menu "Configuration" depends on PACKAGE_dropbear config DROPBEAR_CURVE25519 bool "Curve25519 support" default y help This enables the following key exchange algorithm: curve25519-sha256@libssh.org Increases binary size by about 4 kB (MIPS). config DROPBEAR_ECC bool "Elliptic curve cryptography (ECC)" help Enables basic support for elliptic curve cryptography (ECC) in key exchange and public key authentication. Key exchange algorithms: ecdh-sha2-nistp256 Public key algorithms: ecdsa-sha2-nistp256 Increases binary size by about 24 kB (MIPS). Note: select DROPBEAR_ECC_FULL if full ECC support is required. config DROPBEAR_ECC_FULL bool "Elliptic curve cryptography (ECC), full support" depends on DROPBEAR_ECC help Enables full support for elliptic curve cryptography (ECC) in key exchange and public key authentication. Key exchange algorithms: ecdh-sha2-nistp256 (*) ecdh-sha2-nistp384 ecdh-sha2-nistp521 Public key algorithms: ecdsa-sha2-nistp256 (*) ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 (*) - basic ECC support; provided by DROPBEAR_ECC. Increases binary size by about 4 kB (MIPS). config DROPBEAR_ED25519 bool "Ed25519 support" default y if !SMALL_FLASH help This enables the following public key algorithm: ssh-ed25519 Increases binary size by about 12 kB (MIPS). config DROPBEAR_CHACHA20POLY1305 bool "Chacha20-Poly1305 support" default y help This enables the following authenticated encryption cipher: chacha20-poly1305@openssh.com Increases binary size by about 4 kB (MIPS). config DROPBEAR_U2F bool "U2F/FIDO support" default y help This option itself doesn't enable any support for U2F/FIDO but subordinate options do: - DROPBEAR_ECDSA_SK - ecdsa-sk keys support depends on DROPBEAR_ECC ("Elliptic curve cryptography (ECC)") - DROPBEAR_ED25519_SK - ed25519-sk keys support depends on DROPBEAR_ED25519 ("Ed25519 support") config DROPBEAR_ECDSA_SK bool "ECDSA-SK support" default y depends on DROPBEAR_U2F && DROPBEAR_ECC help This enables the following public key algorithm: sk-ecdsa-sha2-nistp256@openssh.com config DROPBEAR_ED25519_SK bool "Ed25519-SK support" default y depends on DROPBEAR_U2F && DROPBEAR_ED25519 help This enables the following public key algorithm: sk-ssh-ed25519@openssh.com config DROPBEAR_ZLIB bool "Enable compression" help Enables compression using shared zlib library. Increases binary size by about 0.1 kB (MIPS) and requires additional 62 kB (MIPS) for a shared zlib library. config DROPBEAR_UTMP bool "Utmp support" depends on BUSYBOX_CONFIG_FEATURE_UTMP help This enables dropbear utmp support, the file /var/run/utmp is used to track who is currently logged in. config DROPBEAR_PUTUTLINE bool "Pututline support" depends on DROPBEAR_UTMP help Dropbear will use pututline() to write the utmp structure into the utmp file. config DROPBEAR_DBCLIENT bool "Build dropbear with dbclient" default y config DROPBEAR_DBCLIENT_AGENTFORWARD bool "Enable agent forwarding in dbclient [LEGACY/SECURITY]" default y depends on DROPBEAR_DBCLIENT help Increases binary size by about 0.1 kB (MIPS). Security notes: SSH agent forwarding might cause security issues (locally and on the jump machine). Hovewer, it's enabled by default for compatibility with previous OpenWrt/dropbear releases. Consider DISABLING this option if you're building own OpenWrt image. Also see DROPBEAR_AGENTFORWARD (agent forwarding in dropbear server itself). config DROPBEAR_SCP bool "Build dropbear with scp" default y config DROPBEAR_ASKPASS bool "Enable askpass helper support" depends on DROPBEAR_DBCLIENT help This enables support for ssh-askpass helper in dropbear client in order to authenticate on remote hosts. Increases binary size by about 0.1 kB (MIPS). config DROPBEAR_AGENTFORWARD bool "Enable agent forwarding [LEGACY/SECURITY]" default y help Increases binary size by about 0.1 kB (MIPS). Security notes: SSH agent forwarding might cause security issues (locally and on the jump machine). Hovewer, it's enabled by default for compatibility with previous OpenWrt/dropbear releases. Consider DISABLING this option if you're building own OpenWrt image. Also see DROPBEAR_DBCLIENT_AGENTFORWARD (agent forwarding in dropbear client) if DROPBEAR_DBCLIENT is selected. config DROPBEAR_MODERN_ONLY bool "Use modern crypto only [BREAKS COMPATIBILITY]" select DROPBEAR_ED25519 select DROPBEAR_CURVE25519 select DROPBEAR_CHACHA20POLY1305 help This option enables: - Chacha20-Poly1305 - Curve25519 - Ed25519 and disables: - AES - RSA - SHA1 Reduces binary size by about 64 kB (MIPS) from default configuration. Consider enabling this option if you're building own OpenWrt image and using modern SSH software everywhere. endmenu