trusty (8) dropbear.8.gz

NAME

       dropbear - lightweight SSH server

SYNOPSIS

       dropbear [-FEmwsgjki] [-b banner] [-d dsskey] [-r rsakey] [-p [address:]port]

DESCRIPTION

       dropbear is a SSH server designed to be small enough to be used in small memory environments, while still
       being functional and secure enough for general use.

OPTIONS

       -b banner
              bannerfile.  Display the contents of the file banner before user login (default: none).

       -d dsskey
              dsskeyfile.   Use  the  contents  of  the  file  dsskey   for   the   DSS   host   key   (default:
              /etc/dropbear/dropbear_dss_host_key).   Note  that  some  SSH  implementations  use the term "DSA"
              rather than "DSS", they mean the same thing.  This file is generated with dropbearkey(1).

       -r rsakey
              rsakeyfile.   Use  the  contents  of  the  file  rsakey   for   the   rsa   host   key   (default:
              /etc/dropbear/dropbear_rsa_host_key).  This file is generated with dropbearkey(1).

       -F     Don't fork into background.

       -E     Log to standard error rather than syslog.

       -m     Don't display the message of the day on login.

       -w     Disallow root logins.

       -s     Disable password logins.

       -g     Disable password logins for root.

       -j     Disable local port forwarding.

       -k     Disable remote port forwarding.

       -p [address:]port
              Listen on specified address and TCP port.  If just a port is given listen on all addresses.  up to
              10 can be specified (default 22 if none specified).

       -i     Service program mode.  Use this option to run dropbear under TCP/IP servers like inetd, tcpsvd, or
              tcpserver.  In program mode the -F option is implied, and -p options are ignored.

       -P pidfile
              Specify  a  pidfile  to  create  when  running  as  a  daemon.  If  not  specified, the default is
              /var/run/dropbear.pid

       -a     Allow remote hosts to connect to forwarded ports.

       -W windowsize
              Specify  the  per-channel  receive  window  buffer  size.  Increasing  this  may  improve  network
              performance at the expense of memory use. Use -h to see the default buffer size.

       -K timeout_seconds
              Ensure  that  traffic  is transmitted at a certain interval in seconds. This is useful for working
              around firewalls or routers that drop connections after a certain period of inactivity. The trade-
              off  is  that  a  session  may  be closed if there is a temporary lapse of network connectivity. A
              setting if 0 disables keepalives.

       -I idle_timeout
              Disconnect the session if no traffic is transmitted or received for idle_timeout seconds.

FILES

       Authorized Keys

              ~/.ssh/authorized_keys can be set up to allow remote login with a RSA or DSS key. Each line is  of
              the form

       [restrictions] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIgAsp... [comment]

              and  can  be  extracted  from  a Dropbear private host key with "dropbearkey -y". This is the same
              format as used by OpenSSH, though the restrictions are a subset (keys  with  unknown  restrictions
              are  ignored).   Restrictions  are comma separated, with double quotes around spaces in arguments.
              Available restrictions are:

       no-port-forwarding
              Don't allow port forwarding for this connection

       no-agent-forwarding
              Don't allow agent forwarding for this connection

       no-X11-forwarding
              Don't allow X11 forwarding for this connection

       no-pty Disable PTY allocation. Note that a user can still obtain most  of  the  same  functionality  with
              other means even if no-pty is set.

       command="forced_command"
              Disregard the command provided by the user and always run forced_command.

              The  authorized_keys  file  and its containing ~/.ssh directory must only be writable by the user,
              otherwise Dropbear will not allow a login using public key authentication.

       Host Key Files

              Host   key   files   are   read   at   startup   from   a   standard    location,    by    default
              /etc/dropbear/dropbear_dss_host_key  and  /etc/dropbear/dropbear_rsa_host_key  or specified on the
              commandline with -d or -r. These are of the form generated by dropbearkey.

       Message Of The Day

              By default the file /etc/motd will be printed for any login shell  (unless  disabled  at  compile-
              time). This can also be disabled per-user by creating a file ~/.hushlogin .

ENVIRONMENT VARIABLES

       Dropbear sets the standard variables USER, LOGNAME, HOME, SHELL, PATH, and TERM.

       The variables below are set for sessions as appropriate.

       SSH_TTY
              This is set to the allocated TTY if a PTY was used.

       SSH_CONNECTION
              Contains "<remote_ip> <remote_port> <local_ip> <local_port>".

       DISPLAY
              Set X11 forwarding is used.

       SSH_ORIGINAL_COMMAND
              If  a  'command='  authorized_keys  option  was  used,  the  original command is specified in this
              variable. If a shell was requested this is set to an empty value.

       SSH_AUTH_SOCK
              Set to a forwarded ssh-agent connection.

NOTES

       Dropbear only supports SSH protocol version 2.

AUTHOR

       Matt Johnston (matt@ucc.asn.au).
       Gerrit Pape (pape@smarden.org) wrote this manual page.

SEE ALSO

       dropbearkey(1), dbclient(1), dropbearconvert(1)

       https://matt.ucc.asn.au/dropbear/dropbear.html

                                                                                                     dropbear(8)