dropbear: hide dropbear version
authorKevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Wed, 7 Sep 2016 16:23:51 +0000 (17:23 +0100)
committerFelix Fietkau <nbd@nbd.name>
Sat, 10 Sep 2016 10:17:39 +0000 (12:17 +0200)
As security precaution and to limit the attack surface based on
the version reported by tools like nmap mask out the dropbear
version so the version is not visible anymore by snooping on the
wire. Version is still visible by 'dropbear -V'

Based on a patch by Hans Dedecker <dedeckeh@gmail.com>

Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Signed-off-by: Felix Fietkau <nbd@nbd.name> [remove trailing _]
package/network/services/dropbear/Makefile

index 36bcb4a..b80f4d5 100644 (file)
@@ -105,6 +105,10 @@ define Build/Configure
          mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \
        done
 
+       # remove protocol idented software version number
+       $(SED) 's,^#define LOCAL_IDENT .*$$$$,#define LOCAL_IDENT "SSH-2.0-dropbear",g' \
+               $(PKG_BUILD_DIR)/sysoptions.h
+
        # Enforce rebuild of svr-chansession.c
        rm -f $(PKG_BUILD_DIR)/svr-chansession.o
 endef