SSH Check – public SSH server testing tool

I followed the Mozilla SSH guidelines[0] modern configuration, and turned out pretty good on this tool.<p>[0] <a href="https:&#x2F;&#x2F;wiki.mozilla.org&#x2F;Security&#x2F;Guidelines&#x2F;OpenSSH" rel="nofollow">https:&#x2F;&#x2F;wiki.mozilla.org&#x2F;Security&#x2F;Guidelines&#x2F;OpenSSH</a>

There are a couple of strange things here.<p>It lists oakley group 14 as insecure with no justification. That&#x27;s a 2048 bit diffie hellman group and it should be totally fine.<p>It also lists hmac-sha1 as problematic, although in hmac the weaknesses of sha1 are irrelevant.<p>I&#x27;m not sure about the umac 64 bit block size. That should at least have some more info why it&#x27;s considered problematic.<p>Usually OpenSSH is pretty good at deprecating problematic algorithm choices, so I tend to stick with upstream defaults.

It would be super-useful if it could give you something actionable for each issue if finds.

OK, I am not embarrassed to ask...<p>If I see some &quot;weak&quot; or &quot;insecure&quot; tags, what can I do about it? I have no idea how to disable MAC, key-exchange, and encryption algorithms used by the server I control. I had thought that just using SSH was &quot;enough&quot;<p>More importantly, if I do disable the insecure stuff, what will it break ?

Great tool - I found some weaknesses in my SSH server. After fixing them, I wanted to test it again but I can&#x27;t find a refresh button...<p>EDIT: turns out you need to wait 10 minutes.

A suggestion: add simulated handshakes for various versions of OpenSSH and PuTTY to indicate which cipher&#x2F;auth&#x2F;kex algorithm they would negotiate with their default settings (ala the SSL Labs scanner).

If it included info on what to do with the WEAK ones, it would be much better. Sort of like the Google Pagespeed style.

Is it just me or am I the only one who is a bit hesitant to submit the public IP&#x2F;hostname to some random service on the web. I&#x27;m not trying to say that the creator of this has any ill intent, but I also don&#x27;t know that they aren&#x27;t cataloging addresses of potentially vulnerable ssh daemons.<p>Anyway.. just to reiterate I&#x27;m not trying accuse you of anything OP. Very cool utility, nice work!

Why is this a service and not a standalone tool that I can use from my own machine?<p>Do I really want to be giving out the locations of my ssh servers to some random website?<p>Also, a standalone tool could be used behind corporate firewalls, where this service is useless.

Is this based on ssh-audit? <a href="https:&#x2F;&#x2F;github.com&#x2F;arthepsy&#x2F;ssh-audit" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;arthepsy&#x2F;ssh-audit</a>

It appear to have problems with newer chiphers.<p>sshd[28670]: fatal: Unable to negotiate with 40.112.150.31 port 47286: no matching cipher found. Their offer: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,3des-cbc,twofish256-ctr,twofish192-ctr,twofish128-ctr,twofish256-cbc,twofish192-cbc,twofish128-cbc,twofish-cbc [preauth]

Great tool! Though I think it much safer to control these things client side, that way no matter what you&#x27;re connecting to you know you&#x27;re getting safe ciphers.

On one hand, nice way to collect a database of SSH servers without triggering alarms.<p>On the other, people using this tool are more likely to take steps to secure their servers.

Ok, say I am on vacations and my laptop turned brick. The SQL crashed and I need to perform a restore.<p>What do I do if only SSH keys are allowed? So I keep my key on a USB key? How is that safe to plug in into a computer?<p>Do I go around with a USB-Linux-distro with my key on it? What if in the border an official decides to keep the USB device I was holding on to.<p>How do you manage this situation?

Is there a similar tool that tests HTTPS enabled web servers on their choice of ciphers etc?

Just shows the following for me:<p>An error occurred This happenned when we were trying to connect to io.r1ch.net:22.<p><a href="https:&#x2F;&#x2F;sshcheck.com&#x2F;server&#x2F;io.r1ch.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sshcheck.com&#x2F;server&#x2F;io.r1ch.net&#x2F;</a>

Should this have &quot;Show HN:&quot; in the title? The author of the site appears to be the OP.<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;showhn.html" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;showhn.html</a>

It&#x27;d be useful to know what this is likely to break, AFAIK I sshd doesn&#x27;t log what ciphers people used, like Apache can do. A caniuse.com for SSH would be useful.

Is there any possibility to do check again, eg. after updating sshd config? After entering same data again i get previous result.

Out of curiosity I tried github.com and one of my servers. To my surprise it judges my server to be far more secure than github.

Ubuntu 16.04 launched from an AMI on AWS EC2 has weak points in its SSH setup out of the box—supporting SHA-1 and 64-bit UMAC.

Kind of useless. I&#x27;ve checked, change settings and can&#x27;t check again. I&#x27;m getting results from some cache.

No IPv6 support.

After updating my SSH config, the tool won&#x27;t let me re-check, it just gives me the previous results.

Is there a good reason to open up access to your ssh port for some service by a novelty account which could easily collect information on what version ssl sub-protocols you do and do not support?<p>Consider me paranoid but I don&#x27;t like services like this unless they come from reputable sources and even then I&#x27;d much rather run something local.<p>Remember to close your port in your firewall after running the test.

hope someone makes a local-executable version...

<a href="https:&#x2F;&#x2F;github.com&#x2F;isgroup-srl&#x2F;secure-ssh-server" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;isgroup-srl&#x2F;secure-ssh-server</a>

Can you share what went into building this?

netcat -z -w 2 $ipaddress 22;echo $?<p>How hard is that?

Call me critical AND paranoid.. but this kind of thing should be a tool people can run locally. Not via some public service, which is probably gonna be blacklisted on plenty of RBLs.<p>However first and above all, SSH SHOULD NEVER LISTEN AND&#x2F;OR RESPOND to non whitelisted ip addresses. NEVER, no exceptions.<p>Also i think it is more a promotion for the rebex site and software, not so much the ssh scan utility... based on the selected sample site, simplicity of the utility and site,<p>Server Identification: SSH-2.0-RebexSSH_1.0.0.0