jtesta/ssh-auditSSH 서버 및 클라이언트 보안 감사 (배너, 키 교환, 암호화, MAC, 압축, 호환성, 보안 등)
ssh-audit는 SSH 서버 및 클라이언트 구성 감사(auditing)를 위한 도구입니다.
jtesta/ssh-audit (v2.0+)은 비활성 상태로 인해 arthepsy/ssh-audit (v1.x)에서 포크된 ssh-audit의 업데이트되고 유지 관리되는 버전입니다.
usage: ssh-audit.py [-h] [-4] [-6] [-b] [-c] [-d] [-g min1:pref1:max1[,min2:pref2:max2,...] / <x-y[:step]>] [-j] [-l {info,warn,fail}] [-L] [-M custom_policy.txt] [-m] [-n] [-P "Built-In Policy Name" / custom_policy.txt] [-p N] [-T targets.txt] [-t N] [-v] [--conn-rate-test N[:max_rate]] [--dheat N[:kex[:e_len]]] [--get-hardening-guide platform] [--list-hardening-guides] [--lookup alg1[,alg2,...]] [--skip-rate-test] [--socks5 host:port] [--threads N] [host]
positional arguments: host target hostname or IPv4/IPv6 address
optional arguments: -h, --help show this help message and exit -4, --ipv4 enable IPv4 (order of precedence) -6, --ipv6 enable IPv6 (order of precedence) -b, --batch batch output -c, --client-audit starts a server on port 2222 to audit client software config (use -p to change port; use -t to change timeout) -d, --debug enable debugging output -g min1:pref1:max1[,min2:pref2:max2,...] / <x-y[:step]>, --gex-test min1:pref1:max1[,min2:pref2:max2,...] / <x-y[:step]> conducts a very customized Diffie-Hellman GEX modulus size test. Tests an array of minimum, preferred, and maximum values, or a range of values with an optional incremental step amount -j, --json enable JSON output (use -jj to enable indentation for better readability) -l {info,warn,fail}, --level {info,warn,fail} minimum output level (default: info) -L, --list-policies list all the official, built-in policies. Combine with -v to view policy change logs -M custom_policy.txt, --make-policy custom_policy.txt creates a policy based on the target server (i.e.: the target server has the ideal configuration that other servers should adhere to), and stores it in the file path specified -m, --manual print the man page (Docker, PyPI, Snap, and Windows builds only) -n, --no-colors disable colors (automatic when the NO_COLOR environment variable is set) -P "Built-In Policy Name" / custom_policy.txt, --policy "Built-In Policy Name" / custom_policy.txt run a policy test using the specified policy (use -L to see built-in policies, or specify filesystem path to custom policy created by -M) -p N, --port N the TCP port to connect to (or to listen on when -c is used) -T targets.txt, --targets targets.txt a file containing a list of target hosts (one per line, format 'HOST[:PORT]'; for UNIX socket servers, use 'unix:///path/socket'). Use -p/--port to set the default port for all hosts. Use --threads to control concurrent scans -t N, --timeout N timeout (in seconds) for connection and reading (default: 5) -v, --verbose enable verbose output --conn-rate-test N[:max_rate] perform a connection rate test (useful for collecting metrics related to susceptibility of the DHEat vuln). Testing is conducted with N concurrent sockets with an optional maximum rate of connections per second --dheat N[:kex[:e_len]] continuously perform the DHEat DoS attack (CVE-2002-20001) against the target using N concurrent sockets. Optionally, a specific key exchange algorithm can be specified instead of allowing it to be automatically chosen. Additionally, a small length of the fake e value sent to the server can be chosen for a more efficient attack (such as 4). --get-hardening-guide platform retrieves the hardening guide for the specified platform name (use --list-hardening-guides to see list of available guides). --list-hardening-guides list all official, built-in hardening guides for common systems. Their full names can then be passed to --get-hardening-guide. Add -v to this option to view hardening guide change logs and prior versions. --lookup alg1[,alg2,...] looks up an algorithm(s) without connecting to a server. --skip-rate-test skip the connection rate test during standard audits (used to safely infer whether the DHEat attack is viable) --socks5 host:port connect via a SOCKS5 proxy (implies --skip-rate-test) --threads N number of threads to use when scanning multiple targets (-T/--targets) (default: 32)
* IPv4와 IPv6가 모두 사용되는 경우, `-46` 또는 `-64`를 사용하여 우선순위를 설정할 수 있습니다.
* 배치 플래그 `-b`는 헤더와 빈 줄 없이 섹션을 출력합니다(verbose 플래그를 의미).
* verbose 플래그 `-v`는 각 줄 앞에 섹션 유형과 알고리즘 이름을 접두사로 추가합니다.
* 모든 알고리즘이 안전한 것으로 간주되면(표준 감사) 또는 정책 검사를 통과하면(정책 감사) 종료 코드 0이 반환됩니다.