diff -Naur dropbear-2012.55-orig/cli-runopts.c dropbear-2012.55/cli-runopts.c
--- dropbear-2012.55-orig/cli-runopts.c	2014-01-13 10:21:20.762118749 +0800
+++ dropbear-2012.55/cli-runopts.c	2012-02-23 21:47:05.000000000 +0800
@@ -287,10 +287,6 @@
 					debug_trace = 1;
 					break;
 #endif
-				case 'o':
-					next = &dummy;
-				case 'x':
-					break;
 				case 'F':
 				case 'e':
 				case 'c':
@@ -302,6 +298,7 @@
 #ifndef ENABLE_CLI_LOCALTCPFWD
 				case 'L':
 #endif
+				case 'o':
 				case 'b':
 					next = &dummy;
 				default:
diff -Naur dropbear-2012.55-orig/dbutil.h dropbear-2012.55/dbutil.h
--- dropbear-2012.55-orig/dbutil.h	2014-01-13 10:21:28.274118742 +0800
+++ dropbear-2012.55/dbutil.h	2012-02-23 21:47:05.000000000 +0800
@@ -93,10 +93,6 @@
 #define DEF_MP_INT(X) mp_int X = {0, 0, 0, NULL}
 
 /* Dropbear assertion */
-#ifndef DROPBEAR_ASSERT_ENABLED
-#define DROPBEAR_ASSERT_ENABLED 0
-#endif
-
-#define dropbear_assert(X) do { if (DROPBEAR_ASSERT_ENABLED && !(X)) { fail_assert(#X, __FILE__, __LINE__); } } while (0)
+#define dropbear_assert(X) do { if (!(X)) { fail_assert(#X, __FILE__, __LINE__); } } while (0)
 
 #endif /* _DBUTIL_H_ */
diff -Naur dropbear-2012.55-orig/dropbear_rsa_host_key.ZyXEL dropbear-2012.55/dropbear_rsa_host_key.ZyXEL
--- dropbear-2012.55-orig/dropbear_rsa_host_key.ZyXEL	1970-01-01 08:00:00.000000000 +0800
+++ dropbear-2012.55/dropbear_rsa_host_key.ZyXEL	2014-01-13 11:00:44.306076814 +0800
@@ -0,0 +1,5 @@
+   ssh-rsa   #   ÕÙ Ã·º:û$30›ˆ`vúW„kLOòÃ2²É’´Èê¬«ÔÞ ßÜ{+áì³Õ†‰b-uƒwàÀú<˜ëxðfzo§«Sq Ó7o[|Y>p.¼-‘ƒð‡Ñ£Ì,ÄÜBåqý	BD¯¹TV®ÆzO­fò`UÌ­{UTês°—<âµ½µå®ÚÊ·Ÿè0.&œîÆ<Ó¦¾lBÜ;4]‘häÉ5nîx\´pÌIªŒ[å"ðýSú¶´`ÿa`Û¿Ê&xí2ëçoQ#è½¿ñ¨iiN‚DQ×õé¾G­LŸPlùZH†±ÙÓÑï‹’ÃC7A™OxùM   tü7÷aØÊ‚0TnšŒ˜\Ÿ§ö:qGh^Ëû½†µsVL¢‹r5¥BÝNÁ÷`K®m›	i"‰2rSÝÉ«Ýü+µ³ùRŽ8—›+kX›‰oc¥[2ä5þ‰7èùEë4RÑD^Ô#Á‰\Ì3ê]K
+|"š+@à,û`{/òVœ	…˜BëÊØTáT|twOæZG(
+"üUß-nuóÔÃ{izXJ·0×h<ß®ÖäÁAK’rè¨Ò0ŒÔN3UgžÏž%gm­R„#\
+2x®QR¸§ºY¸ EZa²Ç({^6Ðµ“.¢qèdsn§£YP=ìgÊ•¸èz#q§    õ9SK½.œ·Êä¿š_SˆG¡ú®Š ¾–¬&örìRêò²Fóûk‚Úcn„¿:E9S~·P&;^¾>b#Ü`pP}¿–;ö¡µHÚïZHe"™%ªÛÁ;uµ"äím")x‰‘Åòkvµ³¼³þmîô¬]÷_ã‹MùÏ    ß?[±a!'p
+*±Ûë´_¤Õÿ‘Ì$ÉÆìLRFé$×»(â!3ëýÝCª ß{™£FYïù;ý€FÀ«@­°hœ+&çÊ&Ú•’ŸaÂˆeJ¹§[…ÝnGÂ•aßM†ÀD»ÆWt&¢¯à&ú°¿Ôðú[Ž¡‡†Ý ¦a 6(5#
\ No newline at end of file
diff -Naur dropbear-2012.55-orig/Makefile.in dropbear-2012.55/Makefile.in
--- dropbear-2012.55-orig/Makefile.in	2014-01-13 10:21:50.634117214 +0800
+++ dropbear-2012.55/Makefile.in	2014-01-13 10:53:36.918082863 +0800
@@ -10,7 +10,8 @@
 # Hopefully that seems intuitive.
 
 ifndef PROGRAMS
-	PROGRAMS=dropbear dbclient dropbearkey dropbearconvert
+#	PROGRAMS=dropbear dbclient dropbearkey dropbearconvert
+	PROGRAMS=dropbear
 endif
 
 LTC=libtomcrypt/libtomcrypt.a
@@ -56,7 +57,7 @@
 		loginrec.h atomicio.h x11fwd.h agentfwd.h tcpfwd.h compat.h \
 		listener.h fake-rfc2553.h
 
-dropbearobjs=$(COMMONOBJS) $(CLISVROBJS) $(SVROBJS)
+dropbearobjs=$(COMMONOBJS) $(CLISVROBJS) $(SVROBJS) @CRYPTLIB@ 
 dbclientobjs=$(COMMONOBJS) $(CLISVROBJS) $(CLIOBJS)
 dropbearkeyobjs=$(COMMONOBJS) $(KEYOBJS)
 dropbearconvertobjs=$(COMMONOBJS) $(CONVERTOBJS)
@@ -77,7 +78,7 @@
 INSTALL=@INSTALL@
 CPPFLAGS=@CPPFLAGS@
 CFLAGS+=-I. -I$(srcdir) $(CPPFLAGS) @CFLAGS@
-LIBS+=@CRYPTLIB@ @LIBS@
+LIBS+=@LIBS@
 LDFLAGS=@LDFLAGS@
 
 EXEEXT=@EXEEXT@
@@ -145,6 +146,9 @@
 	-chown root $(DESTDIR)$(sbindir)/dropbear$(EXEEXT)
 	-chgrp 0 $(DESTDIR)$(sbindir)/dropbear$(EXEEXT)
 
+	$(INSTALL) -d -m 755 $(INSTALL_DIR)/etc/mycert
+	$(INSTALL) dropbear_rsa_host_key.ZyXEL $(INSTALL_DIR)/etc/mycert/ssh.rsa
+
 inst_%: $*
 	$(INSTALL) -d -m 755 $(DESTDIR)$(bindir)
 	$(INSTALL) -m 755 $*$(EXEEXT) $(DESTDIR)$(bindir)
@@ -169,7 +173,7 @@
 # multi-binary compilation.
 MULTIOBJS=
 ifeq ($(MULTI),1)
-	MULTIOBJS=dbmulti.o $(sort $(foreach prog, $(PROGRAMS), $($(prog)objs)))
+	MULTIOBJS=dbmulti.o $(sort $(foreach prog, $(PROGRAMS), $($(prog)objs))) @CRYPTLIB@ 
 	CFLAGS+=$(addprefix -DDBMULTI_, $(PROGRAMS)) -DDROPBEAR_MULTI
 endif
 
diff -Naur dropbear-2012.55-orig/options.h dropbear-2012.55/options.h
--- dropbear-2012.55-orig/options.h	2014-01-13 10:22:19.610117073 +0800
+++ dropbear-2012.55/options.h	2014-01-13 10:38:54.842099304 +0800
@@ -5,11 +5,6 @@
 #ifndef _OPTIONS_H_
 #define _OPTIONS_H_
 
-#if !defined(DROPBEAR_CLIENT) && !defined(DROPBEAR_SERVER)
-#define DROPBEAR_SERVER
-#define DROPBEAR_CLIENT
-#endif
-
 /******************************************************************
  * Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif"
  * parts are to allow for commandline -DDROPBEAR_XXX options etc.
@@ -29,7 +24,7 @@
 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
 #endif
 #ifndef RSA_PRIV_FILENAME
-#define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
+#define RSA_PRIV_FILENAME "/etc/mycert/ssh.rsa"
 #endif
 
 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
@@ -43,7 +38,7 @@
  * Both of these flags can be defined at once, don't compile without at least
  * one of them. */
 #define NON_INETD_MODE
-/*#define INETD_MODE*/
+#define INETD_MODE
 
 /* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is
  * perhaps 20% slower for pubkey operations (it is probably worth experimenting
@@ -54,7 +49,7 @@
 several kB in binary size however will make the symmetrical ciphers and hashes
 slower, perhaps by 50%. Recommended for small systems that aren't doing
 much traffic. */
-#define DROPBEAR_SMALL_CODE
+/*#define DROPBEAR_SMALL_CODE*/
 
 /* Enable X11 Forwarding - server only */
 #define ENABLE_X11FWD
@@ -83,7 +78,7 @@
 
 /* Enable "Netcat mode" option. This will forward standard input/output
  * to a remote TCP-forwarded connection */
-/*#define ENABLE_CLI_NETCAT*/
+#define ENABLE_CLI_NETCAT
 
 /* Encryption - at least one required.
  * Protocol RFC requires 3DES and recommends AES128 for interoperability.
@@ -94,8 +89,8 @@
 #define DROPBEAR_AES256
 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
 /*#define DROPBEAR_BLOWFISH*/
-/*#define DROPBEAR_TWOFISH256
-#define DROPBEAR_TWOFISH128*/
+#define DROPBEAR_TWOFISH256
+#define DROPBEAR_TWOFISH128
 
 /* Enable "Counter Mode" for ciphers. This is more secure than normal
  * CBC mode against certain attacks. This adds around 1kB to binary 
@@ -115,7 +110,7 @@
  * If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
  * which are not the standard form. */
 #define DROPBEAR_SHA1_HMAC
-/*#define DROPBEAR_SHA1_96_HMAC*/
+#define DROPBEAR_SHA1_96_HMAC
 #define DROPBEAR_MD5_HMAC
 
 /* Hostkey/public key algorithms - at least one required, these are used
@@ -149,11 +144,11 @@
 #endif
 
 /* Whether to do reverse DNS lookups. */
-/*#define DO_HOST_LOOKUP*/
+#define DO_HOST_LOOKUP
 
 /* Whether to print the message of the day (MOTD). This doesn't add much code
  * size */
-/*#define DO_MOTD*/
+#define DO_MOTD
 
 /* The MOTD file path */
 #ifndef MOTD_FILENAME
@@ -197,7 +192,7 @@
  * note that it will be provided for all "hidden" client-interactive
  * style prompts - if you want something more sophisticated, use 
  * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
-/*#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"*/
+#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
 
 /* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of
  * a helper program for the ssh client. The helper program should be
@@ -297,7 +292,7 @@
 #define DEFAULT_IDLE_TIMEOUT 0
 
 /* The default path. This will often get replaced by the shell */
-#define DEFAULT_PATH "/bin:/sbin:/usr/bin:/usr/sbin"
+#define DEFAULT_PATH "/usr/bin:/bin"
 
 /* Some other defines (that mostly should be left alone) are defined
  * in sysoptions.h */
diff -Naur dropbear-2012.55-orig/svr-authpubkey.c dropbear-2012.55/svr-authpubkey.c
--- dropbear-2012.55-orig/svr-authpubkey.c	2014-01-13 10:21:01.538118357 +0800
+++ dropbear-2012.55/svr-authpubkey.c	2012-02-23 21:47:06.000000000 +0800
@@ -209,21 +209,17 @@
 		goto out;
 	}
 
-	if (ses.authstate.pw_uid != 0) {
-		/* we don't need to check pw and pw_dir for validity, since
-		 * its been done in checkpubkeyperms. */
-		len = strlen(ses.authstate.pw_dir);
-		/* allocate max required pathname storage,
-		 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
-		filename = m_malloc(len + 22);
-		snprintf(filename, len + 22, "%s/.ssh/authorized_keys", 
-		         ses.authstate.pw_dir);
-
-		/* open the file */
-		authfile = fopen(filename, "r");
-	} else {
-		authfile = fopen("/etc/dropbear/authorized_keys","r");
-	}
+	/* we don't need to check pw and pw_dir for validity, since
+	 * its been done in checkpubkeyperms. */
+	len = strlen(ses.authstate.pw_dir);
+	/* allocate max required pathname storage,
+	 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
+	filename = m_malloc(len + 22);
+	snprintf(filename, len + 22, "%s/.ssh/authorized_keys", 
+				ses.authstate.pw_dir);
+
+	/* open the file */
+	authfile = fopen(filename, "r");
 	if (authfile == NULL) {
 		goto out;
 	}
@@ -376,35 +372,26 @@
 		goto out;
 	}
 
-	if (ses.authstate.pw_uid == 0) {
-		if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
-			goto out;
-		}
-		if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
-			goto out;
-		}
-	} else {
-		/* allocate max required pathname storage,
-		 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
-		filename = m_malloc(len + 22);
-		strncpy(filename, ses.authstate.pw_dir, len+1);
-
-		/* check ~ */
-		if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-			goto out;
-		}
-
-		/* check ~/.ssh */
-		strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
-		if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-			goto out;
-		}
-
-		/* now check ~/.ssh/authorized_keys */
-		strncat(filename, "/authorized_keys", 16);
-		if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-			goto out;
-		}
+	/* allocate max required pathname storage,
+	 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
+	filename = m_malloc(len + 22);
+	strncpy(filename, ses.authstate.pw_dir, len+1);
+
+	/* check ~ */
+	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
+		goto out;
+	}
+
+	/* check ~/.ssh */
+	strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
+	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
+		goto out;
+	}
+
+	/* now check ~/.ssh/authorized_keys */
+	strncat(filename, "/authorized_keys", 16);
+	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
+		goto out;
 	}
 
 	/* file looks ok, return success */
diff -Naur dropbear-2012.55-orig/svr-chansession.c dropbear-2012.55/svr-chansession.c
--- dropbear-2012.55-orig/svr-chansession.c	2014-01-13 10:21:10.234119965 +0800
+++ dropbear-2012.55/svr-chansession.c	2012-02-23 21:47:06.000000000 +0800
@@ -891,12 +891,12 @@
 	/* We can only change uid/gid as root ... */
 	if (getuid() == 0) {
 
-		if ((ses.authstate.pw_gid != 0) && ((setgid(ses.authstate.pw_gid) < 0) ||
+		if ((setgid(ses.authstate.pw_gid) < 0) ||
 			(initgroups(ses.authstate.pw_name, 
-						ses.authstate.pw_gid) < 0))) {
+						ses.authstate.pw_gid) < 0)) {
 			dropbear_exit("Error changing user group");
 		}
-		if ((ses.authstate.pw_uid != 0) && (setuid(ses.authstate.pw_uid) < 0)) {
+		if (setuid(ses.authstate.pw_uid) < 0) {
 			dropbear_exit("Error changing user");
 		}
 	} else {
diff -Naur dropbear-2012.55-orig/svr-runopts.c dropbear-2012.55/svr-runopts.c
--- dropbear-2012.55-orig/svr-runopts.c	2014-01-13 10:22:01.914118433 +0800
+++ dropbear-2012.55/svr-runopts.c	2012-02-23 21:47:06.000000000 +0800
@@ -325,7 +325,7 @@
 		myspec = m_strdup(spec);
 
 		/* search for ':', that separates address and port */
-		svr_opts.ports[svr_opts.portcount] = strrchr(myspec, ':');
+		svr_opts.ports[svr_opts.portcount] = strchr(myspec, ':');
 
 		if (svr_opts.ports[svr_opts.portcount] == NULL) {
 			/* no ':' -> the whole string specifies just a port */
diff -Naur dropbear-2012.55-orig/sysoptions.h dropbear-2012.55/sysoptions.h
--- dropbear-2012.55-orig/sysoptions.h	2012-02-23 21:47:06.000000000 +0800
+++ dropbear-2012.55/sysoptions.h	2014-01-13 10:39:28.162098432 +0800
@@ -25,10 +25,10 @@
 
 /* Minimum key sizes for DSS and RSA */
 #ifndef MIN_DSS_KEYLEN
-#define MIN_DSS_KEYLEN 512
+#define MIN_DSS_KEYLEN 1024
 #endif
 #ifndef MIN_RSA_KEYLEN
-#define MIN_RSA_KEYLEN 512
+#define MIN_RSA_KEYLEN 2048
 #endif
 
 #define MAX_BANNER_SIZE 2000 /* this is 25*80 chars, any more is foolish */