SSH Check – public SSH server testing tool • Hacker News Board

Re: SSH Check – public SSH server testing tool

#81

Post by pmoriarty » Thu, Jun 15, 2017, 5:38 PM UTC

Why is this a service and not a standalone tool that I can use from my own machine?

Do I really want to be giving out the locations of my ssh servers to some random website?

Also, a standalone tool could be used behind corporate firewalls, where this service is useless.

Re: SSH Check – public SSH server testing tool

#82

Post by blacksmith_tb » Thu, Jun 15, 2017, 5:41 PM UTC

pmoriarty wrote: post #81

Why is this a service and not a standalone tool that I can use from my own machine? Do I really want to be giving out the locations of my ssh servers to some random website? Also, a standalone tool could be used behind corporate firewalls, where this service is useless.

Well, yes and no - I can see the argument that it might be nice to test them locally before you expose them to the world (and I suppose you might also have them on a private LAN permanently), but otherwise, they will be tested, by someone, and soon...

Re: SSH Check – public SSH server testing tool

#83

Post by ryandrake » Thu, Jun 15, 2017, 5:46 PM UTC

jokr004 wrote: post #52

Is it just me or am I the only one who is a bit hesitant to submit the public IP/hostname to some random service on the web. I'm not trying to say that the creator of this has any ill intent, but I also don't know that they aren't cataloging addresses of potentially vulnerable ssh daemons. Anyway.. just to reiterate I'm not trying accuse you of anything OP. Very cool utility, nice work!

You're getting a lot of responses along the lines of: "Well if it's on the public internet it's already being indexed and scanned already, so there's no harm submitting a single IP address / hostname." Whoever thinks this is relevant: Please post your personal server's IP address here.

My phone number is 10 digits. It can easily be enumerated. I'm still not posting it in a public forum or submitting it to an unknown web site.

Re: SSH Check – public SSH server testing tool

#84

Post by cmurf » Thu, Jun 15, 2017, 6:00 PM UTC

pmoriarty wrote: post #81

Why is this a service and not a standalone tool that I can use from my own machine? Do I really want to be giving out the locations of my ssh servers to some random website? Also, a standalone tool could be used behind corporate firewalls, where this service is useless.

Yeah I'd like a local tool. Maybe I want to do a test before I put it on the internet.

Re: SSH Check – public SSH server testing tool

#85

Post by jlgaddis » Thu, Jun 15, 2017, 6:00 PM UTC

thinkMOAR wrote: post #63

Call me critical AND paranoid.. but this kind of thing should be a tool people can run locally. Not via some public service, which is probably gonna be blacklisted on plenty of RBLs. However first and above all, SSH SHOULD NEVER LISTEN AND/OR RESPOND to non whitelisted ip addresses. NEVER, no exceptions. Also i think it is more a promotion for the rebex site and software, not so much the ssh scan utility... based on…

Meh, I've got two hosts running SSH that are accessible from anywhere. They run OpenSSH on OpenBSD and are pretty locked down (only specific ciphers, key exchange algorithms, and MACs are permitted), root login is disabled, and password authentication is disabled, among other non-default configuration options. These two hosts allow access (via SSH) to another 40 or so boxes running various flavors and versions of Linux that can't be locked down as much.

I do not worry one bit about those two hosts getting compromised as I took the time to minimize the chances of that happening.

Re: SSH Check – public SSH server testing tool

#86

Post by woodrowbarlow » Thu, Jun 15, 2017, 6:01 PM UTC

matt_wulfeck wrote: post #74

Great tool! Though I think it much safer to control these things client side, that way no matter what you're connecting to you know you're getting safe ciphers.

safer for you, not safer for the server.

Re: SSH Check – public SSH server testing tool

#87

Post by jlgaddis » Thu, Jun 15, 2017, 6:02 PM UTC

rythie wrote: post #17

It'd be useful to know what this is likely to break, AFAIK I sshd doesn't log what ciphers people used, like Apache can do. A caniuse.com for SSH would be useful.

It can log that stuff -- increase "LogLevel" in sshd_config.

Re: SSH Check – public SSH server testing tool

#88

Post by newman314 » Thu, Jun 15, 2017, 6:14 PM UTC

cmurf wrote: post #84

pmoriarty wrote: post #81

Why is this a service and not a standalone tool that I can use from my own machine? Do I really want to be giving out the locations of my ssh servers to some random website? Also, a standalone tool could be used behind corporate firewalls, where this service is useless.

Yeah I'd like a local tool. Maybe I want to do a test before I put it on the internet.

Not quite the same but there's always

  nmap --script ssh2-enum-algos.nse

Re: SSH Check – public SSH server testing tool

#89

Post by atmosx » Thu, Jun 15, 2017, 6:15 PM UTC

Ok, say I am on vacations and my laptop turned brick. The SQL crashed and I need to perform a restore.

What do I do if only SSH keys are allowed? So I keep my key on a USB key? How is that safe to plug in into a computer?

Do I go around with a USB-Linux-distro with my key on it? What if in the border an official decides to keep the USB device I was holding on to.

How do you manage this situation?

Re: SSH Check – public SSH server testing tool

#90

Post by blfr » Thu, Jun 15, 2017, 6:20 PM UTC

atmosx wrote: post #89

Ok, say I am on vacations and my laptop turned brick. The SQL crashed and I need to perform a restore. What do I do if only SSH keys are allowed? So I keep my key on a USB key? How is that safe to plug in into a computer? Do I go around with a USB-Linux-distro with my key on it? What if in the border an official decides to keep the USB device I was holding on to. How do you manage this situation?

You have other people on call to care for critical infrastructure.