ssh: Port lib/ssh from x/crypto v0.7.0 #399
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR updates the lib/ssh package to be on par with x/crypto/ssh v0.7.0. I chose not to update to v0.14.0 to avoid possible incompatibilities with the x/crypto dependency of the project. Updating lib/ssh is necessary for zgrab2 to stay relevant in the future and retain its ability to scan a large variety of different SSH servers.
The following key changes ported from x/crypto are relevant for zgrab2:
In addition, I integrated some minor improvements myself:
--userauth
or the new--extensions
flag to be present.DontAuthenticate
config flag by splitting it into two separate flags (DontAuthenticate
andCollectUserAuth
) for better readabilityHow to Test
Simply scan a few SSH servers and observe the results. I was able to perform an entire IPv4 address range scan without issues.
Notes & Caveats
Without this PR (or a similar one), the SSH scanning capabilities of zgrab2 will slowly decline due to its lack of recent key exchange and cipher algorithms. In the future, it may be beneficial to implement additional algorithms to increase the overall coverage of zgrab2. However, since supported algorithms can be captured without supporting the actual algorithms, a sufficient amount of data is already available to the user.