Package: dropbear
Version: 0.51-1
Severity: wishlist
Hello,
according to the Debian changelog [1], dropbear in Debian doesn't ship
the scp binary, which is a problem when installed on embedded devices,
like the Openmoko FreeRunner (GTA02) [2].
Is there any specific reason the scp binary is not compiled in?
Installing openssh-client requires 2MB, which can be a problem on small
flash memories.
Thx, bye,
Gismo / Luca
PS, I cc:ed the pkg-fso-maint mailing list, since this bug directly
concerns Openmoko users :-)
Footnotes:
[1] the first and only occurrence is in version 0.48-1:
=====
dropbear (0.48-1) unstable; urgency=medium
* New upstream release.
* SECURITY: Improve handling of denial of service attempts from a single
IP.
* debian/implicit: update to revision 1.11.
* new upstream release updates to scp from OpenSSH 4.3p2 - fixes a
security issue where use of system() could cause users to execute
arbitrary code through malformed filenames; CVE-2006-0225 (see also
#349645); the scp binary is not provided by this package though.
-- Gerrit Pape <[email protected]> Fri, 10 Mar 2006 22:00:32 +0000
=====
[2] http://lists.alioth.debian.org/pipermail/pkg-fso-maint/2008-August/000006.html
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: armel (armv4tl)
Kernel: Linux 2.6.24 (PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages dropbear depends on:
ii libc6 2.7-13 GNU C Library: Shared libraries
ii libgcc1 1:4.3.1-9 GCC support library
ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime
dropbear recommends no packages.
Versions of packages dropbear suggests:
pn openssh-client <none> (no description available)
pn runit <none> (no description available)
-- no debconf information
Acknowledgement sent
to "W. Martin Borgert" <[email protected]>:
Extra info received and forwarded to list. Copy sent to Gerrit Pape <[email protected]>.
(Mon, 16 Aug 2010 17:15:03 GMT) (full text, mbox, link).
Hi,
any chance to get this fixed? It would be very helpful to
have an scp binary for an embedded system. In 2008-12 it
hasn't been included, because we were already in the
freeze for Lenny, now we are in freeze for Squeeze...
TIA
Acknowledgement sent
to Jens Rottmann <[email protected]>:
Extra info received and forwarded to list. Copy sent to Gerrit Pape <[email protected]>.
(Tue, 24 Jul 2012 17:06:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Guilhem Moulin <[email protected]>:
Extra info received and forwarded to list. Copy sent to Gerrit Pape <[email protected]>.
(Fri, 18 Sep 2015 15:12:03 GMT) (full text, mbox, link).
Control: tag -1 moreinfo
Hi there,
I wonder what's the best way to close this. dropbear and openssh-client
can currently coexist, because the SSH clients have different binary
names: /usr/bin/dbclient and /usr/bin/ssh. We could also install
dropbear SCP binary to e.g., /usr/bin/dbscp to have a non-conflicting
SCP *client*.
However that doesn't for the *server* part, since AFAIK a remote
executable called ‘scp’ is required by the SCP protocol (and needs to be
in the remote $PATH). So I believe the options at hands are:
* ask the OpenSSH maintainers to consider using an alternative for
their scp binary (and possibly ssh too), or
* provide a new package dropbear-client to ship /usr/bin/{dbclient,scp}
and make it conflict with openssh-client.
Any thoughts or suggestions?
Cheers,
--
Guilhem.
Acknowledgement sent
to Mert Dirik <[email protected]>:
Extra info received and forwarded to list. Copy sent to Guilhem Moulin <[email protected]>.
(Mon, 05 Sep 2016 12:21:25 GMT) (full text, mbox, link).
Subject: Re: dropbear: please provide the scp binary
Date: Mon, 5 Sep 2016 15:15:46 +0300
On Fri, 18 Sep 2015 17:09:43 +0200 Guilhem Moulin <[email protected]> wrote:
> Control: tag -1 moreinfo
>
> Hi there,
>
> I wonder what's the best way to close this. dropbear and openssh-client
> can currently coexist, because the SSH clients have different binary
> names: /usr/bin/dbclient and /usr/bin/ssh. We could also install
> dropbear SCP binary to e.g., /usr/bin/dbscp to have a non-conflicting
> SCP *client*.
>
> However that doesn't for the *server* part, since AFAIK a remote
> executable called ‘scp’ is required by the SCP protocol (and needs to be
> in the remote $PATH). So I believe the options at hands are:
>
> * ask the OpenSSH maintainers to consider using an alternative for
> their scp binary (and possibly ssh too), or
> * provide a new package dropbear-client to ship /usr/bin/{dbclient,scp}
> and make it conflict with openssh-client.
>
> Any thoughts or suggestions?
>
Hi Mr. Moulin,
I came across this report while I was trying to get Ansible working
with dropbear.
I know you've wanted to get some suggestions last year but this bug
report, which is only followed by a couple users like me who were
affected from the lack of scp, is not really the right place for
getting answer to the questions you have in your mind. My humble
suggestion is you should talk to OpenSSH maintainers on how to proceed
with it and maybe consult debian-devel for policy related questions or
best practices.
Thanks for your consideration and let's hope we'll have a more
comprehensive dropbear for stretch!
Acknowledgement sent
to Sven Oliver Moll <[email protected]>:
Extra info received and forwarded to list. Copy sent to Guilhem Moulin <[email protected]>.
(Wed, 25 Jan 2017 12:27:03 GMT) (full text, mbox, link).
The attached archive contains a suggestion on how scp could be added.
Winke: o/~
SvOlli
--
| _______ |
| ( /\ | Such Dir 'nen Baum begiesse ihn
|__)v\/lli a.k.a.| und schau den Voegeln nach, die nach Sueden ziehn.
|Sven Oliver Moll| -- Stoppok, "Happy End"
Acknowledgement sent
to Guilhem Moulin <[email protected]>:
Extra info received and forwarded to list.
(Sat, 16 Sep 2017 19:24:05 GMT) (full text, mbox, link).
Control: block -1 by 875979
On Mon, 05 Sep 2016 at 15:15:46 +0300, Mert Dirik wrote:
> I know you've wanted to get some suggestions last year but this bug
> report, which is only followed by a couple users like me who were
> affected from the lack of scp, is not really the right place for
> getting answer to the questions you have in your mind. My humble
> suggestion is you should talk to OpenSSH maintainers on how to proceed
> with it and maybe consult debian-devel for policy related questions or
> best practices.
In fact the ‘scp.c’ found in the Dropbear source package comes from
OpenSSH with minor modifications, so it makes little sense to ship a
second version the scp binary.
After discussion with upstream and the OpenSSH maintainers, we agreed on
a solution:
1. ship OpenSSH's /usr/bin/scp in a dedicated binary package (unlike
/usr/bin/ssh it only depends on libc6), cf. #875979;
2. make dbclient(1) accept (as no-op) the options passed by scp(1) to
avoid warnings: `-x -oForwardAgent=no -oPermitLocalCommand=no
-oClearAllForwardings=yes`; and
3. for the client part, ship a `dbscp` shell wrapper invoking scp(1)
with dbclient(1) as SSH client.
See https://lists.debian.org/debian-ssh/2017/07/msg00019.html for
details.
--
Guilhem.
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.