devzat VS dropbear

did not know it was possible to use such ports as not-root.

anyway here is a direct link to how you can host your own devzat server: https://github.com/quackduck/devzat#want-to-host-your-own-in...

good luck, OP!

> That sounds like a great feature/configuration option. Maybe even allow a admin-defined backlog size for people that want persistent instances.

Done! https://github.com/quackduck/devzat/commit/00160b83751d90176...

> SSH based chat is not super popular which really surprises me. I could see devzat being an amazing fall-back for a private chat inside a company when Slack or Discord are having a moment or for those times when people want to say something that isn't recorded forever and especially not visible to their management. I think it would also be amazing for people in oppressive regimes that block access to all the mainstream chat platforms but allow SSH to specific VPS providers.

:))))) I'm glad you like devzat. I'd love to talk to you on the main chat!

Oh storing to a DB would be possible! The new gRPC API would make this very easy to implement: https://github.com/quackduck/devzat/pull/110

Details here: https://github.com/quackduck/devzat/issues/77

Dropbear server v2020.81 https://matt.ucc.asn.au/dropbear/dropbear.html

# docker run -it --rm debian:latest # then run the following commands apt-get update apt-get install -y git wget build-essential zlib1g-dev git clone https://github.com/mkj/dropbear cd dropbear # here we disable ChaCha20Poly1305 and enable GCM instead # CBC is disabled by default env CFLAGS='-DDROPBEAR_CHACHA20POLY1305=0 -DDROPBEAR_ENABLE_GCM_MODE=1' ./configure make make install # check if dropbear is vulnerable dropbear -R wget https://github.com/RUB-NDS/Terrapin-Scanner/releases/download/v1.1.0/Terrapin_Scanner_Linux_amd64 chmod +x Terrapin_Scanner_Linux_amd64 ./Terrapin_Scanner_Linux_amd64 -connect 127.0.0.1:22 pkill dropbear

I would follow the suggestions in https://github.com/mkj/dropbear/blob/master/DEVELOPING.md for Deubg Printing, as this seems difficult to solve within information from dropbear.

Heads is good reference for what could be done at BIOS level. It can connect via ethernet but only because the firmware is built in (The GBE section in IFD stands for Gigabit Ethernet). If you want an SSH server, this needs to be built separately because Dropbear is too big to include by default. Due to the size of firmware and range of different wifi cards that could be installed plus the software to connect, wifi is not possible in Heads. Similarly with Bluetooth. For cellar, the firmware, software and configuration would be needed to BIOS. There is also how no service/roaming would be indicated without any physical meter like LEDs (Ethernet has LEDs to show connection). It would also take time during the boot cycle to connect to a cellular service and would block booting the OS. That said, you could add a service at boot of your OS to do this and connect to something like a NextCloud Phone Tracker to do this.

While it is good to have another alternative, I think Dropbear SSH[1] is also being used very widely.

[1] https://matt.ucc.asn.au/dropbear/dropbear.html

I need an SSH server. I try OpenSSH, but run into an issue when I attempt to log in. OpenSSH servers use privilege separation as a security measure. The OpenSSH subprocess that handles authentication runs as an unprivileged user with its root directory set to some safe location. The CAP_SYS_CHROOT capability is required to change the root directory for a process, but Render services run in unprivileged containers without this capability. I discover that there are other SSH servers, like dropbear, that don't do privilege separation. This is great because it's not necessary for my use case anyway. My SSH server will run as a non-root user and will only be available within the VPN.

That's what Dropbear is supposed to do, it can be included in the initramfs of a server: https://matt.ucc.asn.au/dropbear/dropbear.html

Disclaimer: I still didn't try it myself yet, but it's on my (too long) list of things to do.