Mercurial > dropbear

comparison default_options.h @ 1546:bb8eaa26bc93 fuzz

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
merge from main
author Matt Johnston <matt@ucc.asn.au>
date Mon, 26 Feb 2018 22:44:48 +0800
parents 1ea92dd2ca5f d1a8a05216ff
children 2fd52c383163
comparison
equal deleted inserted replaced
1530:63fa53d3b6c7 1546:bb8eaa26bc93
1 /*
2 > > > Do not edit this file (default_options.h) < < <
3 Generated from ../default_options.h.in
4 Local customisation goes in localoptions.h
5 */
6
7
8 #ifndef DROPBEAR_DEFAULT_OPTIONS_H_ 1 #ifndef DROPBEAR_DEFAULT_OPTIONS_H_
9 #define DROPBEAR_DEFAULT_OPTIONS_H_ 2 #define DROPBEAR_DEFAULT_OPTIONS_H_
10 /* 3 /*
11 > > > Read This < < < 4 > > > Read This < < <
12 5
13 default_options.h.in documents compile-time options, and provides default values. 6 default_options.h documents compile-time options, and provides default values.
14 7
15 Local customisation should be added to localoptions.h which is 8 Local customisation should be added to localoptions.h which is
16 used if it exists. Options defined there will override any options in this 9 used if it exists. Options defined there will override any options in this
17 file. 10 file.
18 11
19 Options can also be defined with -DDROPBEAR_XXX in Makefile CFLAGS 12 Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS
20 13
21 IMPORTANT: Many options will require "make clean" after changes */ 14 IMPORTANT: Some options will require "make clean" after changes */
22 15
23 #ifndef DROPBEAR_DEFPORT
24 #define DROPBEAR_DEFPORT "22" 16 #define DROPBEAR_DEFPORT "22"
25 #endif
26 17
27 /* Listen on all interfaces */ 18 /* Listen on all interfaces */
28 #ifndef DROPBEAR_DEFADDRESS
29 #define DROPBEAR_DEFADDRESS "" 19 #define DROPBEAR_DEFADDRESS ""
30 #endif
31 20
32 /* Default hostkey paths - these can be specified on the command line */ 21 /* Default hostkey paths - these can be specified on the command line */
33 #ifndef DSS_PRIV_FILENAME
34 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key" 22 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
35 #endif
36 #ifndef RSA_PRIV_FILENAME
37 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key" 23 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
38 #endif
39 #ifndef ECDSA_PRIV_FILENAME
40 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key" 24 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key"
41 #endif
42 25
43 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens 26 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
44 * on chosen ports and keeps accepting connections. This is the default. 27 * on chosen ports and keeps accepting connections. This is the default.
45 * 28 *
46 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or 29 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or
48 * lasts for a single connection. Dropbear should be invoked with the -i flag 31 * lasts for a single connection. Dropbear should be invoked with the -i flag
49 * for inetd, and can only accept IPv4 connections. 32 * for inetd, and can only accept IPv4 connections.
50 * 33 *
51 * Both of these flags can be defined at once, don't compile without at least 34 * Both of these flags can be defined at once, don't compile without at least
52 * one of them. */ 35 * one of them. */
53 #ifndef NON_INETD_MODE
54 #define NON_INETD_MODE 1 36 #define NON_INETD_MODE 1
55 #endif
56 #ifndef INETD_MODE
57 #define INETD_MODE 1 37 #define INETD_MODE 1
58 #endif 38
59 39 /* Include verbose debug output, enabled with -v at runtime.
60 /* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is 40 * This will add a reasonable amount to your executable size. */
61 * perhaps 20% slower for pubkey operations (it is probably worth experimenting 41 #define DEBUG_TRACE 0
62 * if you want to use this) */
63 /*#define NO_FAST_EXPTMOD*/
64 42
65 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save 43 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save
66 several kB in binary size however will make the symmetrical ciphers and hashes 44 * several kB in binary size however will make the symmetrical ciphers and hashes
67 slower, perhaps by 50%. Recommended for small systems that aren't doing 45 * slower, perhaps by 50%. Recommended for small systems that aren't doing
68 much traffic. */ 46 * much traffic. */
69 #ifndef DROPBEAR_SMALL_CODE
70 #define DROPBEAR_SMALL_CODE 1 47 #define DROPBEAR_SMALL_CODE 1
71 #endif
72 48
73 /* Enable X11 Forwarding - server only */ 49 /* Enable X11 Forwarding - server only */
74 #ifndef DROPBEAR_X11FWD
75 #define DROPBEAR_X11FWD 1 50 #define DROPBEAR_X11FWD 1
76 #endif
77 51
78 /* Enable TCP Fowarding */ 52 /* Enable TCP Fowarding */
79 /* 'Local' is "-L" style (client listening port forwarded via server) 53 /* 'Local' is "-L" style (client listening port forwarded via server)
80 * 'Remote' is "-R" style (server listening port forwarded via client) */ 54 * 'Remote' is "-R" style (server listening port forwarded via client) */
81
82 #ifndef DROPBEAR_CLI_LOCALTCPFWD
83 #define DROPBEAR_CLI_LOCALTCPFWD 1 55 #define DROPBEAR_CLI_LOCALTCPFWD 1
84 #endif
85 #ifndef DROPBEAR_CLI_REMOTETCPFWD
86 #define DROPBEAR_CLI_REMOTETCPFWD 1 56 #define DROPBEAR_CLI_REMOTETCPFWD 1
87 #endif 57
88
89 #ifndef DROPBEAR_SVR_LOCALTCPFWD
90 #define DROPBEAR_SVR_LOCALTCPFWD 1 58 #define DROPBEAR_SVR_LOCALTCPFWD 1
91 #endif
92 #ifndef DROPBEAR_SVR_REMOTETCPFWD
93 #define DROPBEAR_SVR_REMOTETCPFWD 1 59 #define DROPBEAR_SVR_REMOTETCPFWD 1
94 #endif
95 60
96 /* Enable Authentication Agent Forwarding */ 61 /* Enable Authentication Agent Forwarding */
97 #ifndef DROPBEAR_SVR_AGENTFWD
98 #define DROPBEAR_SVR_AGENTFWD 1 62 #define DROPBEAR_SVR_AGENTFWD 1
99 #endif
100 #ifndef DROPBEAR_CLI_AGENTFWD
101 #define DROPBEAR_CLI_AGENTFWD 1 63 #define DROPBEAR_CLI_AGENTFWD 1
102 #endif
103
104 64
105 /* Note: Both DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_NETCAT must be set to 65 /* Note: Both DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_NETCAT must be set to
106 * allow multihop dbclient connections */ 66 * allow multihop dbclient connections */
107 67
108 /* Allow using -J <proxycommand> to run the connection through a 68 /* Allow using -J <proxycommand> to run the connection through a
109 pipe to a program, rather the normal TCP connection */ 69 pipe to a program, rather the normal TCP connection */
110 #ifndef DROPBEAR_CLI_PROXYCMD
111 #define DROPBEAR_CLI_PROXYCMD 1 70 #define DROPBEAR_CLI_PROXYCMD 1
112 #endif
113 71
114 /* Enable "Netcat mode" option. This will forward standard input/output 72 /* Enable "Netcat mode" option. This will forward standard input/output
115 * to a remote TCP-forwarded connection */ 73 * to a remote TCP-forwarded connection */
116 #ifndef DROPBEAR_CLI_NETCAT
117 #define DROPBEAR_CLI_NETCAT 1 74 #define DROPBEAR_CLI_NETCAT 1
118 #endif
119 75
120 /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */ 76 /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
121 #ifndef ENABLE_USER_ALGO_LIST 77 #define DROPBEAR_USER_ALGO_LIST 1
122 #define ENABLE_USER_ALGO_LIST 1
123 #endif
124 78
125 /* Encryption - at least one required. 79 /* Encryption - at least one required.
126 * Protocol RFC requires 3DES and recommends AES128 for interoperability. 80 * AES128 should be enabled, some very old implementations might only
127 * Including multiple keysize variants the same cipher 81 * support 3DES.
128 * (eg AES256 as well as AES128) will result in a minimal size increase.*/ 82 * Including both AES keysize variants (128 and 256) will result in
129 #ifndef DROPBEAR_AES128 83 * a minimal size increase */
130 #define DROPBEAR_AES128 1 84 #define DROPBEAR_AES128 1
131 #endif
132 #ifndef DROPBEAR_3DES
133 #define DROPBEAR_3DES 1 85 #define DROPBEAR_3DES 1
134 #endif
135 #ifndef DROPBEAR_AES256
136 #define DROPBEAR_AES256 1 86 #define DROPBEAR_AES256 1
137 #endif 87 #define DROPBEAR_TWOFISH256 0
88 #define DROPBEAR_TWOFISH128 0
138 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ 89 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
139 /*#define DROPBEAR_BLOWFISH*/ 90 #define DROPBEAR_BLOWFISH 0
140 #ifndef DROPBEAR_TWOFISH256
141 #define DROPBEAR_TWOFISH256 1
142 #endif
143 #ifndef DROPBEAR_TWOFISH128
144 #define DROPBEAR_TWOFISH128 1
145 #endif
146 91
147 /* Enable CBC mode for ciphers. This has security issues though 92 /* Enable CBC mode for ciphers. This has security issues though
148 * is the most compatible with older SSH implementations */ 93 * is the most compatible with older SSH implementations */
149 #ifndef DROPBEAR_ENABLE_CBC_MODE
150 #define DROPBEAR_ENABLE_CBC_MODE 1 94 #define DROPBEAR_ENABLE_CBC_MODE 1
151 #endif 95
152 96 /* Enable "Counter Mode" for ciphers. This is more secure than
153 /* Enable "Counter Mode" for ciphers. This is more secure than normal
154 * CBC mode against certain attacks. It is recommended for security 97 * CBC mode against certain attacks. It is recommended for security
155 * and forwards compatibility */ 98 * and forwards compatibility */
156 #ifndef DROPBEAR_ENABLE_CTR_MODE
157 #define DROPBEAR_ENABLE_CTR_MODE 1 99 #define DROPBEAR_ENABLE_CTR_MODE 1
158 #endif
159
160 /* Twofish counter mode is disabled by default because it
161 has not been tested for interoperability with other SSH implementations.
162 If you test it please contact the Dropbear author */
163 #ifndef DROPBEAR_TWOFISH_CTR
164 #define DROPBEAR_TWOFISH_CTR 0
165 #endif
166 100
167 /* Message integrity. sha2-256 is recommended as a default, 101 /* Message integrity. sha2-256 is recommended as a default,
168 sha1 for compatibility */ 102 sha1 for compatibility */
169 #ifndef DROPBEAR_SHA1_HMAC
170 #define DROPBEAR_SHA1_HMAC 1 103 #define DROPBEAR_SHA1_HMAC 1
171 #endif
172 #ifndef DROPBEAR_SHA1_96_HMAC
173 #define DROPBEAR_SHA1_96_HMAC 1 104 #define DROPBEAR_SHA1_96_HMAC 1
174 #endif
175 #ifndef DROPBEAR_SHA2_256_HMAC
176 #define DROPBEAR_SHA2_256_HMAC 1 105 #define DROPBEAR_SHA2_256_HMAC 1
177 #endif
178 /* Default is to include it is sha512 is being compiled in for ECDSA */
179 #ifndef DROPBEAR_SHA2_512_HMAC
180 #define DROPBEAR_SHA2_512_HMAC (DROPBEAR_ECDSA)
181 #endif
182
183 /* XXX needed for fingerprints */
184 #ifndef DROPBEAR_MD5_HMAC
185 #define DROPBEAR_MD5_HMAC 0
186 #endif
187 106
188 /* Hostkey/public key algorithms - at least one required, these are used 107 /* Hostkey/public key algorithms - at least one required, these are used
189 * for hostkey as well as for verifying signatures with pubkey auth. 108 * for hostkey as well as for verifying signatures with pubkey auth.
190 * Removing either of these won't save very much space. 109 * Removing either of these won't save very much space.
191 * RSA is recommended 110 * RSA is recommended
192 * DSS may be necessary to connect to some systems though 111 * DSS may be necessary to connect to some systems though
193 is not recommended for new keys */ 112 is not recommended for new keys */
194 #ifndef DROPBEAR_RSA
195 #define DROPBEAR_RSA 1 113 #define DROPBEAR_RSA 1
196 #endif
197 #ifndef DROPBEAR_DSS
198 #define DROPBEAR_DSS 1 114 #define DROPBEAR_DSS 1
199 #endif
200 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC 115 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
201 * code (either ECDSA or ECDH) increases binary size - around 30kB 116 * code (either ECDSA or ECDH) increases binary size - around 30kB
202 * on x86-64 */ 117 * on x86-64 */
203 #ifndef DROPBEAR_ECDSA
204 #define DROPBEAR_ECDSA 1 118 #define DROPBEAR_ECDSA 1
205 #endif
206 119
207 /* RSA must be >=1024 */ 120 /* RSA must be >=1024 */
208 #ifndef DROPBEAR_DEFAULT_RSA_SIZE
209 #define DROPBEAR_DEFAULT_RSA_SIZE 2048 121 #define DROPBEAR_DEFAULT_RSA_SIZE 2048
210 #endif
211 /* DSS is always 1024 */ 122 /* DSS is always 1024 */
212 /* ECDSA defaults to largest size configured, usually 521 */ 123 /* ECDSA defaults to largest size configured, usually 521 */
213 124
214 /* Add runtime flag "-R" to generate hostkeys as-needed when the first 125 /* Add runtime flag "-R" to generate hostkeys as-needed when the first
215 connection using that key type occurs. 126 connection using that key type occurs.
216 This avoids the need to otherwise run "dropbearkey" and avoids some problems 127 This avoids the need to otherwise run "dropbearkey" and avoids some problems
217 with badly seeded /dev/urandom when systems first boot. */ 128 with badly seeded /dev/urandom when systems first boot. */
218 #ifndef DROPBEAR_DELAY_HOSTKEY
219 #define DROPBEAR_DELAY_HOSTKEY 1 129 #define DROPBEAR_DELAY_HOSTKEY 1
220 #endif 130
221
222 /* Enable Curve25519 for key exchange. This is another elliptic
223 * curve method with good security properties. Increases binary size
224 * by ~8kB on x86-64 */
225 #ifndef DROPBEAR_CURVE25519
226 #define DROPBEAR_CURVE25519 1
227 #endif
228
229 /* Enable elliptic curve Diffie Hellman key exchange, see note about
230 * ECDSA above */
231 #ifndef DROPBEAR_ECDH
232 #define DROPBEAR_ECDH 1
233 #endif
234 131
235 /* Key exchange algorithm. 132 /* Key exchange algorithm.
133
236 * group14_sha1 - 2048 bit, sha1 134 * group14_sha1 - 2048 bit, sha1
237 * group14_sha256 - 2048 bit, sha2-256 135 * group14_sha256 - 2048 bit, sha2-256
238 * group16 - 4096 bit, sha2-512 136 * group16 - 4096 bit, sha2-512
239 * group1 - 1024 bit, sha1 137 * group1 - 1024 bit, sha1
138 * curve25519 - elliptic curve DH
139 * ecdh - NIST elliptic curve DH (256, 384, 521)
240 * 140 *
141 * group1 is too small for security though is necessary if you need
142 compatibility with some implementations such as Dropbear versions < 0.53
241 * group14 is supported by most implementations. 143 * group14 is supported by most implementations.
242 * group16 provides a greater strength level but is slower and increases binary size 144 * group16 provides a greater strength level but is slower and increases binary size
243 * group1 is too small for security though is necessary if you need 145 * curve25519 and ecdh algorithms are faster than non-elliptic curve methods
244 compatibility with some implementations such as Dropbear versions < 0.53 146 * curve25519 increases binary size by ~8kB on x86-64
147 * including either ECDH or ECDSA increases binary size by ~30kB on x86-64
148
149 * Small systems should generally include either curve25519 or ecdh for performance.
150 * curve25519 is less widely supported but is faster
245 */ 151 */
246 #ifndef DROPBEAR_DH_GROUP1 152 #define DROPBEAR_DH_GROUP14_SHA1 1
153 #define DROPBEAR_DH_GROUP14_SHA256 1
154 #define DROPBEAR_DH_GROUP16 0
155 #define DROPBEAR_CURVE25519 1
156 #define DROPBEAR_ECDH 1
247 #define DROPBEAR_DH_GROUP1 1 157 #define DROPBEAR_DH_GROUP1 1
248 #endif 158
249 #ifndef DROPBEAR_DH_GROUP14_SHA1 159 /* When group1 is enabled it will only be allowed by Dropbear client
250 #define DROPBEAR_DH_GROUP14_SHA1 1 160 not as a server, due to concerns over its strength. Set to 0 to allow
251 #endif 161 group1 in Dropbear server too */
252 #ifndef DROPBEAR_DH_GROUP14_SHA256 162 #define DROPBEAR_DH_GROUP1_CLIENTONLY 1
253 #define DROPBEAR_DH_GROUP14_SHA256 1
254 #endif
255 #ifndef DROPBEAR_DH_GROUP16
256 #define DROPBEAR_DH_GROUP16 0
257 #endif
258 163
259 /* Control the memory/performance/compression tradeoff for zlib. 164 /* Control the memory/performance/compression tradeoff for zlib.
260 * Set windowBits=8 for least memory usage, see your system's 165 * Set windowBits=8 for least memory usage, see your system's
261 * zlib.h for full details. 166 * zlib.h for full details.
262 * Default settings (windowBits=15) will use 256kB for compression 167 * Default settings (windowBits=15) will use 256kB for compression
263 * windowBits=8 will use 129kB for compression. 168 * windowBits=8 will use 129kB for compression.
264 * Both modes will use ~35kB for decompression (using windowBits=15 for 169 * Both modes will use ~35kB for decompression (using windowBits=15 for
265 * interoperability) */ 170 * interoperability) */
266 #ifndef DROPBEAR_ZLIB_WINDOW_BITS
267 #define DROPBEAR_ZLIB_WINDOW_BITS 15 171 #define DROPBEAR_ZLIB_WINDOW_BITS 15
268 #endif
269 172
270 /* Whether to do reverse DNS lookups. */ 173 /* Whether to do reverse DNS lookups. */
271 #ifndef DO_HOST_LOOKUP
272 #define DO_HOST_LOOKUP 0 174 #define DO_HOST_LOOKUP 0
273 #endif
274 175
275 /* Whether to print the message of the day (MOTD). */ 176 /* Whether to print the message of the day (MOTD). */
276 #ifndef DO_MOTD
277 #define DO_MOTD 0 177 #define DO_MOTD 0
278 #endif
279
280 /* The MOTD file path */
281 #ifndef MOTD_FILENAME
282 #define MOTD_FILENAME "/etc/motd" 178 #define MOTD_FILENAME "/etc/motd"
283 #endif
284 179
285 /* Authentication Types - at least one required. 180 /* Authentication Types - at least one required.
286 RFC Draft requires pubkey auth, and recommends password */ 181 RFC Draft requires pubkey auth, and recommends password */
182 #define DROPBEAR_SVR_PASSWORD_AUTH 1
287 183
288 /* Note: PAM auth is quite simple and only works for PAM modules which just do 184 /* Note: PAM auth is quite simple and only works for PAM modules which just do
289 * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c). 185 * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c).
290 * It's useful for systems like OS X where standard password crypts don't work 186 * It's useful for systems like OS X where standard password crypts don't work
291 * but there's an interface via a PAM module. It won't work for more complex 187 * but there's an interface via a PAM module. It won't work for more complex
292 * PAM challenge/response. 188 * PAM challenge/response.
293 * You can't enable both PASSWORD and PAM. */ 189 * You can't enable both PASSWORD and PAM. */
294
295 /* This requires crypt() */
296 #ifdef HAVE_CRYPT
297 #ifndef DROPBEAR_SVR_PASSWORD_AUTH
298 #define DROPBEAR_SVR_PASSWORD_AUTH 1
299 #endif
300 #else
301 #ifndef DROPBEAR_SVR_PASSWORD_AUTH
302 #define DROPBEAR_SVR_PASSWORD_AUTH 0
303 #endif
304 #endif
305 /* PAM requires ./configure --enable-pam */
306 #ifndef DROPBEAR_SVR_PAM_AUTH
307 #define DROPBEAR_SVR_PAM_AUTH 0 190 #define DROPBEAR_SVR_PAM_AUTH 0
308 #endif 191
309 #ifndef DROPBEAR_SVR_PUBKEY_AUTH 192 /* ~/.ssh/authorized_keys authentication */
310 #define DROPBEAR_SVR_PUBKEY_AUTH 1 193 #define DROPBEAR_SVR_PUBKEY_AUTH 1
311 #endif
312 194
313 /* Whether to take public key options in 195 /* Whether to take public key options in
314 * authorized_keys file into account */ 196 * authorized_keys file into account */
315 #ifndef DROPBEAR_SVR_PUBKEY_OPTIONS
316 #define DROPBEAR_SVR_PUBKEY_OPTIONS 1 197 #define DROPBEAR_SVR_PUBKEY_OPTIONS 1
317 #endif 198
318 199 /* Client authentication options */
319 /* This requires getpass. */
320 #ifdef HAVE_GETPASS
321 #ifndef DROPBEAR_CLI_PASSWORD_AUTH
322 #define DROPBEAR_CLI_PASSWORD_AUTH 1 200 #define DROPBEAR_CLI_PASSWORD_AUTH 1
323 #endif
324 #ifndef DROPBEAR_CLI_INTERACT_AUTH
325 #define DROPBEAR_CLI_INTERACT_AUTH 1
326 #endif
327 #endif
328 #ifndef DROPBEAR_CLI_PUBKEY_AUTH
329 #define DROPBEAR_CLI_PUBKEY_AUTH 1 201 #define DROPBEAR_CLI_PUBKEY_AUTH 1
330 #endif
331 202
332 /* A default argument for dbclient -i <privatekey>. 203 /* A default argument for dbclient -i <privatekey>.
333 Homedir is prepended unless path begins with / */ 204 Homedir is prepended unless path begins with / */
334 #ifndef DROPBEAR_DEFAULT_CLI_AUTHKEY
335 #define DROPBEAR_DEFAULT_CLI_AUTHKEY ".ssh/id_dropbear" 205 #define DROPBEAR_DEFAULT_CLI_AUTHKEY ".ssh/id_dropbear"
336 #endif 206
337 207 /* Allow specifying the password for dbclient via the DROPBEAR_PASSWORD
338 /* This variable can be used to set a password for client 208 * environment variable. */
339 * authentication on the commandline. Beware of platforms 209 #define DROPBEAR_USE_PASSWORD_ENV 1
340 * that don't protect environment variables of processes etc. Also
341 * note that it will be provided for all "hidden" client-interactive
342 * style prompts - if you want something more sophisticated, use
343 * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
344 #ifndef DROPBEAR_PASSWORD_ENV
345 #define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
346 #endif
347 210
348 /* Define this (as well as DROPBEAR_CLI_PASSWORD_AUTH) to allow the use of 211 /* Define this (as well as DROPBEAR_CLI_PASSWORD_AUTH) to allow the use of
349 * a helper program for the ssh client. The helper program should be 212 * a helper program for the ssh client. The helper program should be
350 * specified in the SSH_ASKPASS environment variable, and dbclient 213 * specified in the SSH_ASKPASS environment variable, and dbclient
351 * should be run with DISPLAY set and no tty. The program should 214 * should be run with DISPLAY set and no tty. The program should
352 * return the password on standard output */ 215 * return the password on standard output */
353 #ifndef DROPBEAR_CLI_ASKPASS_HELPER
354 #define DROPBEAR_CLI_ASKPASS_HELPER 0 216 #define DROPBEAR_CLI_ASKPASS_HELPER 0
355 #endif
356 217
357 /* Save a network roundtrip by sendng a real auth request immediately after 218 /* Save a network roundtrip by sendng a real auth request immediately after
358 * sending a query for the available methods. It is at the expense of < 100 219 * sending a query for the available methods. This is not yet enabled by default
359 * bytes of extra network traffic. This is not yet enabled by default since it 220 since it could cause problems with non-compliant servers */
360 * could cause problems with non-compliant servers */
361 #ifndef DROPBEAR_CLI_IMMEDIATE_AUTH
362 #define DROPBEAR_CLI_IMMEDIATE_AUTH 0 221 #define DROPBEAR_CLI_IMMEDIATE_AUTH 0
363 #endif 222
364 223 /* Set this to use PRNGD or EGD instead of /dev/urandom */
365 /* Source for randomness. This must be able to provide hundreds of bytes per SSH 224 #define DROPBEAR_USE_PRNGD 0
366 * connection without blocking. In addition /dev/random is used for seeding 225 #define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"
367 * rsa/dss key generation */
368 #ifndef DROPBEAR_URANDOM_DEV
369 #define DROPBEAR_URANDOM_DEV "/dev/urandom"
370 #endif
371
372 /* Set this to use PRNGD or EGD instead of /dev/urandom or /dev/random */
373 /*#define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"*/
374
375 226
376 /* Specify the number of clients we will allow to be connected but 227 /* Specify the number of clients we will allow to be connected but
377 * not yet authenticated. After this limit, connections are rejected */ 228 * not yet authenticated. After this limit, connections are rejected */
378 /* The first setting is per-IP, to avoid denial of service */ 229 /* The first setting is per-IP, to avoid denial of service */
379 #ifndef MAX_UNAUTH_PER_IP
380 #define MAX_UNAUTH_PER_IP 5 230 #define MAX_UNAUTH_PER_IP 5
381 #endif
382 231
383 /* And then a global limit to avoid chewing memory if connections 232 /* And then a global limit to avoid chewing memory if connections
384 * come from many IPs */ 233 * come from many IPs */
385 #ifndef MAX_UNAUTH_CLIENTS
386 #define MAX_UNAUTH_CLIENTS 30 234 #define MAX_UNAUTH_CLIENTS 30
387 #endif
388 235
389 /* Default maximum number of failed authentication tries (server option) */ 236 /* Default maximum number of failed authentication tries (server option) */
390 /* -T server option overrides */ 237 /* -T server option overrides */
391 #ifndef MAX_AUTH_TRIES
392 #define MAX_AUTH_TRIES 10 238 #define MAX_AUTH_TRIES 10
393 #endif
394 239
395 /* The default file to store the daemon's process ID, for shutdown 240 /* The default file to store the daemon's process ID, for shutdown
396 scripts etc. This can be overridden with the -P flag */ 241 scripts etc. This can be overridden with the -P flag */
397 #ifndef DROPBEAR_PIDFILE
398 #define DROPBEAR_PIDFILE "/var/run/dropbear.pid" 242 #define DROPBEAR_PIDFILE "/var/run/dropbear.pid"
399 #endif
400 243
401 /* The command to invoke for xauth when using X11 forwarding. 244 /* The command to invoke for xauth when using X11 forwarding.
402 * "-q" for quiet */ 245 * "-q" for quiet */
403 #ifndef XAUTH_COMMAND
404 #define XAUTH_COMMAND "/usr/bin/xauth -q" 246 #define XAUTH_COMMAND "/usr/bin/xauth -q"
405 #endif 247
406 248
407 /* if you want to enable running an sftp server (such as the one included with 249 /* if you want to enable running an sftp server (such as the one included with
408 * OpenSSH), set the path below. If the path isn't defined, sftp will not 250 * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER.
409 * be enabled */ 251 * The sftp-server program is not provided by Dropbear itself */
410 #ifndef SFTPSERVER_PATH 252 #define DROPBEAR_SFTPSERVER 1
411 #define SFTPSERVER_PATH "/usr/libexec/sftp-server" 253 #define SFTPSERVER_PATH "/usr/libexec/sftp-server"
412 #endif
413 254
414 /* This is used by the scp binary when used as a client binary. If you're 255 /* This is used by the scp binary when used as a client binary. If you're
415 * not using the Dropbear client, you'll need to change it */ 256 * not using the Dropbear client, you'll need to change it */
416 #ifndef DROPBEAR_PATH_SSH_PROGRAM
417 #define DROPBEAR_PATH_SSH_PROGRAM "/usr/bin/dbclient" 257 #define DROPBEAR_PATH_SSH_PROGRAM "/usr/bin/dbclient"
418 #endif
419 258
420 /* Whether to log commands executed by a client. This only logs the 259 /* Whether to log commands executed by a client. This only logs the
421 * (single) command sent to the server, not what a user did in a 260 * (single) command sent to the server, not what a user did in a
422 * shell/sftp session etc. */ 261 * shell/sftp session etc. */
423 #ifndef LOG_COMMANDS
424 #define LOG_COMMANDS 0 262 #define LOG_COMMANDS 0
425 #endif
426 263
427 /* Window size limits. These tend to be a trade-off between memory 264 /* Window size limits. These tend to be a trade-off between memory
428 usage and network performance: */ 265 usage and network performance: */
429 /* Size of the network receive window. This amount of memory is allocated 266 /* Size of the network receive window. This amount of memory is allocated
430 as a per-channel receive buffer. Increasing this value can make a 267 as a per-channel receive buffer. Increasing this value can make a
431 significant difference to network performance. 24kB was empirically 268 significant difference to network performance. 24kB was empirically
432 chosen for a 100mbit ethernet network. The value can be altered at 269 chosen for a 100mbit ethernet network. The value can be altered at
433 runtime with the -W argument. */ 270 runtime with the -W argument. */
434 #ifndef DEFAULT_RECV_WINDOW
435 #define DEFAULT_RECV_WINDOW 24576 271 #define DEFAULT_RECV_WINDOW 24576
436 #endif
437 /* Maximum size of a received SSH data packet - this _MUST_ be >= 32768 272 /* Maximum size of a received SSH data packet - this _MUST_ be >= 32768
438 in order to interoperate with other implementations */ 273 in order to interoperate with other implementations */
439 #ifndef RECV_MAX_PAYLOAD_LEN
440 #define RECV_MAX_PAYLOAD_LEN 32768 274 #define RECV_MAX_PAYLOAD_LEN 32768
441 #endif
442 /* Maximum size of a transmitted data packet - this can be any value, 275 /* Maximum size of a transmitted data packet - this can be any value,
443 though increasing it may not make a significant difference. */ 276 though increasing it may not make a significant difference. */
444 #ifndef TRANS_MAX_PAYLOAD_LEN
445 #define TRANS_MAX_PAYLOAD_LEN 16384 277 #define TRANS_MAX_PAYLOAD_LEN 16384
446 #endif
447 278
448 /* Ensure that data is transmitted every KEEPALIVE seconds. This can 279 /* Ensure that data is transmitted every KEEPALIVE seconds. This can
449 be overridden at runtime with -K. 0 disables keepalives */ 280 be overridden at runtime with -K. 0 disables keepalives */
450 #ifndef DEFAULT_KEEPALIVE
451 #define DEFAULT_KEEPALIVE 0 281 #define DEFAULT_KEEPALIVE 0
452 #endif
453 282
454 /* If this many KEEPALIVES are sent with no packets received from the 283 /* If this many KEEPALIVES are sent with no packets received from the
455 other side, exit. Not run-time configurable - if you have a need 284 other side, exit. Not run-time configurable - if you have a need
456 for runtime configuration please mail the Dropbear list */ 285 for runtime configuration please mail the Dropbear list */
457 #ifndef DEFAULT_KEEPALIVE_LIMIT
458 #define DEFAULT_KEEPALIVE_LIMIT 3 286 #define DEFAULT_KEEPALIVE_LIMIT 3
459 #endif
460 287
461 /* Ensure that data is received within IDLE_TIMEOUT seconds. This can 288 /* Ensure that data is received within IDLE_TIMEOUT seconds. This can
462 be overridden at runtime with -I. 0 disables idle timeouts */ 289 be overridden at runtime with -I. 0 disables idle timeouts */
463 #ifndef DEFAULT_IDLE_TIMEOUT
464 #define DEFAULT_IDLE_TIMEOUT 0 290 #define DEFAULT_IDLE_TIMEOUT 0
465 #endif
466 291
467 /* The default path. This will often get replaced by the shell */ 292 /* The default path. This will often get replaced by the shell */
468 #ifndef DEFAULT_PATH
469 #define DEFAULT_PATH "/usr/bin:/bin" 293 #define DEFAULT_PATH "/usr/bin:/bin"
470 #endif
471 294
472 #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */ 295 #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */