Re: Change ssh version/greeting

On Thu, Nov 17, 2005 at 01:11:35AM -0700, [email protected] wrote:
> Hi guys, 
> 
> I'm a girl and currently using FC3. I'm trying to change the greeting of my 
> ssh (for security reasons). You see...when I type this:
> # telnet 10.10.5.137 22
>   Trying 10.10.5.137...
>   Connected to 10.10.5.137).
>   Escape character is '^]'.
>   SSH-1.99-OpenSSH_3.9p1   <------It show's my SSH version. This is what I 
> want to change. 

By default, OpenSSH does not ship with any user-configurable options to
change or remove the identification string, which is used to exchange
protocol versions during the handshake. There are two ways you can
modify the identification string: you can either modify the source code
and then recompile OpenSSH, or you can modify the executable binary
directly using a hex editor to block out the OpenSSH version with some
useless text.

Be careful with how you modify the identification string, though. The
protocol version is important during the initial algorithm negotiation
and key exchange handshake. The format of this string is defined in
section 3.2 of the SSH Transport Layer Protocol Internet-Draft[1].

[1] http://www.openssh.com/txt/draft-ietf-secsh-transport-14.txt

You may also want to reconsider running a self-modified and therefore
self-maintained version of OpenSSH, though. That will make it harder to
keep up with security and bug fix updates from upstream or from your
GNU/Linux distribution (RedHat FC in this case). Perhaps you will get
more mileage for your administrative overhead by focusing on keeping SSH
and other critical components of your system up-to-date.

Here are some other less-invasive things you can do to help reduce the
risk of break-ins through your SSH daemon:

    - Disable password-based logins in lieu of key-based authentication

    - Only enable SSH logins from a set of trusted users

    - Disable root logins

    - Firewall off SSH connections from all hosts except those that you
      know you'll be initiating connections from

    - Make SSH listen to a non-standard port

    - Implement an extra obfuscation layer by implementing port knocking

Good luck!

 --> Jijo

-- 
Federico Sevilla III : jijo.free.net.ph : When we speak of free software
GNU/Linux Specialist : GnuPG 0x93B746BE : we refer to freedom, not price.
_________________________________________________________
Philippine Linux Users' Group (PLUG) Newbie Mailing List
[email protected] (#PLUG @ irc.free.net.ph)
Read the Guidelines: http://linux.org.ph/lists
Searchable Archives: http://archives.free.net.ph