91–100 of 125 posts
On one hand, nice way to collect a database of SSH servers without triggering alarms. On the other, people using this tool are more likely to take steps to secure their servers.
https://www.shodan.io/search?query=OpenSSH_5.2+country%3A%22...
There's a decent chance your SSH server is already in this database and many others.
Is it just me or am I the only one who is a bit hesitant to submit the public IP/hostname to some random service on the web. I'm not trying to say that the creator of this has any ill intent, but I also don't know that they aren't cataloging addresses of potentially vulnerable ssh daemons. Anyway.. just to reiterate I'm not trying accuse you of anything OP. Very cool utility, nice work!
You're getting a lot of responses along the lines of: "Well if it's on the public internet it's already being indexed and scanned already, so there's no harm submitting a single IP address / hostname." Whoever thinks this is relevant: Please post your personal server's IP address here. My phone number is 10 digits. It can easily be enumerated. I'm still not posting it in a public forum or submitting it to an unknown…
I still get a couple hundred failed login attempts every day. Reasonably strong passwords and fail2ban mean that it's nbd.
Also, my phone number is on my website (it's 320 584 9293) and most of the spam calls I get are through whois, not the fact that there's a tel: URL out there pointing at it.
Ok, say I am on vacations and my laptop turned brick. The SQL crashed and I need to perform a restore. What do I do if only SSH keys are allowed? So I keep my key on a USB key? How is that safe to plug in into a computer? Do I go around with a USB-Linux-distro with my key on it? What if in the border an official decides to keep the USB device I was holding on to. How do you manage this situation?
Why is this a service and not a standalone tool that I can use from my own machine? Do I really want to be giving out the locations of my ssh servers to some random website? Also, a standalone tool could be used behind corporate firewalls, where this service is useless.
Well, yes and no - I can see the argument that it might be nice to test them locally before you expose them to the world (and I suppose you might also have them on a private LAN permanently), but otherwise, they will be tested, by someone, and soon...
This is akin to putting your email address all over the internet. If you do that, you're going to get lots of spam. If you are more careful about who you give it to, you'll get less.
It's clearly a win to keep both email addresses and ssh server addresses as private as possible.
Why is this a service and not a standalone tool that I can use from my own machine? Do I really want to be giving out the locations of my ssh servers to some random website? Also, a standalone tool could be used behind corporate firewalls, where this service is useless.
Yeah I'd like a local tool. Maybe I want to do a test before I put it on the internet.
hope someone makes a local-executable version...
It would be super-useful if it could give you something actionable for each issue if finds.
https://wiki.mozilla.org/Security/Guidelines/OpenSSH While not exactly the solution you're looking for the Mozilla OpenSSH guidelines are quite better than the default sshd_config
It would be super-useful if it could give you something actionable for each issue if finds.
https://wiki.mozilla.org/Security/Guidelines/OpenSSH While not exactly the solution you're looking for the Mozilla OpenSSH guidelines are quite better than the default sshd_config
Some of their concerns with SSH agent forwarding are good too - but make me wonder if writing some little GUI that would have you allow or deny authentication requests would solve the problem.
On one hand, nice way to collect a database of SSH servers without triggering alarms. On the other, people using this tool are more likely to take steps to secure their servers.
shodan.io already has a pretty good database of SSH servers. Want to find servers running an old version of OpenSSH? Easily queriable. https://www.shodan.io/search?query=OpenSSH_5.2+country%3A%22... There's a decent chance your SSH server is already in this database and many others.
OK, I am not embarrassed to ask... If I see some "weak" or "insecure" tags, what can I do about it? I have no idea how to disable MAC, key-exchange, and encryption algorithms used by the server I control. I had thought that just using SSH was "enough" More importantly, if I do disable the insecure stuff, what will it break ?
For the most part it is, many of the things they're labeling as "weak" is not stuff that's likely to get you exploited today, but stuff that might at some point in the future - attacks only get better. Not necessarily things that are completely broken, just weak by today's standards.
> More importantly, if I do disable the insecure stuff, what will it break ?
Older clients mostly. Many phone apps for example don't have recent SSH implementations that support newer cryptography.