Bug 2971 - Prevent OpenSSH from advertising its version number
Summary: Prevent OpenSSH from advertising its version number
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 7.6p1
Hardware: All Linux
: P5 security
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-02-20 13:22 AEDT by Nagesh
Modified: 2021-03-04 09:53 AEDT (History)
1 user (show)

See Also:


Attachments
OpenSSH version captured from wireshark (8.57 KB, image/jpeg)
2019-02-20 13:22 AEDT, Nagesh
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Nagesh 2019-02-20 13:22:36 AEDT
Created attachment 3244 [details]
OpenSSH version captured from wireshark

Cyber security team has recommended to disable the OpenSSH software version advertising when the connection has been established.

RFC 4253 Says : The software version part is used commonly for interoperability and it is also not good idea to remove it.

OpenSSH software version advertising is part of the compiled code and do not have configuration options to alter or suppress them.

You have to modify the below code and recompile the software. 

src/ssh/version.h

-- #define SSH_VERSION "OpenSSH_7.6"
++ #define SSH_VERSION " " // length should be > 0

It will be good if you provide that option in sshd configuration file.

Thanks & Regards,
Nagesh
Comment 1 Damien Miller 2019-02-21 09:19:51 AEDT
Sorry but there is zero chance we will offer this as an option. The version number is used for a number of compatibility tweaks and bug workarounds, so removing it would greatly hinder our ability to interoperate and improve the protocol over time.

I'd also say that your security advise is bad: hiding the version number doesn't prevent an attacker from attempting exploits and doesn't even prevent the attacker from learning the version of software in use (protocol fingerprinting).
Comment 2 Damien Miller 2021-03-04 09:53:23 AEDT
close bugs that were resolved in OpenSSH 8.5 release cycle