Skip to main content

SSH-audit

License Apache-2.0GitHub release (latest SemVer)OWASP Lab ProjectArtifact HUBGitHub Repo starsTwitter Follower

What is SSH-audit?​

ssh-audit is a tool for ssh server & client configuration auditing.

To learn more about the ssh-audit scanner itself visit ssh-audit GitHub.

Deployment​

The ssh-audit chart can be deployed via helm:

# Install HelmChart (use -n to configure another namespace)
helm upgrade --install ssh-audit secureCodeBox/ssh-audit

Scanner Configuration​

The following security scan configuration example are based on the ssh-audit Documentation, please take a look at the original documentation for more configuration examples.

usage: ssh-audit.py [options] <host>

   -h,  --help             print this help
   -1,  --ssh1             force ssh version 1 only
   -2,  --ssh2             force ssh version 2 only
   -4,  --ipv4             enable IPv4 (order of precedence)
   -6,  --ipv6             enable IPv6 (order of precedence)
   -b,  --batch            batch output
   -c,  --client-audit     starts a server on port 2222 to audit client
                               software config (use -p to change port;
                               use -t to change timeout)
   -d,  --debug            Enable debug output.
   -g,  --gex-test=<x[,y,...]>  dh gex modulus size test
                   <min1:pref1:max1[,min2:pref2:max2,...]>
                   <x-y[:step]>
   -j,  --json             JSON output (use -jj to enable indents)
   -l,  --level=<level>    minimum output level (info|warn|fail)
   -L,  --list-policies    list all the official, built-in policies
        --lookup=<alg1,alg2,...>    looks up an algorithm(s) without
                                    connecting to a server
   -m,  --manual           print the man page (Windows only)
   -M,  --make-policy=<policy.txt>  creates a policy based on the target server
                                    (i.e.: the target server has the ideal
                                    configuration that other servers should
                                    adhere to)
   -n,  --no-colors        disable colors
   -p,  --port=<port>      port to connect
   -P,  --policy=<"policy name" | policy.txt>  run a policy test using the
                                                   specified policy
   -t,  --timeout=<secs>   timeout (in seconds) for connection and reading
                               (default: 5)
   -T,  --targets=<hosts.txt>  a file containing a list of target hosts (one
                                   per line, format HOST[:PORT])
        --threads=<threads>    number of threads to use when scanning multiple
                                   targets (-T/--targets) (default: 32)
   -v,  --verbose          verbose output

Requirements​

Kubernetes: >=v1.11.0-0

Values​

KeyTypeDefaultDescription
cascadingRules.enabledboolfalse
envlist[]
extraContainerslist[]
extraVolumeMountslist[]
extraVolumeslist[]
parser.backoffLimitint3
parser.envlist[]
parser.image.pullPolicystring"IfNotPresent"Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
parser.image.repositorystring"docker.io/securecodebox/parser-ssh-audit"
parser.image.tagstringdefaults to the charts versionParser image tag
parser.scopeLimiterAliasesobject{}
parser.ttlSecondsAfterFinishedstringnil
scanner.backoffLimitint3
scanner.image.repositorystring"docker.io/securecodebox/scanner-ssh-audit"
scanner.image.tagstringnil
scanner.resourcesobject{}CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
scanner.ttlSecondsAfterFinishedstringnil
securityContext.allowPrivilegeEscalationboolfalse
securityContext.capabilities.drop[0]string"all"
securityContext.privilegedboolfalse
securityContext.readOnlyRootFilesystembooltrue
securityContext.runAsNonRootbooltrue

License​

License

Code of secureCodeBox is licensed under the Apache License 2.0.

Examples​

dummy-ssh​

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "ssh-ssh-demo-cluster-internal"
spec:
  scanType: "ssh-audit"
  parameters:
    - "dummy-ssh.demo-targets.svc"

port-example​

# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "ssh-audit-port-example"
spec:
  scanType: "ssh-audit"
  parameters:
    - "127.0.0.1"
    - "-p"
    - "29683"