1

I'm running dropbear as SSH daemon on Debian (actually Raspbian). I tried setting

# /etc/hosts.allow
dropbear:192.168.1.1
# my static ip from which I SSH connect to the device

and

# /etc/hosts.deny
ALL:ALL
# block all others

Then I restarted the whole device. I could still SSH into the device from different IP addresses and even from remote. Did I configure the files wrong or does dropbear not support these two files?

1

Dropbear doesn't include any support for /etc/hosts.allow and /etc/hosts.deny. These files are managed by the TCP wrapper library (libwrap), which Dropbear doesn't use. Some third-party packages patch Dropbear for TCP wrapper support, but not Debian.

You can start Dropbear via tcpd to get TCP wrapper support.

/usr/sbin/tcpd /usr/sbin/dropbear -i

If you only want to filter by IP address, you can do it with iptables.

iptables -A INPUT -p tcp ! --dport 22 -j DROP
0

Try:

# /etc/hosts.deny
sshd:ALL:spawn /bin/echo  the ip %h tried to access `/bin/date`>> /var/log/ssh.log

and

# /etc/hosts.allow
sshd:192.168.1.1

if does not work try again with dropbear this way.

# /etc/hosts.deny
dropear:ALL:spawn /bin/echo  the ip %h tried to access `/bin/date`>> /var/log/ssh.log

and

# /etc/hosts.allow
dropbear:192.168.1.1

and check if dropbear have support for tcp/wrappers.

ldd /path/to/dropbear

look for libwrap.so.0 → /lib/libwrap.so.0

  • Dropbear doesn't come with support TCP wrappers, and Debian doesn't add it either. – Gilles May 13 '14 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.