Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
closed as off-topic by Xander, Adi, TildalWave, Iszi, AJ Henderson Apr 23 '14 at 16:37
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Xander, Adi, TildalWave, AJ Henderson
The most secure server is the one which is most efficiently maintained. So this would point at the default SSH server (which happens to be OpenSSH): if a security flaw is found in that software, it can be expected that the corresponding patch will be made available within a few hours, and you will get it through the normal Debian update mechanisms (that I hope you dutifully apply on a daily basis).
Theoretical framework: you cannot know bugs which are not discovered yet, so the best that can be hoped for is to fix bugs as soon as they become known, and hope that actual attacks will strike somebody else. That's how 95% of software security works, and it works "fine" for now. The remaining 5% are proactive analysis and sane development practices which should prevent most bugs from coming to existence in the first place; OpenSSH has good reputation in that respect, and since it is so widely used, this implies some level of public scrutiny (some people are looking for bugs) and also a profusion of targets, thus making it much less probable that you are being hit before the patch becomes available.