DROPBEAR(8)

📦
version 2026.94 · 5 versions
, in arch rolling, nixpkgs unstable, ubuntu stonking

💖 DROPBEAR(8) — like, the manual page, but make it make sense 💖

okay bestie, gather round, because we're reading the dropbear(8) page from the System Manager's Manual and I'm gonna hold your hand through every single line. it's giving ✨server girl summer✨. no cap.

🌸 NAME 🌸

dropbear — a lightweight SSH server. that's it. that's the girl. tiny, does her job, slays.

🎀 SYNOPSIS 🎀

dropbear [flag arguments] [-b banner] [-r hostkeyfile]
         [-p [address:]port]

so you just... run dropbear with some flags and she's up. the flags you see in brackets are the optional little accessories. 💅

🦋 DESCRIPTION 🦋

dropbear is a small SSH server. like, actually small. not "small" the way your ex said he was "working on himself". genuinely compact. 🔥

✨ OPTIONS ✨

here's the whole menu, no skips, no cuts, every single one:

  • -b banner — bannerfile. shows the contents of the file banner before the user logs in. default: none, so no banner unless you ask for one.
  • -r hostkey — use the contents of the file hostkey as the SSH hostkey. that file gets made with dropbearkey(1) or automatically via the -R option. go peek at “Host Key Files” down below. 🔑
  • -R — generate hostkeys automatically. again, see “Host Key Files”. self-sufficient queen behavior.
  • -F — don't fork into background. she stays right there in the foreground with you. clingy but cute.
  • -E — log to standard error instead of syslog.
  • -e — pass the server environment on to all child processes. this is required, for example, if Dropbear is launched on the fly from a SLURM workload manager. the environment is not passed by default, jsyk.
⚠️ careful bestie: this could expose secrets sitting in environment variables from the calling process. use with caution. fr fr.
  • -m — don't display the message of the day on login. bye motd 🫶
  • -w — disallow root logins.
  • -s — disable password logins entirely.
  • -g — disable password logins for root specifically. (root, queen, you're on keys only now.)
  • -t — enable two-factor authentication. both password login and public key authentication are required. should not be used with the -s option. pick a struggle, honestly.
  • -j — disable local port forwarding. this includes unix stream forwards.
  • -k — disable remote port forwarding.
  • -p [address:]port — listen on the specified address and TCP port. if you give just a port, she listens on all addresses. up to 10 of these can be specified, and the default is 22 if you specify none. 🙈
  • -l interface — listen on the specified interface.
  • -i — service program mode. use this to run dropbear under TCP/IP servers like inetd, tcpsvd, or tcpserver. in program mode the -F option is implied, and -p options are ignored. lowkey iconic for embedded stuff.
  • -P pidfile — specify a pidfile to create when running as a daemon. if you don't specify one, the default is /var/run/dropbear.pid.
  • -a — allow remote hosts to connect to forwarded ports.
  • -W windowsize — specify the per-channel receive window buffer size. increasing this may improve network performance at the expense of memory use. use -h to see the default buffer size. (yes, -h, go look 👀)
  • -K timeout_seconds — make sure traffic is transmitted at a certain interval, in seconds. super useful for working around firewalls or routers that drop connections after a certain period of inactivity. the trade-off? a session may be closed if there's a temporary lapse of network connectivity. a setting of 0 disables keepalives. and if no response is received for 3 consecutive keepalives, the connection will be closed. 💀
  • -I idle_timeout — disconnect the session if no traffic is transmitted or received for idle_timeout seconds.
  • -M — set maximum session duration in seconds. all sessions will close after this time. if a compile-time setting was set (default is none), then setting -M 0 will disable the session duration timeout.
  • -z — by default Dropbear sends network traffic with the AF21 setting for QoS, letting network devices give it higher priority. some devices may have problems with that, so -z can be used to disable it.
  • -T max_authentication_attempts — set the number of authentication attempts allowed per connection. if unspecified, the default is 10 (MAX_AUTH_TRIES).
  • -c forced_command — disregard the command/shell provided by the user and always run forced_command. this also overrides any authorized_keys command= option. the original command is saved in the SSH_ORIGINAL_COMMAND environment variable (see below).

the forced command is started using the user's normal shell, the same as occurs for normal commands.

unix stream forwarding is disabled when a forced command is set, since that may allow a bypass of the forced command. other SSH features such as TCP forwarding are still allowed by default — it may be desirable to disable those using the -j or -k options when using forced command. 🫣

  • -D authorized_keys_dir — specify the directory to use for authorized_keys files. the default is ~/.ssh, and paths with a leading ~/ will be home directory expanded.
  • -Q algo — query supported algorithms. options are kex, sig, cipher, mac, compress.
  • -V — print the version. short, sweet, iconic.

🌈 FILES 🌈

🗝️ Authorized Keys 🗝️

~/.ssh/authorized_keys can be set up to allow remote login with a Ed25519, RSA, or ECDSA key. the authorized_keys file and its containing ~/.ssh directory must only be writable by the user, otherwise Dropbear will not allow a login using public key authentication. so like... don't let anybody else touch your stuff. boundaries, bestie. 💅

each line is of the form

[restrictions] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIgAsp... [comment]

and can be extracted from a Dropbear private host key with dropbearkey -y. this is the same format as used by OpenSSH, though the restrictions are a subset (keys with unknown restrictions are ignored). restrictions are comma separated, with double quotes around spaces in arguments. the available restrictions are:

  • no-port-forwarding — don't allow port forwarding for this connection, including unix streams.
  • no-agent-forwarding — don't allow agent forwarding for this connection.
  • no-X11-forwarding — don't allow X11 forwarding for this connection.
  • no-pty — disable PTY allocation. note that a user can still obtain most of the same functionality with other means even if no-pty is set. 🙈
  • restrict — applies all the no- restrictions listed above. it's the bundle deal. 🎀
  • permitopen="host:port" — restrict local port forwarding so that connection is allowed only to the specified host and port. multiple permitopen options separated by commas can be set in authorized_keys. wildcard character (*) may be used in port specification for matching any port. hosts must be literal domain names or IP addresses.
  • permitlisten="port" — restrict remote port forwarding listeners to the given port. multiple permitlisten="port" options separated by commas can be set in authorized_keys. port can be 0 to allow the listen port to be dynamically allocated on the server.
  • command="forced_command" — disregard the command provided by the user and always run forced_command. the -c command line option overrides this. see the -c documentation for behaviour of forced commands.

when using command= it is often desirable to also use the restrict option to avoid other SSH features that may allow additional access. 🫶

🔐 Host Key Files 🔐

host key files are read at startup from a standard location, by default:

  • /etc/dropbear/dropbear_dss_host_key
  • /etc/dropbear/dropbear_rsa_host_key
  • /etc/dropbear/dropbear_ecdsa_host_key
  • /etc/dropbear/dropbear_ed25519_host_key

if the -r command line option is specified, the default files are not loaded. host key files are of the form generated by dropbearkey(1). the -R option can be used to automatically generate keys in the default location — keys will be generated after startup when the first connection is established. this had the benefit that the system /dev/urandom random number source has a better chance of being securely seeded. ✨ entropy glow-up ✨

📜 Message Of The Day 📜

by default the file /etc/motd will be printed for any login shell (unless disabled at compile-time). this can also be disabled per-user by creating a file ~/.hushlogin. sometimes you just want peace and quiet, and honestly? valid.

💜 ENVIRONMENT VARIABLES 💜

Dropbear sets the standard variables USER, LOGNAME, HOME, SHELL, PATH, and TERM.

the variables below are set for sessions as appropriate.

  • SSH_TTY — this is set to the allocated TTY if a PTY was used.
  • SSH_CONNECTION — contains <remote_ip> <remote_port> <local_ip> <local_port>.
  • DISPLAY — set X11 forwarding is used.
  • SSH_ORIGINAL_COMMAND — if a command= authorized_keys option was used, the original command is specified in this variable. if a shell was requested this is set to an empty value.
  • SSH_AUTH_SOCK — set to a forwarded ssh-agent connection.

⭐ NOTES ⭐

Dropbear only supports SSH protocol version 2. one protocol, done properly. main character energy. 👑

🦄 SEE ALSO 🦄

https://matt.ucc.asn.au/dropbear/dropbear.html

💖 AUTHORS 💖

Matt Johnston <matt@ucc.asn.au>. Gerrit Pape <pape@smarden.org> wrote this manual page.

and that's the whole page, you made it, I'm so proud of you 🥹 this one's from Debian, dated February 1, 2023 — so when you see DROPBEAR(8) floating around down there, you'll know exactly whose era it is. bye bestie, go set up your server 💅🌸✨

📦 where this page comes from