I just did a scan with nmap and it found a ssh service running (nothing wrong here). The problem is it identifies the service as OpenSSH 12.1, but when I looked on the website of OpenSSH they say the last release is 7.3

Here the command, if it may help:

nmap -sS -A -p 22 xxx.xxx.xxx.xxx

Here is the output:

Starting Nmap 7.12SVN ( https://nmap.org ) at 2016-08-15 15:29 EDT
Nmap scan report for xx.xx.xx.xx
Host is up (0.00026s latency).
22/tcp open  ssh     OpenSSH 12.1 (protocol 2.0)
| ssh-hostkey:
|   1024 xx (DSA)
|_  2048 xx (RSA)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32, Linux 2.6.32 - 2.6.35

Any idea?


2 Answers 2


Someone is being deliberately deceptive. Nmap's service fingerprints are written as regular expressions that match and capture portions of the banner. Here's an example for OpenSSH:

match ssh m|^SSH-([\d.]+)-OpenSSH[_-]([\w.]+)\r?\n|i p/OpenSSH/ v/$2/ i/protocol $1/ cpe:/a:openbsd:openssh:$2/

So if someone created an SSH service that returned a banner like this:


Then it would produce the output you see. OpenSSH itself does not allow this banner to be configured at runtime, so the person in question either changed the code before compiling or is running some other SSH daemon.

  • It's also possible he has a custom (poisoned?) version of nmap-service-probes in his installation. He could compare his copy to svn.nmap.org/nmap/nmap-service-probes to make sure. Aug 15, 2016 at 20:07
  • @bonsaiviking Ok thanks, I will to look further into it. It could make sense, because Nexpose is giving me info that the scan is on a Palo Alto Networks PA Firewall ... For my personnal knowledge, were did you get this information? :) Aug 15, 2016 at 20:09
  • I confirm the banner. Using telnet xx.xx.xx.xx 22 give me the banner with the OpenSSH-12.1 Aug 15, 2016 at 20:24

I'm pretty sure Palo Alto is doing this intentionally. Every instance of OpenSSH 12.1 that I have seen were Palo Alto PA firewalls. I think they're doing this so that a scanning tool will not show vulnerabilities in their SSH.

Some of those firewalls were atleast 4 or 5 years old and if they are actually running OpenSSH and haven't been patched, those have to vulnerable. These firewalls may run in networks without their packages updated for years. So they could have chosen this version number so that it would remain latest for decades to come.

I'd suggest trying all the PoCs for OpenSSH in the last one decade to see how it holds up then.

  • In comments above, the OP confirms that the target is a Palo Alto Networks PA Firewall. But your speculation for why the version number is different needs support, else this is a pretty serious accusation. They might simply have their own version.
    – schroeder
    May 13, 2020 at 13:32
  • @schroeder - While they could indeed have their own version of SSH , it would not be OpenSSH. That would be a contradiction in definition. May 13, 2020 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .