No IPv6 support.
hi snvzz, which server did you try it on? i tried few ipv6 servers and it was ok.
SSH Check – public SSH server testing tool
21–30 of 125 posts
Re: SSH Check – public SSH server testing tool
#22Great tool - I found some weaknesses in my SSH server. After fixing them, I wanted to test it again but I can't find a refresh button... EDIT: turns out you need to wait 10 minutes.
i am adding refresh button to my to-do list! :)
Re: SSH Check – public SSH server testing tool
#23There are a couple of strange things here. It lists oakley group 14 as insecure with no justification. That's a 2048 bit diffie hellman group and it should be totally fine. It also lists hmac-sha1 as problematic, although in hmac the weaknesses of sha1 are irrelevant. I'm not sure about the umac 64 bit block size. That should at least have some more info why it's considered problematic. Usually OpenSSH is pretty good…
It shows this as justification right now:
Oakley Group 14 is no longer considered secure enough. SHA-1 is no longer considered secure enough (see shattered.io).
Re: SSH Check – public SSH server testing tool
#24OK, I am not embarrassed to ask...
If I see some "weak" or "insecure" tags, what can I do about it? I have no idea how to disable MAC, key-exchange, and encryption algorithms used by the server I control. I had thought that just using SSH was "enough"
More importantly, if I do disable the insecure stuff, what will it break ?
Re: SSH Check – public SSH server testing tool
#25Re: SSH Check – public SSH server testing tool
#26OK, I am not embarrassed to ask... If I see some "weak" or "insecure" tags, what can I do about it? I have no idea how to disable MAC, key-exchange, and encryption algorithms used by the server I control. I had thought that just using SSH was "enough" More importantly, if I do disable the insecure stuff, what will it break ?
This article is very detailed and includes examples of setting sshd to only use more secure options: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
There was also a lot of HN discussion about it: https://news.ycombinator.com/item?id=8843994
Re: SSH Check – public SSH server testing tool
#27Kind of useless. I've checked, change settings and can't check again. I'm getting results from some cache.
Re: SSH Check – public SSH server testing tool
#28Kind of useless. I've checked, change settings and can't check again. I'm getting results from some cache.
you have to wait 10 minutes ... I am adding a refresh button as we speak.
Re: SSH Check – public SSH server testing tool
#29hope someone makes a local-executable version...
There already is: https://github.com/evict/SSHScan
and returns almost the same details , there is also a nmap script https://nmap.org/nsedoc/scripts/ssh2-enum-algos.html
I've always found these kind of webapps attractive in a way ... the fact that it may be doing a os.popen("nmap -vv bla bla bla") makes me uncomfortable ,
Re: SSH Check – public SSH server testing tool
#30There are a couple of strange things here. It lists oakley group 14 as insecure with no justification. That's a 2048 bit diffie hellman group and it should be totally fine. It also lists hmac-sha1 as problematic, although in hmac the weaknesses of sha1 are irrelevant. I'm not sure about the umac 64 bit block size. That should at least have some more info why it's considered problematic. Usually OpenSSH is pretty good…
Hi hannob, I'll re-check the classifications. Pretty sure you're right about the hmac-sha1 being still ok. Wrt oakley 14 and umac64 (and others) I'll try to add more detailed justifications. Thanks for your comment!