Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbear SSH, a lightweight alternative to OpenSSH

librebyte.net

Post reply on HN
Print view View original

51–60 of 110 posts

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#51

Post by iveqy »

I needed a ssh server with some tweaks a few years ago. I must say that the dropbear code was very neatly written, easy to read and easy to understand. It made me to choose dropbear instead of openssh for my tweaks.

I would have used dropbear on my main machine as well, but it doesn't seem to support ~/.ssh/config

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#52

Post by loxias »

mirimir wrote: post #9

Dropbear works well for preboot LUKS unlocking with remote servers.

Currently, all my remote servers of any import use LUKS to encrypt the PVs. My /boot is a tiny unencrypted filesystem containing just the kernel, and an initrd, which prompts for my decryption key before booting. (afaict, the standard setup)

For remote servers, I reboot them and then have to use a serial console to type in the LUKS password.

Are you saying that with this, I could put an ssh server in the initrd (and I guess I'd have to make sure network was up as well), that I could log in to to provide my LUKS password???? Because that would be ... beautiful.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#53

Post by DownGoat »

fapjacks wrote: post #40

A word of caution: Many (most) IRC spambot detectors check if your connecting IP is also running a Dropbear SSHd service. This can cause you to be k-lined in some instances, and it's not immediately obvious to basically everyone why the anti-spambot bots are flagging your connection. Of course, this isn't Dropbear SSHd's fault. Just something you might want to keep in mind if you use both of these things.

It is because dropbear is very common in embedded systems. They are commonly riddled with vulnerabilities, so they are getting hacked almost as soon as they are publicly reachable. This is not because of dropbear, but because they are typically configured with weak credentials that are newer changed. I guess IRC servers see a lot of spam from such devices, so they just drop all systems which has dropbear.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#55

Post by avar »

rl3 wrote: post #8

I use an ad-free, open-source Android app called SimpleSSHD that implements a Dropbear SSH server. Being able to SSH into your phone and wirelessly perform an incremental rsync backup of all your photos and data is life-changing compared to the hell that is cables and the MTP protocol. Thank you to all these projects for delivering me from the clutches of MTP, I am indebted.

It's somewhat flaky, but you can also mount your phone as a local FS over USB debugging, requires a wired connection though: https://github.com/spion/adbfs-rootless

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#58

Post by tjoff »

pozibrothers wrote: post #50
tjoff wrote: post #48

Earlier quoted context omitted.

I haven't used SimpleSSHD but I use Termux, which gives me a "normal" terminal (no root required). Since Android 8 I've lost write access to general locations in the sd-card but I still have read access, as well as read+write on the internal storage. It has an ssh server which can be nice if you want to edit some files on the phone remotely but that's not needed for rsync. I have a shortcut on the home screen which t…

I think that you need to run the command "termux-setup-storage" to be able to r/w again: https://wiki.termux.com/wiki/Termux-setup-storage

Thanks, doesn't work though. I have write access to the private directory for termux on the sdcard but nothing else (which unfortunately breaks my usage, I'll report it to them any day to see if a fix is possible).

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#59

Post by bleke »

loxias wrote: post #52
mirimir wrote: post #9

Dropbear works well for preboot LUKS unlocking with remote servers.

Currently, all my remote servers of any import use LUKS to encrypt the PVs. My /boot is a tiny unencrypted filesystem containing just the kernel, and an initrd, which prompts for my decryption key before booting. (afaict, the standard setup) For remote servers, I reboot them and then have to use a serial console to type in the LUKS password. Are you saying that with this, I could put an ssh server in the initrd (and…

Yes you can and start whatever program you want, take i look at better-initramfs (https://github.com/slashbeast/better-initramfs), although it is more for gentoo/funtoo.

Basicaly when linux boot from initrd it starts "/init" executable and chroots to your system (ok, it is using pivot_root and it is slightly more complex), but idea it is same as manually mounting filesystems and doing chroot then starting executable /bin/init

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#60

Post by rhubinak »

mkj wrote: post #19
ajross wrote: post #7

Earlier quoted context omitted.

Nginx won because it was faster, simpler and more easily extended, not because it was "lightweight" per se. In comparison, dropbear doesn't really do anything that ssh doesn't, and lags in a bunch of esoteric features that "most" people don't use but that inevitably some people do. Who wants to use a distro where one's preferred ssh-agent feature or X11 forwarding inexplicably doesn't work? Dropbear is small and buil…

Dropbear author here. It used to have one unique feature, but OpenSSH has copied it now[0] :) dbclient host1,host2,user@host3 to onion-TCP-forward through a few hosts. [0] https://manpages.debian.org/stretch/openssh-client/ssh.1.en....

Hi,

First of all, thank you for creating Dropbear SSH. I would love to try it. I am currently using OpenSSH with PAM (Google Authenticator) and Ed25519. Does Dropbear support both PAM and Ed25519?

Post reply on HN