Hacker News Reader

Comment by themoonisachees | Hacker News Reader

I don't think there's much of one. The concept in itself isn't really useful, I've never seen someone go "you know the real problem with sshd? It's too bloated".

It is slightly useful to put in smaller devices that don't have much space but I think it still relies on top many linux facilities to be an appropriate fix for that too. Still, cool project.

View on HN

I suspect the average openssh-server user just uses it for remote terminal access and copying files. Reducing the attack surface by dropping features and outdated standards is certainly valuable.

Dropbear ssh is very useful when you have a full disk encryption on a remote server and want to be able to decrypt it after a reboot.

There's technically no reason OpenSSHd can't also be used in this context. Maybe 2 decades ago there was a legitimate performance/disk space reason which is why Dropbear was preferred for this use case (and the convention remains to do this day), but nowadays the couple megabytes of difference in your initrd between using Dropbear and OpenSSH won't matter.

> There's technically no reason OpenSSHd can't also be used in this context.

For initrd you generally prefer static binaries. Not saying that OpenSSHd doesn't build statically, but having less code and dependencies makes it easier to statically compile.

But yes, technically there is no reason to not use OpenSSHd, but in practice having a smaller and more self contained binary helps considering that you would want the bare minimum during initrd.

What dependencies does openssh have?

OpenSSL

if you don't care for v1 and odd cyphers, --without-openssl

Reply on news.ycombinator.com