🛠 Exploiter le double Ethernet 2,5 GbE et sécuriser le SSH

Objectives

Verify the two 2.5 GbE Ethernet ports on the Orange Pi 5 Plus (two RTL8125BG controllers connected via PCIe — this board has no 1 GbE port), measure actual throughput with iperf3, then configure key-based SSH access and disable password authentication. Under the mainline kernel (Armbian), the drivers are r8169 + firmware rtl_nic/rtl8125b-2.fw; vendor images use the external Realtek driver r8125.

Hardware

• Orange Pi 5 Plus (Armbian recommended for this use case)
• 2 Ethernet cables Cat 5e minimum + switch or second machine with 2.5 GbE
• Second machine for iperf3; default credentials for Orange Pi images: orangepi/orangepi (change these!)

Complete Code

# 1. Identifier les deux ports (noms variables : end0/end1 ou eth0/eth1)
ip -br link
sudo ethtool end0 | grep -E 'Supported link|Speed|Link'   # 2500baseT/Full attendu
sudo dmesg | grep -iE 'r8169|r8125'                        # driver actif

# 2. Débit : serveur sur la machine peer, client sur l'Orange Pi
sudo apt install -y iperf3
iperf3 -s -p 5201                          # sur le peer
iperf3 -c 192.168.1.10 -p 5201 -P 4        # ~2,3-2,35 Gbit/s attendus par port

# 3. SSH par clé : générer sur le poste client, installer, verrouiller
ssh-keygen -t ed25519
ssh-copy-id orangepi@<ip-de-la-carte>
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
printf 'PasswordAuthentication no\nPermitRootLogin no\n' | sudo tee /etc/ssh/sshd_config.d/10-cle.conf
sudo sshd -t && sudo systemctl reload ssh

Expected Verification

ethtool reports 2500baseT/Full on both ports; iperf3 shows approximately 2.3 Gbit/s per port (the 2.5 G line is only measurable with a 2.5 G peer and switch). After reconnecting, ssh -o PubkeyAuthentication=no -o PasswordAuthentication=yes user@board is refused (password disabled) while key-based connection works.

Common Errors

• Assuming cumulative throughput: the two ports are independent (each RTL8125BG on its own PCIe 2.0 link); do not aggregate the two ports to "double" bandwidth — a single stream remains capped at 2.5 G.
• Cat 5 cable or 1 G switch: negotiation falls back to 1000/100 Mbit/s, check Speed: in ethtool.
• Offline lockout: always keep a session open and validate sshd -t before reloading; test from a second session.
• >