SSH enumeration & access

SSH, or Secure Shell, provides encrypted remote administration, command execution and file transfer. It is commonly used to manage Linux and Unix systems securely over a network.

SSH normally listens on TCP port 22, although administrators can configure it to use another port. Service detection is therefore more reliable than assuming every service on port 22 is SSH.

Start by confirming the SSH service and identifying the implementation and version. The banner may reveal software such as OpenSSH and sometimes information about the operating system.

An SSH server normally presents an identification string during connection establishment. This can reveal the SSH protocol version and server implementation. Version information is useful for enumeration but does not by itself prove that a vulnerability is exploitable.

Nmap can enumerate SSH host keys, supported cryptographic algorithms and authentication methods.

SSH supports different authentication mechanisms. The two most important during basic enumeration are password authentication and public-key authentication.

Password authentication requires a valid username and password. If valid credentials are obtained during an authorised assessment, they can be tested directly with the SSH client.

Public-key authentication uses a cryptographic key pair. The client keeps the private key while the corresponding public key is stored on the server. The server verifies that the client possesses the correct private key.

A private SSH key should be treated like a credential. Common private-key filenames include id_rsa and id_ed25519. Their public counterparts commonly end with .pub.

If a private key is discovered during an authorised assessment, it may allow authentication to systems where the corresponding public key is trusted. OpenSSH expects private-key files to have restrictive permissions.

chmod 600 gives the owner read and write permissions while removing access for group members and other users. OpenSSH may refuse to use a private key if its permissions are too permissive.

A private SSH key may itself be protected with a passphrase. Possessing the key file therefore does not always mean it can immediately be used for authentication.

The authorized_keys file contains public keys that are permitted to authenticate to a specific user account. It is normally stored inside the users .ssh directory.

Reading authorized_keys can reveal which public keys are trusted by an account. Write access to this file is security-sensitive because it controls which keys are allowed to authenticate.

SSH host keys identify the server rather than the user. When connecting to a server for the first time, the SSH client normally displays the host-key fingerprint so the user can verify the identity of the server.

Previously accepted SSH server host keys are normally stored in the client known_hosts file. Unexpected changes to a host key can produce an SSH warning.

Valid SSH usernames may be discovered from other exposed services, web applications, configuration files, operating-system information or previous enumeration. Whether SSH itself reveals valid usernames depends on the implementation and configuration.

Hydra can validate SSH credentials during an authorised credential audit. Repeated attempts may trigger account lockouts, rate limiting, intrusion detection or temporary connection restrictions.

sshpass allows a password to be supplied to SSH non-interactively. It can be convenient in labs and automation, but passwords written directly into commands may be exposed through shell history or process information.

SCP uses SSH to transfer files securely between systems. It uses the same authentication mechanisms as SSH.

SSH uses lowercase -p to specify a custom port. SCP uses uppercase -P for the same purpose.

Metasploit includes auxiliary scanners for SSH service identification and authentication testing.

The ssh_login auxiliary module can validate username and password combinations against an SSH service.

Metasploit also provides modules capable of validating SSH authentication using private keys.

After obtaining authorised SSH access, identify the current account and its privileges before continuing. Valid SSH access does not automatically mean root access.

Common SSH files include private and public keys, authorized_keys, known_hosts and the system SSH client and server configuration files.

The SSH server configuration can reveal the listening port, root-login policy and enabled authentication methods. The effective configuration may also depend on included files and Match blocks.

Confirm the SSH service, identify the implementation and version, enumerate authentication methods and host keys, collect potential usernames and then test valid credentials or discovered keys when authorised. After authentication, identify the current user, groups, sudo permissions and relevant SSH files.

SSH also supports local, remote and dynamic port forwarding. Tunneling and pivoting are covered separately because they belong to network pivoting rather than basic SSH enumeration.

These are the SSH enumeration and access commands worth remembering.