Remote SSH to Buildroot devices

A Buildroot image is yours to shape. Three things decide if the agent fits: the SSH server, the init system and a read-only root.

1. OpenSSH, not Dropbear

Many Buildroot images ship Dropbear. Sessions need the OpenSSH server (BR2_PACKAGE_OPENSSH). The installer also needs curl or wget, sha256sum, tar and mktemp, plus OpenSSL 3 to check the signature, or --sha256 without it.

2. BusyBox init

• With no systemd or OpenRC, the installer writes /etc/init.d/S95rescueshell-agent with start, stop and restart.
• It logs to /var/log/rescueshell-agent.log. On each start, a log over 1 MB is moved to .1.
• Our installer tests run this path under BusyBox and dash, in a test folder. We have no Buildroot image in our device matrix.

3. A read-only root

• Point --prefix at a writable mount for the binary, and --state-dir at storage that survives a reboot. The device's credential lives there.
• A tmpfs state dir is refused unless you pass --allow-volatile-state. After a reboot that device needs a new token.
• If /etc is read-only, the installer cannot write the init script. It prints the start command instead: add it to your image. --no-sshd prints the two sshd lines to add yourself, too.

Builds

amd64, arm64, armv7 and armv6. The installer picks one from uname -m. We run armv7 in QEMU; the armv6 build is not run in our matrix.

curl -fsSL https://releases.rescueshell.com/latest/install.sh | sh -s -- \
  --base-url https://releases.rescueshell.com/latest --relay https://app.rescueshell.com \
  --name pump-07 --trust-keys-from pi

Change pi to the account you log in as. The device trusts the keys in that account's ~/.ssh/authorized_keys, and our servers cannot add one. See add a device for the other options.

Also see SSH over a 4G or LTE link. €0.10 a device a month, billed yearly, at least €6 a year.