mkj/dropbear

dropbear starts despite NO_START=1

Closed this issue · 2 comments

jp-umea commented

I am using dropbear to remotely unlock encrypted disks (https://github.com/ceremcem/unlock-luks-partition) in debian 11. It has previously worked well.

I have now upgraded to debian 12 bookworm. Now dropbear keeps restarting.

/etc/default/dropbear

# disabled because OpenSSH is installed
# change to NO_START=0 to enable Dropbear
NO_START=1
# the TCP port that Dropbear listens on
DROPBEAR_PORT=22

# any additional arguments for Dropbear
DROPBEAR_EXTRA_ARGS=

# specify an optional banner file containing a message to be
# sent to clients before they connect, such as "/etc/issue.net"
DROPBEAR_BANNER=""

# RSA hostkey file (default: /etc/dropbear/dropbear_rsa_host_key)
#DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key"

# DSS hostkey file (default: /etc/dropbear/dropbear_dss_host_key)
#DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key"

# ECDSA hostkey file (default: /etc/dropbear/dropbear_ecdsa_host_key)
#DROPBEAR_ECDSAKEY="/etc/dropbear/dropbear_ecdsa_host_key"

# Receive window size - this is a tradeoff between memory and
# network performance
DROPBEAR_RECEIVE_WINDOW=65536

I have tried reinstalling dropbear.
I have tried changing port during boot/unlock which changed the port I had to use. Dropbear keeps starting at port 22 once the system is booted.

....
root        1472  0.0  0.0   4524  1344 ?        Ss   17:41   0:00 /usr/sbin/dropbear -EF -p 22 -W 65536
...
root        1933  0.0  0.0   4524  3180 ?        Ss   17:41   0:00 /usr/sbin/dropbear -EF -p 22 -W 65536 -2 8
...

Version: 2022.83-1+deb12u1

Any ideas why it behaves this way?

mkj commented
jp-umea commented

I have been informed about the problem...

From the NEWS file:

| dropbear (2022.82-1) unstable; urgency=medium
|
| Setting NO_START=1 in /etc/default/dropbear in order to avoid automatically
| starting dropbear(8) is no longer honored. Use your service manager
| instead, for instance run systemctl disable --now dropbear.
| Alternatively, you can run apt remove dropbear to remove startup scripts
| and service files (you'll still be able to start dropbear(8) manually if
| the 'dropbear-bin' package is installed, and use the initramfs integration
| if the 'dropbear-initramfs' package is installed.)
|
| In addition, /etc/default/dropbear settings DROPBEAR_*KEY and
| DROPBEAR_BANNER are subsumed by DROPBEAR_EXTRA_ARGS are no longer honored.
| See /etc/default/dropbear for examples.
|
| -- Guilhem Moulin guilhem@debian.org Sat, 02 Apr 2022 15:51:17 +0200

  • 👍1