Major update #4
Major update #4
Conversation
- Realistic versions - Avoids bot fingerprinting
- Add Variable delay between failures - Increase key to `3072` bits, `1024` was way too outdated - Readme update with a new variables and add some comments to them
- Config update with `SSHD_HOSTKEY_TYPE` and `SSHD_RSA_BITS` - Faking Session channel - Readme example update: - Add isolated network example - Update health check with log file test to aviod empty log after system log rotation - Add new variables with comments - Unused code cleanup
…different IPs Add random seed based on start time
- Add `SSHD_PROFILE_SCOPE` for per host, or per ip profiles - Remove initial code to emulate succeed login - bad idea :(
|
Hi! Cool stuff.. do you think the banners may cause some issues? I'd fear that it would make ssh-auth-logger a bit too easy to fingerprint. |
|
Those are standard banners from Ubuntu Debian and Centos. The aim is to mimic real system and avoid fingerprinting. We can disable them, or make it even configurable to send banner or not. Anyway SSHd version depends on a host machine OS. So I tried to match SSH version with standard Banners. I think at least different SSH versions needs to be presented. |
|
Are those banners or motd? The banner is sent before authentication and I don't think I've ever seen an ubuntu system send something like 'Ubuntu 20.04.6 LTS'. |
|
Yes, banners are send before auth and there is even one funny project about it: https://github.com/shizunge/endlessh-go As I sad, may be a a good idea to make them configurable... Not sure here |
…fault to clear text as it initially was
|
Just checked on fresh ubuntu install and there is default loggin banner: cat /etc/issue
Ubuntu 24.04.3 LTS \n \l
But, per default it is usually disabled too: grep Banner /etc/ssh/sshd_config
#Banner noneSo I add config key to enable Banners. Per default will not send any. And one additional thing that was changed, but I forget to set default to initial behavior. Now passwords can be logged as clear text (as it was) or base64. |
|
Have you noticed any increased CPU from removing the |
2 participants
Hey, I prepared major update for you. As I push it first to my private repo it looks here is it was pushed within short time now. Anyway, few changes:
host, new per IP.