有没有办法输出ssh
它支持的 MAC、密码和 KexAlgorithms?
我希望动态地找出答案,而不必查看源代码。
答案1
相关的 OpenSSH 手册页:https://man.openbsd.org/ssh#Q
Ciphers
:ssh -Q cipher
MACs
:ssh -Q mac
KexAlgorithms
:ssh -Q kex
PubkeyAcceptedKeyTypes
:ssh -Q key
答案2
您还可以使用最新版本的 nmap 远程探测 ssh 服务器支持的密码:
nmap --script ssh2-enum-algos -sV -p <port> <host>
还有一项在线服务叫做sshcheck.com
以及(以及我刚刚发现的相当多的类似的扫描仪项目)。
答案3
一些旧版本的 OpenSSH 不支持该-Q
选项,但这个选项适用于任何版本ssh
,并且它的好处是可以同时显示客户和服务器选项,无需任何第三方工具,如nmap
:
ssh -vv username@servername
扫描输出以查看支持哪些密码、KEX 算法和 MAC...
- 由您的客户:“本地客户KEXINIT提案”
- 由服务器:“对等服务器 KEXINIT 提案”
...
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
...
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
...
答案4
# sudo sshd -T | egrep 'ciphers|macs|kexalgo'