DROPBEAR(8) System Manager's Manual DROPBEAR(8)

# [NAME](#NAME)

`dropbear` — lightweight SSH server

# [SYNOPSIS](#SYNOPSIS)

`dropbear` \[`flag arguments`] \[`-b` `banner`] \[`-r` `hostkeyfile`] \[`-p` `[address:]port`]

# [DESCRIPTION](#DESCRIPTION)

`dropbear` is a small SSH server

# [OPTIONS](#OPTIONS)

[`-b`](#b) `banner`

bannerfile. Display the contents of the file `banner` before user login (default: none).

[`-r`](#r) `hostkey`

Use the contents of the file `hostkey` for the SSH hostkey. This file is generated with [dropbearkey(1)](/man/os/dropbear/dropbearkey.1) or automatically with the `-R` option. See “Host Key Files” below.

[`-R`](#R)

Generate hostkeys automatically. See “Host Key Files” below.

[`-F`](#F)

Don't fork into background.

[`-E`](#E)

Log to standard error rather than syslog.

[`-e`](#e)

Pass on the server environment to all child processes. This is required, for example, if Dropbear is launched on the fly from a SLURM workload manager. The environment is not passed by default. Note that this could expose secrets in environment variables from the calling process - use with caution.

[`-m`](#m)

Don't display the message of the day on login.

[`-w`](#w)

Disallow root logins.

[`-s`](#s)

Disable password logins.

[`-g`](#g)

Disable password logins for root.

[`-t`](#t)

Enable two-factor authentication. Both password login and public key authentication are required. Should not be used with the `-s` option.

[`-j`](#j)

Disable local port forwarding. This includes unix stream forwards.

[`-k`](#k)

Disable remote port forwarding.

[`-p`](#p) `[address:]port`

Listen on specified `address` and TCP `port`. If just a port is given listen on all addresses. Up to 10 can be specified (default 22 if none specified).

[`-l`](#l) `interface`

Listen on the specified `interface`

[`-i`](#i)

Service program mode. Use this option to run `dropbear` under TCP/IP servers like inetd, tcpsvd, or tcpserver. In program mode the `-F` option is implied, and `-p` options are ignored.

[`-P`](#P) `pidfile`

Specify a pidfile to create when running as a daemon. If not specified, the default is /var/run/dropbear.pid

[`-a`](#a)

Allow remote hosts to connect to forwarded ports.

[`-W`](#W) `windowsize`

Specify the per-channel receive window buffer size. Increasing this may improve network performance at the expense of memory use. Use -h to see the default buffer size.

[`-K`](#K) `timeout_seconds`

Ensure that traffic is transmitted at a certain interval in seconds. This is useful for working around firewalls or routers that drop connections after a certain period of inactivity. The trade-off is that a session may be closed if there is a temporary lapse of network connectivity. A setting of 0 disables keepalives. If no response is received for 3 consecutive keepalives the connection will be closed.

[`-I`](#I) `idle_timeout`

Disconnect the session if no traffic is transmitted or received for `idle_timeout` seconds.

[`-M`](#M)

Set maximum session duration in seconds. All sessions will close after this time. If a compile-time setting was set (default is none), then setting `-M` `0` will disable the session duration timeout.

[`-z`](#z)

By default Dropbear will send network traffic with the `AF21` setting for QoS, letting network devices give it higher priority. Some devices may have problems with that, `-z` can be used to disable it.

[`-T`](#T) `max_authentication_attempts`

Set the number of authentication attempts allowed per connection. If unspecified the default is 10 (`MAX_AUTH_TRIES`)

[`-c`](#c) `forced_command`

Disregard the command/shell provided by the user and always run `forced_command`. This also overrides any authorized\_keys `command=` option. The original command is saved in the `SSH_ORIGINAL_COMMAND` environment variable (see below).

The forced command is started using the user's normal shell, the same as occurs for normal commands.

Unix stream forwarding is disabled when a forced command is set, since that may allow a bypass of the forced command. Other SSH features such as TCP forwarding are still allowed by default - it may be desirable to disable those using `-j` or `-k` options when using forced command.

[`-D`](#D) `authorized_keys_dir`

Specify the directory to use for authorized\_keys files. The default is ~/.ssh, paths with a leading ~/ will be home directory expanded.

[`-Q`](#Q) `algo`

Query supported algorithms. Options are kex, sig, cipher, mac, compress

[`-V`](#V)

Print the version

# [FILES](#FILES)

Authorized Keys

~/.ssh/authorized\_keys can be set up to allow remote login with a `Ed25519`, `RSA`, or `ECDSA` key. The authorized\_keys file and its containing ~/.ssh directory must only be writable by the user, otherwise Dropbear will not allow a login using public key authentication.

Each line is of the form

```
[restrictions] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIgAsp... [comment]
```

and can be extracted from a Dropbear private host key with ‘`dropbearkey -y`’. This is the same format as used by OpenSSH, though the restrictions are a subset (keys with unknown restrictions are ignored). Restrictions are comma separated, with double quotes around spaces in arguments. Available restrictions are:

[`no-port-forwarding`](#no-port-forwarding)

Don't allow port forwarding for this connection, including unix streams.

[`no-agent-forwarding`](#no-agent-forwarding)

Don't allow agent forwarding for this connection

[`no-X11-forwarding`](#no-X11-forwarding)

Don't allow X11 forwarding for this connection

[`no-pty`](#no-pty)

Disable PTY allocation. Note that a user can still obtain most of the same functionality with other means even if no-pty is set.

[`restrict`](#restrict)

Applies all the no- restrictions listed above.

[`permitopen=`](#permitopen=)"`host:port`"

Restrict local port forwarding so that connection is allowed only to the specified host and port. Multiple permitopen options separated by commas can be set in authorized\_keys. Wildcard character (‘`*`’) may be used in port specification for matching any port. Hosts must be literal domain names or IP addresses.

[`permitlisten=`](#permitlisten=)"`port`"

Restrict remote port forwarding listeners to the given port. Multiple `permitlisten=`"`port`" options separated by commas can be set in authorized\_keys. Port can be 0 to allow the listen port to be dynamically allocated on the server.

[`command=`](#command=)"`forced_command`"

Disregard the command provided by the user and always run `forced_command`. The `-c` command line option overrides this. See `-c` documentation for behaviour of forced commands.

When using `command=` it is often desirable to also use `restrict` option to avoid other SSH features that may allow additional access.

Host Key Files

Host key files are read at startup from a standard location, by default /etc/dropbear/dropbear\_dss\_host\_key, /etc/dropbear/dropbear\_rsa\_host\_key, /etc/dropbear/dropbear\_ecdsa\_host\_key and /etc/dropbear/dropbear\_ed25519\_host\_key

If the `-r` command line option is specified the default files are not loaded. Host key files are of the form generated by [dropbearkey(1)](/man/os/dropbear/dropbearkey.1). The `-R` option can be used to automatically generate keys in the default location - keys will be generated after startup when the first connection is established. This had the benefit that the system /dev/urandom random number source has a better chance of being securely seeded.

Message Of The Day

By default the file /etc/motd will be printed for any login shell (unless disabled at compile-time). This can also be disabled per-user by creating a file ~/.hushlogin.

# [ENVIRONMENT VARIABLES](#ENVIRONMENT_VARIABLES)

Dropbear sets the standard variables `USER`, `LOGNAME`, `HOME`, `SHELL`, `PATH`, and `TERM`.

The variables below are set for sessions as appropriate.

[`SSH_TTY`](#SSH_TTY)

This is set to the allocated TTY if a PTY was used.

[`SSH_CONNECTION`](#SSH_CONNECTION)

Contains ‘`<remote_ip> <remote_port> <local_ip> <local_port>`’.

[`DISPLAY`](#DISPLAY)

Set X11 forwarding is used.

[`SSH_ORIGINAL_COMMAND`](#SSH_ORIGINAL_COMMAND)

If a `command=` authorized\_keys option was used, the original command is specified in this variable. If a shell was requested this is set to an empty value.

[`SSH_AUTH_SOCK`](#SSH_AUTH_SOCK)

Set to a forwarded ssh-agent connection.

# [NOTES](#NOTES)

Dropbear only supports SSH protocol version 2.

# [SEE ALSO](#SEE_ALSO)

[dbclient(1)](/man/os/dropbear/dbclient.1), [dropbearconvert(1)](/man/os/dropbear/dropbearconvert.1), [dropbearkey(1)](/man/os/dropbear/dropbearkey.1)

[https://matt.ucc.asn.au/dropbear/dropbear.html](https://matt.ucc.asn.au/dropbear/dropbear.html)

# [AUTHORS](#AUTHORS)

Matt Johnston &lt;[matt@ucc.asn.au](mailto:matt@ucc.asn.au)&gt;.  
Gerrit Pape &lt;[pape@smarden.org](mailto:pape@smarden.org)&gt; wrote this manual page.

February 1, 2023 Linux 4.19.0-gvisor

---

Document: dropbear(8) from dropbear 2026.94-r2 (Chainguard OS)
Source: https://github.com/mkj/dropbear