diff options
| -rw-r--r-- | package/dropbear/Makefile | 11 | ||||
| -rw-r--r-- | package/dropbear/files/dropbear.init | 8 | ||||
| -rw-r--r-- | package/dropbear/patches/patch-Makefile_in | 35 | ||||
| -rw-r--r-- | package/dropbear/patches/patch-svr-authpubkey_c | 109 | ||||
| -rw-r--r-- | target/config/Config.in.runtime | 2 |
5 files changed, 7 insertions, 158 deletions
diff --git a/package/dropbear/Makefile b/package/dropbear/Makefile index 93ec5e548..8f12d4cf4 100644 --- a/package/dropbear/Makefile +++ b/package/dropbear/Makefile @@ -4,9 +4,9 @@ include $(ADK_TOPDIR)/rules.mk PKG_NAME:= dropbear -PKG_VERSION:= 2020.81 -PKG_RELEASE:= 4 -PKG_HASH:= 48235d10b37775dbda59341ac0c4b239b82ad6318c31568b985730c788aac53b +PKG_VERSION:= 2022.83 +PKG_RELEASE:= 1 +PKG_HASH:= bc5a121ffbc94b5171ad5ebe01be42746d50aa797c9549a4639894a16749443b PKG_DESCR:= ssh server/client designed for embedded systems PKG_SECTION:= net/security PKG_URL:= http://matt.ucc.asn.au/dropbear/ @@ -39,6 +39,7 @@ CONFIGURE_ARGS+= --disable-pam \ --disable-wtmpx \ --disable-loginfunc \ --disable-pututxline \ + --disable-harden \ --disable-zlib ifeq (${ADK_PACKAGE_DROPBEAR_WITH_UTMP},) CONFIGURE_ARGS+= --disable-utmp --disable-pututline @@ -75,9 +76,9 @@ do-install: $(IDIR_DBCONVERT)/usr/bin/dropbearconvert # ssh pubkey test -z $(ADK_RUNTIME_SSH_PUBKEY) || ( \ - $(INSTALL_DIR) $(IDIR_DROPBEAR)/etc/dropbear; \ + $(INSTALL_DIR) $(IDIR_DROPBEAR)/root; \ echo $(ADK_RUNTIME_SSH_PUBKEY) \ - >$(IDIR_DROPBEAR)/etc/dropbear/authorized_keys; \ + >$(IDIR_DROPBEAR)/root/.authorized_keys; \ ) include ${ADK_TOPDIR}/mk/pkg-bottom.mk diff --git a/package/dropbear/files/dropbear.init b/package/dropbear/files/dropbear.init index 15bb561df..3e464e34b 100644 --- a/package/dropbear/files/dropbear.init +++ b/package/dropbear/files/dropbear.init @@ -24,14 +24,6 @@ start) test $rv = 0 || exit 1 test -f /etc/dropbear/dropbear_rsa_host_key || exit 1 fi - if test ! -f /etc/dropbear/dropbear_dss_host_key; then - # take it easy here, since above already catched the worst cases - if test -x /usr/bin/dropbearkey; then - echo "dropbear: generating SSH private key (DSS)" - /usr/bin/dropbearkey -f /etc/dropbear/dropbear_dss_host_key -t dss - echo "dropbear: key generation exited with code $?" - fi - fi if test ! -f /etc/dropbear/dropbear_ecdsa_host_key; then # take it easy here, since above already catched the worst cases if test -x /usr/bin/dropbearkey; then diff --git a/package/dropbear/patches/patch-Makefile_in b/package/dropbear/patches/patch-Makefile_in deleted file mode 100644 index b0b77949a..000000000 --- a/package/dropbear/patches/patch-Makefile_in +++ /dev/null @@ -1,35 +0,0 @@ ---- dropbear-2020.81.orig/Makefile.in 2020-10-29 14:35:50.000000000 +0100 -+++ dropbear-2020.81/Makefile.in 2020-11-04 03:02:49.901343218 +0100 -@@ -106,10 +106,10 @@ AR=@AR@ - RANLIB=@RANLIB@ - STRIP=@STRIP@ - INSTALL=@INSTALL@ --CPPFLAGS=@CPPFLAGS@ --CFLAGS+=-I. -I$(srcdir) $(CPPFLAGS) @CFLAGS@ --LIBS+=@LIBS@ --LDFLAGS=@LDFLAGS@ -+CPPFLAGS=@CPPFLAGS@ -I. -I$(srcdir) -+LIBS+=@LIBS@ @CRYPTLIB@ -+LDFLAGS+=@LDFLAGS@ -+ - - EXEEXT=@EXEEXT@ - -@@ -198,7 +198,7 @@ dropbearkey: $(dropbearkeyobjs) - dropbearconvert: $(dropbearconvertobjs) - - dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile -- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@ $(PLUGIN_LIBS) -+ $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) $(PLUGIN_LIBS) - - dbclient: $(HEADERS) $(LIBTOM_DEPS) Makefile - $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) -@@ -219,7 +219,7 @@ ifeq ($(MULTI),1) - endif - - dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile -- $(CC) $(LDFLAGS) -o $@ $(MULTIOBJS) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@ -+ $(CC) $(LDFLAGS) -o $@ $(MULTIOBJS) $(LIBTOM_LIBS) $(LIBS) - - multibinary: dropbearmulti$(EXEEXT) - diff --git a/package/dropbear/patches/patch-svr-authpubkey_c b/package/dropbear/patches/patch-svr-authpubkey_c deleted file mode 100644 index f3df0c58f..000000000 --- a/package/dropbear/patches/patch-svr-authpubkey_c +++ /dev/null @@ -1,109 +0,0 @@ ---- dropbear-2020.81.orig/svr-authpubkey.c 2020-10-29 14:35:50.000000000 +0100 -+++ dropbear-2020.81/svr-authpubkey.c 2020-11-04 03:14:22.641017199 +0100 -@@ -386,26 +386,32 @@ static int checkpubkey(const char* keyal - goto out; - } - -- /* we don't need to check pw and pw_dir for validity, since -- * its been done in checkpubkeyperms. */ -- len = strlen(ses.authstate.pw_dir); -- /* allocate max required pathname storage, -- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ -- filename = m_malloc(len + 22); -- snprintf(filename, len + 22, "%s/.ssh/authorized_keys", -- ses.authstate.pw_dir); -+ /* special case for root authorized_keys in /etc/dropbear/authorized_keys */ -+ if (ses.authstate.pw_uid != 0) { -+ /* we don't need to check pw and pw_dir for validity, since -+ * its been done in checkpubkeyperms. */ -+ len = strlen(ses.authstate.pw_dir); -+ /* allocate max required pathname storage, -+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ -+ filename = m_malloc(len + 22); -+ snprintf(filename, len + 22, "%s/.ssh/authorized_keys", -+ ses.authstate.pw_dir); - --#if DROPBEAR_SVR_MULTIUSER -- /* open the file as the authenticating user. */ -- origuid = getuid(); -- origgid = getgid(); -- if ((setegid(ses.authstate.pw_gid)) < 0 || -- (seteuid(ses.authstate.pw_uid)) < 0) { -- dropbear_exit("Failed to set euid"); -- } --#endif -+ /* open the file as the authenticating user. */ -+ origuid = getuid(); -+ origgid = getgid(); -+ if ((setegid(ses.authstate.pw_gid)) < 0 || -+ (seteuid(ses.authstate.pw_uid)) < 0) { -+ dropbear_exit("Failed to set euid"); -+ } - -- authfile = fopen(filename, "r"); -+ authfile = fopen(filename, "r"); -+ -+ } else { -+ origuid = getuid(); -+ origgid = getgid(); -+ authfile = fopen("/etc/dropbear/authorized_keys","r"); -+ } - - #if DROPBEAR_SVR_MULTIUSER - if ((seteuid(origuid)) < 0 || -@@ -474,27 +480,37 @@ static int checkpubkeyperms() { - goto out; - } - -- /* allocate max required pathname storage, -- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ -- len += 22; -- filename = m_malloc(len); -- strlcpy(filename, ses.authstate.pw_dir, len); -+ if (ses.authstate.pw_uid != 0) { -+ /* allocate max required pathname storage, -+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ -+ filename = m_malloc(len + 22); -+ strncpy(filename, ses.authstate.pw_dir, len+1); -+ -+ /* check ~ */ -+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -+ goto out; -+ } - -- /* check ~ */ -- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -- goto out; -- } -+ /* check ~/.ssh */ -+ strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ -+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -+ goto out; -+ } - -- /* check ~/.ssh */ -- strlcat(filename, "/.ssh", len); -- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -- goto out; -- } -+ /* now check ~/.ssh/authorized_keys */ -+ strncat(filename, "/authorized_keys", 16); -+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -+ goto out; -+ } - -- /* now check ~/.ssh/authorized_keys */ -- strlcat(filename, "/authorized_keys", len); -- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -- goto out; -+ } else { -+ -+ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) { -+ goto out; -+ } -+ if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) { -+ goto out; -+ } - } - - /* file looks ok, return success */ diff --git a/target/config/Config.in.runtime b/target/config/Config.in.runtime index 533d58499..5866ba2a1 100644 --- a/target/config/Config.in.runtime +++ b/target/config/Config.in.runtime @@ -117,7 +117,7 @@ config ADK_RUNTIME_PASSWORD help Predefine the root password enabled in the built image. Use ./host_*/usr/bin/mkcrypt to generate the hash. - Default password is linux123 + Default password is: linux123 config ADK_RUNTIME_ADDUSER bool "add an user" |