Dropbear is an SSH 2 server, designed to be usable in small memory
environments. It supports:
* Main features of SSH 2 protocol
* Implements X11 forwarding, and authentication-agent forwarding
for OpenSSH clients
* Compatible with OpenSSH ~/.ssh/authorized_keys public key
authentication
===> The following configuration options are available for dropbear-2026.94:
PORTS_LIBTOM=on: Use libtomcrypt/libtommath in ports tree
SMALL_CODE=off: Make binary smaller in exchange for 50% performance hit
STATIC=off: Build static executables and/or libraries
X11FWD=off: Enable X11 forwarding
====> Options available for the multi ENC: you have to choose at least one of them
3DES=off: Enable 3DES-based encryption
AES128=on: Enable AES128-based encryption
AES256=on: Enable AES256-based encryption
CHACHA20POLY1305=off: Enable chacha20poly1305-based encryption
====> Options available for the multi KEY: you have to choose at least one of them
DSS=off: Enable DSS (insecure)
ECDSA=on: Enable ECDSA public key support
ED25519=on: Enable ED25519 public key support
RSA=on: Enable RSA public key support
====> Options available for the multi KEX: you have to choose at least one of them
CURVE25519=on: Enable Curve25519
ECDH=off: Enable ECDH (insecure)
GROUP1=off: Enable Group1 Diffie-Hellman (insecure)
GROUP14_SHA1=off: Enable Group14 Diffie-Helman with SHA1 (insecure)
GROUP14_SHA256=on: Enable Group14 Diffie-Helman with SHA256
GROUP16=on: Enable Group16 Diffie-Hellman
MLKEM768=on: Enable mlkem768 key exchange algorithm (recommended)
SNTRUP761=on: Enable sntrup761 key exchange algorithm (recommended)
====> Options available for the multi MAC: you have to choose at least one of them
MD5=off: Enable MD5 MAC (broken)
RSA_SHA1=off: Enable RSA SHA1 MAC (insecure)
SHA1=off: Enable SHA1 MAC (less secure)
SHA1_96=off: Enable SHA1_96 MAC (less secure)
SHA2_256=on: Enable SHA2_256 MAC
SHA2_512=off: Enable SHA2_512 MAC
====> Options available for the multi MODE: you have to choose at least one of them
CBC=off: Use CBC mode for ciphers (less secure)
CTR=off: Use CTR mode for ciphers
GCM=on: Enable GCM mode for ciphers (more secure)
===> Use 'make config' to modify these settings
security/dropbear: update to 2026.94
PR: 297038
Changelog:
2026.94 - 23 July 2026
Note >> for compatibility/configuration changes
- Fix scp build failure regression from 2026.93
The new ascii_isdigit() etc wasn't linked.
- >> Print square brackets around ipv6 addresses with ports, eg
[2a00:f10:400:2:1c00:bcff:fe00:1c6]:22
This may affect log parsers such as fail2ban.
Patch from Seo Suchan
(Only the first 15 lines of the commit message are shown above )
security/dropbear: update to 2025.89
Changelog:
- Security: Avoid privilege escalation via unix stream forwarding in Dropbear
server. Other programs on a system may authenticate unix sockets via
SO_PEERCRED, which would be root user for Dropbear forwarded connections,
allowing root privilege escalation.
Reported by Turistu, and thanks for advice on the fix.
This is tracked as CVE-2025-14282, and affects 2024.84 to 2025.88.
It is fixed by dropping privileges of the dropbear process after
authentication. Unix stream sockets are now disallowed when a
forced command is used, either with authorized_key restrictions or
"dropbear -c command".
(Only the first 15 lines of the commit message are shown above )
security/dropbear: update to 2025.88
Changelog:
- Security: Don't allow dbclient hostname arguments to be interpreted
by the shell.
dbclient hostname arguments with a comma (for multihop) would be
passed to the shell which could result in running arbitrary shell
commands locally. That could be a security issue in situations
where dbclient is passed untrusted hostname arguments.
Now the multihop command is executed directly, no shell is involved.
Thanks to Marcin Nowak for the report, tracked as CVE-2025-47203
- Fix compatibility for htole64 and htole32, regression in 2025.87
(Only the first 15 lines of the commit message are shown above )
security/dropbear: update to 2025.87
Changes:
Note >> for compatibility/configuration changes
- >> Disable SHA-1 algorithms by default. SHA-1 has known weakness and
most implementations support alternatives.
- Add post-quantum key exchange. These avoid the possibility of current
stored traffic being decrypted using a possible future quantum
computer.
sntrup761 added by Matt Johnston, using sntrup761 implementation from
Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange and
Christine van Vredendaal, with integration work from OpenSSH.
(Only the first 15 lines of the commit message are shown above )
security/dropbear: Unbundle libtom* libs by default
Add option to use libtom* libraries from ports tree and set as default
PR: 274351
Reviewed by: pkubaj (maintainer)
security/dropbear: update to 2022.83
Features and Changes:
Note >> for compatibility/configuration changes
- >> Disable DROPBEAR_DSS by default
It is only 1024 bit and uses sha1, most distros disable it by default already.
- Added DROPBEAR_RSA_SHA1 option to allow disabling sha1 rsa signatures.
>> RSA with sha1 will be disabled in a future release (rsa keys will continue
to work OK, with sha256 signatures used instead).
- Add option for requiring both password and pubkey (-t)
Patch from Jackkal
(Only the first 15 lines of the commit message are shown above )
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/dropbear: update to 2020.81
Changelog:
- Fix regression in 2020.79 which prevented connecting with some SSH
implementations. Increase MAX_PROPOSED_ALGO to 50, and print a log
message if the limit is hit. This fixes interoperability with sshj
library (used by PyCharm), and GoAnywhere.
Reported by Pirmin Walthert and Piotr Jurkiewicz
- Fix building with non-GCC compilers, reported by Kazuo Kuroi
- Fix potential long delay in dbclient, found by OSS Fuzz
- Fix null pointer dereference crash, found by OSS Fuzz
- libtommath now uses the same random source as Dropbear (in 2020.79
and 2020.80 used getrandom() separately)
- Some fuzzing improvements, start of a dbclient fuzzer
security/dropbear: change in rc DSS to ed25519
dropbear no longer supports DSS keys, use ed25519 instead. rc file needs to be
updated.
currently starting dropbear fails with error:
% service dropbear start
...
Unknown key type 'dss'
...
Submitted by: waitman@waitman.net
PR: 250192
MFH: 2020Q4 (runtime fix)
security/dropbear: add scp
Build and install the scp binary with the dropbear package. To avoid a name
colision with openssh-portable, call binary dbscp.
PR: 242551
Submitted by: mm
security/dropbear: update to 2019.78, change maintainer
Update the port to 2019.78 and change maintainer to my FreeBSD address.
Approved by: mat (mentor)
Differential Revision: https://reviews.freebsd.org/D20601
- Update to version 2016.74
- Add license information
Changelog:
- Security: Message printout was vulnerable to format string injection.
If specific usernames including "%" symbols can be created on a system
(validated by getpwnam()) then an attacker could run arbitrary code as root
when connecting to Dropbear server.
A dbclient user who can control username or host arguments could potentially
run arbitrary code as the dbclient user. This could be a problem if scripts
or webpages pass untrusted input to the dbclient program.
- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
(Only the first 15 lines of the commit message are shown above )
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
- Fix compile if WITH_STATIC is enabled [1]
- Also pr ports/163593, which is a duplicate of this one. root@42.org [2]
PR: ports/163217
Submitted by: Mattia Rossi <mrossi@swin.edu.au> [1], root@42.org [2]
Approved by: spam@rm-rf.kiev.ua (maintainer), gabor (mentor)
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS)
- Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav
- Update to 0.47
- SECURITY: fix for buffer allocation error in server code, could potentially
allow authenticated users to gain elevated privileges.
PR: ports/90531
Submitted by: Gea-Suan Lin <gslin@gslin.org>
[maintainer patch] security/dropbear: Change fetch location
I'm rearranging the files a bit on the Dropbear site to
avoid problems with links going away for previous versions,
would you be able to change the source url for Dropbear to
be the package in the http://matt.ucc.asn.au/dropbear/releases/
directory, rather than just the /dropbear/ dir?
PR: ports/57643
Submitted by: Clement Laforet <sheepkiller@cultdeadsheep.org>
[new port] security/dropbear: a lightweight SSH2 server
Dropbear is an SSH 2 server, designed to be usable in small
memory environments.
It supports:
* Main features of SSH 2 protocol
* Implements X11 forwarding, and authentication-agent forwarding
for OpenSSH clients
* Compatible with OpenSSH ~/.ssh/authorized_keys public key
authentication
WWW: http://matt.ucc.asn.au/dropbear/dropbear.html
PR: ports/55795
Submitted by: Clement Laforet <sheepkiller@cultdeadsheep.org>
