From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 26 Nov 2021 15:35:05 +0100 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by lore.white.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mqcJd-00047p-39 for lore@lore.pengutronix.de; Fri, 26 Nov 2021 15:35:05 +0100 Received: from localhost ([127.0.0.1] helo=metis.ext.pengutronix.de) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mqcJc-0004zu-Ht; Fri, 26 Nov 2021 15:35:04 +0100 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mqcJX-0004vF-EN; Fri, 26 Nov 2021 15:34:59 +0100 Received: from [2a0a:edc0:0:1101:1d::39] (helo=dude03.red.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.94.2) (envelope-from ) id 1mqcJX-001BuT-EW; Fri, 26 Nov 2021 15:34:58 +0100 Received: from mol by dude03.red.stw.pengutronix.de with local (Exim 4.94.2) (envelope-from ) id 1mqcJV-0053KI-Vs; Fri, 26 Nov 2021 15:34:58 +0100 From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 26 Nov 2021 15:34:57 +0100 Message-Id: <20211126143457.1204248-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211105154734.19983-2-ada@thorsis.com> References: <20211105154734.19983-2-ada@thorsis.com> MIME-Version: 1.0 Subject: Re: [ptxdist] [APPLIED] dropbear: Remove host/public key DSS support X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 3c822e5aa8e5aed64273df8823cd6d5b56954d03. Michael [sent from post-receive hook] On Fri, 26 Nov 2021 15:34:57 +0100, Alexander Dahl wrote: > DSS option was removed already from ptxdist, it is not recommended for > new keys. In dropbear however, it was still default enabled, this is > disabled through localoptions.h now. > > Fixes: 01ac7cc409b5 ("dropbear: Remove deprecated options") > Signed-off-by: Alexander Dahl > Message-Id: <20211105154734.19983-2-ada@thorsis.com> > Signed-off-by: Michael Olbrich > > diff --git a/projectroot/etc/init.d/dropbear b/projectroot/etc/init.d/dropbear > index 1edda1116a93..4d6530bdcc46 100644 > --- a/projectroot/etc/init.d/dropbear > +++ b/projectroot/etc/init.d/dropbear > @@ -10,21 +10,17 @@ DROPBEAR_EXTRA_ARGS= > # test ! -h /var/service/dropbear || exit 0 > > DROPBEAR_RSAKEY_DEFAULT="@KEYDIR@/dropbear_rsa_host_key" > -DROPBEAR_DSSKEY_DEFAULT="@KEYDIR@/dropbear_dss_host_key" > > test -z "$DROPBEAR_BANNER" || \ > DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER" > test -n "$DROPBEAR_RSAKEY" || \ > DROPBEAR_RSAKEY=$DROPBEAR_RSAKEY_DEFAULT > -test -n "$DROPBEAR_DSSKEY" || \ > - DROPBEAR_DSSKEY=$DROPBEAR_DSSKEY_DEFAULT > test -n "$DROPBEAR_KEYTYPES" || \ > - DROPBEAR_KEYTYPES="rsa dss" > + DROPBEAR_KEYTYPES="rsa" > > dropbear_start() { > > KEY_ARGS="" > - test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d $DROPBEAR_DSSKEY" > test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r $DROPBEAR_RSAKEY" > > echo -n "starting dropbear..." > diff --git a/projectroot/etc/rc.once.d/dropbear b/projectroot/etc/rc.once.d/dropbear > index a126b26db76e..451236097832 100644 > --- a/projectroot/etc/rc.once.d/dropbear > +++ b/projectroot/etc/rc.once.d/dropbear > @@ -3,12 +3,9 @@ > PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin > > DROPBEAR_RSAKEY_DEFAULT="@KEYDIR@/dropbear_rsa_host_key" > -DROPBEAR_DSSKEY_DEFAULT="@KEYDIR@/dropbear_dss_host_key" > > test -n "$DROPBEAR_RSAKEY" || \ > DROPBEAR_RSAKEY=$DROPBEAR_RSAKEY_DEFAULT > -test -n "$DROPBEAR_DSSKEY" || \ > - DROPBEAR_DSSKEY=$DROPBEAR_DSSKEY_DEFAULT > > gen_key() { > > @@ -29,5 +26,3 @@ gen_key() { > } > > [ -e "$DROPBEAR_RSAKEY" ] || gen_key rsa "$DROPBEAR_RSAKEY" > -[ -e "$DROPBEAR_DSSKEY" ] || gen_key dss "$DROPBEAR_DSSKEY" > - > diff --git a/rules/dropbear.in b/rules/dropbear.in > index 507ee8e7f28e..8ae2d788bd27 100644 > --- a/rules/dropbear.in > +++ b/rules/dropbear.in > @@ -260,7 +260,7 @@ config DROPBEAR_SHA512 > SHA-1. SHA-2 consists of a set of four hash functions with digests > that are 224, 256, 384 or 512 bits. > > -comment "Hostkey/public key algorithms, at least one required --- RSA is recommended, DSS is not recommended for new keys" > +comment "Hostkey/public key algorithms, at least one required ---" > > config DROPBEAR_RSA > bool > @@ -277,7 +277,7 @@ config DROPBEAR_ECDSA > prompt "ecdsa" > help > ECDSA stands for Elliptic Curve Digital Signature Algorithm. > - ECDSA is significantly faster than RSA or DSS. > + ECDSA is significantly faster than RSA. > > comment "Key exchange algorithm ---" > > diff --git a/rules/dropbear.make b/rules/dropbear.make > index 536c9176a5d7..c4577fed2685 100644 > --- a/rules/dropbear.make > +++ b/rules/dropbear.make > @@ -198,6 +198,9 @@ else > endif > > # host key / public key > + @echo "ptxdist: disabling dss" > + @echo "#define DROPBEAR_DSS 0" >> $(DROPBEAR_LOCALOPTIONS) > + > ifdef PTXCONF_DROPBEAR_RSA > @echo "ptxdist: enabling rsa" > @echo "#define DROPBEAR_RSA 1" >> $(DROPBEAR_LOCALOPTIONS) _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de