CanuteTheGreat/sshd-hardening-auditor
Watch
1
0
Fork
You've already forked sshd-hardening-auditor
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
3 releases 5 tags
  • v1.2.0 3ab4a86ad6

    sshd-hardening-auditor v1.2.0
    All checks were successful
    tests / test (3.13) (push) Successful in 48s
    Details
    tests / test (3.8) (push) Successful in 56s
    Details
    release / release (push) Successful in 20s
    Details
    Stable

    Ghost released this 2026-10-16 19:57:38 -07:00 | 17 commits to main since this release

    • --remote host[:port]: reads a running server's KEXINIT over the network (no login) and judges the
      key exchange, host key, cipher and MAC algorithms it actually offers, plus Terrapin (CVE-2023-48795:
      chacha20-poly1305 or CBC+EtM without strict kex) and pre-auth zlib compression.
    • Much fuller algorithm policy with per-algorithm severities: SHA-1 KEX/host keys, ssh-rsa, ssh-dss,
      NIST curves, every CBC cipher, hmac-sha1, umac-64, non-ETM MACs, and a post-quantum KEX advisory.
    • New CIS checks: LogLevel, MaxSessions, MaxStartups, Banner, StrictModes, GSSAPIAuthentication,
      KbdInteractiveAuthentication (and its ChallengeResponseAuthentication alias), AllowUsers/AllowGroups,
      ClientAliveCountMax; sshd_config and host key ownership/permissions; RSA/DSA host key sizes
      (--no-file-checks to skip).
    • --fail-on (default high, the previous behaviour).
    • JSON results now include passing algorithm entries for every configured or offered algorithm list.
    • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor.git
      puts a sshd-hardening-auditor command on PATH (pyproject.toml, MIT license metadata).
    • --version flag.
    • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
    • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
    • CI installs the package with pip in a clean venv and checks --version/--help on every push.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor.git@v1.2.0
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.0/sshd_hardening_auditor-1.2.0-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/sshd-hardening-auditor/releases/download/v1.2.0/sshd_audit.py

    SHA-256

    98bb31097d56d9ace0837b833ad44cbc8d6cd56f09b1fe79d76facfc863cdfb0  sshd_audit.py
b1a551a8b996e51df2fb79433fbad4f0f199f9d55653ca35e2a433abea738790  sshd_hardening_auditor-1.2.0-py3-none-any.whl
4807796f8d485cfc880b8a6e94d8fbf788faa028c1d85e630da2d020b58d74b4  sshd_hardening_auditor-1.2.0.tar.gz
    Downloads