Mercurial > dropbear
annotate SMALL @ 1921:284c3837891c
Allow user space file locations (rootless support)
Why:
Running dropbear as a user (rootless) is aided if
files and programs can be saved/removed without
needing sudo.
What:
Use the same convention as DROPBEAR_DEFAULT_CLI_AUTHKEY;
if not starting with '/', then is relative to hedge's /home/hedge:
*_PRIV_FILENAME
DROPBEAR_PIDFILE
SFTPSERVER_PATH
default_options.h commentary added.
Changes kept to a minimum, so log entry in svr_kex.c#163
is refactored.
From:
Generated hostkey is <path> ... <finger-print>
to:
Generated hostkey path is <path>
Generated hostkey fingerprint is <fp>
Otherwise the unexpanded path was reported.
Patch modified by Matt Johnston
Signed-off-by: Begley Brothers Inc <[email protected]>
| author | Begley Brothers Inc <begleybrothers@gmail.com> |
|---|---|
| date | Thu, 09 Jul 2020 17:47:58 +1000 |
| parents | 13cb8cc1b0e4 |
| children |
| rev | line source |
|---|---|
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
1 Tips for a small system: |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
2 |
| 161 | 3 If you only want server functionality (for example), compile with |
| 4 make PROGRAMS=dropbear | |
| 5 rather than just | |
| 6 make dropbear | |
| 7 so that client functionality in shared portions of Dropbear won't be included. | |
| 8 The same applies if you are compiling just a client. | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
9 |
| 161 | 10 --- |
| 11 | |
|
1915
13cb8cc1b0e4
Remove twofish and remnants of blowfish
Matt Johnston <matt@ucc.asn.au>
parents:
161
diff
changeset
|
12 The following are set in localoptions.h: |
| 161 | 13 |
| 14 - If you're compiling statically, you can turn off host lookups | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
15 |
| 161 | 16 - You can disable either password or public-key authentication, though note |
| 17 that the IETF draft states that pubkey authentication is required. | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
18 |
| 161 | 19 - Similarly with DSS and RSA, you can disable one of these if you know that |
| 20 all clients will be able to support a particular one. The IETF draft | |
| 21 states that DSS is required, however you may prefer to use RSA. | |
| 22 DON'T disable either of these on systems where you aren't 100% sure about | |
| 23 who will be connecting and what clients they will be using. | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
24 |
| 161 | 25 - Disabling the MOTD code and SFTP-SERVER may save a small amount of codesize |
| 26 | |
| 27 - You can disable x11, tcp and agent forwarding as desired. None of these are | |
| 28 essential, although agent-forwarding is often useful even on firewall boxes. | |
| 29 | |
| 30 --- | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
31 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
32 If you are compiling statically, you may want to disable zlib, as it will use |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
33 a few tens of kB of binary-size (./configure --disable-zlib). |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
34 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
35 You can create a combined binary, see the file MULTI, which will put all |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
36 the functions into one binary, avoiding repeated code. |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
37 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
38 If you're compiling with gcc, you might want to look at gcc's options for |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
39 stripping unused code. The relevant vars to set before configure are: |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
40 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
41 LDFLAGS=-Wl,--gc-sections |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
42 CFLAGS="-ffunction-sections -fdata-sections" |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
43 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
44 You can also experiment with optimisation flags such as -Os, note that in some |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
45 cases these flags actually seem to increase size, so experiment before |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
46 deciding. |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
47 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
48 Of course using small C libraries such as uClibc and dietlibc can also help. |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
49 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
50 If you have any queries, mail me and I'll see if I can help. |