Major update #4
Major update #4
Conversation
- Realistic versions - Avoids bot fingerprinting
- Add Variable delay between failures - Increase key to `3072` bits, `1024` was way too outdated - Readme update with a new variables and add some comments to them
- Config update with `SSHD_HOSTKEY_TYPE` and `SSHD_RSA_BITS` - Faking Session channel - Readme example update: - Add isolated network example - Update health check with log file test to aviod empty log after system log rotation - Add new variables with comments - Unused code cleanup
…different IPs Add random seed based on start time
- Add `SSHD_PROFILE_SCOPE` for per host, or per ip profiles - Remove initial code to emulate succeed login - bad idea :(
|
Hi! Cool stuff.. do you think the banners may cause some issues? I'd fear that it would make ssh-auth-logger a bit too easy to fingerprint. |
|
Those are standard banners from Ubuntu Debian and Centos. The aim is to mimic real system and avoid fingerprinting. We can disable them, or make it even configurable to send banner or not. Anyway SSHd version depends on a host machine OS. So I tried to match SSH version with standard Banners. I think at least different SSH versions needs to be presented. |
|
Are those banners or motd? The banner is sent before authentication and I don't think I've ever seen an ubuntu system send something like 'Ubuntu 20.04.6 LTS'. |
|
Yes, banners are send before auth and there is even one funny project about it: https://github.com/shizunge/endlessh-go As I sad, may be a a good idea to make them configurable... Not sure here |
…fault to clear text as it initially was
|
Just checked on fresh ubuntu install and there is default loggin banner: cat /etc/issue
Ubuntu 24.04.3 LTS \n \l
But, per default it is usually disabled too: grep Banner /etc/ssh/sshd_config
#Banner noneSo I add config key to enable Banners. Per default will not send any. And one additional thing that was changed, but I forget to set default to initial behavior. Now passwords can be logged as clear text (as it was) or base64. |
|
Have you noticed any increased CPU from removing the |
|
To be honest I didn't really observed it well, but from overall picture didn't notice any change. Theoretically it will consume more CPU as we are not caching config now. But it also brings fresh May be smarter move was initial code --> use it if exist. Not really sure here. |
| healthcheck: | ||
| test: wget -v localhost$SSHD_BIND --no-verbose --tries=1 --spider || exit 1 | ||
| # Will test if port is still open AND log file was not vanished by host machine log rotate | ||
| test: wget -v localhost$SSHD_BIND --no-verbose --tries=1 --spider && test -s /var/log/ssh-auth-logger.log || exit 1 |
There was a problem hiding this comment.
Just checked and this is not working... Variable is not expanded here.
2 participants
Hey, I prepared major update for you. As I push it first to my private repo it looks here is it was pushed within short time now. Anyway, few changes:
host, new per IP.