mirror of
https://github.com/jtesta/ssh-audit.git
synced 2025-07-06 14:02:49 -05:00
Compare commits
24 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| f517e03d9f | |||
| 6c64257d91 | |||
| 982c0b4c72 | |||
| e26597a7aa | |||
| f8e29674a3 | |||
| d3dd5a9cac | |||
| 79ca4b2d8b | |||
| 884ef645f8 | |||
| 953683a762 | |||
| 38f9c21760 | |||
| 4e6169d0cb | |||
| 2867c65819 | |||
| 77cdb969b9 | |||
| 199e75f6cd | |||
| 3f2fdbaa3d | |||
| 83e90729e2 | |||
| 83f9e48271 | |||
| e2fc60cbb4 | |||
| a74c3abdde | |||
| e99cb0b579 | |||
| 639f11a5e5 | |||
| 521a50a796 | |||
| 2d5a97841f | |||
| 54b8c7da02 |
@ -2,6 +2,9 @@ FROM python:3-slim
|
||||
|
||||
WORKDIR /
|
||||
|
||||
# Update the image to remediate any vulnerabilities.
|
||||
RUN apt clean && apt update && apt -y dist-upgrade && apt clean
|
||||
|
||||
# Remove suid & sgid bits from all files.
|
||||
RUN find / -xdev -perm /6000 -exec chmod ug-s {} \; 2> /dev/null || true
|
||||
|
||||
|
||||
@ -4,10 +4,20 @@ ifeq ($(VERSION),)
|
||||
endif
|
||||
|
||||
all:
|
||||
docker buildx build \
|
||||
--platform linux/amd64,linux/arm64,linux/arm/v7 \
|
||||
--tag positronsecurity/ssh-audit:${VERSION} \
|
||||
--tag positronsecurity/ssh-audit:latest \
|
||||
.
|
||||
|
||||
local-build:
|
||||
docker build -t positronsecurity/ssh-audit:${VERSION} .
|
||||
docker tag positronsecurity/ssh-audit:${VERSION} positronsecurity/ssh-audit:latest
|
||||
|
||||
upload:
|
||||
docker login
|
||||
docker push positronsecurity/ssh-audit:${VERSION}
|
||||
docker push positronsecurity/ssh-audit:latest
|
||||
docker buildx build \
|
||||
--platform linux/amd64,linux/arm64,linux/arm/v7 \
|
||||
--tag positronsecurity/ssh-audit:${VERSION} \
|
||||
--tag positronsecurity/ssh-audit:latest \
|
||||
--push \
|
||||
.
|
||||
|
||||
@ -3,10 +3,10 @@ all:
|
||||
virtualenv -p /usr/bin/python3 /tmp/pypi_upload/
|
||||
cp -R src /tmp/pypi_upload/
|
||||
cp setup.py setup.cfg README.md LICENSE /tmp/pypi_upload/
|
||||
/bin/bash -c "pushd /tmp/pypi_upload/; source bin/activate; pip3 install setuptools twine; python3 setup.py sdist bdist_wheel"
|
||||
/bin/bash -c "pushd /tmp/pypi_upload/; source bin/activate; pip3 install -U setuptools twine build; pip3 install -U requests_toolbelt; python3 -m build"
|
||||
|
||||
uploadtest:
|
||||
/bin/bash -c "pushd /tmp/pypi_upload; source bin/activate; twine upload --repository-url https://test.pypi.org/legacy/ /tmp/pypi_upload/dist/*"
|
||||
/bin/bash -c "pushd /tmp/pypi_upload; source bin/activate; python3 -m twine upload --repository testpypi /tmp/pypi_upload/dist/*"
|
||||
|
||||
uploadprod:
|
||||
/bin/bash -c "pushd /tmp/pypi_upload; source bin/activate; twine upload /tmp/pypi_upload/dist/*"
|
||||
|
||||
@ -18,7 +18,7 @@ An executable can only be made on a Windows host because the PyInstaller tool (h
|
||||
To create package and upload to test server:
|
||||
|
||||
```
|
||||
$ sudo apt install python3-virtualenv
|
||||
$ sudo apt install python3-virtualenv python3.8-venv
|
||||
$ make -f Makefile.pypi
|
||||
$ make -f Makefile.pypi uploadtest
|
||||
```
|
||||
@ -58,7 +58,9 @@ Create the snap package with:
|
||||
Upload the snap with:
|
||||
|
||||
```
|
||||
$ snapcraft login
|
||||
$ snapcraft export-login ~/snap_creds.txt
|
||||
$ export SNAPCRAFT_STORE_CREDENTIALS=$(cat ~/snap_creds.txt)
|
||||
$ snapcraft upload --release=beta ssh-audit_*.snap
|
||||
$ snapcraft upload --release=stable ssh-audit_*.snap
|
||||
```
|
||||
|
||||
|
||||
17
README.md
17
README.md
@ -178,6 +178,23 @@ For convenience, a web front-end on top of the command-line tool is available at
|
||||
|
||||
## ChangeLog
|
||||
|
||||
### v3.0.0 (2023-09-07)
|
||||
- Results from concurrent scans against multiple hosts are no longer improperly combined; bug discovered by [Adam Russell](https://github.com/thecliguy).
|
||||
- Hostname resolution failure no longer causes scans against multiple hosts to terminate unexpectedly; credit [Dani Cuesta](https://github.com/daniel-cues).
|
||||
- Algorithm recommendations resulting from warnings are now printed in yellow instead of red; credit [Adam Russell](https://github.com/thecliguy).
|
||||
- Added failure, warning, and info notes to JSON output (note that this results in a breaking change to the banner protocol, "enc", and "mac" fields); credit [Bareq Al-Azzawi](https://github.com/BareqAZ).
|
||||
- Docker Makefile now creates multi-arch builds for amd64, arm64, and armv7; credit [Sebastian Cohnen](https://github.com/tisba).
|
||||
- Fixed crash during GEX tests.
|
||||
- Refined GEX testing against OpenSSH servers: when the fallback mechanism is suspected of being triggered, perform an additional test to obtain more accurate results.
|
||||
- The color of all notes will be printed in green when the related algorithm is rated good.
|
||||
- Prioritized host key certificate algorithms for Ubuntu 22.04 LTS client policy.
|
||||
- Marked all NIST K-, B-, and T-curves as unproven since they are so rarely used.
|
||||
- Added built-in policy for OpenSSH 9.4.
|
||||
- Added 12 new host keys: `ecdsa-sha2-curve25519`, `ecdsa-sha2-nistb233`, `ecdsa-sha2-nistb409`, `ecdsa-sha2-nistk163`, `ecdsa-sha2-nistk233`, `ecdsa-sha2-nistk283`, `ecdsa-sha2-nistk409`, `ecdsa-sha2-nistp224`, `ecdsa-sha2-nistp192`, `ecdsa-sha2-nistt571`, `ssh-dsa`, `x509v3-sign-rsa-sha256`.
|
||||
- Added 15 new key exchanges: `curve448-sha512@libssh.org`, `ecdh-nistp256-kyber-512r3-sha256-d00@openquantumsafe.org`, `ecdh-nistp384-kyber-768r3-sha384-d00@openquantumsafe.org`, `ecdh-nistp521-kyber-1024r3-sha512-d00@openquantumsafe.org`, `ecdh-sha2-brainpoolp256r1@genua.de`, `ecdh-sha2-brainpoolp384r1@genua.de`, `ecdh-sha2-brainpoolp521r1@genua.de`, `kexAlgoDH14SHA1`, `kexAlgoDH1SHA1`, `kexAlgoECDH256`, `kexAlgoECDH384`, `kexAlgoECDH521`, `sm2kep-sha2-nistp256`, `x25519-kyber-512r3-sha256-d00@amazon.com`, `x25519-kyber512-sha512@aws.amazon.com`.
|
||||
- Added 8 new ciphers: `aes192-gcm@openssh.com`, `cast128-12-cbc`, `cast128-12-cfb`, `cast128-12-ecb`, `cast128-12-ofb`, `des-cfb`, `des-ecb`, `des-ofb`.
|
||||
- Added 14 new MACs: `cbcmac-3des`, `cbcmac-aes`, `cbcmac-blowfish`, `cbcmac-des`, `cbcmac-rijndael`, `cbcmac-twofish`, `hmac-sha256-96`, `md5`, `md5-8`, `ripemd160`, `ripemd160-8`, `sha1`, `sha1-8`, `umac-128`.
|
||||
|
||||
### v2.9.0 (2023-04-29)
|
||||
- Dropped support for Python 3.6, as it reached EOL at the end of 2021.
|
||||
- Added Ubuntu Server & Client 22.04 hardening policies.
|
||||
|
||||
@ -34,10 +34,10 @@
|
||||
PLATFORM="$(uname -s)"
|
||||
|
||||
# This script is intended for use on Cygwin only.
|
||||
case "$PLATFORM" in
|
||||
case "${PLATFORM}" in
|
||||
CYGWIN*) ;;
|
||||
*)
|
||||
echo "Platform not supported ($PLATFORM). This must be run in Cygwin only."
|
||||
echo "Platform not supported (${PLATFORM}). This must be run in Cygwin only."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@ -78,13 +78,14 @@ git checkout src/ssh_audit/globals.py 2> /dev/null
|
||||
|
||||
# Update the man page.
|
||||
./update_windows_man_page.sh
|
||||
if [[ $? != 0 ]]; then
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
echo "Failed to run ./update_windows_man_page.sh"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Do all operations from this point from the main source directory.
|
||||
pushd src/ssh_audit > /dev/null
|
||||
pushd src/ssh_audit || exit > /dev/null
|
||||
|
||||
# Delete the existing VERSION variable and add the value that the user entered, above.
|
||||
sed -i '/^VERSION/d' globals.py
|
||||
@ -109,8 +110,9 @@ else
|
||||
fi
|
||||
|
||||
# Ensure that the version string doesn't have '-dev' in it.
|
||||
X=`dist/ssh-audit.exe | grep -E 'ssh-audit.exe v.+\-dev'` > /dev/null
|
||||
if [[ $? == 0 ]]; then
|
||||
dist/ssh-audit.exe | grep -E 'ssh-audit.exe v.+\-dev' > /dev/null
|
||||
retval=$?
|
||||
if [[ ${retval} == 0 ]]; then
|
||||
echo -e "\nError: executable's version number includes '-dev'."
|
||||
exit 1
|
||||
fi
|
||||
@ -121,5 +123,5 @@ rm -rf build/ ssh-audit.spec ssh-audit.py
|
||||
# Reset the changes we made to globals.py.
|
||||
git checkout globals.py 2> /dev/null
|
||||
|
||||
popd > /dev/null
|
||||
popd || exit > /dev/null
|
||||
exit 0
|
||||
|
||||
277
docker_test.sh
277
docker_test.sh
@ -28,8 +28,8 @@ IMAGE_NAME=positronsecurity/ssh-audit-test-framework
|
||||
|
||||
# Terminal colors.
|
||||
CLR="\033[0m"
|
||||
RED="\033[0;31m"
|
||||
YELLOW="\033[0;33m"
|
||||
#RED="\033[0;31m"
|
||||
#YELLOW="\033[0;33m"
|
||||
GREEN="\033[0;32m"
|
||||
REDB="\033[1;31m" # Red + bold
|
||||
YELLOWB="\033[1;33m" # Yellow + bold
|
||||
@ -38,7 +38,7 @@ GREENB="\033[1;32m" # Green + bold
|
||||
# Program return values.
|
||||
PROGRAM_RETVAL_FAILURE=3
|
||||
PROGRAM_RETVAL_WARNING=2
|
||||
PROGRAM_RETVAL_CONNECTION_ERROR=1
|
||||
#PROGRAM_RETVAL_CONNECTION_ERROR=1
|
||||
PROGRAM_RETVAL_GOOD=0
|
||||
|
||||
|
||||
@ -58,21 +58,21 @@ check_if_docker_image_exists() {
|
||||
# Uncompresses and compiles the specified version of Dropbear.
|
||||
compile_dropbear() {
|
||||
version=$1
|
||||
compile 'Dropbear' "$version"
|
||||
compile "Dropbear" "$version"
|
||||
}
|
||||
|
||||
|
||||
# Uncompresses and compiles the specified version of OpenSSH.
|
||||
compile_openssh() {
|
||||
version=$1
|
||||
compile 'OpenSSH' "$version"
|
||||
compile "OpenSSH" "$version"
|
||||
}
|
||||
|
||||
|
||||
# Uncompresses and compiles the specified version of TinySSH.
|
||||
compile_tinyssh() {
|
||||
version=$1
|
||||
compile 'TinySSH' "$version"
|
||||
compile "TinySSH" "$version"
|
||||
}
|
||||
|
||||
|
||||
@ -84,31 +84,31 @@ compile() {
|
||||
uncompress_options=
|
||||
source_dir=
|
||||
server_executable=
|
||||
if [[ $project == 'OpenSSH' ]]; then
|
||||
if [[ $project == "OpenSSH" ]]; then
|
||||
tarball="openssh-${version}.tar.gz"
|
||||
uncompress_options="xzf"
|
||||
source_dir="openssh-${version}"
|
||||
server_executable=sshd
|
||||
elif [[ $project == 'Dropbear' ]]; then
|
||||
elif [[ $project == "Dropbear" ]]; then
|
||||
tarball="dropbear-${version}.tar.bz2"
|
||||
uncompress_options="xjf"
|
||||
source_dir="dropbear-${version}"
|
||||
server_executable=dropbear
|
||||
elif [[ $project == 'TinySSH' ]]; then
|
||||
elif [[ $project == "TinySSH" ]]; then
|
||||
tarball="${version}.tar.gz"
|
||||
uncompress_options="xzf"
|
||||
source_dir="tinyssh-${version}"
|
||||
server_executable='build/bin/tinysshd'
|
||||
server_executable="build/bin/tinysshd"
|
||||
fi
|
||||
|
||||
echo "Uncompressing ${project} ${version}..."
|
||||
tar $uncompress_options "$tarball"
|
||||
|
||||
echo "Compiling ${project} ${version}..."
|
||||
pushd "$source_dir" > /dev/null
|
||||
pushd "$source_dir" || exit > /dev/null
|
||||
|
||||
# TinySSH has no configure script... only a Makefile.
|
||||
if [[ $project == 'TinySSH' ]]; then
|
||||
if [[ $project == "TinySSH" ]]; then
|
||||
make -j 10
|
||||
else
|
||||
./configure && make -j 10
|
||||
@ -120,7 +120,7 @@ compile() {
|
||||
fi
|
||||
|
||||
echo -e "\n${GREEN}Successfully built ${project} ${version}${CLR}\n"
|
||||
popd > /dev/null
|
||||
popd || exit > /dev/null
|
||||
}
|
||||
|
||||
|
||||
@ -130,11 +130,11 @@ create_docker_image() {
|
||||
TMP_DIR=$(mktemp -d /tmp/sshaudit-docker-XXXXXXXXXX)
|
||||
|
||||
# Copy the Dockerfile and all files in the test/docker/ dir to our new temp directory.
|
||||
find test/docker/ -maxdepth 1 -type f -exec cp -t "$TMP_DIR" '{}' +
|
||||
find test/docker/ -maxdepth 1 -type f -exec cp -t "$TMP_DIR" "{}" +
|
||||
|
||||
# Make the temp directory our working directory for the duration of the build
|
||||
# process.
|
||||
pushd "$TMP_DIR" > /dev/null
|
||||
pushd "$TMP_DIR" || exit > /dev/null
|
||||
|
||||
# Get the release keys.
|
||||
get_dropbear_release_key
|
||||
@ -143,22 +143,22 @@ create_docker_image() {
|
||||
|
||||
# Aside from checking the GPG signatures, we also compare against this known-good
|
||||
# SHA-256 hash just in case.
|
||||
get_openssh '4.0p1' '5adb9b2c2002650e15216bf94ed9db9541d9a17c96fcd876784861a8890bc92b'
|
||||
get_openssh '5.6p1' '538af53b2b8162c21a293bb004ae2bdb141abd250f61b4cea55244749f3c6c2b'
|
||||
get_openssh '8.0p1' 'bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68'
|
||||
get_dropbear '2019.78' '525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4'
|
||||
get_tinyssh '20190101' '554a9a94e53b370f0cd0c5fbbd322c34d1f695cbcea6a6a32dcb8c9f595b3fea'
|
||||
get_openssh "4.0p1" "5adb9b2c2002650e15216bf94ed9db9541d9a17c96fcd876784861a8890bc92b"
|
||||
get_openssh "5.6p1" "538af53b2b8162c21a293bb004ae2bdb141abd250f61b4cea55244749f3c6c2b"
|
||||
get_openssh "8.0p1" "bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68"
|
||||
get_dropbear "2019.78" "525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4"
|
||||
get_tinyssh "20190101" "554a9a94e53b370f0cd0c5fbbd322c34d1f695cbcea6a6a32dcb8c9f595b3fea"
|
||||
|
||||
# Compile the versions of OpenSSH.
|
||||
compile_openssh '4.0p1'
|
||||
compile_openssh '5.6p1'
|
||||
compile_openssh '8.0p1'
|
||||
compile_openssh "4.0p1"
|
||||
compile_openssh "5.6p1"
|
||||
compile_openssh "8.0p1"
|
||||
|
||||
# Compile the versions of Dropbear.
|
||||
compile_dropbear '2019.78'
|
||||
compile_dropbear "2019.78"
|
||||
|
||||
# Compile the versions of TinySSH.
|
||||
compile_tinyssh '20190101'
|
||||
compile_tinyssh "20190101"
|
||||
|
||||
|
||||
# Rename the default config files so we know they are our originals.
|
||||
@ -175,7 +175,7 @@ create_docker_image() {
|
||||
#
|
||||
|
||||
# Test 1: Basic test.
|
||||
create_openssh_config '4.0p1' 'test1' "HostKey /etc/ssh/ssh1_host_key\nHostKey /etc/ssh/ssh_host_rsa_key_1024\nHostKey /etc/ssh/ssh_host_dsa_key"
|
||||
create_openssh_config "4.0p1" "test1" "HostKey /etc/ssh/ssh1_host_key\nHostKey /etc/ssh/ssh_host_rsa_key_1024\nHostKey /etc/ssh/ssh_host_dsa_key"
|
||||
|
||||
|
||||
#
|
||||
@ -183,19 +183,19 @@ create_docker_image() {
|
||||
#
|
||||
|
||||
# Test 1: Basic test.
|
||||
create_openssh_config '5.6p1' 'test1' "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostKey /etc/ssh/ssh_host_dsa_key"
|
||||
create_openssh_config "5.6p1" "test1" "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostKey /etc/ssh/ssh_host_dsa_key"
|
||||
|
||||
# Test 2: RSA 1024 host key with RSA 1024 certificate.
|
||||
create_openssh_config '5.6p1' 'test2' "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostCertificate /etc/ssh/ssh_host_rsa_key_1024-cert_1024.pub"
|
||||
create_openssh_config "5.6p1" "test2" "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostCertificate /etc/ssh/ssh_host_rsa_key_1024-cert_1024.pub"
|
||||
|
||||
# Test 3: RSA 1024 host key with RSA 3072 certificate.
|
||||
create_openssh_config '5.6p1' 'test3' "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostCertificate /etc/ssh/ssh_host_rsa_key_1024-cert_3072.pub"
|
||||
create_openssh_config "5.6p1" "test3" "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostCertificate /etc/ssh/ssh_host_rsa_key_1024-cert_3072.pub"
|
||||
|
||||
# Test 4: RSA 3072 host key with RSA 1024 certificate.
|
||||
create_openssh_config '5.6p1' 'test4' "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostCertificate /etc/ssh/ssh_host_rsa_key_3072-cert_1024.pub"
|
||||
create_openssh_config "5.6p1" "test4" "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostCertificate /etc/ssh/ssh_host_rsa_key_3072-cert_1024.pub"
|
||||
|
||||
# Test 5: RSA 3072 host key with RSA 3072 certificate.
|
||||
create_openssh_config '5.6p1' 'test5' "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostCertificate /etc/ssh/ssh_host_rsa_key_3072-cert_3072.pub"
|
||||
create_openssh_config "5.6p1" "test5" "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostCertificate /etc/ssh/ssh_host_rsa_key_3072-cert_3072.pub"
|
||||
|
||||
|
||||
#
|
||||
@ -203,19 +203,19 @@ create_docker_image() {
|
||||
#
|
||||
|
||||
# Test 1: Basic test.
|
||||
create_openssh_config '8.0p1' 'test1' "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostKey /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key"
|
||||
create_openssh_config "8.0p" "test1" "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostKey /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key"
|
||||
|
||||
# Test 2: ED25519 certificate test.
|
||||
create_openssh_config '8.0p1' 'test2' "HostKey /etc/ssh/ssh_host_ed25519_key\nHostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"
|
||||
create_openssh_config "8.0p1" "test2" "HostKey /etc/ssh/ssh_host_ed25519_key\nHostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"
|
||||
|
||||
# Test 3: Hardened installation test.
|
||||
create_openssh_config '8.0p1' 'test3' "HostKey /etc/ssh/ssh_host_ed25519_key\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com"
|
||||
create_openssh_config "8.0p1" "test3" "HostKey /etc/ssh/ssh_host_ed25519_key\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com"
|
||||
|
||||
|
||||
# Now build the docker image!
|
||||
docker build --tag "$IMAGE_NAME:$IMAGE_VERSION" .
|
||||
|
||||
popd > /dev/null
|
||||
popd || exit > /dev/null
|
||||
rm -rf -- "$TMP_DIR"
|
||||
}
|
||||
|
||||
@ -233,19 +233,19 @@ create_openssh_config() {
|
||||
|
||||
# Downloads the Dropbear release key and adds it to the local keyring.
|
||||
get_dropbear_release_key() {
|
||||
get_release_key 'Dropbear' 'https://matt.ucc.asn.au/dropbear/releases/dropbear-key-2015.asc' 'F29C6773' 'F734 7EF2 EE2E 07A2 6762 8CA9 4493 1494 F29C 6773'
|
||||
get_release_key "Dropbear" "https://matt.ucc.asn.au/dropbear/releases/dropbear-key-2015.asc" "F29C6773" "F734 7EF2 EE2E 07A2 6762 8CA9 4493 1494 F29C 6773"
|
||||
}
|
||||
|
||||
|
||||
# Downloads the OpenSSH release key and adds it to the local keyring.
|
||||
get_openssh_release_key() {
|
||||
get_release_key 'OpenSSH' 'https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc' '6D920D30' '59C2 118E D206 D927 E667 EBE3 D3E5 F56B 6D92 0D30'
|
||||
get_release_key "OpenSSH" "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc" "6D920D30" "59C2 118E D206 D927 E667 EBE3 D3E5 F56B 6D92 0D30"
|
||||
}
|
||||
|
||||
|
||||
# Downloads the TinySSH release key and adds it to the local keyring.
|
||||
get_tinyssh_release_key() {
|
||||
get_release_key 'TinySSH' '' '96939FF9' 'AADF 2EDF 5529 F170 2772 C8A2 DEC4 D246 931E F49B'
|
||||
get_release_key "TinySSH" "" "96939FF9" "AADF 2EDF 5529 F170 2772 C8A2 DEC4 D246 931E F49B"
|
||||
}
|
||||
|
||||
|
||||
@ -256,7 +256,7 @@ get_release_key() {
|
||||
release_key_fingerprint_expected=$4
|
||||
|
||||
# The TinySSH release key isn't on any website, apparently.
|
||||
if [[ $project == 'TinySSH' ]]; then
|
||||
if [[ $project == "TinySSH" ]]; then
|
||||
gpg --keyserver keys.gnupg.net --recv-key "$key_id"
|
||||
else
|
||||
echo -e "\nGetting ${project} release key...\n"
|
||||
@ -268,7 +268,8 @@ get_release_key() {
|
||||
rm key.asc
|
||||
fi
|
||||
|
||||
local release_key_fingerprint_actual=$(gpg --fingerprint "$key_id")
|
||||
local release_key_fingerprint_actual
|
||||
release_key_fingerprint_actual=$(gpg --fingerprint "$key_id")
|
||||
if [[ $release_key_fingerprint_actual != *"$release_key_fingerprint_expected"* ]]; then
|
||||
echo -e "\n${REDB}Error: ${project} release key fingerprint does not match expected value!\n\tExpected: $release_key_fingerprint_expected\n\tActual: $release_key_fingerprint_actual\n\nTerminating.${CLR}"
|
||||
exit 1
|
||||
@ -281,7 +282,7 @@ get_release_key() {
|
||||
get_dropbear() {
|
||||
version=$1
|
||||
tarball_checksum_expected=$2
|
||||
get_source 'Dropbear' "$version" "$tarball_checksum_expected"
|
||||
get_source "Dropbear" "$version" "$tarball_checksum_expected"
|
||||
}
|
||||
|
||||
|
||||
@ -289,7 +290,7 @@ get_dropbear() {
|
||||
get_openssh() {
|
||||
version=$1
|
||||
tarball_checksum_expected=$2
|
||||
get_source 'OpenSSH' "$version" "$tarball_checksum_expected"
|
||||
get_source "OpenSSH" "$version" "$tarball_checksum_expected"
|
||||
}
|
||||
|
||||
|
||||
@ -297,7 +298,7 @@ get_openssh() {
|
||||
get_tinyssh() {
|
||||
version=$1
|
||||
tarball_checksum_expected=$2
|
||||
get_source 'TinySSH' "$version" "$tarball_checksum_expected"
|
||||
get_source "TinySSH" "$version" "$tarball_checksum_expected"
|
||||
}
|
||||
|
||||
|
||||
@ -311,20 +312,20 @@ get_source() {
|
||||
tarball=
|
||||
sig=
|
||||
signer=
|
||||
if [[ $project == 'OpenSSH' ]]; then
|
||||
base_url_source='https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/'
|
||||
if [[ $project == "OpenSSH" ]]; then
|
||||
base_url_source="https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/"
|
||||
base_url_sig=$base_url_source
|
||||
tarball="openssh-${version}.tar.gz"
|
||||
sig="${tarball}.asc"
|
||||
signer="Damien Miller "
|
||||
elif [[ $project == 'Dropbear' ]]; then
|
||||
base_url_source='https://matt.ucc.asn.au/dropbear/releases/'
|
||||
elif [[ $project == "Dropbear" ]]; then
|
||||
base_url_source="https://matt.ucc.asn.au/dropbear/releases/"
|
||||
base_url_sig=$base_url_source
|
||||
tarball="dropbear-${version}.tar.bz2"
|
||||
sig="${tarball}.asc"
|
||||
signer="Dropbear SSH Release Signing <matt@ucc.asn.au>"
|
||||
elif [[ $project == 'TinySSH' ]]; then
|
||||
base_url_source='https://github.com/janmojzis/tinyssh/archive/'
|
||||
elif [[ $project == "TinySSH" ]]; then
|
||||
base_url_source="https://github.com/janmojzis/tinyssh/archive/"
|
||||
base_url_sig="https://github.com/janmojzis/tinyssh/releases/download/${version}/"
|
||||
tarball="${version}.tar.gz"
|
||||
sig="${tarball}.asc"
|
||||
@ -339,12 +340,14 @@ get_source() {
|
||||
|
||||
|
||||
# Older OpenSSH releases were .sigs.
|
||||
if [[ ($project == 'OpenSSH') && (! -f $sig) ]]; then
|
||||
if [[ ($project == "OpenSSH") && (! -f $sig) ]]; then
|
||||
wget "${base_url_sig}openssh-${version}.tar.gz.sig"
|
||||
sig=openssh-${version}.tar.gz.sig
|
||||
fi
|
||||
|
||||
local gpg_verify=$(gpg --verify "${sig}" "${tarball}" 2>&1)
|
||||
local gpg_verify
|
||||
gpg_verify=$(gpg --verify "${sig}" "${tarball}" 2>&1)
|
||||
retval=$?
|
||||
if [[ $gpg_verify != *"Good signature from \"${signer}"* ]]; then
|
||||
echo -e "\n\n${REDB}Error: ${project} signature invalid!\n$gpg_verify\n\nTerminating.${CLR}"
|
||||
exit 1
|
||||
@ -352,14 +355,15 @@ get_source() {
|
||||
|
||||
# Check GPG's return value. 0 denotes a valid signature, and 1 is returned
|
||||
# on invalid signatures.
|
||||
if [[ $? != 0 ]]; then
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
echo -e "\n\n${REDB}Error: ${project} signature invalid! Verification returned code: $?\n\nTerminating.${CLR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}Signature on ${project} sources verified.${CLR}\n"
|
||||
|
||||
local checksum_actual=$(sha256sum "${tarball}" | cut -f1 -d" ")
|
||||
local checksum_actual
|
||||
checksum_actual=$(sha256sum "${tarball}" | cut -f1 -d" ")
|
||||
if [[ $checksum_actual != "$tarball_checksum_expected" ]]; then
|
||||
echo -e "${REDB}Error: ${project} checksum is invalid!\n Expected: ${tarball_checksum_expected}\n Actual: ${checksum_actual}\n\n Terminating.${CLR}"
|
||||
exit 1
|
||||
@ -369,11 +373,12 @@ get_source() {
|
||||
|
||||
# Pulls the defined image from Dockerhub.
|
||||
pull_docker_image() {
|
||||
docker pull "$IMAGE_NAME:$IMAGE_VERSION"
|
||||
if [[ $? == 0 ]]; then
|
||||
echo -e "${GREEN}Successfully downloaded image $IMAGE_NAME:$IMAGE_VERSION from Dockerhub.${CLR}\n"
|
||||
docker pull "${IMAGE_NAME}:${IMAGE_VERSION}"
|
||||
retval=$?
|
||||
if [[ ${retval} == 0 ]]; then
|
||||
echo -e "${GREEN}Successfully downloaded image ${IMAGE_NAME}:${IMAGE_VERSION} from Dockerhub.${CLR}\n"
|
||||
else
|
||||
echo -e "${REDB}Failed to pull image $IMAGE_NAME:$IMAGE_VERSION from Dockerhub! Error code: $?${CLR}\n"
|
||||
echo -e "${REDB}Failed to pull image ${IMAGE_NAME}:${IMAGE_VERSION} from Dockerhub! Error code: ${retval}${CLR}\n"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
@ -387,7 +392,7 @@ run_dropbear_test() {
|
||||
options=$3
|
||||
expected_retval=$4
|
||||
|
||||
run_test 'Dropbear' $dropbear_version $test_number "$options" $expected_retval
|
||||
run_test "Dropbear" "${dropbear_version}" "${test_number}" "${options}" "${expected_retval}"
|
||||
}
|
||||
|
||||
|
||||
@ -398,7 +403,7 @@ run_openssh_test() {
|
||||
test_number=$2
|
||||
expected_retval=$3
|
||||
|
||||
run_test 'OpenSSH' $openssh_version $test_number '' $expected_retval
|
||||
run_test "OpenSSH" "${openssh_version}" "${test_number}" "" "${expected_retval}"
|
||||
}
|
||||
|
||||
|
||||
@ -409,7 +414,7 @@ run_tinyssh_test() {
|
||||
test_number=$2
|
||||
expected_retval=$3
|
||||
|
||||
run_test 'TinySSH' $tinyssh_version $test_number '' $expected_retval
|
||||
run_test "TinySSH" "${tinyssh_version}" "${test_number}" "" "${expected_retval}"
|
||||
}
|
||||
|
||||
|
||||
@ -427,7 +432,7 @@ run_test() {
|
||||
expected_result_stdout=
|
||||
expected_result_json=
|
||||
test_name=
|
||||
if [[ $server_type == 'OpenSSH' ]]; then
|
||||
if [[ $server_type == "OpenSSH" ]]; then
|
||||
server_exec="/openssh/sshd-${version} -D -f /etc/ssh/sshd_config-${version}_${test_number}"
|
||||
test_result_stdout="${TEST_RESULT_DIR}/openssh_${version}_${test_number}.txt"
|
||||
test_result_json="${TEST_RESULT_DIR}/openssh_${version}_${test_number}.json"
|
||||
@ -435,14 +440,14 @@ run_test() {
|
||||
expected_result_json="test/docker/expected_results/openssh_${version}_${test_number}.json"
|
||||
test_name="OpenSSH ${version} ${test_number}"
|
||||
options=
|
||||
elif [[ $server_type == 'Dropbear' ]]; then
|
||||
elif [[ $server_type == "Dropbear" ]]; then
|
||||
server_exec="/dropbear/dropbear-${version} -F ${options}"
|
||||
test_result_stdout="${TEST_RESULT_DIR}/dropbear_${version}_${test_number}.txt"
|
||||
test_result_json="${TEST_RESULT_DIR}/dropbear_${version}_${test_number}.json"
|
||||
expected_result_stdout="test/docker/expected_results/dropbear_${version}_${test_number}.txt"
|
||||
expected_result_json="test/docker/expected_results/dropbear_${version}_${test_number}.json"
|
||||
test_name="Dropbear ${version} ${test_number}"
|
||||
elif [[ $server_type == 'TinySSH' ]]; then
|
||||
elif [[ $server_type == "TinySSH" ]]; then
|
||||
server_exec="/usr/bin/tcpserver -HRDl0 0.0.0.0 22 /tinysshd/tinyssh-20190101 -v /etc/tinyssh/"
|
||||
test_result_stdout="${TEST_RESULT_DIR}/tinyssh_${version}_${test_number}.txt"
|
||||
test_result_json="${TEST_RESULT_DIR}/tinyssh_${version}_${test_number}.json"
|
||||
@ -451,10 +456,11 @@ run_test() {
|
||||
test_name="TinySSH ${version} ${test_number}"
|
||||
fi
|
||||
|
||||
cid=$(docker run -d -p 2222:22 "$IMAGE_NAME:$IMAGE_VERSION" ${server_exec})
|
||||
cid=$(docker run -d -p 2222:22 "${IMAGE_NAME}:${IMAGE_VERSION}" ${server_exec})
|
||||
retval=$?
|
||||
#echo "Running: docker run -d -p 2222:22 $IMAGE_NAME:$IMAGE_VERSION ${server_exec}"
|
||||
if [[ $? != 0 ]]; then
|
||||
echo -e "${REDB}Failed to run docker image! (exit code: $?)${CLR}"
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
echo -e "${REDB}Failed to run docker image! (exit code: ${retval})${CLR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@ -467,8 +473,8 @@ run_test() {
|
||||
echo -e "\n${REDB}This failure cannot be automatically fixed; this script must be manually updated with the new expected return value.${CLR}"
|
||||
fi
|
||||
|
||||
cat ${test_result_stdout}
|
||||
docker container stop -t 0 $cid > /dev/null
|
||||
cat "${test_result_stdout}"
|
||||
docker container stop -t 0 "${cid}" > /dev/null
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@ -481,21 +487,22 @@ run_test() {
|
||||
echo -e "\n${REDB}This failure cannot be automatically fixed; this script must be manually updated with the new expected return value.${CLR}"
|
||||
fi
|
||||
|
||||
cat ${test_result_json}
|
||||
docker container stop -t 0 $cid > /dev/null
|
||||
cat "${test_result_json}"
|
||||
docker container stop -t 0 "${cid}" > /dev/null
|
||||
exit 1
|
||||
fi
|
||||
|
||||
docker container stop -t 0 $cid > /dev/null
|
||||
if [[ $? != 0 ]]; then
|
||||
echo -e "${REDB}Failed to stop docker container ${cid}! (exit code: $?)${CLR}"
|
||||
docker container stop -t 0 "${cid}" > /dev/null
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
echo -e "${REDB}Failed to stop docker container ${cid}! (exit code: ${retval})${CLR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# TinySSH outputs a random string in each banner, which breaks our test. So
|
||||
# we need to filter out the banner part of the output so we get stable, repeatable
|
||||
# results.
|
||||
if [[ $server_type == 'TinySSH' ]]; then
|
||||
if [[ $server_type == "TinySSH" ]]; then
|
||||
grep -v "(gen) banner: " "${test_result_stdout}" > "${test_result_stdout}.tmp"
|
||||
mv "${test_result_stdout}.tmp" "${test_result_stdout}"
|
||||
cat "${test_result_json}" | perl -pe 's/"comments": ".*?"/"comments": ""/' | perl -pe 's/"raw": ".+?"/"raw": ""/' > "${test_result_json}.tmp"
|
||||
@ -503,7 +510,8 @@ run_test() {
|
||||
fi
|
||||
|
||||
diff=$(diff -u "${expected_result_stdout}" "${test_result_stdout}")
|
||||
if [[ $? != 0 ]]; then
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
|
||||
# If the user wants to update the tests, then overwrite the expected results with the actual results.
|
||||
if [[ $accept == 1 ]]; then
|
||||
@ -518,7 +526,8 @@ run_test() {
|
||||
fi
|
||||
|
||||
diff=$(diff -u "${expected_result_json}" "${test_result_json}")
|
||||
if [[ $? != 0 ]]; then
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
|
||||
# If the user wants to update the tests, then overwrite the expected results with the actual results.
|
||||
if [[ $accept == 1 ]]; then
|
||||
@ -562,15 +571,15 @@ run_custom_policy_test() {
|
||||
|
||||
version=
|
||||
config=
|
||||
if [[ ${config_number} == 'config1' ]]; then
|
||||
version='5.6p1'
|
||||
config='sshd_config-5.6p1_test1'
|
||||
elif [[ ${config_number} == 'config2' ]]; then
|
||||
version='8.0p1'
|
||||
config='sshd_config-8.0p1_test1'
|
||||
elif [[ ${config_number} == 'config3' ]]; then
|
||||
version='5.6p1'
|
||||
config='sshd_config-5.6p1_test4'
|
||||
if [[ ${config_number} == "config1" ]]; then
|
||||
version="5.6p1"
|
||||
config="sshd_config-5.6p1_test1"
|
||||
elif [[ ${config_number} == "config2" ]]; then
|
||||
version="8.0p1"
|
||||
config="sshd_config-8.0p1_test1"
|
||||
elif [[ ${config_number} == "config3" ]]; then
|
||||
version="5.6p1"
|
||||
config="sshd_config-5.6p1_test4"
|
||||
fi
|
||||
|
||||
server_exec="/openssh/sshd-${version} -D -f /etc/ssh/${config}"
|
||||
@ -595,9 +604,10 @@ run_policy_test() {
|
||||
|
||||
|
||||
#echo "Running: docker run -d -p 2222:22 $IMAGE_NAME:$IMAGE_VERSION ${server_exec}"
|
||||
cid=$(docker run -d -p 2222:22 "$IMAGE_NAME:$IMAGE_VERSION" ${server_exec})
|
||||
if [[ $? != 0 ]]; then
|
||||
echo -e "${REDB}Failed to run docker image! (exit code: $?)${CLR}"
|
||||
cid=$(docker run -d -p 2222:22 "${IMAGE_NAME}:${IMAGE_VERSION}" ${server_exec})
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
echo -e "${REDB}Failed to run docker image! (exit code: ${retval})${CLR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@ -612,7 +622,7 @@ run_policy_test() {
|
||||
fi
|
||||
|
||||
cat "${test_result_stdout}"
|
||||
docker container stop -t 0 $cid > /dev/null
|
||||
docker container stop -t 0 "${cid}" > /dev/null
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@ -627,18 +637,20 @@ run_policy_test() {
|
||||
fi
|
||||
|
||||
cat "${test_result_json}"
|
||||
docker container stop -t 0 $cid > /dev/null
|
||||
docker container stop -t 0 "${cid}" > /dev/null
|
||||
exit 1
|
||||
fi
|
||||
|
||||
docker container stop -t 0 $cid > /dev/null
|
||||
if [[ $? != 0 ]]; then
|
||||
echo -e "${REDB}Failed to stop docker container ${cid}! (exit code: $?)${CLR}"
|
||||
docker container stop -t 0 "${cid}" > /dev/null
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
echo -e "${REDB}Failed to stop docker container ${cid}! (exit code: ${retval})${CLR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
diff=$(diff -u "${expected_result_stdout}" "${test_result_stdout}")
|
||||
if [[ $? != 0 ]]; then
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
|
||||
# If the user wants to update the tests, then overwrite the expected results with the actual results.
|
||||
if [[ $accept == 1 ]]; then
|
||||
@ -652,7 +664,8 @@ run_policy_test() {
|
||||
fi
|
||||
|
||||
diff=$(diff -u "${expected_result_json}" "${test_result_json}")
|
||||
if [[ $? != 0 ]]; then
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
|
||||
# If the user wants to update the tests, then overwrite the expected results with the actual results.
|
||||
if [[ $accept == 1 ]]; then
|
||||
@ -671,8 +684,9 @@ run_policy_test() {
|
||||
|
||||
# First check if docker is functional.
|
||||
docker version > /dev/null
|
||||
if [[ $? != 0 ]]; then
|
||||
echo -e "${REDB}Error: 'docker version' command failed (error code: $?). Is docker installed and functioning?${CLR}"
|
||||
retval=$?
|
||||
if [[ ${retval} != 0 ]]; then
|
||||
echo -e "${REDB}Error: 'docker version' command failed (error code: ${retval}). Is docker installed and functioning?${CLR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@ -680,7 +694,8 @@ fi
|
||||
# Check if the docker image is the most up-to-date version.
|
||||
docker_image_exists=0
|
||||
check_if_docker_image_exists
|
||||
if [[ $? == 0 ]]; then
|
||||
retval=$?
|
||||
if [[ ${retval} == 0 ]]; then
|
||||
docker_image_exists=1
|
||||
fi
|
||||
|
||||
@ -688,11 +703,11 @@ fi
|
||||
# Check if the user specified --create to build a new image.
|
||||
if [[ ($# == 1) && ($1 == "--create") ]]; then
|
||||
# Ensure that the image name doesn't already exist before building.
|
||||
if [[ $docker_image_exists == 1 ]]; then
|
||||
echo -e "${REDB}Error: --create specified, but $IMAGE_NAME:$IMAGE_VERSION already exists!${CLR}"
|
||||
if [[ ${docker_image_exists} == 1 ]]; then
|
||||
echo -e "${REDB}Error: --create specified, but ${IMAGE_NAME}:${IMAGE_VERSION} already exists!${CLR}"
|
||||
exit 1
|
||||
else
|
||||
echo -e "\nCreating docker image $IMAGE_NAME:$IMAGE_VERSION..."
|
||||
echo -e "\nCreating docker image ${IMAGE_NAME}:${IMAGE_VERSION}..."
|
||||
create_docker_image
|
||||
echo -e "\n${GREEN}Done creating docker image!${CLR}"
|
||||
exit 0
|
||||
@ -708,8 +723,8 @@ fi
|
||||
|
||||
|
||||
# If we weren't explicitly told to create a new image, and it doesn't exist, then pull it from Dockerhub.
|
||||
if [[ $docker_image_exists == 0 ]]; then
|
||||
echo -e "\nPulling docker image $IMAGE_NAME:$IMAGE_VERSION..."
|
||||
if [[ ${docker_image_exists} == 0 ]]; then
|
||||
echo -e "\nPulling docker image ${IMAGE_NAME}:${IMAGE_VERSION}..."
|
||||
pull_docker_image
|
||||
fi
|
||||
|
||||
@ -721,64 +736,64 @@ TEST_RESULT_DIR=$(mktemp -d /tmp/ssh-audit_test-results_XXXXXXXXXX)
|
||||
|
||||
# Now run all the tests.
|
||||
echo -e "\nRunning tests..."
|
||||
run_openssh_test '4.0p1' 'test1' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test "4.0p1" "test1" "${PROGRAM_RETVAL_FAILURE}"
|
||||
echo
|
||||
run_openssh_test '5.6p1' 'test1' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test '5.6p1' 'test2' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test '5.6p1' 'test3' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test '5.6p1' 'test4' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test '5.6p1' 'test5' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test "5.6p1" "test1" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_openssh_test "5.6p1" "test2" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_openssh_test "5.6p1" "test3" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_openssh_test "5.6p1" "test4" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_openssh_test "5.6p1" "test5" "${PROGRAM_RETVAL_FAILURE}"
|
||||
echo
|
||||
run_openssh_test '8.0p1' 'test1' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test '8.0p1' 'test2' $PROGRAM_RETVAL_FAILURE
|
||||
run_openssh_test '8.0p1' 'test3' $PROGRAM_RETVAL_WARNING
|
||||
run_openssh_test "8.0p1" "test1" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_openssh_test "8.0p1" "test2" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_openssh_test "8.0p1" "test3" "${PROGRAM_RETVAL_GOOD}"
|
||||
echo
|
||||
run_dropbear_test '2019.78' 'test1' '-r /etc/dropbear/dropbear_rsa_host_key_1024 -r /etc/dropbear/dropbear_dss_host_key -r /etc/dropbear/dropbear_ecdsa_host_key' 3
|
||||
run_dropbear_test "2019.78" "test1" "-r /etc/dropbear/dropbear_rsa_host_key_1024 -r /etc/dropbear/dropbear_dss_host_key -r /etc/dropbear/dropbear_ecdsa_host_key" 3
|
||||
echo
|
||||
run_tinyssh_test '20190101' 'test1' $PROGRAM_RETVAL_WARNING
|
||||
run_tinyssh_test "20190101" "test1" "${PROGRAM_RETVAL_WARNING}"
|
||||
echo
|
||||
echo
|
||||
run_custom_policy_test 'config1' 'test1' $PROGRAM_RETVAL_GOOD
|
||||
run_custom_policy_test 'config1' 'test2' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test 'config1' 'test3' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test 'config1' 'test4' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test 'config1' 'test5' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test 'config2' 'test6' $PROGRAM_RETVAL_GOOD
|
||||
run_custom_policy_test "config1" "test1" "${PROGRAM_RETVAL_GOOD}"
|
||||
run_custom_policy_test "config1" "test2" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_custom_policy_test "config1" "test3" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_custom_policy_test "config1" "test4" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_custom_policy_test "config1" "test5" "${PROGRAM_RETVAL_FAILURE}"
|
||||
run_custom_policy_test "config2" "test6" "${PROGRAM_RETVAL_GOOD}"
|
||||
|
||||
# Passing test with host key certificate and CA key certificates.
|
||||
run_custom_policy_test 'config3' 'test7' $PROGRAM_RETVAL_GOOD
|
||||
run_custom_policy_test "config3" "test7" "${PROGRAM_RETVAL_GOOD}"
|
||||
|
||||
# Failing test with host key certificate and non-compliant CA key length.
|
||||
run_custom_policy_test 'config3' 'test8' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test "config3" "test8" "${PROGRAM_RETVAL_FAILURE}"
|
||||
|
||||
# Failing test with non-compliant host key certificate and CA key certificate.
|
||||
run_custom_policy_test 'config3' 'test9' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test "config3" "test9" "${PROGRAM_RETVAL_FAILURE}"
|
||||
|
||||
# Failing test with non-compliant host key certificate and non-compliant CA key certificate.
|
||||
run_custom_policy_test 'config3' 'test10' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test "config3" "test10" "${PROGRAM_RETVAL_FAILURE}"
|
||||
|
||||
# Passing test with host key size check.
|
||||
run_custom_policy_test 'config2' 'test11' $PROGRAM_RETVAL_GOOD
|
||||
run_custom_policy_test "config2" "test11" "${PROGRAM_RETVAL_GOOD}"
|
||||
|
||||
# Failing test with non-compliant host key size check.
|
||||
run_custom_policy_test 'config2' 'test12' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test "config2" "test12" "${PROGRAM_RETVAL_FAILURE}"
|
||||
|
||||
# Passing test with DH modulus test.
|
||||
run_custom_policy_test 'config2' 'test13' $PROGRAM_RETVAL_GOOD
|
||||
run_custom_policy_test "config2" "test13" "${PROGRAM_RETVAL_GOOD}"
|
||||
|
||||
# Failing test with DH modulus test.
|
||||
run_custom_policy_test 'config2' 'test14' $PROGRAM_RETVAL_FAILURE
|
||||
run_custom_policy_test "config2" "test14" "${PROGRAM_RETVAL_FAILURE}"
|
||||
|
||||
# Failing test for built-in OpenSSH 8.0p1 server policy (RSA host key size is 3072 instead of 4096).
|
||||
run_builtin_policy_test "Hardened OpenSSH Server v8.0 (version 2)" "8.0p1" "test1" "-o HostKeyAlgorithms=rsa-sha2-512,rsa-sha2-256,ssh-ed25519 -o KexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 -o Ciphers=chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr -o MACs=hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com" $PROGRAM_RETVAL_FAILURE
|
||||
run_builtin_policy_test "Hardened OpenSSH Server v8.0 (version 3)" "8.0p1" "test1" "-o HostKeyAlgorithms=rsa-sha2-512,rsa-sha2-256,ssh-ed25519 -o KexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 -o Ciphers=chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr -o MACs=hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com" "${PROGRAM_RETVAL_FAILURE}"
|
||||
|
||||
# Failing test for built-in OpenSSH 8.0p1 server policy (MACs not hardened).
|
||||
run_builtin_policy_test "Hardened OpenSSH Server v8.0 (version 2)" "8.0p1" "test2" "-o HostKeyAlgorithms=rsa-sha2-512,rsa-sha2-256,ssh-ed25519 -o KexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 -o Ciphers=chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr" $PROGRAM_RETVAL_FAILURE
|
||||
run_builtin_policy_test "Hardened OpenSSH Server v8.0 (version 3)" "8.0p1" "test2" "-o HostKeyAlgorithms=rsa-sha2-512,rsa-sha2-256,ssh-ed25519 -o KexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 -o Ciphers=chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr" "${PROGRAM_RETVAL_FAILURE}"
|
||||
|
||||
|
||||
if [[ $num_failures == 0 ]]; then
|
||||
echo -e "\n${GREENB}ALL TESTS PASS!${CLR}\n"
|
||||
rm -rf -- "$TEST_RESULT_DIR"
|
||||
rm -rf -- "${TEST_RESULT_DIR}"
|
||||
else
|
||||
echo -e "\n${REDB}${num_failures} TESTS FAILED!${CLR}\n"
|
||||
fi
|
||||
|
||||
@ -54,7 +54,7 @@ class Algorithms:
|
||||
def ssh1(self) -> Optional['Algorithms.Item']:
|
||||
if self.ssh1kex is None:
|
||||
return None
|
||||
item = Algorithms.Item(1, SSH1_KexDB.ALGORITHMS)
|
||||
item = Algorithms.Item(1, SSH1_KexDB.get_db())
|
||||
item.add('key', ['ssh-rsa1'])
|
||||
item.add('enc', self.ssh1kex.supported_ciphers)
|
||||
item.add('aut', self.ssh1kex.supported_authentications)
|
||||
@ -64,7 +64,7 @@ class Algorithms:
|
||||
def ssh2(self) -> Optional['Algorithms.Item']:
|
||||
if self.ssh2kex is None:
|
||||
return None
|
||||
item = Algorithms.Item(2, SSH2_KexDB.ALGORITHMS)
|
||||
item = Algorithms.Item(2, SSH2_KexDB.get_db())
|
||||
item.add('kex', self.ssh2kex.kex_algorithms)
|
||||
item.add('key', self.ssh2kex.key_algorithms)
|
||||
item.add('enc', self.ssh2kex.server.encryption)
|
||||
|
||||
@ -27,7 +27,8 @@ import traceback
|
||||
from typing import Dict, List, Set, Sequence, Tuple, Iterable # noqa: F401
|
||||
from typing import Callable, Optional, Union, Any # noqa: F401
|
||||
|
||||
from ssh_audit.kexdh import KexDHException, KexGroupExchange_SHA1, KexGroupExchange_SHA256
|
||||
from ssh_audit.banner import Banner
|
||||
from ssh_audit.kexdh import KexDHException, KexGroupExchange, KexGroupExchange_SHA1, KexGroupExchange_SHA256
|
||||
from ssh_audit.ssh2_kexdb import SSH2_KexDB
|
||||
from ssh_audit.ssh2_kex import SSH2_Kex
|
||||
from ssh_audit.ssh_socket import SSH_Socket
|
||||
@ -106,24 +107,12 @@ class GEXTest:
|
||||
# in a "connection reset by peer" error. It may be possible
|
||||
# to recover from such an error by sleeping for some time
|
||||
# before continuing to issue reconnects.
|
||||
if GEXTest.reconnect(out, s, kex, gex_alg) is False:
|
||||
modulus_size_returned, reconnect_failed = GEXTest._send_init(out, s, kex_group, kex, gex_alg, bits_min, bits_pref, bits_max)
|
||||
if reconnect_failed:
|
||||
out.fail('Reconnect failed.')
|
||||
return exitcodes.FAILURE
|
||||
try:
|
||||
modulus_size_returned = None
|
||||
kex_group.send_init_gex(s, bits_min, bits_pref, bits_max)
|
||||
kex_group.recv_reply(s, False)
|
||||
modulus_size_returned = kex_group.get_dh_modulus_size()
|
||||
out.d('Modulus size returned by server: ' + str(modulus_size_returned) + ' bits', write_now=True)
|
||||
except KexDHException:
|
||||
out.d('[exception] ' + str(traceback.format_exc()), write_now=True)
|
||||
finally:
|
||||
# The server is in a state that is not re-testable,
|
||||
# so there's nothing else to do with this open
|
||||
# connection.
|
||||
s.close()
|
||||
|
||||
if modulus_size_returned is not None:
|
||||
if modulus_size_returned > 0:
|
||||
if gex_alg in modulus_dict:
|
||||
if modulus_size_returned not in modulus_dict[gex_alg]:
|
||||
modulus_dict[gex_alg].append(modulus_size_returned)
|
||||
@ -134,7 +123,7 @@ class GEXTest:
|
||||
|
||||
# Runs the DH moduli test against the specified target.
|
||||
@staticmethod
|
||||
def run(out: 'OutputBuffer', s: 'SSH_Socket', kex: 'SSH2_Kex') -> None:
|
||||
def run(out: 'OutputBuffer', s: 'SSH_Socket', banner: Optional['Banner'], kex: 'SSH2_Kex') -> None:
|
||||
GEX_ALGS = {
|
||||
'diffie-hellman-group-exchange-sha1': KexGroupExchange_SHA1,
|
||||
'diffie-hellman-group-exchange-sha256': KexGroupExchange_SHA256,
|
||||
@ -148,31 +137,14 @@ class GEXTest:
|
||||
|
||||
# Check if the server supports any of the group-exchange
|
||||
# algorithms. If so, test each one.
|
||||
for gex_alg, kex_group_class in GEX_ALGS.items():
|
||||
for gex_alg, kex_group_class in GEX_ALGS.items(): # pylint: disable=too-many-nested-blocks
|
||||
if gex_alg in kex.kex_algorithms:
|
||||
out.d('Preparing to perform DH group exchange using ' + gex_alg + ' with min, pref and max modulus sizes of 512 bits, 1024 bits and 1536 bits...', write_now=True)
|
||||
|
||||
if GEXTest.reconnect(out, s, kex, gex_alg) is False:
|
||||
break
|
||||
|
||||
kex_group = kex_group_class(out)
|
||||
smallest_modulus = -1
|
||||
|
||||
# First try a range of weak sizes.
|
||||
try:
|
||||
kex_group.send_init_gex(s, 512, 1024, 1536)
|
||||
kex_group.recv_reply(s, False)
|
||||
|
||||
# Its been observed that servers will return a group
|
||||
# larger than the requested max. So just because we
|
||||
# got here, doesn't mean the server is vulnerable...
|
||||
smallest_modulus = kex_group.get_dh_modulus_size()
|
||||
out.d('Modulus size returned by server: ' + str(smallest_modulus) + ' bits', write_now=True)
|
||||
|
||||
except KexDHException:
|
||||
out.d('[exception] ' + str(traceback.format_exc()), write_now=True)
|
||||
finally:
|
||||
s.close()
|
||||
smallest_modulus, reconnect_failed = GEXTest._send_init(out, s, kex_group, kex, gex_alg, 512, 1024, 1536)
|
||||
if reconnect_failed:
|
||||
break
|
||||
|
||||
# Try an array of specific modulus sizes... one at a time.
|
||||
reconnect_failed = False
|
||||
@ -183,32 +155,25 @@ class GEXTest:
|
||||
if bits >= smallest_modulus > 0:
|
||||
break
|
||||
|
||||
out.d('Preparing to perform DH group exchange using ' + gex_alg + ' with min, pref and max modulus sizes of ' + str(bits) + ' bits...', write_now=True)
|
||||
smallest_modulus, reconnect_failed = GEXTest._send_init(out, s, kex_group, kex, gex_alg, bits, bits, bits)
|
||||
|
||||
if GEXTest.reconnect(out, s, kex, gex_alg) is False:
|
||||
reconnect_failed = True
|
||||
break
|
||||
|
||||
try:
|
||||
kex_group.send_init_gex(s, bits, bits, bits)
|
||||
kex_group.recv_reply(s, False)
|
||||
smallest_modulus = kex_group.get_dh_modulus_size()
|
||||
out.d('Modulus size returned by server: ' + str(smallest_modulus) + ' bits', write_now=True)
|
||||
except KexDHException as e:
|
||||
out.d('Exception when testing DH group exchange ' + gex_alg + ' with modulus size ' + str(bits) + '. (Hint: this is probably normal since the server does not support this modulus size.): ' + str(e), write_now=True)
|
||||
finally:
|
||||
# The server is in a state that is not re-testable,
|
||||
# so there's nothing else to do with this open
|
||||
# connection.
|
||||
s.close()
|
||||
# If the smallest modulus is 2048 and the server is OpenSSH, then we may have triggered the fallback mechanism, which tends to happen in testing scenarios such as this but not in most real-world conditions (see X). To better test this condition, we will do an additional check to see if the server supports sizes between 2048 and 4096, and consider this the definitive result.
|
||||
openssh_test_updated = False
|
||||
if (smallest_modulus == 2048) and (banner is not None) and (banner.software is not None) and (banner.software.find('OpenSSH') != -1):
|
||||
out.d('First pass found a minimum GEX modulus of 2048 against OpenSSH server. Performing a second pass to get a more accurate result...')
|
||||
smallest_modulus, _ = GEXTest._send_init(out, s, kex_group, kex, gex_alg, 2048, 3072, 4096)
|
||||
out.d('Modulus size returned by server during second pass: %d bits' % smallest_modulus, write_now=True)
|
||||
openssh_test_updated = bool((smallest_modulus > 0) and (smallest_modulus != 2048))
|
||||
|
||||
if smallest_modulus > 0:
|
||||
kex.set_dh_modulus_size(gex_alg, smallest_modulus)
|
||||
|
||||
lst = SSH2_KexDB.get_db()['kex'][gex_alg]
|
||||
|
||||
# We flag moduli smaller than 2048 as a failure.
|
||||
if smallest_modulus < 2048:
|
||||
text = 'using small %d-bit modulus' % smallest_modulus
|
||||
lst = SSH2_KexDB.ALGORITHMS['kex'][gex_alg]
|
||||
|
||||
# For 'diffie-hellman-group-exchange-sha256', add
|
||||
# a failure reason.
|
||||
if len(lst) == 1:
|
||||
@ -222,7 +187,6 @@ class GEXTest:
|
||||
|
||||
# Moduli smaller than 3072 get flagged as a warning.
|
||||
elif smallest_modulus < 3072:
|
||||
lst = SSH2_KexDB.ALGORITHMS['kex'][gex_alg]
|
||||
|
||||
# Ensure that a warning list exists for us to append to, below.
|
||||
while len(lst) < 3:
|
||||
@ -233,5 +197,39 @@ class GEXTest:
|
||||
if text not in lst[2]:
|
||||
lst[2].append(text)
|
||||
|
||||
# If we retested against OpenSSH (because its fallback mechanism was triggered), add a special note for the user.
|
||||
if openssh_test_updated:
|
||||
text = "OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use %u. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477)." % smallest_modulus
|
||||
|
||||
# Ensure that an info list exists for us to append to, below.
|
||||
while len(lst) < 4:
|
||||
lst.append([])
|
||||
|
||||
# Ensure this is only added once.
|
||||
if text not in lst[3]:
|
||||
lst[3].append(text)
|
||||
|
||||
if reconnect_failed:
|
||||
break
|
||||
|
||||
@staticmethod
|
||||
def _send_init(out: 'OutputBuffer', s: 'SSH_Socket', kex_group: 'KexGroupExchange', kex: 'SSH2_Kex', gex_alg: str, min_bits: int, pref_bits: int, max_bits: int) -> Tuple[int, bool]:
|
||||
'''Internal function for sending the GEX initialization to the server with the minimum, preferred, and maximum modulus bits. Returns a Tuple of the modulus size received from the server (or -1 on error) and boolean signifying that the connection to the server failed.'''
|
||||
|
||||
smallest_modulus = -1
|
||||
reconnect_failed = False
|
||||
try:
|
||||
if GEXTest.reconnect(out, s, kex, gex_alg) is False:
|
||||
reconnect_failed = True
|
||||
out.d('GEXTest._send_init(%s, %u, %u, %u): reconnection failed.' % (gex_alg, min_bits, pref_bits, max_bits), write_now=True)
|
||||
else:
|
||||
kex_group.send_init_gex(s, min_bits, pref_bits, max_bits)
|
||||
kex_group.recv_reply(s, False)
|
||||
smallest_modulus = kex_group.get_dh_modulus_size()
|
||||
out.d('GEXTest._send_init(%s, %u, %u, %u): received modulus size: %d' % (gex_alg, min_bits, pref_bits, max_bits, smallest_modulus), write_now=True)
|
||||
except KexDHException as e:
|
||||
out.d('GEXTest._send_init(%s, %u, %u, %u): exception when performing DH group exchange init: %s' % (gex_alg, min_bits, pref_bits, max_bits, str(e)), write_now=True)
|
||||
finally:
|
||||
s.close()
|
||||
|
||||
return smallest_modulus, reconnect_failed
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
"""
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (C) 2017-2021 Joe Testa (jtesta@positronsecurity.com)
|
||||
Copyright (C) 2017-2023 Joe Testa (jtesta@positronsecurity.com)
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
@ -22,7 +22,7 @@
|
||||
THE SOFTWARE.
|
||||
"""
|
||||
# The version to display.
|
||||
VERSION = 'v2.9.0'
|
||||
VERSION = 'v3.0.0'
|
||||
|
||||
# SSH software to impersonate
|
||||
SSH_HEADER = 'SSH-{0}-OpenSSH_8.2'
|
||||
|
||||
@ -216,16 +216,18 @@ class HostKeyTest:
|
||||
|
||||
# If the current key is a member of the RSA family, then populate all RSA family members with the same
|
||||
# failure and/or warning comments.
|
||||
while len(SSH2_KexDB.ALGORITHMS['key'][rsa_type]) < 3:
|
||||
SSH2_KexDB.ALGORITHMS['key'][rsa_type].append([])
|
||||
db = SSH2_KexDB.get_db()
|
||||
while len(db['key'][rsa_type]) < 3:
|
||||
db['key'][rsa_type].append([])
|
||||
|
||||
SSH2_KexDB.ALGORITHMS['key'][rsa_type][1].extend(key_fail_comments)
|
||||
SSH2_KexDB.ALGORITHMS['key'][rsa_type][2].extend(key_warn_comments)
|
||||
db['key'][rsa_type][1].extend(key_fail_comments)
|
||||
db['key'][rsa_type][2].extend(key_warn_comments)
|
||||
|
||||
else:
|
||||
host_key_types[host_key_type]['parsed'] = True
|
||||
while len(SSH2_KexDB.ALGORITHMS['key'][host_key_type]) < 3:
|
||||
SSH2_KexDB.ALGORITHMS['key'][host_key_type].append([])
|
||||
db = SSH2_KexDB.get_db()
|
||||
while len(db['key'][host_key_type]) < 3:
|
||||
db['key'][host_key_type].append([])
|
||||
|
||||
SSH2_KexDB.ALGORITHMS['key'][host_key_type][1].extend(key_fail_comments)
|
||||
SSH2_KexDB.ALGORITHMS['key'][host_key_type][2].extend(key_warn_comments)
|
||||
db['key'][host_key_type][1].extend(key_fail_comments)
|
||||
db['key'][host_key_type][2].extend(key_warn_comments)
|
||||
|
||||
@ -26,6 +26,7 @@ import binascii
|
||||
import os
|
||||
import random
|
||||
import struct
|
||||
import traceback
|
||||
|
||||
# pylint: disable=unused-import
|
||||
from typing import Dict, List, Set, Sequence, Tuple, Iterable # noqa: F401
|
||||
@ -375,19 +376,22 @@ class KexGroupExchange(KexDH):
|
||||
while packet_type == Protocol.MSG_DEBUG:
|
||||
packet_type, payload = s.read_packet(2)
|
||||
|
||||
# Parse the modulus (p) and generator (g) values from the server.
|
||||
ptr = 0
|
||||
p_len = struct.unpack('>I', payload[ptr:ptr + 4])[0]
|
||||
ptr += 4
|
||||
try:
|
||||
# Parse the modulus (p) and generator (g) values from the server.
|
||||
ptr = 0
|
||||
p_len = struct.unpack('>I', payload[ptr:ptr + 4])[0]
|
||||
ptr += 4
|
||||
|
||||
p = int(binascii.hexlify(payload[ptr:ptr + p_len]), 16)
|
||||
ptr += p_len
|
||||
p = int(binascii.hexlify(payload[ptr:ptr + p_len]), 16)
|
||||
ptr += p_len
|
||||
|
||||
g_len = struct.unpack('>I', payload[ptr:ptr + 4])[0]
|
||||
ptr += 4
|
||||
g_len = struct.unpack('>I', payload[ptr:ptr + 4])[0]
|
||||
ptr += 4
|
||||
|
||||
g = int(binascii.hexlify(payload[ptr:ptr + g_len]), 16)
|
||||
ptr += g_len
|
||||
g = int(binascii.hexlify(payload[ptr:ptr + g_len]), 16)
|
||||
ptr += g_len
|
||||
except struct.error:
|
||||
raise KexDHException("Error while parsing modulus and generator during GEX init: %s" % str(traceback.format_exc())) from None
|
||||
|
||||
# Now that we got the generator and modulus, perform the DH exchange
|
||||
# like usual.
|
||||
|
||||
@ -43,50 +43,52 @@ class Policy:
|
||||
|
||||
# Ubuntu Server policies
|
||||
|
||||
'Hardened Ubuntu Server 16.04 LTS (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256@libssh.org', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened Ubuntu Server 16.04 LTS (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256@libssh.org', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened Ubuntu Server 18.04 LTS (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened Ubuntu Server 18.04 LTS (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened Ubuntu Server 20.04 LTS (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened Ubuntu Server 20.04 LTS (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened Ubuntu Server 22.04 LTS (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened Ubuntu Server 22.04 LTS (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
|
||||
# Generic OpenSSH Server policies
|
||||
|
||||
'Hardened OpenSSH Server v7.7 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v7.7 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v7.8 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v7.8 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v7.9 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v7.9 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.0 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.0 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.1 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.1 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.2 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.2 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.3 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.3 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.4 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.4 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.5 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.5 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.6 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.6 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.7 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.7 (version 3)': {'version': '3', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.8 (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.8 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v8.9 (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v8.9 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v9.0 (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v9.0 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v9.1 (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v9.1 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v9.2 (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v9.2 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v9.3 (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 2048}, 'server_policy': True},
|
||||
'Hardened OpenSSH Server v9.3 (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
'Hardened OpenSSH Server v9.4 (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-ed25519'], 'optional_host_keys': ['sk-ssh-ed25519@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512-cert-v01@openssh.com'], 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': {"rsa-sha2-256": {"hostkey_size": 4096}, "rsa-sha2-256-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "rsa-sha2-512": {"hostkey_size": 4096}, "rsa-sha2-512-cert-v01@openssh.com": {"ca_key_size": 4096, "ca_key_type": "ssh-rsa", "hostkey_size": 4096}, "sk-ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}, "sk-ssh-ed25519@openssh.com": {"hostkey_size": 256}, "ssh-ed25519": {"hostkey_size": 256}, "ssh-ed25519-cert-v01@openssh.com": {"ca_key_size": 256, "ca_key_type": "ssh-ed25519", "hostkey_size": 256}}, 'dh_modulus_sizes': {'diffie-hellman-group-exchange-sha256': 4096}, 'server_policy': True},
|
||||
|
||||
|
||||
# Ubuntu Client policies
|
||||
@ -97,7 +99,7 @@ class Policy:
|
||||
|
||||
'Hardened Ubuntu Client 20.04 LTS (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512', 'rsa-sha2-512-cert-v01@openssh.com'], 'optional_host_keys': None, 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256', 'ext-info-c'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': None, 'dh_modulus_sizes': None, 'server_policy': False},
|
||||
|
||||
'Hardened Ubuntu Client 22.04 LTS (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512', 'rsa-sha2-512-cert-v01@openssh.com'], 'optional_host_keys': None, 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256', 'ext-info-c'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': None, 'dh_modulus_sizes': None, 'server_policy': False},
|
||||
'Hardened Ubuntu Client 22.04 LTS (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['sk-ssh-ed25519-cert-v01@openssh.com', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519@openssh.com', 'ssh-ed25519', 'rsa-sha2-512-cert-v01@openssh.com', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512', 'rsa-sha2-256'], 'optional_host_keys': None, 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256', 'ext-info-c'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': None, 'dh_modulus_sizes': None, 'server_policy': False},
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -22,6 +22,9 @@
|
||||
THE SOFTWARE.
|
||||
"""
|
||||
# pylint: disable=unused-import
|
||||
import copy
|
||||
import threading
|
||||
|
||||
from typing import Dict, List, Set, Sequence, Tuple, Iterable # noqa: F401
|
||||
from typing import Callable, Optional, Union, Any # noqa: F401
|
||||
|
||||
@ -34,7 +37,9 @@ class SSH1_KexDB: # pylint: disable=too-few-public-methods
|
||||
FAIL_NA_UNSAFE = 'not implemented in OpenSSH (server), unsafe algorithm'
|
||||
TEXT_CIPHER_IDEA = 'cipher used by commercial SSH'
|
||||
|
||||
ALGORITHMS: Dict[str, Dict[str, List[List[Optional[str]]]]] = {
|
||||
DB_PER_THREAD: Dict[int, Dict[str, Dict[str, List[List[Optional[str]]]]]] = {}
|
||||
|
||||
MASTER_DB: Dict[str, Dict[str, List[List[Optional[str]]]]] = {
|
||||
'key': {
|
||||
'ssh-rsa1': [['1.2.2']],
|
||||
},
|
||||
@ -56,3 +61,24 @@ class SSH1_KexDB: # pylint: disable=too-few-public-methods
|
||||
'kerberos': [['1.2.2', '3.6'], [FAIL_OPENSSH37_REMOVE]],
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@staticmethod
|
||||
def get_db() -> Dict[str, Dict[str, List[List[Optional[str]]]]]:
|
||||
'''Returns a copy of the MASTER_DB that is private to the calling thread. This prevents multiple threads from polluting the results of other threads.'''
|
||||
calling_thread_id = threading.get_ident()
|
||||
|
||||
if calling_thread_id not in SSH1_KexDB.DB_PER_THREAD:
|
||||
SSH1_KexDB.DB_PER_THREAD[calling_thread_id] = copy.deepcopy(SSH1_KexDB.MASTER_DB)
|
||||
|
||||
return SSH1_KexDB.DB_PER_THREAD[calling_thread_id]
|
||||
|
||||
|
||||
@staticmethod
|
||||
def thread_exit() -> None:
|
||||
'''Deletes the calling thread's copy of the MASTER_DB. This is needed because, in rare circumstances, a terminated thread's ID can be re-used by new threads.'''
|
||||
|
||||
calling_thread_id = threading.get_ident()
|
||||
|
||||
if calling_thread_id in SSH1_KexDB.DB_PER_THREAD:
|
||||
del SSH1_KexDB.DB_PER_THREAD[calling_thread_id]
|
||||
|
||||
@ -23,6 +23,9 @@
|
||||
THE SOFTWARE.
|
||||
"""
|
||||
# pylint: disable=unused-import
|
||||
import copy
|
||||
import threading
|
||||
|
||||
from typing import Dict, List, Set, Sequence, Tuple, Iterable # noqa: F401
|
||||
from typing import Callable, Optional, Union, Any # noqa: F401
|
||||
|
||||
@ -69,14 +72,17 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
INFO_REMOVED_IN_OPENSSH70 = 'removed in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0'
|
||||
INFO_WITHDRAWN_PQ_ALG = 'the sntrup4591761 algorithm was withdrawn, as it may not provide strong post-quantum security'
|
||||
|
||||
# Maintains a dictionary per calling thread that yields its own copy of MASTER_DB. This prevents results from one thread polluting the results of another thread.
|
||||
DB_PER_THREAD: Dict[int, Dict[str, Dict[str, List[List[Optional[str]]]]]] = {}
|
||||
|
||||
ALGORITHMS: Dict[str, Dict[str, List[List[Optional[str]]]]] = {
|
||||
MASTER_DB: Dict[str, Dict[str, List[List[Optional[str]]]]] = {
|
||||
# Format: 'algorithm_name': [['version_first_appeared_in'], [reason_for_failure1, reason_for_failure2, ...], [warning1, warning2, ...], [info1, info2, ...]]
|
||||
'kex': {
|
||||
'Curve25519SHA256': [[]],
|
||||
'curve25519-sha256': [['7.4,d2018.76'], [], [], [INFO_DEFAULT_OPENSSH_KEX]],
|
||||
'curve25519-sha256@libssh.org': [['6.4,d2013.62,l10.6.0'], [], [], [INFO_DEFAULT_OPENSSH_KEX]],
|
||||
'curve448-sha512': [[]],
|
||||
'curve448-sha512@libssh.org': [[]],
|
||||
'diffie-hellman-group14-sha1': [['3.9,d0.53,l10.6.0'], [FAIL_SHA1], [WARN_2048BIT_MODULUS]],
|
||||
'diffie-hellman-group14-sha224@ssh.com': [[]],
|
||||
'diffie-hellman-group14-sha256': [['7.3,d2016.73'], [], [WARN_2048BIT_MODULUS]],
|
||||
@ -101,47 +107,52 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'diffie-hellman-group-exchange-sha256@ssh.com': [[]],
|
||||
'diffie-hellman-group-exchange-sha384@ssh.com': [[]],
|
||||
'diffie-hellman-group-exchange-sha512@ssh.com': [[]],
|
||||
'ecdh-nistp256-kyber-512r3-sha256-d00@openquantumsafe.org': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-nistp384-kyber-768r3-sha384-d00@openquantumsafe.org': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-nistp521-kyber-1024r3-sha512-d00@openquantumsafe.org': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-sha2-1.2.840.10045.3.1.1': [[], [FAIL_SMALL_ECC_MODULUS, FAIL_NSA_BACKDOORED_CURVE]], # NIST P-192 / secp192r1
|
||||
'ecdh-sha2-1.2.840.10045.3.1.7': [[], [FAIL_NSA_BACKDOORED_CURVE]], # NIST P-256 / secp256r1
|
||||
'ecdh-sha2-1.3.132.0.10': [[]], # ECDH over secp256k1 (i.e.: the Bitcoin curve)
|
||||
'ecdh-sha2-1.3.132.0.16': [[]], # sect283k1
|
||||
'ecdh-sha2-1.3.132.0.1': [[], [FAIL_SMALL_ECC_MODULUS]], # sect163k1
|
||||
'ecdh-sha2-1.3.132.0.26': [[], [FAIL_SMALL_ECC_MODULUS]], # sect233k1
|
||||
'ecdh-sha2-1.3.132.0.16': [[], [FAIL_UNPROVEN]], # sect283k1
|
||||
'ecdh-sha2-1.3.132.0.1': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS]], # sect163k1
|
||||
'ecdh-sha2-1.3.132.0.26': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS]], # sect233k1
|
||||
'ecdh-sha2-1.3.132.0.27': [[], [FAIL_SMALL_ECC_MODULUS, FAIL_NSA_BACKDOORED_CURVE]], # sect233r1
|
||||
'ecdh-sha2-1.3.132.0.33': [[], [FAIL_SMALL_ECC_MODULUS, FAIL_NSA_BACKDOORED_CURVE]], # NIST P-224 / secp224r1
|
||||
'ecdh-sha2-1.3.132.0.34': [[], [FAIL_NSA_BACKDOORED_CURVE]], # NIST P-384 / secp384r1
|
||||
'ecdh-sha2-1.3.132.0.35': [[], [FAIL_NSA_BACKDOORED_CURVE]], # NIST P-521 / secp521r1
|
||||
'ecdh-sha2-1.3.132.0.36': [[]], # sect409k1
|
||||
'ecdh-sha2-1.3.132.0.36': [[], [FAIL_UNPROVEN]], # sect409k1
|
||||
'ecdh-sha2-1.3.132.0.37': [[], [FAIL_NSA_BACKDOORED_CURVE]], # sect409r1
|
||||
'ecdh-sha2-1.3.132.0.38': [[]], # sect571k1
|
||||
'ecdh-sha2-1.3.132.0.38': [[], [FAIL_UNPROVEN]], # sect571k1
|
||||
|
||||
# Note: the base64 strings, according to draft 6 of RFC5656, is Base64(MD5(DER(OID))). The final RFC5656 dropped the base64 strings in favor of plain OID concatenation, but apparently some SSH servers implement them anyway. See: https://datatracker.ietf.org/doc/html/draft-green-secsh-ecc-06#section-9.2
|
||||
'ecdh-sha2-4MHB+NBt3AlaSRQ7MnB4cg==': [[], [FAIL_SMALL_ECC_MODULUS]], # sect163k1
|
||||
'ecdh-sha2-4MHB+NBt3AlaSRQ7MnB4cg==': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS]], # sect163k1
|
||||
'ecdh-sha2-5pPrSUQtIaTjUSt5VZNBjg==': [[], [FAIL_SMALL_ECC_MODULUS, FAIL_NSA_BACKDOORED_CURVE]], # NIST P-192 / secp192r1
|
||||
'ecdh-sha2-9UzNcgwTlEnSCECZa7V1mw==': [[], [FAIL_NSA_BACKDOORED_CURVE]], # NIST P-256 / secp256r1
|
||||
'ecdh-sha2-brainpoolp256r1@genua.de': [[], [FAIL_UNPROVEN]],
|
||||
'ecdh-sha2-brainpoolp384r1@genua.de': [[], [FAIL_UNPROVEN]],
|
||||
'ecdh-sha2-brainpoolp521r1@genua.de': [[], [FAIL_UNPROVEN]],
|
||||
'ecdh-sha2-curve25519': [[], []],
|
||||
'ecdh-sha2-D3FefCjYoJ/kfXgAyLddYA==': [[], [FAIL_NSA_BACKDOORED_CURVE]], # sect409r1
|
||||
'ecdh-sha2-h/SsxnLCtRBh7I9ATyeB3A==': [[], [FAIL_NSA_BACKDOORED_CURVE]], # NIST P-521 / secp521r1
|
||||
'ecdh-sha2-m/FtSAmrV4j/Wy6RVUaK7A==': [[]], # sect409k1
|
||||
'ecdh-sha2-mNVwCXAoS1HGmHpLvBC94w==': [[]], # sect571k1
|
||||
|
||||
'ecdh-sha2-nistb233': [[]], # The NIST P-curves are suspected as being backdoored; this isn't a P-curve.
|
||||
'ecdh-sha2-nistb409': [[]], # Not a NIST P-curve.
|
||||
'ecdh-sha2-nistk163': [[], [FAIL_SMALL_ECC_MODULUS]], # Not a NIST P-curve.
|
||||
'ecdh-sha2-nistk233': [[]], # Not a NIST P-curve.
|
||||
'ecdh-sha2-nistk283': [[]], # Not a NIST P-curve.
|
||||
'ecdh-sha2-nistk409': [[]], # Not a NIST P-curve.
|
||||
'ecdh-sha2-m/FtSAmrV4j/Wy6RVUaK7A==': [[], [FAIL_UNPROVEN]], # sect409k1
|
||||
'ecdh-sha2-mNVwCXAoS1HGmHpLvBC94w==': [[], [FAIL_UNPROVEN]], # sect571k1
|
||||
'ecdh-sha2-nistb233': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS]],
|
||||
'ecdh-sha2-nistb409': [[], [FAIL_UNPROVEN]],
|
||||
'ecdh-sha2-nistk163': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS]],
|
||||
'ecdh-sha2-nistk233': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS]],
|
||||
'ecdh-sha2-nistk283': [[], [FAIL_UNPROVEN]],
|
||||
'ecdh-sha2-nistk409': [[], [FAIL_UNPROVEN]],
|
||||
'ecdh-sha2-nistp192': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-sha2-nistp224': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-sha2-nistp256': [['5.7,d2013.62,l10.6.0'], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-sha2-nistp384': [['5.7,d2013.62'], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-sha2-nistp521': [['5.7,d2013.62'], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'ecdh-sha2-nistt571': [[]], # Not a NIST P-curve.
|
||||
'ecdh-sha2-nistt571': [[], [FAIL_UNPROVEN]],
|
||||
'ecdh-sha2-qCbG5Cn/jjsZ7nBeR7EnOA==': [[FAIL_SMALL_ECC_MODULUS, FAIL_NSA_BACKDOORED_CURVE]], # sect233r1
|
||||
'ecdh-sha2-qcFQaMAMGhTziMT0z+Tuzw==': [[], [FAIL_NSA_BACKDOORED_CURVE]], # NIST P-384 / secp384r1
|
||||
'ecdh-sha2-VqBg4QRPjxx1EXZdV0GdWQ==': [[], [FAIL_SMALL_ECC_MODULUS, FAIL_NSA_BACKDOORED_CURVE]], # NIST P-224 / secp224r1
|
||||
'ecdh-sha2-wiRIU8TKjMZ418sMqlqtvQ==': [[]], # sect283k1
|
||||
'ecdh-sha2-zD/b3hu/71952ArpUG4OjQ==': [[], [FAIL_SMALL_ECC_MODULUS]], # sect233k1
|
||||
'ecdh-sha2-VqBg4QRPjxx1EXZdV0GdWQ==': [[], [FAIL_NSA_BACKDOORED_CURVE, FAIL_SMALL_ECC_MODULUS]], # NIST P-224 / secp224r1
|
||||
'ecdh-sha2-wiRIU8TKjMZ418sMqlqtvQ==': [[], [FAIL_UNPROVEN]], # sect283k1
|
||||
'ecdh-sha2-zD/b3hu/71952ArpUG4OjQ==': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS]], # sect233k1
|
||||
'ecmqv-sha2': [[], [FAIL_UNPROVEN]],
|
||||
'ext-info-c': [[]], # Extension negotiation (RFC 8308)
|
||||
'ext-info-s': [[]], # Extension negotiation (RFC 8308)
|
||||
@ -162,15 +173,22 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'gss-nistp256-sha256-*': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'gss-nistp384-sha256-*': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'gss-nistp521-sha512-*': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
|
||||
'kexAlgoCurve25519SHA256': [[]],
|
||||
'kexAlgoDH14SHA1': [[], [FAIL_SHA1], [WARN_2048BIT_MODULUS]],
|
||||
'kexAlgoDH1SHA1': [[], [FAIL_1024BIT_MODULUS, FAIL_LOGJAM_ATTACK, FAIL_SHA1]],
|
||||
'kexAlgoECDH256': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'kexAlgoECDH384': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'kexAlgoECDH521': [[], [FAIL_NSA_BACKDOORED_CURVE]],
|
||||
'kexguess2@matt.ucc.asn.au': [['d2013.57']],
|
||||
'm383-sha384@libassh.org': [[], [FAIL_UNPROVEN]],
|
||||
'm511-sha512@libassh.org': [[], [FAIL_UNPROVEN]],
|
||||
'rsa1024-sha1': [[], [FAIL_1024BIT_MODULUS, FAIL_SHA1]],
|
||||
'rsa2048-sha256': [[], [], [WARN_2048BIT_MODULUS]],
|
||||
'sm2kep-sha2-nistp256': [[], [FAIL_NSA_BACKDOORED_CURVE, FAIL_UNTRUSTED]],
|
||||
'sntrup4591761x25519-sha512@tinyssh.org': [['8.0', '8.4'], [], [WARN_EXPERIMENTAL], [INFO_WITHDRAWN_PQ_ALG]],
|
||||
'sntrup761x25519-sha512@openssh.com': [['8.5'], [], []],
|
||||
'x25519-kyber-512r3-sha256-d00@amazon.com': [[]],
|
||||
'x25519-kyber512-sha512@aws.amazon.com': [[]],
|
||||
},
|
||||
'key': {
|
||||
'dsa2048-sha224@libassh.org': [[], [FAIL_UNPROVEN], [WARN_2048BIT_MODULUS]],
|
||||
@ -178,12 +196,22 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'dsa3072-sha256@libassh.org': [[], [FAIL_UNPROVEN]],
|
||||
'ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com': [[], [FAIL_UNKNOWN]],
|
||||
'ecdsa-sha2-1.3.132.0.10': [[], [], [WARN_RNDSIG_KEY]], # ECDSA over secp256k1 (i.e.: the Bitcoin curve)
|
||||
'ecdsa-sha2-curve25519': [[], [], [WARN_RNDSIG_KEY]], # ECDSA with Curve25519? Bizarre...
|
||||
'ecdsa-sha2-nistb233': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistb409': [[], [FAIL_UNPROVEN], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistk163': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistk233': [[], [FAIL_UNPROVEN, FAIL_SMALL_ECC_MODULUS], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistk283': [[], [FAIL_UNPROVEN], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistk409': [[], [FAIL_UNPROVEN], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp224': [[], [FAIL_NSA_BACKDOORED_CURVE, FAIL_SMALL_ECC_MODULUS], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp192': [[], [FAIL_NSA_BACKDOORED_CURVE, FAIL_SMALL_ECC_MODULUS], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp256': [['5.7,d2013.62,l10.6.4'], [FAIL_NSA_BACKDOORED_CURVE], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp256-cert-v01@openssh.com': [['5.7'], [FAIL_NSA_BACKDOORED_CURVE], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp384': [['5.7,d2013.62,l10.6.4'], [FAIL_NSA_BACKDOORED_CURVE], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp384-cert-v01@openssh.com': [['5.7'], [FAIL_NSA_BACKDOORED_CURVE], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp521': [['5.7,d2013.62,l10.6.4'], [FAIL_NSA_BACKDOORED_CURVE], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistp521-cert-v01@openssh.com': [['5.7'], [FAIL_NSA_BACKDOORED_CURVE], [WARN_RNDSIG_KEY]],
|
||||
'ecdsa-sha2-nistt571': [[], [FAIL_UNPROVEN], [WARN_RNDSIG_KEY]],
|
||||
'eddsa-e382-shake256@libassh.org': [[], [FAIL_UNPROVEN]],
|
||||
'eddsa-e521-shake256@libassh.org': [[], [FAIL_UNPROVEN]],
|
||||
'null': [[], [FAIL_PLAINTEXT]],
|
||||
@ -200,6 +228,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'spi-sign-rsa': [[]],
|
||||
'spki-sign-dss': [[], [FAIL_1024BIT_MODULUS]],
|
||||
'spki-sign-rsa': [[], [FAIL_1024BIT_MODULUS]],
|
||||
'ssh-dsa': [[], [FAIL_1024BIT_MODULUS], [WARN_RNDSIG_KEY]],
|
||||
'ssh-dss': [['2.1.0,d0.28,l10.2', '6.9'], [FAIL_1024BIT_MODULUS], [WARN_RNDSIG_KEY], [INFO_DISABLED_IN_OPENSSH70]],
|
||||
'ssh-dss-cert-v00@openssh.com': [['5.4', '6.9'], [FAIL_1024BIT_MODULUS], [WARN_RNDSIG_KEY], [INFO_DISABLED_IN_OPENSSH70]],
|
||||
'ssh-dss-cert-v01@openssh.com': [['5.6', '6.9'], [FAIL_1024BIT_MODULUS], [WARN_RNDSIG_KEY]],
|
||||
@ -241,6 +270,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'x509v3-sign-rsa': [[], [FAIL_SHA1]],
|
||||
'x509v3-sign-rsa-sha1': [[], [FAIL_SHA1]],
|
||||
'x509v3-sign-rsa-sha224@ssh.com': [[]],
|
||||
'x509v3-sign-rsa-sha256': [[]],
|
||||
'x509v3-sign-rsa-sha256@ssh.com': [[]],
|
||||
'x509v3-sign-rsa-sha384@ssh.com': [[]],
|
||||
'x509v3-sign-rsa-sha512@ssh.com': [[]],
|
||||
@ -262,6 +292,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'aes128-gcm@openssh.com': [['6.2']],
|
||||
'aes192-cbc': [['2.3.0,l10.2', '6.6', None], [], [WARN_CIPHER_MODE]],
|
||||
'aes192-ctr': [['3.7,l10.4.1']],
|
||||
'aes192-gcm@openssh.com': [[], [], [], [INFO_NEVER_IMPLEMENTED_IN_OPENSSH]],
|
||||
'aes256-cbc': [['2.3.0,d0.47,l10.2', '6.6', None], [], [WARN_CIPHER_MODE]],
|
||||
'aes256-ctr': [['3.7,d0.52,l10.4.1']],
|
||||
'aes256-gcm': [[]],
|
||||
@ -289,6 +320,10 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'camellia256-ctr@openssh.org': [[]],
|
||||
'cast128-12-cbc@ssh.com': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
|
||||
'cast128-cbc': [['2.1.0', '6.6', '7.1'], [FAIL_CAST], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
'cast128-12-cbc': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
|
||||
'cast128-12-cfb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
|
||||
'cast128-12-ecb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
|
||||
'cast128-12-ofb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
|
||||
'cast128-cfb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
|
||||
'cast128-ctr': [[], [FAIL_CAST]],
|
||||
'cast128-ecb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
|
||||
@ -297,6 +332,9 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'chacha20-poly1305@openssh.com': [['6.5'], [], [], [INFO_DEFAULT_OPENSSH_CIPHER]],
|
||||
'crypticore128@ssh.com': [[], [FAIL_UNPROVEN]],
|
||||
'des-cbc': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
'des-cfb': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
'des-ecb': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
'des-ofb': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
'des-cbc-ssh1': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
'des-cbc@ssh.com': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
'des': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
|
||||
@ -340,6 +378,12 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'AEAD_AES_256_GCM': [[]],
|
||||
'aes128-gcm': [[]],
|
||||
'aes256-gcm': [[]],
|
||||
'cbcmac-3des': [[], [FAIL_UNPROVEN, FAIL_3DES]],
|
||||
'cbcmac-aes': [[], [FAIL_UNPROVEN]],
|
||||
'cbcmac-blowfish': [[], [FAIL_UNPROVEN, FAIL_BLOWFISH]],
|
||||
'cbcmac-des': [[], [FAIL_UNPROVEN, FAIL_DES]],
|
||||
'cbcmac-rijndael': [[], [FAIL_UNPROVEN, FAIL_RIJNDAEL]],
|
||||
'cbcmac-twofish': [[], [FAIL_UNPROVEN]],
|
||||
'chacha20-poly1305@openssh.com': [[], [], [], [INFO_NEVER_IMPLEMENTED_IN_OPENSSH]], # Despite the @openssh.com tag, this was never shipped as a MAC in OpenSSH (only as a cipher); it is only implemented as a MAC in Syncplify.
|
||||
'crypticore-mac@ssh.com': [[], [FAIL_UNPROVEN]],
|
||||
'hmac-md5': [['2.1.0,d0.28', '6.6', '7.1'], [FAIL_MD5], [WARN_ENCRYPT_AND_MAC]],
|
||||
@ -369,6 +413,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'hmac-sha2-512-etm@openssh.com': [['6.2']],
|
||||
'hmac-sha256-2@ssh.com': [[], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'hmac-sha256-96@ssh.com': [[], [], [WARN_ENCRYPT_AND_MAC, WARN_TAG_SIZE]],
|
||||
'hmac-sha256-96': [[], [], [WARN_ENCRYPT_AND_MAC, WARN_TAG_SIZE]],
|
||||
'hmac-sha256@ssh.com': [[], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'hmac-sha256': [[], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'hmac-sha2-56': [[], [], [WARN_TAG_SIZE, WARN_ENCRYPT_AND_MAC]],
|
||||
@ -380,7 +425,14 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'hmac-sha512@ssh.com': [[], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'hmac-sha512': [[], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'hmac-whirlpool': [[], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'md5': [[], [FAIL_PLAINTEXT]],
|
||||
'md5-8': [[], [FAIL_PLAINTEXT]],
|
||||
'none': [['d2013.56'], [FAIL_PLAINTEXT]],
|
||||
'ripemd160': [[], [FAIL_PLAINTEXT]],
|
||||
'ripemd160-8': [[], [FAIL_PLAINTEXT]],
|
||||
'sha1': [[], [FAIL_PLAINTEXT]],
|
||||
'sha1-8': [[], [FAIL_PLAINTEXT]],
|
||||
'umac-128': [[], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'umac-128-etm@openssh.com': [['6.2']],
|
||||
'umac-128@openssh.com': [['6.2'], [], [WARN_ENCRYPT_AND_MAC]],
|
||||
'umac-32@openssh.com': [[], [], [WARN_ENCRYPT_AND_MAC, WARN_TAG_SIZE], [INFO_NEVER_IMPLEMENTED_IN_OPENSSH]],
|
||||
@ -389,3 +441,24 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
|
||||
'umac-96@openssh.com': [[], [], [WARN_ENCRYPT_AND_MAC], [INFO_NEVER_IMPLEMENTED_IN_OPENSSH]],
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@staticmethod
|
||||
def get_db() -> Dict[str, Dict[str, List[List[Optional[str]]]]]:
|
||||
'''Returns a copy of the MASTER_DB that is private to the calling thread. This prevents multiple threads from polluting the results of other threads.'''
|
||||
calling_thread_id = threading.get_ident()
|
||||
|
||||
if calling_thread_id not in SSH2_KexDB.DB_PER_THREAD:
|
||||
SSH2_KexDB.DB_PER_THREAD[calling_thread_id] = copy.deepcopy(SSH2_KexDB.MASTER_DB)
|
||||
|
||||
return SSH2_KexDB.DB_PER_THREAD[calling_thread_id]
|
||||
|
||||
|
||||
@staticmethod
|
||||
def thread_exit() -> None:
|
||||
'''Deletes the calling thread's copy of the MASTER_DB. This is needed because, in rare circumstances, a terminated thread's ID can be re-used by new threads.'''
|
||||
|
||||
calling_thread_id = threading.get_ident()
|
||||
|
||||
if calling_thread_id in SSH2_KexDB.DB_PER_THREAD:
|
||||
del SSH2_KexDB.DB_PER_THREAD[calling_thread_id]
|
||||
|
||||
@ -195,6 +195,7 @@ def output_algorithm(out: OutputBuffer, alg_db: Dict[str, Dict[str, List[List[Op
|
||||
|
||||
alg_name = alg_name_with_size if alg_name_with_size is not None else alg_name
|
||||
first = True
|
||||
use_good_for_all = False
|
||||
for level, text in texts:
|
||||
if level == 'fail':
|
||||
program_retval = exitcodes.FAILURE
|
||||
@ -203,9 +204,13 @@ def output_algorithm(out: OutputBuffer, alg_db: Dict[str, Dict[str, List[List[Op
|
||||
|
||||
f = getattr(out, level)
|
||||
comment = (padding + ' -- [' + level + '] ' + text) if text != '' else ''
|
||||
|
||||
# If the first algorithm's comment is an 'info', this implies that it is rated good. Hence, the out.good() function should be used to write all subsequent notes for this algorithm as well.
|
||||
if (first and level == 'info') or use_good_for_all:
|
||||
f = out.good
|
||||
use_good_for_all = True
|
||||
|
||||
if first:
|
||||
if first and level == 'info':
|
||||
f = out.good
|
||||
f(prefix + alg_name + comment)
|
||||
first = False
|
||||
else: # pylint: disable=else-if-used
|
||||
@ -379,6 +384,12 @@ def output_recommendations(out: OutputBuffer, algs: Algorithms, algorithm_recomm
|
||||
ret = False
|
||||
return ret
|
||||
|
||||
level_to_output = {
|
||||
"informational": out.good,
|
||||
"warning": out.warn,
|
||||
"critical": out.fail
|
||||
}
|
||||
|
||||
with out:
|
||||
recommendations = get_algorithm_recommendations(algs, algorithm_recommendation_suppress_list, software, for_server=True)
|
||||
|
||||
@ -391,15 +402,15 @@ def output_recommendations(out: OutputBuffer, algs: Algorithms, algorithm_recomm
|
||||
|
||||
p = '' if out.batch else ' ' * (padlen - len(name))
|
||||
|
||||
fn = level_to_output[level]
|
||||
|
||||
if action == 'del':
|
||||
an, sg, fn = 'remove', '-', out.warn
|
||||
an, sg = 'remove', '-'
|
||||
ret = False
|
||||
if level == 'critical':
|
||||
fn = out.fail
|
||||
elif action == 'add':
|
||||
an, sg, fn = 'append', '+', out.good
|
||||
an, sg = 'append', '+'
|
||||
elif action == 'chg':
|
||||
an, sg, fn = 'change', '!', out.fail
|
||||
an, sg = 'change', '!'
|
||||
ret = False
|
||||
|
||||
if notes != '':
|
||||
@ -446,10 +457,11 @@ def post_process_findings(banner: Optional[Banner], algs: Algorithms) -> List[st
|
||||
if (algs.ssh2kex is not None and 'diffie-hellman-group-exchange-sha256' in algs.ssh2kex.kex_algorithms and 'diffie-hellman-group-exchange-sha256' in algs.ssh2kex.dh_modulus_sizes() and algs.ssh2kex.dh_modulus_sizes()['diffie-hellman-group-exchange-sha256'] == 2048) and (banner is not None and banner.software is not None and banner.software.find('OpenSSH') != -1):
|
||||
|
||||
# Ensure a list for notes exists.
|
||||
while len(SSH2_KexDB.ALGORITHMS['kex']['diffie-hellman-group-exchange-sha256']) < 4:
|
||||
SSH2_KexDB.ALGORITHMS['kex']['diffie-hellman-group-exchange-sha256'].append([])
|
||||
db = SSH2_KexDB.get_db()
|
||||
while len(db['kex']['diffie-hellman-group-exchange-sha256']) < 4:
|
||||
db['kex']['diffie-hellman-group-exchange-sha256'].append([])
|
||||
|
||||
SSH2_KexDB.ALGORITHMS['kex']['diffie-hellman-group-exchange-sha256'][3].append("A bug in OpenSSH causes it to fall back to a 2048-bit modulus regardless of server configuration (https://bugzilla.mindrot.org/show_bug.cgi?id=2793)")
|
||||
db['kex']['diffie-hellman-group-exchange-sha256'][3].append("A bug in OpenSSH causes it to fall back to a 2048-bit modulus regardless of server configuration (https://bugzilla.mindrot.org/show_bug.cgi?id=2793)")
|
||||
|
||||
# Ensure that this algorithm doesn't appear in the recommendations section since the user cannot control this OpenSSH bug.
|
||||
algorithm_recommendation_suppress_list.append('diffie-hellman-group-exchange-sha256')
|
||||
@ -522,7 +534,7 @@ def output(out: OutputBuffer, aconf: AuditConf, banner: Optional[Banner], header
|
||||
|
||||
# SSHv1
|
||||
if pkm is not None:
|
||||
adb = SSH1_KexDB.ALGORITHMS
|
||||
adb = SSH1_KexDB.get_db()
|
||||
ciphers = pkm.supported_ciphers
|
||||
auths = pkm.supported_authentications
|
||||
title, atype = 'SSH1 host-key algorithms', 'key'
|
||||
@ -534,7 +546,7 @@ def output(out: OutputBuffer, aconf: AuditConf, banner: Optional[Banner], header
|
||||
|
||||
# SSHv2
|
||||
if kex is not None:
|
||||
adb = SSH2_KexDB.ALGORITHMS
|
||||
adb = SSH2_KexDB.get_db()
|
||||
title, atype = 'key exchange algorithms', 'kex'
|
||||
program_retval = output_algorithms(out, title, adb, atype, kex.kex_algorithms, unknown_algorithms, aconf.json, program_retval, maxlen, dh_modulus_sizes=kex.dh_modulus_sizes())
|
||||
title, atype = 'host-key algorithms', 'key'
|
||||
@ -889,13 +901,41 @@ def process_commandline(out: OutputBuffer, args: List[str], usage_cb: Callable[.
|
||||
|
||||
def build_struct(target_host: str, banner: Optional['Banner'], cves: List[Dict[str, Union[str, float]]], kex: Optional['SSH2_Kex'] = None, pkm: Optional['SSH1_PublicKeyMessage'] = None, client_host: Optional[str] = None, software: Optional[Software] = None, algorithms: Optional[Algorithms] = None, algorithm_recommendation_suppress_list: Optional[List[str]] = None) -> Any: # pylint: disable=too-many-arguments
|
||||
|
||||
def fetch_notes(algorithm: str, alg_type: str) -> Dict[str, List[Optional[str]]]:
|
||||
'''Returns a dictionary containing the messages in the "fail", "warn", and "info" levels for this algorithm.'''
|
||||
alg_db = SSH2_KexDB.get_db()
|
||||
alg_info = {}
|
||||
if algorithm in alg_db[alg_type]:
|
||||
alg_desc = alg_db[alg_type][algorithm]
|
||||
alg_desc_len = len(alg_desc)
|
||||
|
||||
# If a list for the failure notes exists, add it to the return value. Similarly, add the related lists for the warnings and informational notes.
|
||||
if (alg_desc_len >= 2) and (len(alg_desc[1]) > 0):
|
||||
alg_info["fail"] = alg_desc[1]
|
||||
if (alg_desc_len >= 3) and (len(alg_desc[2]) > 0):
|
||||
alg_info["warn"] = alg_desc[2]
|
||||
if (alg_desc_len >= 4) and (len(alg_desc[3]) > 0):
|
||||
alg_info["info"] = alg_desc[3]
|
||||
|
||||
# Add information about when this algorithm was implemented in OpenSSH/Dropbear.
|
||||
since_text = Algorithm.get_since_text(alg_desc[0])
|
||||
if (since_text is not None) and (len(since_text) > 0):
|
||||
# Add the "info" key with an empty list if the if-block above didn't create it already.
|
||||
if "info" not in alg_info:
|
||||
alg_info["info"] = []
|
||||
alg_info["info"].append(since_text)
|
||||
else:
|
||||
alg_info["fail"] = [SSH2_KexDB.FAIL_UNKNOWN]
|
||||
|
||||
return alg_info
|
||||
|
||||
banner_str = ''
|
||||
banner_protocol = None
|
||||
banner_software = None
|
||||
banner_comments = None
|
||||
if banner is not None:
|
||||
banner_str = str(banner)
|
||||
banner_protocol = banner.protocol
|
||||
banner_protocol = '.'.join(str(x) for x in banner.protocol)
|
||||
banner_software = banner.software
|
||||
banner_comments = banner.comments
|
||||
|
||||
@ -920,19 +960,22 @@ def build_struct(target_host: str, banner: Optional['Banner'], cves: List[Dict[s
|
||||
res['kex'] = []
|
||||
dh_alg_sizes = kex.dh_modulus_sizes()
|
||||
for algorithm in kex.kex_algorithms:
|
||||
alg_notes = fetch_notes(algorithm, 'kex')
|
||||
entry: Any = {
|
||||
'algorithm': algorithm,
|
||||
'notes': alg_notes,
|
||||
}
|
||||
if algorithm in dh_alg_sizes:
|
||||
hostkey_size = dh_alg_sizes[algorithm]
|
||||
entry['keysize'] = hostkey_size
|
||||
res['kex'].append(entry)
|
||||
|
||||
res['key'] = []
|
||||
host_keys = kex.host_keys()
|
||||
for algorithm in kex.key_algorithms:
|
||||
alg_notes = fetch_notes(algorithm, 'key')
|
||||
entry = {
|
||||
'algorithm': algorithm,
|
||||
'notes': alg_notes,
|
||||
}
|
||||
if algorithm in host_keys:
|
||||
hostkey_info = host_keys[algorithm]
|
||||
@ -952,8 +995,24 @@ def build_struct(target_host: str, banner: Optional['Banner'], cves: List[Dict[s
|
||||
entry['casize'] = ca_size
|
||||
res['key'].append(entry)
|
||||
|
||||
res['enc'] = kex.server.encryption
|
||||
res['mac'] = kex.server.mac
|
||||
res['enc'] = []
|
||||
for algorithm in kex.server.encryption:
|
||||
alg_notes = fetch_notes(algorithm, 'enc')
|
||||
entry = {
|
||||
'algorithm': algorithm,
|
||||
'notes': alg_notes,
|
||||
}
|
||||
res['enc'].append(entry)
|
||||
|
||||
res['mac'] = []
|
||||
for algorithm in kex.server.mac:
|
||||
alg_notes = fetch_notes(algorithm, 'mac')
|
||||
entry = {
|
||||
'algorithm': algorithm,
|
||||
'notes': alg_notes,
|
||||
}
|
||||
res['mac'].append(entry)
|
||||
|
||||
res['fingerprints'] = []
|
||||
host_keys = kex.host_keys()
|
||||
|
||||
@ -1093,7 +1152,7 @@ def audit(out: OutputBuffer, aconf: AuditConf, sshv: Optional[int] = None, print
|
||||
if aconf.gex_test != '':
|
||||
return run_gex_granular_modulus_size_test(out, s, kex, aconf)
|
||||
else:
|
||||
GEXTest.run(out, s, kex)
|
||||
GEXTest.run(out, s, banner, kex)
|
||||
|
||||
# This is a standard audit scan.
|
||||
if (aconf.policy is None) and (aconf.make_policy is False):
|
||||
@ -1124,7 +1183,7 @@ def algorithm_lookup(out: OutputBuffer, alg_names: str) -> int:
|
||||
}
|
||||
|
||||
algorithm_names = alg_names.split(",")
|
||||
adb = SSH2_KexDB.ALGORITHMS
|
||||
adb = SSH2_KexDB.get_db()
|
||||
|
||||
# Use nested dictionary comprehension to iterate an outer dictionary where
|
||||
# each key is an alg type that consists of a value (which is itself a
|
||||
@ -1376,6 +1435,10 @@ def main() -> int:
|
||||
if aconf.json:
|
||||
print(']')
|
||||
|
||||
# Send notification that this thread is exiting. This deletes the thread's local copy of the algorithm databases.
|
||||
SSH1_KexDB.thread_exit()
|
||||
SSH2_KexDB.thread_exit()
|
||||
|
||||
else: # Just a scan against a single target.
|
||||
ret = audit(out, aconf)
|
||||
out.write()
|
||||
|
||||
@ -75,24 +75,26 @@ class SSH_Socket(ReadBuf, WriteBuf):
|
||||
self.client_port = None
|
||||
|
||||
def _resolve(self) -> Iterable[Tuple[int, Tuple[Any, ...]]]:
|
||||
"""Resolves a hostname into a list of IPs
|
||||
Raises
|
||||
------
|
||||
socket.gaierror [Errno -2]
|
||||
If the hostname cannot be resolved.
|
||||
"""
|
||||
# If __ip_version_preference has only one entry, then it means that ONLY that IP version should be used.
|
||||
if len(self.__ip_version_preference) == 1:
|
||||
family = socket.AF_INET if self.__ip_version_preference[0] == 4 else socket.AF_INET6
|
||||
else:
|
||||
family = socket.AF_UNSPEC
|
||||
try:
|
||||
stype = socket.SOCK_STREAM
|
||||
r = socket.getaddrinfo(self.__host, self.__port, family, stype)
|
||||
stype = socket.SOCK_STREAM
|
||||
r = socket.getaddrinfo(self.__host, self.__port, family, stype)
|
||||
|
||||
# If the user has a preference for using IPv4 over IPv6 (or vice-versa), then sort the list returned by getaddrinfo() so that the preferred address type comes first.
|
||||
if len(self.__ip_version_preference) == 2:
|
||||
r = sorted(r, key=lambda x: x[0], reverse=(self.__ip_version_preference[0] == 6)) # pylint: disable=superfluous-parens
|
||||
for af, socktype, _proto, _canonname, addr in r:
|
||||
if socktype == socket.SOCK_STREAM:
|
||||
yield af, addr
|
||||
except socket.error as e:
|
||||
self.__outputbuffer.fail('[exception] {}'.format(e)).write()
|
||||
sys.exit(exitcodes.CONNECTION_ERROR)
|
||||
# If the user has a preference for using IPv4 over IPv6 (or vice-versa), then sort the list returned by getaddrinfo() so that the preferred address type comes first.
|
||||
if len(self.__ip_version_preference) == 2:
|
||||
r = sorted(r, key=lambda x: x[0], reverse=(self.__ip_version_preference[0] == 6)) # pylint: disable=superfluous-parens
|
||||
for af, socktype, _proto, _canonname, addr in r:
|
||||
if socktype == socket.SOCK_STREAM:
|
||||
yield af, addr
|
||||
|
||||
# Listens on a server socket and accepts one connection (used for
|
||||
# auditing client connections).
|
||||
@ -105,8 +107,8 @@ class SSH_Socket(ReadBuf, WriteBuf):
|
||||
s.bind(('0.0.0.0', self.__port))
|
||||
s.listen()
|
||||
self.__sock_map[s.fileno()] = s
|
||||
except Exception:
|
||||
print("Warning: failed to listen on any IPv4 interfaces.")
|
||||
except Exception as e:
|
||||
print("Warning: failed to listen on any IPv4 interfaces: %s" % str(e))
|
||||
|
||||
try:
|
||||
# Socket to listen on all IPv6 addresses.
|
||||
@ -116,8 +118,8 @@ class SSH_Socket(ReadBuf, WriteBuf):
|
||||
s.bind(('::', self.__port))
|
||||
s.listen()
|
||||
self.__sock_map[s.fileno()] = s
|
||||
except Exception:
|
||||
print("Warning: failed to listen on any IPv6 interfaces.")
|
||||
except Exception as e:
|
||||
print("Warning: failed to listen on any IPv6 interfaces: %s" % str(e))
|
||||
|
||||
# If we failed to listen on any interfaces, terminate.
|
||||
if len(self.__sock_map.keys()) == 0:
|
||||
@ -152,18 +154,18 @@ class SSH_Socket(ReadBuf, WriteBuf):
|
||||
def connect(self) -> Optional[str]:
|
||||
'''Returns None on success, or an error string.'''
|
||||
err = None
|
||||
for af, addr in self._resolve():
|
||||
s = None
|
||||
try:
|
||||
s = None
|
||||
try:
|
||||
for af, addr in self._resolve():
|
||||
s = socket.socket(af, socket.SOCK_STREAM)
|
||||
s.settimeout(self.__timeout)
|
||||
self.__outputbuffer.d(("Connecting to %s:%d..." % ('[%s]' % addr[0] if Utils.is_ipv6_address(addr[0]) else addr[0], addr[1])), write_now=True)
|
||||
s.connect(addr)
|
||||
self.__sock = s
|
||||
return None
|
||||
except socket.error as e:
|
||||
err = e
|
||||
self._close_socket(s)
|
||||
except socket.error as e:
|
||||
err = e
|
||||
self._close_socket(s)
|
||||
if err is None:
|
||||
errm = 'host {} has no DNS records'.format(self.__host)
|
||||
else:
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-dropbear_2019.78",
|
||||
"software": "dropbear_2019.78"
|
||||
},
|
||||
@ -14,12 +11,70 @@
|
||||
],
|
||||
"cves": [],
|
||||
"enc": [
|
||||
"aes128-ctr",
|
||||
"aes256-ctr",
|
||||
"aes128-cbc",
|
||||
"aes256-cbc",
|
||||
"3des-ctr",
|
||||
"3des-cbc"
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-ctr",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -35,46 +90,175 @@
|
||||
],
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "curve25519-sha256"
|
||||
"algorithm": "curve25519-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "curve25519-sha256@libssh.org"
|
||||
"algorithm": "curve25519-sha256@libssh.org",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp521"
|
||||
"algorithm": "ecdh-sha2-nistp521",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp384"
|
||||
"algorithm": "ecdh-sha2-nistp384",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp256"
|
||||
"algorithm": "ecdh-sha2-nistp256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha256"
|
||||
"algorithm": "diffie-hellman-group14-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.3, Dropbear SSH 2016.73"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "kexguess2@matt.ucc.asn.au"
|
||||
"algorithm": "kexguess2@matt.ucc.asn.au",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since Dropbear SSH 2013.57"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ecdsa-sha2-nistp256"
|
||||
"algorithm": "ecdsa-sha2-nistp256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
],
|
||||
"warn": [
|
||||
"using weak random number generator could reveal the key"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-dss"
|
||||
"algorithm": "ssh-dss",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak random number generator could reveal the key"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-sha1-96",
|
||||
"hmac-sha1",
|
||||
"hmac-sha2-256"
|
||||
{
|
||||
"algorithm": "hmac-sha1-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 5.9, Dropbear SSH 2013.56"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -6,9 +6,9 @@
|
||||
|
||||
[0;36m# key exchange algorithms[0m
|
||||
[0;32m(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;32m(kex) curve25519-sha256@libssh.org -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;31m(kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
|
||||
[0;31m(kex) ecdh-sha2-nistp384 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
1,
|
||||
99
|
||||
],
|
||||
"protocol": "1.99",
|
||||
"raw": "SSH-1.99-OpenSSH_4.0",
|
||||
"software": "OpenSSH_4.0"
|
||||
},
|
||||
@ -125,17 +122,134 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"aes128-cbc",
|
||||
"3des-cbc",
|
||||
"blowfish-cbc",
|
||||
"cast128-cbc",
|
||||
"arcfour",
|
||||
"aes192-cbc",
|
||||
"aes256-cbc",
|
||||
"rijndael-cbc@lysator.liu.se",
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr"
|
||||
{
|
||||
"algorithm": "aes128-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "blowfish-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated Blowfish cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "cast128-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated CAST cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "rijndael-cbc@lysator.liu.se",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated & non-standardized Rijndael cipher"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -152,31 +266,161 @@
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha1",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group1-sha1"
|
||||
"algorithm": "diffie-hellman-group1-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus",
|
||||
"vulnerable to the Logjam attack: https://en.wikipedia.org/wiki/Logjam_(computer_security)",
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"removed in OpenSSH 6.9: https://www.openssh.com/txt/release-6.9",
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-dss"
|
||||
"algorithm": "ssh-dss",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak random number generator could reveal the key"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-md5",
|
||||
"hmac-sha1",
|
||||
"hmac-ripemd160",
|
||||
"hmac-ripemd160@openssh.com",
|
||||
"hmac-sha1-96",
|
||||
"hmac-md5-96"
|
||||
{
|
||||
"algorithm": "hmac-md5",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-md5-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_5.6",
|
||||
"software": "OpenSSH_5.6"
|
||||
},
|
||||
@ -90,19 +87,156 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr",
|
||||
"arcfour256",
|
||||
"arcfour128",
|
||||
"aes128-cbc",
|
||||
"3des-cbc",
|
||||
"blowfish-cbc",
|
||||
"cast128-cbc",
|
||||
"aes192-cbc",
|
||||
"aes256-cbc",
|
||||
"arcfour",
|
||||
"rijndael-cbc@lysator.liu.se"
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour128",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "blowfish-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated Blowfish cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "cast128-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated CAST cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "rijndael-cbc@lysator.liu.se",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated & non-standardized Rijndael cipher"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -119,36 +253,185 @@
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha1",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group1-sha1"
|
||||
"algorithm": "diffie-hellman-group1-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus",
|
||||
"vulnerable to the Logjam attack: https://en.wikipedia.org/wiki/Logjam_(computer_security)",
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"removed in OpenSSH 6.9: https://www.openssh.com/txt/release-6.9",
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-dss"
|
||||
"algorithm": "ssh-dss",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak random number generator could reveal the key"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-md5",
|
||||
"hmac-sha1",
|
||||
"umac-64@openssh.com",
|
||||
"hmac-ripemd160",
|
||||
"hmac-ripemd160@openssh.com",
|
||||
"hmac-sha1-96",
|
||||
"hmac-md5-96"
|
||||
{
|
||||
"algorithm": "hmac-md5",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-64@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 4.7"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode",
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-md5-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_5.6",
|
||||
"software": "OpenSSH_5.6"
|
||||
},
|
||||
@ -90,19 +87,156 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr",
|
||||
"arcfour256",
|
||||
"arcfour128",
|
||||
"aes128-cbc",
|
||||
"3des-cbc",
|
||||
"blowfish-cbc",
|
||||
"cast128-cbc",
|
||||
"aes192-cbc",
|
||||
"aes256-cbc",
|
||||
"arcfour",
|
||||
"rijndael-cbc@lysator.liu.se"
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour128",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "blowfish-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated Blowfish cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "cast128-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated CAST cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "rijndael-cbc@lysator.liu.se",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated & non-standardized Rijndael cipher"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -119,39 +253,187 @@
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha1",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group1-sha1"
|
||||
"algorithm": "diffie-hellman-group1-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus",
|
||||
"vulnerable to the Logjam attack: https://en.wikipedia.org/wiki/Logjam_(computer_security)",
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"removed in OpenSSH 6.9: https://www.openssh.com/txt/release-6.9",
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-rsa-cert-v01@openssh.com",
|
||||
"ca_algorithm": "ssh-rsa",
|
||||
"casize": 1024,
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit hostkey modulus",
|
||||
"using small 1024-bit CA key modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 5.6"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-md5",
|
||||
"hmac-sha1",
|
||||
"umac-64@openssh.com",
|
||||
"hmac-ripemd160",
|
||||
"hmac-ripemd160@openssh.com",
|
||||
"hmac-sha1-96",
|
||||
"hmac-md5-96"
|
||||
{
|
||||
"algorithm": "hmac-md5",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-64@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 4.7"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode",
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-md5-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_5.6",
|
||||
"software": "OpenSSH_5.6"
|
||||
},
|
||||
@ -90,19 +87,156 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr",
|
||||
"arcfour256",
|
||||
"arcfour128",
|
||||
"aes128-cbc",
|
||||
"3des-cbc",
|
||||
"blowfish-cbc",
|
||||
"cast128-cbc",
|
||||
"aes192-cbc",
|
||||
"aes256-cbc",
|
||||
"arcfour",
|
||||
"rijndael-cbc@lysator.liu.se"
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour128",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "blowfish-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated Blowfish cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "cast128-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated CAST cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "rijndael-cbc@lysator.liu.se",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated & non-standardized Rijndael cipher"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -119,39 +253,186 @@
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha1",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group1-sha1"
|
||||
"algorithm": "diffie-hellman-group1-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus",
|
||||
"vulnerable to the Logjam attack: https://en.wikipedia.org/wiki/Logjam_(computer_security)",
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"removed in OpenSSH 6.9: https://www.openssh.com/txt/release-6.9",
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-rsa-cert-v01@openssh.com",
|
||||
"ca_algorithm": "ssh-rsa",
|
||||
"casize": 3072,
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit hostkey modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 5.6"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-md5",
|
||||
"hmac-sha1",
|
||||
"umac-64@openssh.com",
|
||||
"hmac-ripemd160",
|
||||
"hmac-ripemd160@openssh.com",
|
||||
"hmac-sha1-96",
|
||||
"hmac-md5-96"
|
||||
{
|
||||
"algorithm": "hmac-md5",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-64@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 4.7"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode",
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-md5-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_5.6",
|
||||
"software": "OpenSSH_5.6"
|
||||
},
|
||||
@ -90,19 +87,156 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr",
|
||||
"arcfour256",
|
||||
"arcfour128",
|
||||
"aes128-cbc",
|
||||
"3des-cbc",
|
||||
"blowfish-cbc",
|
||||
"cast128-cbc",
|
||||
"aes192-cbc",
|
||||
"aes256-cbc",
|
||||
"arcfour",
|
||||
"rijndael-cbc@lysator.liu.se"
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour128",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "blowfish-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated Blowfish cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "cast128-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated CAST cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "rijndael-cbc@lysator.liu.se",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated & non-standardized Rijndael cipher"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -119,39 +253,185 @@
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha1",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group1-sha1"
|
||||
"algorithm": "diffie-hellman-group1-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus",
|
||||
"vulnerable to the Logjam attack: https://en.wikipedia.org/wiki/Logjam_(computer_security)",
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"removed in OpenSSH 6.9: https://www.openssh.com/txt/release-6.9",
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 3072
|
||||
"keysize": 3072,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-rsa-cert-v01@openssh.com",
|
||||
"ca_algorithm": "ssh-rsa",
|
||||
"casize": 1024,
|
||||
"keysize": 3072
|
||||
"keysize": 3072,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm",
|
||||
"using small 1024-bit CA key modulus"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 5.6"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-md5",
|
||||
"hmac-sha1",
|
||||
"umac-64@openssh.com",
|
||||
"hmac-ripemd160",
|
||||
"hmac-ripemd160@openssh.com",
|
||||
"hmac-sha1-96",
|
||||
"hmac-md5-96"
|
||||
{
|
||||
"algorithm": "hmac-md5",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-64@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 4.7"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode",
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-md5-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_5.6",
|
||||
"software": "OpenSSH_5.6"
|
||||
},
|
||||
@ -90,19 +87,156 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr",
|
||||
"arcfour256",
|
||||
"arcfour128",
|
||||
"aes128-cbc",
|
||||
"3des-cbc",
|
||||
"blowfish-cbc",
|
||||
"cast128-cbc",
|
||||
"aes192-cbc",
|
||||
"aes256-cbc",
|
||||
"arcfour",
|
||||
"rijndael-cbc@lysator.liu.se"
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour128",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "3des-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken & deprecated 3DES cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "blowfish-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated Blowfish cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 1.2.2, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "cast128-cbc",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using weak & deprecated CAST cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode",
|
||||
"using small 64-bit block size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-cbc",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "arcfour",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken RC4 cipher"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "rijndael-cbc@lysator.liu.se",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated & non-standardized Rijndael cipher"
|
||||
],
|
||||
"info": [
|
||||
"disabled in OpenSSH 7.0: https://www.openssh.com/txt/release-7.0",
|
||||
"available since OpenSSH 2.3.0"
|
||||
],
|
||||
"warn": [
|
||||
"using weak cipher mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -119,39 +253,184 @@
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha1",
|
||||
"keysize": 1024
|
||||
"keysize": 1024,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.3.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group1-sha1"
|
||||
"algorithm": "diffie-hellman-group1-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using small 1024-bit modulus",
|
||||
"vulnerable to the Logjam attack: https://en.wikipedia.org/wiki/Logjam_(computer_security)",
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"removed in OpenSSH 6.9: https://www.openssh.com/txt/release-6.9",
|
||||
"available since OpenSSH 2.3.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 3072
|
||||
"keysize": 3072,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-rsa-cert-v01@openssh.com",
|
||||
"ca_algorithm": "ssh-rsa",
|
||||
"casize": 3072,
|
||||
"keysize": 3072
|
||||
"keysize": 3072,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 5.6"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-md5",
|
||||
"hmac-sha1",
|
||||
"umac-64@openssh.com",
|
||||
"hmac-ripemd160",
|
||||
"hmac-ripemd160@openssh.com",
|
||||
"hmac-sha1-96",
|
||||
"hmac-md5-96"
|
||||
{
|
||||
"algorithm": "hmac-md5",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-64@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 4.7"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode",
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-ripemd160@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using deprecated RIPEMD hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.47"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-md5-96",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken MD5 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.5.0"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -27,5 +27,5 @@
|
||||
],
|
||||
"host": "localhost",
|
||||
"passed": false,
|
||||
"policy": "Hardened OpenSSH Server v8.0 (version 2)"
|
||||
"policy": "Hardened OpenSSH Server v8.0 (version 3)"
|
||||
}
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
Host: localhost:2222
|
||||
Policy: Hardened OpenSSH Server v8.0 (version 2)
|
||||
Policy: Hardened OpenSSH Server v8.0 (version 3)
|
||||
Result: [0;31m❌ Failed![0m
|
||||
[0;33m
|
||||
Errors:
|
||||
|
||||
@ -50,5 +50,5 @@
|
||||
],
|
||||
"host": "localhost",
|
||||
"passed": false,
|
||||
"policy": "Hardened OpenSSH Server v8.0 (version 2)"
|
||||
"policy": "Hardened OpenSSH Server v8.0 (version 3)"
|
||||
}
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
Host: localhost:2222
|
||||
Policy: Hardened OpenSSH Server v8.0 (version 2)
|
||||
Policy: Hardened OpenSSH Server v8.0 (version 3)
|
||||
Result: [0;31m❌ Failed![0m
|
||||
[0;33m
|
||||
Errors:
|
||||
|
||||
@ -2,13 +2,13 @@
|
||||
"errors": [
|
||||
{
|
||||
"actual": [
|
||||
"2048"
|
||||
"4096"
|
||||
],
|
||||
"expected_optional": [
|
||||
""
|
||||
],
|
||||
"expected_required": [
|
||||
"4096"
|
||||
"8192"
|
||||
],
|
||||
"mismatched_field": "Group exchange (diffie-hellman-group-exchange-sha256) modulus sizes"
|
||||
}
|
||||
|
||||
@ -16,6 +16,6 @@ Result: [0;31m❌ Failed![0m
|
||||
[0;33m
|
||||
Errors:
|
||||
* Group exchange (diffie-hellman-group-exchange-sha256) modulus sizes did not match.
|
||||
- Expected: 4096
|
||||
- Actual: 2048
|
||||
- Expected: 8192
|
||||
- Actual: 4096
|
||||
[0m
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_8.0",
|
||||
"software": "OpenSSH_8.0"
|
||||
},
|
||||
@ -35,12 +32,55 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"chacha20-poly1305@openssh.com",
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr",
|
||||
"aes128-gcm@openssh.com",
|
||||
"aes256-gcm@openssh.com"
|
||||
{
|
||||
"algorithm": "chacha20-poly1305@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default cipher since OpenSSH 6.9",
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-gcm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-gcm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -66,68 +106,269 @@
|
||||
],
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "curve25519-sha256"
|
||||
"algorithm": "curve25519-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "curve25519-sha256@libssh.org"
|
||||
"algorithm": "curve25519-sha256@libssh.org",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp256"
|
||||
"algorithm": "ecdh-sha2-nistp256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp384"
|
||||
"algorithm": "ecdh-sha2-nistp384",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp521"
|
||||
"algorithm": "ecdh-sha2-nistp521",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 2048
|
||||
"keysize": 4096,
|
||||
"notes": {
|
||||
"info": [
|
||||
"OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).",
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group16-sha512"
|
||||
"algorithm": "diffie-hellman-group16-sha512",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.3, Dropbear SSH 2016.73"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group18-sha512"
|
||||
"algorithm": "diffie-hellman-group18-sha512",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.3"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha256"
|
||||
"algorithm": "diffie-hellman-group14-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.3, Dropbear SSH 2016.73"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "rsa-sha2-512",
|
||||
"keysize": 3072
|
||||
"keysize": 3072,
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "rsa-sha2-256",
|
||||
"keysize": 3072
|
||||
"keysize": 3072,
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-rsa",
|
||||
"keysize": 3072
|
||||
"keysize": 3072,
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8",
|
||||
"available since OpenSSH 2.5.0, Dropbear SSH 0.28"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdsa-sha2-nistp256"
|
||||
"algorithm": "ecdsa-sha2-nistp256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
],
|
||||
"warn": [
|
||||
"using weak random number generator could reveal the key"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-ed25519"
|
||||
"algorithm": "ssh-ed25519",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"umac-64-etm@openssh.com",
|
||||
"umac-128-etm@openssh.com",
|
||||
"hmac-sha2-256-etm@openssh.com",
|
||||
"hmac-sha2-512-etm@openssh.com",
|
||||
"hmac-sha1-etm@openssh.com",
|
||||
"umac-64@openssh.com",
|
||||
"umac-128@openssh.com",
|
||||
"hmac-sha2-256",
|
||||
"hmac-sha2-512",
|
||||
"hmac-sha1"
|
||||
{
|
||||
"algorithm": "umac-64-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
],
|
||||
"warn": [
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-128-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-256-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-512-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-etm@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-64@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 4.7"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode",
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-128@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 5.9, Dropbear SSH 2013.56"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-512",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 5.9, Dropbear SSH 2013.56"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -12,18 +12,17 @@
|
||||
|
||||
[0;36m# key exchange algorithms[0m
|
||||
[0;32m(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;32m(kex) curve25519-sha256@libssh.org -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;31m(kex) ecdh-sha2-nistp256 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
|
||||
[0;31m(kex) ecdh-sha2-nistp384 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
|
||||
[0;31m(kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
|
||||
[0;33m(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength[0m
|
||||
`- [info] available since OpenSSH 4.4
|
||||
`- [info] A bug in OpenSSH causes it to fall back to a 2048-bit modulus regardless of server configuration (https://bugzilla.mindrot.org/show_bug.cgi?id=2793)
|
||||
[0;32m(kex) diffie-hellman-group-exchange-sha256 (4096-bit) -- [info] available since OpenSSH 4.4[0m
|
||||
[0;32m `- [info] OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).[0m
|
||||
[0;32m(kex) diffie-hellman-group16-sha512 -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73[0m
|
||||
[0;32m(kex) diffie-hellman-group18-sha512 -- [info] available since OpenSSH 7.3[0m
|
||||
[0;33m(kex) diffie-hellman-group14-sha256 -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength[0m
|
||||
@ -45,7 +44,7 @@
|
||||
|
||||
[0;36m# encryption algorithms (ciphers)[0m
|
||||
[0;32m(enc) chacha20-poly1305@openssh.com -- [info] available since OpenSSH 6.5[0m
|
||||
`- [info] default cipher since OpenSSH 6.9
|
||||
[0;32m `- [info] default cipher since OpenSSH 6.9[0m
|
||||
[0;32m(enc) aes128-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52[0m
|
||||
[0;32m(enc) aes192-ctr -- [info] available since OpenSSH 3.7[0m
|
||||
[0;32m(enc) aes256-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52[0m
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_8.0",
|
||||
"software": "OpenSSH_8.0"
|
||||
},
|
||||
@ -35,12 +32,55 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"chacha20-poly1305@openssh.com",
|
||||
"aes128-ctr",
|
||||
"aes192-ctr",
|
||||
"aes256-ctr",
|
||||
"aes128-gcm@openssh.com",
|
||||
"aes256-gcm@openssh.com"
|
||||
{
|
||||
"algorithm": "chacha20-poly1305@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default cipher since OpenSSH 6.9",
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-gcm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-gcm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -56,58 +96,234 @@
|
||||
],
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "curve25519-sha256"
|
||||
"algorithm": "curve25519-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "curve25519-sha256@libssh.org"
|
||||
"algorithm": "curve25519-sha256@libssh.org",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp256"
|
||||
"algorithm": "ecdh-sha2-nistp256",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp384"
|
||||
"algorithm": "ecdh-sha2-nistp384",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ecdh-sha2-nistp521"
|
||||
"algorithm": "ecdh-sha2-nistp521",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 5.7, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 2048
|
||||
"keysize": 4096,
|
||||
"notes": {
|
||||
"info": [
|
||||
"OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).",
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group16-sha512"
|
||||
"algorithm": "diffie-hellman-group16-sha512",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.3, Dropbear SSH 2016.73"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group18-sha512"
|
||||
"algorithm": "diffie-hellman-group18-sha512",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.3"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha256"
|
||||
"algorithm": "diffie-hellman-group14-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 7.3, Dropbear SSH 2016.73"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group14-sha1"
|
||||
"algorithm": "diffie-hellman-group14-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 3.9, Dropbear SSH 0.53"
|
||||
],
|
||||
"warn": [
|
||||
"2048-bit modulus only provides 112-bits of symmetric strength"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-ed25519"
|
||||
"algorithm": "ssh-ed25519",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "ssh-ed25519-cert-v01@openssh.com",
|
||||
"ca_algorithm": "ssh-ed25519",
|
||||
"casize": 256
|
||||
"casize": 256,
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"umac-64-etm@openssh.com",
|
||||
"umac-128-etm@openssh.com",
|
||||
"hmac-sha2-256-etm@openssh.com",
|
||||
"hmac-sha2-512-etm@openssh.com",
|
||||
"hmac-sha1-etm@openssh.com",
|
||||
"umac-64@openssh.com",
|
||||
"umac-128@openssh.com",
|
||||
"hmac-sha2-256",
|
||||
"hmac-sha2-512",
|
||||
"hmac-sha1"
|
||||
{
|
||||
"algorithm": "umac-64-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
],
|
||||
"warn": [
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-128-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-256-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-512-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1-etm@openssh.com",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-64@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 4.7"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode",
|
||||
"using small 64-bit tag size"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-128@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 5.9, Dropbear SSH 2013.56"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-512",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 5.9, Dropbear SSH 2013.56"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha1",
|
||||
"notes": {
|
||||
"fail": [
|
||||
"using broken SHA-1 hash algorithm"
|
||||
],
|
||||
"info": [
|
||||
"available since OpenSSH 2.1.0, Dropbear SSH 0.28"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"critical": {
|
||||
|
||||
@ -12,18 +12,17 @@
|
||||
|
||||
[0;36m# key exchange algorithms[0m
|
||||
[0;32m(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;32m(kex) curve25519-sha256@libssh.org -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;31m(kex) ecdh-sha2-nistp256 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
|
||||
[0;31m(kex) ecdh-sha2-nistp384 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
|
||||
[0;31m(kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency[0m
|
||||
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
|
||||
[0;33m(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength[0m
|
||||
`- [info] available since OpenSSH 4.4
|
||||
`- [info] A bug in OpenSSH causes it to fall back to a 2048-bit modulus regardless of server configuration (https://bugzilla.mindrot.org/show_bug.cgi?id=2793)
|
||||
[0;32m(kex) diffie-hellman-group-exchange-sha256 (4096-bit) -- [info] available since OpenSSH 4.4[0m
|
||||
[0;32m `- [info] OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).[0m
|
||||
[0;32m(kex) diffie-hellman-group16-sha512 -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73[0m
|
||||
[0;32m(kex) diffie-hellman-group18-sha512 -- [info] available since OpenSSH 7.3[0m
|
||||
[0;33m(kex) diffie-hellman-group14-sha256 -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength[0m
|
||||
@ -38,7 +37,7 @@
|
||||
|
||||
[0;36m# encryption algorithms (ciphers)[0m
|
||||
[0;32m(enc) chacha20-poly1305@openssh.com -- [info] available since OpenSSH 6.5[0m
|
||||
`- [info] default cipher since OpenSSH 6.9
|
||||
[0;32m `- [info] default cipher since OpenSSH 6.9[0m
|
||||
[0;32m(enc) aes128-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52[0m
|
||||
[0;32m(enc) aes192-ctr -- [info] available since OpenSSH 3.7[0m
|
||||
[0;32m(enc) aes256-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52[0m
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": null,
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "SSH-2.0-OpenSSH_8.0",
|
||||
"software": "OpenSSH_8.0"
|
||||
},
|
||||
@ -35,12 +32,55 @@
|
||||
}
|
||||
],
|
||||
"enc": [
|
||||
"chacha20-poly1305@openssh.com",
|
||||
"aes256-gcm@openssh.com",
|
||||
"aes128-gcm@openssh.com",
|
||||
"aes256-ctr",
|
||||
"aes192-ctr",
|
||||
"aes128-ctr"
|
||||
{
|
||||
"algorithm": "chacha20-poly1305@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default cipher since OpenSSH 6.9",
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-gcm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-gcm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes256-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes192-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "aes128-ctr",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 3.7, Dropbear SSH 0.52"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -56,25 +96,69 @@
|
||||
],
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "curve25519-sha256"
|
||||
"algorithm": "curve25519-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "curve25519-sha256@libssh.org"
|
||||
"algorithm": "curve25519-sha256@libssh.org",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "diffie-hellman-group-exchange-sha256",
|
||||
"keysize": 2048
|
||||
"keysize": 4096,
|
||||
"notes": {
|
||||
"info": [
|
||||
"OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).",
|
||||
"available since OpenSSH 4.4"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-ed25519"
|
||||
"algorithm": "ssh-ed25519",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-sha2-256-etm@openssh.com",
|
||||
"hmac-sha2-512-etm@openssh.com",
|
||||
"umac-128-etm@openssh.com"
|
||||
{
|
||||
"algorithm": "hmac-sha2-256-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "hmac-sha2-512-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "umac-128-etm@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.2"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {
|
||||
"informational": {
|
||||
|
||||
@ -12,19 +12,18 @@
|
||||
|
||||
[0;36m# key exchange algorithms[0m
|
||||
[0;32m(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;32m(kex) curve25519-sha256@libssh.org -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;33m(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength[0m
|
||||
`- [info] available since OpenSSH 4.4
|
||||
`- [info] A bug in OpenSSH causes it to fall back to a 2048-bit modulus regardless of server configuration (https://bugzilla.mindrot.org/show_bug.cgi?id=2793)
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;32m(kex) diffie-hellman-group-exchange-sha256 (4096-bit) -- [info] available since OpenSSH 4.4[0m
|
||||
[0;32m `- [info] OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).[0m
|
||||
|
||||
[0;36m# host-key algorithms[0m
|
||||
[0;32m(key) ssh-ed25519 -- [info] available since OpenSSH 6.5[0m
|
||||
|
||||
[0;36m# encryption algorithms (ciphers)[0m
|
||||
[0;32m(enc) chacha20-poly1305@openssh.com -- [info] available since OpenSSH 6.5[0m
|
||||
`- [info] default cipher since OpenSSH 6.9
|
||||
[0;32m `- [info] default cipher since OpenSSH 6.9[0m
|
||||
[0;32m(enc) aes256-gcm@openssh.com -- [info] available since OpenSSH 6.2[0m
|
||||
[0;32m(enc) aes128-gcm@openssh.com -- [info] available since OpenSSH 6.2[0m
|
||||
[0;32m(enc) aes256-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52[0m
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{
|
||||
"banner": {
|
||||
"comments": "",
|
||||
"protocol": [
|
||||
2,
|
||||
0
|
||||
],
|
||||
"protocol": "2.0",
|
||||
"raw": "",
|
||||
"software": "tinyssh_noversion"
|
||||
},
|
||||
@ -13,7 +10,15 @@
|
||||
],
|
||||
"cves": [],
|
||||
"enc": [
|
||||
"chacha20-poly1305@openssh.com"
|
||||
{
|
||||
"algorithm": "chacha20-poly1305@openssh.com",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default cipher since OpenSSH 6.9",
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"fingerprints": [
|
||||
{
|
||||
@ -29,22 +34,58 @@
|
||||
],
|
||||
"kex": [
|
||||
{
|
||||
"algorithm": "curve25519-sha256"
|
||||
"algorithm": "curve25519-sha256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "curve25519-sha256@libssh.org"
|
||||
"algorithm": "curve25519-sha256@libssh.org",
|
||||
"notes": {
|
||||
"info": [
|
||||
"default key exchange since OpenSSH 6.4",
|
||||
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"algorithm": "sntrup4591761x25519-sha512@tinyssh.org"
|
||||
"algorithm": "sntrup4591761x25519-sha512@tinyssh.org",
|
||||
"notes": {
|
||||
"info": [
|
||||
"the sntrup4591761 algorithm was withdrawn, as it may not provide strong post-quantum security",
|
||||
"available since OpenSSH 8.0"
|
||||
],
|
||||
"warn": [
|
||||
"using experimental algorithm"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"key": [
|
||||
{
|
||||
"algorithm": "ssh-ed25519"
|
||||
"algorithm": "ssh-ed25519",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 6.5"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"mac": [
|
||||
"hmac-sha2-256"
|
||||
{
|
||||
"algorithm": "hmac-sha2-256",
|
||||
"notes": {
|
||||
"info": [
|
||||
"available since OpenSSH 5.9, Dropbear SSH 2013.56"
|
||||
],
|
||||
"warn": [
|
||||
"using encrypt-and-MAC mode"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"recommendations": {},
|
||||
"target": "localhost:2222"
|
||||
|
||||
@ -5,9 +5,9 @@
|
||||
|
||||
[0;36m# key exchange algorithms[0m
|
||||
[0;32m(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;32m(kex) curve25519-sha256@libssh.org -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62[0m
|
||||
`- [info] default key exchange since OpenSSH 6.4
|
||||
[0;32m `- [info] default key exchange since OpenSSH 6.4[0m
|
||||
[0;33m(kex) sntrup4591761x25519-sha512@tinyssh.org -- [warn] using experimental algorithm[0m
|
||||
`- [info] available since OpenSSH 8.0
|
||||
`- [info] the sntrup4591761 algorithm was withdrawn, as it may not provide strong post-quantum security
|
||||
@ -17,7 +17,7 @@
|
||||
|
||||
[0;36m# encryption algorithms (ciphers)[0m
|
||||
[0;32m(enc) chacha20-poly1305@openssh.com -- [info] available since OpenSSH 6.5[0m
|
||||
`- [info] default cipher since OpenSSH 6.9
|
||||
[0;32m `- [info] default cipher since OpenSSH 6.9[0m
|
||||
|
||||
[0;36m# message authentication code algorithms[0m
|
||||
[0;33m(mac) hmac-sha2-256 -- [warn] using encrypt-and-MAC mode[0m
|
||||
|
||||
@ -23,7 +23,7 @@ hostkey_size_rsa-sha2-512 = 3072
|
||||
hostkey_size_ssh-rsa = 3072
|
||||
|
||||
# Group exchange DH modulus sizes.
|
||||
dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048
|
||||
dh_modulus_size_diffie-hellman-group-exchange-sha256 = 4096
|
||||
|
||||
# The host key types that must match exactly (order matters).
|
||||
host keys = rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519
|
||||
|
||||
@ -23,7 +23,7 @@ hostkey_size_rsa-sha2-512 = 3072
|
||||
hostkey_size_ssh-rsa = 3072
|
||||
|
||||
# Group exchange DH modulus sizes.
|
||||
dh_modulus_size_diffie-hellman-group-exchange-sha256 = 4096
|
||||
dh_modulus_size_diffie-hellman-group-exchange-sha256 = 8192
|
||||
|
||||
# The host key types that must match exactly (order matters).
|
||||
host keys = rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519
|
||||
|
||||
@ -54,24 +54,24 @@ class TestPolicy:
|
||||
assert len(required_fields) == len(Policy.BUILTIN_POLICIES[policy_name])
|
||||
|
||||
# Ensure that at least one host key is defined.
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['host_keys']) == list
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['host_keys']) is list
|
||||
assert len(Policy.BUILTIN_POLICIES[policy_name]['host_keys']) > 0
|
||||
|
||||
# Ensure that at least one key exchange is defined.
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['kex']) == list
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['kex']) is list
|
||||
assert len(Policy.BUILTIN_POLICIES[policy_name]['kex']) > 0
|
||||
|
||||
# Ensure that at least one cipher is defined.
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['ciphers']) == list
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['ciphers']) is list
|
||||
assert len(Policy.BUILTIN_POLICIES[policy_name]['ciphers']) > 0
|
||||
|
||||
# Ensure that at least one MAC is defined
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['macs']) == list
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['macs']) is list
|
||||
assert len(Policy.BUILTIN_POLICIES[policy_name]['macs']) > 0
|
||||
|
||||
# These tests apply to server policies only.
|
||||
if Policy.BUILTIN_POLICIES[policy_name]['server_policy']:
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['hostkey_sizes']) == dict
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['hostkey_sizes']) is dict
|
||||
assert len(Policy.BUILTIN_POLICIES[policy_name]['hostkey_sizes']) > 0
|
||||
|
||||
# Examine all the hostkey_sizes entries...
|
||||
@ -80,7 +80,7 @@ class TestPolicy:
|
||||
|
||||
# Ensure that 'hostkey_size' is always included and that it is an integer.
|
||||
assert 'hostkey_size' in hostkey_data
|
||||
assert type(hostkey_data['hostkey_size']) == int
|
||||
assert type(hostkey_data['hostkey_size']) is int
|
||||
|
||||
# If this is an ed25519 host key, ensure its size is fixed at 256. If its an RSA host key, ensure the size is 4096.
|
||||
if hostkey_type.find('ed25519') != -1:
|
||||
@ -105,7 +105,7 @@ class TestPolicy:
|
||||
assert hostkey_data['ca_key_size'] == 256
|
||||
|
||||
# Ensure that the 'dh_modulus_size' field is a dict.
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['dh_modulus_sizes']) == dict
|
||||
assert type(Policy.BUILTIN_POLICIES[policy_name]['dh_modulus_sizes']) is dict
|
||||
|
||||
# The 'dh_modulus_size' field should have either one entry, or be empty.
|
||||
assert len(Policy.BUILTIN_POLICIES[policy_name]['dh_modulus_sizes']) in range(0, 2) # The endpoint in range() is not inclusive
|
||||
|
||||
@ -22,12 +22,12 @@ class TestResolve:
|
||||
vsocket.gsock.addrinfodata['localhost#22'] = socket.gaierror(8, 'hostname nor servname provided, or not known')
|
||||
conf = self._conf()
|
||||
s = self.ssh_socket(self.OutputBuffer(), 'localhost', 22, conf.ip_version_preference)
|
||||
output_spy.begin()
|
||||
with pytest.raises(SystemExit):
|
||||
# output_spy.begin()
|
||||
with pytest.raises(socket.gaierror):
|
||||
list(s._resolve())
|
||||
lines = output_spy.flush()
|
||||
assert len(lines) == 1
|
||||
assert 'hostname nor servname provided' in lines[-1]
|
||||
# lines = output_spy.flush()
|
||||
# assert len(lines) == 1
|
||||
# assert 'hostname nor servname provided' in lines[-1]
|
||||
|
||||
def test_resolve_hostname_without_records(self, output_spy, virtual_socket):
|
||||
vsocket = virtual_socket
|
||||
|
||||
@ -7,7 +7,7 @@ class Test_SSH2_KexDB:
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def init(self):
|
||||
self.db = SSH2_KexDB.ALGORITHMS
|
||||
self.db = SSH2_KexDB.get_db()
|
||||
|
||||
def test_ssh2_kexdb(self):
|
||||
'''Ensures that the SSH2_KexDB.ALGORITHMS dictionary is in the right format.'''
|
||||
|
||||
@ -55,10 +55,10 @@ usage() {
|
||||
PLATFORM="$(uname -s)"
|
||||
|
||||
# This script is intended for use on Linux and Cygwin only.
|
||||
case "$PLATFORM" in
|
||||
case "${PLATFORM}" in
|
||||
Linux | CYGWIN*) ;;
|
||||
*)
|
||||
echo "Platform not supported: $PLATFORM"
|
||||
echo "Platform not supported: ${PLATFORM}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@ -67,12 +67,12 @@ MAN_PAGE=./ssh-audit.1
|
||||
GLOBALS_PY=./src/ssh_audit/globals.py
|
||||
|
||||
while getopts "m: g: h" OPTION; do
|
||||
case "$OPTION" in
|
||||
case "${OPTION}" in
|
||||
m)
|
||||
MAN_PAGE="$OPTARG"
|
||||
MAN_PAGE="${OPTARG}"
|
||||
;;
|
||||
g)
|
||||
GLOBALS_PY="$OPTARG"
|
||||
GLOBALS_PY="${OPTARG}"
|
||||
;;
|
||||
h)
|
||||
usage
|
||||
@ -88,10 +88,10 @@ done
|
||||
|
||||
# Check that the specified files exist.
|
||||
[[ -f "$MAN_PAGE" ]] || { echo >&2 "man page file not found: $MAN_PAGE"; exit 1; }
|
||||
[[ -f "$GLOBALS_PY" ]] || { echo >&2 "globals.py file not found: $GLOBALS_PY"; exit 1; }
|
||||
[[ -f "${GLOBALS_PY}" ]] || { echo >&2 "globals.py file not found: ${GLOBALS_PY}"; exit 1; }
|
||||
|
||||
# Check that the 'ul' (do underlining) binary exists.
|
||||
if [[ "$PLATFORM" == "Linux" ]]; then
|
||||
if [[ "${PLATFORM}" == "Linux" ]]; then
|
||||
command -v ul >/dev/null 2>&1 || { echo >&2 "ul not found."; exit 1; }
|
||||
fi
|
||||
|
||||
@ -99,10 +99,10 @@ fi
|
||||
command -v sed >/dev/null 2>&1 || { echo >&2 "sed not found."; exit 1; }
|
||||
|
||||
# Reset the globals.py file, in case it was modified from a prior run.
|
||||
git checkout $GLOBALS_PY > /dev/null 2>&1
|
||||
git checkout "${GLOBALS_PY}" > /dev/null 2>&1
|
||||
|
||||
# Remove the Windows man page placeholder from 'globals.py'.
|
||||
sed -i '/^WINDOWS_MAN_PAGE/d' "$GLOBALS_PY"
|
||||
sed -i '/^WINDOWS_MAN_PAGE/d' "${GLOBALS_PY}"
|
||||
|
||||
echo "Processing man page at ${MAN_PAGE} and placing output into ${GLOBALS_PY}..."
|
||||
|
||||
@ -116,15 +116,15 @@ echo "Processing man page at ${MAN_PAGE} and placing output into ${GLOBALS_PY}..
|
||||
# escape sequence. Not required under Cygwin because man outputs ANSI escape
|
||||
# codes automatically.
|
||||
|
||||
echo WINDOWS_MAN_PAGE = '"""' >> "$GLOBALS_PY"
|
||||
echo WINDOWS_MAN_PAGE = '"""' >> "${GLOBALS_PY}"
|
||||
|
||||
if [[ "$PLATFORM" == CYGWIN* ]]; then
|
||||
MANWIDTH=80 MAN_KEEP_FORMATTING=1 man "$MAN_PAGE" | sed $'s/\u2010/-/g' >> "$GLOBALS_PY"
|
||||
if [[ "${PLATFORM}" == CYGWIN* ]]; then
|
||||
MANWIDTH=80 MAN_KEEP_FORMATTING=1 man "${MAN_PAGE}" | sed $'s/\u2010/-/g' >> "${GLOBALS_PY}"
|
||||
else
|
||||
MANWIDTH=80 MAN_KEEP_FORMATTING=1 man "$MAN_PAGE" | ul | sed $'s/\u2010/-/g' >> "$GLOBALS_PY"
|
||||
MANWIDTH=80 MAN_KEEP_FORMATTING=1 man "${MAN_PAGE}" | ul | sed $'s/\u2010/-/g' >> "${GLOBALS_PY}"
|
||||
fi
|
||||
|
||||
echo '"""' >> "$GLOBALS_PY"
|
||||
echo '"""' >> "${GLOBALS_PY}"
|
||||
|
||||
echo "Done."
|
||||
exit 0
|
||||
|
||||
Reference in New Issue
Block a user