Lion Cipher Lab
Assess an SSH server's crypto with ssh-audit, harden it, and verify the fix
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
SSH is the front door of almost every Linux server, and in a penetration test or vulnerability assessment one of the first things you check on that door is not the password but the cryptography it is willing to speak. When an SSH client connects, the two sides negotiate which key exchange, host-key type, cipher and integrity check to use. If the server still offers an old one -- a SHA-1 based integrity check, a small Diffie-Hellman group -- that is an attack surface: any client (or anyone sitting in the network path) that can steer the negotiation toward the weakest common choice gets a…
What you'll learn
- what an SSH 'algorithm negotiation' is: the key exchange (KEX), host-key, cipher and MAC lists a server offers, and why a weak entry is a finding even if nobody has used it yet
- standing up a disposable OpenSSH server in Docker on 127.0.0.1:2222 so you assess only a machine you own
- running ssh-audit and reading its output: [fail] / [warn] / [info], the (rec) recommendations, and the exit code
- turning output into numbers (count fail/warn/rec lines before and after) so a fix is measured, not asserted
- hardening sshd_config KexAlgorithms, Ciphers, MACs and HostKeyAlgorithms from the ssh-audit hardening guide, validating with sshd -t, and re-auditing
- using ssh-audit policy mode (-M to create, -P to test) as a repeatable pass/fail check that catches configuration drift
- what the Terrapin warning (CVE-2023-48795, 'strict kex') means and how it is mitigated, at a conceptual level
- proving the compatibility cost of hardening by forcing an old client algorithm and reading the negotiation failure
- writing the result up as a pentest finding: evidence, severity reasoning, remediation, and verification
Steps in this lab
- What you are assessing, and how this differs from the other SSH labs
- Stand up a throwaway OpenSSH server you own, on 127.0.0.1:2222
- Install ssh-audit and take the BEFORE measurement
- Read the report like an assessor: real problems versus cautious opinions
- Terrapin (CVE-2023-48795) in plain words: what the warning means and how it is fixed
- Harden the four algorithm lists, validate, restart, and take the AFTER measurement
- Prove the cost: an older client is now refused
- Make it repeatable: ssh-audit policy mode, and catching drift
- Going further: a stricter config that scores zero, and why you might not ship it
- Write it up as a finding: evidence, severity, remediation, verification
- Tear it down