Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?

closed as off-topic by Xander, Adi, TildalWave, Iszi, AJ Henderson Apr 23 '14 at 16:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Usually when a so critical service as SSH is exploited, they usually hurry up fixing their problems so, unless you use an old fashioned and outdated ssh server, just go ahead taking one like openssh-server. After all they usually hurry up fixing the problems also (if any). – kiBytes Apr 23 '14 at 13:14
  • Ok, thank you. I do not understand why this question has been marked as off-topic, as I'm not asking for a product recommendation, only asking which server has the fewest security issues (which I would think is on topic for a computer security site). – Fearless Apr 23 '14 at 20:15

The most secure server is the one which is most efficiently maintained. So this would point at the default SSH server (which happens to be OpenSSH): if a security flaw is found in that software, it can be expected that the corresponding patch will be made available within a few hours, and you will get it through the normal Debian update mechanisms (that I hope you dutifully apply on a daily basis).

Theoretical framework: you cannot know bugs which are not discovered yet, so the best that can be hoped for is to fix bugs as soon as they become known, and hope that actual attacks will strike somebody else. That's how 95% of software security works, and it works "fine" for now. The remaining 5% are proactive analysis and sane development practices which should prevent most bugs from coming to existence in the first place; OpenSSH has good reputation in that respect, and since it is so widely used, this implies some level of public scrutiny (some people are looking for bugs) and also a profusion of targets, thus making it much less probable that you are being hit before the patch becomes available.

Not the answer you're looking for? Browse other questions tagged or ask your own question.