CanuteTheGreat/sshd-hardening-auditor
Watch
1
0
Fork
You've already forked sshd-hardening-auditor
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
3 releases 5 tags
  • v1.2.2 c367cd89dc

    sshd-hardening-auditor v1.2.2
    All checks were successful
    tests / test (3.14) (push) Successful in 1m37s
    Details
    tests / test (3.8) (push) Successful in 1m41s
    Details
    release / release (push) Successful in 16s
    Details
    Stable

    Ghost released this 2026-10-17 03:19:45 -07:00 | 11 commits to main since this release

    • --remote: a server whose KEXINIT is cut short or carries a name-list longer than the packet is reported as
      ERROR -- malformed KEXINIT (exit 2) instead of crashing with a Python traceback (exit 1).
    • Tests: wire-contract suite for --remote (fragmented reads, pre-banner lines, every broken-server case,
      both-direction lists, Terrapin CBC+EtM, compression) and exact text/HTML reports.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor.git@v1.2.2
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.2/sshd_hardening_auditor-1.2.2-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.2/sshd_audit.py

    SHA-256

    4d2c8e695c39f2d876f4e8ff4b44acda1e34c8557b2b42c0968e05c2fecd4ab7  sshd_audit.py
09a51935f96adbe1a4a472979650f033549078ce34e0c7e06e2ddea3bce4566c  sshd_hardening_auditor-1.2.2-py3-none-any.whl
1df15e1bf13b6e283c061cda1142a4959be9e0bcb99e9036243ab5c4cc6026ef  sshd_hardening_auditor-1.2.2.tar.gz
    Downloads
  • v1.2.1 91a8bdfd75

    sshd-hardening-auditor v1.2.1
    All checks were successful
    tests / test (3.14) (push) Successful in 1m23s
    Details
    tests / test (3.8) (push) Successful in 1m38s
    Details
    release / release (push) Successful in 33s
    Details
    Stable

    Ghost released this 2026-10-17 01:50:12 -07:00 | 12 commits to main since this release

    • ChallengeResponseAuthentication and KbdInteractiveAuthentication are one option inside sshd, so the first of either now wins (the tool always preferred KbdInteractive, disagreeing with sshd -T whenever ChallengeResponse came first).
    • Times are read in sshd's format (1m, 90s, 1m30s, 2h): LoginGraceTime 1m used to fail and ClientAliveInterval 0s used to pass.
    • LoginGraceTime 0 (no limit at all) and ClientAliveCountMax 0 (never drops unresponsive clients, OpenSSH 8.2+) now fail their rules instead of passing as "<= limit".
    • Tests: accuracy suite (200 random configs whose verdicts must equal those from OpenSSH's own sshd -T, Mozilla's Modern guideline, Debian's stock config), mutation testing (nightly), claims ledger.
    • Time values with a trailing bare number (1m30, 0m45) are read the way sshd reads them (seconds), instead
      of failing ClientAliveInterval/LoginGraceTime as unparseable. Checked against sshd -T.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor.git@v1.2.1
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.1/sshd_hardening_auditor-1.2.1-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.1/sshd_audit.py

    SHA-256

    9cdd154eb130a887028bfd15b825fbd47675276421331edc3f11b25eef20d980  sshd_audit.py
c30505a3c4091437d7b7a0d40266c5218a7671a115c28e24b0500dcc11aecae9  sshd_hardening_auditor-1.2.1-py3-none-any.whl
7fa93f23fc92b4a025a51ac025d0208cee497d5a74cb6ffa79f6fe4c5dc37c7e  sshd_hardening_auditor-1.2.1.tar.gz
    Downloads
  • v1.2.0 3ab4a86ad6

    sshd-hardening-auditor v1.2.0
    All checks were successful
    tests / test (3.13) (push) Successful in 48s
    Details
    tests / test (3.8) (push) Successful in 56s
    Details
    release / release (push) Successful in 20s
    Details
    Stable

    Ghost released this 2026-10-16 19:57:38 -07:00 | 17 commits to main since this release

    • --remote host[:port]: reads a running server's KEXINIT over the network (no login) and judges the
      key exchange, host key, cipher and MAC algorithms it actually offers, plus Terrapin (CVE-2023-48795:
      chacha20-poly1305 or CBC+EtM without strict kex) and pre-auth zlib compression.
    • Much fuller algorithm policy with per-algorithm severities: SHA-1 KEX/host keys, ssh-rsa, ssh-dss,
      NIST curves, every CBC cipher, hmac-sha1, umac-64, non-ETM MACs, and a post-quantum KEX advisory.
    • New CIS checks: LogLevel, MaxSessions, MaxStartups, Banner, StrictModes, GSSAPIAuthentication,
      KbdInteractiveAuthentication (and its ChallengeResponseAuthentication alias), AllowUsers/AllowGroups,
      ClientAliveCountMax; sshd_config and host key ownership/permissions; RSA/DSA host key sizes
      (--no-file-checks to skip).
    • --fail-on (default high, the previous behaviour).
    • JSON results now include passing algorithm entries for every configured or offered algorithm list.
    • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor.git
      puts a sshd-hardening-auditor command on PATH (pyproject.toml, MIT license metadata).
    • --version flag.
    • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
    • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
    • CI installs the package with pip in a clean venv and checks --version/--help on every push.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor.git@v1.2.0
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.0/sshd_hardening_auditor-1.2.0-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.0/sshd_audit.py

    SHA-256

    98bb31097d56d9ace0837b833ad44cbc8d6cd56f09b1fe79d76facfc863cdfb0  sshd_audit.py
b1a551a8b996e51df2fb79433fbad4f0f199f9d55653ca35e2a433abea738790  sshd_hardening_auditor-1.2.0-py3-none-any.whl
4807796f8d485cfc880b8a6e94d8fbf788faa028c1d85e630da2d020b58d74b4  sshd_hardening_auditor-1.2.0.tar.gz
    Downloads