Gitiles
Code Review Sign In
192.168.1.100 / T108 / c2023d5d03be91dbb983606f0ec5e9e4ea36c8c2 / . / package / network / services / dropbear / Config.in
blob: 0d012b21b0a5c5ff097ef289fbc65c264722af16 [file] [log] [blame]
b.liue9582032025-04-17 19:18:16 +0800[diff] [blame]1menu "Configuration"
2 depends on PACKAGE_dropbear
3
4config DROPBEAR_CURVE25519
5 bool "Curve25519 support"
6 default y
7 help
8 This enables the following key exchange algorithm:
9 curve25519-sha256@libssh.org
10
11 Increases binary size by about 4 kB (MIPS).
12
13config DROPBEAR_ECC
14 bool "Elliptic curve cryptography (ECC)"
15 help
16 Enables basic support for elliptic curve cryptography (ECC)
17 in key exchange and public key authentication.
18
19 Key exchange algorithms:
20 ecdh-sha2-nistp256
21
22 Public key algorithms:
23 ecdsa-sha2-nistp256
24
25 Increases binary size by about 24 kB (MIPS).
26
27 Note: select DROPBEAR_ECC_FULL if full ECC support is required.
28
29config DROPBEAR_ECC_FULL
30 bool "Elliptic curve cryptography (ECC), full support"
31 depends on DROPBEAR_ECC
32 help
33 Enables full support for elliptic curve cryptography (ECC)
34 in key exchange and public key authentication.
35
36 Key exchange algorithms:
37 ecdh-sha2-nistp256 (*)
38 ecdh-sha2-nistp384
39 ecdh-sha2-nistp521
40
41 Public key algorithms:
42 ecdsa-sha2-nistp256 (*)
43 ecdsa-sha2-nistp384
44 ecdsa-sha2-nistp521
45
46 (*) - basic ECC support; provided by DROPBEAR_ECC.
47
48 Increases binary size by about 4 kB (MIPS).
49
50config DROPBEAR_ED25519
51 bool "Ed25519 support"
52 default y if !SMALL_FLASH
53 help
54 This enables the following public key algorithm:
55 ssh-ed25519
56
57 Increases binary size by about 12 kB (MIPS).
58
59config DROPBEAR_CHACHA20POLY1305
60 bool "Chacha20-Poly1305 support"
61 default y
62 help
63 This enables the following authenticated encryption cipher:
64 chacha20-poly1305@openssh.com
65
66 Increases binary size by about 4 kB (MIPS).
67
68config DROPBEAR_U2F
69 bool "U2F/FIDO support"
70 default y
71 help
72 This option itself doesn't enable any support for U2F/FIDO
73 but subordinate options do:
74
75 - DROPBEAR_ECDSA_SK - ecdsa-sk keys support
76 depends on DROPBEAR_ECC ("Elliptic curve cryptography (ECC)")
77 - DROPBEAR_ED25519_SK - ed25519-sk keys support
78 depends on DROPBEAR_ED25519 ("Ed25519 support")
79
80config DROPBEAR_ECDSA_SK
81 bool "ECDSA-SK support"
82 default y
83 depends on DROPBEAR_U2F && DROPBEAR_ECC
84 help
85 This enables the following public key algorithm:
86 sk-ecdsa-sha2-nistp256@openssh.com
87
88config DROPBEAR_ED25519_SK
89 bool "Ed25519-SK support"
90 default y
91 depends on DROPBEAR_U2F && DROPBEAR_ED25519
92 help
93 This enables the following public key algorithm:
94 sk-ssh-ed25519@openssh.com
95
96config DROPBEAR_ZLIB
97 bool "Enable compression"
98 help
99 Enables compression using shared zlib library.
100
101 Increases binary size by about 0.1 kB (MIPS) and requires
102 additional 62 kB (MIPS) for a shared zlib library.
103
104config DROPBEAR_UTMP
105 bool "Utmp support"
106 depends on BUSYBOX_CONFIG_FEATURE_UTMP
107 help
108 This enables dropbear utmp support, the file /var/run/utmp is
109 used to track who is currently logged in.
110
111config DROPBEAR_PUTUTLINE
112 bool "Pututline support"
113 depends on DROPBEAR_UTMP
114 help
115 Dropbear will use pututline() to write the utmp structure into
116 the utmp file.
117
118config DROPBEAR_DBCLIENT
119 bool "Build dropbear with dbclient"
120 default y
121
122config DROPBEAR_ASKPASS
123 bool "Enable askpass helper support"
124 depends on DROPBEAR_DBCLIENT
125 help
126 This enables support for ssh-askpass helper in dropbear client
127 in order to authenticate on remote hosts.
128
129 Increases binary size by about 0.1 kB (MIPS).
130
131config DROPBEAR_DBCLIENT_AGENTFORWARD
132 bool "Enable agent forwarding in dbclient [LEGACY/SECURITY]"
133 default y
134 depends on DROPBEAR_DBCLIENT
135 help
136 Increases binary size by about 0.1 kB (MIPS).
137
138 Security notes:
139
140 SSH agent forwarding might cause security issues (locally and
141 on the jump machine).
142
143 Hovewer, it's enabled by default for compatibility with
144 previous OpenWrt/dropbear releases.
145
146 Consider DISABLING this option if you're building own OpenWrt
147 image.
148
149 Also see DROPBEAR_AGENTFORWARD (agent forwarding in dropbear
150 server itself).
151
152config DROPBEAR_SCP
153 bool "Build dropbear with scp"
154 default y
155
156config DROPBEAR_AGENTFORWARD
157 bool "Enable agent forwarding [LEGACY/SECURITY]"
158 default y
159 help
160 Increases binary size by about 0.1 kB (MIPS).
161
162 Security notes:
163
164 SSH agent forwarding might cause security issues (locally and
165 on the jump machine).
166
167 Hovewer, it's enabled by default for compatibility with
168 previous OpenWrt/dropbear releases.
169
170 Consider DISABLING this option if you're building own OpenWrt
171 image.
172
173 Also see DROPBEAR_DBCLIENT_AGENTFORWARD (agent forwarding in
174 dropbear client) if DROPBEAR_DBCLIENT is selected.
175
176config DROPBEAR_MODERN_ONLY
177 bool "Use modern crypto only [BREAKS COMPATIBILITY]"
178 select DROPBEAR_ED25519
179 select DROPBEAR_CURVE25519
180 select DROPBEAR_CHACHA20POLY1305
181 help
182 This option enables:
183 - Chacha20-Poly1305
184 - Curve25519
185 - Ed25519
186 and disables:
187 - AES
188 - RSA
189
190 Reduces binary size by about 64 kB (MIPS) from default
191 configuration.
192
193 Consider enabling this option if you're building own OpenWrt
194 image and using modern SSH software everywhere.
195
196endmenu