jtesta/ssh-auditSSH 服务器与客户端安全审计（banner、密钥交换、加密、MAC、压缩、兼容性、安全性等）
ssh-audit 是一个用于 SSH 服务器和客户端配置审计的工具。
jtesta/ssh-audit（v2.0+）是 ssh-audit 的更新维护版本，由于原项目停止维护，从 arthepsy/ssh-audit（v1.x）分叉而来。
usage: ssh-audit.py [-h] [-4] [-6] [-b] [-c] [-d] [-g min1:pref1:max1[,min2:pref2:max2,...] / <x-y[:step]>] [-j] [-l {info,warn,fail}] [-L] [-M custom_policy.txt] [-m] [-n] [-P "Built-In Policy Name" / custom_policy.txt] [-p N] [-T targets.txt] [-t N] [-v] [--conn-rate-test N[:max_rate]] [--dheat N[:kex[:e_len]]] [--get-hardening-guide platform] [--list-hardening-guides] [--lookup alg1[,alg2,...]] [--skip-rate-test] [--socks5 host:port] [--threads N] [host]
positional arguments: host target hostname or IPv4/IPv6 address
optional arguments: -h, --help show this help message and exit -4, --ipv4 enable IPv4 (order of precedence) -6, --ipv6 enable IPv6 (order of precedence) -b, --batch batch output -c, --client-audit starts a server on port 2222 to audit client software config (use -p to change port; use -t to change timeout) -d, --debug enable debugging output -g min1:pref1:max1[,min2:pref2:max2,...] / <x-y[:step]>, --gex-test min1:pref1:max1[,min2:pref2:max2,...] / <x-y[:step]> conducts a very customized Diffie-Hellman GEX modulus size test. Tests an array of minimum, preferred, and maximum values, or a range of values with an optional incremental step amount -j, --json enable JSON output (use -jj to enable indentation for better readability) -l {info,warn,fail}, --level {info,warn,fail} minimum output level (default: info) -L, --list-policies list all the official, built-in policies. Combine with -v to view policy change logs -M custom_policy.txt, --make-policy custom_policy.txt creates a policy based on the target server (i.e.: the target server has the ideal configuration that other servers should adhere to), and stores it in the file path specified -m, --manual print the man page (Docker, PyPI, Snap, and Windows builds only) -n, --no-colors disable colors (automatic when the NO_COLOR environment variable is set) -P "Built-In Policy Name" / custom_policy.txt, --policy "Built-In Policy Name" / custom_policy.txt run a policy test using the specified policy (use -L to see built-in policies, or specify filesystem path to custom policy created by -M) -p N, --port N the TCP port to connect to (or to listen on when -c is used) -T targets.txt, --targets targets.txt a file containing a list of target hosts (one per line, format 'HOST[:PORT]'; for UNIX socket servers, use 'unix:///path/socket'). Use -p/--port to set the default port for all hosts. Use --threads to control concurrent scans -t N, --timeout N timeout (in seconds) for connection and reading (default: 5) -v, --verbose enable verbose output --conn-rate-test N[:max_rate] perform a connection rate test (useful for collecting metrics related to susceptibility of the DHEat vuln). Testing is conducted with N concurrent sockets with an optional maximum rate of connections per second --dheat N[:kex[:e_len]] continuously perform the DHEat DoS attack (CVE-2002-20001) against the target using N concurrent sockets. Optionally, a specific key exchange algorithm can be specified instead of allowing it to be automatically chosen. Additionally, a small length of the fake e value sent to the server can be chosen for a more efficient attack (such as 4). --get-hardening-guide platform retrieves the hardening guide for the specified platform name (use --list-hardening-guides to see list of available guides). --list-hardening-guides list all official, built-in hardening guides for common systems. Their full names can then be passed to --get-hardening-guide. Add -v to this option to view hardening guide change logs and prior versions. --lookup alg1[,alg2,...] looks up an algorithm(s) without connecting to a server. --skip-rate-test skip the connection rate test during standard audits (used to safely infer whether the DHEat attack is viable) --socks5 host:port connect via a SOCKS5 proxy (implies --skip-rate-test) --threads N number of threads to use when scanning multiple targets (-T/--targets) (default: 32)
* 如果同时使用 IPv4 和 IPv6，可以通过 `-46` 或 `-64` 设置优先级顺序。
* 批量标志 `-b` 将输出不带标题和空行的分区（隐含详细模式标志）。
* 详细模式标志 `-v` 将在每行前添加分区类型和算法名称前缀。
* 当所有算法均被视为安全（对于标准审计）或策略检查通过（对于策略审计）时，返回退出码 0。
基本服务器审计：```
ssh-audit localhost
ssh-audit 127.0.0.1
ssh-audit 127.0.0.1:222
ssh-audit ::1
ssh-audit [::1]:222
ssh-audit unix:///run/ssh-unix-local/socket
To run a standard audit against many servers (place targets into servers.txt, one on each line in the format of HOST[:PORT]):