4

My Archlinux running devices does not present themselves duing ssh handshake: 

$ telnet 192.168.1.151 11735
Trying 192.168.1.151...
Connected to 192.168.1.151.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4

However Raspribian

# telnet 1.2.3.4 1234
Trying 1.2.3.4...
Connected to 1.2.3.4.
Escape character is '^]'.
SSH-2.0-OpenSSH_6.7p1 Raspbian-5+deb8u3

or Ubuntu Server 16.04 LTS

# telnet 4.3.2.1 4321
Trying 4.3.2.1...
Connected to 4.3.2.1.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1

They introduce themselves during handshake.

Does configuring system to not present themselves during handshake, increase security?

(I guess, it does, as knowledge about software and version allow to narrow search of potential security holes)

If, yes, how to configure server to not introduce it's OS version during ssh handshake? (or maybe even introduce as some other, to confuse potential adversary?)

Improve this question

2 Answers 2

Reset to default
4

Does configuring system to not present themselves during handshake, increase security?

Yes, service fingerprinting is a first step for an attacker to identify vulnerable systems. It's good advice to not advertise version details of your OS.

how to configure server to not introduce it's OS version during ssh handshake?

In /etc/ssh/sshd_config you can set the VersionAddendum entry to none or a custom vaue:

VersionAddendum none

(Make sure you restart the SSH daemon afterwards.)

Improve this answer
3
  • This removes only the Ubuntu part, but it is still simple identifiable by the p1 appendix, which makes it still quite clear what is that server running, because Debian/Ubuntu is the only one having that.
    – Jakuje
    Commented Feb 2, 2017 at 20:20
  • @Jakuje Do you have a source for that? As I understand it, that's just part of the version identifier and not specific to the OS.
    – Arminius
    Commented Feb 2, 2017 at 20:41
  • There is patch modifying the OpenSSH package source claiming the opposite (increasing security by doing so). The p1 means simple "Portable release" saying "I am not OpenBSD (upstream)".
    – Jakuje
    Commented Feb 2, 2017 at 20:46
1

Does configuring system to not present themselves during handshake, increase security?

According to Debian maintainers it does not. They are adding additional informations showing more information about the system above what is provided by upstream (OpenBSD) developers:

  • They are adding p1 after the version which says it is Portable version of OpenSSH (not OpenBSD). This was removed from portable OpenSSH 13 years ago to increase privacy.

  • They are adding their internal version number, such as Raspbian-5+deb8u3 with a reason:

    This makes it easier to audit networks for versions patched against security vulnerabilities.

I am not wearing Debian hat and I do not completely agree with what is said above, but they are having a point.

  • Divulging that we are not OpenBSD is minimal bit of information that is not helpful most of the times, same way as that the system is Debian.

  • Specific Debian version is usually not much helpful either, unless there is some very big security hole

  • Most of the other services are sending similar information and still most of the servers run more of them on public facing Internet. You can get similar HELO from mail server, from web servers, FTP server ... Therefore one more service shouting its version to the world does not decrease overall security.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .