P2PractitionerAbout 15 minutes

SSH Security

How SSH authentication and cryptography settings decide whether remote administration is a strength or a door.

OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/p2.html. Offline: openvapt learn P2.

Read First: P1

You Will Be Able To

Explain why key-based authentication beats passwords for SSH.
Explain the risk of direct root login.
Identify weak SSH ciphers, MACs and key exchange methods.

Authentication

Internet-facing SSH is guessed at constantly by automated tools. Public-key authentication cannot be guessed like a password and is not reused across sites. Disabling password and keyboard-interactive logins, and refusing empty passwords, removes guessing as an attack.

Root Login and Attempt Limits

Root is the one account name every attacker knows, and logging in as root directly loses the record of which person acted. Log in as a named user and use sudo. PermitRootLogin no blocks root entirely, and prohibit-password allows root to use keys only. A low MaxAuthTries makes guessing slower and noisier.

Cryptography

Old algorithms such as CBC-mode ciphers, RC4 and MD5 MACs have known weaknesses. RFC 9142 deprecates key exchange methods that use SHA-1, including 1024-bit Diffie-Hellman. SHA-1 MACs are also best avoided. Modern OpenSSH defaults are strong. Most weak settings come from old custom configuration lines.

In Summary

Use keys, not passwords. Do not let root log in directly. Keep attempt limits low. Remove old cipher, MAC and key exchange lines so OpenSSH uses its modern defaults.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Check	Title	Severity
`HOST-SSH-001`	SSH Allows Direct Root Login	High
`HOST-SSH-002`	SSH Password Authentication Enabled	Medium
`HOST-SSH-003`	SSH Permits Empty Passwords	Critical
`HOST-SSH-004`	SSH Offers Weak Cryptography	Medium
`HOST-SSH-005`	SSH X11 Forwarding Enabled	Low
`HOST-SSH-006`	SSH Allows Many Authentication Attempts	Low
`HOST-SSH-007`	SSH Forwarding Features Enabled	Medium
`HOST-SSH-008`	SSH Authentication Controls Too Permissive	Low
`HOST-SSH-009`	SSH Host Private Keys Readable by Others	High
`HOST-SSH-010`	SSH Server Configuration Writable by Non-Root Users	High
`HOST-SSH-011`	SSH Legacy Trust Options Enabled	Medium
`HOST-SSH-012`	SSH Logging Level Too Low	Low
`HOST-SSH-013`	SSH Authorized Keys Without Restrictions or Protection	Low

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

Run: openvapt explain HOST-SSH-004 and read the detection logic.
Run: openvapt demo --only HOST-SSH- and read the evidence lines for each finding.
On your own server: sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|ciphers'

Check Yourself

Answers are checked in your browser and never stored or sent.

1. Why is public-key authentication stronger than passwords for SSH?

Keys cannot be guessed by trying common passwordsKeys make SSH fasterKeys hide the serverKeys let any user log in as root

2. PermitRootLogin prohibit-password means:

Root may log in with a passwordRoot may log in only with a keyRoot may never log inRoot may log in only from the console

3. Which SSH cipher is considered weak?

aes256-gcmchacha20-poly1305aes128-cbcaes256-ctr

4. Why log in as a named user and use sudo instead of logging in as root?

Sudo is fasterIt keeps a record of which person acted and avoids the one name every attacker knowsRoot cannot use SSH keysIt turns off MaxAuthTries

5. What does a low MaxAuthTries setting do?

Blocks the address foreverMakes guessing slower and noisier by ending a connection after a few failuresDisables password loginsLimits the number of open sessions

6. Where do most weak SSH cryptography settings come from today?

Modern OpenSSH defaultsOld custom configuration linesThe client's web browserRFC 9142

References

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

Cite This Page

If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.

APA 7

OpenVAPT. (2026). P2: SSH Security (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p2.html

In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.

BibTeX

@misc{openvapt_p2,
  author       = {{OpenVAPT}},
  title        = {{P2: SSH Security}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p2.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}

Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.

Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.

Previous: P1 Linux Server Hardening Next: P3 Network Exposure and Firewalls

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt