Mercurial > dropbear

comparison options.h @ 149:ed9ca2a9705c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Cleaned up the random code, use /dev/random by default, and remove the addrandom() function which wasn't used.
author Matt Johnston <matt@ucc.asn.au>
date Mon, 20 Dec 2004 13:11:15 +0000
parents 4562a2f4d690
children b9d3f725e00b
comparison
equal deleted inserted replaced
148:9a1dc9bc17d7 149:ed9ca2a9705c
126 #define ENABLE_SVR_PUBKEY_AUTH 126 #define ENABLE_SVR_PUBKEY_AUTH
127 127
128 #define ENABLE_CLI_PASSWORD_AUTH 128 #define ENABLE_CLI_PASSWORD_AUTH
129 #define ENABLE_CLI_PUBKEY_AUTH 129 #define ENABLE_CLI_PUBKEY_AUTH
130 130
131 /* Random device to use - you must specify _one only_. 131 /* Random device to use - define either DROPBEAR_RANDOM_DEV or
132 * DEV_URANDOM is recommended on hosts with a good /dev/urandom, otherwise use 132 * DROPBEAR_PRNGD_SOCKET.
133 * PRNGD and run prngd, specifying the socket. This device must be able to 133 * DROPBEAR_RANDOM_DEV is recommended on hosts with a good /dev/(u)random,
134 * produce a large amount of random data, so using /dev/random or Entropy 134 * otherwise use run prngd (or egd if you want), specifying the socket.
135 * Gathering Daemon (egd) may result in halting, as it waits for more random 135 * The device will be queried for a few dozen bytes of seed a couple of times
136 * data */ 136 * per session (or more for very long-lived sessions). */
137 #define DROPBEAR_DEV_URANDOM /* use /dev/urandom */ 137
138 138 /* If you are lacking entropy on the system then using /dev/urandom
139 /*#undef DROPBEAR_PRNGD */ /* use prngd socket - you must manually set up prngd 139 * will prevent Dropbear from blocking on the device. This could
140 to produce output */ 140 * however significantly reduce the security of your ssh connections
141 #ifndef DROPBEAR_PRNGD_SOCKET 141 * if the PRNG state becomes simpler. */
142 #define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng" 142 #define DROPBEAR_RANDOM_DEV "/dev/random"
143 #endif 143
144 /* prngd must be manually set up to produce output */
145 /*#define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"*/
144 146
145 /* Specify the number of clients we will allow to be connected but 147 /* Specify the number of clients we will allow to be connected but
146 * not yet authenticated. After this limit, connections are rejected */ 148 * not yet authenticated. After this limit, connections are rejected */
147 #ifndef MAX_UNAUTH_CLIENTS 149 #ifndef MAX_UNAUTH_CLIENTS
148 #define MAX_UNAUTH_CLIENTS 30 150 #define MAX_UNAUTH_CLIENTS 30
210 #define MIN_RSA_KEYLEN 512 212 #define MIN_RSA_KEYLEN 512
211 #endif 213 #endif
212 214
213 #define MAX_BANNER_SIZE 2000 /* this is 25*80 chars, any more is foolish */ 215 #define MAX_BANNER_SIZE 2000 /* this is 25*80 chars, any more is foolish */
214 #define MAX_BANNER_LINES 20 /* How many lines the client will display */ 216 #define MAX_BANNER_LINES 20 /* How many lines the client will display */
215
216 #define DEV_URANDOM "/dev/urandom"
217 217
218 /* the number of NAME=VALUE pairs to malloc for environ, if we don't have 218 /* the number of NAME=VALUE pairs to malloc for environ, if we don't have
219 * the clearenv() function */ 219 * the clearenv() function */
220 #define ENV_SIZE 100 220 #define ENV_SIZE 100
221 221
334 334
335 #if defined(ENABLE_SVR_PASSWORD_AUTH) && defined(ENABLE_SVR_PAM_AUTH) 335 #if defined(ENABLE_SVR_PASSWORD_AUTH) && defined(ENABLE_SVR_PAM_AUTH)
336 #error "You can't turn on PASSWORD and PAM auth both at once. Fix it in options.h" 336 #error "You can't turn on PASSWORD and PAM auth both at once. Fix it in options.h"
337 #endif 337 #endif
338 338
339 #if defined(DROPBEAR_RANDOM_DEV) && defined(DROPBEAR_PRNGD_SOCKET)
340 #error "You can't turn on DROPBEAR_PRNGD_SOCKET and DROPBEAR_RANDOM_DEV at once"
341 #endif
342
343 #if !defined(DROPBEAR_RANDOM_DEV) && !defined(DROPBEAR_PRNGD_SOCKET)
344 #error "You must choose one of DROPBEAR_PRNGD_SOCKET or DROPBEAR_RANDOM_DEV in options.h"
345 #endif
346
339 /* We use dropbear_client and dropbear_server as shortcuts to avoid redundant 347 /* We use dropbear_client and dropbear_server as shortcuts to avoid redundant
340 * code, if we're just compiling as client or server */ 348 * code, if we're just compiling as client or server */
341 #if defined(DROPBEAR_SERVER) && defined(DROPBEAR_CLIENT) 349 #if defined(DROPBEAR_SERVER) && defined(DROPBEAR_CLIENT)
342 350
343 #define IS_DROPBEAR_SERVER (ses.isserver == 1) 351 #define IS_DROPBEAR_SERVER (ses.isserver == 1)