Baslinux mailing list

[baslinux AT lists.ibiblio.org]

I have posted a ssh server package called dropbear at
httpd://keesan.freeshell.org/bl/
with dropbear key for making keys (see the README for instructions).
Under 200K executable.

It requires libc.so and ld-linux from glibc 2.2.5 (Slackware 8.1), which 
can be found in my operalib.tgz packages.  Also libz (from zlib or 
elflibs) and libcrypt and libutil (both glibc) so libraries.  I can 
package all these if anyone wants.  Or compile dropbear without libz 
compression ability.

I made and copied both keys to /etc/dropbear as instructed.

If I run dropbear then try to ssh (or dbclient) to my computer from a 
shell account (to the IP number assigned by my ISP), or if I insert the 
network module and ifconfig eth0, then try to ssh from my own computer to 
my own computer, it won't accept my user or root password.

That was yesterday.  Today it won't even start the login process (with ssh 
or dbclient).

I now have a /home/user/.ssh/known_hosts and random_seed, neither of which 
is recent, and a recent /root/.ssh/known_hosts from yesterday when it 
started to work (for both root and user - I got to the point where I 
could enter a password, which was not accepted).

Could someone who has used sshd before try this out in BL3 or BL2?

There are switches to allow login without password, or disallow root 
logins (the default for inetd telnets), or disable local port forwarding 
(what does that mean and would it make things more secure?) or remote port 
forwarding.  openssh uses a config file but dropbear seems not to.

The README has something about authorized_keys used the same way as 
OpenSSH in ~/.ssh/authorized_keys and using dropbearkey -y to get the 
public-key portion of a private key. .ssh and the key file should be 
writable only by the user.  My /home/user/.ssh appears to be writable only 
by root, as are the files in it.  I just made them o+w but that did not 
help.

Do I generate a public key with dropbear -y and put that file in ~/.ssh/ 
as authorized_keys?

Sindi

On Thu, 10 Mar 2005, 3aoo-cvfd AT dea.spamcon.org wrote:

> Andrew wrote:
> > Am I right in thinking the bl3 ssh packet only
> > includes client programs?
>
> Yes.  BL3 was designed to be a network client, not a
> server.  That includes dhcp, telnet, ftp, pop3, smtp
> and dns.  The one exception is http, for which BL3
> provides both a client and a server.
>
> Servers face a variety of security issues and are
> best run on locked-down, up-to-date distributions.
> Especially servers that provide login access.
>
> > I was hoping to be able to log into the bl3 machine
> > remotely using ssh,
>
> BL3 doesn't even have local login, let alone a remote
> login capability.
>
> With BL1 and BL2 (which have local login), you can
> use the in.telnetd executable from Slackware (it's
> in the tcpip1.tgz package) to provide a telnet login:
> -----------------
> in.telnetd -debug
> -----------------
> That will give you a single remote login.
>
> However, I have never tried the above on BL3 and expect
> it to fail (because there's no local login capability).
> If anybody decides to experiment with in.telnetd on
> BL3, please report back here with your findings.
>
> > but I don't seem to be able to (Connection refused).
>
> There's nothing running to accept a connection (execute
> ps to see what is running).  Most mainstream Linux
> distributions start a whole bunch of servers by default.
> This uses system resources and opens up avenues for
> potential attack (thereby making security an issue).
>
> BL3 does very little by default.  For example, you need
> to activate a CDrom drive yourself.  Ditto a PCMCIA slot.
> (see /etc/rc for details)
>
> It is only by keeping defaults to a minimum that BL3 is
> able to run on very low-end systems.
>
> Cheers,
> Steven
>
> ____________________________
> http://www.basiclinux.com.ru
> _______________________________________________
> BasLinux mailing list
> BasLinux AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/baslinux

keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org