The server I am using is Ubuntu 10.10. To ensure security I want to edit the banner the server sends to the client.

If I telnet to my host on port 22 it tells me the exact version of SSH I am running (SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu4). The situation is the same with MySQL and Cyrus.

Any suggestions? At least for SSH?


  • 5
    I hope you also realise it takes more than just removing these banners to ensure your server is secure. Dec 28 '10 at 20:31
  • 10
    That information is largely irrelevant, bots will try hacks that work on older version regardless of what version information your server provides. Hostile users maliciously attacking your server are the least of your worries; careless users are usually much more dangerous.
    – Chris S
    Dec 28 '10 at 20:36
  • Ben, I think I know what I am asking. And I know how to protect a NIX-Server thanks. Chris, gropping in the dark is good too. Regardless of snort, iptables fail2bans etc.
    – Lerikun
    Dec 28 '10 at 20:52
  • as long as you know this is one of many things to do, that's alright. I didn't want you going away having done this thinking your system was super secure, that's all. Dec 28 '10 at 20:59
  • As Auticracy pointed out I want at least to hide "Debian-3ubuntu4".
    – Lerikun
    Dec 28 '10 at 21:05

Almost universally, identifying banners are part of the compiled code and do not have configuration options to alter or suppress them. You will have to recompile those pieces of software.

  • Thanks. The only real useful answer here. What about TCP Wrapper they just add a banner but do not hide the actual information?
    – Lerikun
    Dec 28 '10 at 20:54
  • 6
    Not only is it compiled in, it also is used by clients to determine compatible connection levels. Feb 20 '11 at 5:23

While it's prohibitively difficult to hide the version number of your SSH daemon, you can easily hide the linux version (Debian-3ubuntu4)

Add the following line to /etc/ssh/sshd_config

DebianBanner no

And restart your SSH daemon: /etc/init.d/ssh restart or service ssh restart

  • 10
    Thanks, this works perfectly! I agree that removing version info is security by obscurity, and might introduce more problems that it solves. With Debian though, OpenSSH not only announces it's own version, but the version and specific flavour of the operating system - i.e. "SSH-2.0-OpenSSH_6.7p1 Raspbian-5+deb8u3". Congratulations, without any kind of authentication, you're now aware that you're talking to a RaspberryPi running Raspbian, and your next obvious step would be to try to connect as "pi" with the default password. IMHO this is giving away WAY to much info on the first date.
    – Saustrup
    Nov 30 '16 at 8:31
  • Brilliant, one of the best hidden gems found here. Feb 19 '19 at 15:06

Hiding those won't secure your server. There are many more ways to fingerprint what your system is running. For SSH in particular, the version announcement is part of the protocol and is required.


  • The less people get to know about your system ... You can disagree. What about other services? I am talking in general about Cyrus (IMAP/POP3) and MySQL and others. And if there are two Admins - I dont need to stick to the protocol?!
    – Lerikun
    Dec 28 '10 at 20:45
  • 3
    @lerikun: It's not about sharing it with scary hackers. It's about SSH not being able to connect because it doesn't know what protocol to use. SSHD has to announce. Dec 28 '10 at 20:51
  • 10
    "the less people know about your system the better". Yes sure, that's a statement that sounds good but doesn't do much, like "If I win the lottery I'm gonna...". Security through obscurity is poor security at best.
    – Rob Moir
    Dec 28 '10 at 20:51
  • 1
    Robert, that's a statement which means a lot. Why the safe is in the dark room where noone can see it? ... Nevermind. I do not ask how to secure my server. I think my question was clear. Yes Autocracy I want at least to get rid of those.
    – Lerikun
    Dec 28 '10 at 20:55
  • 2
    For what it's worth, robert moir is completely right.
    – Sirex
    Dec 28 '10 at 21:07

As said above, changing a version number is

  1. Hard to do
  2. Security through obscurity
  3. Not flexible

What I suggest is implementing Port Knocking. It's a fairly simple technique to hide anything that is running on your server.

Here is a good implementation: http://www.zeroflux.org/projects/knock

This is how I implemented it on my servers (other numbers) to open SSH only to the people who know 'the secret knock':

    sequence = 300,4000,32
    seq_timeout = 5
    command = /opencloseport.sh %IP% 2305
    tcpflags = syn

This will give a 5 sec window in which the 3 SYN-packets need to be received in the right order. Choose ports that are far from each other and not sequential. That way, a portscanner can't open the port by accident. These ports do not need to be opened by iptables.

The script I call is this one. It opens a particular port for 5 seconds for the IP sending the SYN-packets.

/sbin/iptables -I INPUT -s $1 -p tcp --dport $2  -j ACCEPT
sleep 5
/sbin/iptables -D INPUT -s $1 -p tcp --dport $2  -j ACCEPT

It can be a real pain to send the SYN-packets so I use the script to connect to the SSH of my servers:

knock $1 $2
knock $1 $3
knock $1 $4
ssh $5@$1 -p $6

(It's pretty obvious what is happening here...)

After the connection is established, the port can be closed. Hint: Use Key-authentication. Otherwise you need to be very fast to type your password.


I'm pretty sure you can't actually change the version announcement.

The best ways to secure sshd are:

  1. Change the default port number.
  2. Forbid root logons.
  3. Force protocol 2 (assuming that it's not done by default).
  4. Whitelist the servers that are allowed to SSH in.

The first three can be done by modifying /etc/sshd_config

The fourth depends on which firewall software you're using.

  • 1/2/3 already done. using certificates no passowrds. Fail2ban(IMAP,POP,SMTP,VPN,WEB) and denyhosts (SSH) The question is about the version announcements for other services.
    – Lerikun
    Dec 28 '10 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.