elie/ssh-audit
1
0
Fork 0
mirror of https://github.com/jtesta/ssh-audit.git synced 2024-07-02 12:14:45 +02:00
Code Issues Packages Projects Releases Wiki Activity
598 Commits 1 Branch 15 Tags 3 MiB
3313046714
Commit Graph

252 Commits

Author SHA1 Message Date
Joe Testa
e447c42a79 Bumped version to v2.2.0. 2020-03-11 11:55:14 -04:00
Joe Testa
5292066e66 Added new ciphers (camellia128-cbc, camellia128-ctr, camellia192-cbc, camellia192-ctr, camellia256-cbc, camellia256-ctr). Fixed certain algorithms not appearing in the recommendations list (#16). 2020-03-10 19:22:15 -04:00
Joe Testa
c043570879
Merge pull request #20 from KiloFoxtrotPapa/fix-lopt-port 
Fix long option for port=
 2020-02-27 10:48:51 -05:00
kfp
a04c96c5b2 Fix long option for port= 2020-02-21 22:21:54 -08:00
Joe Testa
c9a2f2955c Marked host key type 'ssh-rsa' as weak due to practical SHA-1 collisions. 2020-02-08 23:56:54 -05:00
Joe Testa
99ae10440b Added new hostkey types for OpenSSH 8.2. 2020-02-08 19:05:36 -05:00
Joe Testa
8cafcd4eb5 Added many new algorithms. 2020-02-08 18:44:42 -05:00
Joe Testa
229a4f2af9 Bumped version number. 2019-11-26 12:13:56 -05:00
Joe Testa
dc36622b50 Bumped version to v2.1.1. 2019-11-26 11:48:18 -05:00
Joe Testa
a16eb2d6cb Added three new PuTTY vulns. 2019-11-18 22:08:17 -05:00
Joe Testa
2848c1fb16 Added two new ciphers: 'des', and '3des'. 2019-11-18 20:22:12 -05:00
Joe Testa
2cff202b32 Added two new host key types: 'rsa-sha2-256-cert-v01@openssh.com' and 'rsa-sha2-512-cert-v01@openssh.com'. 2019-11-14 16:45:40 -05:00
Joe Testa
dae92513fd During client tests, client IP is now listed in output. 2019-11-14 13:52:36 -05:00
Joe Testa
e101e22720 Bumped version number. 2019-11-14 11:07:16 -05:00
Joe Testa
cf1e069db4 Updated version to 2.1.0. 2019-11-14 08:56:43 -05:00
Joe Testa
0263769243 Added JSON output tests to docker testing suite. 2019-11-08 18:40:32 -05:00
Joe Testa
14e0ed0e00 Fixed minor whitespace issue. 2019-11-08 11:09:00 -05:00
Andreas Jaggi
b6c64d296b Add --json output option 2019-11-07 22:08:09 +01:00
Joe Testa
1ec13c653e A timeout can now be specified when auditing client connections. 2019-11-06 20:40:25 -05:00
Joe Testa
a401afd099 Merged arthepsy/ssh-audit#47 2019-10-25 11:48:02 -04:00
Joe Testa
8a3ae321f1 Added five kex algorithms: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==, gss-group14-sha1-, gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==, gss-group14-sha256-toWM5Slw5Ew8Mqkay+al2g==, gss-group15-sha512-toWM5Slw5Ew8Mqkay+al2g==; added four ciphers: idea-cbc, serpent128-cbc, serpent192-cbc, serpent256-cbc; added four MACs: hmac-ripemd, hmac-sha256-96@ssh.com, umac-32@openssh.com, umac-96@openssh.com. 2019-10-25 11:27:22 -04:00
Joe Testa
e62b548677 Updated info on curve25519-sha256 kex. 2019-10-21 11:50:23 -04:00
Joe Testa
fd85e247e7 Improved IPv4/IPv6 error handling during client testing. 2019-10-10 23:09:45 -04:00
Joe Testa
e3a59a3e21 Client auditing feature now supports IPv6. 2019-10-09 22:29:56 -04:00
Joe Testa
4ebefdf894 Updated usage message. 2019-10-09 21:12:09 -04:00
Joe Testa
83544836c9 Fixed client parsing crash. 2019-10-09 20:57:31 -04:00
Joe Testa
4c9b871f5c Removed duplicate MAC. 2019-10-07 11:00:11 -04:00
Joe Testa
fd3a1f7d41 Added client audit functionality. (#3) 2019-09-27 18:14:36 -04:00
Joe Testa
08677d65b1 Added potential fix for additional crash against Sun_SSH. 2019-09-19 22:25:30 -04:00
Joe Testa
8c5493ae3e Added 2 key exchanges (ecdh-sha2-1.3.132.0.10, curve448-sha512), 1 host key type (ecdsa-sha2-1.3.132.0.10), and 2 MACs (hmac-sha2-256-96-etm@openssh.com, hmac-sha2-512-96-etm@openssh.com). 2019-09-19 22:19:26 -04:00
Joe Testa
bbf6204ce1 Add support for Sun_SSH (on Solaris). Add 'gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==' key exchange. 2019-09-19 20:08:10 -04:00
Joe Testa
eac81455a9 Added PyPI package support. 2019-09-04 15:05:07 -04:00
Joe Testa
bce9e2b152 Added new KEX: diffie-hellman-group15-sha256. 2019-09-03 20:41:53 -04:00
Joe Testa
f5431559ff Bumped version number. 2019-08-29 16:52:38 -04:00
Joe Testa
6f60722455 Fixed version number. 2019-08-29 15:53:35 -04:00
Joe Testa
c185a25af1 For unrecognized servers, only recommend algorithm changes & removals, not additions (since they can be very inaccurate). 2019-08-28 00:37:55 -04:00
Joe Testa
747177c1c7 Added TinySSH support. Fixes #7. 2019-08-27 17:02:03 -04:00
Joe Testa
6846b1bf29 Added two KEX algorithms: diffie-hellman-group16-sha256 and diffie-hellman-group-exchange-sha512@ssh.com. 2019-08-26 15:28:37 -04:00
Joe Testa
af7e2a088c Added hmac-sha512 and hmac-sha512@ssh.com MACs. Added diffie-hellman-group17-sha512 key exchange. 2019-08-26 15:19:49 -04:00
Joe Testa
0b034b8226 Marked 3des-ctr as a weak cipher. 2019-08-26 14:44:35 -04:00
Joe Testa
af663da838 Now SHA256 fingerprints are displayed for RSA and ED25519 host keys. Fixes #2. 2019-08-22 15:47:37 -04:00
Joe Testa
ed11fc135b When unknown algorithms are encountered, ask the user to report them. 2019-08-18 15:20:16 -04:00
Joe Testa
afa73d2dd2 Added 1 kex (diffie-hellman-group-exchange-sha256@ssh.com), 3 encryption algs (des-cbc-ssh1, blowfish-ctr, twofish-ctr), and 8 macs (hmac-sha2-56, hmac-sha2-224, hmac-sha2-384, hmac-sha3-256, hmac-sha3-384, hmac-sha3-512, hmac-sha256, hmac-sha256@ssh.com). 2019-08-18 14:38:39 -04:00
Joe Testa
64656b5228 Added timeout option to usage message. 2019-08-18 10:03:44 -04:00
Joe Testa
f9a51d4108 Default interpreter changed to python3. 2019-08-18 00:34:03 -04:00
Joe Testa
8527d13343 Added documentation on ALGORITHMS structure. 2019-08-18 00:32:59 -04:00
Joe Testa
f8fcd119e2 Tagged sntrup4591761x25519-sha512@tinyssh.org as experimental, just as the OpenSSH 8.0 release notes say. 2019-08-18 00:16:42 -04:00
Joe Testa
76a4750934 Added support for kex sntrup4591761x25519-sha512@tinyssh.org, introduced in OpenSSH 8.0. 2019-08-18 00:09:40 -04:00
Joe Testa
7155efeb4a Added CVEs for Dropbear & libssh. Fixed libssh CVE parsing. Now prints CVEs in red when score is >= 8.0, otherwise they are printed in orange. 2019-08-17 23:11:03 -04:00
Joe Testa
41d396f551 Updated version, copyright header, URL, and added Python 2 warning. 2019-08-17 20:59:23 -04:00
Shaun Hammill
f2e6f1a71c
Replace getopt.getopt with getopt.gnu_getopt 
Addresses Issue #41, gnu_getopt allows non-option arguments to be intermingled with option arguments whereas getopt stops processing arguments when a non option is found.
 2019-06-05 16:19:33 -04:00
Joe Testa
f44663bfc4 Fixed Socket.connect() method arguments. 2017-10-31 16:49:19 -04:00
Joe Testa
95ca0bb243 Fixed merge collision in connect() method. 2017-10-31 16:40:02 -04:00
Joe Testa
a9f6b93391 Merge branch 'timeout_arg' into all_my_patches 2017-10-31 16:36:20 -04:00
Joe Testa
04973df2af Added command-line option to modify connection/read timeout. 2017-10-29 17:48:04 -04:00
Joe Testa
a3f126a1dd Added missing algorithms from RFC4250 and RFC4432. 2017-10-11 15:47:01 -04:00
Joe Testa
1bb5490e01 Added new algorithms (some as per RFC4344). 2017-10-11 15:13:58 -04:00
Joe Testa
c1d0540d1e Fixed one more warning. 2017-09-27 22:42:49 -04:00
Joe Testa
cd80917c62 Fixed more warnings. 2017-09-27 22:36:23 -04:00
Joe Testa
b7bf8ab38a Suppressed more unused variables warnings. 2017-09-27 22:22:42 -04:00
Joe Testa
a3c6d16500 Suppressing pylint warnings on unused variables. 2017-09-27 22:14:48 -04:00
Joe Testa
4f6e23e568 Fixed send_init() inheritance problems. Now kex failures will try to continue on instead of terminating the program. 2017-09-27 21:27:08 -04:00
Joe Testa
b2775c9cf9 Python3 fixes. 2017-09-26 20:51:10 -04:00
Joe Testa
ee5dde1cde Added RSA certificate auditing. 2017-09-26 20:46:00 -04:00
Joe Testa
33ae2946ea Syntax fix for Python2. 2017-09-22 15:01:51 -04:00
Joe Testa
7c919b093b Added RSA & DH modulus size auditing. 2017-09-21 22:44:34 -04:00
Andris Raugulis
d8eb46d766 Correct IPv6 parsing in command-line. Fixes #26. 2017-05-05 14:12:45 +03:00
Andris Raugulis
1d1f842bed Refactor output level/colors, fix python:S1845. 2017-04-10 19:20:31 +03:00
Andris Raugulis
72a6b9eeaf Refactor and test SSH.Algorithm. 2017-04-10 13:20:32 +03:00
Andris Raugulis
21a93cbd66 Condition must be a boolean fixes. 2017-04-06 05:27:29 +03:00
Andris Raugulis
0d555d43b3 Condition must be a boolean fixes. 2017-04-05 18:12:26 +03:00
Andris Raugulis
e4bdabb891 Fix method type and naming. 2017-04-05 17:34:19 +03:00
Andris Raugulis
c132c62b96 Remove useless parentheses. 2017-04-05 16:13:35 +03:00
Andris Raugulis
bb122ffe13 Replace assertions with exceptions. 2017-04-05 16:02:40 +03:00
Andris Raugulis
09c2e7b2d5 Fix SonarQube python:S1871. 2017-04-05 04:27:39 +03:00
Andris Raugulis
76849540be It's 2017 already. 2017-03-26 06:31:06 +03:00
Andris Raugulis
57a8744d03 Fix some unused variable warnings. 2017-03-26 06:24:07 +03:00
Andris Raugulis
3ebb59108b Ignore pylint's else-if-used in validly used places. 2017-03-26 05:58:39 +03:00
Andris Raugulis
74d1b5c7b5 Fix pylint's bad-builtin and deprecated-lambda with list comprehension. 2017-03-26 05:54:14 +03:00
Andris Raugulis
29d9e4270d Fix flake8 reported issues. 2017-03-25 08:44:37 +02:00
Andris Raugulis
65ef250aae Upgrade to Mypy 0.501 and fix issues. Add requirements.txt. 2017-03-23 23:17:35 +02:00
Andris Raugulis
9ac03d368a Add OpenSSH 7.4 changes and use as default banner. 2017-01-24 12:45:53 +02:00
Andris Raugulis
54b0960502 Upgrade to Mypy 0.470. Add colorama stub. Fix identation. 2017-01-23 19:34:06 +02:00
bs
ff500ba84b Add OpenSSH CVE list (#25) 2017-01-23 17:45:25 +02:00
Andris Raugulis
9a409e835e Refactor outer functions within classes. 
Use mypy strict optional checks and fix them.
Use better comparison for compatiblity output.
Add initial socket tests.
 2016-11-03 19:10:49 +02:00
Andris Raugulis
6c4b9fcadf Banner should be in printable ASCII, not the whole ASCII space. 2016-11-02 18:25:13 +02:00
Andris Raugulis
5bb0ae0ceb Rework is/to ASCII and implement printable ASCII is/to functions. 
Add Utils tests.
 2016-11-02 18:23:55 +02:00
Andris Raugulis
44c1d4827c Specify error when couldn't get banner. Test for timeout and retry cases. 2016-11-02 13:00:24 +02:00
Andris Raugulis
dd3ca9688e Back to development version. 2016-10-26 19:14:03 +03:00
Andris Raugulis
e42064b9b9 Release 1.7.0. 2016-10-26 19:02:13 +03:00
Andris Raugulis
66b9e079a8 Implement new options (-4/--ipv4, -6/--ipv6, -p/--port <port>). 
By default both IPv4 and IPv6 is supported and order of precedence depends on OS.
By using -46, IPv4 is prefered, but by using -64, IPv6 is preferd.
For now the old way how to specify port (host:port) has been kept intact.
 2016-10-26 18:33:00 +03:00
Andris Raugulis
4684ff0113 Add linter fixes for tests. 2016-10-25 17:19:08 +03:00
Andris Raugulis
aa4eabda66 Do not count coverage for missing import. 2016-10-25 14:04:54 +03:00
Andris Raugulis
4bbb1f4d11 Use safer UTF-8 decoding (with replace) and add related tests. 2016-10-25 13:53:51 +03:00
Andris Raugulis
182467e0e8 Fix typo, which slipped in while adding type system. 2016-10-25 11:52:55 +03:00
Andris Raugulis
385c230376 Add colors support for Microsoft Windows via optional colorama dependency. 2016-10-25 11:50:12 +03:00
Andris Raugulis
5b3b630623 Fix pylint reported issues and disable unnecessary ones. 2016-10-20 20:00:51 +03:00
Andris Raugulis
cdfe06e75d Fix type after argument removal. 2016-10-20 17:19:37 +03:00
Andris Raugulis
cbe7ad4ac3 Fix pylint reported no-self-use and disable checks in py2/3 compatibility code. 2016-10-20 17:06:23 +03:00
Andris Raugulis
dfb8c302bf Fix pylint reported attribute-defined-outside-init. 2016-10-20 16:46:53 +03:00