What to Replace OpenSSH with on Low-Power Devices and Routers

When you're building a minimalist image for a microcontroller, router, or Docker container, every megabyte of memory becomes a luxury. Full-featured OpenSSH works great on servers, but for embedded systems it looks like a truck pulling up to a corner store. It drags along a trail of dependencies, and RAM literally melts away before your eyes.

In situations like these, people turn to Dropbear. It's a compact SSH server and client written by Matt Johnston. The project appeared over twenty years ago, but is still actively maintained and serves as the default standard in OpenWrt and network device firmware.

What's inside and how the savings are achieved

Dropbear solves one specific task: to economize disk space and RAM while maintaining the basic security of the SSH-2 protocol. If you compile the project with the right flags, the resulting binary takes up just a couple hundred kilobytes.

The developer applied the concept of a single multi-purpose binary, similar to how the BusyBox utility works. In this mode, one file handles the functions of the server, client dbclient, key generator dropbearkey, and converter dropbearconvert. You create symbolic links with the required names pointing to one binary, and the program determines its operating mode based on the name of the called file.

Here are a couple more tricks for reducing size:

• The built-in client scp is compiled without a file transfer progress bar by default. If you need an indicator, you'll have to explicitly pass the SCPPROGRESS=1 parameter during compilation.
• In the options.h file, you can manually disable unused encryption algorithms, port forwarding, or password authentication support, further reducing the final file size.

Key handling nuances

If you're used to standard OpenSSH tooling, the project will throw a few surprises your way. On the server side, everything is familiar: the ~/.ssh/authorized_keys file works in the standard way. You add public keys in ssh-rsa or ssh-ed25519 format there. The main thing is to make sure your editor doesn't split the key string across multiple lines, and that the permissions on the .ssh directory allow writing only for the owner.

On the client side and when generating host keys, the quirks begin. The utility uses its own format for private keys. To use your familiar ~/.ssh/id_rsa key in the dbclient client, you'll need to convert it first:

dropbearconvert openssh dropbear ~/.ssh/id_rsa ~/.ssh/id_rsa.db
dbclient -i ~/.ssh/id_rsa.db user@remotehost

If you create a new key through the native dropbearkey utility, the private and public parts are output directly to the console. You can extract the public key for adding to another server with simple filtering:

./dropbearkey -y -f ~/.ssh/id_ed25519 | grep "^ssh-" > ~/.ssh/id_ed25519.pub

Starting the server and pitfalls

Usually, before starting the SSH server, you need to manually generate host keys:

./dropbearkey -t rsa -f dropbear_rsa_host_key
./dropbearkey -t ed25519 -f dropbear_ed25519_host_key

Dropbear has a convenient hack for fast system boot. Instead of generating keys at startup (which slows down boot on weak processors), you pass the -R flag to the server. In this case, keys will be automatically created in the /etc/dropbear/ directory only on the first incoming connection.

When operating, keep in mind the project's quirks:

• Running the server as a regular user is heavily restricted. You won't be able to allocate a pseudo-terminal (pty), switch to another account, or use shadow passwords.
• Password-encrypted host keys are not directly supported, although the client can connect to a running ssh-agent.
• The project lacks detailed documentation. The main instructions are scattered across the text files INSTALL.md, MULTI.md, and SMALL.md in the repository root.

Who will find this tool useful

Dropbear will come in handy if you're making custom router firmware, developing a Linux-based device with limited flash memory, or building a compact initramfs image. On a full server with dozens of gigabytes of memory, you'll hardly notice any difference from OpenSSH. But where every kilobyte counts, this tool conserves resources better than most alternatives.