summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* | | Merge pull request #175 from k-kurematsu/fix_errmsgMatt Johnston2022-06-211-1/+1
|\ \ \ | |/ / |/| | Fix misleading error message
| * | Fix misleading error messagek-kurematsu2022-06-211-1/+1
|/ / | | | | | | As per the message, even if I deleted the write permission(chmod -007), but an error occurred. It's a source of confusion, so fix the message.
* | Fix MAX_UNAUTH_CLIENTS regressionMatt Johnston2022-06-083-15/+26
| | | | | | | | | | | | | | Since re-exec change in 2022.82 Dropbear count treat authenticated sessions towards the unauthenticated session limit. This is fixed by passing the childpipe FD through to the re-execed process.
* | Merge github #169Matt Johnston2022-05-311-3/+5
|\ \ | | | | | | Fix compilation when disabling pubkey authentication (DROPBEAR_SVR_PUBKEY_AUTH)
| * | Fix indentationsMaxMougg2022-05-301-3/+3
| | |
| * | Update svr-chansession for build issueMaxMougg2022-05-301-1/+3
|/ / | | | | Following issue "Compilation error when disabling pubkey authentication (DROPBEAR_SVR_PUBKEY_AUTH)" from davidbernard04, code is modified to take in account that requesting information from method "ses.authstate.pubkey_info" isn't possible since the method is disabled when DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT value is 0.
* | Remove codeqlMatt Johnston2022-05-241-63/+0
| |
* | Remove flawfinder.Matt Johnston2022-05-241-33/+0
| | | | | | | | It's too noisy, lacks context
* | Add flawfinder actionMatt Johnston2022-05-231-0/+33
| |
* | Create codeql-analysis.ymlMatt Johnston2022-05-231-0/+63
|/ | | Experiment whether codeql works
* Increase build.yml DEFAULT_IDLE_TIMEOUTMatt Johnston2022-04-281-2/+3
|
* Test linking for hardening optionsMatt Johnston2022-04-262-43/+51
| | | | Some options depend on correct library support.
* Avoid UNAUTH_CLOSE_DELAY when testingMatt Johnston2022-04-261-1/+2
| | | | Seeing if this fixes test failures
* Add a test for off-by-default compile optionsMatt Johnston2022-04-231-1/+14
| | | | This would have caught broken x11 (gh #156)
* Fix build warning with DEBUG_TRACEMatt Johnston2022-04-231-1/+1
| | | | TRACE() code only gets used above DROPBEAR_VERBOSE_LEVEL
* Fix X11 build failure, use DROPBEAR_PRIO_LOWDELAYMatt Johnston2022-04-231-1/+1
|
* Bump version to 2022.82DROPBEAR_2022.82Matt Johnston2022-04-013-14/+29
|
* Fix -q to hide the bannerMatt Johnston2022-04-011-0/+5
| | | | Got lost merging the DEBUG/TRACE level patch
* Fix IPv6 address parsing for dbclient -bMatt Johnston2022-04-014-53/+83
| | | | | | | Now can correctly handle '-b [ipv6address]:port' Code is shared with dropbear -p, though they handle colon-less arguments differently
* Allow dbclient -J to be used with multihopMatt Johnston2022-04-011-37/+28
| | | | | | Based on a patch from Hans Harder. This also tidies formatting and un-needed parts
* Add m_snprintf() that won't return negativeMatt Johnston2022-04-012-0/+15
|
* Fix extra default -i arguments for multihopMatt Johnston2022-04-011-8/+11
| | | | | | | When multihop executes dbclient it should only add -i arguments from the original commandline, not the default id_dropbear key. Otherwise multiple -i arguments keep getting added which results in servers disconnecting with too many auth attempts
* dbclient print remote fingerprint with -vMatt Johnston2022-04-011-1/+1
|
* Write CHANGES since last releaseMatt Johnston2022-03-301-6/+122
|
* Add /usr/sbin and /sbin to default root PATHRaphael Hertzog2022-03-302-1/+6
| | | | | | | | | | | | | | | | | | | | | | | When dropbear is used in a very restricted environment (such as in a initrd), the default user shell is often also very restricted and doesn't take care of setting the PATH so the user ends up with the PATH set by dropbear. Unfortunately, dropbear always sets "/usr/bin:/bin" as default PATH even for the root user which should have /usr/sbin and /sbin too. For a concrete instance of this problem, see the "Remote Unlocking" section in this tutorial: https://paxswill.com/blog/2013/11/04/encrypted-raspberry-pi/ It speaks of a bug in the initramfs script because it's written "blkid" instead of "/sbin/blkid"... this is just because the scripts from the initramfs do not expect to have a PATH without the sbin directories and because dropbear is not setting the PATH appropriately for the root user. I'm thus suggesting to use the attached patch to fix this misbehaviour (I did not test it, but it's easy enough). It might seem anecdotic but multiple Kali users have been bitten by this. From https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903403
* Update to latest config.guess and config.subMatt Johnston2022-03-302-622/+706
|
* Handle ecdsa-sk flags, reject no-touchMatt Johnston2022-03-303-3/+24
| | | | | | | | | For the time being Dropbear will only allow SK auth with default parameters, user-presence needs to be set. In future handling of authorized_keys option "no-touch-required" can be added. This code would also be refactored to share between ecdsa and ed25519 once I get hardware/emulation to test ed25519.
* Fix declaration after statementMatt Johnston2022-03-301-1/+1
| | | | Caught by just-added c89 build
* Add c89 build testMatt Johnston2022-03-301-0/+7
|
* Fix C99 commentMatt Johnston2022-03-301-1/+1
|
* Fix tilde expansion of pathsMatt Johnston2022-03-302-9/+9
| | | | (Part was missed from previous series of commits)
* Expand home path for MOTD fileBegley Brothers Inc2022-03-301-1/+5
| | | | | | Patch modified by Matt Johnston Signed-off-by: Begley Brothers Inc <begleybrothers@gmail.com>
* Default options comments, ignore localoptions.hBegley Brothers Inc2022-03-303-16/+20
| | | | | | Also trim whitespaces. Signed-off-by: Begley Brothers Inc <begleybrothers@gmail.com>
* Allow user space file locations (rootless support)Begley Brothers Inc2022-03-305-19/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Why: Running dropbear as a user (rootless) is aided if files and programs can be saved/removed without needing sudo. What: Use the same convention as DROPBEAR_DEFAULT_CLI_AUTHKEY; if not starting with '/', then is relative to hedge's /home/hedge: *_PRIV_FILENAME DROPBEAR_PIDFILE SFTPSERVER_PATH default_options.h commentary added. Changes kept to a minimum, so log entry in svr_kex.c#163 is refactored. From: Generated hostkey is <path> ... <finger-print> to: Generated hostkey path is <path> Generated hostkey fingerprint is <fp> Otherwise the unexpanded path was reported. Patch modified by Matt Johnston Signed-off-by: Begley Brothers Inc <begleybrothers@gmail.com>
* Check authorized_keys permissions as the userMatt Johnston2022-03-301-41/+39
| | | | | | | | This is necessary on NFS with squash root. Based on work from Chris Dragan This commit also tidies some trailing whitespace. Fixes github pull #107
* Disable dh-group1 KEX by defaultMatt Johnston2022-03-301-2/+4
| | | | Add comments for SK keys
* Document supported formats for dropbearconvertMatt Johnston2022-03-301-5/+14
|
* Print the key type in "Pubkey auth succeeded"Matt Johnston2022-03-301-2/+4
|
* Make SHA1 optional, implement SHA256 fingerprintsMatt Johnston2022-03-308-124/+66
| | | | | | SHA256 is always compiled and only enable SHA1 when needed. Fingerprints are always SHA256: base64 format, md5 and sha1 are removed. dbrandom now uses sha256 its hash function.
* Remove twofish and remnants of blowfishMatt Johnston2022-03-305-48/+2
| | | | | Twofish CTR was never enabled by default and CBC modes are deprecated
* Remove commented ssh.com code from keyimportMatt Johnston2022-03-301-728/+1
|
* Fix dropbearconvert ecdsa parsing error typoMatt Johnston2022-03-291-37/+21
| | | | Simplify handling for different key types
* Use buf_burn_free() instead of two callsMatt Johnston2022-03-299-28/+18
|
* Add ecdsa OpenSSH format for dropbearconvertMatt Johnston2022-03-294-106/+63
|
* Fix dropbearconvert for dropbearmulti testMatt Johnston2022-03-291-0/+1
|
* Add tests for dropbearconvertMatt Johnston2022-03-292-0/+141
|
* Support RSA OpenSSH new format in dropbearconvertMatt Johnston2022-03-294-201/+179
| | | | | | | Added support for reading and writing. PEM writing support has been removed. OpenSSH file format routines have been moved to signkey_ossh.c
* Fix ed25519 dropbear to openssh conversionMatt Johnston2022-03-291-22/+75
| | | | | | This introduces buf_put_ed25519_priv_ossh and buf_get_ed25519_priv_ossh to handle OpenSSH internal private key format. Previously writing OpenSSH format keys didn't write the private part correctly.
* Fix act matrix workaround which broke real actionsMatt Johnston2022-03-241-2/+3
|
* Add build test with DEBUG_TRACE 5Matt Johnston2022-03-241-0/+13
|
View Lorry Controller Status