Should this have "Show HN:" in the title? The author of the site appears to be the OP.
SSH Check – public SSH server testing tool
31–40 of 125 posts
Re: SSH Check – public SSH server testing tool
#32There are a couple of strange things here. It lists oakley group 14 as insecure with no justification. That's a 2048 bit diffie hellman group and it should be totally fine. It also lists hmac-sha1 as problematic, although in hmac the weaknesses of sha1 are irrelevant. I'm not sure about the umac 64 bit block size. That should at least have some more info why it's considered problematic. Usually OpenSSH is pretty good…
It shows this as justification right now: Oakley Group 14 is no longer considered secure enough. SHA-1 is no longer considered secure enough (see shattered.io).
Here is my problem with this statement: SHA-1 can be used in different configurations for different applications. Some are secure, some are not.
People making these blanket statement very clearly demonstrate that they don't understand security and cryptography. Do you really want to use a security tool written by such people?
Re: SSH Check – public SSH server testing tool
#33Is there a good reason to open up access to your ssh port for some service by a novelty account which could easily collect information on what version ssl sub-protocols you do and do not support?
Consider me paranoid but I don't like services like this unless they come from reputable sources and even then I'd much rather run something local.
Remember to close your port in your firewall after running the test.
Re: SSH Check – public SSH server testing tool
#34Is there a good reason to open up access to your ssh port for some service by a novelty account which could easily collect information on what version ssl sub-protocols you do and do not support? Consider me paranoid but I don't like services like this unless they come from reputable sources and even then I'd much rather run something local. Remember to close your port in your firewall after running the test.
I think it's more the other way round. You already have a public SSH server for whatever reason (e.g. hosting, tunelling, ...) and you might use this tool to check its capabilities.
The reputability of such service or even existence thereof does not have anything to do with how much your server is or is not secured.
Re: SSH Check – public SSH server testing tool
#35Is this based on ssh-audit? https://github.com/arthepsy/ssh-audit
Re: SSH Check – public SSH server testing tool
#36I followed the Mozilla SSH guidelines[0] modern configuration, and turned out pretty good on this tool.
Re: SSH Check – public SSH server testing tool
#37It would be super-useful if it could give you something actionable for each issue if finds.
Re: SSH Check – public SSH server testing tool
#38Re: SSH Check – public SSH server testing tool
#39Is there a good reason to open up access to your ssh port for some service by a novelty account which could easily collect information on what version ssl sub-protocols you do and do not support? Consider me paranoid but I don't like services like this unless they come from reputable sources and even then I'd much rather run something local. Remember to close your port in your firewall after running the test.
I'm not sure I get you, I find this service most useful for public-facing SSH services (where the risk of attack in the greatest). I wouldn't bother forwarding my laptop's port 22 just to test it, that's for sure.
If an attacker wants to gather a list of vulnerable SSH servers in the wild they just have to map a bunch of random addresses (and that seems to be extremely common judging by the number of failed auths on my public server). Although it could be useful if you wanted to get a list of ssh servers not running on port 22.
Re: SSH Check – public SSH server testing tool
#40After updating my SSH config, the tool won't let me re-check, it just gives me the previous results.