Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Check – public SSH server testing tool

sshcheck.com

Post reply on HN
Print view View original

111–120 of 125 posts

Re: SSH Check – public SSH server testing tool

#111

Post by mistaken »

sajagi wrote: post #30
hannob wrote: post #15

There are a couple of strange things here. It lists oakley group 14 as insecure with no justification. That's a 2048 bit diffie hellman group and it should be totally fine. It also lists hmac-sha1 as problematic, although in hmac the weaknesses of sha1 are irrelevant. I'm not sure about the umac 64 bit block size. That should at least have some more info why it's considered problematic. Usually OpenSSH is pretty good…

Hi hannob, I'll re-check the classifications. Pretty sure you're right about the hmac-sha1 being still ok. Wrt oakley 14 and umac64 (and others) I'll try to add more detailed justifications. Thanks for your comment!

The site also seems to flag RSA host keys. Using SHA1 in this case shouldn't be a security issue since the hash is calculated as SHA1(SHA2(x)) and you would need to break SHA2 as well. [1]

[1] - https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

Re: SSH Check – public SSH server testing tool

#112

Post by thinkMOAR »

jlgaddis wrote: post #85
thinkMOAR wrote: post #63

Call me critical AND paranoid.. but this kind of thing should be a tool people can run locally. Not via some public service, which is probably gonna be blacklisted on plenty of RBLs. However first and above all, SSH SHOULD NEVER LISTEN AND/OR RESPOND to non whitelisted ip addresses. NEVER, no exceptions. Also i think it is more a promotion for the rebex site and software, not so much the ssh scan utility... based on…

Meh, I've got two hosts running SSH that are accessible from anywhere. They run OpenSSH on OpenBSD and are pretty locked down (only specific ciphers, key exchange algorithms, and MACs are permitted), root login is disabled, and password authentication is disabled, among other non-default configuration options. These two hosts allow access (via SSH) to another 40 or so boxes running various flavors and versions of Lin…

The fact you think that secures you, worries me, and that you share the almost exact setup you have with the world, just as much. Security is layers, and one layer is not telling the world about your setup.

Re: SSH Check – public SSH server testing tool

#114

Post by sajagi »

sajagi wrote: post #22
sleavey wrote: post #8

Great tool - I found some weaknesses in my SSH server. After fixing them, I wanted to test it again but I can't find a refresh button... EDIT: turns out you need to wait 10 minutes.

i am adding refresh button to my to-do list! :)

I actually decreased the cache expiry to 10 seconds instead, I believe that should be ok for everyone.

Re: SSH Check – public SSH server testing tool

#116

Post by sajagi »

goblin89 wrote: post #115

Ubuntu 16.04 launched from an AMI on AWS EC2 has weak points in its SSH setup out of the box—supporting SHA-1 and 64-bit UMAC.

It's quite probably because of compatibility with the older clients. Unfortunately you can't simply use only the safest algorithms out there because the clients wouldn't be able to connect :/

Re: SSH Check – public SSH server testing tool

#118

Post by dicknuckle »

pmoriarty wrote: post #94
blacksmith_tb wrote: post #82

Earlier quoted context omitted.

Well, yes and no - I can see the argument that it might be nice to test them locally before you expose them to the world (and I suppose you might also have them on a private LAN permanently), but otherwise, they will be tested, by someone, and soon...

But the fewer people "test" it, apart from me, the better. This is akin to putting your email address all over the internet. If you do that, you're going to get lots of spam. If you are more careful about who you give it to, you'll get less. It's clearly a win to keep both email addresses and ssh server addresses as private as possible.

When was the last time you looked at your SSH logs for public machines? Your public IP is just that, public. Anyone can scan it, and it most certainly gets hit by many scanners a day.

Re: SSH Check – public SSH server testing tool

#119

Post by dicknuckle »

blfr wrote: post #90
atmosx wrote: post #89

Ok, say I am on vacations and my laptop turned brick. The SQL crashed and I need to perform a restore. What do I do if only SSH keys are allowed? So I keep my key on a USB key? How is that safe to plug in into a computer? Do I go around with a USB-Linux-distro with my key on it? What if in the border an official decides to keep the USB device I was holding on to. How do you manage this situation?

You have other people on call to care for critical infrastructure.

I know many people keep an encrypted copy in various cloud or email accounts. Then all you would need is the encryption password and internet access to download the application to decrypt.

Re: SSH Check – public SSH server testing tool

#120

Post by jlgaddis »

thinkMOAR wrote: post #112
jlgaddis wrote: post #85

Earlier quoted context omitted.

Meh, I've got two hosts running SSH that are accessible from anywhere. They run OpenSSH on OpenBSD and are pretty locked down (only specific ciphers, key exchange algorithms, and MACs are permitted), root login is disabled, and password authentication is disabled, among other non-default configuration options. These two hosts allow access (via SSH) to another 40 or so boxes running various flavors and versions of Lin…

The fact you think that secures you, worries me, and that you share the almost exact setup you have with the world, just as much. Security is layers, and one layer is not telling the world about your setup.

Security is also not relying on obscurity to keep you safe.
Post reply on HN