Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbear SSH, a lightweight alternative to OpenSSH

librebyte.net

Post reply on HN
Print view View original

71–80 of 110 posts

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#71

Post by mkj »

rhubinak wrote: post #60
mkj wrote: post #19

Earlier quoted context omitted.

Dropbear author here. It used to have one unique feature, but OpenSSH has copied it now[0] :) dbclient host1,host2,user@host3 to onion-TCP-forward through a few hosts. [0] https://manpages.debian.org/stretch/openssh-client/ssh.1.en....

Hi, First of all, thank you for creating Dropbear SSH. I would love to try it. I am currently using OpenSSH with PAM (Google Authenticator) and Ed25519. Does Dropbear support both PAM and Ed25519?

PAM support is fairly rudimentary and only supports username/password. ed25519 isn't supported - a few people have wanted it I might add it at some point. I haven't seen a real reason to go with that over ecdsa.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#72

Post by [deleted] »

chx wrote: post #20
ajross wrote: post #7

Earlier quoted context omitted.

Nginx won because it was faster, simpler and more easily extended, not because it was "lightweight" per se. In comparison, dropbear doesn't really do anything that ssh doesn't, and lags in a bunch of esoteric features that "most" people don't use but that inevitably some people do. Who wants to use a distro where one's preferred ssh-agent feature or X11 forwarding inexplicably doesn't work? Dropbear is small and buil…

Or the SOCKS proxy built into OpenSSHD...

[deleted]

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#73

Post by paulie_a »

CyberShadow wrote: post #41
adrianratnapala wrote: post #11

Earlier quoted context omitted.

A long time ago, when I tried something like that, I was stymied because the SSH server did not have permissions to write to any directory which the document readers etc. could see. Is this sort of thing still a problem? How did you get around it?

If your phone is rooted, you can use e.g. Linux Deploy to install a full Linux distribution. Then, you can set up regular ol' OpenSSH, mount /sys and /data under the Linux chroot, and rsync as usual. I use this method to rsync to btrfs snapshots (+ raw copies of non-filesystem partitions) to make daily incremental backups of the entire phone. (Restoring said backups is a bit more involved, but I verified it's doable.…

I'd backup to a more reliable filesystem than btrfs. In my experience you will eventually randomly lose data with btrfs. I have lost all trust in it.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#74

Post by rl3 »

LudoA wrote: post #67
rl3 wrote: post #8

I use an ad-free, open-source Android app called SimpleSSHD that implements a Dropbear SSH server. Being able to SSH into your phone and wirelessly perform an incremental rsync backup of all your photos and data is life-changing compared to the hell that is cables and the MTP protocol. Thank you to all these projects for delivering me from the clutches of MTP, I am indebted.

What do you use to have rsync on your phone? And did you have to root your phone to achieve any of this? Also, is there a tool to use duckdns or similar to assign a hostname to your phone?

1) SimpleSSHD includes rsync.

2) No.

3) Haven't looked into dynamic DNS yet; only using the setup with local wifi currently.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#75

Post by crest »

mkj wrote: post #71
rhubinak wrote: post #60

Earlier quoted context omitted.

Hi, First of all, thank you for creating Dropbear SSH. I would love to try it. I am currently using OpenSSH with PAM (Google Authenticator) and Ed25519. Does Dropbear support both PAM and Ed25519?

PAM support is fairly rudimentary and only supports username/password. ed25519 isn't supported - a few people have wanted it I might add it at some point. I haven't seen a real reason to go with that over ecdsa.

The reason to use Ed25519 over ECDSA is that ECDSA can't be used unless you have a good CPRNG. Just ask Sony what happens if you reuse a nonce with (EC-)DSA.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#76

Post by tambourine_man »

_zskd wrote: post #31
tambourine_man wrote: post #28

Earlier quoted context omitted.

Is there an equivalent for iOS?

Lol

Thank you for your thoughtful contribution.

Open Terminal managed to sandbox a busybox like suite (grep, curl, gzip…). And a scripting language to boot.

rsync limited to the app's directory + shared folders such Photos, iCloud drive, etc would be pretty useful, even without full file system access.

iOS's restrictions are loosening up, vide Files.app

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#77

Post by JdeBP »

gonvaled wrote: post #39
spockz wrote: post #32

Earlier quoted context omitted.

Or ‘better’ fix an IP to your device MAC in your dhcp settings.

Usually not needed, since your router will usually try to assign a fixed address for already known devices.

What spockz said takes the words "usually" and "try" out of that. (-:

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#78

Post by loxias »

mkj wrote: post #70
loxias wrote: post #52

Earlier quoted context omitted.

Currently, all my remote servers of any import use LUKS to encrypt the PVs. My /boot is a tiny unencrypted filesystem containing just the kernel, and an initrd, which prompts for my decryption key before booting. (afaict, the standard setup) For remote servers, I reboot them and then have to use a serial console to type in the LUKS password. Are you saying that with this, I could put an ssh server in the initrd (and…

For Ubuntu or Debian the dropbear-initramfs package should handle most of it, it looks like https://hamy.io/post/0005/remote-unlocking-of-luks-encrypted... is an alright run through. Another approach is to use something like OpenWRT as a bootloader then pivot_root into the real distribution after unlocking it - not sure there are any good instructions online for that though. I'm using it on a Raspberry Pi colocated 1…

You are rocking my world. :D

When I first started switching my VPSs to having full disk encryption, I think it was around lenny though it might have been squeeze. Anyway, me and another peer thought it would be good practice to, while we figured we'd never cover every possible surface, find a standard deployment for debian VMs where even though we have no physical access to the hosts, wherever possible minimized the ability of an employee at a hosting company accessing our precious, precious bits.

The memory hadn't come back when I wrote my first comment, but one of the ideas we had at the time was shoving sshd inside the initrd! But we concluded it would be hard -- involving not only making a static build of sshd (which I did some eons ago when I had foolish opinions concerning /bin /usr/bin) but also probably trimming code away from it or adding executable compression, and modifying the initrd creation scripts....either way -- too much complexity.

So I went the route previously described. Now I learn that not only is there an ssh implementation which i can statically link into a tiny binary (which helps some other projects...), but someone went threw the trouble of making a modified initrd package with it!

Fantastic. Look for an email from me soon offering help on a specific project I noticed on your github...

I'm well aware of building my own scripts that use chroot/pivot_root tricks -- I personally like using them for making small boxes that run everything from ram and keep no persistent state.

But just out of random curiosity, what's the advantage of using OpenWRT?

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#79

Post by bjoli »

Terretta wrote: post #66
_zskd wrote: post #31

Earlier quoted context omitted.

Lol

Let’s keep in mind the user story: “Being able to wirelessly perform an incremental backup of all your photos and data is life-changing” The LOL is telling your Mom about DropbearSSH when this is now how iCloud Photos and Files just works. The equivalent goal is baked in. You can still use cables or local WiFi via iTunes, but now all media and files sync over-the-air as files, along with an incremental backup of all…

The bizarre part about Apple is than when an idevice fails, which they do at a rate higher than anything else I have ever owned, you have to go to an apple store, pull your pants down and bend over. If they consider the device fixable (which they often don't) they take it from you for at least 10 days (since Apple won't allow them to have any parts in the actual stores) and you get back a device with a fix that usually doesn't work that good (small rubber mats to push a chip in place) or they will have replaced the faulty part with a new one that is at great risk of being faulty in the same way in a couple of months again.

This forces you to actually pay for iCloud since they will wipe your device even if the problem is in a completely unrelated part of the computer.

After repairing countless idevice that the Apple store deemed broken beyond rescue with 10 minute soldering jobs for a fraction of the price of what apple would have charged for the job had they been willing to do it (because apple can't solder or underfill even if their life depended on it) i have simply stopped buying apple devices and recommended others to do like me.

Someone else said it better than me: being an apple user is like being in a bad relationship.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#80

Post by mkj »

crest wrote: post #75
mkj wrote: post #71

Earlier quoted context omitted.

PAM support is fairly rudimentary and only supports username/password. ed25519 isn't supported - a few people have wanted it I might add it at some point. I haven't seen a real reason to go with that over ecdsa.

The reason to use Ed25519 over ECDSA is that ECDSA can't be used unless you have a good CPRNG. Just ask Sony what happens if you reuse a nonce with (EC-)DSA.

True, that could be a good reason. Forgot to mention and can't edit in the previous comment, there's a PoC ed25519 implementation I need to look at merging.
Post reply on HN