search

arthepsy / ssh-audit

SSH server auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)
MIT License
2.96k stars 269 forks source link

Warn if Protocol 1 is activated #12

Closed Yamakaky closed 7 years ago

Yamakaky commented 7 years ago

I think it's depreciated?

arthepsy commented 7 years ago

It should be, but unfortunately it is still pretty widely used. One example is Cisco devices, e.g.: ssh-audit-ssh1

Yamakaky commented 7 years ago

I said warn, not forbid ^^

arthepsy commented 7 years ago

SSH1 is rich of security vulnerabilities. It definitely should be "fail", not "warn".