ssh_scan

ssh_scan

A SSH configuration and policy scanner

⚠️ Deprecation Notice ⚠️

Mozilla is no longer maintaining the SSH Scan project.

Please fork it to continue development.

Key Benefits

• Minimal Dependencies - Uses native Ruby and BinData to do its work, no heavy dependencies.
• Not Just a Script - Implementation is portable for use in another project or for automation of tasks.
• Simple - Just point ssh_scan at an SSH service and get a JSON report of what it supports and its policy status.
• Configurable - Make your own custom policies that fit your unique policy requirements.

Setup

To install and run as a gem, type:

gem install ssh_scan
ssh_scan

To run from a docker container, type:

docker pull mozilla/ssh_scan
docker run -it mozilla/ssh_scan -t sshscan.rubidus.com

To install and run from source, type:

# clone repo
git clone https://github.com/mozilla/ssh_scan.git
cd ssh_scan

gem install bundler
bundle install

./bin/ssh_scan

Example Command-Line Usage

Run ssh_scan -h to get this

…

• See here for example output
• See here for example policies

ssh_scan as a service/api?

This project is solely for ssh_scan engine/command-line usage.

If you would like to run ssh_scan as a service, please refer to the ssh_scan_api project

Rubies Supported

This project is integrated with travis-ci and is regularly tested to work with multiple rubies.

To checkout the current build status for these rubies, click here.

Contributing

If you are interested in contributing to this project, please see CONTRIBUTING.md.

Credits

Sources of Inspiration for ssh_scan

• Mozilla OpenSSH Security Guide - For providing a sane baseline policy recommendation for SSH configuration parameters (eg. Ciphers, MACs, and KexAlgos).