use dropbear instead of openssh

Dockerfile

@@ -35,13 +35,11 @@ ENV HOSTNAME=
 
 RUN echo 'deb http://deb.debian.org/debian bookworm-backports main' >> /etc/apt/sources.list
 RUN apt-get update && apt-get install -y \
-    supervisor curl jq jc borgbackup/bookworm-backports openssh-server rsyslog && \
+    supervisor curl jq jc borgbackup/bookworm-backports dropbear rsyslog && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
 RUN groupadd -g ${GID} borgwarehouse && useradd -m -u ${UID} -g ${GID} borgwarehouse
 
-RUN cp /etc/ssh/moduli /home/borgwarehouse/
-
 WORKDIR /home/borgwarehouse/app
 
 COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/docker-bw-init.sh /app/LICENSE ./
@@ -51,7 +49,9 @@ COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/public ./public
 COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/.next/static ./.next/static
 COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/supervisord.conf ./
 COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/rsyslog.conf /etc/rsyslog.conf
-COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/sshd_config ./
+COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/start_dropbear.sh ./
+
+RUN chmod +x ./start_dropbear.sh
 
 USER borgwarehouse
 

docker/docker-bw-init.sh

@@ -14,14 +14,11 @@ print_red() {
 }
 
 init_ssh_server() {
-  if [ -z "$(ls -A /etc/ssh)" ]; then
-    print_green "/etc/ssh is empty, generating SSH host keys..."
-    ssh-keygen -A
-    cp /home/borgwarehouse/moduli /etc/ssh/
-  fi
-  if [ ! -f "/etc/ssh/sshd_config" ]; then
-    print_green "sshd_config not found in your volume, copying the default one..."
-    cp /home/borgwarehouse/app/sshd_config /etc/ssh/
+  if [ -z "$(ls -A $SSH_DIR)" ]; then
+    print_green "$SSH_DIR is empty, generating SSH host keys..."
+    dropbearkey -t rsa -f $SSH_DIR/ssh_host_rsa_key
+    dropbearkey -t ed25519 -f $SSH_DIR/ssh_host_ed25519_key
+    dropbearkey -t ecdsa -f  $SSH_DIR/ssh_host_ecdsa_key
   fi
 }
 
@@ -53,9 +50,9 @@ check_repos_directory() {
 
 get_SSH_fingerprints() {
   print_green "Getting SSH fingerprints..."
-  RSA_FINGERPRINT=$(ssh-keygen -lf /etc/ssh/ssh_host_rsa_key | awk '{print $2}')
-  ED25519_FINGERPRINT=$(ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key | awk '{print $2}')
-  ECDSA_FINGERPRINT=$(ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key | awk '{print $2}')
+  RSA_FINGERPRINT=$(dropbearkey -y -f $SSH_DIR/ssh_host_rsa_key | awk 'END{print $2}')
+  ED25519_FINGERPRINT=$(dropbearkey -y -f $SSH_DIR/ssh_host_ed25519_key | awk 'END{print $2}')
+  ECDSA_FINGERPRINT=$(dropbearkey -y -f $SSH_DIR/ssh_host_ecdsa_key | awk 'END{print $2}')
   export SSH_SERVER_FINGERPRINT_RSA="$RSA_FINGERPRINT"
   export SSH_SERVER_FINGERPRINT_ED25519="$ED25519_FINGERPRINT"
   export SSH_SERVER_FINGERPRINT_ECDSA="$ECDSA_FINGERPRINT"
@@ -76,7 +73,6 @@ check_env() {
 }
 
 check_env
-init_ssh_server
 check_ssh_directory
 create_authorized_keys_file
 check_repos_directory

docker/rsyslog.conf

@@ -19,11 +19,11 @@ input(type="imfile"
       ruleset="bwLogs")
 
 input(type="imfile"
-      File="/home/borgwarehouse/tmp/sshd.log"
-      Tag="sshd"
+      File="/home/borgwarehouse/tmp/dropbear.log"
+      Tag="dropbear"
       Severity="info"
       Facility="local7"
-      ruleset="sshdLogs")
+      ruleset="dropbearLogs")
 
 $template myFormat,"%timegenerated:::date-rfc3339% %syslogtag% %msg%\n"
 
@@ -33,8 +33,8 @@ ruleset(name="bwLogs") {
            Template="myFormat")
 }
 
-ruleset(name="sshdLogs") {
+ruleset(name="dropbearLogs") {
     action(type="omfile"
-           File="/home/borgwarehouse/logs/sshd.log"
+           File="/home/borgwarehouse/logs/dropbear.log"
            Template="myFormat")
 }

docker/start_dropbear.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+dropbear -p 0.0.0.0:22 \
+         -P /home/borgwarehouse/tmp/sshd.pid \
+         -r /home/borgwarehouse/.ssh/ssh_host_ecdsa_key \
+         -r /home/borgwarehouse/.ssh/ssh_host_ed25519_key \
+         -r /home/borgwarehouse/.ssh/ssh_host_rsa_key \
+         -s \
+         -w \
+         -m

docker/supervisord.conf

@@ -6,9 +6,9 @@ pidfile=/home/borgwarehouse/tmp/supervisord.pid
 logfile_maxbytes=10MB
 logfile_backups=5
 
-[program:sshd]
-command=/usr/sbin/sshd -D -e -f /etc/ssh/sshd_config
-stdout_logfile=/home/borgwarehouse/tmp/sshd.log
+[program:dropbear]
+command=sh /home/borgwarehouse/app/start_dropbear.sh
+stdout_logfile=/home/borgwarehouse/tmp/dropbear.log
 stdout_logfile_maxbytes=10MB
 stdout_logfile_backups=5
 redirect_stderr=true