OpenWrt Forum Archive

Topic: Sysupgrade always removes openssh-server and reverts to dropbear

The content of this topic has been archived on 17 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

As the title says, sysupgrade always removes openssh-server and reverts to dropbear. This is a PITA to restore every time system is upgraded to new firmware, especially if you have several boxes configured to use openssh that you maintain.

I know it is possible to preserve sshd_config and authorized_keys, but how to preserve the package and service startup status?

It would be really nice if it was possible to tell sysupgrade not to touch SSH server so it doesn't revert back to that stupid default dropbear.

I believe it would be possible as long as OpenWRT changes the way SSH server is managed. For example, you could add an option to select SSH server in Luci and then let sysupgrade know which one is selected so it doesn't revert to default. After all, it's not like there are 1,000 SSH server options out there, most people use either dropbear or openssh where dropbear doesn't cut it.

Easiest solution is to build own firmware image, where openssh is included and options set according to your needs.

sysupgrade does not install any additional packages, just the plain firmware.

hnyman wrote:

Easiest solution is to build own firmware image, where openssh is included and options set according to your needs.

sysupgrade does not install any additional packages, just the plain firmware.

Well that is certainly a valid option, but it would require additional work and testing on my side each time new firmware is released.

I understand not putting OpenSSH in by default for devices which have limited resources (space, CPU, RAM), but why not include it for things more powerfull devices?

What I would like to understand is whether there are any other reasons for sticking with dropbear?

Probably because it's a lot easier to maintain one default package set. This is a distribution made specifically for embedded devices.

To put it the other way around, why should OpenSSH be default, even if the device is powerful enough? What features are you using that "stupid dropbear" doesn't offer?

BTW, OpenWrt is not similar to a rolling distribution. Sysupgrade does not preserve packages for a reason.

levicki wrote:

Well that is certainly a valid option, but it would require additional work and testing on my side each time new firmware is released.

Try it! The image builder (image generator) is very easy to use. I used it yesterday for updating a single router. When you get a little comfortable with it, I think you will want to use it, especially if you have several routers with similar configuration.

The discussion might have continued from here.