Using LibreELEC like a pro—management via SSH

For a recent project, I needed to install LibreELEC/Kodi on a Raspberry Pi Compute Module 4 with built-in eMMC storage.

Because it's inconvenient to be swapping the Pi around from the embedded display I was using it in to my preferred carrier board I use for flashing Pis and interacting with their filesystems, I wanted to manage my LibreELEC install over SSH.

It seems like whatever documentation the LibreELEC Wiki used to have for remote SSH access is missing, and all I could find were references to enabling SSH during a GUI setup wizard. If you didn't see that during initial setup, the easiest way is to add ssh to the end of the line in the system's cmdline.txt file, then reboot.

So I pulled the Pi, used usbboot to mount the fat32 volume on my Mac, and opened cmdline.txt and added ssh. Then I popped the Pi back in the embedded display, and started it up.

Sure enough, I could now SSH in:

SSH into LibreELEC

The default user is root and the default password is libreelec. No wonder they don't have SSH enabled by default :P

If you have a typical network, you don't need to hunt for the Pi's IP address either, you can just type in ssh [email protected] and that should find it by mDNS on your local network.

Now, another thing I wanted to do was enable USB so I could plug a keyboard or flash drive into my embedded display. The CM4 doesn't enable the built-in USB 2.0 ports by default—or at least it didn't, historically.

But if I tried editing the /flash/config.txt file, it said it wasn't editable. Apparently the /flash directory is mounted read-only at boot, so I had to remount it as read-write.

Once I did that, I added dtoverlay=dwc2,dr_mode=host to enable USB 2.0 at the end of the /flash/config.txt file, and rebooted (reboot).

It's probably a good idea to change the default SSH password (passwd while logged in as root) while you're in there.

SSH can be useful for a number of things. Remote management, config backups, uploading/downloading files, and remote rebooting of your LibreELEC box, to name a few.


Yep - when you install a new LibreElec instance the first-time set-up wizard asks if you want to enable SSH (it's disabled by default), change the default host name etc.

If you want to enable it after installation, from the GUI it's in SYSTEM->SERVICES I think. If you enable it from the cmdline.txt flag you override the GUI and remove the ability to enable/disable from within the GUI I think?

The SSH login credentials (name, password) on a Kodi setup can be changed nowadays.

I'm able to edit cmdline.txt and if I add or remove "quiet" the boot processes appear and disappear, so my edits are effective. My RPI Kodi installation shows OpenSSH launching. However I can't find an ssh name and password combination that let's me log in. I tried setting it to boot single user, however "rw init=/bin/sh" or "rw init=/usr/bin/bash" has no effect on the boot process, I still end up in the Kodi interface. I tried replacing "rw init=/bin/sh" with just "single" and even with "single rw init=/bin/sh" but no luck.
Any tips?
BTW you can reach me at myname at myname dot org

You'd think this one would have been easy but no, not entirely intuitive.

You can set the SSH password in an existing RPI Kodi installation from:
Add-ons->Program add-ons->LibreELEC Configuration->Services->SSH Password

Because when I'm changing my password, I always think "That's an add-on"?

Hmm, isn't cmdline.txt simply the linux kernel boot command?

I put my public ssh key (~/.ssh/ into .ssh/authorized_keys file on the sdcard. Then I can log in using my ssh passphrase. Remeber to "chmod 600 .ssh/authorized_keys" since sshd can be picky about the permission.

I tried it today with ssh as boot param. But adding this param kills my libreelec: it starts and then stop again quite instantly. If I remove the param it boots. Found a way to enable SSH without display by creating a service file for ssh as /storage/.config/system.d/sshd.service with a ssh config in /storage/.cache/services/sshd.conf