Hacker News Reader

Comment by daneel_w | Hacker News Reader

How does it compare to Dropbear?

No CVEs, much smaller cipher set, password authentication is not allowed, only ed25519 user authentication is supported.

No CVEs yet. It would be truly exceptional should that record withstand widespread adoption.

Foregoing dynamic memory allocation, removing all non-DJB ciphers, and supporting only inetd drastically reduces the attack surface, so there is some hope that no CVEs will ever be found.

There may be some hope, but I would not bet on it. Indeed, I can imagine this very thread resulting in a miffed security researcher uttering "challenge accepted" and finding a way to break it. Again, that is not something I would bet against, given enough time and eyeballs.

That said, I greatly appreciate this kind of effort, and I will probably even look into using it for small embedded projects in the future. My pessimism about security track records does not block out my optimism that we can and should do better, and this sounds much better than some other alternatives.

It is also quite useful for older systems where the native SSH doesn't support newer features.

I have to support an Oracle 10g database on this platform, and I run tinyssh on port 26:

    $ ssh -p 26 myserver.com

    $ cat /etc/redhat-release /etc/oracle-release
    Red Hat Enterprise Linux Server release 5.11 (Tikanga)
    Oracle Linux Server release 5.11

    $ ps -e -o user,pid:5,args | grep tinyssh                                 
    root     14147 tinysshd -lpsv -x sftp=/usr/libexec/openssh/sftp-server /etc/tinyssh/sshkeydir

    $ size /usr/sbin/tinysshd
       text    data     bss     dec     hex filename
     122828    1428  680156  804412   c463c /usr/sbin/tinysshd

Unfortunately, I can't get it running on HP-UX 10.20, but I only have one of those left.

No password authentication? That's a problem to me. I use keys for everything serious, but sometimes I want to have a Raspberry Pi with the root password "derp". :^(

No, it does not allow passwords.

Also, logins on the root account cannot be disabled, although /etc/profile could also be used to shut that down.

No, it can't. When you specify a command, {/etc/,~/.}profile are not loaded. E.g. ssh root@host rm -rf /

Reply on news.ycombinator.com