Lessons learned from ~2K SSH host scan - Round 2

[claudijd]

Round 2 results (See round 1 here #122)

1.) We now have a robust enough implementation to now run against 2K hosts without a weird exception case that causes the scan to bork out 👍
2.) We reported 328 errors (this is not a reflection on SSH scan as much as it is the target population)
3.) Average scan time was 2.4709785984506114 per node 👍
3.) We need to up our game on banner fingerprinting (we should support all of these in our specs) 👎

"SSH-2.0-mpSSH_0.2.1",
"SSH-2.0-dropbear_2013.60",
"SSH-2.0-dropbear_2012.55",
"SSH-2.0-dropbear_0.52",
"SSH-2.0-cryptlib",
"SSH-2.0-ServerTech_SSH",
"SSH-2.0-RomSShell_4.62",
"SSH-2.0-PGP",
"SSH-2.0-OpenSSH_7.3p1 Debian-1",
"SSH-2.0-OpenSSH_7.3",
"SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1",
"SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu1",
"SSH-2.0-OpenSSH_7.2p2 Debian-8",
"SSH-2.0-OpenSSH_7.2p2 Debian-5",
"SSH-2.0-OpenSSH_7.2p2 Debian-2",
"SSH-2.0-OpenSSH_7.2",
"SSH-2.0-OpenSSH_7.1p1 Microsoft_Win32_port_with_VS",
"SSH-2.0-OpenSSH_7.1",
"SSH-2.0-OpenSSH_6.9p1 Ubuntu-2ubuntu0.2",
"SSH-2.0-OpenSSH_6.9",
"SSH-2.0-OpenSSH_6.8p1-hpn14v6",
"SSH-2.0-OpenSSH_6.7p1 Ubuntu-5ubuntu1",
"SSH-2.0-OpenSSH_6.7p1 Raspbian-5",
"SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3",
"SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u2",
"SSH-2.0-OpenSSH_6.7",
"SSH-2.0-OpenSSH_6.6p1-hpn14v4",
"SSH-2.0-OpenSSH_6.6p1 Ubuntu-2ubuntu1",
"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-8",
"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8",
"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7",
"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.6",
"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3",
"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2",
"SSH-2.0-OpenSSH_6.6.1",
"SSH-2.0-OpenSSH_6.6",
"SSH-2.0-OpenSSH_6.4",
"SSH-2.0-OpenSSH_6.2",
"SSH-2.0-OpenSSH_6.2 FIPS",
"SSH-2.0-OpenSSH_6.1",
"SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u4",
"SSH-2.0-OpenSSH_6.0",
"SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.9",
"SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.8",
"SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.10",
"SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1",
"SSH-2.0-OpenSSH_5.9",
"SSH-2.0-OpenSSH_5.8",
"SSH-2.0-OpenSSH_5.6",
"SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze2",
"SSH-2.0-OpenSSH_5.4p1 FreeBSD-20100308",
"SSH-2.0-OpenSSH_5.4",
"SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7.1",
"SSH-2.0-OpenSSH_5.3",
"SSH-2.0-OpenSSH_5.2",
"SSH-2.0-OpenSSH_4.6",
"SSH-2.0-OpenSSH_4.3",
"SSH-2.0-OpenSSH_12.1",
"SSH-2.0-NOS-SSH_2.0",
"SSH-2.0-Mocana SSH ",
"SSH-2.0-IPSSH-6.6.0",
"SSH-2.0-Cisco-1.25",
"SSH-2.0-5.32 FlowSsh
"SSH-1.99-OpenSSH_6.7",
"SSH-1.99-OpenSSH_5.3",
"SSH-1.99-OpenSSH_5.0",
"SSH-1.99-OpenSSH_3.7.1p2",
"SSH-1.99-Cisco-1.25",

[claudijd]

/cc @jinankjain

[claudijd]

4.) Total scan time was ~15min (w/ the default of 5 threads, single process) 👍

[claudijd]

5.) when we have an ubuntu version we don't understand, we will improperly spit out the cpe ( "os_cpe": "o:canonical:ubuntu:#SSHScan::OS::Ubuntu::Version:0x007f8c9e9741e0",) 👎

[claudijd]

More insight from 2 above about errors...

180     "error": "ConnectTimeout: Operation timed out - user specified timeout",
 59     "error": "ConnectTimeout: timeout during server version negotiating",
 43     "error": "NoKexResponse: service did not respond to our kex init request",
 21     "error": "Disconnected: connection closed by remote host",
 10     "error": "Disconnected: disconnected:  Protocol error\u0000 (11)",
  2     "error": "NoBanner: service did not respond with an SSH banner",
  2     "error": "Disconnected: disconnected:  (10)",
  1     "error": "Disconnected: disconnected: FlowSshUserAuthServer: requested service 'none' is not supported by this server, expecting 'ssh-connection' (7)",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",
  1     "error": "ConnectionRefused: Connection refused - connect(2) for REDACTED:22",