Dropbear SSH. This is the official git mirror.
C TeX Makefile M4 C++ Other Other
Permalink
Failed to load latest commit information.
debian changelogs Jul 21, 2016
libtomcrypt Support out-of-tree builds usign bundled libtom May 11, 2016
libtommath Support out-of-tree builds usign bundled libtom May 11, 2016
.hgsigs merge 2016.74 Jul 21, 2016
.hgtags merge 2016.74 Jul 21, 2016
.travis.yml Avoid osx "install" race Apr 12, 2016
CHANGES add CVEs and patch urls Sep 15, 2016
INSTALL Fix spelling typo Jul 19, 2007
LICENSE Fix no-writev fallback May 2, 2015
MULTI - Fix "inst_scp" target since there isn't a manpage Oct 9, 2013
Makefile.in Add generated header default_options.h to version control. May 4, 2016
README README: fix ecdsa key generation command Feb 9, 2014
SMALL 0.44 release changes Jan 2, 2005
TODO 0.48 progress Mar 9, 2006
agentfwd.h Convert #ifdef to #if, other build changes May 4, 2016
algo.h Convert #ifdef to #if, other build changes May 4, 2016
atomicio.c upgrade atomicio Nov 15, 2016
atomicio.h upgrade atomicio Nov 15, 2016
auth.h Convert #ifdef to #if, other build changes May 4, 2016
bignum.c more hard tab Jan 1, 2016
bignum.h move m_burn and function attributes to dbhelpers Mar 17, 2016
buffer.c additional length checks Jul 11, 2016
buffer.h buf_getstring and buf_putstring now use non-unsigned char* Jun 4, 2015
channel.h Convert #ifdef to #if, other build changes May 4, 2016
chansession.h Convert #ifdef to #if, other build changes May 4, 2016
circbuffer.c lazy allocation of circbuffer Nov 19, 2015
circbuffer.h Fix no-writev fallback May 2, 2015
cli-agentfwd.c upgrade atomicio Nov 15, 2016
cli-auth.c message about truncated banner May 4, 2016
cli-authinteract.c Convert #ifdef to #if, other build changes May 4, 2016
cli-authpasswd.c Convert #ifdef to #if, other build changes May 4, 2016
cli-authpubkey.c Convert #ifdef to #if, other build changes May 4, 2016
cli-channel.c Rearranged some more bits, marked some areas that need work. Oct 2, 2006
cli-chansession.c Convert #ifdef to #if, other build changes May 4, 2016
cli-kex.c Convert #ifdef to #if, other build changes May 4, 2016
cli-main.c merge 2016.74 Jul 21, 2016
cli-runopts.c Convert #ifdef to #if, other build changes May 4, 2016
cli-session.c Convert #ifdef to #if, other build changes May 4, 2016
cli-tcpfwd.c initialize variable and protect against NULL dereferencement Nov 15, 2016
common-algo.c merge 2016.74 Jul 21, 2016
common-channel.c remove duplicated include Nov 15, 2016
common-chansession.c Chantype handling is sorted Jun 2, 2004
common-kex.c Convert #ifdef to #if, other build changes May 4, 2016
common-runopts.c Convert #ifdef to #if, other build changes May 4, 2016
common-session.c merge 2016.74 Jul 21, 2016
compat.c upgrade strlcat Nov 15, 2016
compat.h fix empty C prototypes Mar 16, 2016
config.guess another new config.guess 2013-06-10 Nov 14, 2013
config.sub Update to 2013-10-01 Dec 3, 2013
configure.ac Use memset_s or explicit_bzero Mar 16, 2016
crypto_desc.c Convert #ifdef to #if, other build changes May 4, 2016
crypto_desc.h fix empty C prototypes Mar 16, 2016
curve25519-donna.c Fix for old compilers, variable declarations at beginning of functions Feb 24, 2015
dbclient.1 use exec for proxycommand Dec 18, 2015
dbhelpers.c move m_burn and function attributes to dbhelpers Mar 17, 2016
dbhelpers.h move m_burn and function attributes to dbhelpers Mar 17, 2016
dbmulti.c allow specifying dropbearmulti command as an argument Mar 10, 2016
dbrandom.c Convert #ifdef to #if, other build changes May 4, 2016
dbrandom.h fix empty C prototypes Mar 16, 2016
dbutil.c Use atomic key generation in all cases Nov 18, 2016
dbutil.h Use atomic key generation in all cases Nov 18, 2016
debug.h Convert #ifdef to #if, other build changes May 4, 2016
default_options.h Add generated header default_options.h to version control. May 4, 2016
default_options.h.in Convert #ifdef to #if, other build changes May 4, 2016
dh_groups.c Fix whitespace missed in merge Mar 18, 2016
dh_groups.h Get rid of group15, move group16 to sha512. Mar 12, 2016
dropbear.8 Add manpage and log for forced_command Apr 12, 2016
dropbearconvert.1 Fix minor manpage formatting issues Nov 25, 2015
dropbearconvert.c Convert #ifdef to #if, other build changes May 4, 2016
dropbearkey.1 Fix minor manpage formatting issues Nov 25, 2015
dropbearkey.c Use atomic key generation in all cases Nov 18, 2016
dss.c Convert #ifdef to #if, other build changes May 4, 2016
dss.h Convert #ifdef to #if, other build changes May 4, 2016
ecc.c Convert #ifdef to #if, other build changes May 4, 2016
ecc.h Convert #ifdef to #if, other build changes May 4, 2016
ecdsa.c Convert #ifdef to #if, other build changes May 4, 2016
ecdsa.h Convert #ifdef to #if, other build changes May 4, 2016
fake-rfc2553.c - Update fake-rfc2553.{c,h} from OpenSSH 5.5p1 Jul 21, 2010
fake-rfc2553.h DROPBEAR_ prefix for include guards to avoid collisions Feb 24, 2015
filelist.txt filelist.txt Aug 14, 2004
gendss.c Convert #ifdef to #if, other build changes May 4, 2016
gendss.h Convert #ifdef to #if, other build changes May 4, 2016
genrsa.c Convert #ifdef to #if, other build changes May 4, 2016
genrsa.h Convert #ifdef to #if, other build changes May 4, 2016
gensignkey.c Use atomic key generation in all cases Nov 18, 2016
gensignkey.h Use atomic key generation in all cases Nov 18, 2016
ifndef_wrapper.sh Convert #ifdef to #if, other build changes May 4, 2016
includes.h DROPBEAR_ prefix for include guards to avoid collisions Feb 24, 2015
install-sh Makefile.in contains updated files required Jun 1, 2004
kex.h Convert #ifdef to #if, other build changes May 4, 2016
keyimport.c merge 2016.74 Jul 21, 2016
keyimport.h DROPBEAR_ prefix for include guards to avoid collisions Feb 24, 2015
list.c list.c also has no trailing newline Jul 5, 2011
list.h fix empty C prototypes Mar 16, 2016
listener.c Free memory before exiting. Based on patch from Thorsten Horstmann. Feb 24, 2015
listener.h fix empty C prototypes Mar 16, 2016
loginrec.c upgrade atomicio Nov 15, 2016
loginrec.h remove unused loginrec_set_addr() Mar 15, 2016
ltc_prng.c Convert #ifdef to #if, other build changes May 4, 2016
ltc_prng.h Convert #ifdef to #if, other build changes May 4, 2016
netio.c make sure socket is of the right domain Jun 19, 2016
netio.h Convert #ifdef to #if, other build changes May 4, 2016
options.h Convert #ifdef to #if, other build changes May 4, 2016
packet.c fix empty C prototypes Mar 16, 2016
packet.h fix empty C prototypes Mar 16, 2016
process-packet.c fix empty C prototypes Mar 16, 2016
progressmeter.c Update to scp from OpenSSH portable 4.3p2 Mar 8, 2006
progressmeter.h Makefile.in contains updated files required Jun 1, 2004
queue.c Move the more verbose TRACE() statements into TRACE2() Mar 31, 2013
queue.h DROPBEAR_ prefix for include guards to avoid collisions Feb 24, 2015
release.sh release.sh reminds how to sign Nov 25, 2015
rsa.c Convert #ifdef to #if, other build changes May 4, 2016
rsa.h Convert #ifdef to #if, other build changes May 4, 2016
runopts.h Convert #ifdef to #if, other build changes May 4, 2016
scp.c Convert #ifdef to #if, other build changes May 4, 2016
scpmisc.c scp: Have `fatal()' append a newline to the message Jan 18, 2016
scpmisc.h upgrade atomicio Nov 15, 2016
service.h fix empty C prototypes Mar 16, 2016
session.h Convert #ifdef to #if, other build changes May 4, 2016
signkey.c Convert #ifdef to #if, other build changes May 4, 2016
signkey.h Convert #ifdef to #if, other build changes May 4, 2016
ssh.h propagate from branch 'au.asn.ucc.matt.dropbear' (head 0501e6f661b541… Mar 21, 2006
sshpty.c ignore I_PUSH if it isn't defined, for Android from Reimar Döffinger Mar 19, 2013
sshpty.h Makefile.in contains updated files required Jun 1, 2004
svr-agentfwd.c Convert #ifdef to #if, other build changes May 4, 2016
svr-auth.c Convert #ifdef to #if, other build changes May 4, 2016
svr-authpam.c Convert #ifdef to #if, other build changes May 4, 2016
svr-authpasswd.c Convert #ifdef to #if, other build changes May 4, 2016
svr-authpubkey.c Convert #ifdef to #if, other build changes May 4, 2016
svr-authpubkeyoptions.c Convert #ifdef to #if, other build changes May 4, 2016
svr-chansession.c initialize variable Nov 15, 2016
svr-kex.c Use atomic key generation in all cases Nov 18, 2016
svr-main.c Convert #ifdef to #if, other build changes May 4, 2016
svr-runopts.c Convert #ifdef to #if, other build changes May 4, 2016
svr-service.c buf_getstring and buf_putstring now use non-unsigned char* Jun 4, 2015
svr-session.c merge 2016.74 Jul 21, 2016
svr-tcpfwd.c Convert #ifdef to #if, other build changes May 4, 2016
svr-x11fwd.c Convert #ifdef to #if, other build changes May 4, 2016
sysoptions.h merge 2016.74 Jul 21, 2016
tcp-accept.c Convert #ifdef to #if, other build changes May 4, 2016
tcpfwd.h fix empty C prototypes Mar 16, 2016
termcodes.c add IUTF8 Apr 2, 2013
termcodes.h DROPBEAR_ prefix for include guards to avoid collisions Feb 24, 2015
x11fwd.h Convert #ifdef to #if, other build changes May 4, 2016

README

This is Dropbear, a smallish SSH server and client.
https://matt.ucc.asn.au/dropbear/dropbear.html

INSTALL has compilation instructions.

MULTI has instructions on making a multi-purpose binary (ie a single binary
which performs multiple tasks, to save disk space)

SMALL has some tips on creating small binaries.

See TODO for a few of the things I know need looking at, and please contact
me if you have any questions/bugs found/features/ideas/comments etc :)

Matt Johnston
matt@ucc.asn.au


In the absence of detailed documentation, some notes follow:
============================================================================

Server public key auth:

You can use ~/.ssh/authorized_keys in the same way as with OpenSSH, just put
the key entries in that file. They should be of the form:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwVa6M6cGVmUcLl2cFzkxEoJd06Ub4bVDsYrWvXhvUV+ZAM9uGuewZBDoAqNKJxoIn0Hyd0Nk/yU99UVv6NWV/5YSHtnf35LKds56j7cuzoQpFIdjNwdxAN0PCET/MG8qyskG/2IE2DPNIaJ3Wy+Ws4IZEgdJgPlTYUBWWtCWOGc= someone@hostname

You must make sure that ~/.ssh, and the key file, are only writable by the
user. Beware of editors that split the key into multiple lines.

Dropbear supports some options for authorized_keys entries, see the manpage.

============================================================================

Client public key auth:

Dropbear can do public key auth as a client, but you will have to convert
OpenSSH style keys to Dropbear format, or use dropbearkey to create them.

If you have an OpenSSH-style private key ~/.ssh/id_rsa, you need to do:

dropbearconvert openssh dropbear ~/.ssh/id_rsa  ~/.ssh/id_rsa.db
dbclient -i ~/.ssh/id_rsa.db <hostname>

Dropbear does not support encrypted hostkeys though can connect to ssh-agent.

============================================================================

If you want to get the public-key portion of a Dropbear private key, look at
dropbearkey's '-y' option.

============================================================================

To run the server, you need to server keys, this is one-off:
./dropbearkey -t rsa -f dropbear_rsa_host_key
./dropbearkey -t dss -f dropbear_dss_host_key
./dropbearkey -t ecdsa -f dropbear_ecdsa_host_key

or alternatively convert OpenSSH keys to Dropbear:
./dropbearconvert openssh dropbear /etc/ssh/ssh_host_dsa_key dropbear_dss_host_key

You can also get Dropbear to create keys when the first connection is made -
this is preferable to generating keys when the system boots. Make sure 
/etc/dropbear/ exists and then pass '-R' to the dropbear server.

============================================================================

If the server is run as non-root, you most likely won't be able to allocate a
pty, and you cannot login as any user other than that running the daemon
(obviously). Shadow passwords will also be unusable as non-root.

============================================================================

The Dropbear distribution includes a standalone version of OpenSSH's scp
program. You can compile it with "make scp", you may want to change the path
of the ssh binary, specified by _PATH_SSH_PROGRAM in options.h . By default
the progress meter isn't compiled in to save space, you can enable it by 
adding 'SCPPROGRESS=1' to the make commandline.