Module: SSH_FINGERPRINT

Defined in:
lib/audit/lib/ssh_fingerprint.rb

Overview

auntitled.blogspot.com/2010/07/identified-ubuntu-version-from-ssh.html

Defined Under Namespace

Classes: ParseException, ProgramExecutionException

Constant Summary collapse

TMP_DIRECTORY = 
'/tmp'

Class Method Summary collapse

Class Method Details

.fingerprint(host, port = 22) ⇒ Object 



211
212
213
214
215
216
217
218
219
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 211

def self.fingerprint(host, port = 22)
  return {
    :host => host,
    :port => port,
    :banner => get_banner(host, port),
    :host_keys => get_host_keys(host, port),
    :algorithms => get_algorithms(host, port),
    :version1 => version1_supported?(host, port)}
end

.get_algorithms(host, port = 22) ⇒ Object

Raises:



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 51

def self.get_algorithms(host, port = 22)
  file = get_temp_file()
  
  exit_ok = system("nmap -p#{port} -v -Pn --script ssh2-enum-algos -oX #{file} #{host} 2>/dev/null 1>/dev/null")
  raise ProgramExecutionException, "NMap returned exit code #{$?} instead of 0" unless exit_ok
  
  xml_data = File.open(file, "r") {|f| f.read}
  FileUtils.rm_f(file)
  doc = REXML::Document.new(xml_data)
  
#   raise ParseException, "NMap ssh script did not execute" unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
  return {} unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
  
  algorithm_lines = doc.elements['//script'].attributes['output'].lines

  algorithms = {}
  current_section = nil
  algorithm_lines.each do|line|
    if /^  ([a-z_]+) \([0-9]+\)$/.match(line) then
      current_section = $1
      algorithms[current_section] = []
    elsif /^      ([a-zA-Z0-9_@.=+-]+)$/.match(line) then
      raise ParseException, "algorithm line not preceded by an algorithm type section: '#{line}'" if current_section.nil?
      algorithms[current_section] << $1
    else
      if line.strip() != "" then
        raise ParseException, "unexpected line in nmap output: '#{line}'"
      end
    end
  end

  return algorithms
end

.get_banner(host, port = 22, timeout = 5) ⇒ Object 



163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 163

def self.get_banner(host, port = 22, timeout = 5)
  begin
    timeout(timeout) do
      sock = TCPSocket.new(host, port)
      sock.puts "SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu5\r\n"
      banner = sock.readline
      sock.close
      return banner
    end
  rescue Errno::EHOSTUNREACH
    return :HOST_UNREACHABLE
  rescue Errno::ECONNREFUSED
    return :CONNECTION_REFUSED
  rescue Timeout::Error
  end
  
  return :TIMEOUT
end

.get_host_keys(host, port = 22) ⇒ Object

Raises:



101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 101

def self.get_host_keys(host, port = 22)
  file = get_temp_file()
  
  exit_ok = system("nmap -p#{port} -v -Pn --script ssh-hostkey -oX #{file} #{host} 2>/dev/null 1>/dev/null")
  raise ProgramExecutionException, "NMap returned exit code #{$?} instead of 0" unless exit_ok
  
  xml_data = File.open(file, "r") {|f| f.read}
  FileUtils.rm_f(file)
  doc = REXML::Document.new(xml_data)
  
#   raise ParseException, "NMap ssh script did not execute" unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
  return [] unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
  
  keys_lines = doc.elements['//script'].attributes['output'].lines

  line_type = :fingerprint_line
  
  keys = []
  current_key = nil
  keys_lines.each do|line|
    line = line.strip
    if line_type == :fingerprint_line then
      line_type = :key_line
      match = /^([0-9]+) ([0-9a-f:]+) (\([A-Z0-9]+\))$/.match(line)
      if match then
        raise ParseException, "current_key is not nil, it should be" unless current_key.nil?
        
        current_key = {:length => match[1], :fingerprint => match[2], :type => match[3]}
      else
        raise ParseException, "Unexpected line '#{line}', expected fingerprint line"
      end
    else
      line_type = :fingerprint_line
      match = /^([a-z0-9_-]+) ([A-Za-z0-9+\/=]+)$/.match(line)
      if match then
        raise ParseException, "current_key is nil, it shouldn't be" if current_key.nil?
        
        current_key[:ssh_type] = match[1]
        current_key[:key] = match[2]
        keys << current_key
        current_key = nil
      else
        raise ParseException, "Unexpected line '#{line}', expected key line"
      end
    end
  end
  
  raise ParseException, "current_key is not nil, it should be" unless current_key.nil?
  return keys
end

.get_temp_file ⇒ Object

Create a name for a new temporary file and check that it does not exist yet. Returns [String] Name of unused temporary file



16
17
18
19
20
21
22
23
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 16

def self.get_temp_file()
  while true do
    file = TMP_DIRECTORY + '/' + RandomString::generate_name(20)
     if !File.exists?(file) then
      return file
    end
  end
end

.version1_supported?(host, port = 22, timeout = 5) ⇒ Boolean

Test if protocol version 1 is supported by the server

Parameter host [String] The target host to connect to Parameter port [Integer] Target port Parameter timeout [Integer] Timeout in seconds

Returns [Boolean/:TIMEOUT] true if remote server supports protocol version 1, false if protocol version 1 is not supported. :TIMEOUT if the connection times out; :HOST_UNREACHABLE if destination host is unreachable

Returns:

  • (Boolean) 


190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 190

def self.version1_supported?(host, port = 22, timeout = 5)
  begin
    timeout(timeout) do
      sock = TCPSocket.new(host, port)
      sock.puts "SSH-1.5-OpenSSH_5.3p1 Debian-3ubuntu5\r\n"
      banner = sock.readline
      data = sock.read(13)
      sock.close
      return /^....[\x00]+\x02/.match(data) != nil
    end
  rescue Errno::EHOSTUNREACH
    return :HOST_UNREACHABLE
  rescue Errno::ECONNREFUSED
    return :CONNECTION_REFUSED
  rescue Timeout::Error
  end
  
  return :TIMEOUT
end