bebbossh.i386-aros 1.0.8

SSH2 server and client suite with SFTP

Short:        SSH2 server and client suite with SFTP
Author:       Stefan Franke (BebboSSH), Michele Dipace (AROS port)
Uploader:     michele dipace kaffeine net (Michele Dipace)
Type:         comm/net
Version:      1.0.8
Replaces:     comm/net/bebbossh.i386-aros.lha
Requires:     AROS One i386 (ABIv0) with a TCP/IP stack (AROSTCP)
Architecture: i386-aros

WHAT IS THIS?

BebboSSH is an SSH2 implementation for Amiga systems by Stefan "Bebbo"
Franke. This archive is its port to
AROS i386 (the "alt-abiv0" ABI of AROS One).
With it you can log in to an AROS machine from any SSH client, run
commands, and copy files with scp and sftp; the native clients connect
from AROS to other SSH servers. The original 68k version is
comm/net/bebbossh.lha;
the AROS x86_64 build is comm/net/bebbossh.x86_64-aros.lha,
the AROS aarch64 build is comm/net/bebbossh.aarch64-aros.lha.

PROGRAMS

  bebbosshd       SSH2 server: remote commands, SFTP, SCP, TCP port
                  forwarding (direct-tcpip), password and public-key login
  bebbossh        SSH2 client, with -L local port forwarding
  bebboscp        SCP client
  bebbosshkeygen  Ed25519 key generator

Algorithms: curve25519-sha256 key exchange, ssh-ed25519 host and user
keys, aes128-gcm@openssh.com and chacha20-poly1305@openssh.com ciphers.

REQUIREMENTS

- AROS One i386 (ABIv0, "alt-abiv0").
- A configured TCP/IP stack (AROSTCP, bsdsocket.library).
- No extra libraries: the crypto code is linked into each program.

CONTENTS

  BebboSSH/bebbosshd, bebbossh, bebboscp, bebbosshkeygen
  BebboSSH/sshd_config.example, passwd.example
  BebboSSH/README.AROS.txt   install and configuration guide
  BebboSSH/README.md, AROS_PORTING.md, docs/, scripts/
  BebboSSH/COPYING, LICENSE  license texts (GNU GPL v3)
  BebboSSH/SHA256SUMS        checksums of the files above

INSTALLATION

1. Extract the archive to a persistent volume, for example DH0:.
2. In an AROS Shell, create the configuration and a host key. The
   throwaway key first creates the random seed (see README.AROS.txt,
   Random Numbers):

     cd DH0:BebboSSH
     copy sshd_config.example sshd_config
     copy passwd.example passwd
     bebbosshkeygen -f T:seed_key
     delete T:seed_key T:seed_key.pub
     bebbosshkeygen -f ssh_host_ed25519_key

   Under QEMU without hardware virtualisation bebbosshkeygen warns
   that the CPU timer shows little jitter; the key then relies more
   on the timer wake-ups and the seed (README.AROS.txt, Random
   Numbers).

3. Edit passwd: one "username password" pair per line. The test/test
   entry of the example is for a first test only; replace it.
4. Start the server:

     stack 262144
     bebbosshd

5. From another machine: ssh username@<address of the AROS machine>

To start the server at boot, add these lines to S:User-Startup:

  Stack 262144
  If EXISTS DH0:BebboSSH/bebbosshd
      Run DH0:BebboSSH/bebbosshd
  EndIf

To call the clients from anywhere, copy bebbossh, bebboscp and
bebbosshkeygen to C:. Keep bebbosshd in its own directory: the example
configuration finds its files through PROGDIR:.

CONFIGURATION

bebbosshd reads ENVARC:ssh/sshd_config if it exists, otherwise
PROGDIR:sshd_config. The main directives (the example sets all but
Ciphers and AllowTcpForwarding, which keep their defaults):

  Port 22                 TCP port
  ListenAddress 0.0.0.0   address to listen on (0.0.0.0 = all)
  HostKey PROGDIR:ssh_host_ed25519_key
  Passwords PROGDIR:passwd
  HomeDir DH0:            start directory of commands and SFTP
  Stack 262144            stack of command tasks (default 1 MiB)
  DebugLevel 1            log level: 0 none to 8 ultra, or a name such
                          as error or debug
  SendNoop some           keepalive messages to idle sessions
  Ciphers aes128-gcm@openssh.com,chacha20-poly1305@openssh.com
                          without this line only aes128-gcm is offered
  AllowTcpForwarding yes  direct-tcpip forwarding (ssh -L); no refuses it

Command-line options override the file: -p port, -A password file,
-K host key, -H home directory, -v log level (for example -v5).
Public-key login reads ENVARC:.ssh/authorized_keys (OpenSSH format,
one key per line). README.AROS.txt describes every file in detail.

USAGE

From a PC with OpenSSH:

  ssh user@aros-host version
  scp file.txt user@aros-host:DH0:
  sftp user@aros-host

From AROS:

  bebbossh user@host
  bebbossh -i DH0:keys/id_ed25519 user@host command
  bebbossh -L 8080:localhost:80 user@host
  bebboscp localfile user@host:remotefile
  bebbosshkeygen -f DH0:keys/id_ed25519

The first connection to a host asks, in a console window, whether to
trust its key: answer yes. The key is then kept in
ENVARC:.ssh/known_hosts. Without a console (for example in a remote
command) an unknown host is refused. A host whose key differs from the
stored one is always refused with a warning; if the change is
expected, remove its line from known_hosts.

KNOWN LIMITS

- No full interactive PTY programs: the interactive shell runs simple
  commands, and programs that read their input are rejected with exit
  status 2.
- No redirection or pipes (>, <, |) in remote commands.
- A command typed in an interactive session runs inside the server:
  other connections wait until it ends, and Ctrl-C does not stop it.
  Run long commands as "ssh host command", which runs them in a
  separate task.
- A remote command still running after 30 seconds gets a timeout
  notice and exit status 124, but it keeps running until it ends.
- OpenSSH "put -p" sets the file time before it closes the file, and
  AROS updates the date on close, so that time is not kept.
- A channel close sent first by the client is ignored: the channel
  stays open until the connection ends.
- passwd.example contains a test password: change it.

WHAT IS NEW IN 1.0.8

- A client that stops reading no longer freezes the server: its
  session is dropped after 30 seconds without progress, or at once on
  Ctrl-C. Updating is recommended.
- With SendNoop some or many, the server sent its keep-alive on a
  closed channel when channel 0 had been closed while another channel
  was still open, and the client dropped the connection.
- When WaitSelect() failed, the server took every socket as readable
  and Ctrl-C as pressed; it now logs the error and goes on.
- The key exchange timing pad has the intended length, and a clock
  step back can no longer make later logins wait almost forever.
- bebbossh frees its keyboard.device request; it lost a small memory
  block after the first cursor key in an interactive session.

TESTED

On AROS One i386 under QEMU, with the programs of this archive:
OpenSSH ssh, scp and sftp; 100 logins in a row; 80 file transfers
without pauses; two servers at once; connections dropped during
commands; Ctrl-C on an idle server, with a client, during a command
and while a dropped connection's command still runs, each followed
by a restart; uploads up to 16 MiB; the login and host key checks of
this release, also a password login as PuTTY sends it;
AllowTcpForwarding off; the native clients, also on the AROS console;
a client that stops reading, Ctrl-C during that stall, and
keep-alives with channel 0 closed.

SOURCE AND LICENSE

GNU GPL v3 or later (see COPYING). Source of this release:
  https://github.com/kaffeine1/bebbossh-aros/tree/v1.0.8-aros-i386-abiv0
Original BebboSSH: https://franke.ms/git/bebbo/bebbossh
Bug reports: https://github.com/kaffeine1/bebbossh-aros/issues

Port by Michele Dipace <michele.dipace@kaffeine.net>.