🖊️ Author: Nairuz Abulhul
🌐 Blog: R3dbuck3t
Secure Shell (SSH) enables two computers to establish an encrypted and direct connection within a possibly insecure network on the standard port TCP 22. This is necessary to prevent third parties from intercepting the data stream and thus intercepting sensitive data
**OpenSSH has six different authentication methods:**
- Password authentication
- Public-key authentication
- Host-based authentication
- Keyboard authentication
- Challenge-response authentication
- GSSAPI authentication
Public-Private Key Authentication
The private key is created individually for the user's own computer and secured with a passphrase that should be longer than a typical password. The private key is stored exclusively on our own computer and always remains secret. If we want to establish an SSH connection, we first enter the passphrase and thus open access to the private key.
Public keys are also stored on the server. The server creates a cryptographic problem with the client's public key and sends it to the client. The client, in turn, decrypts the problem with its own private key, sends back the solution, and thus informs the server that it may establish a legitimate connection. During a session, users only need to enter the passphrase once to connect to any number of servers. At the end of the session, users log out of their local machines, ensuring that no third party who gains physical access to the local machine can connect to the server.
cat /etc/ssh/sshd_config | grep -v "#" | sed -r '/^\s*$/d'
Despite the SSH protocol being one of the most secure protocols available today, some misconfigurations can still make the SSH server vulnerable to easy-to-execute attacks. Let us take a look at the following settings:
| Setting | Description |
|---|---|
PasswordAuthentication yes |
Allows password-based authentication. |
PermitEmptyPasswords yes |
Allows the use of empty passwords. |
PermitRootLogin yes |
Allows to log in as the root user. |
Protocol 1 |
Uses an outdated version of encryption. |
X11Forwarding yes |
Allows X11 forwarding for GUI applications. |
AllowTcpForwarding yes |
Allows forwarding of TCP ports. |
PermitTunnel |
Allows tunneling. |
DebianBanner yes |
Displays a specific banner when logging in. |
Allowing password authentication allows us to brute-force a known username for possible passwords. Many different methods can be used to guess the passwords of users. For this purpose, specific patterns` are usually used to mutate the most commonly used passwords and, frighteningly, correct them. This is because we humans are lazy and do not want to remember complex and complicated passwords. Therefore, we create passwords that we can easily remember, and this leads to the fact that, for example, numbers or characters are added only at the end of the password. Believing that the password is secure, the mentioned patterns are used to guess precisely such "adjustments" of these passwords.
One of the tools we can use to fingerprint the SSH server is ssh-audit. It checks the client-side and server-side configuration and shows some general information and which encryption algorithms are still used by the client and server.