--- title: "P2: SSH Security" canonical: https://openvapt.com/academy/p2.html html: https://openvapt.com/academy/p2.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P2: SSH Security How SSH authentication and cryptography settings decide whether remote administration is a strength or a door. - Level: Practitioner - Time: about 15 minutes - Read first: P1 ## You Will Be Able To - Explain why key-based authentication beats passwords for SSH. - Explain the risk of direct root login. - Identify weak SSH ciphers, MACs and key exchange methods. ## Authentication Internet-facing SSH is guessed at constantly by automated tools. Public-key authentication cannot be guessed like a password and is not reused across sites. Disabling password and keyboard-interactive logins, and refusing empty passwords, removes guessing as an attack. ## Root Login and Attempt Limits Root is the one account name every attacker knows, and logging in as root directly loses the record of which person acted. Log in as a named user and use sudo. PermitRootLogin no blocks root entirely, and prohibit-password allows root to use keys only. A low MaxAuthTries makes guessing slower and noisier. ## Cryptography Old algorithms such as CBC-mode ciphers, RC4 and MD5 MACs have known weaknesses. RFC 9142 deprecates key exchange methods that use SHA-1, including 1024-bit Diffie-Hellman. SHA-1 MACs are also best avoided. Modern OpenSSH defaults are strong. Most weak settings come from old custom configuration lines. ## In Summary Use keys, not passwords. Do not let root log in directly. Keep attempt limits low. Remove old cipher, MAC and key exchange lines so OpenSSH uses its modern defaults. ## Apply It - [HOST-SSH-001 SSH Allows Direct Root Login](https://openvapt.com/checks/HOST-SSH-001.md) (high) - [HOST-SSH-002 SSH Password Authentication Enabled](https://openvapt.com/checks/HOST-SSH-002.md) (medium) - [HOST-SSH-003 SSH Permits Empty Passwords](https://openvapt.com/checks/HOST-SSH-003.md) (critical) - [HOST-SSH-004 SSH Offers Weak Cryptography](https://openvapt.com/checks/HOST-SSH-004.md) (medium) - [HOST-SSH-005 SSH X11 Forwarding Enabled](https://openvapt.com/checks/HOST-SSH-005.md) (low) - [HOST-SSH-006 SSH Allows Many Authentication Attempts](https://openvapt.com/checks/HOST-SSH-006.md) (low) - [HOST-SSH-007 SSH Forwarding Features Enabled](https://openvapt.com/checks/HOST-SSH-007.md) (medium) - [HOST-SSH-008 SSH Authentication Controls Too Permissive](https://openvapt.com/checks/HOST-SSH-008.md) (low) - [HOST-SSH-009 SSH Host Private Keys Readable by Others](https://openvapt.com/checks/HOST-SSH-009.md) (high) - [HOST-SSH-010 SSH Server Configuration Writable by Non-Root Users](https://openvapt.com/checks/HOST-SSH-010.md) (high) - [HOST-SSH-011 SSH Legacy Trust Options Enabled](https://openvapt.com/checks/HOST-SSH-011.md) (medium) - [HOST-SSH-012 SSH Logging Level Too Low](https://openvapt.com/checks/HOST-SSH-012.md) (low) - [HOST-SSH-013 SSH Authorized Keys Without Restrictions or Protection](https://openvapt.com/checks/HOST-SSH-013.md) (low) ## Lab 1. `Run: openvapt explain HOST-SSH-004 and read the detection logic.` 2. `Run: openvapt demo --only HOST-SSH- and read the evidence lines for each finding.` 3. `On your own server: sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|ciphers'` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why is public-key authentication stronger than passwords for SSH? - A. Keys cannot be guessed by trying common passwords - B. Keys make SSH faster - C. Keys hide the server - D. Keys let any user log in as root - Answer: A. Keys remove password guessing and password reuse as attack paths. 2. PermitRootLogin prohibit-password means: - A. Root may log in with a password - B. Root may log in only with a key - C. Root may never log in - D. Root may log in only from the console - Answer: B. It blocks password and keyboard-interactive logins for root while still allowing keys. 3. Which SSH cipher is considered weak? - A. aes256-gcm - B. chacha20-poly1305 - C. aes128-cbc - D. aes256-ctr - Answer: C. CBC-mode SSH ciphers have known weaknesses. GCM, ChaCha20-Poly1305 and CTR modes are accepted. 4. Why log in as a named user and use sudo instead of logging in as root? - A. Sudo is faster - B. It keeps a record of which person acted and avoids the one name every attacker knows - C. Root cannot use SSH keys - D. It turns off MaxAuthTries - Answer: B. Direct root logins lose the record of who acted, and root is the account name every attacker tries first. 5. What does a low MaxAuthTries setting do? - A. Blocks the address forever - B. Makes guessing slower and noisier by ending a connection after a few failures - C. Disables password logins - D. Limits the number of open sessions - Answer: B. MaxAuthTries caps failed attempts per connection. Attackers must reconnect more often, which is slower and leaves more log lines. 6. Where do most weak SSH cryptography settings come from today? - A. Modern OpenSSH defaults - B. Old custom configuration lines - C. The client's web browser - D. RFC 9142 - Answer: B. Modern OpenSSH defaults are strong. Weak algorithms usually come from old lines someone added to sshd_config. RFC 9142 deprecates weak key exchange methods. ## Key Terms - Public-Key Authentication: Logging in by proving possession of a private key instead of typing a password. - Brute Force: Trying many passwords or keys in turn until one works. - Cipher: An algorithm that encrypts and decrypts data. - MAC: Message authentication code: a value that proves a message was not altered and came from someone with the key. - Key Exchange: The method two parties use to agree on encryption keys over an untrusted network. ## References - [OpenBSD, sshd_config(5)](https://man.openbsd.org/sshd_config) - [RFC 9142, Key Exchange Method Updates for SSH](https://www.rfc-editor.org/rfc/rfc9142.html) Offline: `openvapt learn P2`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p2.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.