annotate README @ 1788:1fc0012b9c38

Fix handling of replies to global requests (#112) The current code assumes that all global requests want / need a reply. This isn't always true and the request itself indicates if it wants a reply or not. It causes a specific problem with [email protected] messages. These are sent by OpenSSH after authentication to inform the client of potential other host keys for the host. This can be used to add a new type of host key or to rotate host keys. The initial information message from the server is sent as a global request, but with want_reply set to false. This means that the server doesn't expect an answer to this message. Instead the client needs to send a prove request as a reply if it wants to receive proof of ownership for the host keys. The bug doesn't cause any current problems with due to how OpenSSH treats receiving the failure message. It instead treats it as a keepalive message and further ignores it. Arguably this is a protocol violation though of Dropbear and it is only accidental that it doesn't cause a problem with OpenSSH. The bug was found when adding host keys support to libssh, which is more strict protocol wise and treats the unexpected failure message an error, also see https://gitlab.com/libssh/libssh-mirror/-/merge_requests/145 for more information. The fix here is to honor the want_reply flag in the global request and to only send a reply if the other side expects a reply.
author Dirkjan Bussink <d.bussink@gmail.com>
date Thu, 10 Dec 2020 16:13:13 +0100
parents d32bcb5c557d
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
821
f8b28a3de6cb Don't say "SSH 2" any more since protocol version 1 is irrelevant
Matt Johnston <matt@ucc.asn.au>
parents: 717
diff changeset
1 This is Dropbear, a smallish SSH server and client.
701
20dafc77322e link to Dropbear webpage
Matt Johnston <matt@ucc.asn.au>
parents: 382
diff changeset
2 https://matt.ucc.asn.au/dropbear/dropbear.html
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 INSTALL has compilation instructions.
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 MULTI has instructions on making a multi-purpose binary (ie a single binary
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7 which performs multiple tasks, to save disk space)
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9 SMALL has some tips on creating small binaries.
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10
1548
10dd3df31d5b remove references to TODO
Matt Johnston <matt@ucc.asn.au>
parents: 901
diff changeset
11 Please contact me if you have any questions/bugs found/features/ideas/comments etc :)
10dd3df31d5b remove references to TODO
Matt Johnston <matt@ucc.asn.au>
parents: 901
diff changeset
12 There is also a mailing list http://lists.ucc.gu.uwa.edu.au/mailman/listinfo/dropbear
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 Matt Johnston
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15 [email protected]
380
d5faf4814ddb Update to LibTomCrypt 1.16
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16
d5faf4814ddb Update to LibTomCrypt 1.16
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17
75
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
18 In the absence of detailed documentation, some notes follow:
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
19 ============================================================================
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
20
90
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
21 Server public key auth:
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
22
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
23 You can use ~/.ssh/authorized_keys in the same way as with OpenSSH, just put
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
24 the key entries in that file. They should be of the form:
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
25
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
26 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwVa6M6cGVmUcLl2cFzkxEoJd06Ub4bVDsYrWvXhvUV+ZAM9uGuewZBDoAqNKJxoIn0Hyd0Nk/yU99UVv6NWV/5YSHtnf35LKds56j7cuzoQpFIdjNwdxAN0PCET/MG8qyskG/2IE2DPNIaJ3Wy+Ws4IZEgdJgPlTYUBWWtCWOGc= someone@hostname
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
27
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
28 You must make sure that ~/.ssh, and the key file, are only writable by the
290
94ee16f5b8a8 0.48 progress
Matt Johnston <matt@ucc.asn.au>
parents: 161
diff changeset
29 user. Beware of editors that split the key into multiple lines.
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
30
717
74deece07742 update text about authorized_keys options
Matt Johnston <matt@ucc.asn.au>
parents: 701
diff changeset
31 Dropbear supports some options for authorized_keys entries, see the manpage.
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
32
75
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
33 ============================================================================
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
34
90
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
35 Client public key auth:
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
36
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
37 Dropbear can do public key auth as a client, but you will have to convert
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
38 OpenSSH style keys to Dropbear format, or use dropbearkey to create them.
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
39
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
40 If you have an OpenSSH-style private key ~/.ssh/id_rsa, you need to do:
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
41
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
42 dropbearconvert openssh dropbear ~/.ssh/id_rsa ~/.ssh/id_rsa.db
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
43 dbclient -i ~/.ssh/id_rsa.db <hostname>
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
44
874
68e2a0f6c1ef Update README
Matt Johnston <matt@ucc.asn.au>
parents: 821
diff changeset
45 Dropbear does not support encrypted hostkeys though can connect to ssh-agent.
90
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
46
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
47 ============================================================================
c2ac796b130e merge of 00b67a11e33c3ed390556805ed6d1078528bee70
Matt Johnston <matt@ucc.asn.au>
parents: 75
diff changeset
48
75
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
49 If you want to get the public-key portion of a Dropbear private key, look at
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
50 dropbearkey's '-y' option.
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
51
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
52 ============================================================================
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
53
1628
ff3f274ea56c Add missing word to readme (#77)
Michael Jones <jonesmz@users.noreply.github.com>
parents: 1548
diff changeset
54 To run the server, you need to generate server keys, this is one-off:
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
55 ./dropbearkey -t rsa -f dropbear_rsa_host_key
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
56 ./dropbearkey -t dss -f dropbear_dss_host_key
901
8bc704f417f3 README: fix ecdsa key generation command
Catalin Patulea <cat@vv.carleton.ca>
parents: 874
diff changeset
57 ./dropbearkey -t ecdsa -f dropbear_ecdsa_host_key
1659
d32bcb5c557d Add Ed25519 support (#91)
Vladislav Grishenko <themiron@users.noreply.github.com>
parents: 1628
diff changeset
58 ./dropbearkey -t ed25519 -f dropbear_ed25519_host_key
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
59
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
60 or alternatively convert OpenSSH keys to Dropbear:
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
61 ./dropbearconvert openssh dropbear /etc/ssh/ssh_host_dsa_key dropbear_dss_host_key
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
62
874
68e2a0f6c1ef Update README
Matt Johnston <matt@ucc.asn.au>
parents: 821
diff changeset
63 You can also get Dropbear to create keys when the first connection is made -
68e2a0f6c1ef Update README
Matt Johnston <matt@ucc.asn.au>
parents: 821
diff changeset
64 this is preferable to generating keys when the system boots. Make sure
68e2a0f6c1ef Update README
Matt Johnston <matt@ucc.asn.au>
parents: 821
diff changeset
65 /etc/dropbear/ exists and then pass '-R' to the dropbear server.
68e2a0f6c1ef Update README
Matt Johnston <matt@ucc.asn.au>
parents: 821
diff changeset
66
75
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
67 ============================================================================
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
68
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
69 If the server is run as non-root, you most likely won't be able to allocate a
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
70 pty, and you cannot login as any user other than that running the daemon
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
71 (obviously). Shadow passwords will also be unusable as non-root.
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
72
75
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
73 ============================================================================
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
74
72
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
75 The Dropbear distribution includes a standalone version of OpenSSH's scp
9597c2e3b9d4 Some doc changes
Matt Johnston <matt@ucc.asn.au>
parents: 4
diff changeset
76 program. You can compile it with "make scp", you may want to change the path
161
b9d3f725e00b 0.44 release changes
Matt Johnston <matt@ucc.asn.au>
parents: 90
diff changeset
77 of the ssh binary, specified by _PATH_SSH_PROGRAM in options.h . By default
75
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
78 the progress meter isn't compiled in to save space, you can enable it by
a54d20c96178 Some documentation touchups
Matt Johnston <matt@ucc.asn.au>
parents: 72
diff changeset
79 adding 'SCPPROGRESS=1' to the make commandline.