<html><body>>From: "Burton, Ross" <ross.burton@intel.com><br>>To: joseph-reynolds@charter.net<br>>Cc: "openembedded-core@lists.openembedded.org"<br>>Sent: Wednesday September 12 2018 7:20:27AM<br>>Subject: Re: [OE-core] [PATCH] disable medium-strength dropbear ssh ciphers<br>><br> >Presumably this doesn't actually work as you're just adding a file to<br>
>git without actually referring to it anywhere.<br></ross.burton@intel.com><div><ross.burton@intel.com>
></ross.burton@intel.com></div><div><ross.burton@intel.com><br></ross.burton@intel.com></div><div><ross.burton@intel.com></ross.burton@intel.com><ross.burton@intel.com><div>Thanks for your email. I am still
trying to get the Dropbear patch upstreamed. (This is my first patch,
so I am a bit of an open source noob.)<br></div><div><br></div><div>To
address your concern: Dropbear version 2018.76 and later build process
specifically looks for the localoptions.h file as the way to customize
dropbear. (Note the 2017.75 and earlier versions use a different
mechanism to customize.) See the Makefile.in file for details.<br></div><div><br></div><div>However,
now I am wondering if patching Dropbear's default_options.h file would
be a better way to make this change. Adding a localoption.h file is the
way to customize dropbear. But I want to change the *default* behavior
of dropbear so that it uses the same encryption ciphers as OpenSSH. I
think patching default_options.h would be better way to accomplish that
goal. And that patch could be applied to the Dropbear project itself.</div><div><br></div></ross.burton@intel.com></div><ross.burton@intel.com>
>Ross<br>
><br>
>On 7 September 2018 at 20:16, <joseph-reynolds@charter.net> wrote:<br>
> This changes the Dropbear SSH server configuration so it will not<br>
> accept medium-strength encryption ciphers including: CBC mode, MD5,<br>
> 96-bit MAC, and triple DES.<br>
><br>
> Upstream-Status: Pending<br>
><br>
> Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net><br>
> ---<br>
> meta/recipes-core/dropbear/dropbear/localoptions.h | 8 ++++++++<br>
> 1 file changed, 8 insertions(+)<br>
> create mode 100644 meta/recipes-core/dropbear/dropbear/localoptions.h<br>
><br>
> diff --git a/meta/recipes-core/dropbear/dropbear/localoptions.h<br>
> b/meta/recipes-core/dropbear/dropbear/localoptions.h<br>
> new file mode 100644<br>
> index 0000000..ec48c26<br>
> --- /dev/null<br>
> +++ b/meta/recipes-core/dropbear/dropbear/localoptions.h<br>
> @@ -0,0 +1,8 @@<br>
> +/* Customize dropbear per default_options.h in the dropbear project */<br>
> +<br>
> +/* Disable insecure ciphers */<br>
> +#define DROPBEAR_TWOFISH256 0<br>
> +#define DROPBEAR_TWOFISH128 0<br>
> +#define DROPBEAR_ENABLE_CBC_MODE 0<br>
> +#define DROPBEAR_SHA1_HMAC 0<br>
> +#define DROPBEAR_SHA1_96_HMAC 0<br>
> --<br>
> 2.7.2<br>
><br>
><br>
><br>
> --<br>
> _______________________________________________<br>
> Openembedded-core mailing list<br>
> Openembedded-core@lists.openembedded.org<br>
> <a target="_blank" href="http://lists.openembedded.org/mailman/listinfo/openembedded-core<br">http://lists.openembedded.org/mailman/listinfo/openembedded-core<br>
/> ><br>
</a></ross.burton@intel.com></body></html>