3 ms·

How does it compare to Dropbear?

chasil 5y ago
No CVEs, much smaller cipher set, password authentication is not allowed, only ed25519 user authentication is supported.
- voakbasda 5y ago
  No CVEs yet. It would be truly exceptional should that record withstand widespread adoption.
  - chasil 5y ago
    Foregoing dynamic memory allocation, removing all non-DJB ciphers, and supporting only inetd drastically reduces the attack surface, so there is some hope that no CVEs will ever be found.
    - voakbasda 5y ago
      There may be some hope, but I would not bet on it. Indeed, I can imagine this very thread resulting in a miffed security researcher uttering "challenge accepted" and finding a way to break it. Again, that is not something I would bet against, given enough time and eyeballs. That said, I greatly appreciate this kind of effort, and I will probably even look into using it for small embedded projects in the future. My pessimism about security track records does not block out my optimism that we can and should do better, and this sounds much better than some other alternatives.
      - chasil 5y ago
        It is also quite useful for older systems where the native SSH doesn't support newer features. I have to support an Oracle 10g database on this platform, and I run tinyssh on port 26: $ ssh -p 26 myserver.com $ cat /etc/redhat-release /etc/oracle-release Red Hat Enterprise Linux Server release 5.11 (Tikanga) Oracle Linux Server release 5.11 $ ps -e -o user,pid:5,args | grep tinyssh root 14147 tinysshd -lpsv -x sftp=/usr/libexec/openssh/sftp-server /etc/tinyssh/sshkeydir $ size /usr/sbin/tinysshd text data bss dec hex filename 122828 1428 680156 804412 c463c /usr/sbin/tinysshd Unfortunately, I can't get it running on HP-UX 10.20, but I only have one of those left.
- Subsentient 5y ago
  No password authentication? That's a problem to me. I use keys for everything serious, but sometimes I want to have a Raspberry Pi with the root password "derp". :^(
  - chasil 5y ago
    No, it does not allow passwords. Also, logins on the root account cannot be disabled, although /etc/profile could also be used to shut that down.
    - boring_twenties 5y ago
      No, it can't. When you specify a command, {/etc/,~/.}profile are not loaded. E.g. ssh root@host rm -rf /

No CVEs, much smaller cipher set, password authentication is not allowed, only ed25519 user authentication is supported.

voakbasda 5y ago
No CVEs yet. It would be truly exceptional should that record withstand widespread adoption.
- chasil 5y ago
  Foregoing dynamic memory allocation, removing all non-DJB ciphers, and supporting only inetd drastically reduces the attack surface, so there is some hope that no CVEs will ever be found.
  - voakbasda 5y ago
    There may be some hope, but I would not bet on it. Indeed, I can imagine this very thread resulting in a miffed security researcher uttering "challenge accepted" and finding a way to break it. Again, that is not something I would bet against, given enough time and eyeballs. That said, I greatly appreciate this kind of effort, and I will probably even look into using it for small embedded projects in the future. My pessimism about security track records does not block out my optimism that we can and should do better, and this sounds much better than some other alternatives.
    - chasil 5y ago
      It is also quite useful for older systems where the native SSH doesn't support newer features. I have to support an Oracle 10g database on this platform, and I run tinyssh on port 26: $ ssh -p 26 myserver.com $ cat /etc/redhat-release /etc/oracle-release Red Hat Enterprise Linux Server release 5.11 (Tikanga) Oracle Linux Server release 5.11 $ ps -e -o user,pid:5,args | grep tinyssh root 14147 tinysshd -lpsv -x sftp=/usr/libexec/openssh/sftp-server /etc/tinyssh/sshkeydir $ size /usr/sbin/tinysshd text data bss dec hex filename 122828 1428 680156 804412 c463c /usr/sbin/tinysshd Unfortunately, I can't get it running on HP-UX 10.20, but I only have one of those left.
Subsentient 5y ago
No password authentication? That's a problem to me. I use keys for everything serious, but sometimes I want to have a Raspberry Pi with the root password "derp". :^(
- chasil 5y ago
  No, it does not allow passwords. Also, logins on the root account cannot be disabled, although /etc/profile could also be used to shut that down.
  - boring_twenties 5y ago
    No, it can't. When you specify a command, {/etc/,~/.}profile are not loaded. E.g. ssh root@host rm -rf /