CHANGES

2025.89 - 16 December 2025

- Security: Avoid privilege escalation via unix stream forwarding in Dropbear
  server. Other programs on a system may authenticate unix sockets via
  SO_PEERCRED, which would be root user for Dropbear forwarded connections,
  allowing root privilege escalation.
  Reported by Turistu, and thanks for advice on the fix.
  This is tracked as CVE-2025-14282, and affects 2024.84 to 2025.88.

  It is fixed by dropping privileges of the dropbear process after
  authentication. Unix stream sockets are now disallowed when a
  forced command is used, either with authorized_key restrictions or
  "dropbear -c command".

  In previous affected releases running with "dropbear -j" (will also disable
  TCP forwarding) or building with localoptions.h/distrooptions.h
  "#define DROPBEAR_SVR_LOCALSTREAMFWD 0" is a mitigation.

- Security: Include scp fix for CVE-2019-6111. This allowed
  a malicious server to overwrite arbitrary local files.
  The missing fix was reported by Ashish Kunwar.

- Server dropping privileges post-auth is enabled by default. This requires
  setresgid() support, so some platforms such as netbsd or macos will have to
  disable DROPBEAR_SVR_DROP_PRIVS in localoptions.h. Unix stream forwarding is
  not available if DROPBEAR_SVR_DROP_PRIVS is disabled.

  Remote server TCP socket forwarding will now use OS privileged port
  restrictions rather than having a fixed "allow >=1024 for non-root" rule.

  A future release may implement privilege dropping for netbsd/macos.

- Fix a regression in 2025.87 when RSA and DSS are not built. This would lead
  to a crash at startup with bad_bufptr().
  Reported by Dani Schmitt and Sebastian Priebe.

- Don't limit channel window to 500MB. That is could cause stuck connections
  if peers advise a large window and don't send an increment within 500MB.
  Affects SSH.NET https://github.com/sshnet/SSH.NET/issues/1671
  Reported by Rob Hague.

- Ignore -g -s when passwords arent enabled. Patch from Norbert Lange.
  Ignore -m (disable MOTD), -j/-k (tcp forwarding) when not enabled.

- Report SIGBUS and SIGTRAP signals. Patch from Loïc Mangeonjean.

- Fix incorrect server auth delay. Was meant to be 250-350ms, it was actually
  150-350ms or possibly negative (zero). Reported by pickaxprograms.

- Fix building without public key options. Thanks to Konstantin Demin

- Fix building with proxycmd but without netcat. Thanks to Konstantin Demin

- Fix incorrect path documentation for distrooptions, thanks to Todd Zullinger

- Fix SO_REUSEADDR for TCP tests, reported by vt-alt.

2025.88 - 7 May 2025

- Security: Don't allow dbclient hostname arguments to be interpreted
  by the shell.

  dbclient hostname arguments with a comma (for multihop) would be
  passed to the shell which could result in running arbitrary shell
  commands locally. That could be a security issue in situations
  where dbclient is passed untrusted hostname arguments.

  Now the multihop command is executed directly, no shell is involved.
  Thanks to Marcin Nowak for the report, tracked as CVE-2025-47203

- Fix compatibility for htole64 and htole32, regression in 2025.87
  Patch from Peter Fichtner to work with old GCC versions, and
  patch from Matt Robinson to check different header files.

- Fix building on older compilers or libc that don't support
  static_assert(). Regression in 2025.87

- Support ~R in the client to force a key re-exchange.

- Improve strict KEX handling. Dropbear previously would allow other
  packets at the end of key exchange prior to receiving the remote
  peer's NEWKEYS message, which should be forbidden by strict KEX.
  Reported by Fabian Bäumer.

2025.87 - 5 March 2025

Note >> for compatibility/configuration changes

- >> Disable SHA-1 algorithms by default. SHA-1 has known weakness and
  most implementations support alternatives.

- Add post-quantum key exchange. These avoid the possibility of current
  stored traffic being decrypted using a possible future quantum
  computer.

  sntrup761 added by Matt Johnston, using sntrup761 implementation from
  Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange and
  Christine van Vredendaal, with integration work from OpenSSH.

  ML-KEM added by Loganaden Velvindron, Jaykishan Mutkawoa, Kavish Nadan,
  using libcrux, also based on OpenSSH work.

  These do increase code size, at least sntrup761 is recommended,
  see default_options.h

- >> Decompression is disabled on the server, compression
  is still supported.
  This avoids attack surface for zlib and saves runtime memory.

- Add -D server flag to specify authorized_keys directory, from Darren Tucker.

- Include remote host in "Login attempt with wrong user" message for fail2ban,
  patch from MichaIng.

- Workaround writing hostkeys on FUSE filesystem that don't
  support hardlinks, reported by elijahr.

- Fix truncated error messages such as host key mismatch.

- >> Preference aes256 ahead of aes128 for the client. chacha20-poly1305
  is still first preference.

- Fix ubsan failure in curve25519 code, reported by Steven Bytnar.
  Has no effect on execution.

2024.86 - 22 October 2024

- Fix failure on concurrent channel open/close.
  This was a regression in 2022.82, reported by rsflo in Github #321.
    failed assertion in common-channel.c:705: !channel->sent_close

- Print remote host after "Login attempt for nonexistent user" log entry to
  assist fail2ban. Fix from MichaIng, the format changed in 2020.79

- Dropbear now exits with exit status 0 on SIGINT/SIGTERM. This is a more
  graceful behaviour for "systemctl stop dropbear".
  Reported by Ninad Palsule

- New IDENT_VERSION_PART config allows customising some of the SSH version
  string. From Marius Dinu

- Fix building SK_KEYS with just one of ECDSA or ED25519
  From Marius Dinu

- Fix dbclient "-m help" and "-c help" without a hostname.
  Patch from Darren Tucker

- Remove fprintf/gettimeofday from sigchld handler when running with
  verbose trace enabled.

- Improved configure help output, from Mikel Olasagasti Uranga

- Compile fix for GNU Hurd, from Guilhem Moulin

- Support running test_aslr without venv, from Guilhem Moulin

- Compilation fixes for older compilers, and better build tests

- Update some test infrastructure versions of python packages,
  github actions, and github runner OSes

2024.85 - 25 April 2024

  This release fixes build regressions in 2024.84

- Fix build failure when SHA1 is disabled, thanks to Peter Krefting

- Fix build failure when DROPBEAR_CLI_PUBKEY_AUTH disabled, thanks to
  Sergey Ponomarev

- Update debian/ directory with changed paths

2024.84 - 4 April 2024

Features and Changes:
  Note >> for compatibility/configuration changes

- >> Only use /etc/shadow when a user has :x: as the crypt in /etc/passwd.
  This is the documented behaviour of passwd(5) so should be consistent with
  other programs. Thanks to Paulo Cabral for the report.
  Note that any users without x as the crypt will not be able
  to log in with /etc/shadow, in cases were the existing configuration
  differs.

- Support -o StrictHostKeyChecking, patch from Sergey Ponomarev

- Support -o BatchMode, from Sergey Ponomarev and Hans Harder

- Support various other -o options compatible with OpenSSH, from
  Sergey Ponomarev. Includes -o PasswordAuthentication

- Add dbclient config file support, ~/.ssh/dropbear_config
  Thanks to tjkolev
  Disabled by default, set #define DROPBEAR_USE_SSH_CONFIG 1

- Add support for unix socket forwarding (destination) on
  the server, thanks to WangYi for the implementation

- Add option to bind to interface, from Diederik De Coninck

- Ignore unsupported arguments in dropbearkey, allow running
  binary as 'ssh-key'. From Sergey Ponomarev

- Save a public key file on generation with dropbearkey.
  -C can be used for a comment, and choose a default key
  type (ed25519 first preference).
  Thanks to Sergey Ponomarev

- Allow inetd to run in non-syslog modes. Thanks to Laurent Bercot
  for the report

- Allow user's own gid in PTY permissions, lets Dropbear work as non-root
  even if /dev/pts isn't mounted with gid=5

- src/distrooptions.h can now be used as another config file.
  This can be used by distributions for customisations (separate
  to the build directory's localoptions.h)

Fixes:

- "dbclient host >> output" would previously overwrite "output", instead of
  appending. Thanks for the report from eSotoIoT

- Add "Strict KEX" support. This mitigates a SSH protocol flaw which lets
  a MITM attacker silently remove packets immediately after the
  first key exchange. At present the flaw does not seem to reduce Dropbear's
  security (the only packet affected would be a server-sig-algs extension,
  which is used for compatibility not security).
  For Dropbear, chacha20-poly1305 is the only affected cipher.
  Both sides of the connection must support Strict KEX for it to be used.

  The protocol flaw is tracked as CVE-2023-48795, details
  at https://terrapin-attack.com . Thanks to the researchers Fabian Bäumer,
  Marcus Brinkmann, and Jörg Schwenk. Thanks to OpenSSH for specifying
  strict KEX mode.

- Fix blocking while closing forwarded TCP sessions. Noticable
  when many connections are being forwarded. Reported and
  tested by GektorUA. Github #230

- Don't offer RSA (then fail) if there is no RSA key. Regression in 2020.79
  Github #219

- Fix missing response to remote TCP requests when it is disabled.
  Patch from Justin Chen. Github #254

- Fix building with DROPBEAR_RSA disabled

- /proc/timer_list is no longer used for entropy, it was a bottleneck.
  Thanks to Aleksei Plotnikov for the report.

- Don't unconditionally enable DROPBEAR_DSS

- Make banner reading failure non-fatal

- Fix DROPBEAR_SVR_MULTIUSER. This appears to have been broken since when it
  was added in 2019. If you're using this let me know (it might be removed
  if I don't hear otherwise). Thanks to davidatrsp

- Fix Y2038 issues

Infrastructure:

- Move source files to src/ subdirectory. Thanks to tjkolev

- Remove more files with "make distclean"

- Add tests for disabled options

2022.83 - 14 November 2022

Features and Changes:
  Note >> for compatibility/configuration changes

- >> Disable DROPBEAR_DSS by default
  It is only 1024 bit and uses sha1, most distros disable it by default already.

- Added DROPBEAR_RSA_SHA1 option to allow disabling sha1 rsa signatures.
  >> RSA with sha1 will be disabled in a future release (rsa keys will continue
  to work OK, with sha256 signatures used instead).

- Add option for requiring both password and pubkey (-t)
  Patch from Jackkal

- Add 'no-touch-required' and 'verify-required' options for sk keys
  Patch from Egor Duda

  - >> DROPBEAR_SK_KEYS config option now replaces separate DROPBEAR_SK_ECDSA
  and DROPBEAR_SK_ED25519 options.

- Add 'permitopen' option for authorized_keys to restrict forwarded ports
  Patch from Tuomas Haikarainen

- >> Added LTM_CFLAGS configure argument to set flags for building
  bundled libtommath. This also restores the previous arguments used
  in 2020.81 (-O3 -funroll-loops). That gives a big speedup for RSA
  key generation, which regressed in 2022.82.
  There is a tradeoff with code size, so -Os can be used if required.
  https://github.com/mkj/dropbear/issues/174
  Reported by David Bernard

- Add '-z' flag to disable setting QoS traffic class. This may be necessary
  to work with broken networks or network drivers, exposed after changes to use
  AF21 in 2022.82
  https://github.com/mkj/dropbear/issues/193
  Reported by yuhongwei380, patch from Petr Štetiar

- Allow overriding user shells with COMPAT_USER_SHELLS
  Based on a patch from Matt Robinson

- Improve permission error message
  Patch from k-kurematsu

- >> Remove HMAC_MD5 entirely

Regression fixes from 2022.82:

- Fix X11 build

- Fix build warning

- Fix compilation when disabling pubkey authentication
  Patch from MaxMougg

- Fix MAX_UNAUTH_CLIENTS regression
  Reported by ptpt52

- Avoid using slower prime testing in bundled libtomcrypt when DSS is disabled
  https://github.com/mkj/dropbear/issues/174
  Suggested by Steffen Jaeckel

- Fix Dropbear plugin support
  https://github.com/mkj/dropbear/issues/194
  Reported by Struan Bartlett

Other fixes:

- Fix long standing incorrect compression size check. Dropbear
  (client or server) would erroneously exit with
  "bad packet, oversized decompressed"
  when receiving a compressed packet of exactly the maximum size.

- Fix missing setsid() removed in 2020.79
  https://github.com/mkj/dropbear/issues/180
  Reported and debugged by m5jt and David Bernard

- Try keyboard-interactive auth before password, in dbclient.
  This was unintentionally changed back in 2013
  https://github.com/mkj/dropbear/pull/190
  Patch from Michele Giacomoli

- Drain the terminal when reading the fingerprint confirmation response
  https://github.com/mkj/dropbear/pull/191
  Patch from Michele Giacomoli

- Fix utx wtmp variable typo. This has been wrong for a long time but
  only recently became a problem when wtmp was detected.
  https://github.com/mkj/dropbear/pull/189
  Patch from Michele Giacomoli

- Improve configure test for hardening options.
  Fixes building on AIX
  https://github.com/mkj/dropbear/issues/158

- Fix debian/dropbear.init newline
  From wulei-student

Infrastructure:

- Test off-by-default compile options

- Set -Wundef to catch typos in #if statements


2022.82 - 1 April 2022

Features and Changes:
  Note >> for compatibility/configuration changes

- Implemented OpenSSH format private key handling for dropbearconvert.
  Keys can be read in OpenSSH format or the old PEM format.
  >> Keys are now written in OpenSSH format rather than PEM.
  ED25519 support is now correct. DSS keys are still PEM format.

- Use SHA256 for key fingerprints

- >> Reworked -v verbose printing, specifying multiple times will increase
  verbosity. -vvvv is equivalent to the old DEBUG_TRACE -v level, it
  can be configured at compile time in localoptions.h (see default_options.h)
  Lower -v options can be used to check connection progress or algorithm
  negotiation.
  Thanks to Hans Harder for the implementation

  localoptions.h DEBUG_TRACE should be set to 4 for the same result as the
  previous DEBUG_TRACE 1.

- Added server support for U2F/FIDO keys (ecdsa-sk and ed25519-sk) in
  authorized_keys. no-touch-required option isn't allowed yet.
  Thanks to Egor Duda for the implementation

- autoconf output (configure script etc) is now committed to version control.
  >> It isn't necessary to run "autoconf" any more on a checkout.

- sha1 will be omitted from the build if KEX/signing/MAC algorithms don't
  require it. Instead sha256 is used for random number generation.
  See sysoptions.h to see which algorithms require which hashes.

- Set SSH_PUBKEYINFO environment variable based on the authorized_keys
  entry used for auth. The first word of the comment after the key is used
  (must only have characters a-z A-Z 0-9 .,_-+@)
  Patch from Hans Harder, modified by Matt Johnston

- Let dbclient multihop mode be used with '-J'.
  Patch from Hans Harder

- Allow home-directory relative paths ~/path for various settings
  and command line options.
  *_PRIV_FILENAME DROPBEAR_PIDFILE SFTPSERVER_PATH MOTD_FILENAME
  Thanks to Begley Brothers Inc

  >> The default DROPBEAR_DEFAULT_CLI_AUTHKEY has now changed, it now needs
  a tilde prefix.

- LANG environment variable is carried over from the Dropbear server process
  From Maxim Kochetkov

- Add /usr/sbin and /sbin to $PATH when logging in as root.
  Patch from Raphaël Hertzog
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903403

- Added client option "-o DisableTrivialAuth". It disallows a server immediately
  giving successful authentication (without presenting any password/pubkey prompt).
  This avoids a UI confusion issue where it may appear that the user is accepting
  a SSH agent prompt from their local machine, but are actually accepting a prompt
  sent immediately by the remote server. 
  CVE-2021-36369 though the description there is a bit confused. It only applies
  to Dropbear as a client.
  Thanks to Manfred Kaiser from Austrian MilCERT

- Add -q client option to hide remote banner, from Hans Harder

- Add -e option to pass all server environment variables to child processes.
  This should be used with caution.
  Patch from Roland Vollgraf (github #118)

- >> Use DSCP for QoS traffic classes. Priority (tty) traffic is now set to
  AF21 "interactive". Previously TOS classes were used, they are not used by
  modern traffic classifiers. Non-tty traffic is left at default priority.

- >> Disable dh-group1 key exchange by default. It has been disabled server
  side by default since 2018.

- >> Removed Twofish cipher

Fixes:

- Fix flushing channel data when pty was allocated (github #85)
  Data wasn't completely transmitted at channel close.
  Reported and initial patch thanks to Yousong Zhou

- Dropbear now re-executes itself rather than just forking for each connection
  (only on Linux). This allows ASLR to randomise address space for each
  connection as a security mitigation. It should not have any visible impact
  - if there are any performance impacts in the wild please report it.

- Check authorized_keys permissions as the user, fixes NFS squash root.
  Patch from Chris Dragan (github #107)

- A missing home directory is now non-fatal, starting in / instead

- Fixed IPv6 [address]:port parsing for dbclient -b
  Reported by Fabio Molinari

- Improve error logging so that they are logged on the server rather than being
  sent to the client over the connection

- Max window size is increased to 10MB, more graceful fallback if it's invalid.

- Fix correctness of Dropbear's handling of global requests.
  Patch from Dirkjan Bussink

- Fix some small bugs found by fuzzers, null pointer dereference crash and leaks
  (post authentication)

- $HOME variable is used before /etc/passwd when expanding paths such as
  ~/.ssh/id_dropbear (for the client). Patch from Matt Robinson

- C89 build fixes from Guillaume Picquet

Infrastructure:

- Improvements to fuzzers. Added post-auth fuzzer, and a mutator that can
  handle the structure of SSH packet streams. Added cifuzz to run on commits
  and pull requests.
  Thanks to OSS-Fuzz for the tools/clusters and reward funding.

- Dropbear source tarballs generated by release.sh are now reproducible from a
  Git or Mercurial checkout, they will be identical on any system. Tested
  on ubuntu and macos.

- Added some integration testing using pytest. Currently this has tests
  for various channel handling edge cases, ASLR fork randomisation,
  dropbearconvert, and SSH_PUBKEYINFO

- Set up github actions. This runs the pytest suite and other checks.
  - build matrix includes c89, dropbearmulti, bundled libtom, macos, DEBUG_TRACE
  - test for configure script regeneration
  - build a tarball for external reproducibility

2020.81 - 29 October 2020

- Fix regression in 2020.79 which prevented connecting with some SSH 
  implementations. Increase MAX_PROPOSED_ALGO to 50, and print a log 
  message if the limit is hit. This fixes interoperability with sshj 
  library (used by PyCharm), and GoAnywhere.
  Reported by Pirmin Walthert and Piotr Jurkiewicz

- Fix building with non-GCC compilers, reported by Kazuo Kuroi

- Fix potential long delay in dbclient, found by OSS Fuzz

- Fix null pointer dereference crash, found by OSS Fuzz

- libtommath now uses the same random source as Dropbear (in 2020.79 
  and 2020.80 used getrandom() separately)

- Some fuzzing improvements, start of a dbclient fuzzer

2020.80 - 26 June 2020

- Don't block authorized_keys logins with no-X11-forwarding or no-agent-forwarding 
  restrictions when X11 or agent forwarding are disabled at compile time.
  This is more of a problem now X11 is disabled by default, reported by Guilhem Moulin

- Reduce binary size by 4kB (x64) when using bundled libtommath

- Define GNU_SOURCE for getrandom() on uclibc, reported by Laurent Bercot and
  Fabrice Fontaine

- Improve checking libtomcrypt version compatibility

- Add some style notes to DEVELOPING.md

2020.79 - 15 June 2020

- Support ed25519 hostkeys and authorized_keys, many thanks to Vladislav Grishenko.
  This also replaces curve25519 with a TweetNaCl implementation that reduces code size.

- Add chacha20-poly1305 authenticated cipher. This will perform faster than AES
  on many platforms. Thanks to Vladislav Grishenko

- Support using rsa-sha2 signatures. No changes are needed to hostkeys/authorized_keys
  entries, existing RSA keys can be used with the new signature format (signatures
  are ephemeral within a session). Old ssh-rsa signatures will no longer
  be supported by OpenSSH in future so upgrading is recommended.

- Use getrandom() call on Linux to ensure sufficient entropy has been gathered at startup.
  Dropbear now avoids reading from the random source at startup, instead waiting until
  the first connection. It is possible that some platforms were running without enough 
  entropy previously, those could potentially block at first boot generating host keys.
  The dropbear "-R" option is one way to avoid that.

- Upgrade libtomcrypt to 1.18.2 and libtommath to 1.2.0, many thanks to Steffen Jaeckel for
  updating Dropbear to use the current API. Dropbear's configure script will check 
  for sufficient system library versions, otherwise using the bundled versions.

- CBC ciphers, 3DES, hmac-sha1-96, and x11 forwarding are now disabled by default.
  They can be set in localoptions.h if required.
  Blowfish has been removed.

- Support AES GCM, patch from Vladislav Grishenko. This is disabled by default,
  Dropbear doesn't currently use hardware accelerated AES.

- Added an API for specifying user public keys as an authorized_keys replacement.
  See pubkeyapi.h for details, thanks to Fabrizio Bertocci

- Fix idle detection clashing with keepalives, thanks to jcmathews

- Include IP addresses in more early exit messages making it easier for fail2ban
  processing. Patch from Kevin Darbyshire-Bryant

- scp fix for CVE-2018-20685 where a server could modify name of output files

- SSH_ORIGINAL_COMMAND is set for "dropbear -c" forced command too

- Fix writing key files on systems without hard links, from Matt Robinson

- Compatibility fixes for IRIX from Kazuo Kuroi

- Re-enable printing MOTD by default, was lost moving from options.h. Thanks to zciendor

- Call fsync() is called on parent directory when writing key files to ensure they are flushed

- Fix "make install" for manpages in out-of-tree builds, from Gabor Z. Papp

- Some notes are added in DEVELOPING.md

2019.78 - 27 March 2019

- Fix dbclient regression in 2019.77. After exiting the terminal would be left
  in a bad state. Reported by Ryan Woodsmall
  
2019.77 - 23 March 2019

- Fix server -R option with ECDSA - only advertise one key size which will be accepted.
  Reported by Peter Krefting, 2018.76 regression.

- Fix server regression in 2018.76 where multiple client -R forwards were all forwarded 
  to the first destination. Reported by Iddo Samet.

- Make failure delay more consistent to avoid revealing valid usernames, set server password 
  limit of 100 characters. Problem reported by usd responsible disclosure team

- Change handling of failed authentication to avoid disclosing valid usernames,
  CVE-2018-15599. 

- Fix dbclient to reliably return the exit code from the remote server.
  Reported by W. Mike Petullo

- Fix export of 521-bit ECDSA keys, from Christian Hohnstädt

- Add -o Port=xxx option to work with sshfs, from xcko

- Merged fuzzing code, see FUZZER-NOTES.md

- Add a DROPBEAR_SVR_MULTIUSER=0 compile option to run on 
  single-user Linux kernels (CONFIG_MULTIUSER disabled). From Patrick Stewart

- Increase allowed username to 100 characters, reported by W. Mike Petullo

- Update config.sub and config.guess, should now work with RISC-V

- Cygwin compile fix from karel-m

- Don't require GNU sed (accidentally in 2018.76), reported by Samuel Hsu

- Fix for IRIX and writev(), reported by Kazuo Kuroi

- Other fixes and cleanups from François Perrad, Andre McCurdy, Konstantin Demin,
  Michael Jones, Pawel Rapkiewicz


2018.76 - 27 February 2018

> > > Configuration/compatibility changes
  IMPORTANT
  Custom configuration is now specified in localoptions.h rather than options.h
  Available options and defaults can be seen in default_options.h

  To migrate your configuration, compare your customised options.h against the
  upstream options.h from your relevant version. Any customised options should
  be put in localoptions.h in the build directory.

- "configure --enable-static" should now be used instead of "make STATIC=1"
  This will avoid 'hardened build' flags that conflict with static binaries

- Set 'hardened build' flags by default if supported by the compiler.
  These can be disabled with configure --disable-harden if needed.
  -Wl,-pie
  -Wl,-z,now -Wl,-z,relro
  -fstack-protector-strong
  -D_FORTIFY_SOURCE=2
  # spectre v2 mitigation
  -mfunction-return=thunk
  -mindirect-branch=thunk

  Spectre patch from Loganaden Velvindron

- "dropbear -r" option for hostkeys no longer attempts to load the default
  hostkey paths as well. If desired these can be specified manually. 
  Patch from CamVan Nguyen

- group1-sha1 key exchange is disabled in the server by default since
  the fixed 1024-bit group may be susceptible to attacks

- twofish ciphers are now disabled in the default configuration

- Default generated ECDSA key size is now 256 (rather than 521) 
  for better interoperability

- Minimum RSA key length has been increased to 1024 bits

> > > Other features and fixes

- Add runtime -T max_auth_tries option from Kevin Darbyshire-Bryant

- Add 'dbclient -J &fd' to allow dbclient to connect over an existing socket.
  See dbclient manpage for a socat example. Patch from Harald Becker

- Add "-c forced_command" option. Patch from Jeremy Kerr

- Restricted group -G option added with patch from stellarpower

- Support server-chosen TCP forwarding ports, patch from houseofkodai

- Allow choosing outgoing address for dbclient with -b [bind_address][:bind_port]
  Patch from houseofkodai

- Makefile will now rebuild object files when header files are modified

- Add group14-256 and group16 key exchange options

- curve25519-sha256 also supported without @libssh.org suffix

- Update bundled libtomcrypt to 1.18.1, libtommath to 1.0.1
  This fixes building with some recent versions of clang

- Set PAM_RHOST which is needed by modules such as pam_abl

- Improvements to DSS and RSA public key validation, found by OSS-Fuzz. 

- Don't exit when an authorized_keys file has malformed entries. Found by OSS-Fuzz

- Fix null-pointer crash with malformed ECDSA or DSS keys. Found by OSS-Fuzz

- Numerous code cleanups and small issues fixed by Francois Perrad

- Test for pkt_sched.h rather than SO_PRIORITY which was problematic with some musl
  platforms. Reported by Oliver Schneider and Andrew Bainbridge

- Fix some platform portability problems, from Ben Gardner

- Add EXEEXT filename suffix for building dropbearmulti, from William Foster

- Support --enable-<option> properly for configure, from Stefan Hauser

- configure have_openpty result can be cached, from Eric Bénard

- handle platforms that return close() < -1 on failure, from Marco Wenzel

- Build and configuration cleanups from Michael Witten

- Fix libtomcrypt/libtommath linking order, from Andre McCurdy

- Fix old Linux platforms that have SYS_clock_gettime but not CLOCK_MONOTONIC

- Update curve25519-donna implementation to current version

2017.75 - 18 May 2017

- Security: Fix double-free in server TCP listener cleanup
  A double-free in the server could be triggered by an authenticated user if
  dropbear is running with -a (Allow connections to forwarded ports from any host)
  This could potentially allow arbitrary code execution as root by an authenticated user.
  Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash.
  CVE-2017-9078 https://hg.ucc.asn.au/dropbear/rev/c8114a48837c

- Security: Fix information disclosure with ~/.ssh/authorized_keys symlink.
  Dropbear parsed authorized_keys as root, even if it were a symlink. The fix
  is to switch to user permissions when opening authorized_keys

  A user could symlink their ~/.ssh/authorized_keys to a root-owned file they
  couldn't normally read. If they managed to get that file to contain valid
  authorized_keys with command= options it might be possible to read other
  contents of that file.
  This information disclosure is to an already authenticated user.
  Thanks to Jann Horn of Google Project Zero for reporting this.
  CVE-2017-9079 https://hg.ucc.asn.au/dropbear/rev/0d889b068123

- Generate hostkeys with dropbearkey atomically and flush to disk with fsync
  Thanks to Andrei Gherzan for a patch

- Fix out of tree builds with bundled libtom
  Thanks to Henrik Nordström and Peter Krefting for patches.

2016.74 - 21 July 2016

- Security: Message printout was vulnerable to format string injection.

  If specific usernames including "%" symbols can be created on a system
  (validated by getpwnam()) then an attacker could run arbitrary code as root
  when connecting to Dropbear server.

  A dbclient user who can control username or host arguments could potentially
  run arbitrary code as the dbclient user. This could be a problem if scripts
  or webpages pass untrusted input to the dbclient program.
  CVE-2016-7406
  https://hg.ucc.asn.au/dropbear/rev/b66a483f3dcb

- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
  the local dropbearconvert user when parsing malicious key files
  CVE-2016-7407
  https://hg.ucc.asn.au/dropbear/rev/34e6127ef02e

- Security: dbclient could run arbitrary code as the local dbclient user if
  particular -m or -c arguments are provided. This could be an issue where
  dbclient is used in scripts.
  CVE-2016-7408
  https://hg.ucc.asn.au/dropbear/rev/eed9376a4ad6

- Security: dbclient or dropbear server could expose process memory to the
  running user if compiled with DEBUG_TRACE and running with -v
  CVE-2016-7409
  https://hg.ucc.asn.au/dropbear/rev/6a14b1f6dc04

  The security issues were reported by an anonymous researcher working with
  Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html

- Fix port forwarding failure when connecting to domains that have both
  IPv4 and IPv6 addresses. The bug was introduced in 2015.68

- Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P
  for the patch


2016.73 - 18 March 2016

- Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev

- Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev

- Option to exit when a TCP forward fails, patch from Konstantin Tokarev

- New "-o" option parsing from Konstantin Tokarev. This allows handling some extra options
  in the style of OpenSSH, though implementing all OpenSSH options is not planned.

- Fix crash when fallback initshells() is used, reported by Michael Nowak and Mike Tzou

- Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks

- Various cleanups for issues found by a lint tool, patch from Francois Perrad

- Fix tab indent consistency, patch from Francois Perrad

- Fix issues found by cppcheck, reported by Mike Tzou

- Use system memset_s() or explicit_bzero() if available to clear memory. Also make
  libtomcrypt/libtommath routines use that (or Dropbear's own m_burn()).

- Prevent scp failing when the local user doesn't exist. Based on patch from Michael Witten.

- Improved Travis CI test running, thanks to Mike Tzou

- Improve some code that was flagged by Coverity and Fortify Static Code Analyzer

2016.72 - 9 March 2016

- Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions,
  found by github.com/tintinweb. Thanks for Damien Miller for a patch. CVE-2016-3116
  https://hg.ucc.asn.au/dropbear/rev/a3e8389e01ff

2015.71 - 3 December 2015

- Fix "bad buf_incrpos" when data is transferred, broke in 2015.69

- Fix crash on exit when -p address:port is used, broke in 2015.68, thanks to
  Frank Stollenwerk for reporting and investigation

- Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev

- Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert,
  broke in 2015.70

- Fix server race condition that could cause sessions to hang on exit,
  https://github.com/robotframework/SSHLibrary/issues/128

2015.70 - 26 November 2015

- Fix server password authentication on Linux, broke in 2015.69

2015.69 - 25 November 2015

- Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68)

- Avoid hang on session close when multiple sessions are started, affects Qt Creator
  Patch from Andrzej Szombierski

- Reduce per-channel memory consumption in common case, increase default
  channel limit from 100 to 1000 which should improve SOCKS forwarding for modern
  webpages

- Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin

- Manpage improvements from Guilhem Moulin

- Build fixes for Android from Mike Frysinger

- Don't display the MOTD when an explicit command is run from Guilhem Moulin

- Check curve25519 shared secret isn't zero

2015.68 - Saturday 8 August 2015

- Reduce local data copying for improved efficiency. Measured 30%
  increase in throughput for connections to localhost

- Forwarded TCP ports connect asynchronously and try all available addresses
  (IPv4, IPv6, round robin DNS)

- Fix all compile warnings, many patches from Gaël Portay
  Note that configure with -Werror may not be successful on some platforms (OS X)
  and some configuration options may still result in unused variable
  warnings.

- Use TCP Fast Open on Linux if available. Saves a round trip at connection
  to hosts that have previously been connected. 
  Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3"
  Client side is disabled by default pending further compatibility testing
  with networks and systems.

- Increase maximum command length to 9000 bytes

- Free memory before exiting, patch from Thorsten Horstmann. Useful for
  Dropbear ports to embedded systems and for checking memory leaks
  with valgrind. Only partially implemented for dbclient.
  This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h

- DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless
  there is a leading slash (~ isn't treated specially)

- Fix small ECC memory leaks

- Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of
  Matta Consulting. Odds of bad values are around 2**-512 -- improbable.

- Twofish-ctr cipher is supported though disabled by default

- Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks
  to CL Ouyang

- Fix null pointer crash with restrictions in authorized_keys without a command, patch from
  Guilhem Moulin

- Ensure authentication timeout is handled while reading the initial banner,
  thanks to CL Ouyang for finding it.

- Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz

2015.67 - Wednesday 28 January 2015

- Call fsync() after generating private keys to ensure they aren't lost if a
  reboot occurs. Thanks to Peter Korsgaard

- Disable non-delayed zlib compression by default on the server. Can be
  enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB

- Default client key path ~/.ssh/id_dropbear

- Prefer stronger algorithms by default, from Fedor Brunner. 
  AES256 over 3DES
  Diffie-hellman group14 over group1

- Add option to disable CBC ciphers.

- Disable twofish in default options.h

- Enable sha2 HMAC algorithms by default, the code was already required
  for ECC key exchange. sha1 is the first preference still for performance. 

- Fix installing dropbear.8 in a separate build directory, from Like Ma

- Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe

- Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea

- Minor bug fixes, a few issues found by Coverity scan

2014.66 - Thursday 23 October 2014

- Use the same keepalive handling behaviour as OpenSSH. This will work better 
  with some SSH implementations that have different behaviour with unknown 
  message types.

- Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own 
  keepalive message

- Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere

- Fix wtmp which broke since 2013.62, patch from Whoopie

2014.65 - Friday 8 August 2014

- Fix 2014.64 regression, server session hang on exit with scp (and probably
  others), thanks to NiLuJe for tracking it down

- Fix 2014.64 regression, clock_gettime() error handling which broke on older
  Linux kernels, reported by NiLuJe

- Fix 2014.64 regression, writev() could occassionally fail with EAGAIN which
  wasn't caught

- Avoid error message when trying to set QoS on proxycommand or multihop pipes

- Use /usr/bin/xauth, thanks to Mike Frysinger

- Don't exit the client if the local user entry can't be found, thanks to iquaba

2014.64 - Sunday 27 July 2014

- Fix compiling with ECDSA and DSS disabled

- Don't exit abruptly if too many outgoing packets are queued for writev(). Patch
  thanks to Ronny Meeus

- The -K keepalive option now behaves more like OpenSSH's "ServerAliveInterval". 
  If no response is received after 3 keepalives then the session is terminated. This
  will close connections faster than waiting for a TCP timeout.

- Rework TCP priority setting. New settings are
	if (connecting || ptys || x11) tos = LOWDELAY
	else if (tcp_forwards) tos = 0
	else tos = BULK
  Thanks to Catalin Patulea for the suggestion.

- Improve handling of many concurrent new TCP forwarded connections, should now
  be able to handle as many as MAX_CHANNELS. Thanks to Eduardo Silva for reporting
  and investigating it.

- Make sure that exit messages from the client are printed, regression in 2013.57

- Use monotonic clock where available, timeouts won't be affected by system time
  changes

- Add -V for version

2014.63 - Wednesday 19 February 2014

- Fix ~. to terminate a client interactive session after waking a laptop
  from sleep.

- Changed port separator syntax again, now using host^port. This is because
  IPv6 link-local addresses use %. Reported by Gui Iribarren

- Avoid constantly relinking dropbearmulti target, fix "make install"
  for multi target, thanks to Mike Frysinger

- Avoid getting stuck in a loop writing huge key files, reported by Bruno
  Thomsen

- Don't link dropbearkey or dropbearconvert to libz or libutil, 
  thanks to Nicolas Boos

- Fix linking -lcrypt on systems without /usr/lib, thanks to Nicolas Boos

- Avoid crash on exit due to cleaned up keys before last packets are sent,
  debugged by Ronald Wahl

- Fix a race condition in rekeying where Dropbear would exit if it received a
  still-in-flight packet after initiating rekeying. Reported by Oliver Metz.
  This is a longstanding bug but is triggered more easily since 2013.57

- Fix README for ecdsa keys, from Catalin Patulea

- Ensure that generated RSA keys are always exactly the length
  requested. Previously Dropbear always generated N+16 or N+15 bit keys.
  Thanks to Unit 193

- Fix DROPBEAR_CLI_IMMEDIATE_AUTH mode which saves a network round trip if the
  first public key succeeds. Still not enabled by default, needs more
  compatibility testing with other implementations.

- Fix for port 0 forwarding in the client and port forwarding with Apache MINA SSHD. Thanks to 

- Fix for bad system linux/pkt-sched.h header file with older Linux
kernels, from Steve Dover

- Fix signal handlers so that errno is saved, thanks to Erik Ahlén for a patch
  and Mark Wickham for independently spotting the same problem.

2013.62 - Tuesday 3 December 2013

- Disable "interactive" QoS connection options when a connection doesn't
  have a PTY (eg scp, rsync). Thanks to Catalin Patulea for the patch.

- Log when a hostkey is generated with -R, fix some bugs in handling server
  hostkey commandline options

- Fix crash in Dropbearconvert and 521 bit key, reported by NiLuJe

- Update config.guess and config.sub again

2013.61test - Thursday 14 November 2013

- Default generated RSA key size changed from 1024 to 2048 bits

- ECC (elliptic curve) support. Supports ECDSA hostkeys (requires new keys to
  be generated) and ECDH for setting up encryption keys (no intervention
  required). This is significantly faster.

- curve25519-sha256@libssh.org support for setting up encryption keys. This is
  another elliptic curve mode with less potential of NSA interference in
  algorithm parameters. curve25519-donna code thanks to Adam Langley

- -R option to automatically generate hostkeys. This is recommended for
  embedded platforms since it allows the system random number device
  /dev/urandom a longer startup time to generate a secure seed before the
  hostkey is required.

- Compile fixes for old vendor compilers like Tru64 from Daniel Richard G.

- Make authorized_keys handling more robust, don't exit encountering
  malformed lines. Thanks to Lorin Hochstein and Mark Stillwell 

2013.60 - Wednesday 16 October 2013

- Fix "make install" so that it doesn't always install to /bin and /sbin

- Fix "make install MULTI=1", installing manpages failed

- Fix "make install" when scp is included since it has no manpage

- Make --disable-bundled-libtom work

2013.59 - Friday 4 October 2013

- Fix crash from -J command 
  Thanks to Lluís Batlle i Rossell and Arnaud Mouiche for patches

- Avoid reading too much from /proc/net/rt_cache since that causes
  system slowness. 

- Improve EOF handling for half-closed connections
  Thanks to Catalin Patulea

- Send a banner message to report PAM error messages intended for the user
  Patch from Martin Donnelly

- Limit the size of decompressed payloads, avoids memory exhaustion denial
  of service 
  Thanks to Logan Lamb for reporting and investigating it. CVE-2013-4421
  https://hg.ucc.asn.au/dropbear/rev/0bf76f54de6f

- Avoid disclosing existence of valid users through inconsistent delays
  Thanks to Logan Lamb for reporting. CVE-2013-4434
  https://hg.ucc.asn.au/dropbear/rev/d7784616409a

- Update config.guess and config.sub for newer architectures

- Avoid segfault in server for locked accounts

- "make install" now installs manpages
  dropbearkey.8 has been renamed to dropbearkey.1
  manpage added for dropbearconvert

- Get rid of one second delay when running non-interactive commands


2013.58 - Thursday 18 April 2013

- Fix building with Zlib disabled, thanks to Hans Harder and cuma@freetz

- Use % as a separator for ports, fixes scp in multihop mode, from Hans Harder

- Reject logins for other users when running as non-root, from Hans Harder

- Disable client immediate authentication request by default, it prevents
  passwordless logins from working

2013.57 - Monday 15 April 2013

- Decreased connection setup time particularly with high latency connections,
  the number of round trips has been reduced for both client and server. 
  CPU time hasn't been changed.

- Client will send an initial key exchange guess to save a round trip.
  Dropbear implements an extension kexguess2@matt.ucc.asn.au to allow the first
  packet guess to succeed in wider circumstances than the standard behaviour.
  When communicating with other implementations the standard behaviour is used.

- Client side: when public key or password authentication with
  $DROPBEAR_PASSWORD is used an initial authentication request will
  be sent immediately rather than querying the list of available methods.
  This behaviour is enabled by CLI_IMMEDIATE_AUTH option (on by default),
  please let the Dropbear author know if it causes any interoperability
  problems.

- Implement client escape characters ~. (terminate session) and 
  ~^Z (background session)

- Server will more reliably clean up utmp when connection is closed, reported by
  Mattias Walström

- Don't crash if /dev/urandom isn't writable (RHEL5), thanks to Scott Case

- Add "-y -y" client option to skip host key checking, thanks to Hans Harder

- scp didn't work properly on systems using vfork(), thanks to Frank Van Uffelen

- Added IUTF8 terminal mode support (Linux and Mac OS). Not standardised yet
though probably will be soon

- Some verbose DROPBEAR_TRACE output is now hidden unless $DROPBEAR_TRACE2
  enviroment variable is set

- Fix using asymmetric MAC algorithms (broke in )

- Renamed configure.in to configure.ac to quieten autoconf, from Mike Frysinger

2013.56 - Thursday 21 March 2013

- Allow specifying cipher (-c) and MAC (-m) lists for dbclient

- Allow using 'none' cipher or MAC (off by default, use options.h). Encryption
  is used during authentication then disabled, similar to OpenSSH HPN mode

- Allow a user in immediately if the account has a blank password and blank
  passwords are enabled

- Include a few extra sources of entropy from /proc on Linux, hash private keys
  as well. Dropbear will also write gathered entropy back into /dev/urandom

- Added hmac-sha2-256 and hmac-sha2-512 support (off by default, use options.h)

- Don't sent bad address "localhost" for -R forward connections, 
  reported by Denis Bider

- Add "-B" runtime option to allow blank passwords

- Allow using IPv6 bracket notation for addresses in server "-p" option, from Ben Jencks

- A few improvements for Android from Reimar Döffinger

- Fix memory leak for TCP forwarded connections to hosts that timed out,
  reported by Norbert Benczúr. Appears to be a very long-standing bug.

- Fix "make clean" for out of tree builds

- Fix compilation when ENABLE_{SVR,CLI}_AGENTFWD are unset

2012.55 - Wednesday 22 February 2012

- Security: Fix use-after-free bug that could be triggered if command="..."
  authorized_keys restrictions are used.  Could allow arbitrary code execution
  or bypass of the command="..." restriction to an authenticated user.
  This bug affects releases 0.52 onwards. Ref CVE-2012-0920.
  Thanks to Danny Fullerton of Mantor Organization for reporting
  the bug.
  https://hg.ucc.asn.au/dropbear/rev/818108bf7749

- Compile fix, only apply IPV6 socket options if they are available in headers
  Thanks to Gustavo Zacarias for the patch

- Overwrite session key memory on exit

- Fix minor memory leak in unusual PAM authentication configurations.
  Thanks to Stathis Voukelatos

- Other small code cleanups

2011.54 - Tuesday 8 November 2011

- Building statically works again, broke in 0.53 and 0.53.1

- Fix crash when forwarding with -R

- Fixed various leaks found by Klocwork analysis software, thanks to them for
  running it

- Set IPTOS_LOWDELAY for IPv6, thanks to Dave Taht

- Bind to sockets with IPV6_V6ONLY so that it works properly on systems
  regardless of the system-wide setting

- Added ALLOW_BLANK_PASSWORD option. Dropbear also now allows public key logins
  to accounts with a blank password. Thanks to Rob Landley

- Fixed case where "-K 1" keepalive for dbclient would cause a SSH_MSG_IGNORE
  packet to be sent

- Avoid some memory allocations in big number maths routines, improves
  performance slightly

- Fix symlink target for installdropbearmulti with DESTDIR set, thanks to
  Scottie Shore

- When requesting server allocated remote ports (-R 0:host:port) print a
  message informing what the port is, thanks to Ali Onur Uyar.

- New version numbering scheme.

Source repository has now migrated to Mercurial at 
https://hg.ucc.asn.au/dropbear/graph/default

0.53.1 - Wednesday 2 March 2011

- -lcrypt needs to be before object files for static linking

- Compile fix when both client and agent forwarding are disabled

- Fix DROPBEAR_PRNGD_SOCKET mode

- Don't allow setting zlib memLevel since it seems buggy

0.53 - Thurs 24 February 2011

- Various performance/memory use improvements

- Client agent forwarding now works, using OpenSSH's ssh-agent

- Improve robustness of client multihop mode

- Fix a prime generation bug in bundled libtommath. This is unlikely to have
  generated any bad keys in the wild.
  See 
  https://bugzilla.redhat.com/show_bug.cgi?id=615088
  http://bugs.gentoo.org/show_bug.cgi?id=328383
  http://bugs.gentoo.org/show_bug.cgi?id=328409

- Attempt to build against system libtomcrypt/libtommath if available. This
  can be disabled with ./configure --enable-bundled-libtom

- Make -K (keepalive) and -I (idle timeout) work together sensibly in the client.
  The idle timeout is no longer reset by SSH_MSG_IGNORE packets.

- Add diffie-hellman-group14-sha1 key exchange method

- Compile fix if ENABLE_CLI_PROXYCMD is disabled

- /usr/bin/X11/xauth is now the default path

- Client remote forward (-L/-R) arguments now accept a listen address

- In uClinux avoid trashing the parent process when a session exits

- Blowfish is now disabled by default since it has large memory usage

- Add option to change zlib windowbits/memlevel. Use less memory by default

- DROPBEAR_SMALL_CODE is now disabled by default

- SSH_ORIGINAL_COMMAND environment variable is set by the server when an
  authorized_keys command is specified.

- Set SSH_TTY and SSH_CONNECTION environment variables in the server

- Client banner is now printed to standard error rather than standard output

- Capitalisation in many log messages has been made consistent. This may affect
  scripts that parse logfiles.

0.52 - Wed 12 November 2008

- Add "netcat-alike" option (-B) to dbclient, allowing Dropbear to tunnel
  standard input/output to a TCP port-forwarded remote host.

- Add "proxy command" support to dbclient, to allow using a spawned process for
  IO rather than a direct TCP connection. eg
	  dbclient remotehost
  is equivalent to
	  dbclient -J 'nc remotehost 22' remotehost
  (the hostname is still provided purely for looking up saved host keys)

- Combine netcat-alike and proxy support to allow "multihop" connections, with
  comma-separated host syntax.  Allows running

	  dbclient user1@host1,user2@host2,user3@host3

  to end up at host3 via the other two, using SSH TCP forwarding. It's a bit
  like onion-routing. All connections are established from the local machine.
  The comma-separated syntax can also be used for scp/rsync, eg

	  rsync -a -e dbclient m@gateway,m2@host,martello:/home/matt/ ~/backup/

  to bounce through a few hosts.

- Add -I "idle timeout" option (contributed by Farrell Aultman)

- Allow restrictions on authorized_keys logins such as restricting commands
  to be run etc. This is a subset of those allowed by OpenSSH, doesn't
  yet allow restricting source host.

- Use vfork() for scp on uClinux

- Default to PATH=/usr/bin:/bin for shells.

- Report errors if -R forwarding fails

- Add counter mode cipher support, which avoids some security problems with the
  standard CBC mode.

- Support zlib@openssh.com delayed compression for client/server. It can be
  required for the Dropbear server with the '-Z' option. This is useful for
  security as it avoids exposing the server to attacks on zlib by
  unauthenticated remote users, though requires client side support.

- options.h has been split into options.h (user-changable) and sysoptions.h
  (less commonly changed)

- Support "dbclient -s sftp" to specify a subsystem

- Fix a bug in replies to channel requests that could be triggered by recent
  versions of PuTTY

0.51 - Thu 27 March 2008

- Make a copy of password fields rather erroneously relying on getwpnam()
  to be safe to call multiple times

- If $SSH_ASKPASS_ALWAYS environment variable is set (and $SSH_ASKPASS is
  as well) always use that program, ignoring isatty() and $DISPLAY

- Wait until a process exits before the server closes a connection, so
  that an exit code can be sent. This fixes problems with exit codes not
  being returned, which could cause scp to fail.

0.50 - Wed 8 August 2007

- Add DROPBEAR_PASSWORD environment variable to specify a dbclient password

- Use /dev/urandom by default, since that's what everyone does anyway

- Correct vfork() use for uClinux in scp
  (thanks to Alex Landau)

- Exit with an exit code of 1 if dropbear can't bind to any ports
  (thanks to Nicolai Ehemann)

- Improve network performance and add a -W <receive_window> argument for
  adjusting the tradeoff between network performance and memory consumption.

- Fix a problem where reply packets could be sent during key exchange,
  in violation of the SSH spec. This could manifest itself with connections
  being terminated after 8 hours with new TCP-forward connections being
  established.

- Add -K <keepalive_time> argument, ensuring that data is transmitted
  over the connection at least every N seconds.

- dropbearkey will no longer generate DSS keys of sizes other than 1024
  bits, as required by the DSS specification. (Other sizes are still
  accepted for use to provide backwards compatibility).

0.49 - Fri 23 February 2007

- Security: dbclient previously would prompt to confirm a 
  mismatching hostkey but wouldn't warn loudly. It will now
  exit upon a mismatch. CVE-2007-1099

- Compile fixes, make sure that all variable definitions are at the start
  of a scope.

- Added -P pidfile argument to the server (from Swen Schillig)

- Add -N dbclient option for "no command"

- Add -f dbclient option for "background after auth"

- Add ability to limit binding to particular addresses, use 
  -p [address:]port, patch from Max-Gerd Retzlaff.

- Try to finally fix ss_family compilation problems (for old
  glibc systems)

- Fix finding relative-path server hostkeys when running daemonized

- Use $HOME in preference to that from /etc/passwd, so that
  dbclient can still work on broken systems.

- Fix various issues found by Klocwork defect analysis, mostly memory leaks
  and error-handling. Thanks to Klocwork for their service.

- Improve building in a separate directory

- Add compile-time LOG_COMMANDS option to log user commands

- Add '-y' flag to dbclient to unconditionally accept host keys,
  patch from Luciano Miguel Ferreira Rocha

- Return immediately for "sleep 10 & echo foo", rather than waiting
  for the sleep to return (pointed out by Rob Landley).
  
- Avoid hanging after exit in certain cases (such as scp)

- Various minor fixes, in particular various leaks reported by
  Erik Hovland
  
- Disable core dumps on startup

- Don't erase over every single buffer, since it was a bottleneck.
  On systems where it really matters, encrypted swap should be utilised.

- Read /dev/[u]random only once at startup to conserve kernel entropy

- Upgrade to LibTomCrypt 1.16 and LibTomMath 0.40

- Upgrade config.status and config.guess 

0.48.1 - Sat 11 March 2006

- Compile fix for scp

0.48 - Thurs 9 March 2006

- Check that the circular buffer is properly empty before
  closing a channel, which could cause truncated transfers
  (thanks to Tomas Vanek for helping track it down)

- Implement per-IP pre-authentication connection limits 
  (after some poking from Pablo Fernandez) CVE-2006-1206

- Exit gracefully if trying to connect to as SSH v1 server 
  (reported by Rushi Lala)

- Only read /dev/random once at startup when in non-inetd mode

- Allow ctrl-c to close a dbclient password prompt (may
  still have to press enter on some platforms)

- Merged in uClinux patch for inetd mode

- Updated to scp from OpenSSH 4.3p2 - fixes a security issue
  where use of system() could cause users to execute arbitrary
  code through malformed filenames, ref CVE-2006-0225

0.47 - Thurs Dec 8 2005

- SECURITY: fix for buffer allocation error in server code, could potentially
  allow authenticated users to gain elevated privileges. All multi-user systems
  running the server should upgrade (or apply the patch available on the
  Dropbear webpage). CVE-2005-4178

- Fix channel handling code so that redirecting to /dev/null doesn't use
  100% CPU.

- Turn on zlib compression for dbclient.

- Set "low delay" TOS bit, can significantly improve interactivity
  over some links.

- Added client keyboard-interactive mode support, allows operation with
  newer OpenSSH servers in default config.

- Log when pubkey auth fails because of bad ~/.ssh/authorized_keys permissions

- Improve logging of assertions

- Added aes-256 cipher and sha1-96 hmac.

- Fix twofish so that it actually works.

- Improve PAM prompt comparison.

- Added -g (dbclient) and -a (dropbear server) options to allow
  connections to listening forwarded ports from remote machines.

- Various other minor fixes

- Compile fixes for glibc 2.1 (ss_family vs __ss_family) and NetBSD
  (netinet/in_systm.h needs to be included).

0.46 - Sat July 9 2005

- Fix long-standing bug which caused connections to be closed if an ssh-agent
  socket was no longer available

- Print a warning if we seem to be blocking on /dev/random 
  (suggested by Paul Fox)

- Fixed a memory leak in DSS code (thanks to Boris Berezovsky for the patch)

- dbclient -L no longer segfaults, allocate correct buffer size (thanks
  to David Cook for reporting it, and Christopher Faylor for independently
  sending in a patch)

- Added RSA blinding to signing code (suggested by Dan Kaminsky)

- Rearranged bignum reading/random generation code

- Reset the non-blocking status on stderr and stdout as well as stdin,
  fixes a problem where the shell running dbclient will exit (thanks to 
  Brent Roman for reporting it)

- Fix so that all file descriptors are closed so the child shell doesn't
  inherit descriptors (thanks to Linden May for the patch)

- Change signkey.c to avoid gcc 4 generating incorrect code

- After both sides of a file descriptor have been shutdown(), close()
  it to avoid leaking descriptors (thanks to Ari Hyttinen for a patch)

- Update to LibTomCrypt 1.05 and LibTomMath 0.35

0.45 - Mon March 7 2005

- Makefile no longer appends 'static' to statically linked binaries

- Add optional SSH_ASKPASS support to the client

- Respect HOST_LOOKUP option

- Fix accidentally removed "return;" statement which was removed in 0.44
  (causing clients which sent an empty terminal-modes string to fail to
  connect - including pssh, ssh.com, danger hiptop). (patches
  independently from Paul Fox, David Horwitt and Sven-Ola Tuecke)

- Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
  will work with scp.

0.44 - Mon Jan 3 2005

- SECURITY: Fix for PAM auth so that usernames are logged and conversation
  function responses are allocated correctly - all 0.44test4 users with PAM
  compiled in (not default) are advised to upgrade.

- Fix calls to getnameinfo() for compatibility with Solaris

- Pristine compilation works (run 'configure' from a fresh dir and make it
  there)

- Fixes for compiling with most options disabled.

- Upgraded to LibTomCrypt 0.99 and LibTomMath 0.32

- Make sure that zeroing out of values in LTM and LTC won't get optimised away

- Removed unused functions from loginrec.c

- /dev/random is now the default entropy source rather than /dev/urandom

- Logging of IPs in auth success/failure messages for improved greppability

- Fix dbclient so that "scp -i keyfile" works. (It can handle "-ikeyfile
  properly)

- Avoid a race in server shell-handling code which prevents the exit-code
  from being returned to the client in some circumstances.

- Makefile modified so that install target works correctly (doesn't try
  to install "all" binary) - patch from Juergen Daubert

- Various minor fixes and compile warnings.

0.44test4 - Tue Sept 14 2004 21:15:54 +0800

- Fix inetd mode so it actually loads the hostkeys (oops)

- Changed DROPBEAR_DEFPORT properly everywhere

- Fix a small memory leak in the auth code

- WCOREDUMP is only used on systems which support it (ie not cygwin or AIX)

- Check (and fail for) cases when we can't negotiate algorithms with the
  remote side successfully (rather than bombing out ungracefully)

- Handle authorized_keys files without a terminating newline

- Fiddle the channel receive window size for possibly better performance

- Added in the PAM authentication code (finally! thanks to Martin Carlsson)

0.44test3 - Fri Aug 27 22:20:54 +0800

- Fixed a bunch of warnings.

- scp works correctly when passed a username (fix for the dbclient program
  itself as well, "-lmatt" works as well as "-l matt").

- Remove unrequired debian files

- Exit with the remote process's return code for dbclient

- Display stderr messages from the server in the client

- Add circular buffering to the channel code. This should dramatically reduce
  the amount of backtraffic sent in response to traffic incoming to the
  Dropbear end - improves high-latency performance (ie dialup).

- Various other related channel-handling fixups.

- Allow leading lines in the banner when connecting to servers

- Fixed printing out errors onto the network socket with stderr (for inetd
  mode when using xinetd)

- Remove obselete documentation

- Fix a null-pointer exception when trying to free non-existant listeners
  at cleanup.

- DEBUG_TRACE now only works if you add "-v" to the program commandline

- Don't leave stdin non-blocking on exit - this caused the parent shell
  of dbclient to close when dbclient exited, for some shells in BusyBox

- Server connections no longer timeout after 5 minutes

- Fixed stupid DSS hostkey typo (server couldn't load host keys)

0.44test2 - Tues Aug 17 2004 17:43:54 +0800

- Fix up dropbearmulti targets in the Makefile - symlinks are now created

- Compile fake-rfc2553 even with dropbearconvert/dropbearkey - this 
  allows them to work on platforms without a native getaddrinfo()

- Create ~/.ssh/known_hosts properly if it doesn't exist

- Fix basename() function prototype

- Backport some local changes (more #ifdefs for termcodes.c, a fix for missing
  defines on AIX).

- Let dbclient be run as "ssh"

- Initialise mp_ints by default

0.44test1 - Sun Aug 16 2005 17:43:54 +0800

- TESTING RELEASE - this is the first public release of the client codebase,
  so there are sure to be bugs to be found. In addition, if you're just using
  the server portion, the final binary size probably will increase - I'll
  be trying to get it back down in future releases.

- Dropbear client added - lots of changes to the server code as well to 
  generalise things

- IPv6 support added for client, server, and forwarding

- New makefile with more generic support for multiple-program binaries

0.43 - Fri Jul 16 2004 17:44:54 +0800

- SECURITY: Don't try to free() uninitialised variables in DSS verification
  code. Thanks to Arne Bernin for pointing out this bug. This is possibly
  exploitable, all users with DSS and pubkey-auth compiled in are advised to
  upgrade. CVE-2004-2486

- Clean up agent forwarding socket files correctly, patch from Gerrit Pape.

- Don't go into an infinite loop when portforwarding to servers which don't
  send any initial data/banner. Patch from Nikola Vladov

- Fix for network vs. host byte order in logging remote TCP ports, also
  from Gerrit Pape.

- Initialise many pointers to NULL, for general safety. Also checked cleanup
  code for mp_ints (related to security issues above).

0.42 - Wed Jun 16 2004 12:44:54 +0800

- Updated to Gerrit Pape's official Debian subdirectory

- Fixed bad check when opening /dev/urandom - thanks to Danny Sung.

- Added -i inetd mode flag, and associated options in options.h . Dropbear
  can be compiled with either normal mode, inetd, or both modes. Thanks
  to Gerrit Pape for basic patch and motivation.

- Use <dirent.h> rather than <sys/dir.h> for POSIX compliance. Thanks to Bill
  Sommerfield.

- Fixed a TCP forwarding (client-local, -L style) bug which caused the whole
  session to close if the TCP connection failed. Thanks to Andrew Braund for
  reporting it and helping track it down.

- Re-enable sigpipe for child processes. Thanks to Gerrit Pape for some
  suggestions, and BSD manpages for a clearer explanation of the behaviour.

- Added manpages, thanks to Gerrit Pape.

- Changed license text for LibTomCrypt and LibTomMath.

- Added strip-static target

- Fixed a bug in agent-forwarding cleanup handler - would segfault
  (dereferencing a null pointer) if agent forwarding had failed.

- Fix behaviour of authorized_keys parsing, so larger (>1024 bit) DSA keys will
  work. Thanks to Dr. Markus Waldeck for the report. 

- Fixed local port forwarding code so that the "-j" option will make forwarding
  attempts fail more gracefully.

- Allow repeated requests in a single session if previous ones fail - this fixes  PuTTY and some other SCP clients, which try SFTP, then fall-back to SCP if it
  isn't available. Thanks to Stirling Westrup for the report.

- Updated to LibTomCrypt 0.96 and LibTomMath 0.30. The AES code now uses
  smaller non-precomputed tables if DROPBEAR_SMALL_CODE is defined in
  options.h, leading to a significant reduction in the binary size.

0.41 - Mon Jan 19 2004 22:40:19 +0800

- Fix in configure so that cross-compiling works, thanks to numerous people for
  reporting and testing

- Terminal mode parsing now handles empty terminal mode strings (sent by
  Windows ssh.com clients), thanks to Ricardo Derbes for the report

- Handling is improved for users with no shell specified in /etc/passwd,
  thanks again to Ricardo Derbes

- Fix for compiling with --disable-syslog, thanks to gordonfh

- Various minor fixes allow scp to work with irix, thanks to Paul Marinceu for
  fixing it up

- Use <stropts.h> not <sys/stropts.h>, since the former seems more common

0.40 - Tue Jan 13 2004 21:05:19 +0800

- Remote TCP forwarding (-R) style implemented

- Local and remote TCP forwarding can each be disabled at runtime (-k and -j
  switches)

- Fix for problems detecting openpty() with uClibc - many thanks to various
  people for reporting and testing fixes, including (in random order) Cristian
  Ionescu-Idbohrn, James Ewing, Steve Dover, Thomas Lundquist and Frederic
  Lavernhe

- Improved portability for IRIX, thanks to Paul Marinceu

- AIX and HPUX portability fixes, thanks to Darren Tucker for patches

- prngd should now work correctly, thanks to Darren Tucker for the patch

- scp compilation on systems without strlcpy() is fixed, thanks to Peter
  Jannesen and David Muse for reporting it (independently and simultaneously :)

- Merged in new LibTomCrypt 0.92 and LibTomMath 0.28

0.39 - Tue Dec 16 2003 15:19:19 +0800

- Better checking of key lengths and parameters for DSS and RSA auth

- Print fingerprint of keys used for pubkey auth

- More consistent logging of usernames and IPs

- Added option to disable password auth (or just for root) at runtime

- Avoid including bignum functions which don't give much speed benefit but
  take up binary size

- Added a stripped down version of OpenSSH's scp binary

- Added additional supporting functions for Irix, thanks to Paul Marinceu

- Don't check for unused libraries in configure script

- Removed trailing comma in algorithm lists (thanks to Mihnea Stoenescu)

- Fixed up channel close handling, always send close packet in response
  (also thanks to Mihnea Stoenescu)

- Various makefile improvements for cross-compiling, thanks to Friedrich
  Lobenstock and Mihnea Stoenescu

- Use daemon() function if available (or our own copy) rather than separate
  code (thanks to Frédéric Lavernhe for the report and debugging, and Bernard
  Blackham for his suggestion on what to look at)

- Fixed up support for first_kex_packet_follows, required to talk to ssh.com
  clients. Thanks to Marian Stagarescu for the bug report.

- Avoid using MAXPATHLEN, pointer from Ian Morris

- Improved input sanity checking

0.38 - Sat Oct 11 2003 16:28:13 +0800

- Default hostkey path changed to /etc/dropbear/dropbear_{rsa,dss}_host_key
  rather than /etc/dropbear_{rsa,dss}_host_key

- Added SMALL and MULTI text files which have info on compiling for multiple
  binaries or small binaries

- Allow for commandline definition of some options.h settings
  (without warnings)

- Be more careful handling EINTR

- More fixes for channel closing

- Added multi-binary support

- Improved logging of IPs, now get logged in all cases

- Don't chew cpu when waiting for version identification string, also
  make sure that we kick off people if they don't auth within 5 minutes.

- Various small fixes, warnings etc

- Display MOTD if requested - suggested by
  Trent Lloyd <lathiat at sixlabs.org> and
  Zach White <zwhite at darkstar.frop.org>

- sftp support works (relies on OpenSSH sftp binary or similar)

- Added --disable-shadow option (requested by the floppyfw guys)

0.37 - Wed Sept 24 2003 19:42:12 +0800

- Various portability fixes, fixes for Solaris 9, Tru64 5.1, Mac OS X 10.2,
  AIX, BSDs

- Updated LibTomMath to 0.27 and LibTomCrypt to 0.90

- Renamed util.{c,h} to dbutil.{c,h} to avoid conflicts with system util.h

- Added some small changes so it'll work with AIX (plus Linux Affinity).
  Thanks to Shig for them.

- Improved the closing messages, so a clean exit is "Exited normally"

- Added some more robust integer/size checking in buffer.c as a backstop for
  integer overflows

- X11 forwarding fixed for OSX, path for xauth changed to /usr/X11R6/bin/xauth

- Channel code handles closing more nicely, doesn't sit waiting for an extra
  keystroke on BSD/OSX platforms, and data is flushed fully before closing
  child processes (thanks to 
  Cristian Ionescu-Idbohrn <cristian.ionescu-idbohrn at axis.com> for
  pointing that out).

- Changed "DISABLE_TCPFWD" to "ENABLE_TCPFWD" (and for x11/auth) so
  "disable DISABLE_TCPWD" isn't so confusing.

- Fix authorized_keys handling (don't crash on too-long keys, and
  use fgetc not getc to avoid strange macro-related issues), thanks to
  Cristian Ionescu-Idbohrn <cristian.ionescu-idbohrn at axis.com> 
  and Steve Rodgers <hwstar at cox.net> for reporting and testing.

- Fixes to the README with regard to uClibc systems, thanks to 
  Cristian Ionescu-Idbohrn <cristian.ionescu-idbohrn at axis.com>,
  as well as general improvements to documentation (split README/INSTALL)

- Fixed up some compilation problems with dropbearconvert/dropbearkey if
  DSS or RSA were disabled, reported by Patrik Karlsson <patrik at cqure.net>

- Fix double-free bug for hostkeys, reported by
  Vincent Sanders <vince at kyllikki.org>

- Fix up missing \ns from dropbearconvert help message,
  thanks to Mordy Ovits <movits at bloomberg.com> for the patch

0.36 - Tue August 19 2003 12:16:23 +0800

- Fix uninitialised temporary variable in DSS signing code
  (thanks to Matthew Franz <mdfranz at io.com> for reporting, and the authors
  of Valgrind for making it easy to track down)
- Fix remote version-string parsing error
  (thanks to Bernard Blackham <bernard at blackham.com.au> for noticing)
- Improved host-algorithm-matching algorithm in algo.c
- Decreased MAX_STRING_LEN to a more realistic value
- Fix incorrect version (0.34) in this CHANGES file for the previous release.

0.35 - Sun August 17 2003 05:37:47 +0800

- Fix for remotely exploitable format string buffer overflow.
  (thanks to Joel Eriksson <je at bitnux.com>)

0.34 - Fri August 15 2003 15:10:00 +0800

- Made syslog optional, both at compile time and as a compile option
  (suggested by Laurent Bercot <ska at skarnet.org>)
- Fixup for bad base64 parsing in authorized_keys
  (noticed by Davyd Madeley <davyd at zdlcomputing.com>)
- Added initial tcp forwarding code, only -L (local) at this stage
- Improved "make install" with DESTDIR and changing ownership seperately,
  don't check for setpgrp on Linux for crosscompiling.
  (from Erik Andersen <andersen at codepoet.org>)
- More commenting, fix minor compile warnings, make return values more
  consistent etc
- Various signedness fixes
- Can listen on multiple ports
- added option to disable openpty with configure script,
  (from K.-P. Kirchdörfer <kapeka at epost.de>)
- Various cleanups to bignum code
  (thanks to Tom St Denis <tomstdenis at iahu.ca>)
- Fix compile error when disabling RSA
  (from Marc Kleine-Budde <kleine-budde at gmx.de>)
- Other cleanups, splitting large functions for packet and kex handling etc

0.33 - Sun June 22 2003 22:24:12 +0800

- Fixed some invalid assertions in the channel code, fixing the server dying
  when forwarding X11 connections.
- Add dropbearconvert to convert to/from OpenSSH host keys and Dropbear keys
- RSA keys now keep p and q parameters for compatibility -- old Dropbear keys
  still work, but can't be converted to OpenSSH etc.
- Debian packaging directory added, thanks to 
  Grahame (grahame at angrygoats.net)
- 'install' target added to the makefile
- general tidying, improve consistency of functions etc
- If RSA or DSS hostkeys don't exist, that algorithm won't be used.
- Improved RSA and DSS key generation, more efficient and fixed some minor bugs
  (thanks to Tom St Denis for the advice)
- Merged new versions of LibTomCrypt (0.86) and LibTomMath (0.21)

0.32 - Sat May 24 2003 12:44:11 +0800

- Don't compile unused code from libtomcrypt (test vectors etc)
- Updated to libtommath 0.17 and libtomcrypt 0.83. New libtommath results
  in smaller binary size, due to not linking unrequired code
- X11 forwarding added
- Agent forwarding added (for OpenSSH.com ssh client/agent)
- Fix incorrect buffer freeing when banners are used
- Hostname resolution works
- Various minor bugfixes/code size improvements etc

0.31 - Fri May 9 2003 17:57:16 +0800

- Improved syslog messages - IP logging etc
- Strip control characters from log messages (specified username currently)
- Login recording (utmp/wtmp) support, so last/w/who work - taken from OpenSSH
- Shell is started as a proper login shell, so /etc/profile etc is sourced
- Ptys work on Solaris (2.8 x86 tested) now
- Fixed bug in specifying the rsa hostkey
- Fixed bug in compression code, could trigger if compression resulted in
  larger output than input (uncommon but possible).

0.30 - Thu Apr 17 2003 18:46:15 +0800

- SECURITY: buffer.c had bad checking for buffer increment length - fixed
- channel code now closes properly on EOF - scp processes don't hang around
- syslog support added - improved auth/login/failure messages
- general code tidying, made return codes more consistent
- Makefile fixed for dependencies and makes libtomcrypt as well
- Implemented sending SSH_MSG_UNIMPLEMENTED :)

0.29 - Wed Apr 9 2003

- Fixed a stupid bug in 0.28 release, 'newstr = strdup(oldstr)',
  not 'newstr=oldstr'

0.28 - Sun Apr 6 2003

- Initial public release

Development was started in October 2002