Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbear SSH, a lightweight alternative to OpenSSH

librebyte.net

Post reply on HN
Print view View original

81–90 of 110 posts

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#81

Post by throwaway-hn123 »

bjoli wrote: post #79
Terretta wrote: post #66

Earlier quoted context omitted.

Let’s keep in mind the user story: “Being able to wirelessly perform an incremental backup of all your photos and data is life-changing” The LOL is telling your Mom about DropbearSSH when this is now how iCloud Photos and Files just works. The equivalent goal is baked in. You can still use cables or local WiFi via iTunes, but now all media and files sync over-the-air as files, along with an incremental backup of all…

The bizarre part about Apple is than when an idevice fails, which they do at a rate higher than anything else I have ever owned, you have to go to an apple store, pull your pants down and bend over. If they consider the device fixable (which they often don't) they take it from you for at least 10 days (since Apple won't allow them to have any parts in the actual stores) and you get back a device with a fix that usual…

> you have to go to an apple store, pull your pants down and bend over.

I mean, if you paid extra for that, that's your deal, and no one is going to judge you.

My iPad stopped working last week. I made an appointment, went in, and in 10 minutes walked out with a brand new replacement iPad.

I guess people get treated like they deserve to be, huh?

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#83

Post by mkj »

loxias wrote: post #78
mkj wrote: post #70

Earlier quoted context omitted.

For Ubuntu or Debian the dropbear-initramfs package should handle most of it, it looks like https://hamy.io/post/0005/remote-unlocking-of-luks-encrypted... is an alright run through. Another approach is to use something like OpenWRT as a bootloader then pivot_root into the real distribution after unlocking it - not sure there are any good instructions online for that though. I'm using it on a Raspberry Pi colocated 1…

You are rocking my world. :D When I first started switching my VPSs to having full disk encryption, I think it was around lenny though it might have been squeeze. Anyway, me and another peer thought it would be good practice to, while we figured we'd never cover every possible surface, find a standard deployment for debian VMs where even though we have no physical access to the hosts, wherever possible minimized the…

> But just out of random curiosity, what's the advantage of using OpenWRT?

I can't remember the exact reason, maybe it was because then the "bootloader" is completely decoupled from the main OS which makes upgrading kernels etc easier. It was about 5 years ago I set it up.

I should add, all the Debian initramfs work has been contributed by various people over the years - full credit to people such as the Debian maintainers, currently Guilhem Moulin.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#85

Post by zymhan »

eldios wrote: post #84

Dropbear has been created in 2002. From the project ChangeLog: ``` [..] 0.28 - Sun Apr 6 2003 - Initial public release Development was started in October 2002 ``` ..why is it surfacing now on HN? O_o

I mean it's good to remind people of older and less-known projects, but Dropbear is quite common for embedded Linux applications.

OpenWRT uses it for example.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#87

Post by loxias »

mkj wrote: post #83
loxias wrote: post #78

Earlier quoted context omitted.

You are rocking my world. :D When I first started switching my VPSs to having full disk encryption, I think it was around lenny though it might have been squeeze. Anyway, me and another peer thought it would be good practice to, while we figured we'd never cover every possible surface, find a standard deployment for debian VMs where even though we have no physical access to the hosts, wherever possible minimized the…

> But just out of random curiosity, what's the advantage of using OpenWRT? I can't remember the exact reason, maybe it was because then the "bootloader" is completely decoupled from the main OS which makes upgrading kernels etc easier. It was about 5 years ago I set it up. I should add, all the Debian initramfs work has been contributed by various people over the years - full credit to people such as the Debian maint…

> should add, all the Debian initramfs work has been contributed by various people over the years

Oh certainly, I would have assumed it was.

All I know for sure is that many moons ago I would have loved this feature, could have probably done it myself at great great great effort but didn't want to, and now, hey, here it is :) progress!!

As for decoupling and lowering complexity... occasionally i miss LILO...

I've been paging through the code (dropbear) so far, very clear. Glad that there's TCP forwarding, as it opens the door to another possible solution in search of a problem. Namely, with USB over IP tunneled through dropbear, a user would have the ability to plug in a yubikey or some sort of challenge response device. ; )

Also, I sent you a note.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#89

Post by theandrewbailey »

mkj wrote: post #70
loxias wrote: post #52

Earlier quoted context omitted.

Currently, all my remote servers of any import use LUKS to encrypt the PVs. My /boot is a tiny unencrypted filesystem containing just the kernel, and an initrd, which prompts for my decryption key before booting. (afaict, the standard setup) For remote servers, I reboot them and then have to use a serial console to type in the LUKS password. Are you saying that with this, I could put an ssh server in the initrd (and…

For Ubuntu or Debian the dropbear-initramfs package should handle most of it, it looks like https://hamy.io/post/0005/remote-unlocking-of-luks-encrypted... is an alright run through. Another approach is to use something like OpenWRT as a bootloader then pivot_root into the real distribution after unlocking it - not sure there are any good instructions online for that though. I'm using it on a Raspberry Pi colocated 1…

I've set my Ubuntu server up with dropbear-initramfs almost 2 years ago, but a few months ago, it stopped working. Since 18.04 was imminent, I decided to wait and not fix it, and hope my new UPS keeps it running.

Re: Dropbear SSH, a lightweight alternative to OpenSSH

#90

Post by mirimir »

loxias wrote: post #52
mirimir wrote: post #9

Dropbear works well for preboot LUKS unlocking with remote servers.

Currently, all my remote servers of any import use LUKS to encrypt the PVs. My /boot is a tiny unencrypted filesystem containing just the kernel, and an initrd, which prompts for my decryption key before booting. (afaict, the standard setup) For remote servers, I reboot them and then have to use a serial console to type in the LUKS password. Are you saying that with this, I could put an ssh server in the initrd (and…

Yes, basically.
Post reply on HN