Folus Wen
3c1544b7f9
[Improve][GPL][Dropbear]
|
vor 2 Jahren | |
|---|---|---|
| .. | ||
| .github | vor 2 Jahren | |
| debian | vor 2 Jahren | |
| fuzz | vor 2 Jahren | |
| libtomcrypt | vor 2 Jahren | |
| libtommath | vor 2 Jahren | |
| release | vor 2 Jahren | |
| test | vor 2 Jahren | |
| .gitignore | vor 2 Jahren | |
| .hgignore | vor 2 Jahren | |
| .hgsigs | vor 2 Jahren | |
| .hgtags | vor 2 Jahren | |
| CHANGES | vor 2 Jahren | |
| DEVELOPING.md | vor 2 Jahren | |
| FUZZER-NOTES.md | vor 2 Jahren | |
| INSTALL | vor 2 Jahren | |
| LICENSE | vor 2 Jahren | |
| MULTI | vor 2 Jahren | |
| Makefile.in | vor 2 Jahren | |
| README | vor 2 Jahren | |
| SMALL | vor 2 Jahren | |
| agentfwd.h | vor 2 Jahren | |
| algo.h | vor 2 Jahren | |
| atomicio.c | vor 2 Jahren | |
| atomicio.h | vor 2 Jahren | |
| auth.h | vor 2 Jahren | |
| bignum.c | vor 2 Jahren | |
| bignum.h | vor 2 Jahren | |
| buffer.c | vor 2 Jahren | |
| buffer.h | vor 2 Jahren | |
| chachapoly.c | vor 2 Jahren | |
| chachapoly.h | vor 2 Jahren | |
| channel.h | vor 2 Jahren | |
| chansession.h | vor 2 Jahren | |
| circbuffer.c | vor 2 Jahren | |
| circbuffer.h | vor 2 Jahren | |
| cli-agentfwd.c | vor 2 Jahren | |
| cli-auth.c | vor 2 Jahren | |
| cli-authinteract.c | vor 2 Jahren | |
| cli-authpasswd.c | vor 2 Jahren | |
| cli-authpubkey.c | vor 2 Jahren | |
| cli-channel.c | vor 2 Jahren | |
| cli-chansession.c | vor 2 Jahren | |
| cli-kex.c | vor 2 Jahren | |
| cli-main.c | vor 2 Jahren | |
| cli-runopts.c | vor 2 Jahren | |
| cli-session.c | vor 2 Jahren | |
| cli-tcpfwd.c | vor 2 Jahren | |
| common-algo.c | vor 2 Jahren | |
| common-channel.c | vor 2 Jahren | |
| common-chansession.c | vor 2 Jahren | |
| common-kex.c | vor 2 Jahren | |
| common-runopts.c | vor 2 Jahren | |
| common-session.c | vor 2 Jahren | |
| compat.c | vor 2 Jahren | |
| compat.h | vor 2 Jahren | |
| config.guess | vor 2 Jahren | |
| config.h.in | vor 2 Jahren | |
| config.sub | vor 2 Jahren | |
| configure | vor 2 Jahren | |
| configure.ac | vor 2 Jahren | |
| crypto_desc.c | vor 2 Jahren | |
| crypto_desc.h | vor 2 Jahren | |
| curve25519.c | vor 2 Jahren | |
| curve25519.h | vor 2 Jahren | |
| dbclient.1 | vor 2 Jahren | |
| dbhelpers.c | vor 2 Jahren | |
| dbhelpers.h | vor 2 Jahren | |
| dbmalloc.c | vor 2 Jahren | |
| dbmalloc.h | vor 2 Jahren | |
| dbmulti.c | vor 2 Jahren | |
| dbrandom.c | vor 2 Jahren | |
| dbrandom.h | vor 2 Jahren | |
| dbutil.c | vor 2 Jahren | |
| dbutil.h | vor 2 Jahren | |
| debug.h | vor 2 Jahren | |
| default_options.h | vor 2 Jahren | |
| dh_groups.c | vor 2 Jahren | |
| dh_groups.h | vor 2 Jahren | |
| dropbear.8 | vor 2 Jahren | |
| dropbear_lint.sh | vor 2 Jahren | |
| dropbearconvert.1 | vor 2 Jahren | |
| dropbearconvert.c | vor 2 Jahren | |
| dropbearkey.1 | vor 2 Jahren | |
| dropbearkey.c | vor 2 Jahren | |
| dss.c | vor 2 Jahren | |
| dss.h | vor 2 Jahren | |
| ecc.c | vor 2 Jahren | |
| ecc.h | vor 2 Jahren | |
| ecdsa.c | vor 2 Jahren | |
| ecdsa.h | vor 2 Jahren | |
| ed25519.c | vor 2 Jahren | |
| ed25519.h | vor 2 Jahren | |
| fake-rfc2553.c | vor 2 Jahren | |
| fake-rfc2553.h | vor 2 Jahren | |
| filelist.txt | vor 2 Jahren | |
| fuzz-wrapfd.h | vor 2 Jahren | |
| fuzz.h | vor 2 Jahren | |
| fuzzers_test.sh | vor 2 Jahren | |
| gcm.c | vor 2 Jahren | |
| gcm.h | vor 2 Jahren | |
| gendss.c | vor 2 Jahren | |
| gendss.h | vor 2 Jahren | |
| gened25519.c | vor 2 Jahren | |
| gened25519.h | vor 2 Jahren | |
| genrsa.c | vor 2 Jahren | |
| genrsa.h | vor 2 Jahren | |
| gensignkey.c | vor 2 Jahren | |
| gensignkey.h | vor 2 Jahren | |
| ifndef_wrapper.sh | vor 2 Jahren | |
| includes.h | vor 2 Jahren | |
| install-sh | vor 2 Jahren | |
| kex.h | vor 2 Jahren | |
| keyimport.c | vor 2 Jahren | |
| keyimport.h | vor 2 Jahren | |
| list.c | vor 2 Jahren | |
| list.h | vor 2 Jahren | |
| listener.c | vor 2 Jahren | |
| listener.h | vor 2 Jahren | |
| loginrec.c | vor 2 Jahren | |
| loginrec.h | vor 2 Jahren | |
| ltc_prng.c | vor 2 Jahren | |
| ltc_prng.h | vor 2 Jahren | |
| netio.c | vor 2 Jahren | |
| netio.h | vor 2 Jahren | |
| options.h | vor 2 Jahren | |
| packet.c | vor 2 Jahren | |
| packet.h | vor 2 Jahren | |
| process-packet.c | vor 2 Jahren | |
| progressmeter.c | vor 2 Jahren | |
| progressmeter.h | vor 2 Jahren | |
| pubkeyapi.h | vor 2 Jahren | |
| queue.c | vor 2 Jahren | |
| queue.h | vor 2 Jahren | |
| release.sh | vor 2 Jahren | |
| rsa.c | vor 2 Jahren | |
| rsa.h | vor 2 Jahren | |
| runopts.h | vor 2 Jahren | |
| scp.c | vor 2 Jahren | |
| scpmisc.c | vor 2 Jahren | |
| scpmisc.h | vor 2 Jahren | |
| service.h | vor 2 Jahren | |
| session.h | vor 2 Jahren | |
| signkey.c | vor 2 Jahren | |
| signkey.h | vor 2 Jahren | |
| signkey_ossh.c | vor 2 Jahren | |
| signkey_ossh.h | vor 2 Jahren | |
| sk-ecdsa.c | vor 2 Jahren | |
| sk-ecdsa.h | vor 2 Jahren | |
| sk-ed25519.c | vor 2 Jahren | |
| sk-ed25519.h | vor 2 Jahren | |
| ssh.h | vor 2 Jahren | |
| sshpty.c | vor 2 Jahren | |
| sshpty.h | vor 2 Jahren | |
| svr-agentfwd.c | vor 2 Jahren | |
| svr-auth.c | vor 2 Jahren | |
| svr-authpam.c | vor 2 Jahren | |
| svr-authpasswd.c | vor 2 Jahren | |
| svr-authpubkey.c | vor 2 Jahren | |
| svr-authpubkeyoptions.c | vor 2 Jahren | |
| svr-chansession.c | vor 2 Jahren | |
| svr-kex.c | vor 2 Jahren | |
| svr-main.c | vor 2 Jahren | |
| svr-runopts.c | vor 2 Jahren | |
| svr-service.c | vor 2 Jahren | |
| svr-session.c | vor 2 Jahren | |
| svr-tcpfwd.c | vor 2 Jahren | |
| svr-x11fwd.c | vor 2 Jahren | |
| sysoptions.h | vor 2 Jahren | |
| tcp-accept.c | vor 2 Jahren | |
| tcpfwd.h | vor 2 Jahren | |
| termcodes.c | vor 2 Jahren | |
| termcodes.h | vor 2 Jahren | |
| x11fwd.h | vor 2 Jahren | |
README
This is Dropbear, a smallish SSH server and client.
https://matt.ucc.asn.au/dropbear/dropbear.html
INSTALL has compilation instructions.
MULTI has instructions on making a multi-purpose binary (ie a single binary
which performs multiple tasks, to save disk space)
SMALL has some tips on creating small binaries.
Please contact me if you have any questions/bugs found/features/ideas/comments etc :)
There is also a mailing list http://lists.ucc.gu.uwa.edu.au/mailman/listinfo/dropbear
Matt Johnston
matt@ucc.asn.au
In the absence of detailed documentation, some notes follow:
============================================================================
Server public key auth:
You can use ~/.ssh/authorized_keys in the same way as with OpenSSH, just put
the key entries in that file. They should be of the form:
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwVa6M6cGVmUcLl2cFzkxEoJd06Ub4bVDsYrWvXhvUV+ZAM9uGuewZBDoAqNKJxoIn0Hyd0Nk/yU99UVv6NWV/5YSHtnf35LKds56j7cuzoQpFIdjNwdxAN0PCET/MG8qyskG/2IE2DPNIaJ3Wy+Ws4IZEgdJgPlTYUBWWtCWOGc= someone@hostname
You must make sure that ~/.ssh, and the key file, are only writable by the
user. Beware of editors that split the key into multiple lines.
Dropbear supports some options for authorized_keys entries, see the manpage.
============================================================================
Client public key auth:
Dropbear can do public key auth as a client, but you will have to convert
OpenSSH style keys to Dropbear format, or use dropbearkey to create them.
If you have an OpenSSH-style private key ~/.ssh/id_rsa, you need to do:
dropbearconvert openssh dropbear ~/.ssh/id_rsa ~/.ssh/id_rsa.db
dbclient -i ~/.ssh/id_rsa.db
Dropbear does not support encrypted hostkeys though can connect to ssh-agent.
============================================================================
If you want to get the public-key portion of a Dropbear private key, look at
dropbearkey's '-y' option.
============================================================================
To run the server, you need to generate server keys, this is one-off:
./dropbearkey -t rsa -f dropbear_rsa_host_key
./dropbearkey -t dss -f dropbear_dss_host_key
./dropbearkey -t ecdsa -f dropbear_ecdsa_host_key
./dropbearkey -t ed25519 -f dropbear_ed25519_host_key
or alternatively convert OpenSSH keys to Dropbear:
./dropbearconvert openssh dropbear /etc/ssh/ssh_host_dsa_key dropbear_dss_host_key
You can also get Dropbear to create keys when the first connection is made -
this is preferable to generating keys when the system boots. Make sure
/etc/dropbear/ exists and then pass '-R' to the dropbear server.
============================================================================
If the server is run as non-root, you most likely won't be able to allocate a
pty, and you cannot login as any user other than that running the daemon
(obviously). Shadow passwords will also be unusable as non-root.
============================================================================
The Dropbear distribution includes a standalone version of OpenSSH's scp
program. You can compile it with "make scp", you may want to change the path
of the ssh binary, specified by _PATH_SSH_PROGRAM in options.h . By default
the progress meter isn't compiled in to save space, you can enable it by
adding 'SCPPROGRESS=1' to the make commandline.
https://matt.ucc.asn.au/dropbear/dropbear.html
INSTALL has compilation instructions.
MULTI has instructions on making a multi-purpose binary (ie a single binary
which performs multiple tasks, to save disk space)
SMALL has some tips on creating small binaries.
Please contact me if you have any questions/bugs found/features/ideas/comments etc :)
There is also a mailing list http://lists.ucc.gu.uwa.edu.au/mailman/listinfo/dropbear
Matt Johnston
matt@ucc.asn.au
In the absence of detailed documentation, some notes follow:
============================================================================
Server public key auth:
You can use ~/.ssh/authorized_keys in the same way as with OpenSSH, just put
the key entries in that file. They should be of the form:
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwVa6M6cGVmUcLl2cFzkxEoJd06Ub4bVDsYrWvXhvUV+ZAM9uGuewZBDoAqNKJxoIn0Hyd0Nk/yU99UVv6NWV/5YSHtnf35LKds56j7cuzoQpFIdjNwdxAN0PCET/MG8qyskG/2IE2DPNIaJ3Wy+Ws4IZEgdJgPlTYUBWWtCWOGc= someone@hostname
You must make sure that ~/.ssh, and the key file, are only writable by the
user. Beware of editors that split the key into multiple lines.
Dropbear supports some options for authorized_keys entries, see the manpage.
============================================================================
Client public key auth:
Dropbear can do public key auth as a client, but you will have to convert
OpenSSH style keys to Dropbear format, or use dropbearkey to create them.
If you have an OpenSSH-style private key ~/.ssh/id_rsa, you need to do:
dropbearconvert openssh dropbear ~/.ssh/id_rsa ~/.ssh/id_rsa.db
dbclient -i ~/.ssh/id_rsa.db
Dropbear does not support encrypted hostkeys though can connect to ssh-agent.
============================================================================
If you want to get the public-key portion of a Dropbear private key, look at
dropbearkey's '-y' option.
============================================================================
To run the server, you need to generate server keys, this is one-off:
./dropbearkey -t rsa -f dropbear_rsa_host_key
./dropbearkey -t dss -f dropbear_dss_host_key
./dropbearkey -t ecdsa -f dropbear_ecdsa_host_key
./dropbearkey -t ed25519 -f dropbear_ed25519_host_key
or alternatively convert OpenSSH keys to Dropbear:
./dropbearconvert openssh dropbear /etc/ssh/ssh_host_dsa_key dropbear_dss_host_key
You can also get Dropbear to create keys when the first connection is made -
this is preferable to generating keys when the system boots. Make sure
/etc/dropbear/ exists and then pass '-R' to the dropbear server.
============================================================================
If the server is run as non-root, you most likely won't be able to allocate a
pty, and you cannot login as any user other than that running the daemon
(obviously). Shadow passwords will also be unusable as non-root.
============================================================================
The Dropbear distribution includes a standalone version of OpenSSH's scp
program. You can compile it with "make scp", you may want to change the path
of the ssh binary, specified by _PATH_SSH_PROGRAM in options.h . By default
the progress meter isn't compiled in to save space, you can enable it by
adding 'SCPPROGRESS=1' to the make commandline.