Mercurial > dropbear

comparison default_options.h @ 1521:198e2ee0f4b1

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
- Fix dependencies and remove old default_options.h from version control - Rename default_options.h.in -> default_options.h, and default_options.h -> default_options_guard.h - Fix newlines in default_options.h
author Matt Johnston <matt@ucc.asn.au>
date Mon, 19 Feb 2018 22:16:50 +0800
parents default_options.h.in@7c7c5326ad73
children 1d163552145f 940828026f28
comparison
equal deleted inserted replaced
1520:84578193ef47 1521:198e2ee0f4b1
1 /*
2 > > > Do not edit this file (default_options.h) < < <
3 Generated from ../default_options.h.in
4 Local customisation goes in localoptions.h
5 */
6
7
8 #ifndef DROPBEAR_DEFAULT_OPTIONS_H_ 1 #ifndef DROPBEAR_DEFAULT_OPTIONS_H_
9 #define DROPBEAR_DEFAULT_OPTIONS_H_ 2 #define DROPBEAR_DEFAULT_OPTIONS_H_
10 /* 3 /*
11 > > > Read This < < < 4 > > > Read This < < <
12 5
13 default_options.h.in documents compile-time options, and provides default values. 6 default_options.h documents compile-time options, and provides default values.
14 7
15 Local customisation should be added to localoptions.h which is 8 Local customisation should be added to localoptions.h which is
16 used if it exists. Options defined there will override any options in this 9 used if it exists. Options defined there will override any options in this
17 file. 10 file.
18 11
19 Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS 12 Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS
20 13
21 IMPORTANT: Some options will require "make clean" after changes */ 14 IMPORTANT: Some options will require "make clean" after changes */
22 15
23 #ifndef DROPBEAR_DEFPORT
24 #define DROPBEAR_DEFPORT "22" 16 #define DROPBEAR_DEFPORT "22"
25 #endif
26 17
27 /* Listen on all interfaces */ 18 /* Listen on all interfaces */
28 #ifndef DROPBEAR_DEFADDRESS
29 #define DROPBEAR_DEFADDRESS "" 19 #define DROPBEAR_DEFADDRESS ""
30 #endif
31 20
32 /* Default hostkey paths - these can be specified on the command line */ 21 /* Default hostkey paths - these can be specified on the command line */
33 #ifndef DSS_PRIV_FILENAME
34 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key" 22 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
35 #endif
36 #ifndef RSA_PRIV_FILENAME
37 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key" 23 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
38 #endif
39 #ifndef ECDSA_PRIV_FILENAME
40 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key" 24 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key"
41 #endif
42 25
43 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens 26 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
44 * on chosen ports and keeps accepting connections. This is the default. 27 * on chosen ports and keeps accepting connections. This is the default.
45 * 28 *
46 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or 29 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or
48 * lasts for a single connection. Dropbear should be invoked with the -i flag 31 * lasts for a single connection. Dropbear should be invoked with the -i flag
49 * for inetd, and can only accept IPv4 connections. 32 * for inetd, and can only accept IPv4 connections.
50 * 33 *
51 * Both of these flags can be defined at once, don't compile without at least 34 * Both of these flags can be defined at once, don't compile without at least
52 * one of them. */ 35 * one of them. */
53 #ifndef NON_INETD_MODE
54 #define NON_INETD_MODE 1 36 #define NON_INETD_MODE 1
55 #endif
56 #ifndef INETD_MODE
57 #define INETD_MODE 1 37 #define INETD_MODE 1
58 #endif
59 38
60 /* Include verbose debug output, enabled with -v at runtime. 39 /* Include verbose debug output, enabled with -v at runtime.
61 * This will add a reasonable amount to your executable size. */ 40 * This will add a reasonable amount to your executable size. */
62 #ifndef DEBUG_TRACE
63 #define DEBUG_TRACE 0 41 #define DEBUG_TRACE 0
64 #endif
65 42
66 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save 43 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save
67 * several kB in binary size however will make the symmetrical ciphers and hashes 44 * several kB in binary size however will make the symmetrical ciphers and hashes
68 * slower, perhaps by 50%. Recommended for small systems that aren't doing 45 * slower, perhaps by 50%. Recommended for small systems that aren't doing
69 * much traffic. */ 46 * much traffic. */
70 #ifndef DROPBEAR_SMALL_CODE
71 #define DROPBEAR_SMALL_CODE 1 47 #define DROPBEAR_SMALL_CODE 1
72 #endif
73 48
74 /* Enable X11 Forwarding - server only */ 49 /* Enable X11 Forwarding - server only */
75 #ifndef DROPBEAR_X11FWD
76 #define DROPBEAR_X11FWD 1 50 #define DROPBEAR_X11FWD 1
77 #endif
78 51
79 /* Enable TCP Fowarding */ 52 /* Enable TCP Fowarding */
80 /* 'Local' is "-L" style (client listening port forwarded via server) 53 /* 'Local' is "-L" style (client listening port forwarded via server)
81 * 'Remote' is "-R" style (server listening port forwarded via client) */ 54 * 'Remote' is "-R" style (server listening port forwarded via client) */
82 #ifndef DROPBEAR_CLI_LOCALTCPFWD
83 #define DROPBEAR_CLI_LOCALTCPFWD 1 55 #define DROPBEAR_CLI_LOCALTCPFWD 1
84 #endif
85 #ifndef DROPBEAR_CLI_REMOTETCPFWD
86 #define DROPBEAR_CLI_REMOTETCPFWD 1 56 #define DROPBEAR_CLI_REMOTETCPFWD 1
87 #endif 57
88
89 #ifndef DROPBEAR_SVR_LOCALTCPFWD
90 #define DROPBEAR_SVR_LOCALTCPFWD 1 58 #define DROPBEAR_SVR_LOCALTCPFWD 1
91 #endif
92 #ifndef DROPBEAR_SVR_REMOTETCPFWD
93 #define DROPBEAR_SVR_REMOTETCPFWD 1 59 #define DROPBEAR_SVR_REMOTETCPFWD 1
94 #endif
95 60
96 /* Enable Authentication Agent Forwarding */ 61 /* Enable Authentication Agent Forwarding */
97 #ifndef DROPBEAR_SVR_AGENTFWD
98 #define DROPBEAR_SVR_AGENTFWD 1 62 #define DROPBEAR_SVR_AGENTFWD 1
99 #endif
100 #ifndef DROPBEAR_CLI_AGENTFWD
101 #define DROPBEAR_CLI_AGENTFWD 1 63 #define DROPBEAR_CLI_AGENTFWD 1
102 #endif
103 64
104 /* Note: Both DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_NETCAT must be set to 65 /* Note: Both DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_NETCAT must be set to
105 * allow multihop dbclient connections */ 66 * allow multihop dbclient connections */
106 67
107 /* Allow using -J <proxycommand> to run the connection through a 68 /* Allow using -J <proxycommand> to run the connection through a
108 pipe to a program, rather the normal TCP connection */ 69 pipe to a program, rather the normal TCP connection */
109 #ifndef DROPBEAR_CLI_PROXYCMD
110 #define DROPBEAR_CLI_PROXYCMD 1 70 #define DROPBEAR_CLI_PROXYCMD 1
111 #endif
112 71
113 /* Enable "Netcat mode" option. This will forward standard input/output 72 /* Enable "Netcat mode" option. This will forward standard input/output
114 * to a remote TCP-forwarded connection */ 73 * to a remote TCP-forwarded connection */
115 #ifndef DROPBEAR_CLI_NETCAT
116 #define DROPBEAR_CLI_NETCAT 1 74 #define DROPBEAR_CLI_NETCAT 1
117 #endif
118 75
119 /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */ 76 /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
120 #ifndef DROPBEAR_USER_ALGO_LIST
121 #define DROPBEAR_USER_ALGO_LIST 1 77 #define DROPBEAR_USER_ALGO_LIST 1
122 #endif
123 78
124 /* Encryption - at least one required. 79 /* Encryption - at least one required.
125 * AES128 should be enabled, some very old implementations might only 80 * AES128 should be enabled, some very old implementations might only
126 * support 3DES. 81 * support 3DES.
127 * Including both AES keysize variants (128 and 256) will result in 82 * Including both AES keysize variants (128 and 256) will result in
128 * a minimal size increase */ 83 * a minimal size increase */
129 #ifndef DROPBEAR_AES128
130 #define DROPBEAR_AES128 1 84 #define DROPBEAR_AES128 1
131 #endif
132 #ifndef DROPBEAR_3DES
133 #define DROPBEAR_3DES 1 85 #define DROPBEAR_3DES 1
134 #endif
135 #ifndef DROPBEAR_AES256
136 #define DROPBEAR_AES256 1 86 #define DROPBEAR_AES256 1
137 #endif
138 #ifndef DROPBEAR_TWOFISH256
139 #define DROPBEAR_TWOFISH256 0 87 #define DROPBEAR_TWOFISH256 0
140 #endif
141 #ifndef DROPBEAR_TWOFISH128
142 #define DROPBEAR_TWOFISH128 0 88 #define DROPBEAR_TWOFISH128 0
143 #endif
144 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ 89 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
145 #ifndef DROPBEAR_BLOWFISH
146 #define DROPBEAR_BLOWFISH 0 90 #define DROPBEAR_BLOWFISH 0
147 #endif
148 91
149 /* Enable CBC mode for ciphers. This has security issues though 92 /* Enable CBC mode for ciphers. This has security issues though
150 * is the most compatible with older SSH implementations */ 93 * is the most compatible with older SSH implementations */
151 #ifndef DROPBEAR_ENABLE_CBC_MODE
152 #define DROPBEAR_ENABLE_CBC_MODE 1 94 #define DROPBEAR_ENABLE_CBC_MODE 1
153 #endif
154 95
155 /* Enable "Counter Mode" for ciphers. This is more secure than 96 /* Enable "Counter Mode" for ciphers. This is more secure than
156 * CBC mode against certain attacks. It is recommended for security 97 * CBC mode against certain attacks. It is recommended for security
157 * and forwards compatibility */ 98 * and forwards compatibility */
158 #ifndef DROPBEAR_ENABLE_CTR_MODE
159 #define DROPBEAR_ENABLE_CTR_MODE 1 99 #define DROPBEAR_ENABLE_CTR_MODE 1
160 #endif
161 100
162 /* Message integrity. sha2-256 is recommended as a default, 101 /* Message integrity. sha2-256 is recommended as a default,
163 sha1 for compatibility */ 102 sha1 for compatibility */
164 #ifndef DROPBEAR_SHA1_HMAC
165 #define DROPBEAR_SHA1_HMAC 1 103 #define DROPBEAR_SHA1_HMAC 1
166 #endif
167 #ifndef DROPBEAR_SHA1_96_HMAC
168 #define DROPBEAR_SHA1_96_HMAC 1 104 #define DROPBEAR_SHA1_96_HMAC 1
169 #endif
170 #ifndef DROPBEAR_SHA2_256_HMAC
171 #define DROPBEAR_SHA2_256_HMAC 1 105 #define DROPBEAR_SHA2_256_HMAC 1
172 #endif
173 106
174 /* Hostkey/public key algorithms - at least one required, these are used 107 /* Hostkey/public key algorithms - at least one required, these are used
175 * for hostkey as well as for verifying signatures with pubkey auth. 108 * for hostkey as well as for verifying signatures with pubkey auth.
176 * Removing either of these won't save very much space. 109 * Removing either of these won't save very much space.
177 * RSA is recommended 110 * RSA is recommended
178 * DSS may be necessary to connect to some systems though 111 * DSS may be necessary to connect to some systems though
179 is not recommended for new keys */ 112 is not recommended for new keys */
180 #ifndef DROPBEAR_RSA
181 #define DROPBEAR_RSA 1 113 #define DROPBEAR_RSA 1
182 #endif
183 #ifndef DROPBEAR_DSS
184 #define DROPBEAR_DSS 1 114 #define DROPBEAR_DSS 1
185 #endif
186 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC 115 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
187 * code (either ECDSA or ECDH) increases binary size - around 30kB 116 * code (either ECDSA or ECDH) increases binary size - around 30kB
188 * on x86-64 */ 117 * on x86-64 */
189 #ifndef DROPBEAR_ECDSA
190 #define DROPBEAR_ECDSA 1 118 #define DROPBEAR_ECDSA 1
191 #endif
192 119
193 /* RSA must be >=1024 */ 120 /* RSA must be >=1024 */
194 #ifndef DROPBEAR_DEFAULT_RSA_SIZE
195 #define DROPBEAR_DEFAULT_RSA_SIZE 2048 121 #define DROPBEAR_DEFAULT_RSA_SIZE 2048
196 #endif
197 /* DSS is always 1024 */ 122 /* DSS is always 1024 */
198 /* ECDSA defaults to largest size configured, usually 521 */ 123 /* ECDSA defaults to largest size configured, usually 521 */
199 124
200 /* Add runtime flag "-R" to generate hostkeys as-needed when the first 125 /* Add runtime flag "-R" to generate hostkeys as-needed when the first
201 connection using that key type occurs. 126 connection using that key type occurs.
202 This avoids the need to otherwise run "dropbearkey" and avoids some problems 127 This avoids the need to otherwise run "dropbearkey" and avoids some problems
203 with badly seeded /dev/urandom when systems first boot. */ 128 with badly seeded /dev/urandom when systems first boot. */
204 #ifndef DROPBEAR_DELAY_HOSTKEY
205 #define DROPBEAR_DELAY_HOSTKEY 1 129 #define DROPBEAR_DELAY_HOSTKEY 1
206 #endif
207 130
208 131
209 /* Key exchange algorithm. 132 /* Key exchange algorithm.
210 133
211 * group14_sha1 - 2048 bit, sha1 134 * group14_sha1 - 2048 bit, sha1
224 * including either ECDH or ECDSA increases binary size by ~30kB on x86-64 147 * including either ECDH or ECDSA increases binary size by ~30kB on x86-64
225 148
226 * Small systems should generally include either curve25519 or ecdh for performance. 149 * Small systems should generally include either curve25519 or ecdh for performance.
227 * curve25519 is less widely supported but is faster 150 * curve25519 is less widely supported but is faster
228 */ 151 */
229 #ifndef DROPBEAR_DH_GROUP1
230 #define DROPBEAR_DH_GROUP1 1 152 #define DROPBEAR_DH_GROUP1 1
231 #endif
232 #ifndef DROPBEAR_DH_GROUP14_SHA1
233 #define DROPBEAR_DH_GROUP14_SHA1 1 153 #define DROPBEAR_DH_GROUP14_SHA1 1
234 #endif
235 #ifndef DROPBEAR_DH_GROUP14_SHA256
236 #define DROPBEAR_DH_GROUP14_SHA256 1 154 #define DROPBEAR_DH_GROUP14_SHA256 1
237 #endif
238 #ifndef DROPBEAR_DH_GROUP16
239 #define DROPBEAR_DH_GROUP16 0 155 #define DROPBEAR_DH_GROUP16 0
240 #endif
241 #ifndef DROPBEAR_CURVE25519
242 #define DROPBEAR_CURVE25519 1 156 #define DROPBEAR_CURVE25519 1
243 #endif
244 #ifndef DROPBEAR_ECDH
245 #define DROPBEAR_ECDH 1 157 #define DROPBEAR_ECDH 1
246 #endif
247 158
248 /* Control the memory/performance/compression tradeoff for zlib. 159 /* Control the memory/performance/compression tradeoff for zlib.
249 * Set windowBits=8 for least memory usage, see your system's 160 * Set windowBits=8 for least memory usage, see your system's
250 * zlib.h for full details. 161 * zlib.h for full details.
251 * Default settings (windowBits=15) will use 256kB for compression 162 * Default settings (windowBits=15) will use 256kB for compression
252 * windowBits=8 will use 129kB for compression. 163 * windowBits=8 will use 129kB for compression.
253 * Both modes will use ~35kB for decompression (using windowBits=15 for 164 * Both modes will use ~35kB for decompression (using windowBits=15 for
254 * interoperability) */ 165 * interoperability) */
255 #ifndef DROPBEAR_ZLIB_WINDOW_BITS
256 #define DROPBEAR_ZLIB_WINDOW_BITS 15 166 #define DROPBEAR_ZLIB_WINDOW_BITS 15
257 #endif
258 167
259 /* Whether to do reverse DNS lookups. */ 168 /* Whether to do reverse DNS lookups. */
260 #ifndef DO_HOST_LOOKUP
261 #define DO_HOST_LOOKUP 0 169 #define DO_HOST_LOOKUP 0
262 #endif
263 170
264 /* Whether to print the message of the day (MOTD). */ 171 /* Whether to print the message of the day (MOTD). */
265 #ifndef DO_MOTD
266 #define DO_MOTD 0 172 #define DO_MOTD 0
267 #endif
268 #ifndef MOTD_FILENAME
269 #define MOTD_FILENAME "/etc/motd" 173 #define MOTD_FILENAME "/etc/motd"
270 #endif
271 174
272 /* Authentication Types - at least one required. 175 /* Authentication Types - at least one required.
273 RFC Draft requires pubkey auth, and recommends password */ 176 RFC Draft requires pubkey auth, and recommends password */
274 #ifndef DROPBEAR_SVR_PASSWORD_AUTH
275 #define DROPBEAR_SVR_PASSWORD_AUTH 1 177 #define DROPBEAR_SVR_PASSWORD_AUTH 1
276 #endif
277 178
278 /* Note: PAM auth is quite simple and only works for PAM modules which just do 179 /* Note: PAM auth is quite simple and only works for PAM modules which just do
279 * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c). 180 * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c).
280 * It's useful for systems like OS X where standard password crypts don't work 181 * It's useful for systems like OS X where standard password crypts don't work
281 * but there's an interface via a PAM module. It won't work for more complex 182 * but there's an interface via a PAM module. It won't work for more complex
282 * PAM challenge/response. 183 * PAM challenge/response.
283 * You can't enable both PASSWORD and PAM. */ 184 * You can't enable both PASSWORD and PAM. */
284 #ifndef DROPBEAR_SVR_PAM_AUTH
285 #define DROPBEAR_SVR_PAM_AUTH 0 185 #define DROPBEAR_SVR_PAM_AUTH 0
286 #endif
287 186
288 /* ~/.ssh/authorized_keys authentication */ 187 /* ~/.ssh/authorized_keys authentication */
289 #ifndef DROPBEAR_SVR_PUBKEY_AUTH
290 #define DROPBEAR_SVR_PUBKEY_AUTH 1 188 #define DROPBEAR_SVR_PUBKEY_AUTH 1
291 #endif
292 189
293 /* Whether to take public key options in 190 /* Whether to take public key options in
294 * authorized_keys file into account */ 191 * authorized_keys file into account */
295 #ifndef DROPBEAR_SVR_PUBKEY_OPTIONS
296 #define DROPBEAR_SVR_PUBKEY_OPTIONS 1 192 #define DROPBEAR_SVR_PUBKEY_OPTIONS 1
297 #endif
298 193
299 /* Client authentication options */ 194 /* Client authentication options */
300 #ifndef DROPBEAR_CLI_PASSWORD_AUTH
301 #define DROPBEAR_CLI_PASSWORD_AUTH 1 195 #define DROPBEAR_CLI_PASSWORD_AUTH 1
302 #endif
303 #ifndef DROPBEAR_CLI_PUBKEY_AUTH
304 #define DROPBEAR_CLI_PUBKEY_AUTH 1 196 #define DROPBEAR_CLI_PUBKEY_AUTH 1
305 #endif
306 197
307 /* A default argument for dbclient -i <privatekey>. 198 /* A default argument for dbclient -i <privatekey>.
308 Homedir is prepended unless path begins with / */ 199 Homedir is prepended unless path begins with / */
309 #ifndef DROPBEAR_DEFAULT_CLI_AUTHKEY
310 #define DROPBEAR_DEFAULT_CLI_AUTHKEY ".ssh/id_dropbear" 200 #define DROPBEAR_DEFAULT_CLI_AUTHKEY ".ssh/id_dropbear"
311 #endif
312 201
313 /* Allow specifying the password for dbclient via the DROPBEAR_PASSWORD 202 /* Allow specifying the password for dbclient via the DROPBEAR_PASSWORD
314 * environment variable. */ 203 * environment variable. */
315 #ifndef DROPBEAR_USE_PASSWORD_ENV
316 #define DROPBEAR_USE_PASSWORD_ENV 1 204 #define DROPBEAR_USE_PASSWORD_ENV 1
317 #endif
318 205
319 /* Define this (as well as DROPBEAR_CLI_PASSWORD_AUTH) to allow the use of 206 /* Define this (as well as DROPBEAR_CLI_PASSWORD_AUTH) to allow the use of
320 * a helper program for the ssh client. The helper program should be 207 * a helper program for the ssh client. The helper program should be
321 * specified in the SSH_ASKPASS environment variable, and dbclient 208 * specified in the SSH_ASKPASS environment variable, and dbclient
322 * should be run with DISPLAY set and no tty. The program should 209 * should be run with DISPLAY set and no tty. The program should
323 * return the password on standard output */ 210 * return the password on standard output */
324 #ifndef DROPBEAR_CLI_ASKPASS_HELPER
325 #define DROPBEAR_CLI_ASKPASS_HELPER 0 211 #define DROPBEAR_CLI_ASKPASS_HELPER 0
326 #endif
327 212
328 /* Save a network roundtrip by sendng a real auth request immediately after 213 /* Save a network roundtrip by sendng a real auth request immediately after
329 * sending a query for the available methods. This is not yet enabled by default 214 * sending a query for the available methods. This is not yet enabled by default
330 since it could cause problems with non-compliant servers */ 215 since it could cause problems with non-compliant servers */
331 #ifndef DROPBEAR_CLI_IMMEDIATE_AUTH
332 #define DROPBEAR_CLI_IMMEDIATE_AUTH 0 216 #define DROPBEAR_CLI_IMMEDIATE_AUTH 0
333 #endif
334 217
335 /* Set this to use PRNGD or EGD instead of /dev/urandom */ 218 /* Set this to use PRNGD or EGD instead of /dev/urandom */
336 #ifndef DROPBEAR_USE_PRNGD
337 #define DROPBEAR_USE_PRNGD 0 219 #define DROPBEAR_USE_PRNGD 0
338 #endif
339 #ifndef DROPBEAR_PRNGD_SOCKET
340 #define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng" 220 #define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"
341 #endif
342 221
343 /* Specify the number of clients we will allow to be connected but 222 /* Specify the number of clients we will allow to be connected but
344 * not yet authenticated. After this limit, connections are rejected */ 223 * not yet authenticated. After this limit, connections are rejected */
345 /* The first setting is per-IP, to avoid denial of service */ 224 /* The first setting is per-IP, to avoid denial of service */
346 #ifndef MAX_UNAUTH_PER_IP
347 #define MAX_UNAUTH_PER_IP 5 225 #define MAX_UNAUTH_PER_IP 5
348 #endif
349 226
350 /* And then a global limit to avoid chewing memory if connections 227 /* And then a global limit to avoid chewing memory if connections
351 * come from many IPs */ 228 * come from many IPs */
352 #ifndef MAX_UNAUTH_CLIENTS
353 #define MAX_UNAUTH_CLIENTS 30 229 #define MAX_UNAUTH_CLIENTS 30
354 #endif
355 230
356 /* Default maximum number of failed authentication tries (server option) */ 231 /* Default maximum number of failed authentication tries (server option) */
357 /* -T server option overrides */ 232 /* -T server option overrides */
358 #ifndef MAX_AUTH_TRIES
359 #define MAX_AUTH_TRIES 10 233 #define MAX_AUTH_TRIES 10
360 #endif
361 234
362 /* The default file to store the daemon's process ID, for shutdown 235 /* The default file to store the daemon's process ID, for shutdown
363 scripts etc. This can be overridden with the -P flag */ 236 scripts etc. This can be overridden with the -P flag */
364 #ifndef DROPBEAR_PIDFILE
365 #define DROPBEAR_PIDFILE "/var/run/dropbear.pid" 237 #define DROPBEAR_PIDFILE "/var/run/dropbear.pid"
366 #endif
367 238
368 /* The command to invoke for xauth when using X11 forwarding. 239 /* The command to invoke for xauth when using X11 forwarding.
369 * "-q" for quiet */ 240 * "-q" for quiet */
370 #ifndef XAUTH_COMMAND
371 #define XAUTH_COMMAND "/usr/bin/xauth -q" 241 #define XAUTH_COMMAND "/usr/bin/xauth -q"
372 #endif
373 242
374 243
375 /* if you want to enable running an sftp server (such as the one included with 244 /* if you want to enable running an sftp server (such as the one included with
376 * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER. 245 * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER.
377 * The sftp-server program is not provided by Dropbear itself */ 246 * The sftp-server program is not provided by Dropbear itself */
378 #ifndef DROPBEAR_SFTPSERVER
379 #define DROPBEAR_SFTPSERVER 1 247 #define DROPBEAR_SFTPSERVER 1
380 #endif
381 #ifndef SFTPSERVER_PATH
382 #define SFTPSERVER_PATH "/usr/libexec/sftp-server" 248 #define SFTPSERVER_PATH "/usr/libexec/sftp-server"
383 #endif
384 249
385 /* This is used by the scp binary when used as a client binary. If you're 250 /* This is used by the scp binary when used as a client binary. If you're
386 * not using the Dropbear client, you'll need to change it */ 251 * not using the Dropbear client, you'll need to change it */
387 #ifndef DROPBEAR_PATH_SSH_PROGRAM
388 #define DROPBEAR_PATH_SSH_PROGRAM "/usr/bin/dbclient" 252 #define DROPBEAR_PATH_SSH_PROGRAM "/usr/bin/dbclient"
389 #endif
390 253
391 /* Whether to log commands executed by a client. This only logs the 254 /* Whether to log commands executed by a client. This only logs the
392 * (single) command sent to the server, not what a user did in a 255 * (single) command sent to the server, not what a user did in a
393 * shell/sftp session etc. */ 256 * shell/sftp session etc. */
394 #ifndef LOG_COMMANDS
395 #define LOG_COMMANDS 0 257 #define LOG_COMMANDS 0
396 #endif
397 258
398 /* Window size limits. These tend to be a trade-off between memory 259 /* Window size limits. These tend to be a trade-off between memory
399 usage and network performance: */ 260 usage and network performance: */
400 /* Size of the network receive window. This amount of memory is allocated 261 /* Size of the network receive window. This amount of memory is allocated
401 as a per-channel receive buffer. Increasing this value can make a 262 as a per-channel receive buffer. Increasing this value can make a
402 significant difference to network performance. 24kB was empirically 263 significant difference to network performance. 24kB was empirically
403 chosen for a 100mbit ethernet network. The value can be altered at 264 chosen for a 100mbit ethernet network. The value can be altered at
404 runtime with the -W argument. */ 265 runtime with the -W argument. */
405 #ifndef DEFAULT_RECV_WINDOW
406 #define DEFAULT_RECV_WINDOW 24576 266 #define DEFAULT_RECV_WINDOW 24576
407 #endif
408 /* Maximum size of a received SSH data packet - this _MUST_ be >= 32768 267 /* Maximum size of a received SSH data packet - this _MUST_ be >= 32768
409 in order to interoperate with other implementations */ 268 in order to interoperate with other implementations */
410 #ifndef RECV_MAX_PAYLOAD_LEN
411 #define RECV_MAX_PAYLOAD_LEN 32768 269 #define RECV_MAX_PAYLOAD_LEN 32768
412 #endif
413 /* Maximum size of a transmitted data packet - this can be any value, 270 /* Maximum size of a transmitted data packet - this can be any value,
414 though increasing it may not make a significant difference. */ 271 though increasing it may not make a significant difference. */
415 #ifndef TRANS_MAX_PAYLOAD_LEN
416 #define TRANS_MAX_PAYLOAD_LEN 16384 272 #define TRANS_MAX_PAYLOAD_LEN 16384
417 #endif
418 273
419 /* Ensure that data is transmitted every KEEPALIVE seconds. This can 274 /* Ensure that data is transmitted every KEEPALIVE seconds. This can
420 be overridden at runtime with -K. 0 disables keepalives */ 275 be overridden at runtime with -K. 0 disables keepalives */
421 #ifndef DEFAULT_KEEPALIVE
422 #define DEFAULT_KEEPALIVE 0 276 #define DEFAULT_KEEPALIVE 0
423 #endif
424 277
425 /* If this many KEEPALIVES are sent with no packets received from the 278 /* If this many KEEPALIVES are sent with no packets received from the
426 other side, exit. Not run-time configurable - if you have a need 279 other side, exit. Not run-time configurable - if you have a need
427 for runtime configuration please mail the Dropbear list */ 280 for runtime configuration please mail the Dropbear list */
428 #ifndef DEFAULT_KEEPALIVE_LIMIT
429 #define DEFAULT_KEEPALIVE_LIMIT 3 281 #define DEFAULT_KEEPALIVE_LIMIT 3
430 #endif
431 282
432 /* Ensure that data is received within IDLE_TIMEOUT seconds. This can 283 /* Ensure that data is received within IDLE_TIMEOUT seconds. This can
433 be overridden at runtime with -I. 0 disables idle timeouts */ 284 be overridden at runtime with -I. 0 disables idle timeouts */
434 #ifndef DEFAULT_IDLE_TIMEOUT
435 #define DEFAULT_IDLE_TIMEOUT 0 285 #define DEFAULT_IDLE_TIMEOUT 0
436 #endif
437 286
438 /* The default path. This will often get replaced by the shell */ 287 /* The default path. This will often get replaced by the shell */
439 #ifndef DEFAULT_PATH
440 #define DEFAULT_PATH "/usr/bin:/bin" 288 #define DEFAULT_PATH "/usr/bin:/bin"
441 #endif
442 289
443 #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */ 290 #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */