Home > Network Pentesting

SSH Misconfigurations

SSH misconfigurations create serious security risks because SSH provides direct remote access to systems. When SSH is poorly configured, attackers can bypass authentication controls, use weak algorithms, exploit outdated versions, or gain elevated privileges. Enumerating and exploiting SSH misconfigurations helps pentesters identify weaknesses that can lead to unauthorized access.

Understanding SSH Attack Surface

SSH misconfigurations commonly involve:

  • Weak or outdated ciphers

  • Disabled security features

  • Weak authentication methods

  • Unsafe permissions on keys

  • Reused keys or passwords

  • Exposed version information

  • Outdated OpenSSH versions

  • Incorrectly configured access controls

Each issue provides an opportunity for unauthorized access or privilege escalation.

Identifying SSH Version and Features

SSH servers reveal version and system details in banners.

Checking Banner

nc -nv 10.10.10.5 22

Banners may reveal:

  • OpenSSH version

  • Operating system (Ubuntu, Debian, FreeBSD)

  • Patch levels

Old versions often contain known vulnerabilities.

Verbose Authentication Enumeration

ssh -vvv user@10.10.10.5

This reveals:

  • Allowed authentication types

  • Enabled algorithms

  • Preferred key types

  • Host key fingerprint

Weak or outdated algorithms indicate misconfigurations.

Weak or Deprecated Cryptographic Algorithms

SSH supports many algorithms, but older ones are insecure.

Common weak algorithms include:

  • DSA keys (1024-bit)

  • RSA < 2048-bit

  • MD5 HMAC

  • CBC mode ciphers

Enumerating SSH Algorithms

nmap --script ssh2-enum-algos -p22 10.10.10.5

This reveals:

  • Key exchange methods

  • Host key algorithms

  • Encryption algorithms

  • MAC algorithms

If outdated algorithms are present, SSH is misconfigured or running outdated software.

Weak Password Authentication

Allowing password login increases attack surface, especially if combined with weak passwords.

Testing Password Login Behavior

ssh user@10.10.10.5

If password authentication is enabled, brute-force attacks may be possible.

Checking Allowed Authentication in Verbose Output

debug1: Authentications that can continue: password,publickey

Pentesters inspect this to determine if password authentication should be disabled.

Public Key Misconfigurations

SSH keys must have strict permissions. Incorrectly set permissions allow attackers to read or steal private keys.

Checking Key Permissions (On Server)

Files should be:

~/.ssh/authorized_keys 600
~/.ssh/id_rsa 600

Weak permissions may allow privilege escalation.

Reused or Known Public Keys

Systems sometimes reuse default or poorly generated keys.
Pentesters check fingerprints using:

ssh-keyscan 10.10.10.5

If the key matches known fingerprints from shared images or templates, attackers may already possess the private key.

Root Login Enabled

SSH should not allow direct root login from remote connections.

Checking Root Login Policy

PermitRootLogin yes

If enabled, attackers may attempt direct brute-force or password reuse.

Misconfigured cloud instances often leave this setting open.

Missing Two-Factor Authentication

If SSH relies solely on passwords, it is vulnerable to brute-force attacks.
Pentesters check whether multi-factor authentication is present by reviewing authentication prompts and logs.

SSH Running on a Non-Standard Port

While not a vulnerability, moving SSH to another port can hide it from basic scans.
Pentesters must check all ports:

nmap -p- -sV 10.10.10.5

Non-standard ports may still expose misconfigurations.

Outdated OpenSSH Versions

Old OpenSSH versions have known vulnerabilities, such as:

  • Information disclosure

  • User enumeration

  • Timing attacks

  • Privilege escalation paths

After identifying version, pentesters match it with known CVEs.

Exploiting Common SSH Misconfigurations

Brute Force (When Allowed in Scope)

hydra -l user -P passwords.txt ssh://10.10.10.5

Public Key Injection via Writable Directories

If a user’s .ssh directory is writable:

echo "attacker_key" >> ~/.ssh/authorized_keys

This immediately grants SSH access.

Abuse of Weak Algorithms

Old SSH versions may allow downgrade attacks.
Pentesters check for:

  • Forced weak ciphers

  • Forced weak MACs

  • Man-in-the-middle downgrade potential

Pass-the-Key Attacks

If SSH private keys are discovered during enumeration, pentesters validate access:

ssh -i id_rsa user@10.10.10.5

Weak permissions or poor key management lead to compromise.

Why SSH Misconfigurations Matter

SSH provides powerful access to systems. Misconfigurations can give attackers direct entry or administrative privileges. Common issues like weak passwords, outdated algorithms, root login, and poor key management are major risks. Identifying these weaknesses helps secure the network and prevent remote compromise.

Intel Dump

  • SSH misconfigurations include weak algorithms, password login, reused keys, and outdated versions

  • Verbose SSH output reveals authentication and algorithm details

  • Tools include nc, ssh -vvv, ssh-keyscan, Hydra, and Nmap scripts

  • Weak keys, root login, and insecure configs lead to remote compromise

  • Proper SSH analysis is essential for securing remote access services

HOME LEARN COMMUNITY DASHBOARD