The difference will be uClibc, yes. Have a look at their buildroot system, that should be able to easily build a binary. Alternatively, don't build it statically and it will be even smaller.
I haven't checked that 110kB is still attainable with the current codebase, though it should still be in that general ballpark. Matt On Thu, May 14, 2009 at 05:49:59PM +0530, Sourav Chakraborty wrote: > Hello List, > We are basically requiring a small footprint dropbear server binary for x86 > linux and have hence followed the steps-- > 1. have downloaded dropbear-0.52 source code in tar.gz format. > 2. ./configure --disable-zlib --disable-syslog > 3. modified the Makefile to append-- > -ffunction-sections -fdata-sections -DLTC_NO_BSWAP with CFLAGS and > -Wl,--gc-sections with LDFLAGS4.modified options.h file --(attached)5. make > STATIC=1 MULTI=1 PROGRAMS=dropbear > 6. strip dropbear > > We have done the above on x86 machine having FC3 linux with gcc 3.4.2 > 20041017. > > The dropbear binary generated after the "strip" is of size 549120 bytes i.e > ~549kB.But from the msg archive I could see that -- > "A small memory footprint suitable for > > memory-constrained environments - Dropbear can compile > > to a 110kB statically linked binary with uClibc (and > > only minimal options selected)." > Of course I am not using uClibc,but is that the reason for such a difference > in the footprint?What else can I do to decreasethe footprint to a size of > 110kB as mentioned?Please reply asap as this is kind of urgent :-)Thanks and > RegardsSourav > /* Dropbear SSH > * Copyright (c) 2002,2003 Matt Johnston > * All rights reserved. See LICENSE for the license. */ > > #ifndef _OPTIONS_H_ > #define _OPTIONS_H_ > > /****************************************************************** > * Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif" > * parts are to allow for commandline -DDROPBEAR_XXX options etc. > ******************************************************************/ > > #ifndef DROPBEAR_DEFPORT > #define DROPBEAR_DEFPORT "22" > #endif > > #ifndef DROPBEAR_DEFADDRESS > /* Listen on all interfaces */ > #define DROPBEAR_DEFADDRESS "" > #endif > > /* Default hostkey paths - these can be specified on the command line */ > #ifndef DSS_PRIV_FILENAME > #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key" > #endif > #ifndef RSA_PRIV_FILENAME > #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key" > #endif > > /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens > * on chosen ports and keeps accepting connections. This is the default. > * > * Set INETD_MODE if you want to be able to run Dropbear with inetd (or > * similar), where it will use stdin/stdout for connections, and each process > * lasts for a single connection. Dropbear should be invoked with the -i flag > * for inetd, and can only accept IPv4 connections. > * > * Both of these flags can be defined at once, don't compile without at least > * one of them. */ > #define NON_INETD_MODE > #define INETD_MODE > > /* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is > * perhaps 20% slower for pubkey operations (it is probably worth > experimenting > * if you want to use this) */ > /*#define NO_FAST_EXPTMOD*/ > //sourav > #define NO_FAST_EXPTMOD > > /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save > several kB in binary size, however will make the symmetrical ciphers (AES, DES > etc) slower (perhaps by 50%). Recommended for most small systems. */ > #define DROPBEAR_SMALL_CODE > > /* Enable X11 Forwarding - server only */ > //sourav > /*#define ENABLE_X11FWD*/ > > /* Enable TCP Fowarding */ > /* 'Local' is "-L" style (client listening port forwarded via server) > * 'Remote' is "-R" style (server listening port forwarded via client) */ > //sourav > /*#define ENABLE_CLI_LOCALTCPFWD > #define ENABLE_CLI_REMOTETCPFWD > > #define ENABLE_SVR_LOCALTCPFWD > #define ENABLE_SVR_REMOTETCPFWD*/ > > /* Enable Authentication Agent Forwarding - server only for now */ > //sourav > /*#define ENABLE_AGENTFWD*/ > > > /* Note: Both ENABLE_CLI_PROXYCMD and ENABLE_CLI_NETCAT must be set to > * allow multihop dbclient connections */ > > /* Allow using -J <proxycommand> to run the connection through a > pipe to a program, rather the normal TCP connection */ > //sourav > /*#define ENABLE_CLI_PROXYCMD*/ > > /* Enable "Netcat mode" option. This will forward standard input/output > * to a remote TCP-forwarded connection */ > //sourav > /*#define ENABLE_CLI_NETCAT*/ > > /* Encryption - at least one required. > * Protocol RFC requires 3DES and recommends AES128 for interoperability. > * Including multiple keysize variants the same cipher > * (eg AES256 as well as AES128) will result in a minimal size increase.*/ > //sourav > /*#define DROPBEAR_AES128*/ > #define DROPBEAR_3DES > /*#define DROPBEAR_AES256*/ > /*#define DROPBEAR_BLOWFISH*/ > /*#define DROPBEAR_TWOFISH256*/ > /*#define DROPBEAR_TWOFISH128*/ > > /* Enable "Counter Mode" for ciphers. This is more secure than normal > * CBC mode against certain attacks. This adds around 1kB to binary > * size and is recommended for most cases */ > #define DROPBEAR_ENABLE_CTR_MODE > > /* Message Integrity - at least one required. > * Protocol RFC requires sha1 and recommends sha1-96. > * sha1-96 may be of use for slow links, as it has a smaller overhead. > * > * Note: there's no point disabling sha1 to save space, since it's used > * for the random number generator and public-key cryptography anyway. > * Disabling it here will just stop it from being used as the integrity > portion > * of the ssh protocol. > * > * These hashes are also used for public key fingerprints in logs. > * If you disable MD5, Dropbear will fall back to SHA1 fingerprints, > * which are not the standard form. */ > #define DROPBEAR_SHA1_HMAC > /*#define DROPBEAR_SHA1_96_HMAC*/ > //sourav > /*#define DROPBEAR_MD5_HMAC*/ > > /* Hostkey/public key algorithms - at least one required, these are used > * for hostkey as well as for verifying signatures with pubkey auth. > * Removing either of these won't save very much space. > * SSH2 RFC Draft requires dss, recommends rsa */ > #define DROPBEAR_RSA > //sourav > /*#define DROPBEAR_DSS*/ > > /* RSA can be vulnerable to timing attacks which use the time required for > * signing to guess the private key. Blinding avoids this attack, though makes > * signing operations slightly slower. */ > #define RSA_BLINDING > > /* Define DSS_PROTOK to use PuTTY's method of generating the value k for dss, > * rather than just from the random byte source. Undefining this will save you > * ~4k in binary size with static uclibc, but your DSS hostkey could be > exposed > * if the random number source isn't good. In general this isn't required */ > /* #define DSS_PROTOK */ > > /* Whether to do reverse DNS lookups. */ > //sourav > /*#define DO_HOST_LOOKUP*/ > > /* Whether to print the message of the day (MOTD). This doesn't add much code > * size */ > //sourav > /*#define DO_MOTD*/ > > /* The MOTD file path */ > #ifndef MOTD_FILENAME > #define MOTD_FILENAME "/etc/motd" > #endif > > /* Authentication Types - at least one required. > RFC Draft requires pubkey auth, and recommends password */ > > /* Note: PAM auth is quite simple, and only works for PAM modules which just > do > * a simple "Login: " "Password: " (you can edit the strings in > svr-authpam.c). > * It's useful for systems like OS X where standard password crypts don't > work, > * but there's an interface via a PAM module - don't bother using it > otherwise. > * You can't enable both PASSWORD and PAM. */ > > #define ENABLE_SVR_PASSWORD_AUTH > /* PAM requires ./configure --enable-pam */ > /*#define ENABLE_SVR_PAM_AUTH*/ > //sourav > /*#define ENABLE_SVR_PUBKEY_AUTH*/ > > /* Wether to ake public key options in authorized_keys file into account */ > #ifdef ENABLE_SVR_PUBKEY_AUTH > #define ENABLE_SVR_PUBKEY_OPTIONS > #endif > > #define ENABLE_CLI_PASSWORD_AUTH > #define ENABLE_CLI_PUBKEY_AUTH > #define ENABLE_CLI_INTERACT_AUTH > > /* This variable can be used to set a password for client > * authentication on the commandline. Beware of platforms > * that don't protect environment variables of processes etc. Also > * note that it will be provided for all "hidden" client-interactive > * style prompts - if you want something more sophisticated, use > * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/ > #define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD" > > /* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of > * a helper program for the ssh client. The helper program should be > * specified in the SSH_ASKPASS environment variable, and dbclient > * should be run with DISPLAY set and no tty. The program should > * return the password on standard output */ > /*#define ENABLE_CLI_ASKPASS_HELPER*/ > > /* Random device to use - define either DROPBEAR_RANDOM_DEV or > * DROPBEAR_PRNGD_SOCKET. > * DROPBEAR_RANDOM_DEV is recommended on hosts with a good /dev/(u)random, > * otherwise use run prngd (or egd if you want), specifying the socket. > * The device will be queried for a few dozen bytes of seed a couple of times > * per session (or more for very long-lived sessions). */ > > /* We'll use /dev/urandom by default, since /dev/random is too much hassle. > * If system developers aren't keeping seeds between boots nor getting > * any entropy from somewhere it's their own fault. */ > #define DROPBEAR_RANDOM_DEV "/dev/urandom" > > /* prngd must be manually set up to produce output */ > /*#define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"*/ > > /* Specify the number of clients we will allow to be connected but > * not yet authenticated. After this limit, connections are rejected */ > /* The first setting is per-IP, to avoid denial of service */ > #ifndef MAX_UNAUTH_PER_IP > #define MAX_UNAUTH_PER_IP 5 > #endif > > /* And then a global limit to avoid chewing memory if connections > * come from many IPs */ > #ifndef MAX_UNAUTH_CLIENTS > #define MAX_UNAUTH_CLIENTS 30 > #endif > > /* Maximum number of failed authentication tries (server option) */ > #ifndef MAX_AUTH_TRIES > #define MAX_AUTH_TRIES 10 > #endif > > /* The default file to store the daemon's process ID, for shutdown > scripts etc. This can be overridden with the -P flag */ > #ifndef DROPBEAR_PIDFILE > #define DROPBEAR_PIDFILE "/var/run/dropbear.pid" > #endif > > /* The command to invoke for xauth when using X11 forwarding. > * "-q" for quiet */ > #ifndef XAUTH_COMMAND > #define XAUTH_COMMAND "/usr/X11R6/bin/xauth -q" > #endif > > /* if you want to enable running an sftp server (such as the one included with > * OpenSSH), set the path below. If the path isn't defined, sftp will not > * be enabled */ > #ifndef SFTPSERVER_PATH > #define SFTPSERVER_PATH "/usr/libexec/sftp-server" > #endif > > /* This is used by the scp binary when used as a client binary. If you're > * not using the Dropbear client, you'll need to change it */ > #define _PATH_SSH_PROGRAM "/usr/bin/dbclient" > > /* Whether to log commands executed by a client. This only logs the > * (single) command sent to the server, not what a user did in a > * shell/sftp session etc. */ > /* #define LOG_COMMANDS */ > > /* Window size limits. These tend to be a trade-off between memory > usage and network performance: */ > /* Size of the network receive window. This amount of memory is allocated > as a per-channel receive buffer. Increasing this value can make a > significant difference to network performance. 24kB was empirically > chosen for a 100mbit ethernet network. The value can be altered at > runtime with the -W argument. */ > #define DEFAULT_RECV_WINDOW 24576 > /* Maximum size of a received SSH data packet - this _MUST_ be >= 32768 > in order to interoperate with other implementations */ > #define RECV_MAX_PAYLOAD_LEN 32768 > /* Maximum size of a transmitted data packet - this can be any value, > though increasing it may not make a significant difference. */ > #define TRANS_MAX_PAYLOAD_LEN 16384 > > /* Ensure that data is transmitted every KEEPALIVE seconds. This can > be overridden at runtime with -K. 0 disables keepalives */ > #define DEFAULT_KEEPALIVE 0 > > /* Ensure that data is received within IDLE_TIMEOUT seconds. This can > be overridden at runtime with -I. 0 disables idle timeouts */ > #define DEFAULT_IDLE_TIMEOUT 0 > > /* The default path. This will often get replaced by the shell */ > #define DEFAULT_PATH "/usr/bin:/bin" > > /* Some other defines (that mostly should be left alone) are defined > * in sysoptions.h */ > #include "sysoptions.h" > > #endif /* _OPTIONS_H_ */
