.Dd February 1, 2023 .Dt DROPBEAR 8 .Os .Sh NAME .Nm dropbear .Nd lightweight SSH server .Sh SYNOPSIS .Nm .Op Ar flag arguments .Op Fl b Ar banner .Op Fl r Ar hostkeyfile .Op Fl p Ar [address:]port .Sh DESCRIPTION .Nm dropbear is a small SSH server .Sh OPTIONS .Bl -tag -width Ds .It Fl b Ar banner bannerfile. Display the contents of the file .Ar banner before user login (default: none). .It Fl r Ar hostkey Use the contents of the file .Ar hostkey for the SSH hostkey. This file is generated with .Xr dropbearkey 1 or automatically with the .Fl R option. See .Dq Host Key Files below. .It Fl R Generate hostkeys automatically. See .Dq Host Key Files below. .It Fl F Don't fork into background. .It Fl E Log to standard error rather than syslog. .It Fl e Pass on the server environment to all child processes. This is required, for example, if Dropbear is launched on the fly from a SLURM workload manager. The environment is not passed by default. Note that this could expose secrets in environment variables from the calling process - use with caution. .It Fl m Don't display the message of the day on login. .It Fl w Disallow root logins. .It Fl s Disable password logins. .It Fl g Disable password logins for root. .It Fl t Enable two-factor authentication. Both password login and public key authentication are required. Should not be used with the .Fl s option. .It Fl j Disable local port forwarding. This includes unix stream forwards. .It Fl k Disable remote port forwarding. .It Fl p Ar [address:]port Listen on specified .Ar address and TCP .Ar port . If just a port is given listen on all addresses. Up to 10 can be specified (default 22 if none specified). .It Fl l Ar interface Listen on the specified .Ar interface .It Fl i Service program mode. Use this option to run .Nm dropbear under TCP/IP servers like inetd, tcpsvd, or tcpserver. In program mode the .Fl F option is implied, and .Fl p options are ignored. .It Fl P Ar pidfile Specify a pidfile to create when running as a daemon. If not specified, the default is .Pa /var/run/dropbear.pid .It Fl a Allow remote hosts to connect to forwarded ports. .It Fl W Ar windowsize Specify the per-channel receive window buffer size. Increasing this may improve network performance at the expense of memory use. Use -h to see the default buffer size. .It Fl K Ar timeout_seconds Ensure that traffic is transmitted at a certain interval in seconds. This is useful for working around firewalls or routers that drop connections after a certain period of inactivity. The trade-off is that a session may be closed if there is a temporary lapse of network connectivity. A setting of 0 disables keepalives. If no response is received for 3 consecutive keepalives the connection will be closed. .It Fl I Ar idle_timeout Disconnect the session if no traffic is transmitted or received for .Ar idle_timeout seconds. .It Fl M Set maximum session duration in seconds. All sessions will close after this time. If a compile-time setting was set (default is none), then setting .Fl M Ar 0 will disable the session duration timeout. .It Fl z By default Dropbear will send network traffic with the .Dv AF21 setting for QoS, letting network devices give it higher priority. Some devices may have problems with that, .Fl z can be used to disable it. .It Fl T Ar max_authentication_attempts Set the number of authentication attempts allowed per connection. If unspecified the default is 10 .Pq Dv MAX_AUTH_TRIES .It Fl c Ar forced_command Disregard the command/shell provided by the user and always run .Ar forced_command . This also overrides any .Pa authorized_keys .Cm command= option. The original command is saved in the .Ev SSH_ORIGINAL_COMMAND environment variable (see below). .Pp The forced command is started using the user's normal shell, the same as occurs for normal commands. .Pp Unix stream forwarding is disabled when a forced command is set, since that may allow a bypass of the forced command. Other SSH features such as TCP forwarding are still allowed by default - it may be desirable to disable those using .Fl j or .Fl k options when using forced command. .It Fl D Ar authorized_keys_dir Specify the directory to use for .Pa authorized_keys files. The default is .Pa ~/.ssh , paths with a leading .Pa ~/ will be home directory expanded. .It Fl Q Ar algo Query supported algorithms. Options are kex, sig, cipher, mac, compress .It Fl V Print the version .El .Sh FILES .Bl -tag -width Ds .It Authorized Keys .Pa ~/.ssh/authorized_keys can be set up to allow remote login with a .Dv Ed25519 , .Dv RSA , or .Dv ECDSA key. The .Pa authorized_keys file and its containing .Pa ~/.ssh directory must only be writable by the user, otherwise Dropbear will not allow a login using public key authentication. .Pp Each line is of the form .Bd -literal -offset indent [restrictions] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIgAsp... [comment] .Ed .Pp and can be extracted from a Dropbear private host key with .Ql dropbearkey -y . This is the same format as used by OpenSSH, though the restrictions are a subset (keys with unknown restrictions are ignored). Restrictions are comma separated, with double quotes around spaces in arguments. Available restrictions are: .Bl -tag -width Ds .It Cm no-port-forwarding Don't allow port forwarding for this connection, including unix streams. .It Cm no-agent-forwarding Don't allow agent forwarding for this connection .It Cm no-X11-forwarding Don't allow X11 forwarding for this connection .It Cm no-pty Disable PTY allocation. Note that a user can still obtain most of the same functionality with other means even if no-pty is set. .It Cm restrict Applies all the no- restrictions listed above. .It Cm permitopen= Ns Qo Ar host:port Qc Restrict local port forwarding so that connection is allowed only to the specified host and port. Multiple permitopen options separated by commas can be set in .Pa authorized_keys . Wildcard character .Pq Ql * may be used in port specification for matching any port. Hosts must be literal domain names or IP addresses. .It Cm permitlisten= Ns Qo Ar port Qc Restrict remote port forwarding listeners to the given port. Multiple .Cm permitlisten= Ns Qo Ar port Qc options separated by commas can be set in .Pa authorized_keys . Port can be 0 to allow the listen port to be dynamically allocated on the server. .It Cm command= Ns Qo Ar forced_command Qc Disregard the command provided by the user and always run .Ar forced_command . The .Fl c command line option overrides this. See .Fl c documentation for behaviour of forced commands. .Pp When using .Cm command= it is often desirable to also use .Cm restrict option to avoid other SSH features that may allow additional access. .El .It Host Key Files Host key files are read at startup from a standard location, by default .Pa /etc/dropbear/dropbear_dss_host_key , .Pa /etc/dropbear/dropbear_rsa_host_key , .Pa /etc/dropbear/dropbear_ecdsa_host_key and .Pa /etc/dropbear/dropbear_ed25519_host_key .Pp If the .Fl r command line option is specified the default files are not loaded. Host key files are of the form generated by .Xr dropbearkey 1 . The .Fl R option can be used to automatically generate keys in the default location - keys will be generated after startup when the first connection is established. This had the benefit that the system .Pa /dev/urandom random number source has a better chance of being securely seeded. .It Message Of The Day By default the file .Pa /etc/motd will be printed for any login shell (unless disabled at compile-time). This can also be disabled per-user by creating a file .Pa ~/.hushlogin . .El .Sh ENVIRONMENT VARIABLES Dropbear sets the standard variables .Ev USER , .Ev LOGNAME , .Ev HOME , .Ev SHELL , .Ev PATH , and .Ev TERM . .Pp The variables below are set for sessions as appropriate. .Bl -tag -width Ds .It Ev SSH_TTY This is set to the allocated TTY if a PTY was used. .It Ev SSH_CONNECTION Contains .Ql . .It Ev DISPLAY Set X11 forwarding is used. .It Ev SSH_ORIGINAL_COMMAND If a .Cm command= .Pa authorized_keys option was used, the original command is specified in this variable. If a shell was requested this is set to an empty value. .It Ev SSH_AUTH_SOCK Set to a forwarded ssh-agent connection. .El .Sh NOTES Dropbear only supports SSH protocol version 2. .Sh SEE ALSO .Xr dbclient 1 , .Xr dropbearconvert 1 , .Xr dropbearkey 1 .Pp .Lk https://matt.ucc.asn.au/dropbear/dropbear.html .Sh AUTHORS .An Matt Johnston Aq Mt matt@ucc.asn.au . .An Gerrit Pape Aq Mt pape@smarden.org wrote this manual page.