How can I configure the ciphers for Dropbear on DD-WRT?

Question

I've installed the latest DD-WRT build for my router and enabled the SSH daemon. The daemon listens to the world on a high port and only accepts key authentication, which is a good start. But ssh-audit reports a number of failures and warnings in DD-WRT's Dropbear SSH configuration:

$ python ssh-audit.py 10.0.1.1
# general
(gen) banner: SSH-2.0-dropbear_2018.76
(gen) software: Dropbear SSH 2018.76
(gen) compatibility: OpenSSH 7.3+ (some functionality from 6.6), Dropbear SSH 2016.73+
(gen) compression: disabled

# key exchange algorithms
(kex) diffie-hellman-group14-sha256  -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
(kex) diffie-hellman-group14-sha1    -- [warn] using weak hashing algorithm
                                     `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
(kex) diffie-hellman-group1-sha1     -- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
                                     `- [fail] disabled (in client) since OpenSSH 7.0, logjam attack
                                     `- [warn] using small 1024-bit modulus
                                     `- [warn] using weak hashing algorithm
                                     `- [info] available since OpenSSH 2.3.0, Dropbear SSH 0.28
(kex) kexguess2@matt.ucc.asn.au      -- [info] available since Dropbear SSH 2013.57

...

# algorithm recommendations (for Dropbear SSH 2018.76)
(rec) -diffie-hellman-group1-sha1    -- kex algorithm to remove
(rec) -diffie-hellman-group14-sha1   -- kex algorithm to remove
(rec) +curve25519-sha256@libssh.org  -- kex algorithm to append
(rec) +diffie-hellman-group16-sha512 -- kex algorithm to append
(rec) -aes128-cbc                    -- enc algorithm to remove
(rec) -aes256-cbc                    -- enc algorithm to remove
(rec) +3des-ctr                      -- enc algorithm to append
(rec) +twofish128-ctr                -- enc algorithm to append
(rec) +twofish256-ctr                -- enc algorithm to append
(rec) -hmac-md5                      -- mac algorithm to remove

Is there a way that I can configure (enable/disable) the key exchange, encryption, and message code algorithms for DD-WRT's Dropbear SSH daemon? I've searched the DD-WRT forums and wiki but haven't found anything conclusive.

score 4 · Accepted Answer · answered Aug 02 '18 at 08:13

To change the encryption algorithms etc., you need to modify the source code of Dropbear and then compile it yourself. Options you mentioned are not configurable with Dropbear configuration utility (according to Dropbear manual). This is probably because Dropbear is designed for embedded systems (like DD-WRT).

You can also wait until the Dropbear development team make changes to these supported algorithms, but I don't know if these changes are included in their roadmap.

How can I configure the ciphers for Dropbear on DD-WRT?

1 Answers1