Re: [ptxdist] [PATCH v2 2/4] dropbear: Revise comments

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Fri, Nov 06, 2020 at 07:58:09AM +0100, Alexander Dahl wrote:
> Add more section markers and update recommendations based on upstream's
> 'default_options.h' file.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  rules/dropbear.in   | 12 +++++++-----
>  rules/dropbear.make | 18 +++++++++++-------
>  2 files changed, 18 insertions(+), 12 deletions(-)
> 
> diff --git a/rules/dropbear.in b/rules/dropbear.in
> index 62a4a8427..d01f2c73e 100644
> --- a/rules/dropbear.in
> +++ b/rules/dropbear.in
> @@ -219,7 +219,7 @@ config DROPBEAR_CTR_CIPHERS
>  	  CBC mode against certain attacks. This adds around 1kB to binary
>  	  size and is recommended for most cases.
>  
> -comment "Integrity, at least one required --- RFC Draft requires sha1-hmac and recommends sha1-96"
> +comment "Integrity, at least one required --- sha2-256 is recommended as a default, sha1 for compatibility"
>  
>  config DROPBEAR_SHA1
>  	bool
> @@ -273,13 +273,13 @@ config DROPBEAR_SHA512
>  
>  config DROPBEAR_MD5
>  	bool
> -	prompt "md5"
> +	prompt "md5 (not recommended!)"
>  	help
>  	  MD5 was developed by Professor Ronald L. Rivest in 1994.
>  	  Its 128 bit (16 byte) message digest makes it a faster
>  	  implementation than SHA-1.
>  
> -comment "Hostkey/public key algorithms, at least one required --- SSH2 RFC Draft requires dss, recommends rsa"
> +comment "Hostkey/public key algorithms, at least one required --- RSA is recommended, DSS is not recommended for new keys"
>  
>  config DROPBEAR_RSA
>  	bool
> @@ -293,7 +293,7 @@ config DROPBEAR_RSA
>  
>  config DROPBEAR_DSS
>  	bool
> -	prompt "dss"
> +	prompt "dss (not recommended!)"

Hmm, I'll take the patch as is, unless some other issues pop up. But what
do you think about removing the DES and MD5 options entirely? I mean doing
ssh with either is really pointless.

Michael

>  	help
>  	  DSS stands for Digital Signature Standard.
>  	  DSS employs the ElGamal and Schnorr PK systems to produce
> @@ -308,6 +308,8 @@ config DROPBEAR_ECDSA
>  	  ECDSA stands for Elliptic Curve Digital Signature Algorithm.
>  	  ECDSA is significantly faster than RSA or DSS.
>  
> +comment "Key exchange algorithm ---"
> +
>  config DROPBEAR_ECDH
>  	bool
>  	prompt "ecdh"
> @@ -377,7 +379,7 @@ config DROPBEAR_SCP
>  comment "OpenSSH scp is selected!"
>  	depends on OPENSSH_SCP
>  
> -comment "runtime options   ---"
> +comment "runtime options        ---"
>  
>  config DROPBEAR_STARTSCRIPT
>  	bool
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index acd9ef5f9..4f55fac48 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -67,6 +67,7 @@ $(STATEDIR)/dropbear.prepare:
>  
>  	@echo "/* localoptions.h created by ptxdist */" > $(DROPBEAR_LOCALOPTIONS)
>  
> +# features
>  ifdef PTXCONF_DROPBEAR_DIS_X11
>  	@echo "ptxdist: disabling x11 forwarding"
>  	@echo "#define DROPBEAR_X11FWD 0" >> $(DROPBEAR_LOCALOPTIONS)
> @@ -76,13 +77,13 @@ else
>  endif
>  
>  ifdef PTXCONF_DROPBEAR_DIS_TCP
> -	@echo "ptxdist: disabling tcp"
> +	@echo "ptxdist: disabling tcp forwarding"
>  	@echo "#define DROPBEAR_CLI_LOCALTCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS)
>  	@echo "#define DROPBEAR_CLI_REMOTETCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS)
>  	@echo "#define DROPBEAR_SVR_LOCALTCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS)
>  	@echo "#define DROPBEAR_SVR_REMOTETCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS)
>  else
> -	@echo "ptxdist: enabling tcp"
> +	@echo "ptxdist: enabling tcp forwarding"
>  	@echo "#define DROPBEAR_CLI_LOCALTCPFWD 1" >> $(DROPBEAR_LOCALOPTIONS)
>  	@echo "#define DROPBEAR_CLI_REMOTETCPFWD 1" >> $(DROPBEAR_LOCALOPTIONS)
>  	@echo "#define DROPBEAR_SVR_LOCALTCPFWD 1" >> $(DROPBEAR_LOCALOPTIONS)
> @@ -90,16 +91,16 @@ else
>  endif
>  
>  ifdef PTXCONF_DROPBEAR_DIS_AGENT
> -	@echo "ptxdist: disabling agent"
> +	@echo "ptxdist: disabling auth agent forwarding"
>  	@echo "#define DROPBEAR_SVR_AGENTFWD 0" >> $(DROPBEAR_LOCALOPTIONS)
>  	@echo "#define DROPBEAR_CLI_AGENTFWD 0" >> $(DROPBEAR_LOCALOPTIONS)
>  else
> -	@echo "ptxdist: enabling agent"
> +	@echo "ptxdist: enabling auth agent forwarding"
>  	@echo "#define DROPBEAR_SVR_AGENTFWD 1" >> $(DROPBEAR_LOCALOPTIONS)
>  	@echo "#define DROPBEAR_CLI_AGENTFWD 1" >> $(DROPBEAR_LOCALOPTIONS)
>  endif
>  
> -
> +# encryption
>  ifdef PTXCONF_DROPBEAR_AES128
>  	@echo "ptxdist: enabling aes128"
>  	@echo "#define DROPBEAR_AES128 1" >> $(DROPBEAR_LOCALOPTIONS)
> @@ -148,6 +149,7 @@ else
>  	@echo "#define DROPBEAR_TWOFISH128 0" >> $(DROPBEAR_LOCALOPTIONS)
>  endif
>  
> +# ciphers
>  ifdef PTXCONF_DROPBEAR_CBC_CIPHERS
>  	@echo "ptxdist: enabling cbc ciphers"
>  	@echo "#define DROPBEAR_ENABLE_CBC_MODE 1" >> $(DROPBEAR_LOCALOPTIONS)
> @@ -165,6 +167,7 @@ else
>  	@echo "#define DROPBEAR_ENABLE_CTR_MODE 0" >> $(DROPBEAR_LOCALOPTIONS)
>  endif
>  
> +# integrity
>  ifdef PTXCONF_DROPBEAR_SHA1
>  	@echo "ptxdist: enabling sha1"
>  	@echo "#define DROPBEAR_SHA1_HMAC 1" >> $(DROPBEAR_LOCALOPTIONS)
> @@ -210,7 +213,7 @@ else
>  	@echo "#define DROPBEAR_MD5_HMAC 0" >> $(DROPBEAR_LOCALOPTIONS)
>  endif
>  
> -
> +# host key / public key
>  ifdef PTXCONF_DROPBEAR_RSA
>  	@echo "ptxdist: enabling rsa"
>  	@echo "#define DROPBEAR_RSA 1" >> $(DROPBEAR_LOCALOPTIONS)
> @@ -235,6 +238,7 @@ else
>  	@echo "#define DROPBEAR_ECDSA 0" >> $(DROPBEAR_LOCALOPTIONS)
>  endif
>  
> +# key exchange algorithm
>  ifdef PTXCONF_DROPBEAR_ECDH
>  	@echo "ptxdist: enabling ecdh"
>  	@echo "#define DROPBEAR_ECDH 1" >> $(DROPBEAR_LOCALOPTIONS)
> @@ -251,7 +255,7 @@ else
>  	@echo "#define DROPBEAR_CURVE25519 0" >> $(DROPBEAR_LOCALOPTIONS)
>  endif
>  
> -
> +# authentication types
>  ifdef PTXCONF_DROPBEAR_PASSWD
>  	@echo "ptxdist: enabling passwd"
>  	@echo "#define DROPBEAR_SVR_PASSWORD_AUTH 1" >> $(DROPBEAR_LOCALOPTIONS)
> -- 
> 2.27.0
> 
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
> 

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de