search

mozilla / ssh_scan_api

An API for ssh_scan (https://github.com/mozilla/ssh_scan) and the backend API service for the Mozilla SSH Observatory (https://observatory.mozilla.org/)
31 stars 12 forks source link

Custom ports on sshscan.rubidus.com #97

Closed craigfrancis closed 7 years ago

craigfrancis commented 7 years ago

The instance that is running on https://sshscan.rubidus.com/api/v1/

Is it possible to change the allowed_ports so a custom port number (e.g. 222) can be specified?

At the moment it returns {"error":"invalid port"} for anything other than port 22.

Would be useful for Issue 126 on the Mozilla HTTP Observatory.

floatingatoll commented 7 years ago

I strongly encourage not doing so. Allowing arbitrary port numbers enables portscans of the entire open port range of any host on the Internet, which is sufficiently abuse-able to get a site permitting it taken down.

On Fri, Jul 21, 2017 at 05:31 Craig Francis notifications@github.com wrote:

The instance that is running on https://sshscan.rubidus.com/api/v1/

Is it possible to change the allowed_ports so a custom port number (e.g. 222) can be specified?

At the moment it returns {"error":"invalid port"} for anything other than port 22.

Would be useful for Issue 126 https://github.com/mozilla/http-observatory-website/issues/126 on the Mozilla HTTP Observatory https://observatory.mozilla.org/.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/mozilla/ssh_scan_api/issues/97, or mute the thread https://github.com/notifications/unsubscribe-auth/AAFqDD_sQu78gwlXC9ByPV67rZMz-FOZks5sQJo4gaJpZM4OfV8T .

claudijd commented 7 years ago

@craigfrancis the allowed ports configuration option was created to prevent abuse of our hosted instance and to allow anyone who wishes to setup up their own instance the ability to make their own choices there. The default for the API and the Mozilla hosted instances remain as 22 only, but if you have a need to scan non-std ports, here are your options...

craigfrancis commented 7 years ago

Fair call, I'll run it locally.