PortaSFTPServer commented on issue #903: URL: https://github.com/apache/mina-sshd/issues/903#issuecomment-5295522246
No problem at all. Keeping the default is fine and is what virtually every SSH server does — the version string is not a vulnerability. But it is a legit concern to where if you leave the version e.g apache mina where attacker knows the vulnerability for the specific version, that is when the custom version/suffix can help to confuse the attacker. Nmap reports it as an informational banner, not a CVE, and real attacker value here is negligible: an SSH server can be fingerprinted many other ways (algorithm negotiation, handshake behavior, timings), so hiding the banner is security-by-obscurity at best. The actual protection is staying on a current, patched version, and controlling exposure through the usual means (auth, keys, firewall) — not by hiding a banner. And if your compliance/security review still insists on not leaking the real version, you don't need to drop the field (RFC 4253 makes the SSH-2.0- prefix mandatory, unlike FTP/S which a free form). You override the string after it with something generic, which is exactly what the maintainer showed in the duplicate #894: CoreModuleProperties.SERVER_IDENTIFICATION.set(server, "SSH-2.0-custom-id"); -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
