<html><body>>From: "Burton, Ross" <ross.burton@intel.com><br>>To: joseph-reynolds@charter.net<br>>Cc: "openembedded-core@lists.openembedded.org"<br>>Sent: Thursday September 13 2018 11:00:26AM<br>>Subject: Re: [OE-core] [PATCH v2] dropbear: disable medium-strength ssh ciphers<br>><br> >This still can't be actually used, because dropbear won't be looking<br>
>in the recipe folder and nothing puts that file into the source tree.<br>
>Put a #error in it if you don't believe me. :)<br></ross.burton@intel.com><br><div><div>Thanks for pointing that out. I had conflated the OE & Yocto recipes, then forgot to include the recipe change in my patch. My home project is actually https://github.com/openbmc/openbmc, so I set out to upstream this change to Yocto/Poky, OE, and Dropbear. Thanks for your patience, as this is my first attempt to upstream.<br></div><div><br></div><div>My second issue is creating a correct patch. I used git format-patch HEAD^ and then cut/paste the result into my web-based email reader. The patch appears correct, but the automation says my patch is mal-formed. I am still trying to enable sending plain-text email from my shell environment.<br></div></div><div><br></div><div>Finally, I want to change my approach. I had been updating the dropbear localoptions.h file to customize Dropbear's behavior. But I really want to change Dropbear's default behavior for everyone, which means I should update default_options.h and leave localoptions.h alone. I plan to create a pull request to update the Dropbear project default_options.h file, and a patch for openembedded-core to change the dropbear_2018.76.bb recipe to pick up the Dropbear patch.<br></div><div><br></div><div>- Joseph<br></div><div><br></div><div><ross.burton@intel.com>>Ross</ross.burton@intel.com></div><div>><br><ross.burton@intel.com></ross.burton@intel.com></div><ross.burton@intel.com>
><br>
>On 12 September 2018 at 22:56, <joseph-reynolds@charter.net> wrote:<br>
>> This changes the Dropbear SSH server configuration so it will not<br>
>> accept medium-strength encryption ciphers including: CBC mode, MD5,<br>
>> 96-bit MAC, and triple DES. This is consistent with the default<br>
>> supported OpenSSH ciphers.<br>
>><br>
>> Upstream-Status: Pending<br>
>><br>
>> Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net><br>
>> ---<br>
>> meta/recipes-core/dropbear/dropbear/localoptions.h | 8 ++++++++<br>
>> 1 file changed, 8 insertions(+)<br>
>> create mode 100644 meta/recipes-core/dropbear/dropbear/localoptions.h<br>
>><br>
>> diff --git a/meta/recipes-core/dropbear/dropbear/localoptions.h<br>
>> b/meta/recipes-core/dropbear/dropbear/localoptions.h<br>
>> new file mode 100644<br>
>> index 0000000..ec48c26<br>
>> --- /dev/null<br>>> +++ b/meta/recipes-core/dropbear/dropbear/localoptions.h<br>
>> @@ -0,0 +1,8 @@<br>
>> +/* Customize dropbear per default_options.h in the dropbear project */<br>
>> +<br>
>> +/* Disable insecure ciphers */<br>
>> +#define DROPBEAR_TWOFISH256 0<br>
>> +#define DROPBEAR_TWOFISH128 0<br>
>> +#define DROPBEAR_ENABLE_CBC_MODE 0<br>
>> +#define DROPBEAR_SHA1_HMAC 0<br>
>> +#define DROPBEAR_SHA1_96_HMAC 0<br>
>> --<br>
>> 1.8.3.1<br>
>><br>
>><br>
>> --<br><a target="_blank" href="http://lists.openembedded.org/mailman/listinfo/openembedded-core<br"><br>
</a></ross.burton@intel.com></body></html>