Mercurial > dropbear
annotate SMALL @ 675:dfdb9d9189ff
Server shouldn't return "localhost" in response to -R forward connections
if that wasn't what the client requested.
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Wed, 09 May 2012 21:09:34 +0800 |
| parents | b9d3f725e00b |
| children | 13cb8cc1b0e4 |
| rev | line source |
|---|---|
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
1 Tips for a small system: |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
2 |
| 161 | 3 If you only want server functionality (for example), compile with |
| 4 make PROGRAMS=dropbear | |
| 5 rather than just | |
| 6 make dropbear | |
| 7 so that client functionality in shared portions of Dropbear won't be included. | |
| 8 The same applies if you are compiling just a client. | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
9 |
| 161 | 10 --- |
| 11 | |
| 12 The following are set in options.h: | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
13 |
| 161 | 14 - You can safely disable blowfish and twofish ciphers, and MD5 hmac, without |
| 15 affecting interoperability | |
| 16 | |
| 17 - If you're compiling statically, you can turn off host lookups | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
18 |
| 161 | 19 - You can disable either password or public-key authentication, though note |
| 20 that the IETF draft states that pubkey authentication is required. | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
21 |
| 161 | 22 - Similarly with DSS and RSA, you can disable one of these if you know that |
| 23 all clients will be able to support a particular one. The IETF draft | |
| 24 states that DSS is required, however you may prefer to use RSA. | |
| 25 DON'T disable either of these on systems where you aren't 100% sure about | |
| 26 who will be connecting and what clients they will be using. | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
27 |
| 161 | 28 - Disabling the MOTD code and SFTP-SERVER may save a small amount of codesize |
| 29 | |
| 30 - You can disable x11, tcp and agent forwarding as desired. None of these are | |
| 31 essential, although agent-forwarding is often useful even on firewall boxes. | |
| 32 | |
| 33 --- | |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
34 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
35 If you are compiling statically, you may want to disable zlib, as it will use |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
36 a few tens of kB of binary-size (./configure --disable-zlib). |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
37 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
38 You can create a combined binary, see the file MULTI, which will put all |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
39 the functions into one binary, avoiding repeated code. |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
40 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
41 If you're compiling with gcc, you might want to look at gcc's options for |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
42 stripping unused code. The relevant vars to set before configure are: |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
43 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
44 LDFLAGS=-Wl,--gc-sections |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
45 CFLAGS="-ffunction-sections -fdata-sections" |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
46 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
47 You can also experiment with optimisation flags such as -Os, note that in some |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
48 cases these flags actually seem to increase size, so experiment before |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
49 deciding. |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
50 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
51 Of course using small C libraries such as uClibc and dietlibc can also help. |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
52 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
53 If you have any queries, mail me and I'll see if I can help. |