Mercurial > dropbear

comparison default_options.h @ 1523:1d163552145f coverity

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
merge coverity
author Matt Johnston <matt@ucc.asn.au>
date Mon, 19 Feb 2018 23:14:49 +0800
parents 1ea92dd2ca5f 198e2ee0f4b1
children 0b991dec7ab9
comparison
equal deleted inserted replaced
1510:eb4c7052f51d 1523:1d163552145f
1 /*
2 > > > Do not edit this file (default_options.h) < < <
3 Generated from ../default_options.h.in
4 Local customisation goes in localoptions.h
5 */
6
7
8 #ifndef DROPBEAR_DEFAULT_OPTIONS_H_ 1 #ifndef DROPBEAR_DEFAULT_OPTIONS_H_
9 #define DROPBEAR_DEFAULT_OPTIONS_H_ 2 #define DROPBEAR_DEFAULT_OPTIONS_H_
10 /* 3 /*
11 > > > Read This < < < 4 > > > Read This < < <
12 5
13 default_options.h.in documents compile-time options, and provides default values. 6 default_options.h documents compile-time options, and provides default values.
14 7
15 Local customisation should be added to localoptions.h which is 8 Local customisation should be added to localoptions.h which is
16 used if it exists. Options defined there will override any options in this 9 used if it exists. Options defined there will override any options in this
17 file. 10 file.
18 11
19 Options can also be defined with -DDROPBEAR_XXX in Makefile CFLAGS 12 Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS
20 13
21 IMPORTANT: Many options will require "make clean" after changes */ 14 IMPORTANT: Some options will require "make clean" after changes */
22 15
23 #ifndef DROPBEAR_DEFPORT
24 #define DROPBEAR_DEFPORT "22" 16 #define DROPBEAR_DEFPORT "22"
25 #endif
26 17
27 /* Listen on all interfaces */ 18 /* Listen on all interfaces */
28 #ifndef DROPBEAR_DEFADDRESS
29 #define DROPBEAR_DEFADDRESS "" 19 #define DROPBEAR_DEFADDRESS ""
30 #endif
31 20
32 /* Default hostkey paths - these can be specified on the command line */ 21 /* Default hostkey paths - these can be specified on the command line */
33 #ifndef DSS_PRIV_FILENAME
34 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key" 22 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
35 #endif
36 #ifndef RSA_PRIV_FILENAME
37 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key" 23 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
38 #endif
39 #ifndef ECDSA_PRIV_FILENAME
40 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key" 24 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key"
41 #endif
42 25
43 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens 26 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
44 * on chosen ports and keeps accepting connections. This is the default. 27 * on chosen ports and keeps accepting connections. This is the default.
45 * 28 *
46 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or 29 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or
48 * lasts for a single connection. Dropbear should be invoked with the -i flag 31 * lasts for a single connection. Dropbear should be invoked with the -i flag
49 * for inetd, and can only accept IPv4 connections. 32 * for inetd, and can only accept IPv4 connections.
50 * 33 *
51 * Both of these flags can be defined at once, don't compile without at least 34 * Both of these flags can be defined at once, don't compile without at least
52 * one of them. */ 35 * one of them. */
53 #ifndef NON_INETD_MODE
54 #define NON_INETD_MODE 1 36 #define NON_INETD_MODE 1
55 #endif
56 #ifndef INETD_MODE
57 #define INETD_MODE 1 37 #define INETD_MODE 1
58 #endif 38
59 39 /* Include verbose debug output, enabled with -v at runtime.
60 /* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is 40 * This will add a reasonable amount to your executable size. */
61 * perhaps 20% slower for pubkey operations (it is probably worth experimenting 41 #define DEBUG_TRACE 0
62 * if you want to use this) */
63 /*#define NO_FAST_EXPTMOD*/
64 42
65 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save 43 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save
66 several kB in binary size however will make the symmetrical ciphers and hashes 44 * several kB in binary size however will make the symmetrical ciphers and hashes
67 slower, perhaps by 50%. Recommended for small systems that aren't doing 45 * slower, perhaps by 50%. Recommended for small systems that aren't doing
68 much traffic. */ 46 * much traffic. */
69 #ifndef DROPBEAR_SMALL_CODE
70 #define DROPBEAR_SMALL_CODE 1 47 #define DROPBEAR_SMALL_CODE 1
71 #endif
72 48
73 /* Enable X11 Forwarding - server only */ 49 /* Enable X11 Forwarding - server only */
74 #ifndef DROPBEAR_X11FWD
75 #define DROPBEAR_X11FWD 1 50 #define DROPBEAR_X11FWD 1
76 #endif
77 51
78 /* Enable TCP Fowarding */ 52 /* Enable TCP Fowarding */
79 /* 'Local' is "-L" style (client listening port forwarded via server) 53 /* 'Local' is "-L" style (client listening port forwarded via server)
80 * 'Remote' is "-R" style (server listening port forwarded via client) */ 54 * 'Remote' is "-R" style (server listening port forwarded via client) */
81
82 #ifndef DROPBEAR_CLI_LOCALTCPFWD
83 #define DROPBEAR_CLI_LOCALTCPFWD 1 55 #define DROPBEAR_CLI_LOCALTCPFWD 1
84 #endif
85 #ifndef DROPBEAR_CLI_REMOTETCPFWD
86 #define DROPBEAR_CLI_REMOTETCPFWD 1 56 #define DROPBEAR_CLI_REMOTETCPFWD 1
87 #endif 57
88
89 #ifndef DROPBEAR_SVR_LOCALTCPFWD
90 #define DROPBEAR_SVR_LOCALTCPFWD 1 58 #define DROPBEAR_SVR_LOCALTCPFWD 1
91 #endif
92 #ifndef DROPBEAR_SVR_REMOTETCPFWD
93 #define DROPBEAR_SVR_REMOTETCPFWD 1 59 #define DROPBEAR_SVR_REMOTETCPFWD 1
94 #endif
95 60
96 /* Enable Authentication Agent Forwarding */ 61 /* Enable Authentication Agent Forwarding */
97 #ifndef DROPBEAR_SVR_AGENTFWD
98 #define DROPBEAR_SVR_AGENTFWD 1 62 #define DROPBEAR_SVR_AGENTFWD 1
99 #endif
100 #ifndef DROPBEAR_CLI_AGENTFWD
101 #define DROPBEAR_CLI_AGENTFWD 1 63 #define DROPBEAR_CLI_AGENTFWD 1
102 #endif
103
104 64
105 /* Note: Both DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_NETCAT must be set to 65 /* Note: Both DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_NETCAT must be set to
106 * allow multihop dbclient connections */ 66 * allow multihop dbclient connections */
107 67
108 /* Allow using -J <proxycommand> to run the connection through a 68 /* Allow using -J <proxycommand> to run the connection through a
109 pipe to a program, rather the normal TCP connection */ 69 pipe to a program, rather the normal TCP connection */
110 #ifndef DROPBEAR_CLI_PROXYCMD
111 #define DROPBEAR_CLI_PROXYCMD 1 70 #define DROPBEAR_CLI_PROXYCMD 1
112 #endif
113 71
114 /* Enable "Netcat mode" option. This will forward standard input/output 72 /* Enable "Netcat mode" option. This will forward standard input/output
115 * to a remote TCP-forwarded connection */ 73 * to a remote TCP-forwarded connection */
116 #ifndef DROPBEAR_CLI_NETCAT
117 #define DROPBEAR_CLI_NETCAT 1 74 #define DROPBEAR_CLI_NETCAT 1
118 #endif
119 75
120 /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */ 76 /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
121 #ifndef ENABLE_USER_ALGO_LIST 77 #define DROPBEAR_USER_ALGO_LIST 1
122 #define ENABLE_USER_ALGO_LIST 1
123 #endif
124 78
125 /* Encryption - at least one required. 79 /* Encryption - at least one required.
126 * Protocol RFC requires 3DES and recommends AES128 for interoperability. 80 * AES128 should be enabled, some very old implementations might only
127 * Including multiple keysize variants the same cipher 81 * support 3DES.
128 * (eg AES256 as well as AES128) will result in a minimal size increase.*/ 82 * Including both AES keysize variants (128 and 256) will result in
129 #ifndef DROPBEAR_AES128 83 * a minimal size increase */
130 #define DROPBEAR_AES128 1 84 #define DROPBEAR_AES128 1
131 #endif
132 #ifndef DROPBEAR_3DES
133 #define DROPBEAR_3DES 1 85 #define DROPBEAR_3DES 1
134 #endif
135 #ifndef DROPBEAR_AES256
136 #define DROPBEAR_AES256 1 86 #define DROPBEAR_AES256 1
137 #endif 87 #define DROPBEAR_TWOFISH256 0
88 #define DROPBEAR_TWOFISH128 0
138 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ 89 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
139 /*#define DROPBEAR_BLOWFISH*/ 90 #define DROPBEAR_BLOWFISH 0
140 #ifndef DROPBEAR_TWOFISH256
141 #define DROPBEAR_TWOFISH256 1
142 #endif
143 #ifndef DROPBEAR_TWOFISH128
144 #define DROPBEAR_TWOFISH128 1
145 #endif
146 91
147 /* Enable CBC mode for ciphers. This has security issues though 92 /* Enable CBC mode for ciphers. This has security issues though
148 * is the most compatible with older SSH implementations */ 93 * is the most compatible with older SSH implementations */
149 #ifndef DROPBEAR_ENABLE_CBC_MODE
150 #define DROPBEAR_ENABLE_CBC_MODE 1 94 #define DROPBEAR_ENABLE_CBC_MODE 1
151 #endif 95
152 96 /* Enable "Counter Mode" for ciphers. This is more secure than
153 /* Enable "Counter Mode" for ciphers. This is more secure than normal
154 * CBC mode against certain attacks. It is recommended for security 97 * CBC mode against certain attacks. It is recommended for security
155 * and forwards compatibility */ 98 * and forwards compatibility */
156 #ifndef DROPBEAR_ENABLE_CTR_MODE
157 #define DROPBEAR_ENABLE_CTR_MODE 1 99 #define DROPBEAR_ENABLE_CTR_MODE 1
158 #endif
159
160 /* Twofish counter mode is disabled by default because it
161 has not been tested for interoperability with other SSH implementations.
162 If you test it please contact the Dropbear author */
163 #ifndef DROPBEAR_TWOFISH_CTR
164 #define DROPBEAR_TWOFISH_CTR 0
165 #endif
166 100
167 /* Message integrity. sha2-256 is recommended as a default, 101 /* Message integrity. sha2-256 is recommended as a default,
168 sha1 for compatibility */ 102 sha1 for compatibility */
169 #ifndef DROPBEAR_SHA1_HMAC
170 #define DROPBEAR_SHA1_HMAC 1 103 #define DROPBEAR_SHA1_HMAC 1
171 #endif
172 #ifndef DROPBEAR_SHA1_96_HMAC
173 #define DROPBEAR_SHA1_96_HMAC 1 104 #define DROPBEAR_SHA1_96_HMAC 1
174 #endif
175 #ifndef DROPBEAR_SHA2_256_HMAC
176 #define DROPBEAR_SHA2_256_HMAC 1 105 #define DROPBEAR_SHA2_256_HMAC 1
177 #endif
178 /* Default is to include it is sha512 is being compiled in for ECDSA */
179 #ifndef DROPBEAR_SHA2_512_HMAC
180 #define DROPBEAR_SHA2_512_HMAC (DROPBEAR_ECDSA)
181 #endif
182
183 /* XXX needed for fingerprints */
184 #ifndef DROPBEAR_MD5_HMAC
185 #define DROPBEAR_MD5_HMAC 0
186 #endif
187 106
188 /* Hostkey/public key algorithms - at least one required, these are used 107 /* Hostkey/public key algorithms - at least one required, these are used
189 * for hostkey as well as for verifying signatures with pubkey auth. 108 * for hostkey as well as for verifying signatures with pubkey auth.
190 * Removing either of these won't save very much space. 109 * Removing either of these won't save very much space.
191 * RSA is recommended 110 * RSA is recommended
192 * DSS may be necessary to connect to some systems though 111 * DSS may be necessary to connect to some systems though
193 is not recommended for new keys */ 112 is not recommended for new keys */
194 #ifndef DROPBEAR_RSA
195 #define DROPBEAR_RSA 1 113 #define DROPBEAR_RSA 1
196 #endif
197 #ifndef DROPBEAR_DSS
198 #define DROPBEAR_DSS 1 114 #define DROPBEAR_DSS 1
199 #endif
200 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC 115 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
201 * code (either ECDSA or ECDH) increases binary size - around 30kB 116 * code (either ECDSA or ECDH) increases binary size - around 30kB
202 * on x86-64 */ 117 * on x86-64 */
203 #ifndef DROPBEAR_ECDSA
204 #define DROPBEAR_ECDSA 1 118 #define DROPBEAR_ECDSA 1
205 #endif
206 119
207 /* RSA must be >=1024 */ 120 /* RSA must be >=1024 */
208 #ifndef DROPBEAR_DEFAULT_RSA_SIZE
209 #define DROPBEAR_DEFAULT_RSA_SIZE 2048 121 #define DROPBEAR_DEFAULT_RSA_SIZE 2048
210 #endif
211 /* DSS is always 1024 */ 122 /* DSS is always 1024 */
212 /* ECDSA defaults to largest size configured, usually 521 */ 123 /* ECDSA defaults to largest size configured, usually 521 */
213 124
214 /* Add runtime flag "-R" to generate hostkeys as-needed when the first 125 /* Add runtime flag "-R" to generate hostkeys as-needed when the first
215 connection using that key type occurs. 126 connection using that key type occurs.
216 This avoids the need to otherwise run "dropbearkey" and avoids some problems 127 This avoids the need to otherwise run "dropbearkey" and avoids some problems
217 with badly seeded /dev/urandom when systems first boot. */ 128 with badly seeded /dev/urandom when systems first boot. */
218 #ifndef DROPBEAR_DELAY_HOSTKEY
219 #define DROPBEAR_DELAY_HOSTKEY 1 129 #define DROPBEAR_DELAY_HOSTKEY 1
220 #endif 130
221
222 /* Enable Curve25519 for key exchange. This is another elliptic
223 * curve method with good security properties. Increases binary size
224 * by ~8kB on x86-64 */
225 #ifndef DROPBEAR_CURVE25519
226 #define DROPBEAR_CURVE25519 1
227 #endif
228
229 /* Enable elliptic curve Diffie Hellman key exchange, see note about
230 * ECDSA above */
231 #ifndef DROPBEAR_ECDH
232 #define DROPBEAR_ECDH 1
233 #endif
234 131
235 /* Key exchange algorithm. 132 /* Key exchange algorithm.
133
236 * group14_sha1 - 2048 bit, sha1 134 * group14_sha1 - 2048 bit, sha1
237 * group14_sha256 - 2048 bit, sha2-256 135 * group14_sha256 - 2048 bit, sha2-256
238 * group16 - 4096 bit, sha2-512 136 * group16 - 4096 bit, sha2-512
239 * group1 - 1024 bit, sha1 137 * group1 - 1024 bit, sha1
138 * curve25519 - elliptic curve DH
139 * ecdh - NIST elliptic curve DH (256, 384, 521)
240 * 140 *
141 * group1 is too small for security though is necessary if you need
142 compatibility with some implementations such as Dropbear versions < 0.53
241 * group14 is supported by most implementations. 143 * group14 is supported by most implementations.
242 * group16 provides a greater strength level but is slower and increases binary size 144 * group16 provides a greater strength level but is slower and increases binary size
243 * group1 is too small for security though is necessary if you need 145 * curve25519 and ecdh algorithms are faster than non-elliptic curve methods
244 compatibility with some implementations such as Dropbear versions < 0.53 146 * curve25519 increases binary size by ~8kB on x86-64
147 * including either ECDH or ECDSA increases binary size by ~30kB on x86-64
148
149 * Small systems should generally include either curve25519 or ecdh for performance.
150 * curve25519 is less widely supported but is faster
245 */ 151 */
246 #ifndef DROPBEAR_DH_GROUP1
247 #define DROPBEAR_DH_GROUP1 1 152 #define DROPBEAR_DH_GROUP1 1
248 #endif
249 #ifndef DROPBEAR_DH_GROUP14_SHA1
250 #define DROPBEAR_DH_GROUP14_SHA1 1 153 #define DROPBEAR_DH_GROUP14_SHA1 1
251 #endif
252 #ifndef DROPBEAR_DH_GROUP14_SHA256
253 #define DROPBEAR_DH_GROUP14_SHA256 1 154 #define DROPBEAR_DH_GROUP14_SHA256 1
254 #endif
255 #ifndef DROPBEAR_DH_GROUP16
256 #define DROPBEAR_DH_GROUP16 0 155 #define DROPBEAR_DH_GROUP16 0
257 #endif 156 #define DROPBEAR_CURVE25519 1
157 #define DROPBEAR_ECDH 1
258 158
259 /* Control the memory/performance/compression tradeoff for zlib. 159 /* Control the memory/performance/compression tradeoff for zlib.
260 * Set windowBits=8 for least memory usage, see your system's 160 * Set windowBits=8 for least memory usage, see your system's
261 * zlib.h for full details. 161 * zlib.h for full details.
262 * Default settings (windowBits=15) will use 256kB for compression 162 * Default settings (windowBits=15) will use 256kB for compression
263 * windowBits=8 will use 129kB for compression. 163 * windowBits=8 will use 129kB for compression.
264 * Both modes will use ~35kB for decompression (using windowBits=15 for 164 * Both modes will use ~35kB for decompression (using windowBits=15 for
265 * interoperability) */ 165 * interoperability) */
266 #ifndef DROPBEAR_ZLIB_WINDOW_BITS
267 #define DROPBEAR_ZLIB_WINDOW_BITS 15 166 #define DROPBEAR_ZLIB_WINDOW_BITS 15
268 #endif
269 167
270 /* Whether to do reverse DNS lookups. */ 168 /* Whether to do reverse DNS lookups. */
271 #ifndef DO_HOST_LOOKUP
272 #define DO_HOST_LOOKUP 0 169 #define DO_HOST_LOOKUP 0
273 #endif
274 170
275 /* Whether to print the message of the day (MOTD). */ 171 /* Whether to print the message of the day (MOTD). */
276 #ifndef DO_MOTD
277 #define DO_MOTD 0 172 #define DO_MOTD 0
278 #endif
279
280 /* The MOTD file path */
281 #ifndef MOTD_FILENAME
282 #define MOTD_FILENAME "/etc/motd" 173 #define MOTD_FILENAME "/etc/motd"
283 #endif
284 174
285 /* Authentication Types - at least one required. 175 /* Authentication Types - at least one required.
286 RFC Draft requires pubkey auth, and recommends password */ 176 RFC Draft requires pubkey auth, and recommends password */
177 #define DROPBEAR_SVR_PASSWORD_AUTH 1
287 178
288 /* Note: PAM auth is quite simple and only works for PAM modules which just do 179 /* Note: PAM auth is quite simple and only works for PAM modules which just do
289 * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c). 180 * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c).
290 * It's useful for systems like OS X where standard password crypts don't work 181 * It's useful for systems like OS X where standard password crypts don't work
291 * but there's an interface via a PAM module. It won't work for more complex 182 * but there's an interface via a PAM module. It won't work for more complex
292 * PAM challenge/response. 183 * PAM challenge/response.
293 * You can't enable both PASSWORD and PAM. */ 184 * You can't enable both PASSWORD and PAM. */
294
295 /* This requires crypt() */
296 #ifdef HAVE_CRYPT
297 #ifndef DROPBEAR_SVR_PASSWORD_AUTH
298 #define DROPBEAR_SVR_PASSWORD_AUTH 1
299 #endif
300 #else
301 #ifndef DROPBEAR_SVR_PASSWORD_AUTH
302 #define DROPBEAR_SVR_PASSWORD_AUTH 0
303 #endif
304 #endif
305 /* PAM requires ./configure --enable-pam */
306 #ifndef DROPBEAR_SVR_PAM_AUTH
307 #define DROPBEAR_SVR_PAM_AUTH 0 185 #define DROPBEAR_SVR_PAM_AUTH 0
308 #endif 186
309 #ifndef DROPBEAR_SVR_PUBKEY_AUTH 187 /* ~/.ssh/authorized_keys authentication */
310 #define DROPBEAR_SVR_PUBKEY_AUTH 1 188 #define DROPBEAR_SVR_PUBKEY_AUTH 1
311 #endif
312 189
313 /* Whether to take public key options in 190 /* Whether to take public key options in
314 * authorized_keys file into account */ 191 * authorized_keys file into account */
315 #ifndef DROPBEAR_SVR_PUBKEY_OPTIONS
316 #define DROPBEAR_SVR_PUBKEY_OPTIONS 1 192 #define DROPBEAR_SVR_PUBKEY_OPTIONS 1
317 #endif 193
318 194 /* Client authentication options */
319 /* This requires getpass. */
320 #ifdef HAVE_GETPASS
321 #ifndef DROPBEAR_CLI_PASSWORD_AUTH
322 #define DROPBEAR_CLI_PASSWORD_AUTH 1 195 #define DROPBEAR_CLI_PASSWORD_AUTH 1
323 #endif
324 #ifndef DROPBEAR_CLI_INTERACT_AUTH
325 #define DROPBEAR_CLI_INTERACT_AUTH 1
326 #endif
327 #endif
328 #ifndef DROPBEAR_CLI_PUBKEY_AUTH
329 #define DROPBEAR_CLI_PUBKEY_AUTH 1 196 #define DROPBEAR_CLI_PUBKEY_AUTH 1
330 #endif
331 197
332 /* A default argument for dbclient -i <privatekey>. 198 /* A default argument for dbclient -i <privatekey>.
333 Homedir is prepended unless path begins with / */ 199 Homedir is prepended unless path begins with / */
334 #ifndef DROPBEAR_DEFAULT_CLI_AUTHKEY
335 #define DROPBEAR_DEFAULT_CLI_AUTHKEY ".ssh/id_dropbear" 200 #define DROPBEAR_DEFAULT_CLI_AUTHKEY ".ssh/id_dropbear"
336 #endif 201
337 202 /* Allow specifying the password for dbclient via the DROPBEAR_PASSWORD
338 /* This variable can be used to set a password for client 203 * environment variable. */
339 * authentication on the commandline. Beware of platforms 204 #define DROPBEAR_USE_PASSWORD_ENV 1
340 * that don't protect environment variables of processes etc. Also
341 * note that it will be provided for all "hidden" client-interactive
342 * style prompts - if you want something more sophisticated, use
343 * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
344 #ifndef DROPBEAR_PASSWORD_ENV
345 #define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
346 #endif
347 205
348 /* Define this (as well as DROPBEAR_CLI_PASSWORD_AUTH) to allow the use of 206 /* Define this (as well as DROPBEAR_CLI_PASSWORD_AUTH) to allow the use of
349 * a helper program for the ssh client. The helper program should be 207 * a helper program for the ssh client. The helper program should be
350 * specified in the SSH_ASKPASS environment variable, and dbclient 208 * specified in the SSH_ASKPASS environment variable, and dbclient
351 * should be run with DISPLAY set and no tty. The program should 209 * should be run with DISPLAY set and no tty. The program should
352 * return the password on standard output */ 210 * return the password on standard output */
353 #ifndef DROPBEAR_CLI_ASKPASS_HELPER
354 #define DROPBEAR_CLI_ASKPASS_HELPER 0 211 #define DROPBEAR_CLI_ASKPASS_HELPER 0
355 #endif
356 212
357 /* Save a network roundtrip by sendng a real auth request immediately after 213 /* Save a network roundtrip by sendng a real auth request immediately after
358 * sending a query for the available methods. It is at the expense of < 100 214 * sending a query for the available methods. This is not yet enabled by default
359 * bytes of extra network traffic. This is not yet enabled by default since it 215 since it could cause problems with non-compliant servers */
360 * could cause problems with non-compliant servers */
361 #ifndef DROPBEAR_CLI_IMMEDIATE_AUTH
362 #define DROPBEAR_CLI_IMMEDIATE_AUTH 0 216 #define DROPBEAR_CLI_IMMEDIATE_AUTH 0
363 #endif 217
364 218 /* Set this to use PRNGD or EGD instead of /dev/urandom */
365 /* Source for randomness. This must be able to provide hundreds of bytes per SSH 219 #define DROPBEAR_USE_PRNGD 0
366 * connection without blocking. In addition /dev/random is used for seeding 220 #define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"
367 * rsa/dss key generation */
368 #ifndef DROPBEAR_URANDOM_DEV
369 #define DROPBEAR_URANDOM_DEV "/dev/urandom"
370 #endif
371
372 /* Set this to use PRNGD or EGD instead of /dev/urandom or /dev/random */
373 /*#define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"*/
374
375 221
376 /* Specify the number of clients we will allow to be connected but 222 /* Specify the number of clients we will allow to be connected but
377 * not yet authenticated. After this limit, connections are rejected */ 223 * not yet authenticated. After this limit, connections are rejected */
378 /* The first setting is per-IP, to avoid denial of service */ 224 /* The first setting is per-IP, to avoid denial of service */
379 #ifndef MAX_UNAUTH_PER_IP
380 #define MAX_UNAUTH_PER_IP 5 225 #define MAX_UNAUTH_PER_IP 5
381 #endif
382 226
383 /* And then a global limit to avoid chewing memory if connections 227 /* And then a global limit to avoid chewing memory if connections
384 * come from many IPs */ 228 * come from many IPs */
385 #ifndef MAX_UNAUTH_CLIENTS
386 #define MAX_UNAUTH_CLIENTS 30 229 #define MAX_UNAUTH_CLIENTS 30
387 #endif
388 230
389 /* Default maximum number of failed authentication tries (server option) */ 231 /* Default maximum number of failed authentication tries (server option) */
390 /* -T server option overrides */ 232 /* -T server option overrides */
391 #ifndef MAX_AUTH_TRIES
392 #define MAX_AUTH_TRIES 10 233 #define MAX_AUTH_TRIES 10
393 #endif
394 234
395 /* The default file to store the daemon's process ID, for shutdown 235 /* The default file to store the daemon's process ID, for shutdown
396 scripts etc. This can be overridden with the -P flag */ 236 scripts etc. This can be overridden with the -P flag */
397 #ifndef DROPBEAR_PIDFILE
398 #define DROPBEAR_PIDFILE "/var/run/dropbear.pid" 237 #define DROPBEAR_PIDFILE "/var/run/dropbear.pid"
399 #endif
400 238
401 /* The command to invoke for xauth when using X11 forwarding. 239 /* The command to invoke for xauth when using X11 forwarding.
402 * "-q" for quiet */ 240 * "-q" for quiet */
403 #ifndef XAUTH_COMMAND
404 #define XAUTH_COMMAND "/usr/bin/xauth -q" 241 #define XAUTH_COMMAND "/usr/bin/xauth -q"
405 #endif 242
406 243
407 /* if you want to enable running an sftp server (such as the one included with 244 /* if you want to enable running an sftp server (such as the one included with
408 * OpenSSH), set the path below. If the path isn't defined, sftp will not 245 * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER.
409 * be enabled */ 246 * The sftp-server program is not provided by Dropbear itself */
410 #ifndef SFTPSERVER_PATH 247 #define DROPBEAR_SFTPSERVER 1
411 #define SFTPSERVER_PATH "/usr/libexec/sftp-server" 248 #define SFTPSERVER_PATH "/usr/libexec/sftp-server"
412 #endif
413 249
414 /* This is used by the scp binary when used as a client binary. If you're 250 /* This is used by the scp binary when used as a client binary. If you're
415 * not using the Dropbear client, you'll need to change it */ 251 * not using the Dropbear client, you'll need to change it */
416 #ifndef DROPBEAR_PATH_SSH_PROGRAM
417 #define DROPBEAR_PATH_SSH_PROGRAM "/usr/bin/dbclient" 252 #define DROPBEAR_PATH_SSH_PROGRAM "/usr/bin/dbclient"
418 #endif
419 253
420 /* Whether to log commands executed by a client. This only logs the 254 /* Whether to log commands executed by a client. This only logs the
421 * (single) command sent to the server, not what a user did in a 255 * (single) command sent to the server, not what a user did in a
422 * shell/sftp session etc. */ 256 * shell/sftp session etc. */
423 #ifndef LOG_COMMANDS
424 #define LOG_COMMANDS 0 257 #define LOG_COMMANDS 0
425 #endif
426 258
427 /* Window size limits. These tend to be a trade-off between memory 259 /* Window size limits. These tend to be a trade-off between memory
428 usage and network performance: */ 260 usage and network performance: */
429 /* Size of the network receive window. This amount of memory is allocated 261 /* Size of the network receive window. This amount of memory is allocated
430 as a per-channel receive buffer. Increasing this value can make a 262 as a per-channel receive buffer. Increasing this value can make a
431 significant difference to network performance. 24kB was empirically 263 significant difference to network performance. 24kB was empirically
432 chosen for a 100mbit ethernet network. The value can be altered at 264 chosen for a 100mbit ethernet network. The value can be altered at
433 runtime with the -W argument. */ 265 runtime with the -W argument. */
434 #ifndef DEFAULT_RECV_WINDOW
435 #define DEFAULT_RECV_WINDOW 24576 266 #define DEFAULT_RECV_WINDOW 24576
436 #endif
437 /* Maximum size of a received SSH data packet - this _MUST_ be >= 32768 267 /* Maximum size of a received SSH data packet - this _MUST_ be >= 32768
438 in order to interoperate with other implementations */ 268 in order to interoperate with other implementations */
439 #ifndef RECV_MAX_PAYLOAD_LEN
440 #define RECV_MAX_PAYLOAD_LEN 32768 269 #define RECV_MAX_PAYLOAD_LEN 32768
441 #endif
442 /* Maximum size of a transmitted data packet - this can be any value, 270 /* Maximum size of a transmitted data packet - this can be any value,
443 though increasing it may not make a significant difference. */ 271 though increasing it may not make a significant difference. */
444 #ifndef TRANS_MAX_PAYLOAD_LEN
445 #define TRANS_MAX_PAYLOAD_LEN 16384 272 #define TRANS_MAX_PAYLOAD_LEN 16384
446 #endif
447 273
448 /* Ensure that data is transmitted every KEEPALIVE seconds. This can 274 /* Ensure that data is transmitted every KEEPALIVE seconds. This can
449 be overridden at runtime with -K. 0 disables keepalives */ 275 be overridden at runtime with -K. 0 disables keepalives */
450 #ifndef DEFAULT_KEEPALIVE
451 #define DEFAULT_KEEPALIVE 0 276 #define DEFAULT_KEEPALIVE 0
452 #endif
453 277
454 /* If this many KEEPALIVES are sent with no packets received from the 278 /* If this many KEEPALIVES are sent with no packets received from the
455 other side, exit. Not run-time configurable - if you have a need 279 other side, exit. Not run-time configurable - if you have a need
456 for runtime configuration please mail the Dropbear list */ 280 for runtime configuration please mail the Dropbear list */
457 #ifndef DEFAULT_KEEPALIVE_LIMIT
458 #define DEFAULT_KEEPALIVE_LIMIT 3 281 #define DEFAULT_KEEPALIVE_LIMIT 3
459 #endif
460 282
461 /* Ensure that data is received within IDLE_TIMEOUT seconds. This can 283 /* Ensure that data is received within IDLE_TIMEOUT seconds. This can
462 be overridden at runtime with -I. 0 disables idle timeouts */ 284 be overridden at runtime with -I. 0 disables idle timeouts */
463 #ifndef DEFAULT_IDLE_TIMEOUT
464 #define DEFAULT_IDLE_TIMEOUT 0 285 #define DEFAULT_IDLE_TIMEOUT 0
465 #endif
466 286
467 /* The default path. This will often get replaced by the shell */ 287 /* The default path. This will often get replaced by the shell */
468 #ifndef DEFAULT_PATH
469 #define DEFAULT_PATH "/usr/bin:/bin" 288 #define DEFAULT_PATH "/usr/bin:/bin"
470 #endif
471 289
472 #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */ 290 #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */