Skip to content

Commit 32a4b15

Browse files
manfred-kaisermanfred-kaiser
committed
added fingerprint chapter
1 parent 1a48c57 commit 32a4b15

File tree

6 files changed

+217
-5
lines changed

6 files changed

+217
-5
lines changed

‎doc/_static/assets/css/theme2.css

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
2+
table.docutils,
3+
.rst-content table.field-list,
4+
.wy-table {
5+
border-collapse: collapse;
6+
border-spacing: 0;
7+
empty-cells: show;
8+
margin-bottom: 24px
9+
}
10+
11+
table.docutils caption,
12+
.rst-content table.field-list caption,
13+
.wy-table caption {
14+
color: #000;
15+
font: italic 85%/1 arial, sans-serif;
16+
padding: 1em 0;
17+
text-align: center
18+
}
19+
20+
table.docutils td,
21+
table.docutils th,
22+
.rst-content table.field-list td,
23+
.rst-content table.field-list th,
24+
.wy-table td,
25+
.wy-table th {
26+
font-size: 90%;
27+
margin: 0;
28+
overflow: visible;
29+
padding: 8px 16px
30+
}
31+
32+
table.docutils td:first-child,
33+
table.docutils th:first-child,
34+
.rst-content table.field-list td:first-child,
35+
.rst-content table.field-list th:first-child,
36+
.wy-table td:first-child,
37+
.wy-table th:first-child {
38+
border-left-width: 0
39+
}
40+
41+
table.docutils thead,
42+
.rst-content table.field-list thead,
43+
.wy-table thead {
44+
color: #000;
45+
text-align: left;
46+
vertical-align: bottom;
47+
white-space: nowrap
48+
}
49+
50+
table.docutils thead th,
51+
.rst-content table.field-list thead th,
52+
.wy-table thead th {
53+
font-weight: 700;
54+
border-bottom: 2px solid #e1e4e5
55+
}
56+
57+
table.docutils td,
58+
.rst-content table.field-list td,
59+
.wy-table td {
60+
background-color: transparent;
61+
vertical-align: middle
62+
}
63+
64+
table.docutils td p,
65+
.rst-content table.field-list td p,
66+
.wy-table td p {
67+
line-height: 18px
68+
}
69+
70+
table.docutils td p:last-child,
71+
.rst-content table.field-list td p:last-child,
72+
.wy-table td p:last-child {
73+
margin-bottom: 0
74+
}
75+
76+
table.docutils .wy-table-cell-min,
77+
.rst-content table.field-list .wy-table-cell-min,
78+
.wy-table .wy-table-cell-min {
79+
width: 1%;
80+
padding-right: 0
81+
}
82+
83+
table.docutils .wy-table-cell-min input[type=checkbox],
84+
.rst-content table.field-list .wy-table-cell-min input[type=checkbox],
85+
.wy-table .wy-table-cell-min input[type=checkbox] {
86+
margin: 0
87+
}
88+
89+
.wy-table-secondary {
90+
color: grey;
91+
font-size: 90%
92+
}
93+
94+
.wy-table-tertiary {
95+
color: grey;
96+
font-size: 80%
97+
}
98+
99+
table.docutils:not(.field-list) tr:nth-child(2n-1) td,
100+
.wy-table-backed,
101+
.wy-table-odd td,
102+
.wy-table-striped tr:nth-child(2n-1) td {
103+
background-color: #f3f6f6
104+
}
105+
106+
table.docutils,
107+
.wy-table-bordered-all {
108+
border: 1px solid #e1e4e5
109+
}
110+
111+
table.docutils td,
112+
.wy-table-bordered-all td {
113+
border-bottom: 1px solid #e1e4e5;
114+
border-left: 1px solid #e1e4e5
115+
}
116+
117+
table.docutils tbody>tr:last-child td,
118+
.wy-table-bordered-all tbody>tr:last-child td {
119+
border-bottom-width: 0
120+
}
121+
122+
table.docutils th {
123+
border-color: #e1e4e5
124+
}
125+
126+
127+
table.docutils td .last,
128+
table.docutils td .last>:last-child {
129+
margin-bottom: 0
130+
}
131+
132+
table.docutils th {
133+
border-color: #e1e4e5
134+
}
135+
136+
137+
table.docutils th {
138+
border: 1px solid #e1e4e5
139+
}
140+
141+
table.docutils td>p,
142+
table.docutils th>p {
143+
line-height: 1rem;
144+
margin-bottom: 0;
145+
font-size: .9rem
146+
}

‎doc/_static/assets/css/toctree-icons.css

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,23 @@
77
#docs-nav .toctree-l1:nth-child(2):before,
88
#docs-cards .toctree-l1:nth-child(2) i:before {
99
font-family: FontAwesome;
10-
content: "\f0e8";
10+
content: "\f577";
1111
}
1212

1313
#docs-nav .toctree-l1:nth-child(3):before,
1414
#docs-cards .toctree-l1:nth-child(3) i:before {
1515
font-family: FontAwesome;
16-
content: "\f542";
16+
content: "\f0e8";
1717
}
1818

1919
#docs-nav .toctree-l1:nth-child(4):before,
2020
#docs-cards .toctree-l1:nth-child(4) i:before {
21+
font-family: FontAwesome;
22+
content: "\f542";
23+
}
24+
25+
#docs-nav .toctree-l1:nth-child(5):before,
26+
#docs-cards .toctree-l1:nth-child(5) i:before {
2127
font-family: FontAwesome;
2228
content: "\f714";
2329
}

‎doc/_templates/layout.html

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
<link id="theme-style" rel="stylesheet" href="_static/pygments.css?{{built_timestamp}}">
2222
<link id="theme-style" rel="stylesheet" href="https://www.ssh-mitm.at/assets/css/theme.css?{{built_timestamp}}">
2323
<link id="theme-style" rel="stylesheet" href="_static/assets/css/sphinx.css?{{built_timestamp}}">
24+
<link id="theme-style" rel="stylesheet" href="_static/assets/css/theme2.css?{{built_timestamp}}">
2425
<link id="theme-style" rel="stylesheet" href="_static/assets/css/toctree-icons.css?{{built_timestamp}}">
2526
{%- block extrahead %} {% endblock %}
2627
</head>

‎doc/fingerprint.rst

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
SSH Fingerprints
2+
================
3+
4+
Recognizing clients with known fingerprints
5+
-------------------------------------------
6+
7+
If the client is already in possession of a fingerprint, the received fingerprint is compared with it. If the fingerprints do not match, a warning is issued and the connection is terminated.
8+
9+
However, a Man in the Middle attack should remain undetected for as long as possible. For this reason, it is necessary to prevent the warnings generated by the client.
10+
11+
RFC-4253 defines how the key exchange works. A list of supported algorithms is sent to the server. The first entry defines the preferred algorithm.
12+
13+
This behavior can be used to find out whether a client has already stored a fingerprint for the current connection or not.
14+
15+
In a Man in the Middle attack, this knowledge can be used to not intercept clients that would issue a warning or to pass the connection through to the actual destination server.
16+
17+
An exemplary key exchange with and without a known fingerprint could look as follows:
18+
19+
20+
+------------------------+------------------------+
21+
| New Fingerprint | Known Fingerprint |
22+
+========================+========================+
23+
| ssh-ed25519 | ssh-rsa |
24+
+------------------------+------------------------+
25+
| ecdsa-sha2-nistp256 | ssh-ed25519 |
26+
+------------------------+------------------------+
27+
| ecdsa-sha2-nistp384 | ecdsa-sha2-nistp256 |
28+
+------------------------+------------------------+
29+
| ecdsa-sha2-nistp521 | ecdsa-sha2-nistp384 |
30+
+------------------------+------------------------+
31+
| ssh-rsa | ecdsa-sha2-nistp521 |
32+
+------------------------+------------------------+
33+
| ssh-dss | ssh-dss |
34+
+------------------------+------------------------+
35+
36+
If the fingerprint is not known, the list is sent to the server with a predefined sequence.
37+
However, if the client has already saved a fingerprint for the server, the last used algorithm used is put first.
38+
39+
40+
Testing with SSH-MITM
41+
"""""""""""""""""""""
42+
43+
SSH-MITM has the possibility to check on an incoming connection if a client has a known fingerprint or not.
44+
45+
For this SSH-MITM must be started without additional parameters.
46+
47+
.. code-block:: none
48+
49+
$ ssh-mitm
50+
[INFO] connected client version: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.3
51+
[INFO] openssh: Client has a locally cached remote fingerprint!
52+
53+
54+
Mitigation
55+
""""""""""
56+
57+
Depending on which client is used, it must be configured differently:
58+
59+
* **Dropbear:** not vulnerable
60+
* **OpenSSH:** :ref:`CVE-2020-14145`
61+
* **PuTTY:** :ref:`CVE-2020-14002`

‎doc/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ SSH-MITM Docs - Main Page
66
:caption: Contents:
77

88
quickstart
9+
fingerprint
910
advanced-usage
1011
portforwarding
1112
ssh_vulnerabilities

‎doc/quickstart.rst

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
Quickstart
22
==========
33

4-
Introduction
5-
------------
6-
74
**SSH-MITM** is a man in the middle SSH Server for security audits and malware analysis.
85

96
Password and publickey authentication are supported and SSH-MITM is able to detect, if a user is able to

0 commit comments

Comments
 (0)