ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-24 15:56:49 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity
c87a192386
openwrt/package/network/services/dropbear/Config.in

198 lines
4.8 KiB
Plaintext
Raw Normal View History

dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
menu "Configuration"
depends on PACKAGE_dropbear
dropbear: split out curve25519 support into a separate config option Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48195
2016-01-10 22:38:53 +00:00
config DROPBEAR_CURVE25519
bool "Curve25519 support"
dropbear: enable curve25519 support by default, increases compressed binary size by ~5 kb Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48196
2016-01-10 22:38:59 +00:00
default y
dropbear: split out curve25519 support into a separate config option Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48195
2016-01-10 22:38:53 +00:00
help
This enables the following key exchange algorithm:
curve25519-sha256@libssh.org
dropbear: add ed25519 and chacha20-poly1305 - add Ed25519 support (backport): * DROPBEAR_ED25519 option for ssh-ed25519, * disabled by default - add Chacha20-Poly1305 support (backport): * DROPBEAR_CHACHA20POLY1305 for chacha20-poly1305@openssh.com, * enabled by default - update feature costs in binary size Signed-off-by: Vladislav Grishenko <themiron@mail.ru>
2020-04-12 22:24:28 +00:00
Increases binary size by about 4 kB (MIPS).
dropbear: split out curve25519 support into a separate config option Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48195
2016-01-10 22:38:53 +00:00
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
config DROPBEAR_ECC
bool "Elliptic curve cryptography (ECC)"
help
dropbear: split ECC support to basic and full - limit ECC support to ec*-sha2-nistp256: * DROPBEAR_ECC now provides only basic support for ECC - provide full ECC support as an option: * DROPBEAR_ECC_FULL brings back support for ec{dh,dsa}-sha2-nistp{384,521} - update feature costs in binary size Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2019-03-25 19:00:28 +00:00
Enables basic support for elliptic curve cryptography (ECC)
in key exchange and public key authentication.
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
Key exchange algorithms:
ecdh-sha2-nistp256
dropbear: split ECC support to basic and full - limit ECC support to ec*-sha2-nistp256: * DROPBEAR_ECC now provides only basic support for ECC - provide full ECC support as an option: * DROPBEAR_ECC_FULL brings back support for ec{dh,dsa}-sha2-nistp{384,521} - update feature costs in binary size Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2019-03-25 19:00:28 +00:00
Public key algorithms:
ecdsa-sha2-nistp256
Increases binary size by about 24 kB (MIPS).
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
Note: select DROPBEAR_ECC_FULL if full ECC support is required.
dropbear: split ECC support to basic and full - limit ECC support to ec*-sha2-nistp256: * DROPBEAR_ECC now provides only basic support for ECC - provide full ECC support as an option: * DROPBEAR_ECC_FULL brings back support for ec{dh,dsa}-sha2-nistp{384,521} - update feature costs in binary size Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2019-03-25 19:00:28 +00:00
config DROPBEAR_ECC_FULL
bool "Elliptic curve cryptography (ECC), full support"
depends on DROPBEAR_ECC
help
Enables full support for elliptic curve cryptography (ECC)
in key exchange and public key authentication.
Key exchange algorithms:
ecdh-sha2-nistp256 (*)
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
ecdh-sha2-nistp384
ecdh-sha2-nistp521
Public key algorithms:
dropbear: split ECC support to basic and full - limit ECC support to ec*-sha2-nistp256: * DROPBEAR_ECC now provides only basic support for ECC - provide full ECC support as an option: * DROPBEAR_ECC_FULL brings back support for ec{dh,dsa}-sha2-nistp{384,521} - update feature costs in binary size Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2019-03-25 19:00:28 +00:00
ecdsa-sha2-nistp256 (*)
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
dropbear: split ECC support to basic and full - limit ECC support to ec*-sha2-nistp256: * DROPBEAR_ECC now provides only basic support for ECC - provide full ECC support as an option: * DROPBEAR_ECC_FULL brings back support for ec{dh,dsa}-sha2-nistp{384,521} - update feature costs in binary size Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2019-03-25 19:00:28 +00:00
(*) - basic ECC support; provided by DROPBEAR_ECC.
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
dropbear: split ECC support to basic and full - limit ECC support to ec*-sha2-nistp256: * DROPBEAR_ECC now provides only basic support for ECC - provide full ECC support as an option: * DROPBEAR_ECC_FULL brings back support for ec{dh,dsa}-sha2-nistp{384,521} - update feature costs in binary size Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2019-03-25 19:00:28 +00:00
Increases binary size by about 4 kB (MIPS).
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
dropbear: add ed25519 and chacha20-poly1305 - add Ed25519 support (backport): * DROPBEAR_ED25519 option for ssh-ed25519, * disabled by default - add Chacha20-Poly1305 support (backport): * DROPBEAR_CHACHA20POLY1305 for chacha20-poly1305@openssh.com, * enabled by default - update feature costs in binary size Signed-off-by: Vladislav Grishenko <themiron@mail.ru>
2020-04-12 22:24:28 +00:00
config DROPBEAR_ED25519
bool "Ed25519 support"
dropbear: Enable Ed25519 for normal devices The Ed25519 key pairs are much shorter than RSA pairs and are supported by default in OpenSSH. Looking at websites explaining how to create new SSH keys, many suggest using Ed25519 rather than RSA, however consider the former as not yet widely established. OpenWrt likely has a positive influence on that development. As enabling Ed25519 is a compile time option, it is currently not possible to install the feature via `opkg` nor select that option in an ImageBuilder. Due to the size impact of **12kB** the option should only be enabled for devices with `!SMALL_FLASH`. This approach seems cleaner than splitting `dropbear` into two packages like `dropbear` and `dropbear-ed25519`. Signed-off-by: Paul Spooren <mail@aparcar.org>
2020-09-01 19:13:28 +00:00
default y if !SMALL_FLASH
dropbear: add ed25519 and chacha20-poly1305 - add Ed25519 support (backport): * DROPBEAR_ED25519 option for ssh-ed25519, * disabled by default - add Chacha20-Poly1305 support (backport): * DROPBEAR_CHACHA20POLY1305 for chacha20-poly1305@openssh.com, * enabled by default - update feature costs in binary size Signed-off-by: Vladislav Grishenko <themiron@mail.ru>
2020-04-12 22:24:28 +00:00
help
This enables the following public key algorithm:
ssh-ed25519
Increases binary size by about 12 kB (MIPS).
config DROPBEAR_CHACHA20POLY1305
bool "Chacha20-Poly1305 support"
default y
help
This enables the following authenticated encryption cipher:
chacha20-poly1305@openssh.com
Increases binary size by about 4 kB (MIPS).
dropbear: split U2F/FIDO support these options allow one to configure U2F/FIDO support in more granular way inspired by upstream commit aa6559db Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
config DROPBEAR_U2F
bool "U2F/FIDO support"
default y
help
This option itself doesn't enable any support for U2F/FIDO
but subordinate options do:
- DROPBEAR_ECDSA_SK - ecdsa-sk keys support
depends on DROPBEAR_ECC ("Elliptic curve cryptography (ECC)")
- DROPBEAR_ED25519_SK - ed25519-sk keys support
depends on DROPBEAR_ED25519 ("Ed25519 support")
config DROPBEAR_ECDSA_SK
bool "ECDSA-SK support"
default y
depends on DROPBEAR_U2F && DROPBEAR_ECC
help
This enables the following public key algorithm:
sk-ecdsa-sha2-nistp256@openssh.com
config DROPBEAR_ED25519_SK
bool "Ed25519-SK support"
default y
depends on DROPBEAR_U2F && DROPBEAR_ED25519
help
This enables the following public key algorithm:
sk-ssh-ed25519@openssh.com
dropbear: make ssh compression support configurable Adds config option to enable compression support which is usefull when using a terminal sessions over a slow link. Impact on binary size is negligible but additional 60 kB (uncompressed) is needed for a shared zlib library. Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
2017-06-30 11:13:50 +00:00
config DROPBEAR_ZLIB
bool "Enable compression"
help
Enables compression using shared zlib library.
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
Increases binary size by about 0.1 kB (MIPS) and requires
additional 62 kB (MIPS) for a shared zlib library.
dropbear: make ssh compression support configurable Adds config option to enable compression support which is usefull when using a terminal sessions over a slow link. Impact on binary size is negligible but additional 60 kB (uncompressed) is needed for a shared zlib library. Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
2017-06-30 11:13:50 +00:00
dropbear: Make utmp and putuline support configurable via seperate config options Utmp support tracks who is currenlty logged in by logging info to the file /var/run/utmp (supported by busybox) Putuline support will use the utmp structure to write to the utmp file Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2016-04-27 09:13:58 +00:00
config DROPBEAR_UTMP
bool "Utmp support"
depends on BUSYBOX_CONFIG_FEATURE_UTMP
help
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
This enables dropbear utmp support, the file /var/run/utmp is
used to track who is currently logged in.
dropbear: Make utmp and putuline support configurable via seperate config options Utmp support tracks who is currenlty logged in by logging info to the file /var/run/utmp (supported by busybox) Putuline support will use the utmp structure to write to the utmp file Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2016-04-27 09:13:58 +00:00
config DROPBEAR_PUTUTLINE
bool "Pututline support"
depends on DROPBEAR_UTMP
help
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
Dropbear will use pututline() to write the utmp structure into
the utmp file.
dropbear: Make utmp and putuline support configurable via seperate config options Utmp support tracks who is currenlty logged in by logging info to the file /var/run/utmp (supported by busybox) Putuline support will use the utmp structure to write to the utmp file Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2016-04-27 09:13:58 +00:00
dropbear: allow build without dbclient This can save ~16KBytes size for the ipk Signed-off-by: Rosy Song <rosysong@rosinson.com>
2019-04-18 02:20:19 +00:00
config DROPBEAR_DBCLIENT
bool "Build dropbear with dbclient"
default y
dropbear: add config options for agent-forwarding support * SSH agent forwarding might cause security issues, locally and on the jump machine (https://defn.io/2019/04/12/ssh-forwarding/). So allow to completely disabling it. * separate options for client and server * keep it enabled by default Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
2021-07-15 22:44:53 +00:00
config DROPBEAR_DBCLIENT_AGENTFORWARD
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
bool "Enable agent forwarding in dbclient [LEGACY/SECURITY]"
dropbear: add config options for agent-forwarding support * SSH agent forwarding might cause security issues, locally and on the jump machine (https://defn.io/2019/04/12/ssh-forwarding/). So allow to completely disabling it. * separate options for client and server * keep it enabled by default Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
2021-07-15 22:44:53 +00:00
default y
depends on DROPBEAR_DBCLIENT
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
help
Increases binary size by about 0.1 kB (MIPS).
Security notes:
SSH agent forwarding might cause security issues (locally and
on the jump machine).
Hovewer, it's enabled by default for compatibility with
previous OpenWrt/dropbear releases.
Consider DISABLING this option if you're building own OpenWrt
image.
Also see DROPBEAR_AGENTFORWARD (agent forwarding in dropbear
server itself).
dropbear: add config options for agent-forwarding support * SSH agent forwarding might cause security issues, locally and on the jump machine (https://defn.io/2019/04/12/ssh-forwarding/). So allow to completely disabling it. * separate options for client and server * keep it enabled by default Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
2021-07-15 22:44:53 +00:00
dropbear: allow disabling support for scp If not needed, disabling scp allows for a nice size reduction. Dropbear executable size comparison: 153621 bytes (baseline) 133077 bytes (without scp) In other words, we trim a total of 20544 bytes. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
2020-08-15 10:10:22 +00:00
config DROPBEAR_SCP
bool "Build dropbear with scp"
default y
dropbear: add ssh-askpass support in configuration binary size cost is much less than 1k. tested on ath79/generic: bin: 215128 -> 215132 (+4b) ipk: 111183 -> 111494 (+311b) Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2020-11-25 03:14:30 +00:00
config DROPBEAR_ASKPASS
bool "Enable askpass helper support"
depends on DROPBEAR_DBCLIENT
help
This enables support for ssh-askpass helper in dropbear client
in order to authenticate on remote hosts.
Increases binary size by about 0.1 kB (MIPS).
dropbear: add config options for agent-forwarding support * SSH agent forwarding might cause security issues, locally and on the jump machine (https://defn.io/2019/04/12/ssh-forwarding/). So allow to completely disabling it. * separate options for client and server * keep it enabled by default Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
2021-07-15 22:44:53 +00:00
config DROPBEAR_AGENTFORWARD
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
bool "Enable agent forwarding [LEGACY/SECURITY]"
dropbear: add config options for agent-forwarding support * SSH agent forwarding might cause security issues, locally and on the jump machine (https://defn.io/2019/04/12/ssh-forwarding/). So allow to completely disabling it. * separate options for client and server * keep it enabled by default Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
2021-07-15 22:44:53 +00:00
default y
dropbear: minor config clarification - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
help
Increases binary size by about 0.1 kB (MIPS).
Security notes:
SSH agent forwarding might cause security issues (locally and
on the jump machine).
Hovewer, it's enabled by default for compatibility with
previous OpenWrt/dropbear releases.
Consider DISABLING this option if you're building own OpenWrt
image.
Also see DROPBEAR_DBCLIENT_AGENTFORWARD (agent forwarding in
dropbear client) if DROPBEAR_DBCLIENT is selected.
dropbear: add config options for agent-forwarding support * SSH agent forwarding might cause security issues, locally and on the jump machine (https://defn.io/2019/04/12/ssh-forwarding/). So allow to completely disabling it. * separate options for client and server * keep it enabled by default Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
2021-07-15 22:44:53 +00:00
dropbear: add option to enable modern crypto only reduces binary/package size and increases overall performance also: - adjust 910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch to build without DROPBEAR_RSA/DROPBEAR_RSA_SHA256 Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2024-01-09 00:40:01 +00:00
config DROPBEAR_MODERN_ONLY
bool "Use modern crypto only [BREAKS COMPATIBILITY]"
select DROPBEAR_ED25519
select DROPBEAR_CURVE25519
select DROPBEAR_CHACHA20POLY1305
help
This option enables:
- Chacha20-Poly1305
- Curve25519
- Ed25519
and disables:
- AES
- RSA
- SHA1
Reduces binary size by about 64 kB (MIPS) from default
configuration.
Consider enabling this option if you're building own OpenWrt
image and using modern SSH software everywhere.
dropbear: update to 2014.63 Upstream changelog: https://matt.ucc.asn.au/dropbear/CHANGES This adds elliptic curve cryptography (ECC) support as an option, disabled by default. dropbear mips 34kc uClibc binary size: before: 161,672 bytes after, without ECC (default): 164,968 after, with ECC: 198,008 Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 40297
2014-03-29 16:59:26 +00:00
endmenu
Reference in New Issue Copy Permalink