4

I have installed openssh server. I want to disable banner which is shown when I do ::

nc 0.0.0.0 22

It shows something like this :: SSH-2.0-OpenSSH_6.7p1 Raspbian-5 .

How to make it show something else or nothing at all ?

Improve this question
1
  • That's part of the SSH protocol (see ssh_api.c, sshd.c), so while you could fiddle around with the source and tell sshd to emit something else, you might break things.
    – thrig
    Mar 10, 2016 at 21:36

2 Answers 2

Reset to default
6

This banner

SSH-2.0-OpenSSH_6.7p1 Raspbian-5

is part of SSH protocol as described in chapter

4.2. Protocol Version Exchange

of RFC 4253:

When the connection has been established, both sides MUST send an identification string. This identification string MUST be

SSH-protoversion-softwareversion SP comments CR LF

You can't get rid of the SSH-2.0 part. The softwareversion part is used commonly for interoperability and it is also not good idea to remove it. The comments are optional and don't need to be there (but Debian puts them in by default).

You can get rid of the comment using DebianBanner option in sshd_config. Setting it to no and restarting ssh server will not show it any more.

Improve this answer
2

The DebianBanner does not work on all Distros (obviously)

The method that work on all distros is the binary replace with Perl, for example:

perl -pi -e 's/OpenSSH_7.4/DragonGuru9/g' /sbin/sshd
systemctl restart sshd

This can be done on live server as well, and the process must not be stopped.

Take care to replace the "OpenSSH_7.4" with the exact ammount of characters (11 in this case), as you are doing binary character replacement. If you replace it with different ammount of charachers, the binary file will be broken.

Here is how it looks like after the Nmap scan:

Nmap scan custom banner message

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .