4 ms·
Thanks, that's an interesting tool. But geezus, it's daunting to address SSH weaknesses unless you know ssh and it's configuration top to bottom. I don't! And
by crispyambulance 5y ago
Thanks, that's an interesting tool.
But geezus, it's daunting to address SSH weaknesses unless you know ssh and it's configuration top to bottom. I don't! And I am not afraid to admit it. I just use ssh "as-is" on mainstream platforms, for example, whatever Amazon gives me on lightsail linux images or windows-10 or whatever's on my Mac and hope for the best.
I mean, there's 4 different groups of algorithms to think about: "Key Exchange", "Server Host Key", "Encryption" and "MAC". Each with a bunch of choices, all different, all consisting of mouthfuls of impossible to remember complicated names.
The sshcheck tool indicates that one of these is "insecure" because it may be "broken by nation states". What does that _really_ mean for a business or individual? ¯\_(ツ)_/¯ There are others which are labeled as "weak" so what does that mean? That it might someday be broken by nation-states?
I think it's still useful, however. Why wouldn't you want to have the most secure ssh connections if it's just a matter of configuration?
Ultimately, someone who uses the report from sshcheck has to decide whether it's worth it to google around, spend a solid 30 minutes or so, and figure out how to change their "out-of-the-box" ssh config to get a fully secure report from sshcheck.
- chasil 5y agoIf you like Wireguard's security, you can emulate it in your sshd_config: Ciphers chacha20-poly1305@openssh.com KexAlgorithms curve25519-sha256@libssh.org MACs hmac-sha2-512-etm@openssh.com The MAC is irrelevant, as that function is built into the AEAD cipher, which are to be preferred (the alternate is AES-GCM). This will shut off a lot of legacy SSH clients. Android Connectbot specifically needs the AES cipher; adding it causes problems for putty. Otherwise, this is the classic "best practice" site for SSH: https://stribika.github.io/2015/01/04/secure-secure-shell.html https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
- egberts1 5y agoExactly my finding too! Except certain version of MacOS (and Windows) ssh client would also be unable to connect.
- chasil 5y agoI don't know about MacOS, but Microsoft's native OpenSSH supports this configuration. C:\>ssh -vv me@myDJBserver.myco.com OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2 ... debug2: KEX algorithms: curve25519-sha256@libssh.org ... debug2: ciphers ctos: chacha20-poly1305@openssh.com debug2: ciphers stoc: chacha20-poly1305@openssh.com ... debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none ... $ Above you can also see that the MAC is implicit with the chosen AEAD cipher.
- password4321 5y agoYou can brew install openssh on MacOS.
- gautamcgoel 5y agoYo, do you play Supreme Commander? I think I saw someone with your username on FAF...
- crispyambulance 5y agoNo, it's just a randomly chosen name (a British new wave band from the early 80's).