elie/ssh-audit
1
0
Fork 0
mirror of https://github.com/jtesta/ssh-audit.git synced 2026-07-08 03:54:53 +02:00
Code Issues Packages Projects Releases Wiki Activity
718 Commits 1 Branch 17 Tags
13fd7102d97065084614e91830e1357be6b6c99e
Commit Graph

718 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Joe Testa 13fd7102d9 Added tabulation for "Not allowed at this time" banners (when the PerSourcePenalties directive triggers in OpenSSH 9.8 and later), along with tabulation for invalid SSH banners. 2026-07-04 14:40:38 -04:00
Joe Testa 419df1b788 Added hardening policy for OpenSSH 10.4. 2026-07-03 11:14:28 -04:00
Joe Testa 859cb7012e Added ssh-mldsa44-ed25519@openssh.com host key type. 2026-07-03 10:59:16 -04:00
Joe Testa 0f8bbdbfd9 Fixed bug where algorithm added in OpenSSH 10.x was being recommended for OpenSSH 9.x targets. 2026-07-03 10:58:48 -04:00
Joe Testa 1eb11050b3 Added 9 new host key types: 'mldsa-44', 'mldsa-65', 'mldsa-87', 'ssh-mldsa-44', 'ssh-mldsa-65', 'ssh-mldsa-87', 'ssh-mldsa44', 'ssh-mldsa65', 'ssh-mldsa87'. 2026-06-20 19:02:08 -04:00
Joe Testa 240840f580 Added note in README that support was added for Python 3.14. 2026-06-20 10:32:43 -04:00
Joe Testa 36def4b5ac Expanded SOCKS5 protocol support, refactored exception handling, updated documentation, added more tests. (#347) 2026-06-20 10:07:14 -04:00
Michał Majchrowicz f369689cd1 Add --socks argument for scanning via SOCKS5 proxy (#347) 
* Add --socks argument for scanning via SOCKS5 proxy

Implement SOCKS5 proxy support without external dependencies:
- Add socks_proxy field to AuditConf
- Add --socks host:port CLI argument with input validation
- Implement SOCKS5 handshake (no-auth, domain-name addressing) in
  SSH_Socket._connect_via_socks5()

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Michał Majchrowicz <sectroyer@gmail.com>

* Add SOCKS proxy regression tests

---------

Signed-off-by: Michał Majchrowicz <sectroyer@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-20 09:57:26 -04:00
Joe Testa 3bd2dd95a9 Updated built-in policy for Debian 12 to match latest hardening guide. (#341) 2026-06-19 21:33:53 -04:00
Joe Testa b7749a7e17 Added built-in policies for OpenSSH 10.1, 10.2, and 10.3. 2026-06-19 20:50:58 -04:00
Joe Testa 974dd324a6 Added Rocky Linux 10 hardening guides and policies. (#354) 2026-06-17 20:20:19 -04:00
Joe Testa e42d993b07 Added hardening guides and policies for Ubuntu 26.04. 2026-06-14 19:55:06 -04:00
Joe Testa 0ccb915f37 Added support for scanning servers over UNIX sockets. (#351) 2026-06-14 17:21:13 -04:00
Joe Testa abf5b8326a Fixed image pull command when using podman. 2026-06-14 17:05:43 -04:00
Joe Testa e01bd61df0 Added usedforsecurity=False to hashlib.md5() call to suppress security scanner warning. 2026-06-13 10:54:54 -04:00
Joe Testa f2ed8c01ae Added new host key: webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com (#348) 2026-06-13 10:27:07 -04:00
Joe Testa bbec6dbf23 Bumped copyright year. 2026-06-13 10:23:36 -04:00
Joe Testa 2573235f6a Added support for Python 3.14. Dropped support for Python 3.9. 2026-06-13 09:08:15 -04:00
Joe Testa 4f9a630de4 Added Debian 13 policies and hardening guides. 2025-09-01 18:22:46 -04:00
Joe Testa f821565ff9 Renamed hardeningguides.py. 2025-09-01 17:39:07 -04:00
Joe Testa 062a1f3cb4 Updated changelog message for version 2 of Ubuntu Server 24 policy. 2025-09-01 16:43:59 -04:00
Joe Testa c900874406 Added policy option to allow host key subsets and/or reorderings. 2025-09-01 16:22:40 -04:00
Joe Testa 0382cf9b2d Aside from linking to online hardening guides, mention that built-in guides are also available. 2025-08-30 16:26:57 -04:00
Joe Testa d8d90a3a89 Dropped support for Python 3.8, as it reached its end-of-life in October 2024. 2025-08-24 15:50:58 -04:00
Joe Testa aaa7d24565 Updated GEX fallback detection for OpenSSH 10.0 and later, as version 9.9 was the last to include it. (#310) 2025-08-24 15:41:14 -04:00
Joe Testa d3b1551520 Added OpenSSH 10.0 policy. 2025-08-24 12:52:22 -04:00
Joe Testa 970d747dcb Smoothed out some rough edges from PR #307. 2025-08-17 16:34:32 -04:00
oam7575 1c0d3d5df1 print config v2 Issue #191 (#307) 
* print config v2

 - printconfig script
 - test_printconfig for tox testing
 - update globals for GUIDES_UPDATED date value
 - update ssh_audit for print_config argument and checks

* pr307 update 1

* pr307 update 2

* pr307 - attempt 2

* Update ssh_audit.py

Missed a TAB
 2025-08-17 16:05:14 -04:00
Joe Testa 4845a8fdee Updated README. 2025-08-06 08:40:36 -04:00
Joe Testa 11a902cb14 Removed SSHv1 support (#298). 2025-07-26 19:57:11 -04:00
Joe Testa b456bb31b9 Added note on mlkem768x25519-sha256 that it is the default key exchange since OpenSSH 10.0. 2025-06-16 18:59:36 -04:00
Joe Testa 32085b2fa5 Added two new ciphers: AEAD_CAMELLIA_128_GCM, AEAD_CAMELLIA_256_GCM. 2025-05-18 18:46:40 -04:00
Joe Testa 5ddd8cca5b Added 2 new key exchanges: mlkem768nistp256-sha256, mlkem1024nistp384-sha384. 2025-04-18 18:29:18 -04:00
Joe Testa b90db2c1af Fixed mypy failure. 2025-04-18 17:06:29 -04:00
playoutsideplay 68c827c239 Update LICENSE (#319) 
Updated year
 2025-04-18 16:27:44 -04:00
Joe Testa e318787a5c Batch mode no longer automatically enables verbose mode. 2024-12-05 10:06:58 -05:00
Joe Testa d9c703c777 When running against multiple hosts, now prints each target host regardless of output level. (#309) 2024-12-05 09:41:26 -05:00
Joe Testa 28a1e23986 Added warnings to all key exchanges that do not provide protection against quantum attacks. 2024-11-25 15:56:51 -05:00
Joe Testa a01baadfa8 Additional cleanups after merging #304. 2024-11-22 12:28:02 -05:00
oam7575 45abc3aaf4 Argparse v3 - RC1 (#304) 
* Argparse v3 - RC1

* Argparse v3 - RC1

Argparse v3 RC1 - post feedback

Argparse v3 - RC2
 2024-11-22 12:26:20 -05:00
Joe Testa 99c64787d9 Updated description of -m option. 2024-10-16 16:39:11 -04:00
Joe Testa 3fa62c3ac5 Fixed man page parsing error. (#301) 2024-10-16 16:23:20 -04:00
Joe Testa d7fff591fa Bumped version to v3.4.0-dev. 2024-10-15 18:30:08 -04:00
Joe Testa 84647ecb32 Updated packaging notes. 2024-10-15 18:29:25 -04:00
Joe Testa 772204ce8b Bumped version to v3.3.0. v3.3.0 2024-10-15 13:28:38 -04:00
Joe Testa c0133a8d5f Listing built-in policies will now hide older versions, unless -v is used. 2024-10-11 15:43:09 -04:00
Joe Testa 3220043aaf Added note regarding hardening instructions. 2024-10-10 16:10:52 -04:00
Joe Testa 40ed92bbe6 Run tests against stable version of Python 3.13. 2024-10-10 16:06:18 -04:00
Joe Testa 720150b471 Issue a warning if an out-dated policy is used. 2024-10-10 15:57:29 -04:00
Joe Testa d0628f6eb4 Updated ext-info-c and ext-info-s key exchanges to include versions of OpenSSH they were first included in. (#291) 2024-10-07 17:41:39 -04:00