Earlier quoted context omitted.
Try any DNS name which only has a AAAA record, e.g. ipv6.google.com, which results in “An unexpected error occurred.”
Alright, thanks!
As secure explained.
SSH Check – public SSH server testing tool
101–110 of 125 posts
Re: SSH Check – public SSH server testing tool
#102Earlier quoted context omitted.
> because people will find it regardless In my experience, if you have an SSH port accessible from the internet, it has been probed today by a few Chinese/Russian IPs. Unless my raspberry pi home server is somehow a high value intelligence target...
In my experience a SSH service on a random, non-standard port gets surprisingly few probes. I look after several machines and I see less than one attempt per year (versus hundreds per day for port 22). I have yet to see somebody probe a SSH that listens on IPv6-only.
You might want to consider using port knocking[1] to make your ssh server even less susceptible to attack.
Re: SSH Check – public SSH server testing tool
#103Is it just me or am I the only one who is a bit hesitant to submit the public IP/hostname to some random service on the web. I'm not trying to say that the creator of this has any ill intent, but I also don't know that they aren't cataloging addresses of potentially vulnerable ssh daemons. Anyway.. just to reiterate I'm not trying accuse you of anything OP. Very cool utility, nice work!
You're getting a lot of responses along the lines of: "Well if it's on the public internet it's already being indexed and scanned already, so there's no harm submitting a single IP address / hostname." Whoever thinks this is relevant: Please post your personal server's IP address here. My phone number is 10 digits. It can easily be enumerated. I'm still not posting it in a public forum or submitting it to an unknown…
There's a significant difference - posting this information here is saying that x.y.z.w is my server, and that has a privacy concern, just as saying that my (or your) phone number is 1234567890.
Anonymously submitting that x.y.z.w is a server running ssh, on the other hand, doesn't provide anything beyond what's already publicly known.
Also, your phone number is not easily enumerated. Scanning even a small range of phone numbers (i.e. attempting a connection to see if they're valid) takes significant time and effort. Finding all open standard ssh ports on the whole internet, on the other hand, can be done in minutes with a good enough connection.
Re: SSH Check – public SSH server testing tool
#104Is it just me or am I the only one who is a bit hesitant to submit the public IP/hostname to some random service on the web. I'm not trying to say that the creator of this has any ill intent, but I also don't know that they aren't cataloging addresses of potentially vulnerable ssh daemons. Anyway.. just to reiterate I'm not trying accuse you of anything OP. Very cool utility, nice work!
That's not something you need to worry about - if you have a vulnerable ssh daemon with a public IPv4 address, then it's already been indexed and you submitting / not submitting it won't change anything. Scanning all standard ports of all addresses of all IPv4 internet is computationally feasible and is done by many parties. For example, https://www.shodan.io/ is one place that has done so and allows public searching…
Not if it's running on a non-standard port though
Re: SSH Check – public SSH server testing tool
#105Why is this a service and not a standalone tool that I can use from my own machine? Do I really want to be giving out the locations of my ssh servers to some random website? Also, a standalone tool could be used behind corporate firewalls, where this service is useless.
I tried entering my personal server's hostname and port number but it timed out trying to connect. Then I remembered that I configured my server's firewall to only allows SSH connections from my home ISP or work IP address.
I too would prefer to use a standalone tool that I could use for testing my SSH configuration without having to temporarily disable those firewall rules.
Re: SSH Check – public SSH server testing tool
#106Earlier quoted context omitted.
Well, yes and no - I can see the argument that it might be nice to test them locally before you expose them to the world (and I suppose you might also have them on a private LAN permanently), but otherwise, they will be tested, by someone, and soon...
But the fewer people "test" it, apart from me, the better. This is akin to putting your email address all over the internet. If you do that, you're going to get lots of spam. If you are more careful about who you give it to, you'll get less. It's clearly a win to keep both email addresses and ssh server addresses as private as possible.
The difference between IP and email adresses is that one is trivially enumerated, the other is not.
Any internet-facing server that responds on port 22 will get several (up to hundreds) of failed login attempts per day. Just install something like fail2ban and watch your logs.
Re: SSH Check – public SSH server testing tool
#107Earlier quoted context omitted.
In my experience a SSH service on a random, non-standard port gets surprisingly few probes. I look after several machines and I see less than one attempt per year (versus hundreds per day for port 22). I have yet to see somebody probe a SSH that listens on IPv6-only.
You might want to consider using port knocking[1] to make your ssh server even less susceptible to attack. [1] - https://en.wikipedia.org/wiki/Port_knocking
No, the best solution is to only allow login by SSH keys. No passwords => brute-forcing is impossible. So your threat model for someone gaining access no longer includes someone using weak passwords.
Re: SSH Check – public SSH server testing tool
#108Earlier quoted context omitted.
That's not something you need to worry about - if you have a vulnerable ssh daemon with a public IPv4 address, then it's already been indexed and you submitting / not submitting it won't change anything. Scanning all standard ports of all addresses of all IPv4 internet is computationally feasible and is done by many parties. For example, https://www.shodan.io/ is one place that has done so and allows public searching…
Not if it's running on a non-standard port though
Yes, non-standard ports transfer it to the domain of either somewhat targeted scan or serious effort - scanning all ports of all IPv4 requires many machines and/or many weeks, so that's not available to everyone. However, I'd still expect multiple organizations to keep an up-to-date scan of all public facing ports worldwide; it's impractical to do it for fun, but if have a need and some budget, it seems doable.
Re: SSH Check – public SSH server testing tool
#109Earlier quoted context omitted.
You might want to consider using port knocking[1] to make your ssh server even less susceptible to attack. [1] - https://en.wikipedia.org/wiki/Port_knocking
No, the best solution is to only allow login by SSH keys. No passwords => brute-forcing is impossible. So your threat model for someone gaining access no longer includes someone using weak passwords.
If your ssh port is wide open and there's a remotely exploitable vulnerability, then using keys may not save you.
But there's no reason you couldn't use both keys and port knocking at the same time.
Re: SSH Check – public SSH server testing tool
#110Is it just me or am I the only one who is a bit hesitant to submit the public IP/hostname to some random service on the web. I'm not trying to say that the creator of this has any ill intent, but I also don't know that they aren't cataloging addresses of potentially vulnerable ssh daemons. Anyway.. just to reiterate I'm not trying accuse you of anything OP. Very cool utility, nice work!
You're getting a lot of responses along the lines of: "Well if it's on the public internet it's already being indexed and scanned already, so there's no harm submitting a single IP address / hostname." Whoever thinks this is relevant: Please post your personal server's IP address here. My phone number is 10 digits. It can easily be enumerated. I'm still not posting it in a public forum or submitting it to an unknown…
Do you get a few random phone calls every hour from someone you don't know?
Your ssh port is.