I did a tcpdump when connecting to my server over ssh. First thing I see is:
Is it possible to make the server not send it's ssh version?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
Not without recompiling the source code.
It is used to negotiate compatibility between the server and the client.
There is a method, described here, and reproduced for completeness, but I would not recommend it, as it would need to be repeated every time the software is updated.
Copy the file
# cp /usr/sbin/sshd /tmp
Find the location of text OpenSSH in it using the
Look for text
SSH-2.0-OpenSSH_5.x since it is the version showed in
# cd /tmp # strings -t d -a -n 7 sshd | grep -i ssh-2 521008 OpenSSH-2.0*,OpenSSH-2.1*,OpenSSH_2.1*,OpenSSH_2.2*
Remove the 521008 line from the above output using the
# dd if=./sshd bs=1 skip=521008 count=11 | od -A n -c 11+0 records in 11+0 records out O p e n S S H - 2 . 0 11 bytes (11 B) copied, 0.000208606 s, 52.7 kB/s # dd if=./sshd bs=1 count=521008 of=sshd.1 521008+0 records in 521008+0 records out 521008 bytes (521 kB) copied, 1.46733 s, 355 kB/s # dd if=./sshd bs=1 skip=521008 count=11 of=sshd.2 11+0 records in 11+0 records out 11 bytes (11 B) copied, 0.00032878 s, 33.5 kB/s # dd if=./sshd bs=1 skip=521008 count=999999999 of=sshd.3 131808+0 records in 131808+0 records out 131808 bytes (132 kB) copied, 0.368016 s, 358 kB/s
OpenSSH_5.x is now cut and copied to sshd.2 file.
Check the content of sshd.2 file using the od command.
# od -A n -c sshd.2 O p e n S S H _ 2 . 0
Write the text "ItsHidden" to
sshd.2 and check the file size change before and after.
# ls -l sshd.2 -rw-r--r-- 1 root root 11 May 6 14:11 sshd.2 # print -n ItsHidden > sshd.2 # ls -l sshd.2 -rw-r--r-- 1 root root 11 May 6 14:12 sshd.2
Combine all the above sshd files to sshd.new.
# cat sshd.* > sshd.new
Give execute permission sshd.new and replace the sshd binary with sshd.new.
# chmod 755 ./sshd.new # cp /usr/sbin/sshd /usr/sbin/sshd.bak # rm /usr/sbin/sshd # cp /tmp/sshd.new /usr/sbin/sshd
Restart the sshd service and test the outcome with telnet command.
# service sshd stop # ps aux | grep -i sshd # kill -9 <pid_sshd> # service sshd restart # telnet localhost 22
Not a very elegant or maintainable solution, though.
Faster way, that works across ssh if you're careful:
First, create a 700 root-owned executable bash file. I called it test.sh. Contents:
#!/bin/bash sleep 10 service sshd stop sleep 10 sed -i.bak.$(date +%F.%s) 's/OpenSSH_5.3/Blocked_9.9/g' /usr/sbin/sshd sleep 10 service sshd start
Basically: Sleep 10 seconds, stop the ssh daemon, give it ten seconds to close, use sed to replace the version string, backing it up while doing it. Sleep another 10 seconds, and then start the sshd service. Note that the service sshd stop and service sshd start commands may need some customization for your system (e.g., might be "systemctrl stop sshd.service" instead of "service sshd stop", and you need to specify the version string you're looking for; my test was with a CentOS 6 box, using OpenSSH 5.3). With that, you can call it from an ssh session as a background daemon - note that you'll need to immediately quit. So call it via something like (as root, obviously):
nohup ./test.sh & exit 0
And make sure there are NO sessions attached (if there are, then the sshd executable will be busy, and you won't do the edits). Then wait a bit, and try connecting again.
Note that you can test if it's working via:
echo "Hello" | nc [Server IP here] 22
Which also gets the version string.
And, of course, as a script, you can call it after an update to quickly re-do the blocking. This is not recommended, due to why the version string is there in the first place, but this should function.