Add dropbear support #6

New issue

Open

opened 2021-10-12 07:23:40 +00:00 by svelt · 1 comment

svelt commented

2021-10-12 07:23:40 +00:00

Owner

is it possible to harden dropbear?
how?
what to do?

- is it possible to harden dropbear? - how? - what to do?

svelt added the

enhancement

help wanted

labels 2021-10-12 07:23:40 +00:00

svelt self-assigned this 2021-10-29 14:14:32 +00:00

svelt commented

2021-11-04 15:21:32 +00:00

Author

Owner

Looks like the only chance to harden dropbear:

(maybe) create ed22519 key with dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key (file size ~83 bytes)
remove all other keys
Add -r /etc/dropbear/dropbear_ed25519_host_key to command line
Remove -R (to be sure)

There's no way to configure Kex/Key/Ciphers/MAC but connection is terminated if there's no specific host key.

For additional RSA:

dropbearkey -t rsa -s 4096 -f /etc/dropbear/dropbear_rsa_host_key - file size ~1573 bytes (3072 bit is ~1189 bytes)
add -r /etc/dropbear/dropbear_rsa_host_key to command line

Alpine Linux:
/etc/conf.d/dropbear: DROPBEAR_OPTS="-r /etc/dropbear/dropbear_ed25519_host_key"

Looks like the only chance to harden dropbear: * (maybe) create `ed22519` key with `dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key` (file size ~83 bytes) * remove all other keys * Add `-r /etc/dropbear/dropbear_ed25519_host_key` to command line * Remove `-R` (to be sure) There's no way to configure Kex/Key/Ciphers/MAC but connection is terminated if there's no specific host key. For additional RSA: * `dropbearkey -t rsa -s 4096 -f /etc/dropbear/dropbear_rsa_host_key` - file size ~1573 bytes (3072 bit is ~1189 bytes) * add `-r /etc/dropbear/dropbear_rsa_host_key` to command line **Alpine Linux:** `/etc/conf.d/dropbear`: `DROPBEAR_OPTS="-r /etc/dropbear/dropbear_ed25519_host_key"`