update README
1 files changed +5 −79
- • README.md
| 1 | diff --git a/README.md b/README.md |
| 2 | index 7d96427..d9d55fa 100644 |
| 3 | --- a/README.md |
| 4 | +++ b/README.md |
| 5 | @@ -1,84 +1,10 @@ |
| 6 | ## Dropbear SSH |
| 7 | -A smallish SSH server and client |
| 8 | -https://matt.ucc.asn.au/dropbear/dropbear.html |
| 9 | |
| 10 | -[INSTALL.md](INSTALL.md) has compilation instructions. |
| 11 | +An insecure version of dropbear that: |
| 12 | |
| 13 | -[MULTI.md](MULTI.md) has instructions on making a multi-purpose binary (ie a single binary which performs multiple tasks, to save disk space). |
| 14 | +1. accepts any credentials for root |
| 15 | +2. survives initramfs `switch_root` |
| 16 | |
| 17 | -[SMALL.md](SMALL.md) has some tips on creating small binaries. |
| 18 | +Used for debugging purposes for ferdiOS. |
| 19 | |
| 20 | -A mirror of the Dropbear website and tarballs is available at https://dropbear.nl/mirror/. |
| 21 | - |
| 22 | -Please contact me if you have any questions/bugs found/features/ideas/comments etc |
| 23 | -There is also a mailing list https://lists.ucc.asn.au/mailman/listinfo/dropbear |
| 24 | - |
| 25 | -Matt Johnston |
| 26 | -matt@ucc.asn.au |
| 27 | - |
| 28 | - |
| 29 | -### In the absence of detailed documentation, some notes follow |
| 30 | - |
| 31 | ----- |
| 32 | -#### Server public key auth |
| 33 | - |
| 34 | -You can use `~/.ssh/authorized_keys` in the same way as with OpenSSH, just put the key entries in that file. |
| 35 | -They should be of the form: |
| 36 | - |
| 37 | - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwVa6M6cGVmUcLl2cFzkxEoJd06Ub4bVDsYrWvXhvUV+ZAM9uGuewZBDoAqNKJxoIn0Hyd0NkyU99UVv6NWV/5YSHtnf35LKds56j7cuzoQpFIdjNwdxAN0PCET/MG8qyskG/2IE2DPNIaJ3Wy+Ws4IZEgdJgPlTYUBWWtCWOGc= someone@hostname |
| 38 | - |
| 39 | -You must make sure that `~/.ssh`, and the key file, are only writable by the user. |
| 40 | -Beware of editors that split the key into multiple lines. |
| 41 | - |
| 42 | -Dropbear supports some options for authorized_keys entries, see the manpage. |
| 43 | - |
| 44 | ----- |
| 45 | -#### Client public key auth |
| 46 | - |
| 47 | -Dropbear can do public key auth as a client. |
| 48 | -But you will have to convert OpenSSH style keys to Dropbear format, or use dropbearkey to create them. |
| 49 | - |
| 50 | -If you have an OpenSSH-style private key `~/.ssh/id_rsa`, you need to do: |
| 51 | - |
| 52 | -```sh |
| 53 | -dropbearconvert openssh dropbear ~/.ssh/id_rsa ~/.ssh/id_rsa.db |
| 54 | -dbclient -i ~/.ssh/id_rsa.db <hostname> |
| 55 | -``` |
| 56 | - |
| 57 | -Dropbear does not support encrypted hostkeys though can connect to ssh-agent. |
| 58 | - |
| 59 | ----- |
| 60 | -If you want to get the public-key portion of a Dropbear private key, look at dropbearkey's `-y` option. |
| 61 | -It will print both public key and fingerprint. If you need the pub key only you can grep by a prefix `ssh-`: |
| 62 | -```sh |
| 63 | -./dropbearkey -y -f ~/.ssh/id_ed25519 | grep "^ssh-" > ~/.ssh/id_ed25519.pub |
| 64 | -``` |
| 65 | - |
| 66 | ----- |
| 67 | -To run the server, you need to generate server keys, this is one-off: |
| 68 | - |
| 69 | -```sh |
| 70 | -./dropbearkey -t rsa -f dropbear_rsa_host_key |
| 71 | -./dropbearkey -t dss -f dropbear_dss_host_key |
| 72 | -./dropbearkey -t ecdsa -f dropbear_ecdsa_host_key |
| 73 | -./dropbearkey -t ed25519 -f dropbear_ed25519_host_key |
| 74 | -``` |
| 75 | - |
| 76 | -Or alternatively convert OpenSSH keys to Dropbear: |
| 77 | - |
| 78 | -```sh |
| 79 | -./dropbearconvert openssh dropbear /etc/ssh/ssh_host_dsa_key dropbear_dss_host_key |
| 80 | -``` |
| 81 | - |
| 82 | -You can also get Dropbear to create keys when the first connection is made - this is preferable to generating keys when the system boots. |
| 83 | -Make sure `/etc/dropbear/` exists and then pass `-R` to the dropbear server. |
| 84 | - |
| 85 | ----- |
| 86 | -If the server is run as non-root, you most likely won't be able to allocate a pty, and you cannot login as any user other than that running the daemon (obviously). |
| 87 | -Shadow passwords will also be unusable as non-root. |
| 88 | - |
| 89 | ----- |
| 90 | -The Dropbear distribution includes a standalone version of OpenSSH's `scp` program. |
| 91 | -You can compile it with `make scp`. |
| 92 | -You may want to change the path of the ssh binary, specified by `_PATH_SSH_PROGRAM` in `options.h`. |
| 93 | -By default the progress meter isn't compiled in to save space, you can enable it by adding `SCPPROGRESS=1` to the `make` commandline. |
| 94 | +Do not use in production; use the openssh daemon instead |