--- name: "dropbear" section: "8" platform: "linux" package: "dropbear" version: "2026.94-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/dropbear" --- # dropbear(8) lightweight SSH server ## NAME **dropbear** – lightweight SSH server ## SYNOPSIS **dropbear** \[*flag* *arguments*\] \[**-b** *banner*\] \[**-r** *hostkeyfile*\] \[**-p** *\[address:\]port*\] ## DESCRIPTION **dropbear** is a small SSH server ## OPTIONS - **-b** *banner* bannerfile. Display the contents of the file *banner* before user login (default: none). - **-r** *hostkey* Use the contents of the file *hostkey* for the SSH hostkey. This file is generated with [dropbearkey(1)](/dropbearkey/1.md) or automatically with the **-R** option. See “Host Key Files” below. - **-R** Generate hostkeys automatically. See “Host Key Files” below. - **-F** Don't fork into background. - **-E** Log to standard error rather than syslog. - **-e** Pass on the server environment to all child processes. This is required, for example, if Dropbear is launched on the fly from a SLURM workload manager. The environment is not passed by default. Note that this could expose secrets in environment variables from the calling process - use with caution. - **-m** Don't display the message of the day on login. - **-w** Disallow root logins. - **-s** Disable password logins. - **-g** Disable password logins for root. - **-t** Enable two-factor authentication. Both password login and public key authentication are required. Should not be used with the **-s** option. - **-j** Disable local port forwarding. This includes unix stream forwards. - **-k** Disable remote port forwarding. - **-p** *\[address:\]port* Listen on specified *address* and TCP *port*. If just a port is given listen on all addresses. Up to 10 can be specified (default 22 if none specified). - **-l** *interface* Listen on the specified *interface* - **-i** Service program mode. Use this option to run **dropbear** under TCP/IP servers like inetd, tcpsvd, or tcpserver. In program mode the **-F** option is implied, and **-p** options are ignored. - **-P** *pidfile* Specify a pidfile to create when running as a daemon. If not specified, the default is */var/run/dropbear.pid* - **-a** Allow remote hosts to connect to forwarded ports. - **-W** *windowsize* Specify the per-channel receive window buffer size. Increasing this may improve network performance at the expense of memory use. Use -h to see the default buffer size. - **-K** *timeout\_seconds* Ensure that traffic is transmitted at a certain interval in seconds. This is useful for working around firewalls or routers that drop connections after a certain period of inactivity. The trade-off is that a session may be closed if there is a temporary lapse of network connectivity. A setting of 0 disables keepalives. If no response is received for 3 consecutive keepalives the connection will be closed. - **-I** *idle\_timeout* Disconnect the session if no traffic is transmitted or received for *idle\_timeout* seconds. - **-M** Set maximum session duration in seconds. All sessions will close after this time. If a compile-time setting was set (default is none), then setting **-M** *0* will disable the session duration timeout. - **-z** By default Dropbear will send network traffic with the AF21 setting for QoS, letting network devices give it higher priority. Some devices may have problems with that, **-z** can be used to disable it. - **-T** *max\_authentication\_attempts* Set the number of authentication attempts allowed per connection. If unspecified the default is 10 (MAX\_AUTH\_TRIES) - **-c** *forced\_command* Disregard the command/shell provided by the user and always run *forced\_command*. This also overrides any *authorized\_keys* **command=** option. The original command is saved in the SSH\_ORIGINAL\_COMMAND environment variable (see below). The forced command is started using the user's normal shell, the same as occurs for normal commands. Unix stream forwarding is disabled when a forced command is set, since that may allow a bypass of the forced command. Other SSH features such as TCP forwarding are still allowed by default - it may be desirable to disable those using **-j** or **-k** options when using forced command. - **-D** *authorized\_keys\_dir* Specify the directory to use for *authorized\_keys* files. The default is *~/.ssh*, paths with a leading *~/* will be home directory expanded. - **-Q** *algo* Query supported algorithms. Options are kex, sig, cipher, mac, compress - **-V** Print the version ## FILES - Authorized Keys *~/.ssh/authorized\_keys* can be set up to allow remote login with a Ed25519, RSA, or ECDSA key. The *authorized\_keys* file and its containing *~/.ssh* directory must only be writable by the user, otherwise Dropbear will not allow a login using public key authentication. Each line is of the form ``` [restrictions] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIgAsp... [comment] ``` and can be extracted from a Dropbear private host key with ‘dropbearkey -y’. This is the same format as used by OpenSSH, though the restrictions are a subset (keys with unknown restrictions are ignored). Restrictions are comma separated, with double quotes around spaces in arguments. Available restrictions are: - **no-port-forwarding** Don't allow port forwarding for this connection, including unix streams. - **no-agent-forwarding** Don't allow agent forwarding for this connection - **no-X11-forwarding** Don't allow X11 forwarding for this connection - **no-pty** Disable PTY allocation. Note that a user can still obtain most of the same functionality with other means even if no-pty is set. - **restrict** Applies all the no- restrictions listed above. - **permitopen=**"*host:port*" Restrict local port forwarding so that connection is allowed only to the specified host and port. Multiple permitopen options separated by commas can be set in *authorized\_keys*. Wildcard character (‘\*’) may be used in port specification for matching any port. Hosts must be literal domain names or IP addresses. - **permitlisten=**"*port*" Restrict remote port forwarding listeners to the given port. Multiple **permitlisten=**"*port*" options separated by commas can be set in *authorized\_keys*. Port can be 0 to allow the listen port to be dynamically allocated on the server. - **command=**"*forced\_command*" Disregard the command provided by the user and always run *forced\_command*. The **-c** command line option overrides this. See **-c** documentation for behaviour of forced commands. When using **command=** it is often desirable to also use **restrict** option to avoid other SSH features that may allow additional access. - Host Key Files Host key files are read at startup from a standard location, by default */etc/dropbear/dropbear\_dss\_host\_key*, */etc/dropbear/dropbear\_rsa\_host\_key*, */etc/dropbear/dropbear\_ecdsa\_host\_key* and */etc/dropbear/dropbear\_ed25519\_host\_key* If the **-r** command line option is specified the default files are not loaded. Host key files are of the form generated by [dropbearkey(1)](/dropbearkey/1.md). The **-R** option can be used to automatically generate keys in the default location - keys will be generated after startup when the first connection is established. This had the benefit that the system */dev/urandom* random number source has a better chance of being securely seeded. - Message Of The Day By default the file */etc/motd* will be printed for any login shell (unless disabled at compile-time). This can also be disabled per-user by creating a file *~/.hushlogin*. ## ENVIRONMENT VARIABLES Dropbear sets the standard variables USER, LOGNAME, HOME, SHELL, PATH, and TERM. The variables below are set for sessions as appropriate. - SSH\_TTY This is set to the allocated TTY if a PTY was used. - SSH\_CONNECTION Contains ‘\ \ \ \’. - DISPLAY Set X11 forwarding is used. - SSH\_ORIGINAL\_COMMAND If a **command=** *authorized\_keys* option was used, the original command is specified in this variable. If a shell was requested this is set to an empty value. - SSH\_AUTH\_SOCK Set to a forwarded ssh-agent connection. ## NOTES Dropbear only supports SSH protocol version 2. ## SEE ALSO [dbclient(1)](/dbclient/1.md), [dropbearconvert(1)](/dropbearconvert/1.md), [dropbearkey(1)](/dropbearkey/1.md) **https://matt.ucc.asn.au/dropbear/dropbear.html** ## AUTHORS Matt Johnston ⟨*matt@ucc.asn.au*⟩. Gerrit Pape ⟨*pape@smarden.org*⟩ wrote this manual page.