[G1 Android Development] Darkstrumn:
dropbear environment setup\\install script

Hi Android Community,

I haven't posted anything in sometime given that the speed and number of roms being cranked out, out paced the need for my themes overlay system.:o

Anyway, my latest update has me on CM6 and lovin' it. However my normal Dev environment was disrupted by the seeming lack of the telnetd server. Many suggest that adb itself is more than enough, but the cli is not rich enough for our needs, I like to use PuTTy and such. Anyway, it turns out that dropbear was there all along, but not setup for "out of the box," servicing.

I figured that was good, as most would likely not realize it was setup and leave it configured and running in default mode which would be insecure (root w/no password), not unlike telnetd which some disliked because of security concerns. This forces the user to set dropbear up in order to use ssh, making them aware of it; a good thing. However CM6 didn't have a howTo or scripts to set it up (that I noticed), and there are plenty of howTo's available however.

So I built this script to install a basic sshd environment using the default\\out of the box dropbear, allowing me to be lazy the next rom upgrade and just plot (dbe) back in place. (This is CM6-rom based but should work for any dropbear install.)

It will build a 'secure' environment for login allowing you the 'root' user to set the login password. (It is recommended that you change it from my example default that the script builds.;))

The environment is built into an img file and loopFS mounted to the /data/dropbear folder so that the environment is not bound by the installed rom as long as the img file is on external storage and the userinit.d script (95sshd) is backed-up on the external storage, you can use any rom that provides the dropbear app and use the environment to setup the rom for sshd operation. (if the rom doesn't have dropbear, you can back that up on the ext-storage also.) This method also keeps the environment off the device saving a little space.

The good news is that you don't need to get or recompile a newer version of dropbear to get it secure. While the .passwd file is in unencrypted plain text, that is not important from the inside of the droid, as you need access to be able to read it, and if you're in, you're in and likely are root anyway.:p (If you are not root, the file permissions should prevent prying eyes, such as apps and such.) A rooted droid and adb == root

The script should only need to be run once unless you are rebuilding your sshd environment. I keep the script on the /sdcard and source\\run it

. /sdcard/online.dropbear.sh

The script will attempt to create the following:

/sd-card/img - holds the dropbear.img dir image

/sd-ext/userinit.d/95sshd - boot script to start the server on boot

Inside the img file (/data/dropbear/):

./.passwd - the password file, if not present the system is considered open, if present it will ask you for a third password (the real password to get in)

./.profile - the sshd environment file, loaded upon 'successful' login

./dropbear.banner - MOTD displayed after the login as: prompt

./dropbear_dss_host_key - ssh private keys

./dropbear_rsa_host_key - ssh private keys

./.ssh/authorized_keys - ssh public keys

./ash/ashrc - root user profile script, it is source\\run by the .profile, personal mods and changes should go here, but it's your system...

Before running the script, look it over and make sure you understand what I\\it is doing. you can change the default password after it is built, but because of hardening you're better off doing it

before

you run the script.;)

Other than the verbiage used by the environment (which you can change as you see fit) and the /sd-ext/img dir, there shouldn't be anything that is specific to my droid to keep this from working on yours (unless you don't have dropbear, dropbearkey, or the userinit.d location (maybe the loop devices).

Let me know if you have issue with the loop devices as I can't recall if I needed to rebuild the nodes on my droid or not, I have a script for that to.:D

(Note I don't normally hard code the loop# device, but seemingly had to in CM6, likely it is just me forgetting something.:o)

When done, you should have something similar to this when trying to login (using PuTTy I have adb portforward to port 22(ssh) but if you know the ip address you can just ssh to it) (it is colourized, but that is lost in code):

login as:
>>(Logon Interrupt detected...
>>(Welcome to the HiveNet Collective (Mobile)- System Access Node(SAN).
>>(Access is restricted to Level 4 Green access and above.

@127.0.0.1's password:
Please enter your: Level 4 Green Access Code::
>>(Login Successful. Link Established.
>>(End of line.
[/]:REQUEST_

Well, hope this is of use to someone besides me!:D