Run a dropbear instance in a VRF, using the procd 'vrf' parameter:
config dropbear
option vrf '<dev>'
dropbear starts before the network, when the VRF device doesn't exist
yet. Don't start the instance at boot, the interface triggers start it
later. An instance without interfaces is started when any interface
comes up.
Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25568
Signed-off-by: Nick Hainke <vincent@systemli.org>
Enable ECDSA by default to:
- Support login with existing ECDSA keys.
- Ensure compatibility with legacy YubiKey devices (e.g., firmware 5.4)
and PIV-based SSH keys (RSA/ECDSA only).
- Maintain access until Ed25519 adoption is widespread.
Default 'y' for all builds except those with SMALL_FLASH.
This activates:
- DROPBEAR_ECC_256 (via DROPBEAR_ECDH || DROPBEAR_ECDSA), enabling
NIST-curve code for non-SMALL_FLASH builds.
- DROPBEAR_SK_ECDSA (default y), offering
sk-ecdsa-sha2-nistp256@openssh.com by default.
Note: Increases only binary size for non-SMALL_FLASH targets.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/24685
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The patch relaxes buf_verify()'s "Non-matching signing type" check so
that an rsa-sha2-256 signature is accepted against an ssh-rsa key.
Dropbear no longer needs the help: both sides of that comparison are now
taken from the wire's own algorithm names, so a compliant client
satisfies expect_sigtype == sigtype unaided.
Tracing the provenance in 2026.92, since it is what the removal rests
on. svr-authpubkey.c:113 reads the algorithm name out of the
SSH_MSG_USERAUTH_REQUEST and :126 turns it into sigtype with
signature_type_from_name(); that value is what :233 hands to buf_verify()
as expect_sigtype. signkey.c:655 parses the type name out of the
signature blob through the same signature_type_from_name(), and :659
compares the two. Neither is derived from the key format found in
authorized_keys: :132 maps the signature type back to the key algorithm
with signkey_type_from_signature() purely for the checkpubkey() lookup.
RFC 8332 section 3 has a client using rsa-sha2-256 send that name in the
userauth request and in the signature both, so the two agree and the
check passes - with an ssh-rsa key in authorized_keys, which is the case
the patch was written for.
Confirmed rather than reasoned: built pristine 2026.92 with this
package's defaults (DROPBEAR_RSA 1, DROPBEAR_RSA_SHA1 0) and logged in
over publickey with an OpenSSH client pinned to
PubkeyAcceptedAlgorithms=rsa-sha2-256. It succeeds, and the server
reports "Pubkey auth succeeded ... with ssh-rsa key" - an ssh-rsa entry
in authorized_keys, an rsa-sha2-256 signature, no patch.
Keeping the patch has an effect of its own. With DROPBEAR_RSA_SHA1 0,
signature_type_from_name("ssh-rsa") falls through to
signkey_type_from_name() and returns DROPBEAR_SIGNKEY_RSA, which is 0.
That is not DROPBEAR_SIGNATURE_NONE, so the patch's own "No signature
type" guard passes it, and expect_sigtype == DROPBEAR_SIGNATURE_RSA_SHA256
skips the type check. buf_rsa_verify() then calls rsa_pad_em(), whose
switch has no case for 0 and ends in default: assert(0), so the process
aborts. Upstream's unconditional check rejects the mismatch instead.
It is also narrower than upstream's in a second way: the replacement
sits inside #if DROPBEAR_RSA / #if DROPBEAR_RSA_SHA256, while the check
it displaces is unconditional. An ECDSA or Ed25519 only build therefore
has no expect_sigtype check at all today, only the "No signature type"
guard. Dropping the patch restores the check for every configuration,
not just this package's default one.
buf_verify() runs only after checkpubkey() has succeeded, so the abort
needs a key already listed in the target's authorized_keys - post-auth,
not an authentication bypass.
The patch's extra DROPBEAR_SIGNATURE_NONE guard is not lost with it:
svr-authpubkey.c rejects that case before buf_verify() is reached.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24525
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
- try to detect supported (hostkey) algorithms; otherwise fallback to predefined list;
- remove size constraint for ECDSA: custom build may include only 384 or 521 bit curves;
- remove size constraint for RSA: default RSA key size is 2048 bits which is sufficient for SSH security recommendations, and previous value of 1024 bits is considered insecure.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23217
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The dropbear init script uses pidof, but BusyBox may be built
without it. Add a Kconfig dependency on BUSYBOX_CONFIG_PIDOF
to ensure the applet is available at runtime.
Signed-off-by: Ivan Romanov <drizt72@zoho.eu>
Link: https://github.com/openwrt/openwrt/pull/23128
Signed-off-by: Robert Marko <robimarko@gmail.com>
- Security: Avoid privilege escalation via unix stream forwarding in Dropbear
server. Other programs on a system may authenticate unix sockets via
SO_PEERCRED, which would be root user for Dropbear forwarded connections,
allowing root privilege escalation.
Reported by Turistu, and thanks for advice on the fix.
This is tracked as CVE-2025-14282, and affects 2024.84 to 2025.88.
It is fixed by dropping privileges of the dropbear process after
authentication. Unix stream sockets are now disallowed when a
forced command is used, either with authorized_key restrictions or
"dropbear -c command".
In previous affected releases running with "dropbear -j" (will also disable
TCP fowarding) or building with localoptions.h/distrooptions.h
"#define DROPBEAR_SVR_LOCALSTREAMFWD 0" is a mitigation.
- Security: Include scp fix for CVE-2019-6111. This allowed
a malicious server to overwrite arbitrary local files.
The missing fix was reported by Ashish Kunwar.
- Server dropping privileges post-auth is enabled by default. This requires
setresgid() support, so some platforms such as netbsd or macos will have to
disable DROPBEAR_SVR_DROP_PRIVS in localoptions.h. Unix stream forwarding is
not available if DROPBEAR_SVR_DROP_PRIVS is disabled.
Remote server TCP socket forwarding will now use OS privileged port
restrictions rather than having a fixed "allow >=1024 for non-root" rule.
A future release may implement privilege dropping for netbsd/macos.
- Fix a regression in 2025.87 when RSA and DSS are not built. This would lead
to a crash at startup with bad_bufptr().
Reported by Dani Schmitt and Sebastian Priebe.
- Don't limit channel window to 500MB. That is could cause stuck connections
if peers advise a large window and don't send an increment within 500MB.
Affects SSH.NET https://github.com/sshnet/SSH.NET/issues/1671
Reported by Rob Hague.
- Ignore -g -s when passwords arent enabled. Patch from Norbert Lange.
Ignore -m (disable MOTD), -j/-k (tcp forwarding) when not enabled.
- Report SIGBUS and SIGTRAP signals. Patch from Loïc Mangeonjean.
- Fix incorrect server auth delay. Was meant to be 250-350ms, it was actually
150-350ms or possibly negative (zero). Reported by pickaxprograms.
- Fix building without public key options. Thanks to Konstantin Demin
- Fix building with proxycmd but without netcat. Thanks to Konstantin Demin
- Fix incorrect path documentation for distrooptions, thanks to Todd Zullinger
- Fix SO_REUSEADDR for TCP tests, reported by vt-alt.
Dropped:
* 050-dropbear-multihop-fix.patch as its included in the release 5cc0127000db5f
* 051-fix-pubkey-options.patch as its included in the release 1d4c4a542cd5df
* 052-fix-missing-depends-for-sntrup761x25519-sha512.patch as its included
in the release 1a2c1e649a1824
* 053-Don-t-limit-channel-window-to-500MB.patch as its included in the release a8610f7b98ad
Manually rebased:
* 110-change_user.patch
Fixes: CVE-2025-14282, CVE-2019-6111
Reviewed-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-by: Konstantin Demin <rockdrilla@gmail.com>
Tested-by: Konstantin Demin <rockdrilla@gmail.com> [mediatek/filogic (GL.iNet GL-MT6000)]
Link: https://github.com/openwrt/openwrt/pull/21186
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently its only possible to disable port forwarding only for specific
keys, via the OpenSSH-style restriction in `authorized_keys` file.
In some use cases it might be feasible to disable such features globally
on service level, so lets add new LocalPortForward and RemotePortForward
config knobs.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/21071
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Upstream has disabled SHA-1 algorithms by default since version 2025.87.
SHA-1 has known weakness and most SSH implementations support alternatives.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
It's hard or even impossible to track affected sources
so it's safe to remove all built objects (if any).
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
This allows to fine-tune dropbear build options.
This change is heavily based on similar work done by Marius Dinu earlier
so I'd like to say many thanks to original author.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Name the pidfile of each dropbear instance according to the
corresponding uci section name. This enables a 1:1 mapping between the
definition of the service instance and its process.
Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/15177
Signed-off-by: John Crispin <john@phrozen.org>
The config_get_bool also works with on/off, yes/no, true/false.
Add 'main' section name. This will make it easier to change settings from uci.
Add a link to documentation.
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15579
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The DropBear's dropbearkey supports limited set of arguments of
OpenSSH ssh-keygen: -t, -q -N -Y
After the change you can generate a key with the same command.
Still many features of the original OpenSSH ssh-keygen are absent in
the dropbearkey.
If it's needed then users should install openssh-keygen package that
will replace the /usr/bin/ssh-keygen with the full version.
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14174
[ wrap commit description to 80 columns ]
Link: https://github.com/openwrt/openwrt/pull/14174
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
- introduce 'DirectInterface' option to bind exactly to specified interface;
fixes#9666 and late IPv4/IPv6 address assignment
- option 'DirectInterface' takes precedence over 'Interface'
- improve interface/address handling,
e.g. verify count of listening endpoints due to dropbear limit (10 for now)
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
- correct maximum receive window size
- adjust receive window size against maximum allowed value
- warn about too high receive window size in syslog
improves f95eecfb
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
end users should have done this since OpenWrt 19.07.
if they didn't do this yet - perform auto-transition.
schedule 'rsakeyfile' removal for next year release.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
these options allow one to configure U2F/FIDO support in more granular way
inspired by upstream commit aa6559db
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
reduces binary/package size and increases overall performance
also:
- adjust 910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch
to build without DROPBEAR_RSA/DROPBEAR_RSA_SHA256
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
hmac-sha1 and diffie-hellman-group14-sha1 are weak algorithms.
A future deprecation notice of ssh-rsa (2048-bit) has been issued. [1]
It has no place in a potentially internet-facing daemon like dropbear.
Upstream has acknowledged this and offered this solution to disable
these two until this is made to be the default in the next release
of dropbear next year. [2]
1. https://www.openssh.com/txt/release-8.2
2. https://github.com/mkj/dropbear/issues/138
Signed-off-by: John Audia <therealgraysky@proton.me>
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
- "default n" is not needed: options are not selected by default
- wrap config on 80 characters width (assuming tab is 8 characters long)
- add feature cost size and security notes for DROPBEAR_AGENTFORWARD
and DROPBEAR_DBCLIENT_AGENTFORWARD:
describe why and where it should be disabled
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
- switch DB_OPT_COMMON and DB_OPT_CONFIG to comma-separated lists:
this allows to have values with "|" in DB_OPT_COMMON and DB_OPT_CONFIG
which is more likely to be than values with commas;
use $(comma) variable for values with commas.
- sort DB_OPT_COMMON and DB_OPT_CONFIG to have "overrides" on top of list.
- allow DB_OPT_COMMON to have values with commas.
- allow to replace multiline definitions in sysoptions.h.
improves e1bd9645
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
- update dropbear to latest stable 2022.83;
for the changes see https://matt.ucc.asn.au/dropbear/CHANGES
- drop patches:
- 001-fix-MAX_UNAUTH_CLIENTS-regression.patch
- rework patches:
- 901-bundled-libs-cflags.patch
- refresh remaining patches
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Nick Hainke
Florian Eckert
Konstantin Demin
Julius Bairaktaris
Ivan Romanov
Petr Štetiar
Andreas Gnau
Hauke Mehrtens
Sergey Ponomarev
John Crispin
Christian Marangi
Fabrice Fontaine