KumiSystems/openwrtv4
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
openwrtv4/package/network/services/dropbear/patches/120-openwrt_options.patch

83 lines
3.2 KiB
Diff
Raw Normal View History

tune some more options by default to decrease size SVN-Revision: 25831
2011-03-02 14:51:45 +00:00
--- a/options.h
+++ b/options.h
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
@@ -41,7 +41,7 @@
tune some more options by default to decrease size SVN-Revision: 25831
2011-03-02 14:51:45 +00:00
* Both of these flags can be defined at once, don't compile without at least
* one of them. */
#define NON_INETD_MODE
-#define INETD_MODE
+/*#define INETD_MODE*/
/* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is
* perhaps 20% slower for pubkey operations (it is probably worth experimenting
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
@@ -81,7 +81,7 @@ much traffic. */
tune some more options by default to decrease size SVN-Revision: 25831
2011-03-02 14:51:45 +00:00
/* Enable "Netcat mode" option. This will forward standard input/output
* to a remote TCP-forwarded connection */
-#define ENABLE_CLI_NETCAT
+/*#define ENABLE_CLI_NETCAT*/
dropbear: update to 2013.59 (released 4 october 2013) - drop mirror www.mirrors.wiretapped.net (not working anymore) - drop patch 300-ipv6_addr_port_split.patch, included upstream - refresh patches - various upstream changes: http://matt.ucc.asn.au/dropbear/CHANGES Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 38356
2013-10-10 14:42:05 +00:00
/* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
#define ENABLE_USER_ALGO_LIST
dropbear: disable 3des, cbc mode, dss support, saves about 5k gzipped While technically required by the RFC, they are usually completely unused (DSA), or have security issues (3DES, CBC) Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 46814
2015-09-08 08:55:10 +00:00
@@ -91,16 +91,16 @@ much traffic. */
* Including multiple keysize variants the same cipher
* (eg AES256 as well as AES128) will result in a minimal size increase.*/
#define DROPBEAR_AES128
-#define DROPBEAR_3DES
+/*#define DROPBEAR_3DES*/
Disable telnet in favor of passwordless SSH This enables passworldless login for root via SSH whenever no root password is set (e.g. after reset, flashing without keeping config or in failsafe) and removes telnet support alltogether. Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46809
2015-09-07 19:29:25 +00:00
#define DROPBEAR_AES256
/* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
/*#define DROPBEAR_BLOWFISH*/
-#define DROPBEAR_TWOFISH256
-#define DROPBEAR_TWOFISH128
+/*#define DROPBEAR_TWOFISH256*/
+/*#define DROPBEAR_TWOFISH128*/
/* Enable CBC mode for ciphers. This has security issues though
* is the most compatible with older SSH implementations */
dropbear: disable 3des, cbc mode, dss support, saves about 5k gzipped While technically required by the RFC, they are usually completely unused (DSA), or have security issues (3DES, CBC) Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 46814
2015-09-08 08:55:10 +00:00
-#define DROPBEAR_ENABLE_CBC_MODE
+/*#define DROPBEAR_ENABLE_CBC_MODE*/
/* Enable "Counter Mode" for ciphers. This is more secure than normal
* CBC mode against certain attacks. It is recommended for security
dropbear: disable MD5 HMAC and switch to sha1 fingerprints As MD5 is known weak for many years and more and more penetration test tools complain about enabled MD5 HMAC I think it's time to drop it. By disabling the MD5 HMAC support dropbear will also automatically use SHA1 for fingerprints. This shouldn't be a problem too. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
2017-11-22 12:39:51 +00:00
@@ -131,10 +131,10 @@ If you test it please contact the Dropbe
tune some more options by default to decrease size SVN-Revision: 25831
2011-03-02 14:51:45 +00:00
* If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
* which are not the standard form. */
#define DROPBEAR_SHA1_HMAC
-#define DROPBEAR_SHA1_96_HMAC
+/*#define DROPBEAR_SHA1_96_HMAC*/
dropbear: enable SHA256 HMACs The only HMACs currently available use MD5 and SHA1, both of which have known weaknesses. We already compile in the SHA256 code since we use Curve25519 by default, so there's no significant size penalty to enabling this. Signed-off-by: Joseph C. Sible <josephcsible@users.noreply.github.com>
2017-02-02 06:51:51 +00:00
#define DROPBEAR_SHA2_256_HMAC
-#define DROPBEAR_SHA2_512_HMAC
dropbear: disable MD5 HMAC and switch to sha1 fingerprints As MD5 is known weak for many years and more and more penetration test tools complain about enabled MD5 HMAC I think it's time to drop it. By disabling the MD5 HMAC support dropbear will also automatically use SHA1 for fingerprints. This shouldn't be a problem too. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
2017-11-22 12:39:51 +00:00
-#define DROPBEAR_MD5_HMAC
dropbear: update to 2015.67 fixes dbclient login into OpenSSH 6.8p1 error: "Bad hostkey signature" reported on irc, replicated with Arch Linux Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de> SVN-Revision: 45493
2015-04-18 11:25:01 +00:00
+/*#define DROPBEAR_SHA2_512_HMAC*/
dropbear: disable MD5 HMAC and switch to sha1 fingerprints As MD5 is known weak for many years and more and more penetration test tools complain about enabled MD5 HMAC I think it's time to drop it. By disabling the MD5 HMAC support dropbear will also automatically use SHA1 for fingerprints. This shouldn't be a problem too. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
2017-11-22 12:39:51 +00:00
+/*#define DROPBEAR_MD5_HMAC*/
dropbear: update to 2015.67 fixes dbclient login into OpenSSH 6.8p1 error: "Bad hostkey signature" reported on irc, replicated with Arch Linux Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de> SVN-Revision: 45493
2015-04-18 11:25:01 +00:00
/* You can also disable integrity. Don't bother disabling this if you're
dropbear: disable MD5 HMAC and switch to sha1 fingerprints As MD5 is known weak for many years and more and more penetration test tools complain about enabled MD5 HMAC I think it's time to drop it. By disabling the MD5 HMAC support dropbear will also automatically use SHA1 for fingerprints. This shouldn't be a problem too. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
2017-11-22 12:39:51 +00:00
* still using a cipher, it's relatively cheap. If you disable this it's dead
dropbear: disable 3des, cbc mode, dss support, saves about 5k gzipped While technically required by the RFC, they are usually completely unused (DSA), or have security issues (3DES, CBC) Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 46814
2015-09-08 08:55:10 +00:00
@@ -146,7 +146,7 @@ If you test it please contact the Dropbe
* Removing either of these won't save very much space.
* SSH2 RFC Draft requires dss, recommends rsa */
#define DROPBEAR_RSA
-#define DROPBEAR_DSS
+/*#define DROPBEAR_DSS*/
/* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
* code (either ECDSA or ECDH) increases binary size - around 30kB
* on x86-64 */
dropbear: update to 2016.73 Update the dropbear package to version 2016.73, refresh patches. The measured .ipk sizes on an x86_64 build are: 94588 dropbear_2015.71-3_x86_64.ipk 95316 dropbear_2016.73-1_x86_64.ipk This is an increase of roughly 700 bytes after compression. Tested-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2016-05-12 08:21:23 +00:00
@@ -194,7 +194,7 @@ If you test it please contact the Dropbe
tune some more options by default to decrease size SVN-Revision: 25831
2011-03-02 14:51:45 +00:00
/* Whether to print the message of the day (MOTD). This doesn't add much code
* size */
-#define DO_MOTD
+/*#define DO_MOTD*/
/* The MOTD file path */
#ifndef MOTD_FILENAME
dropbear: update to 2016.73 Update the dropbear package to version 2016.73, refresh patches. The measured .ipk sizes on an x86_64 build are: 94588 dropbear_2015.71-3_x86_64.ipk 95316 dropbear_2016.73-1_x86_64.ipk This is an increase of roughly 700 bytes after compression. Tested-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2016-05-12 08:21:23 +00:00
@@ -242,7 +242,7 @@ Homedir is prepended unless path begins
tune some more options by default to decrease size SVN-Revision: 25831
2011-03-02 14:51:45 +00:00
* note that it will be provided for all "hidden" client-interactive
* style prompts - if you want something more sophisticated, use
* SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
-#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
+/*#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"*/
/* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of
* a helper program for the ssh client. The helper program should be
Reference in a new issue Copy permalink