Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The server I am using is Ubuntu 10.10. To ensure security I want to edit the banner the server sends to the client.

If I telnet to my host on port 22 it tells me the exact version of SSH I am running (SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu4). The situation is the same with MySQL and Cyrus.

Any suggestions? At least for SSH?

Thanks

share|improve this question
4  
I hope you also realise it takes more than just removing these banners to ensure your server is secure. –  Ben Pilbrow Dec 28 '10 at 20:31
8  
That information is largely irrelevant, bots will try hacks that work on older version regardless of what version information your server provides. Hostile users maliciously attacking your server are the least of your worries; careless users are usually much more dangerous. –  Chris S Dec 28 '10 at 20:36
    
Ben, I think I know what I am asking. And I know how to protect a NIX-Server thanks. Chris, gropping in the dark is good too. Regardless of snort, iptables fail2bans etc. –  Lerikun Dec 28 '10 at 20:52
    
as long as you know this is one of many things to do, that's alright. I didn't want you going away having done this thinking your system was super secure, that's all. –  Ben Pilbrow Dec 28 '10 at 20:59
    
As Auticracy pointed out I want at least to hide "Debian-3ubuntu4". –  Lerikun Dec 28 '10 at 21:05

4 Answers 4

up vote 7 down vote accepted

Almost universally, identifying banners are part of the compiled code and do not have configuration options to alter or suppress them. You will have to recompile those pieces of software.

share|improve this answer
    
Thanks. The only real useful answer here. What about TCP Wrapper they just add a banner but do not hide the actual information? –  Lerikun Dec 28 '10 at 20:54
2  
Not only is it compiled in, it also is used by clients to determine compatible connection levels. –  Jeremy Bouse Feb 20 '11 at 5:23

Hiding those won't secure your server. There are many more ways to fingerprint what your system is running. For SSH in particular, the version announcement is part of the protocol and is required.

http://www.snailbook.com/faq/version-string.auto.html

share|improve this answer
    
The less people get to know about your system ... You can disagree. What about other services? I am talking in general about Cyrus (IMAP/POP3) and MySQL and others. And if there are two Admins - I dont need to stick to the protocol?! –  Lerikun Dec 28 '10 at 20:45
2  
@lerikun: It's not about sharing it with scary hackers. It's about SSH not being able to connect because it doesn't know what protocol to use. SSHD has to announce. –  Satanicpuppy Dec 28 '10 at 20:51
7  
"the less people know about your system the better". Yes sure, that's a statement that sounds good but doesn't do much, like "If I win the lottery I'm gonna...". Security through obscurity is poor security at best. –  RobM Dec 28 '10 at 20:51
1  
Robert, that's a statement which means a lot. Why the safe is in the dark room where noone can see it? ... Nevermind. I do not ask how to secure my server. I think my question was clear. Yes Autocracy I want at least to get rid of those. –  Lerikun Dec 28 '10 at 20:55
2  
For what it's worth, robert moir is completely right. –  Sirex Dec 28 '10 at 21:07

I'm pretty sure you can't actually change the version announcement.

The best ways to secure sshd are:

  1. Change the default port number.
  2. Forbid root logons.
  3. Force protocol 2 (assuming that it's not done by default).
  4. Whitelist the servers that are allowed to SSH in.

The first three can be done by modifying /etc/sshd_config

The fourth depends on which firewall software you're using.

share|improve this answer
    
1/2/3 already done. using certificates no passowrds. Fail2ban(IMAP,POP,SMTP,VPN,WEB) and denyhosts (SSH) The question is about the version announcements for other services. –  Lerikun Dec 28 '10 at 20:49

As said above, changing a version number is

  1. Hard to do
  2. Security through obscurity
  3. Not flexible

What I suggest is implementing Port Knocking. It's a fairly simple technique to hide anything that is running on your server.

Here is a good implementation: http://www.zeroflux.org/projects/knock

This is how I implemented it on my servers (other numbers) to open SSH only to the people who know 'the secret knock':

[openSSH]
    sequence = 300,4000,32
    seq_timeout = 5
    command = /opencloseport.sh %IP% 2305
    tcpflags = syn

This will give a 5 sec window in which the 3 SYN-packets need to be received in the right order. Choose ports that are far from each other and not sequential. That way, a portscanner can't open the port by accident. These ports do not need to be opened by iptables.

The script I call is this one. It opens a particular port for 5 seconds for the IP sending the SYN-packets.

#!/bin/bash
/sbin/iptables -I INPUT -s $1 -p tcp --dport $2  -j ACCEPT
sleep 5
/sbin/iptables -D INPUT -s $1 -p tcp --dport $2  -j ACCEPT

It can be a real pain to send the SYN-packets so I use the script to connect to the SSH of my servers:

#!/bin/bash
knock $1 $2
knock $1 $3
knock $1 $4
ssh $5@$1 -p $6

(It's pretty obvious what is happening here...)

After the connection is established, the port can be closed. Hint: Use Key-authentication. Otherwise you need to be very fast to type your password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.