关于SSH的一些总结

1. 查看sshd的版本

 

root # rpm -qf /usr/sbin/sshd

openssh-server-4.3p2-82.el5

root # rpm -qi openssh-server-4.3p2-82.el5

Name        : openssh-server               Relocations: (not relocatable)

Version     : 4.3p2                             Vendor: Red Hat, Inc.

Release     : 82.el5                        Build Date: Wed 04 Jan 2012 09:42:39 PM CST

Install Date: Mon 25 Mar 2013 10:02:23 AM CST      Build Host: hs20-bc2-3.build.redhat.com

Group       : System Environment/Daemons    Source RPM: openssh-4.3p2-82.el5.src.rpm

Size        : 491029                           License: BSD

Signature   : DSA/SHA1, Thu 05 Jan 2012 11:55:31 PM CST, Key ID 5326810137017186

Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>

URL         : http://www.openssh.com/portable.html

Summary     : The OpenSSH server daemon

Description :

OpenSSH is a free version of SSH (Secure SHell), a program for logging

into and executing commands on a remote machine. This package contains

the secure shell daemon (sshd). The sshd daemon allows SSH clients to

securely connect to your SSH server. You also need to have the openssh

package installed.

2. ssh的协议层次结构

 

from: http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_12-4/124_ssh.html

 

SSH is organized as three protocols that typically run on top of TCP::

• Transport Layer Protocol: Provides server authentication, data confidentiality, and data integrity with forward secrecy (that is, if a key is compromised during one session, the knowledge does not affect the security of earlier sessions); the transport layer may optionally provide compression
• User Authentication Protocol: Authenticates the user to the server
• Connection Protocol: Multiplexes multiple logical communications channels over a single underlying SSH connection

3. 在transport layer protocol中，server端还是client端会先发布自己的版本信息呢？

http://stackoverflow.com/questions/16205240/which-side-will-initiate-the-version-negotiation-in-the-ssh-transport-layer-prot

结论是：协议没有规定，因为这个消息不是request-response。

jsch-0.1.20就存在着问题，先等待server端的版本信息，然后再发自己client端的。需要升级到比较新的版本解决这个问题。

4. 验证server端sshd版本的一个简单方法

 

root # telnet oc26 22



Trying 120.2.13.244...



Connected to oc26.



Escape character is '^]'.

SSH-2.0-OpenSSH_4.3

5. 有时server端会基于安全的考虑，故意隐藏ssh的版本信息，下面是一些资料。

 

 

http://www.mail-archive.com/[email protected]/msg06806.html

http://e-rezaei.persianblog.ir/post/2

http://0x80.org/blog/sshd-hide-version-patch/

http://www.unix.com/solaris/53391-how-hide-ssh-version.html (I just been audited and one the recommendations is to hide the SSH version or give fake information.)

http://www.linuxquestions.org/questions/slackware-14/how-to-hide-openssh-version-331399/

http://serverfault.com/questions/216801/prevent-ssh-from-advertising-its-version-number

http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html

6. ssh问题debug的一些方法

 

http://www.snailbook.com/faq/general-debugging.auto.html