Is there a similar tool that tests HTTPS enabled web servers on their choice of ciphers etc?
https://observatory.mozilla.org/ is a great all-in-one tool that does SSL, headers, and a bunch of other stuff - calls out to ssllabs among others.
SSH Check – public SSH server testing tool
11–20 of 125 posts
Re: SSH Check – public SSH server testing tool
#12It appear to have problems with newer chiphers.
sshd[28670]: fatal: Unable to negotiate with 40.112.150.31 port 47286: no matching cipher found. Their offer: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,3des-cbc,twofish256-ctr,twofish192-ctr,twofish128-ctr,twofish256-cbc,twofish192-cbc,twofish128-cbc,twofish-cbc [preauth]
Re: SSH Check – public SSH server testing tool
#13Is there a similar tool that tests HTTPS enabled web servers on their choice of ciphers etc?
https://www.ssllabs.com/ is just that.
Or https://testssl.sh/ if you don't want to rely on a third-party.
Re: SSH Check – public SSH server testing tool
#14Can you share what went into building this?
Re: SSH Check – public SSH server testing tool
#15There are a couple of strange things here.
It lists oakley group 14 as insecure with no justification. That's a 2048 bit diffie hellman group and it should be totally fine.
It also lists hmac-sha1 as problematic, although in hmac the weaknesses of sha1 are irrelevant.
I'm not sure about the umac 64 bit block size. That should at least have some more info why it's considered problematic.
Usually OpenSSH is pretty good at deprecating problematic algorithm choices, so I tend to stick with upstream defaults.
Re: SSH Check – public SSH server testing tool
#16Great tool - I found some weaknesses in my SSH server. After fixing them, I wanted to test it again but I can't find a refresh button... EDIT: turns out you need to wait 10 minutes.
Yeah, same here :/
Ah, thanks, just saw your edit.
Re: SSH Check – public SSH server testing tool
#17It'd be useful to know what this is likely to break, AFAIK I sshd doesn't log what ciphers people used, like Apache can do. A caniuse.com for SSH would be useful.
Re: SSH Check – public SSH server testing tool
#18Is there a similar tool that tests HTTPS enabled web servers on their choice of ciphers etc?
https://sslping.com even monitors your configuration every day for free
Re: SSH Check – public SSH server testing tool
#19hope someone makes a local-executable version...
There already is: https://github.com/evict/SSHScan
Re: SSH Check – public SSH server testing tool
#20Is there a similar tool that tests HTTPS enabled web servers on their choice of ciphers etc?
I've actually been building a tool that does just this during the current YC Startup School program.
You can get on the launch list here: https://watchdog443.com
My main focus is ongoing alerting of changes to HTTPS configs rather than just a one off check. So you can be confident that everything is up to your spec or know as soon as something isn't.
Because we'll know your setup we can also alert you to things you specifically should be aware of - for instance a browser policy change that would affect user experience due to your certificates not meeting the browser policy etc.
Feel free to mail me if you'd like more info! (email in profile.)
(PS. YC Startup School's virtual demo day is tomorrow if you're interested! All the startups that completed the course are posting a short demo video.)