Amiga Unix — 68040 · 68060

Manual pages › System maintenance and boot (8)

dropbear(8)

small SSH server

Package: dropbear, added for amigaux.

NAME · SYNOPSIS · DESCRIPTION · OPTIONS · ALGORITHMS · BOOT SCRIPT · FILES · ENVIRONMENT · SEE ALSO · NOTES

dropbear - small SSH server

/opt/amix/sbin/dropbear [ -RFEmwsgjkiaz ] [ -b banner ] [ -r hostkey ] ... [ -p [address:]port ] ... [ -P pidfile ] [ -W window ] [ -K seconds ] [ -I seconds ] [ -T tries ] [ -c command ] [ -D directory ]

dropbear is a small server for the SSH protocol, version 2. It is started at boot by /etc/init.d/dropbear, which makes the host key at the first start (see BOOT SCRIPT below). It forks into the background, listens on port 22 and starts one process for each connection. A user logs in with a password (checked against /etc/shadow) or with a key listed in ~/.ssh/authorized_keys.

Root may log in, by password or key, as on the console: the defaults refuse no user, and refuse only an empty password. -w refuses root, -g allows root by key only; put either in dropbear_flags (below). The server does not read /etc/default/login, so its CONSOLE line does not apply to it.

dropbear and the client programs dbclient(1), scp(1) and dropbearkey(1) are one program, installed under four names.

Show the contents of the file banner before the user logs in.
Use the host key in the file hostkey, as made by dropbearkey(1). May be given more than once, once for each key type. Without -r, the keys are read from /etc/dropbear/host_ed25519 and /etc/dropbear/host_rsa, those that exist.
Make a missing host key at the first connection that needs it.
Stay in the foreground.
Log to standard error instead of syslog(3).
Do not show /etc/motd at login.
Refuse logins as root.
Refuse password logins (keys only).
Refuse password logins as root.
Require both a key and the password.
Refuse local port forwarding.
Refuse remote port forwarding.
Listen on port (default 22), on every address or on address only. Up to 10 may be given.
Serve one connection on standard input and output, for inetd(1M); -F is implied and -p is ignored.
Write the server's process number to pidfile (default /etc/dropbear/dropbear.pid).
Let other hosts connect to remotely forwarded ports.
The receive window of each channel, in bytes (default 24576). A larger window can speed up a transfer and costs as much memory per channel.
Send a keepalive after seconds without traffic (0, the default, sends none); after three unanswered ones the connection is closed.
Close a connection idle for seconds (0, the default, never).
Close every session after seconds (0, the default, never).
Do not mark the traffic with the AF21 class of service.
The authentication attempts allowed for one connection (default 10).
Run command for every login, in place of what the user asked for, which is put in SSH_ORIGINAL_COMMAND.
Where the authorized_keys files are (default ~/.ssh).
List the algorithms of one kind: kex, sig, cipher, mac or compress.
Print the version.

The program holds only these, in this order of preference; a client must share one of each kind.

mlkem768x25519-sha256, curve25519-sha256, curve25519-sha256@libssh.org
ssh-ed25519, and rsa-sha2-256 with an RSA host key; the client, dbclient(1), asks a server for rsa-sha2-256 first, which is ten times cheaper to verify here, and then ssh-ed25519
ssh-ed25519, rsa-sha2-256
chacha20-poly1305@openssh.com, aes128-ctr
hmac-sha2-256 (with aes128-ctr; chacha20-poly1305 has its own)

There is no finite-field Diffie-Hellman, no NIST curve, no DSA, no SHA-1, no CBC mode, no 3DES and no compression: on a 68k each is slower than what is offered, or weaker, or both. The measurements are in the README of the package's source, userland/packages/dropbear in the amix repository.

/etc/init.d/dropbear (also /etc/rc2.d/S76dropbear, and K40dropbear in /etc/rc0.d and /etc/rc1.d) starts the server when the system enters run level 2 and stops it when the system leaves it. It reads these lines of /etc/rc.conf; see rc.conf(4).

Whether the server starts (default yes).
The port (default 22), on every address of the machine. At boot a DHCP interface may not have its address yet, so a -p address:port in dropbear_flags fails until the lease comes.
Also an RSA host key, for clients that know no ed25519 (default no). Making it takes over 12 minutes of CPU on a 68060 and hours on a 68030; see below.
More options for the server, such as -s -g.
How long the background key making may take before it is stopped (default 86400, a day).

The host keys are made from /dev/urandom. The server starts as soon as the ed25519 key exists: at once when it does, or, at the first start, in the background with rc_bg once the key is made (a few seconds), so the boot goes on. With dropbear_rsa=yes a 3072-bit RSA key is made after that, in the same background run at a low priority (nice -10), while the server already answers with the ed25519 key; when the RSA key is ready the server is restarted with both keys, which takes it off the port for a moment and leaves running sessions alone. The run's shell and dropbearkey are recorded in /etc/dropbear/keygen.pid, so /etc/init.d/dropbear stop ends them, and the server, at any stage. A key is written under a new name and renamed when it is complete, so a run stopped part-way, by stop, a shutdown or dropbear_keytime, leaves no half key, and the next start begins that key again. A host key never comes from the package, so no two machines share one, and neither an update nor pkgrm(1M) touches it. Without /dev/urandom (the random module) the server is not started. What the script does is logged in /var/adm/rc.log; the server itself logs through syslog(3), with the facility auth.

To run the server from inetd(1M) instead, so that it uses no memory between connections, set dropbear=no and add to /etc/inet/inetd.conf the line

ssh stream tcp nowait root /opt/amix/sbin/dropbear dropbear -i -r /etc/dropbear/host_ed25519

(and ssh 22/tcp to /etc/inet/services, if it is not there). Each connection then pays the start of the program.

~/.ssh/authorized_keys
The keys a user may log in with, one per line:

[options] ssh-ed25519 AAAAC3Nz... comment

The file and ~/.ssh must be writable by the user only, or the keys are ignored. The options are separated by commas:

No port forwarding.
No terminal.
Both of the above (agent and X11 forwarding are not in this build).
Local forwarding only to host:port; * as the port allows any port.
Remote forwarding only from port.
Always run command, as -c does.
/etc/dropbear/host_ed25519
/etc/dropbear/host_rsa
The host keys, readable by root only.
/etc/dropbear/dropbear.pid
The server's process number.
/etc/dropbear/keygen.pid
The background key run's shell and dropbearkey, while one is at work.
/etc/rc.conf
The switch and settings of the boot script (above).
/var/adm/rc.log
What the boot script did.
/var/adm/rclog/dropbear
The output of a first start that made the host keys.
/etc/motd
Shown at login, unless -m is given or the user has a ~/.hushlogin.

A session gets USER, LOGNAME, HOME, SHELL, PATH (/opt/amix/bin:/usr/bin:/usr/ucb, for root /opt/amix/bin:/usr/sbin:/usr/bin:/sbin:/etc), TERM when it has a terminal, and:

The client's address and port, then the server's.
The terminal, when one was allocated.
The command the client asked for, under a forced command.

dbclient(1), dropbearkey(1), scp(1), rc.conf(4), rc.subr(1M), inetd(1M)

SFTP is not served: a modern OpenSSH scp uses it by default, so give it -O to copy with the older protocol, which scp(1) here speaks.

Each session switches to its user when it starts the user's shell or command, not right after the login: the 1992 system cannot keep a saved group for the login records the way the upstream server does.

4 November 2026 dropbear 2026.94