2 ms·
SSH-audit: Free tool audits the configuration of an SSH server or client
- LinuxBender 3y agoWorth mentioning that if using this tool to harden ones ssh server or client, I would suggest hardening the client first and then test connecting to "all the things" one normally connects to and then harden all of the ssh daemons to prevent being locked out. If a server does not support stronger ciphers one can make exceptions in their ~/.ssh/config for that host. e.g. such as old golang / libssh libraries Host some.old.host # [snip...] HostkeyAlgorithms +ssh-rsa PubkeyAcceptedKeyTypes +ssh-rsa The benefit of going through this exercise is not just that it stops most of the old bots from negotiating but it also speeds up the client-server handshake substantially. Anyone making heave use of Ansible should certainly consider doing this. Use test/canary servers/clients first unless one has the t-shirt allowing testing in production.