SSH Security Auditor — Enterprise SSH Hardening in Go
An enterprise-grade SSH infrastructure auditing tool: passive discovery, KEXINIT handshake analysis, policy auditing against configurable baselines and CVE mapping — shipped as a single static Go binary with zero exploit surface.
- Role
- Security Tooling Engineering
- Status
- Open Source
Architecture: SSH-Hack — enterprise SSH security auditor
SSH is everywhere in enterprise infrastructure, and its misconfigurations are invisible until they matter. The SSH Security Auditor finds them systematically — without ever crossing into offensive territory.
What it does
The tool runs three phases against IPv4/IPv6 ranges:
- Discovery — concurrent TCP-connect scanning (no root required), banner grabbing and normalization, target import from Nmap or Shodan.
- Analysis — parses the KEXINIT handshake to enumerate ciphers, MACs and key-exchange algorithms; checks effective configuration via
sshd -T; maps software versions to an offline CVE database; scores each host 0–100 against a configurable baseline. - Reporting — severity-ranked output as JSON, Markdown, SARIF (for GitHub/GitLab security integrations) and interactive HTML dashboards.
Engineering highlights
- Protocol depth without a full handshake: KEXINIT parsing extracts algorithm negotiation early enough to fingerprint implementations (OpenSSH, Dropbear) while staying read-only.
- Rules as data: baselines (
allowed/deprecated/forbidden) and CVE entries live in YAML, so compliance profiles change without recompiling. - Concurrency with manners: goroutine pools scan thousands of hosts under configurable rate limits with jitter — thorough without DoS-ing the network you're auditing.
- Ethics as architecture: a consent gate (
--i-am-authorized) precedes any scan; logs auto-sanitize sensitive data; the codebase contains detection and remediation only.
docker build -t ssh-audit .
docker run --rm -v $(pwd)/configs:/configs \
ssh-audit --allowlist 10.0.0.0/24 --i-am-authorized
Result
A single-binary auditor that slots into CI pipelines via SARIF, schedules recurring audits with Slack alerting on score regressions, and turns SSH hygiene into a measurable, tracked number.
architecture
Three stages: Scanner (Go net) probes targets concurrently and collects service fingerprints; Analyzer (rule engine) maps findings against hardening rules plus a CVE database; Report layer produces severity-ranked, actionable output (JSON/Markdown/SARIF/HTML). No state between scans — read-only and idempotent.
select a node to inspect responsibility, I/O, failure modes & security
- ▸Automatic CVE detection from banner/version fingerprints
- ▸Crypto analysis of ciphers, MACs and KEX algorithms
- ▸Policy auditing against configurable compliance baselines
- ▸Prioritized reporting with concrete remediation steps
- ▸Single-binary distribution (Go)
- ▸Passive/read-only checks only — no credential brute force, no exploits
- ▸Rule updates must not require a binary rebuild
- ▸Enterprise networks: scans must run parallel and fast without flooding targets
- ▸Scan speed vs. network load: parallel scans need throttling and jitter
- ▸Banner-based CVE detection is fast but less precise than version pinning
- ▸No credentials collected, no persistence of target data
- ▸Findings never contain key material
- ▸Rule set contains detection and remediation only — zero exploit code
- ▸Explicit consent gate (--i-am-authorized) before scanning
- ▸Idempotent scans; retries on connection timeouts
- ▸Configurable concurrency limits prevent target overload
- ▸Golden fixtures: known SSH banners → expected findings
- ▸Rule-set updates double as regression tests
- ▸Single binary for Linux/macOS; runs locally or in CI pipelines
- ▸Scan logs record duration, target count and finding distribution
- ▸Enterprise-capable SSH audit tool with CVE detection and compliance scoring
- ▸Reusable architecture pattern for security scanner design
- ▸Public repository: github.com/amariwan/ssh-hack
- ▸Case study documents passive scanning, KEXINIT analysis, CVE mapping, policy baselines and SARIF/HTML/JSON outputs
- ▸Detection without an exploit path keeps the tool inside enterprise policy boundaries
- ▸Storing the rule set as data pays off with every new CVE
problem
SSH infrastructures decay silently: legacy ciphers, outdated algorithms, default ports left open. Security teams need a tool that scans hosts systematically, scores them against hardening policies and returns actionable remediation — without ever becoming an attack tool itself.
context
Built for enterprises and security teams as a three-phase auditor: discovery (host + banner collection), analysis (rule engine + CVE database scoring), reporting (prioritized hardening recommendations). Written in Go to ship as a single static binary.
requirements
constraints
key decisions
Why: Security tooling has to run inside varied enterprise environments without dependency drama; Go also gives cheap concurrency for scans.
Less scripting flexibility than Python, but far easier distribution and predictable runtime behavior.
Why: Baselines and CVE entries need updates without rebuilding or redistributing the scanner binary.
The rule schema becomes a product surface, but compliance profiles stay swappable and reviewable.
Why: Enterprise policy needs an auditor, not an exploit harness; no credentials or mutation keeps the tool acceptable in controlled networks.
Cannot prove exploitability, but stays inside a defensible audit boundary.