Now issues a warning when 2048-bit moduli are encountered.

README.md

@@ -182,6 +182,7 @@ For convenience, a web front-end on top of the command-line tool is available at
  - Added `-g` and `--gex-test` for granular GEX modulus size tests; credit [Adam Russell](https://github.com/thecliguy).
  - Snap packages now print more user-friendly error messages when permission errors are encountered.
  - JSON 'target' field now always includes port number; credit [tomatohater1337](https://github.com/tomatohater1337).
+ - Warnings are now printed for 2048-bit moduli.
  - Added 33 new host keys: `dsa2048-sha224@libassh.org`, `dsa2048-sha256@libassh.org`, `dsa3072-sha256@libassh.org`, `ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com`, `eddsa-e382-shake256@libassh.org`, `eddsa-e521-shake256@libassh.org`, `null`, `pgp-sign-dss`, `pgp-sign-rsa`, `spki-sign-dss`, `spki-sign-rsa`, `ssh-dss-sha224@ssh.com`, `ssh-dss-sha384@ssh.com`, `ssh-dss-sha512@ssh.com`, `ssh-ed448-cert-v01@openssh.com`, `ssh-rsa-sha224@ssh.com`, `ssh-rsa-sha2-256`, `ssh-rsa-sha2-512`, `ssh-rsa-sha384@ssh.com`, `ssh-rsa-sha512@ssh.com`, `ssh-xmss-cert-v01@openssh.com`, `ssh-xmss@openssh.com`, `webauthn-sk-ecdsa-sha2-nistp256@openssh.com`, `x509v3-ecdsa-sha2-1.3.132.0.10`, `x509v3-sign-dss-sha1`, `x509v3-sign-dss-sha224@ssh.com`, `x509v3-sign-dss-sha256@ssh.com`, `x509v3-sign-dss-sha384@ssh.com`, `x509v3-sign-dss-sha512@ssh.com`, `x509v3-sign-rsa-sha1`, `x509v3-sign-rsa-sha224@ssh.com`, `x509v3-sign-rsa-sha384@ssh.com`, `x509v3-sign-rsa-sha512@ssh.com`.
  - Added 46 new key exchanges: `diffie-hellman-group14-sha224@ssh.com`, `diffie-hellman_group17-sha512`, `diffie-hellman-group-exchange-sha224@ssh.com`, `diffie-hellman-group-exchange-sha384@ssh.com`, `ecdh-sha2-1.2.840.10045.3.1.1`, `ecdh-sha2-1.2.840.10045.3.1.7`, `ecdh-sha2-1.3.132.0.1`, `ecdh-sha2-1.3.132.0.16`, `ecdh-sha2-1.3.132.0.26`, `ecdh-sha2-1.3.132.0.27`, `ecdh-sha2-1.3.132.0.33`, `ecdh-sha2-1.3.132.0.34`, `ecdh-sha2-1.3.132.0.35`, `ecdh-sha2-1.3.132.0.36`, `ecdh-sha2-1.3.132.0.37`, `ecdh-sha2-1.3.132.0.38`, `ecdh-sha2-4MHB+NBt3AlaSRQ7MnB4cg==`, `ecdh-sha2-5pPrSUQtIaTjUSt5VZNBjg==`, `ecdh-sha2-9UzNcgwTlEnSCECZa7V1mw==`, `ecdh-sha2-D3FefCjYoJ/kfXgAyLddYA==`, `ecdh-sha2-h/SsxnLCtRBh7I9ATyeB3A==`, `ecdh-sha2-m/FtSAmrV4j/Wy6RVUaK7A==`, `ecdh-sha2-mNVwCXAoS1HGmHpLvBC94w==`, `ecdh-sha2-qCbG5Cn/jjsZ7nBeR7EnOA==`, `ecdh-sha2-qcFQaMAMGhTziMT0z+Tuzw==`, `ecdh-sha2-VqBg4QRPjxx1EXZdV0GdWQ==`, `ecdh-sha2-wiRIU8TKjMZ418sMqlqtvQ==`, `ecdh-sha2-zD/b3hu/71952ArpUG4OjQ==`, `ecmqv-sha2`, `gss-13.3.132.0.10-sha256-*`, `gss-curve25519-sha256-*`, `gss-curve448-sha512-*`, `gss-gex-sha1-*`, `gss-gex-sha256-*`, `gss-group14-sha1-*`, `gss-group14-sha256-*`, `gss-group15-sha512-*`, `gss-group16-sha512-*`, `gss-group17-sha512-*`, `gss-group18-sha512-*`, `gss-group1-sha1-*`, `gss-nistp256-sha256-*`, `gss-nistp384-sha256-*`, `gss-nistp521-sha512-*`, `m383-sha384@libassh.org`, `m511-sha512@libassh.org`.
  - Added 28 new ciphers: `3des-cfb`, `3des-ecb`, `3des-ofb`, `blowfish-cfb`, `blowfish-ecb`, `blowfish-ofb`, `camellia128-cbc@openssh.org`, `camellia128-ctr@openssh.org`, `camellia192-cbc@openssh.org`, `camellia192-ctr@openssh.org`, `camellia256-cbc@openssh.org`, `camellia256-ctr@openssh.org`, `cast128-cfb`, `cast128-ecb`, `cast128-ofb`, `cast128-12-cbc@ssh.com`, `idea-cfb`, `idea-ecb`, `idea-ofb`, `rijndael-cbc@ssh.com`, `seed-ctr@ssh.com`, `serpent128-gcm@libassh.org`, `serpent256-gcm@libassh.org`, `twofish128-gcm@libassh.org`, `twofish256-gcm@libassh.org`, `twofish-cfb`, `twofish-ecb`, `twofish-ofb`

docker_test.sh

@@ -661,7 +661,7 @@ run_openssh_test '5.6p1' 'test5' $PROGRAM_RETVAL_FAILURE
 echo
 run_openssh_test '8.0p1' 'test1' $PROGRAM_RETVAL_FAILURE
 run_openssh_test '8.0p1' 'test2' $PROGRAM_RETVAL_FAILURE
-run_openssh_test '8.0p1' 'test3' $PROGRAM_RETVAL_GOOD
+run_openssh_test '8.0p1' 'test3' $PROGRAM_RETVAL_WARNING
 echo
 run_dropbear_test '2019.78' 'test1' '-r /etc/dropbear/dropbear_rsa_host_key_1024 -r /etc/dropbear/dropbear_dss_host_key -r /etc/dropbear/dropbear_ecdsa_host_key' 3
 echo

src/ssh_audit/gextest.py

@@ -1,7 +1,7 @@
 """
    The MIT License (MIT)
 
-   Copyright (C) 2017-2021 Joe Testa (jtesta@positronsecurity.com)
+   Copyright (C) 2017-2023 Joe Testa (jtesta@positronsecurity.com)
 
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
@@ -220,5 +220,18 @@ class GEXTest:
                             del lst[1]
                             lst.insert(1, [text])
 
+                    # Moduli smaller than 3072 get flagged as a warning.
+                    elif smallest_modulus < 3072:
+                        lst = SSH2_KexDB.ALGORITHMS['kex'][gex_alg]
+
+                        # Ensure that a warning list exists for us to append to, below.
+                        while len(lst) < 3:
+                            lst.append([])
+
+                        # Ensure this is only added once.
+                        text = '2048-bit modulus only provides 112-bits of symmetric strength'
+                        if text not in lst[2]:
+                            lst[2].append(text)
+
                 if reconnect_failed:
                     break

src/ssh_audit/hostkeytest.py

@@ -1,7 +1,7 @@
 """
    The MIT License (MIT)
 
-   Copyright (C) 2017-2021 Joe Testa (jtesta@positronsecurity.com)
+   Copyright (C) 2017-2023 Joe Testa (jtesta@positronsecurity.com)
 
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
@@ -54,6 +54,9 @@ class HostKeyTest:
         'ssh-ed25519-cert-v01@openssh.com': {'cert': True, 'variable_key_len': False},
     }
 
+    TWO2K_MODULUS_WARNING = '2048-bit modulus only provides 112-bits of symmetric strength'
+
+
     @staticmethod
     def run(out: 'OutputBuffer', s: 'SSH_Socket', server_kex: 'SSH2_Kex') -> None:
         KEX_TO_DHGROUP = {
@@ -161,24 +164,34 @@ class HostKeyTest:
                     elif cert is True:
                         server_kex.set_rsa_key_size(host_key_type, hostkey_modulus_size, ca_modulus_size)
 
-                    # Keys smaller than 2048 result in a failure.  Update the database accordingly.
+                    # Keys smaller than 2048 result in a failure.  Keys smaller 3072 result in a warning.  Update the database accordingly.
-                    if (cert is False) and (hostkey_modulus_size < 2048):
+                    if (cert is False) and (hostkey_modulus_size < 3072):
                         for rsa_type in HostKeyTest.RSA_FAMILY:
                             alg_list = SSH2_KexDB.ALGORITHMS['key'][rsa_type]
 
-                            # If no failure list exists, add an empty failure list.
+                            # Ensure that failure & warning lists exist.
-                            if len(alg_list) < 2:
+                            while len(alg_list) < 3:
                                 alg_list.append([])
+
+                            # If the key is under 2048, add to the failure list.
+                            if hostkey_modulus_size < 2048:
                                 alg_list[1].append('using small %d-bit modulus' % hostkey_modulus_size)
-                    elif (cert is True) and ((hostkey_modulus_size < 2048) or (ca_modulus_size > 0 and ca_modulus_size < 2048)):  # pylint: disable=chained-comparison
+                            elif HostKeyTest.TWO2K_MODULUS_WARNING not in alg_list[2]:  # Issue a warning about 2048-bit moduli.
+                                alg_list[2].append(HostKeyTest.TWO2K_MODULUS_WARNING)
+
+                    elif (cert is True) and ((hostkey_modulus_size < 3072) or (ca_modulus_size > 0 and ca_modulus_size < 3072)):  # pylint: disable=chained-comparison
                         alg_list = SSH2_KexDB.ALGORITHMS['key'][host_key_type]
                         min_modulus = min(hostkey_modulus_size, ca_modulus_size)
                         min_modulus = min_modulus if min_modulus > 0 else max(hostkey_modulus_size, ca_modulus_size)
 
-                        # If no failure list exists, add an empty failure list.
+                        # Ensure that failure & warning lists exist.
-                        if len(alg_list) < 2:
+                        while len(alg_list) < 3:
                             alg_list.append([])
+
+                        if (hostkey_modulus_size < 2048) or (ca_modulus_size > 0 and ca_modulus_size < 2048):  # pylint: disable=chained-comparison
                             alg_list[1].append('using small %d-bit modulus' % min_modulus)
+                        elif HostKeyTest.TWO2K_MODULUS_WARNING not in alg_list[2]:
+                            alg_list[2].append(HostKeyTest.TWO2K_MODULUS_WARNING)
 
                 # If this host key type is in the RSA family, then mark them all as parsed (since results in one are valid for them all).
                 if host_key_type in HostKeyTest.RSA_FAMILY:

src/ssh_audit/ssh2_kexdb.py

@@ -61,6 +61,7 @@ class SSH2_KexDB:  # pylint: disable=too-few-public-methods
     WARN_UNTRUSTED = 'using untrusted algorithm'
     WARN_OPENSSH74_UNSAFE = 'disabled (in client) since OpenSSH 7.4, unsafe algorithm'
     WARN_OPENSSH72_LEGACY = 'disabled (in client) since OpenSSH 7.2, legacy algorithm'
+    WARN_2048BIT_MODULUS = '2048-bit modulus only provides 112-bits of symmetric strength'
 
     INFO_OPENSSH82_FUTURE_DEPRECATION = 'a future deprecation notice has been issued in OpenSSH 8.2: https://www.openssh.com/txt/release-8.2'
     INFO_OPENSSH69_CHACHA = 'default cipher since OpenSSH 6.9.'
@@ -68,7 +69,7 @@ class SSH2_KexDB:  # pylint: disable=too-few-public-methods
 
 
     ALGORITHMS: Dict[str, Dict[str, List[List[Optional[str]]]]] = {
-        # Format: 'algorithm_name': [['version_first_appeared_in'], [reason_for_failure1, reason_for_failure2, ...], [warning1, warning2, ...]]
+        # Format: 'algorithm_name': [['version_first_appeared_in'], [reason_for_failure1, reason_for_failure2, ...], [warning1, warning2, ...], [info1, info2, ...]]
         'kex': {
             'diffie-hellman-group1-sha1': [['2.3.0,d0.28,l10.2', '6.6', '6.9'], [FAIL_1024BIT_MODULUS, FAIL_OPENSSH67_UNSAFE, FAIL_OPENSSH70_LOGJAM], [WARN_HASH_WEAK]],
             'gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==': [[], [FAIL_1024BIT_MODULUS, FAIL_OPENSSH67_UNSAFE, FAIL_OPENSSH70_LOGJAM], [WARN_HASH_WEAK]],
@@ -77,11 +78,11 @@ class SSH2_KexDB:  # pylint: disable=too-few-public-methods
             'gss-gex-sha1-': [[], [], [WARN_HASH_WEAK]],
             'gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==': [[], [FAIL_1024BIT_MODULUS], [WARN_HASH_WEAK]],
             'gss-group1-sha1-': [[], [FAIL_1024BIT_MODULUS], [WARN_HASH_WEAK]],
-            'gss-group14-sha1-': [[], [], [WARN_HASH_WEAK]],
+            'gss-group14-sha1-': [[], [], [WARN_HASH_WEAK, WARN_2048BIT_MODULUS]],
-            'gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==': [[], [], [WARN_HASH_WEAK]],
+            'gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==': [[], [], [WARN_HASH_WEAK, WARN_2048BIT_MODULUS]],
-            'gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==': [[], [], [WARN_HASH_WEAK]],
+            'gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==': [[], [], [WARN_HASH_WEAK, WARN_2048BIT_MODULUS]],
-            'gss-group14-sha256-': [[]],
+            'gss-group14-sha256-': [[], [], [WARN_2048BIT_MODULUS]],
-            'gss-group14-sha256-toWM5Slw5Ew8Mqkay+al2g==': [[]],
+            'gss-group14-sha256-toWM5Slw5Ew8Mqkay+al2g==': [[], [], [WARN_2048BIT_MODULUS]],
             'gss-group15-sha512-': [[]],
             'gss-group15-sha512-toWM5Slw5Ew8Mqkay+al2g==': [[]],
             'gss-group16-sha512-': [[]],
@@ -92,9 +93,9 @@ class SSH2_KexDB:  # pylint: disable=too-few-public-methods
             'gss-curve448-sha512-*': [[]],
             'gss-gex-sha1-*': [[], [], [WARN_HASH_WEAK]],
             'gss-gex-sha256-*': [[]],
-            'gss-group1-sha1-*': [[], [], [WARN_HASH_WEAK]],
+            'gss-group1-sha1-*': [[], [FAIL_1024BIT_MODULUS], [WARN_HASH_WEAK]],
-            'gss-group14-sha1-*': [[], [], [WARN_HASH_WEAK]],
+            'gss-group14-sha1-*': [[], [], [WARN_HASH_WEAK, WARN_2048BIT_MODULUS]],
-            'gss-group14-sha256-*': [[]],
+            'gss-group14-sha256-*': [[], [], [WARN_2048BIT_MODULUS]],
             'gss-group15-sha512-*': [[]],
             'gss-group16-sha512-*': [[]],
             'gss-group17-sha512-*': [[]],
@@ -103,9 +104,9 @@ class SSH2_KexDB:  # pylint: disable=too-few-public-methods
             'gss-nistp384-sha256-*': [[], [FAIL_CURVES_WEAK]],
             'gss-nistp521-sha512-*': [[], [FAIL_CURVES_WEAK]],
             'diffie-hellman-group1-sha256': [[], [FAIL_1024BIT_MODULUS]],
-            'diffie-hellman-group14-sha1': [['3.9,d0.53,l10.6.0'], [], [WARN_HASH_WEAK]],
+            'diffie-hellman-group14-sha1': [['3.9,d0.53,l10.6.0'], [], [WARN_HASH_WEAK, WARN_2048BIT_MODULUS]],
-            'diffie-hellman-group14-sha256': [['7.3,d2016.73']],
+            'diffie-hellman-group14-sha256': [['7.3,d2016.73'], [], [WARN_2048BIT_MODULUS]],
-            'diffie-hellman-group14-sha256@ssh.com': [[]],
+            'diffie-hellman-group14-sha256@ssh.com': [[], [], [WARN_2048BIT_MODULUS]],
             'diffie-hellman-group15-sha256': [[]],
             'diffie-hellman-group15-sha256@ssh.com': [[]],
             'diffie-hellman-group15-sha384@ssh.com': [[]],
@@ -171,7 +172,7 @@ class SSH2_KexDB:  # pylint: disable=too-few-public-methods
             'curve448-sha512': [[]],
             'kexguess2@matt.ucc.asn.au': [['d2013.57']],
             'rsa1024-sha1': [[], [FAIL_1024BIT_MODULUS], [WARN_HASH_WEAK]],
-            'rsa2048-sha256': [[]],
+            'rsa2048-sha256': [[], [], [WARN_2048BIT_MODULUS]],
             'sntrup4591761x25519-sha512@tinyssh.org': [['8.0', '8.4'], [], [WARN_EXPERIMENTAL]],
             'sntrup761x25519-sha512@openssh.com': [['8.5'], [], []],
             'kexAlgoCurve25519SHA256': [[]],
@@ -225,8 +226,8 @@ class SSH2_KexDB:  # pylint: disable=too-few-public-methods
             'webauthn-sk-ecdsa-sha2-nistp256@openssh.com': [['8.3'], [FAIL_CURVES_WEAK]],
             'ssh-xmss@openssh.com': [['7.7'], [WARN_EXPERIMENTAL]],
             'ssh-xmss-cert-v01@openssh.com': [['7.7'], [WARN_EXPERIMENTAL]],
-            'dsa2048-sha224@libassh.org': [[], [FAIL_UNPROVEN]],
+            'dsa2048-sha224@libassh.org': [[], [FAIL_UNPROVEN], [WARN_2048BIT_MODULUS]],
-            'dsa2048-sha256@libassh.org': [[], [FAIL_UNPROVEN]],
+            'dsa2048-sha256@libassh.org': [[], [FAIL_UNPROVEN], [WARN_2048BIT_MODULUS]],
             'dsa3072-sha256@libassh.org': [[], [FAIL_UNPROVEN]],
             'ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com': [[], [FAIL_UNKNOWN]],
             'eddsa-e382-shake256@libassh.org': [[], [FAIL_UNPROVEN]],

src/ssh_audit/ssh_audit.py

@@ -2,7 +2,7 @@
 """
    The MIT License (MIT)
 
-   Copyright (C) 2017-2021 Joe Testa (jtesta@positronsecurity.com)
+   Copyright (C) 2017-2023 Joe Testa (jtesta@positronsecurity.com)
    Copyright (C) 2017 Andris Raugulis (moo@arthepsy.eu)
 
    Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -365,7 +365,7 @@ def output_recommendations(out: OutputBuffer, algs: Algorithms, software: Option
                         elif action == 'chg':
                             an, sg, fn = 'change', '!', out.fail
                             ret = False
-                            chg_additional_info = ' (increase modulus size to 2048 bits or larger)'
+                            chg_additional_info = ' (increase modulus size to 3072 bits or larger)'
                         b = '(SSH{})'.format(sshv) if sshv == 1 else ''
                         fm = '(rec) {0}{1}{2}-- {3} algorithm to {4}{5} {6}'
                         fn(fm.format(sg, name, p, alg_type, an, chg_additional_info, b))

test/docker/expected_results/dropbear_2019.78_test1.txt

@@ -13,8 +13,10 @@
                                      `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
 (kex) ecdh-sha2-nistp256             -- [fail] using weak elliptic curves
                                      `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
-(kex) diffie-hellman-group14-sha256  -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
+(kex) diffie-hellman-group14-sha256  -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
+                                     `- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
 (kex) diffie-hellman-group14-sha1    -- [warn] using weak hashing algorithm
+                                     `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                      `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 (kex) kexguess2@matt.ucc.asn.au      -- [info] available since Dropbear SSH 2013.57
 
@@ -80,6 +82,7 @@
 (rec) +twofish128-ctr                -- enc algorithm to append 
 (rec) +twofish256-ctr                -- enc algorithm to append 
 (rec) -diffie-hellman-group14-sha1   -- kex algorithm to remove 
+(rec) -diffie-hellman-group14-sha256 -- kex algorithm to remove 
 (rec) -hmac-sha1                     -- mac algorithm to remove 
 (rec) -hmac-sha2-256                 -- mac algorithm to remove 
 

test/docker/expected_results/openssh_4.0p1_test1.txt

@@ -35,6 +35,7 @@
                                                     `- [warn] using weak hashing algorithm
                                                     `- [info] available since OpenSSH 2.3.0
 (kex) diffie-hellman-group14-sha1         -- [warn] using weak hashing algorithm
+                                          `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                           `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 (kex) diffie-hellman-group1-sha1          -- [fail] using small 1024-bit modulus
                                           `- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm

test/docker/expected_results/openssh_5.6p1_test1.txt

@@ -28,6 +28,7 @@
                                                     `- [warn] using weak hashing algorithm
                                                     `- [info] available since OpenSSH 2.3.0
 (kex) diffie-hellman-group14-sha1           -- [warn] using weak hashing algorithm
+                                            `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                             `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 (kex) diffie-hellman-group1-sha1            -- [fail] using small 1024-bit modulus
                                             `- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
@@ -127,7 +128,7 @@
 (fin) ssh-rsa: SHA256:YZ457EBcJTSxRKI3yXRgtAj3PBf5B9/F36b1SVooml4
 
 # algorithm recommendations (for OpenSSH 5.6)
-(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 

test/docker/expected_results/openssh_5.6p1_test2.txt

@@ -28,6 +28,7 @@
                                                     `- [warn] using weak hashing algorithm
                                                     `- [info] available since OpenSSH 2.3.0
 (kex) diffie-hellman-group14-sha1           -- [warn] using weak hashing algorithm
+                                            `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                             `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 (kex) diffie-hellman-group1-sha1            -- [fail] using small 1024-bit modulus
                                             `- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
@@ -127,7 +128,7 @@
 (fin) ssh-rsa: SHA256:YZ457EBcJTSxRKI3yXRgtAj3PBf5B9/F36b1SVooml4
 
 # algorithm recommendations (for OpenSSH 5.6)
-(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 

test/docker/expected_results/openssh_5.6p1_test3.txt

@@ -28,6 +28,7 @@
                                                     `- [warn] using weak hashing algorithm
                                                     `- [info] available since OpenSSH 2.3.0
 (kex) diffie-hellman-group14-sha1           -- [warn] using weak hashing algorithm
+                                            `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                             `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 (kex) diffie-hellman-group1-sha1            -- [fail] using small 1024-bit modulus
                                             `- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
@@ -127,7 +128,7 @@
 (fin) ssh-rsa: SHA256:YZ457EBcJTSxRKI3yXRgtAj3PBf5B9/F36b1SVooml4
 
 # algorithm recommendations (for OpenSSH 5.6)
-(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 

test/docker/expected_results/openssh_5.6p1_test4.txt

@@ -28,6 +28,7 @@
                                                     `- [warn] using weak hashing algorithm
                                                     `- [info] available since OpenSSH 2.3.0
 (kex) diffie-hellman-group14-sha1           -- [warn] using weak hashing algorithm
+                                            `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                             `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 (kex) diffie-hellman-group1-sha1            -- [fail] using small 1024-bit modulus
                                             `- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
@@ -126,7 +127,7 @@
 (fin) ssh-rsa: SHA256:nsWtdJ9Z67Vrf7OsUzQov7esXhsWAfVppArGh25u244
 
 # algorithm recommendations (for OpenSSH 5.6)
-(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 

test/docker/expected_results/openssh_5.6p1_test5.txt

@@ -28,6 +28,7 @@
                                                     `- [warn] using weak hashing algorithm
                                                     `- [info] available since OpenSSH 2.3.0
 (kex) diffie-hellman-group14-sha1           -- [warn] using weak hashing algorithm
+                                            `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                             `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 (kex) diffie-hellman-group1-sha1            -- [fail] using small 1024-bit modulus
                                             `- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
@@ -125,7 +126,7 @@
 (fin) ssh-rsa: SHA256:nsWtdJ9Z67Vrf7OsUzQov7esXhsWAfVppArGh25u244
 
 # algorithm recommendations (for OpenSSH 5.6)
-(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 

test/docker/expected_results/openssh_8.0p1_test1.txt

@@ -19,11 +19,14 @@
                                             `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
 (kex) ecdh-sha2-nistp521                    -- [fail] using weak elliptic curves
                                             `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
-(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [info] available since OpenSSH 4.4
+(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
+                                                      `- [info] available since OpenSSH 4.4
 (kex) diffie-hellman-group16-sha512         -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
 (kex) diffie-hellman-group18-sha512         -- [info] available since OpenSSH 7.3
-(kex) diffie-hellman-group14-sha256         -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
+(kex) diffie-hellman-group14-sha256         -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
+                                            `- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
 (kex) diffie-hellman-group14-sha1           -- [warn] using weak hashing algorithm
+                                            `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                             `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 
 # host-key algorithms
@@ -72,12 +75,14 @@
 (fin) ssh-rsa: SHA256:nsWtdJ9Z67Vrf7OsUzQov7esXhsWAfVppArGh25u244
 
 # algorithm recommendations (for OpenSSH 8.0)
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) -ecdh-sha2-nistp256                   -- kex algorithm to remove 
 (rec) -ecdh-sha2-nistp384                   -- kex algorithm to remove 
 (rec) -ecdh-sha2-nistp521                   -- kex algorithm to remove 
 (rec) -ecdsa-sha2-nistp256                  -- key algorithm to remove 
 (rec) -ssh-rsa                              -- key algorithm to remove 
 (rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove 
+(rec) -diffie-hellman-group14-sha256        -- kex algorithm to remove 
 (rec) -hmac-sha1                            -- mac algorithm to remove 
 (rec) -hmac-sha1-etm@openssh.com            -- mac algorithm to remove 
 (rec) -hmac-sha2-256                        -- mac algorithm to remove 

test/docker/expected_results/openssh_8.0p1_test2.txt

@@ -19,11 +19,14 @@
                                             `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
 (kex) ecdh-sha2-nistp521                    -- [fail] using weak elliptic curves
                                             `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
-(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [info] available since OpenSSH 4.4
+(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
+                                                      `- [info] available since OpenSSH 4.4
 (kex) diffie-hellman-group16-sha512         -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
 (kex) diffie-hellman-group18-sha512         -- [info] available since OpenSSH 7.3
-(kex) diffie-hellman-group14-sha256         -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
+(kex) diffie-hellman-group14-sha256         -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
+                                            `- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
 (kex) diffie-hellman-group14-sha1           -- [warn] using weak hashing algorithm
+                                            `- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                             `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
 
 # host-key algorithms
@@ -64,12 +67,14 @@
 (fin) ssh-ed25519: SHA256:UrnXIVH+7dlw8UqYocl48yUEcKrthGDQG2CPCgp7MxU
 
 # algorithm recommendations (for OpenSSH 8.0)
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) -ecdh-sha2-nistp256                   -- kex algorithm to remove 
 (rec) -ecdh-sha2-nistp384                   -- kex algorithm to remove 
 (rec) -ecdh-sha2-nistp521                   -- kex algorithm to remove 
 (rec) +rsa-sha2-256                         -- key algorithm to append 
 (rec) +rsa-sha2-512                         -- key algorithm to append 
 (rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove 
+(rec) -diffie-hellman-group14-sha256        -- kex algorithm to remove 
 (rec) -hmac-sha1                            -- mac algorithm to remove 
 (rec) -hmac-sha1-etm@openssh.com            -- mac algorithm to remove 
 (rec) -hmac-sha2-256                        -- mac algorithm to remove 

test/docker/expected_results/openssh_8.0p1_test3.txt

@@ -13,7 +13,8 @@
 # key exchange algorithms
 (kex) curve25519-sha256                     -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
 (kex) curve25519-sha256@libssh.org          -- [info] available since OpenSSH 6.5, Dropbear SSH 2013.62
-(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [info] available since OpenSSH 4.4
+(kex) diffie-hellman-group-exchange-sha256 (2048-bit) -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
+                                                      `- [info] available since OpenSSH 4.4
 
 # host-key algorithms
 (key) ssh-ed25519                           -- [info] available since OpenSSH 6.5
@@ -36,9 +37,12 @@
 (fin) ssh-ed25519: SHA256:UrnXIVH+7dlw8UqYocl48yUEcKrthGDQG2CPCgp7MxU
 
 # algorithm recommendations (for OpenSSH 8.0)
-(rec) +diffie-hellman-group14-sha256        -- kex algorithm to append 
+(rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 3072 bits or larger) 
 (rec) +diffie-hellman-group16-sha512        -- kex algorithm to append 
 (rec) +diffie-hellman-group18-sha512        -- kex algorithm to append 
 (rec) +rsa-sha2-256                         -- key algorithm to append 
 (rec) +rsa-sha2-512                         -- key algorithm to append 
 
+# additional info
+(nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>
+

test/test_ssh2.py

@@ -147,7 +147,7 @@ class TestSSH2:
         self.audit(out, self._conf())
         out.write()
         lines = output_spy.flush()
-        assert len(lines) == 74
+        assert len(lines) == 73
 
     def test_ssh2_server_invalid_first_packet(self, output_spy, virtual_socket):
         vsocket = virtual_socket