Mercurial > dropbear

comparison options.h @ 849:754d7bee1068 ecc

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge
author Matt Johnston <matt@ucc.asn.au>
date Fri, 08 Nov 2013 23:32:13 +0800
parents 6c69e7df3621 f4bb964c8678
children 7507b174bba0
comparison
equal deleted inserted replaced
848:6c69e7df3621 849:754d7bee1068
6 #define _OPTIONS_H_ 6 #define _OPTIONS_H_
7 7
8 /* Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif" 8 /* Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif"
9 * parts are to allow for commandline -DDROPBEAR_XXX options etc. */ 9 * parts are to allow for commandline -DDROPBEAR_XXX options etc. */
10 10
11 /* Important: Many options will require "make clean" after changes */ 11 /* IMPORTANT: Many options will require "make clean" after changes */
12 12
13 #ifndef DROPBEAR_DEFPORT 13 #ifndef DROPBEAR_DEFPORT
14 #define DROPBEAR_DEFPORT "22" 14 #define DROPBEAR_DEFPORT "22"
15 #endif 15 #endif
16 16
127 /*#define DROPBEAR_SHA2_512_HMAC*/ 127 /*#define DROPBEAR_SHA2_512_HMAC*/
128 #define DROPBEAR_MD5_HMAC 128 #define DROPBEAR_MD5_HMAC
129 129
130 /* You can also disable integrity. Don't bother disabling this if you're 130 /* You can also disable integrity. Don't bother disabling this if you're
131 * still using a cipher, it's relatively cheap. If you disable this it's dead 131 * still using a cipher, it's relatively cheap. If you disable this it's dead
132 * simple to run arbitrary commands on the remote host. Beware. */ 132 * simple for an attacker to run arbitrary commands on the remote host. Beware. */
133 /* #define DROPBEAR_NONE_INTEGRITY */ 133 /* #define DROPBEAR_NONE_INTEGRITY */
134 134
135 /* Hostkey/public key algorithms - at least one required, these are used 135 /* Hostkey/public key algorithms - at least one required, these are used
136 * for hostkey as well as for verifying signatures with pubkey auth. 136 * for hostkey as well as for verifying signatures with pubkey auth.
137 * Removing either of these won't save very much space. 137 * Removing either of these won't save very much space.
138 * SSH2 RFC Draft requires dss, recommends rsa */ 138 * SSH2 RFC Draft requires dss, recommends rsa */
139 #define DROPBEAR_RSA 139 #define DROPBEAR_RSA
140 #define DROPBEAR_DSS 140 #define DROPBEAR_DSS
141
142 #define DROPBEAR_ECDH
143 #define DROPBEAR_ECDSA 141 #define DROPBEAR_ECDSA
142
143 /* Generate hostkeys as-needed when the first connection using that key type occurs.
144 This avoids the need to otherwise run "dropbearkey" and avoids some problems
145 with badly seeded random devices when systems first boot.
146 This also requires a runtime flag "-R". */
147 #define DROPBEAR_DELAY_HOSTKEY
144 148
145 #define DROPBEAR_CURVE25519 149 #define DROPBEAR_CURVE25519
146 150
147 /* RSA can be vulnerable to timing attacks which use the time required for 151 /* RSA can be vulnerable to timing attacks which use the time required for
148 * signing to guess the private key. Blinding avoids this attack, though makes 152 * signing to guess the private key. Blinding avoids this attack, though makes
149 * signing operations slightly slower. */ 153 * signing operations slightly slower. */
150 #define RSA_BLINDING 154 #define RSA_BLINDING
155
156 /* Enable elliptic curve Diffie Hellman key exchange */
157 #define DROPBEAR_ECDH
151 158
152 /* Control the memory/performance/compression tradeoff for zlib. 159 /* Control the memory/performance/compression tradeoff for zlib.
153 * Set windowBits=8 for least memory usage, see your system's 160 * Set windowBits=8 for least memory usage, see your system's
154 * zlib.h for full details. 161 * zlib.h for full details.
155 * Default settings (windowBits=15) will use 256kB for compression 162 * Default settings (windowBits=15) will use 256kB for compression
182 * PAM challenge/response. 189 * PAM challenge/response.
183 * You can't enable both PASSWORD and PAM. */ 190 * You can't enable both PASSWORD and PAM. */
184 191
185 #define ENABLE_SVR_PASSWORD_AUTH 192 #define ENABLE_SVR_PASSWORD_AUTH
186 /* PAM requires ./configure --enable-pam */ 193 /* PAM requires ./configure --enable-pam */
187 //#define ENABLE_SVR_PAM_AUTH 194 /*#define ENABLE_SVR_PAM_AUTH */
188 #define ENABLE_SVR_PUBKEY_AUTH 195 #define ENABLE_SVR_PUBKEY_AUTH
189 196
190 /* Whether to take public key options in 197 /* Whether to take public key options in
191 * authorized_keys file into account */ 198 * authorized_keys file into account */
192 #ifdef ENABLE_SVR_PUBKEY_AUTH 199 #ifdef ENABLE_SVR_PUBKEY_AUTH