1

When I do an nmap -sV 127.0.0.1 -p 22 of my system I get the following information:

SF-Port22-TCP:V=4.62%I=7%D=11/9%Time=4916402C%P=i686-pc-linux-gnu%r(NULL,2 SF:7,"SSH-2.0-OpenSSH_5.1p1\x20Debian-3ubuntu1\r\n");

How do I go about chaining these two pieces of information? i686-pc-linux-gnu and SSH-2\.0-OpenSSH_5\.1p1\x20Debian-3ubuntu1.

3 Answers 3

1

I think trying to remove the header isn't the best way to add a little security here. All it really would be is security through obscruity which doesn't amount to that much.

Instead, I would suggest you look into port knocking. It is described for Linux in this article. I rather think your paranoid side will be pleased with this. Basically a scan would show the port as closed unless the scanner tried to scan certain ports in a certain order (A secret knock, so to speak).

You could also block people who exhibit scan behavior which some of the solutions mentioned in this serverfault post.

3
  • 1
    +1 Port knocking is very cool. Although i disagree with the security though obscurity comment. This information gives details that are only useful to attacker. By looking at this string an attacker knows I'm using a 64bit ubuntu system and they can make sure their exploit works against that system, this is especially important for buffer overflows where 1 wrong bit means a crash instead of a remote shell.
    – Rook
    Apr 26, 2010 at 22:41
  • My counter argument is that there are generally not many known holes in ssh at any given time. So, even if they can not tell what ssh version you have, they can try all the known exploits anyways (and probably will if they are really trying). I would also think that someone (maybe not you) would be more likely to create a security hole by messing with a binary with something like a hex editor than the possible security gain. You will also have to maintain this change for all future ssh updates. Up to you in the end of course, does sound like a fun experiment at the very least. Apr 26, 2010 at 22:48
  • I am not concerned with vulnerabilities in ssh per say. There aren't many vulnerabilities in ssh, so keeping it up to date won't be that difficult. I am more concerned with an attackers ability profile and then replicate my server and conduct simulated attacks such that a real attack will become more successful.
    – Rook
    Apr 26, 2010 at 22:57
2

You cannot remove it (easily/safely) it is part of the SSH protocol and used to determine what version of SSH is supported by sshd and should be left where it is. That said you might be able to use your favourite hex editor to change the string to another string of equal length. You will need at least: SSH-2.0 present. I really don't recommend that you do this, you will break the checksum for your sshd and it will be replaced whenever you update your sshd package. Again changing it will not achieve anything.

Telnetting onto port 22 will reveal this information also:

$ telnet localhost 22
Trying ::1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu3
0
-1

NMAP determines that information based on a certain amount of guesswork. If your SSHD responds to an NMAP probe at all then NMAP will check that response against it's database, and make a guess as to what system you're running.

The probes are pretty sophisticated; for example, it may try several variations of initiating a SSH connection on a port, to see which versions are recognized. It may attempt to provoke an error message, or it may just check the "hello" screen.

The surest way of blocking NMAP probes is by simply blocking NMAP probes all together at the firewall, and white listing servers that are allowed to SSH into your machines.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .