in your customised YAML e.g.:

Which will end up looking something like this:

The VM config should now be ready for Launch instance

After a few minutes the APKAM key can be approved:

If the VM isn't quite ready you'll see:

Waiting a little longer and retrying should produce a successful approval:

The VM is now ready for connection with the NoPorts client.

Install IPFire

IPFire provides a solid Firewall and uses a base Linux OS. The installation of the OS itself is well documented at ipfire.org. X64 and Arm devices like Raspberry PI's are well supported.

Make sure to configure the network interfaces and ensure you can get to the Web Interface on

Installing sshnpd the SSH No Ports Daemon

Web UI Setup

SSH No Ports relies on the SSH daemon and so the first step is to enable it on the IPFire Web interface, under System.

We will also need to add the TMUX package via the web interface under the IPFire section click Pakfire, then add TMUX.

Linux Setup

Add non root user

IPFire only has a root user after installation so the first step is to set up a non privileged account in this example we will use atsign but feel free to pick your own. Login to the console or via SSH as root and type:

Non root user environment

The next step is su to the user you just created and setup the directories sshnpd will need

Adding sudo access (if you want to) to the new user account

Using sudo allows you to get access to the root account if you need it but keep at a non root shell when you do not, its a good practice but optional.

As root you will need to edit the /etc/sudoers file and uncomment the line below as show by removing the #. Note you may need to use w! in vi to force the update of the file.

Once done then you can add the sudo group and then add the username atsign to the group with the following commands as root.

Then add a password to the atsign account again as root

Once completed then check everything is working by su - to atsign the using sudo -s to get back to root.

Installing sshnpd

As atsign (not root!) download the SSH No Ports software, which we can do with curl and then unpack the archive with tar. The curl command below brings in the x64 CPU architecture file if you are using Arm/Arm64 then curl down the right option by picking the right link from:-

To install the software just cd and run the install command

You will see some errors at this stage as IPFire uses fcron not cron which needs root powers to install fcron jobs which we will handle soon.

Configuring the sshnpd.sh file

The sshnpd is started via a script and that script and that script needs some simple edits. You will need to know your atSign for the device (_device) and manager (_client). to edit use nano/vi on this file.

Then edit the lines as below with your details.

Certificate Authority public certificates

IPFire has non standard base certificates but we can install the latest versions from Mozilla so the sshnpd daemon can use TLS, by using these commands.

Put your atSign atKeys file in place

If you have not got your atKeys file you will need to use at_activate to get them as explained in the the advanced installation guide. If you do have the keys for your device then they need to be in the ~/.atsign/keys directory. You can scp them over for instance. Its a good idea to chmod them to 600.

Adding the fcron entries

As mentioned above fcron is used not cron so a couple of extra steps are required. First add your username to the /etc/fcron.allow file.

Then add your username ours looks like this

Once that is completed then you can add an entry to atsign's fcron, this can only be done as root and uses vi to edit by default.

Then you will need to add the following line

That's it you are done!

To test you can reboot or as atsign run the command below and try and log in using sshnp

Logging in from a remote machine

At this point you will be able to log in remotely using sshnp. The first time you will need to specify a ssh key using the -i and -s arguments. This will put the public key into the authorized_hosts file on the IPFire machine. In my case I would use.

your will look like something similar depending on your SSH Key pair (you can generate one if you do not have one with ssh-keygen) and your client/device atsigns.

When you get logged in you can remove the -s and the -i flags and login on subsequent logins as the public key will be in place on the IPFire machine. You will have to put the keys you want to use in ~/.ssh/config also on the machine you are ssh'ing from, in my case I use a single line.

Remember to keep your SSH and Atsign keys safe and make a copy offline.

You are now able to login from anywhere as long as the firewall and you have Internet access. Congrats!

For the paranoid

If you would like to remove the ssh daemon from the GREEN side as well then you can edit the /etc/ssh/sshd_config file to only bind on localhost but updating this line.

to

and then reboot or restart the sshd daemon.

The NoPorts daemon can be installed on a Linux cloud virtual machine (VM) using a cloud-init script of the form:

Some clouds, such as Azure and Oracle Cloud will take the script pretty much as presented above. Other clouds, including AWS and GCP need alternate formatting or additional customisation.

In all cases the variables in the first section of the script should be changed to match the atSigns being used, the desired device name, the Linux username and the one time password (OTP) or semi-permanent passcode (SPP) being used. e.g.:

Once the VM is started (which will generally take a few minutes) the NoPorts daemon will be waiting for an APKAM key in order to start up. That key can be approved using at_activate:

Cloud Specific Guides

Navigate to Compute Engine > VM instances and hit the + CREATE INSTANCE button as usual, then select Name, Region, Machine configuration etc.

Expand Advanced options at the bottom of the page:

Then scroll down and expand Management:

In the Automation section paste in your customised startup script like:

NB this script is creating a new user noports to deal with the fact that GCP images don't have default usernames.

Once filled, the box should look something like:

The VM is now ready for Create

After a few minutes the APKAM key can be approved:

If the VM isn't quite ready you'll see:

Waiting a little longer and retrying should produce a successful approval:

The VM is now ready for connection with the NoPorts client.

"Old machine" is the machine that has the original set of cryptographic keys that were generated. "New machine" is the device you want the new set of cryptographic keys on.

Step 1) Generate a passcode from your Old machine

Choose the operating system that is running on your old machine.

Step 2) Make an authorization request on your New machine

Choose the operating system that is running on your new machine.

Step 3) Approve the request on your Old machine

Choose the operating system that is running on your old machine.

Overview

Example client atSign

Example device atSign

Activate your atSigns

Activate the client atSign

(1) Run the at_activate command for the client atSign

(2) Enter the One Time Password (OTP) & Check your SPAM/PROMOTIONS folders

at_activate will pause and wait for the input of a one time pin (OTP) before you can continue. You should receive this pin to the contact information associated with the registration of your noports address (i.e. email or text message).

Once you receive the message, enter the pin into the application and press enter to continue. The application should proceed to create the cryptographic keys and store them in the ~/.atsign/keys/ directory with a filename that includes the atSign.

Activate the device atSign

1) Run the at_activate command for the device atSign

2) Enter the One Time Password (OTP) & Check your SPAM/PROMOTIONS folders

Again, at_activate will pause and wait for the input of a one time pin (OTP) before you can continue. You should receive this pin to the contact information associated with the registration of your noports address (i.e. email or text message).

Once you receive the message, enter the pin into the application and press enter to continue. The application should proceed to create the cryptographic keys and store them in the ~/.atsign/keys/ directory with a filename that includes the atSign.

Want to use your atSign on a different machine?

You can:

A. Generate a new set of cryptographic keys (Recommended)

B. Copy the cryptographic keys from the machine where it's been activated in the past (Not recommended)

Option A) Generate a new set of cryptographic keys (Recommended)

To generate a new set of cryptographic keys, there are three main steps. They occur from two different machines, so pay careful attention to which machine you perform each step on.

"Old machine" is the machine that has the original set of cryptographic keys that were generated. "New machine" is the device you want the new set of cryptographic keys on. These new keys will have restricted permissions that only work with NoPorts, and cannot be used for generating other keys.

1. [Old machine] Generate a Passcode

2. [New machine] Enroll the new key pair (send a request for keys from the new machine)

3. [Old machine] Approve the request

For detailed instructions, follow this guide:

Option B) Copy the cryptographic keys from the machine where it's been activated in the past (Not recommended)

• The atSign keys file will be located at ~/.atsign/keys/ directory with a filename that will include the atSign. Copy this file from your other machine to the same location on the machine that you are installing SSH No Ports on, using scp or similar.

Why don't we recommend this approach?

When you use method A, it creates a new set of cryptographic keys. These keys can be disabled individually, which means if a device's keys are compromised, you can disable those keys without affecting your other devices.

Example snake case device names

Stable Releases

We recommend choosing a release from stable, if there's one available that's supported on your platform.

Desktop App

Our dedicated desktop app is preferred in most cases.

Cli Binaries

This includes all binaries for NoPorts.

Beta Releases

These releases are subject to potential instability or breaking changes as we mature the product-line.

SSH uses keys to authenticate as well as having a fallback of using passwords, but using keys is easier and more secure than "mypassword!". If you already are a seasoned user of SSH then you might have keys already, but if not, then on the client machine you can create a key pair using ssh-keygen.

Example ssh-keygen command to create SSH Key Pair

Use Cases

If you have a specific use case, we may already cover the steps you need to take. Check out these guides.

Generic Usage of NoPorts

If your primary use case involves more than just SSH, start here, or check out some of our use cases below.

SSH Usage over NoPorts

If your primary use case is SSH, start here. We also recommend the ssh config integration for a seamless experience.

Quick Start

Options

Overview

This guide covers the basics to understanding the parameters of npt and invoking npt.

The NoPorts Tunnel or npt for short, provides an end to end encrypted TCP Tunnel without the need for inbound port rules on client or device machines.

Examples

-f, --from

This argument is the client address, a.k.a. the from address, since we are connecting from the client.

-t, --to

This argument is the device address, a.k.a. the to address, since we are connecting to the device.

-d, --device

This argument is the device name, which works in tandem with --to to allow multiple devices to run sshnpd under a single device name. By default, this value is "default", so unless you named your sshnpd device the same thing, you will need to include this parameter. For example:

-r, --srvd

This argument is the address of the socket rendezvous used to establish the session connection. Atsign currently provides coverage in 3 regions, use whichever is closest to you:

Americas

Europe

Asia-Pacific

-p, --remote-port, --rp

This argument is the port you are connecting to on the device side.

This argument is mandatory.

It is important to make sure the port you are connecting to is included in the list of permitted ports on the device side. (--permit-open, --po)

-l, --local-port, --lp

This argument is the port you are connecting to on the client side.

This argument is optional, but suggested.

It is important to make sure the port you are connecting to is not a restricted port.

Putting it altogether

An example of a complete command might look like this:

Usage Guides

Here are some guides where we demonstrate how to use the NoPorts Tunnel to run some common TCP Services without opening any ports.

Options

Examples

-h, --rh, --remote-host

This argument is the remote host. It is NOT required, this options defaults to localhost.

-x, --exit-when-connected

This argument, forks the srv when connected.

--[no-]pps, --[no-]per-session-storage

This argument defaults to true. It is used for when you want to run only one client at a time.

-k, --keyFile, --key-file

This argument defaults to ~/.atsign/keys, where your keys are stored.