Git/ssh-audit
1
0
Fork 0
mirror of https://github.com/jtesta/ssh-audit.git synced 2024-11-25 12:01:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

Updated availability of algorithms in Dropbear. (#257)

Browse Source
This commit is contained in:
Joe Testa 2024-03-19 15:47:09 -04:00
parent 9fae870260
commit 3d403b1d70
9 changed files with 25 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/ssh_audit/ssh2_kexdb.py
View File

@ -223,7 +223,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
'null': [[], [FAIL_PLAINTEXT]], 'null': [[], [FAIL_PLAINTEXT]],
'pgp-sign-dss': [[], [FAIL_1024BIT_MODULUS]], 'pgp-sign-dss': [[], [FAIL_1024BIT_MODULUS]],
'pgp-sign-rsa': [[], [FAIL_1024BIT_MODULUS]], 'pgp-sign-rsa': [[], [FAIL_1024BIT_MODULUS]],
'rsa-sha2-256': [['7.2']], 'rsa-sha2-256': [['7.2,d2020.79']],
'rsa-sha2-256-cert-v01@openssh.com': [['7.8']], 'rsa-sha2-256-cert-v01@openssh.com': [['7.8']],
'rsa-sha2-512': [['7.2']], 'rsa-sha2-512': [['7.2']],
'rsa-sha2-512-cert-v01@openssh.com': [['7.8']], 'rsa-sha2-512-cert-v01@openssh.com': [['7.8']],
@ -242,7 +242,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
'ssh-dss-sha256@ssh.com': [[], [FAIL_1024BIT_MODULUS]], 'ssh-dss-sha256@ssh.com': [[], [FAIL_1024BIT_MODULUS]],
'ssh-dss-sha384@ssh.com': [[], [FAIL_1024BIT_MODULUS]], 'ssh-dss-sha384@ssh.com': [[], [FAIL_1024BIT_MODULUS]],
'ssh-dss-sha512@ssh.com': [[], [FAIL_1024BIT_MODULUS]], 'ssh-dss-sha512@ssh.com': [[], [FAIL_1024BIT_MODULUS]],
'ssh-ed25519': [['6.5,l10.7.0']], 'ssh-ed25519': [['6.5,d2020.79,l10.7.0']],
'ssh-ed25519-cert-v01@openssh.com': [['6.5']], 'ssh-ed25519-cert-v01@openssh.com': [['6.5']],
'ssh-ed448': [[]], 'ssh-ed448': [[]],
'ssh-ed448-cert-v01@openssh.com': [[], [], [], [INFO_NEVER_IMPLEMENTED_IN_OPENSSH]], 'ssh-ed448-cert-v01@openssh.com': [[], [], [], [INFO_NEVER_IMPLEMENTED_IN_OPENSSH]],
@ -335,7 +335,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
'cast128-ecb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]], 'cast128-ecb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
'cast128-ofb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]], 'cast128-ofb': [[], [FAIL_CAST], [WARN_CIPHER_MODE]],
'chacha20-poly1305': [[], [], [], [INFO_DEFAULT_OPENSSH_CIPHER]], 'chacha20-poly1305': [[], [], [], [INFO_DEFAULT_OPENSSH_CIPHER]],
'chacha20-poly1305@openssh.com': [['6.5'], [], [], [INFO_DEFAULT_OPENSSH_CIPHER]], 'chacha20-poly1305@openssh.com': [['6.5,d2020.79'], [], [], [INFO_DEFAULT_OPENSSH_CIPHER]],
'crypticore128@ssh.com': [[], [FAIL_UNPROVEN]], 'crypticore128@ssh.com': [[], [FAIL_UNPROVEN]],
'des-cbc': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]], 'des-cbc': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],
'des-cfb': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]], 'des-cfb': [[], [FAIL_DES], [WARN_CIPHER_MODE, WARN_BLOCK_SIZE]],

6
test/docker/expected_results/openssh_8.0p1_test1.json
View File

@ -40,7 +40,7 @@
"notes": { "notes": {
"info": [ "info": [
"default cipher since OpenSSH 6.9", "default cipher since OpenSSH 6.9",
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
], ],
"warn": [ "warn": [
"vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation" "vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation"
@ -229,7 +229,7 @@
"keysize": 3072, "keysize": 3072,
"notes": { "notes": {
"info": [ "info": [
"available since OpenSSH 7.2" "available since OpenSSH 7.2, Dropbear SSH 2020.79"
] ]
} }
}, },
@ -264,7 +264,7 @@
"algorithm": "ssh-ed25519", "algorithm": "ssh-ed25519",
"notes": { "notes": {
"info": [ "info": [
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
] ]
} }
} }

8
test/docker/expected_results/openssh_8.0p1_test1.txt
View File

@ -1,7 +1,7 @@
# general # general
(gen) banner: SSH-2.0-OpenSSH_8.0 (gen) banner: SSH-2.0-OpenSSH_8.0
(gen) software: OpenSSH 8.0 (gen) software: OpenSSH 8.0
(gen) compatibility: OpenSSH 7.4+, Dropbear SSH 2018.76+ (gen) compatibility: OpenSSH 7.4+, Dropbear SSH 2020.79+
(gen) compression: enabled (zlib@openssh.com) (gen) compression: enabled (zlib@openssh.com)
# security # security
@ -33,18 +33,18 @@
# host-key algorithms # host-key algorithms
(key) rsa-sha2-512 (3072-bit) -- [info] available since OpenSSH 7.2 (key) rsa-sha2-512 (3072-bit) -- [info] available since OpenSSH 7.2
(key) rsa-sha2-256 (3072-bit) -- [info] available since OpenSSH 7.2 (key) rsa-sha2-256 (3072-bit) -- [info] available since OpenSSH 7.2, Dropbear SSH 2020.79
(key) ssh-rsa (3072-bit) -- [fail] using broken SHA-1 hash algorithm (key) ssh-rsa (3072-bit) -- [fail] using broken SHA-1 hash algorithm
`- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28 `- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28
`- [info] deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8 `- [info] deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8
(key) ecdsa-sha2-nistp256 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency (key) ecdsa-sha2-nistp256 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
 `- [warn] using weak random number generator could reveal the key  `- [warn] using weak random number generator could reveal the key
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62 `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(key) ssh-ed25519 -- [info] available since OpenSSH 6.5 (key) ssh-ed25519 -- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
# encryption algorithms (ciphers) # encryption algorithms (ciphers)
(enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation (enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation
`- [info] available since OpenSSH 6.5 `- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
`- [info] default cipher since OpenSSH 6.9 `- [info] default cipher since OpenSSH 6.9
(enc) aes128-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52 (enc) aes128-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
(enc) aes192-ctr -- [info] available since OpenSSH 3.7 (enc) aes192-ctr -- [info] available since OpenSSH 3.7

4
test/docker/expected_results/openssh_8.0p1_test2.json
View File

@ -40,7 +40,7 @@
"notes": { "notes": {
"info": [ "info": [
"default cipher since OpenSSH 6.9", "default cipher since OpenSSH 6.9",
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
], ],
"warn": [ "warn": [
"vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation" "vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation"
@ -209,7 +209,7 @@
"algorithm": "ssh-ed25519", "algorithm": "ssh-ed25519",
"notes": { "notes": {
"info": [ "info": [
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
] ]
} }
}, },

6
test/docker/expected_results/openssh_8.0p1_test2.txt
View File

@ -1,7 +1,7 @@
# general # general
(gen) banner: SSH-2.0-OpenSSH_8.0 (gen) banner: SSH-2.0-OpenSSH_8.0
(gen) software: OpenSSH 8.0 (gen) software: OpenSSH 8.0
(gen) compatibility: OpenSSH 7.4+, Dropbear SSH 2018.76+ (gen) compatibility: OpenSSH 7.4+, Dropbear SSH 2020.79+
(gen) compression: enabled (zlib@openssh.com) (gen) compression: enabled (zlib@openssh.com)
# security # security
@ -32,12 +32,12 @@
`- [info] available since OpenSSH 3.9, Dropbear SSH 0.53 `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
# host-key algorithms # host-key algorithms
(key) ssh-ed25519 -- [info] available since OpenSSH 6.5 (key) ssh-ed25519 -- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
(key) ssh-ed25519-cert-v01@openssh.com (256-bit cert/256-bit ssh-ed25519 CA) -- [info] available since OpenSSH 6.5 (key) ssh-ed25519-cert-v01@openssh.com (256-bit cert/256-bit ssh-ed25519 CA) -- [info] available since OpenSSH 6.5
# encryption algorithms (ciphers) # encryption algorithms (ciphers)
(enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation (enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation
`- [info] available since OpenSSH 6.5 `- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
`- [info] default cipher since OpenSSH 6.9 `- [info] default cipher since OpenSSH 6.9
(enc) aes128-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52 (enc) aes128-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
(enc) aes192-ctr -- [info] available since OpenSSH 3.7 (enc) aes192-ctr -- [info] available since OpenSSH 3.7

4
test/docker/expected_results/openssh_8.0p1_test3.json
View File

@ -40,7 +40,7 @@
"notes": { "notes": {
"info": [ "info": [
"default cipher since OpenSSH 6.9", "default cipher since OpenSSH 6.9",
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
], ],
"warn": [ "warn": [
"vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation" "vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation"
@ -135,7 +135,7 @@
"algorithm": "ssh-ed25519", "algorithm": "ssh-ed25519",
"notes": { "notes": {
"info": [ "info": [
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
] ]
} }
} }

6
test/docker/expected_results/openssh_8.0p1_test3.txt
View File

@ -1,7 +1,7 @@
# general # general
(gen) banner: SSH-2.0-OpenSSH_8.0 (gen) banner: SSH-2.0-OpenSSH_8.0
(gen) software: OpenSSH 8.0 (gen) software: OpenSSH 8.0
(gen) compatibility: OpenSSH 7.4+, Dropbear SSH 2018.76+ (gen) compatibility: OpenSSH 7.4+, Dropbear SSH 2020.79+
(gen) compression: enabled (zlib@openssh.com) (gen) compression: enabled (zlib@openssh.com)
# security # security
@ -19,11 +19,11 @@
 `- [info] OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).  `- [info] OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).
# host-key algorithms # host-key algorithms
(key) ssh-ed25519 -- [info] available since OpenSSH 6.5 (key) ssh-ed25519 -- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
# encryption algorithms (ciphers) # encryption algorithms (ciphers)
(enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation (enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation
`- [info] available since OpenSSH 6.5 `- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
`- [info] default cipher since OpenSSH 6.9 `- [info] default cipher since OpenSSH 6.9
(enc) aes256-gcm@openssh.com -- [info] available since OpenSSH 6.2 (enc) aes256-gcm@openssh.com -- [info] available since OpenSSH 6.2
(enc) aes128-gcm@openssh.com -- [info] available since OpenSSH 6.2 (enc) aes128-gcm@openssh.com -- [info] available since OpenSSH 6.2

4
test/docker/expected_results/tinyssh_20190101_test1.json
View File

@ -18,7 +18,7 @@
"notes": { "notes": {
"info": [ "info": [
"default cipher since OpenSSH 6.9", "default cipher since OpenSSH 6.9",
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
], ],
"warn": [ "warn": [
"vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation" "vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation"
@ -75,7 +75,7 @@
"algorithm": "ssh-ed25519", "algorithm": "ssh-ed25519",
"notes": { "notes": {
"info": [ "info": [
"available since OpenSSH 6.5" "available since OpenSSH 6.5, Dropbear SSH 2020.79"
] ]
} }
} }

6
test/docker/expected_results/tinyssh_20190101_test1.txt
View File

@ -1,6 +1,6 @@
# general # general
(gen) software: TinySSH noversion (gen) software: TinySSH noversion
(gen) compatibility: OpenSSH 8.0-8.4, Dropbear SSH 2018.76+ (gen) compatibility: OpenSSH 8.0-8.4, Dropbear SSH 2020.79+
(gen) compression: disabled (gen) compression: disabled
# key exchange algorithms # key exchange algorithms
@ -13,11 +13,11 @@
`- [info] the sntrup4591761 algorithm was withdrawn, as it may not provide strong post-quantum security `- [info] the sntrup4591761 algorithm was withdrawn, as it may not provide strong post-quantum security
# host-key algorithms # host-key algorithms
(key) ssh-ed25519 -- [info] available since OpenSSH 6.5 (key) ssh-ed25519 -- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
# encryption algorithms (ciphers) # encryption algorithms (ciphers)
(enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation (enc) chacha20-poly1305@openssh.com -- [warn] vulnerable to the Terrapin attack (CVE-2023-48795), allowing message prefix truncation
`- [info] available since OpenSSH 6.5 `- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
`- [info] default cipher since OpenSSH 6.9 `- [info] default cipher since OpenSSH 6.9
# message authentication code algorithms # message authentication code algorithms