kindle-ssh-guide

KO | EN

gitlite — search

#gpt #mcp #csharp #macos #claude-code #golang #git #graphql #go #proxy

kindle-ssh-guide

(★ 9)

The missing guide: get a working outbound SSH client on a jailbroken Kindle over Tailscale, no OpenSSH needed

File Explorer

ZIP Download

- kterm.sh.diff
- build-dbclient-musl.sh
- sshc
.gitignore
LICENSE
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

A complete, from-scratch guide to getting a real, working `ssh` prompt **on**
a jailbroken Kindle — not just SSH access *into* it, which several guides
already cover. As far as I could find, nobody has published a full working
path to *outbound* SSH from the device itself, over Tailscale, without
installing the full OpenSSH client. This is that guide.

End result: open a terminal app on your Kindle's e-ink screen, type
`sshc youruser@your-server`, and get a real shell on any machine on your
Tailscale network.

## Why this doesn't just work out of the box

Two existing projects get you 90% of the way there:

- [tailscale_kual](https://github.com/jonaolden/tailscale_kual) puts your
  Kindle on your tailnet and makes it reachable *from* other devices.
- [kterm](https://github.com/bfabiszewski/kterm) gives you an actual
  terminal emulator on the Kindle's screen, with an on-screen keyboard.

Put them together and you'd expect to just type `ssh user@host`. You can't —
the Kindle ships with no SSH client at all, and building/installing one
yourself hits two separate walls:

**1. Static glibc binaries crash on this kernel.**
Cross-compiling `dbclient` (Dropbear's SSH client) statically with a normal
`gcc-arm-linux-gnueabihf` toolchain produces a binary that aborts
immediately on the Kindle:
```
dbclient: dl-call-libc-early-init.c:37: _dl_call_libc_early_init:
Assertion `sym != NULL' failed.
Aborted
```
This happens with plain `-static` and with `-static -no-pie` alike. It comes
from glibc >= 2.34's ld.so/libc.so merge, which wires
`_dl_call_libc_early_init` into the standard startup path even for non-PIE
static executables — and it doesn't get along with the Kindle's ancient
lab126 4.9 kernel.

**2. Userspace mode has no outbound route for apps.**
`tailscale_kual`'s Standard (Userspace) mode makes tailscaled itself
reachable, but it adds no TUN interface — apps on the Kindle (including a
freshly built `dbclient`) have no kernel route to the tailnet at all. Kernel
TUN mode isn't an option either, because most Kindles don't ship `tun.ko`.
That leaves Proxy mode (SOCKS5), which the
[official Tailscale writeup for jailbroken Kindles](https://tailscale.com/blog/jailbroken-kindle-proxy-tun-modes)
covers — but Dropbear's `dbclient` can't speak SOCKS, which is why guides
for similar embedded devices (e.g. the
[reMarkable tablet](https://remarkable.guide/tech/tailscale.html)) tell you
to install the full OpenSSH client instead.

This guide solves both without needing OpenSSH at all:

1. Cross-compile `dbclient`/`dropbearkey` with a **musl** toolchain instead
   of glibc. Static musl binaries don't have glibc's early-init machinery,
   so they just run.
2. Instead of a SOCKS proxy, pipe `dbclient` through tailscaled's own
   `tailscale nc` via `-J` (Dropbear's ProxyCommand equivalent). tailscaled
   can dial out over its own userspace netstack regardless of what mode
   it's in — `tailscale nc` just exposes that as a subprocess, so no kernel
   route or TUN device is needed.

Tested on a Kindle running kernel `4.9.77-lab126`, Kindle firmware 5.17.1,
Tailscale client 1.98.9, Dropbear 2025.89.

## Prerequisites

- A jailbroken Kindle with [KUAL](https://kindlemodding.org/jailbreaking/post-jailbreak/installing-kual-mrpi/) installed.
- A machine to cross-compile on (any Linux x86_64 box; a Docker container
  works fine and is what the build script assumes nothing beyond).
- A Tailscale account.

## Step 1 — Install tailscale_kual

Follow [tailscale_kual](https://github.com/jonaolden/tailscale_kual)'s own
instructions: drop the `extensions/tailscale` folder onto `/mnt/us/extensions/`,
put an auth key in `extensions/tailscale/config/auth_key.txt`, open KUAL and
run **Start Tailscale** (Standard/Userspace mode — this guide is built
around that mode, since it's the one that works on Kindles without
`tun.ko`).

Verify it's up from another machine on your tailnet:
```sh
tailscale status | grep kindle
```

## Step 2 — Install kterm

Download the `-armhf` build (firmware > 5.16.3 needs it) from
[kterm's releases](https://github.com/bfabiszewski/kterm/releases), unzip it,
and drop the `kterm` folder into `/mnt/us/extensions/`. It'll show up in the
KUAL menu.

## Step 3 — Build a static dbclient with musl

On your build machine:
```sh
git clone https://github.com/Mounstroya/kindle-ssh-guide
cd kindle-ssh-guide
./scripts/build-dbclient-musl.sh
```
This downloads a [musl.cc](https://musl.cc) ARM toolchain and Dropbear's
source, and cross-compiles `dbclient` + `dropbearkey` as static, non-PIE
ARM binaries. Output lands in `./out/`.

(The script also flips off `DROPBEAR_SVR_PASSWORD_AUTH` — a server-only
option that otherwise pulls in `crypt()` and breaks the static link.
`dbclient` never uses it.)

Copy both binaries to the Kindle, into the same folder tailscale_kual's
binaries live in:
```sh
scp out/dbclient out/dropbearkey root@<kindle-tailscale-ip>:/mnt/us/extensions/tailscale/bin/
```

## Step 4 — Generate a key and authorize it

Dropbear's `dbclient -i` only reads Dropbear's own binary key format — **not**
the OpenSSH PEM format `ssh-keygen` produces. Trying to use an OpenSSH key
fails with a cryptic `dbclient: Exited: String too long`. Generate the key
with `dropbearkey` instead, directly on the Kindle:

```sh
chmod 755 /mnt/us/extensions/tailscale/bin/dbclient /mnt/us/extensions/tailscale/bin/dropbearkey

/mnt/us/extensions/tailscale/bin/dropbearkey -t ed25519 \
    -f /mnt/us/extensions/tailscale/bin/kindle_native_key
```
Copy the printed `ssh-ed25519 AAAA...` line into `~/.ssh/authorized_keys` on
the machine you want to SSH into.

## Step 5 — Install the wrapper

```sh
cat > /mnt/us/extensions/tailscale/bin/sshc < scripts/sshc
chmod 755 /mnt/us/extensions/tailscale/bin/sshc
```

> **Don't name this file `ssh`.** tailscale_kual already ships a
> *directory* named `ssh/` under `bin/`, used to store the embedded
> Tailscale SSH server's host keys. A file named `ssh` silently lands
> inside that directory (via `scp`'s destination-is-a-directory behavior)
> instead of being created where you expect — it'll look like the copy
> succeeded and then you'll get `Permission denied` running it. `sshc`
> sidesteps this entirely.

`sshc` is a small wrapper that runs:
```sh
dbclient -y -i kindle_native_key -J "tailscale nc $HOST 22" "$TARGET" "$@"
```
i.e. it tunnels the SSH connection through `tailscale nc`, so it works even
though the Kindle has no kernel route to the tailnet.

## Step 6 — Put it on your PATH inside kterm

Apply the one-line patch in `patches/kterm.sh.diff` to
`/mnt/us/extensions/kterm/bin/kterm.sh` (or just add the line by hand,
right before the line that launches the `kterm` binary):
```sh
export PATH=/mnt/us/extensions/tailscale/bin:$PATH
```

## Step 7 — Use it

Open KUAL → **kterm** on the Kindle, then:
```sh
sshc youruser@100.x.y.z
```
That's it — a real shell, on your e-ink screen, over Tailscale.

## Notes / troubleshooting

- Target resolution goes through `tailscale nc`, so it needs to be a
  tailnet IP or MagicDNS name reachable from the Kindle's tailnet.
- `sshc` hardcodes port 22. Edit the script if your target uses a different
  port.
- If `dbclient -h` itself crashes with an `_dl_call_libc_early_init`
  assertion, you built with glibc, not musl — re-check step 3.
- If auth fails with `String too long`, you generated the key with
  `ssh-keygen` instead of `dropbearkey` — see step 4.

## Credits

Built on top of, not a replacement for:
- [tailscale_kual](https://github.com/jonaolden/tailscale_kual) — Tailscale on jailbroken Kindles
- [kterm](https://github.com/bfabiszewski/kterm) — terminal emulator for Kindle
- [Dropbear SSH](https://matt.ucc.asn.au/dropbear/dropbear.html) by Matt Johnston
- [musl.cc](https://musl.cc) cross toolchains

---

## ☕ Was it useful?

If this project saved you some time, you can buy me a coffee:

[![Buy Me A Coffee](https://img.shields.io/badge/Buy%20Me%20A%20Coffee-mounstroya-FFDD00?style=for-the-badge&logo=buy-me-a-coffee&logoColor=black)](https://www.buymeacoffee.com/mounstroya)

---

## License

MIT — see [LICENSE](LICENSE). Dropbear itself is separately licensed (MIT-style); see its own source for details.

kindle-ssh-guide

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README