Security Scanning — ssh-audit

~10 min · ssh-audit, scanning, weak-algorithms

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

An automated check on your sshd

ssh-audit connects to your SSH server and reports on the algorithms it advertises, flagging weak or deprecated ones. It's the cheap, automated way to verify your hardening from the network side — no need to read sshd_config and remember which ciphers are bad. The tool knows.

Code

Run ssh-audit·bash

# Install
pip install ssh-audit
# or
brew install ssh-audit

# Audit your own server
ssh-audit 192.168.1.100

# Non-default port
ssh-audit 192.168.1.100:2222

# Batch — fleet-wide audit
for host in $(cat ~/.fleet/all.txt); do
    echo "=== $host ==="
    ssh-audit "$host" 2>&1 | tail -30
done

# Output uses colors:
#   green/✓  good algorithm or setting
#   yellow/⚠ acceptable but not ideal
#   red/✗    weak — fix it

Tighten algorithms in sshd_config if needed·bash

# Modern, restrictive
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# Validate and restart
sudo sshd -t
sudo systemctl restart sshd

# Re-run ssh-audit
ssh-audit 192.168.1.100

External links

ssh-audit on GitHub

Exercise

Run ssh-audit against every machine in your fleet. Note which ones show any red or yellow. Investigate each: is it a legitimate trade-off (legacy cipher needed for compatibility) or actual drift? Add the batch script above to cron, weekly, with output mailed to yourself. Now you know the moment any server's posture drifts.