./security/dropbear, Small SSH2 server and client, aimed at embedded market

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 2016.74, Package name: dropbear-2016.74, Maintainer: snj

The search for a small Secure Shell server to fit on a laptop with 4
megs ram and no hard disk was fruitless, so Matt Johnston decided to
write his own, and Dropbear is the result. It implements various
features of the SSH 2 protocol, including X11 and Authentication Agent
forwarding. Dropbear is Open Source software, distributed under a
MIT-style license. It includes a server, client and tools to
generate server keys and to convert OpenSSH keys for Dropbear.

Features

* A small memory footprint - Dropbear can compile to a 110kB
statically linked binary with uClibc (and only minimal options
selected).
* Implements X11 forwarding, and authentication-agent forwarding
for OpenSSH clients
* Compatible with OpenSSH ~/.ssh/authorized_keys public key
authentication
* Features can easily be disabled when compiling to save space.
* Preliminary TCP forwarding support (-L style only)


Required to run:
[math/ltm] [security/libtomcrypt]

Required to build:
[pkgtools/cwrappers]

Master sites:

SHA1: 92483315a112c862667c3e90af854a52dab09a12
RMD160: ec0a5a45ce3f636ac25e8f1170aa75cc79cafe12
Filesize: 1584.213 KB

Version history: (Expand)


CVS history: (Expand)


   2017-05-16 23:54:21 by Soren Jacobsen | Files touched by this commit (5)
   2015-11-04 02:18:12 by Alistair G. Crooks | Files touched by this commit (434)
Log message:
Add SHA512 digests for distfiles for security category

Problems found locating distfiles:
	Package f-prot-antivirus6-fs-bin: missing distfile fp-NetBSD.x86.32-fs-6.2.3.tar.gz
	Package f-prot-antivirus6-ws-bin: missing distfile fp-NetBSD.x86.32-ws-6.2.3.tar.gz
	Package libidea: missing distfile libidea-0.8.2b.tar.gz
	Package openssh: missing distfile openssh-7.1p1-hpn-20150822.diff.bz2
	Package uvscan: missing distfile vlp4510e.tar.Z

Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden).  All existing
SHA1 digests retained for now as an audit trail.
   2014-03-14 23:40:17 by Alistair G. Crooks | Files touched by this commit (1) | Package updated
Log message:
Use the xauth builtin.mk to find the location on the target system.

Just use the security/libtomcrypt/buildlink3.mk now the
BUILDLINK_API_DEPENDS has been updated.
   2014-01-31 18:32:19 by Alistair G. Crooks | Files touched by this commit (4)
Log message:
First part of minor dropbear package cleanup - this part lets the
package build as a normal user

+ don't refer to MAKEFLAGS outside of pkgsrc/mk
+ add comments to patch files
+ use BSD_INSTALL_* definitions in the build Makefile
+ re-order some parts of the pkgsrc Makefile
+ use pkgsrc definitions for CFLAGS.${OPSYS} rather than conditionals

XXX - TO DO - fix the xauth issue here
   2014-01-27 20:53:06 by Matthias Drochner | Files touched by this commit (4) | Package updated
Log message:
update to 2013.62
changes:
-ECC (elliptic curve) support
-curve25519-sha256@libssh.org support
-misc fixes and improvements

approved by The Maintainer
   2013-09-14 05:40:01 by Matthew Sporleder | Files touched by this commit (2)
Log message:
version bump to latest 2012.55 to 2013.58
also added a netbsd-specific build option

(changes)
2013.58 - Thursday 18 April 2013

- Fix building with Zlib disabled, thanks to Hans Harder and cuma@freetz

- Use % as a separator for ports, fixes scp in multihop mode, from Hans Harder

- Reject logins for other users when running as non-root, from Hans Harder

- Disable client immediate authentication request by default, it prevents
  passwordless logins from working

2013.57 - Monday 15 April 2013

- Decreased connection setup time particularly with high latency connections,
  the number of round trips has been reduced for both client and server.
  CPU time hasn't been changed.

- Client will send an initial key exchange guess to save a round trip.
  Dropbear implements an extension kexguess2@matt.ucc.asn.au to allow the first
  packet guess to succeed in wider circumstances than the standard behaviour.
  When communicating with other implementations the standard behaviour is used.

- Client side: when public key or password authentication with
  $DROPBEAR_PASSWORD is used an initial authentication request will
  be sent immediately rather than querying the list of available methods.
  This behaviour is enabled by CLI_IMMEDIATE_AUTH option (on by default),
  please let the Dropbear author know if it causes any interoperability
  problems.

- Implement client escape characters ~. (terminate session) and
  ~^Z (background session)

- Server will more reliably clean up utmp when connection is closed, reported by
  Mattias Walstr<C3><B6>m
- Don't crash if /dev/urandom isn't writable (RHEL5), thanks to Scott Case

- Add "-y -y" client option to skip host key checking, thanks to Hans \ 
Harder

- scp didn't work properly on systems using vfork(), thanks to Frank Van Uffelen

- Added IUTF8 terminal mode support (Linux and Mac OS). Not standardised yet
though probably will be soon

- Some verbose DROPBEAR_TRACE output is now hidden unless $DROPBEAR_TRACE2
  enviroment variable is set

- Fix using asymmetric MAC algorithms (broke in )

- Renamed configure.in to configure.ac to quieten autoconf, from Mike Frysinger

2013.56 - Thursday 21 March 2013

- Allow specifying cipher (-c) and MAC (-m) lists for dbclient

- Allow using 'none' cipher or MAC (off by default, use options.h). Encryption
  is used during authentication then disabled, similar to OpenSSH HPN mode

- Allow a user in immediately if the account has a blank password and blank
  passwords are enabled

- Include a few extra sources of entropy from /proc on Linux, hash private keys
  as well. Dropbear will also write gathered entropy back into /dev/urandom

- Added hmac-sha2-256 and hmac-sha2-512 support (off by default, use options.h)

- Don't sent bad address "localhost" for -R forward connections,
  reported by Denis Bider

- Add "-B" runtime option to allow blank passwords

- Allow using IPv6 bracket notation for addresses in server "-p" \ 
option, from Ben Jencks

- A few improvements for Android from Reimar D<C3><B6>ffinger

- Fix memory leak for TCP forwarded connections to hosts that timed out,
  reported by Norbert Bencz<C3><BA>r. Appears to be a very \ 
long-standing bug.

- Fix "make clean" for out of tree builds

- Fix compilation when ENABLE_{SVR,CLI}_AGENTFWD are unset
   2012-10-23 20:17:02 by Aleksej Saushev | Files touched by this commit (368)
Log message:
Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.
   2012-08-13 19:47:26 by Matthias Drochner | Files touched by this commit (2) | Package updated
Log message:
update to 2012.55
changes: fix a use-after-free bug which could be used to potentially
execute arbitrary code with root privileges, provided that the user
has been authenticated using a public key and also that a command
restriction is enforced (the "command" option must be used in
the authorized_keys file)