From ab78bc85cc098d7d33eec4f0c0cc6a1a518d053b Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Thu, 31 Aug 2017 14:32:39 +0200 Subject: [PATCH] dropbear: hide dropbear version As security precaution and to limit the attack surface based on the version reported by tools like nmap mask out the dropbear version so the version is not visible anymore by snooping on the wire. Version is still visible by 'dropbear -V' Based on a patch by Hans Dedecker Signed-off-by: Kevin Darbyshire-Bryant Signed-off-by: Felix Fietkau --- package/network/services/dropbear/Makefile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile index 8c9b45f486..7caf0c7083 100644 --- a/package/network/services/dropbear/Makefile +++ b/package/network/services/dropbear/Makefile @@ -104,6 +104,10 @@ define Build/Configure mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \ done + # remove protocol idented software version number + $(SED) 's,^#define LOCAL_IDENT .*$$$$,#define LOCAL_IDENT "SSH-2.0-dropbear",g' \ + $(PKG_BUILD_DIR)/sysoptions.h + # Enforce rebuild of svr-chansession.c rm -f $(PKG_BUILD_DIR)/svr-chansession.o endef -- 2.11.0