How to disable Dropbear Password Auth in 1.9.2.7-d-r1612?

[darkside40]

Hi there,
i asked my self if there is a way to disable the normal password auth of the built-in dropbear ssh server in 1.9.2.7-d-r1612?

With my 2 year old original oleg it was no problem, there the service was started by a script and i simply could add the -s command to dropbear to only use certificate based auth.

Is there any way to do this in the current fw?

[lly]

You can simply disable dropbear startup from web-UI: System Setup->Services->Enable SSH Server and continue to use your own custom script.

[darkside40]

Okay have to try that, but after my FW upgrade i wasnt able to connect to the router via ssh.
Could it be that dropbear in fw has overwritten my self installed one?

I did my old fw install after wengis tut http://wl500g.info/showthread.php?t=10307

[lly]

Okay have to try that, but after my FW upgrade i wasnt able to connect to the router via ssh.
Could it be that dropbear in fw has overwritten my self installed one?
You have to study tutorial deeper - dropbear itself can't be overwritten, since it is a part of FW. You can only modify/disable startup procedure.

[darkside40]

Okay worked.
After adding a suitable Firewall rule to post-firewall and the command dropbear -s to post-boot it now works.

Thanks for the hint.

[darkside40]

Just one more question, does the Anti Bruteforce for SSH also work when i start dropbear by myself?

And how does it work anyway? Filter rules or some kind of script?

I just ask because there where massive (unsuccessfull) Login Attempts to dropbear last evening and i dont think that they where stopped by the Anti Bruteforce protection.

http://pastebin.com/kZE1zxau

[kolaCZek]

SSH ON in webadmin (because of firewall and anti bruteforce).

And /opt/etc/init.d/S07dropbear script:


#!/bin/sh

case $1 in
start)
echo "Starting dropbear..."

if [ -n "`pidof dropbear`" ]; then
killall dropbear > /dev/null
fi

dropbear -s

echo "dropbear started"
;;
stop)
echo "Stopping dropbear..."

if [ -n "`pidof dropbear`" ]; then
killall dropbear > /dev/null
fi

echo "dropbear stoped"
;;
*)
echo "usage: $0 (start|stop)"
exit 1
esac