securecodebox/scanner-ssh-audit repository overview

⁠What is OWASP secureCodeBox?

OWASP secureCodeBox⁠ is an automated and scalable open source solution that can be used to integrate various security vulnerability scanners with a simple and lightweight interface. The secureCodeBox mission is to support DevSecOps Teams to make it easy to automate security vulnerability testing in different scenarios.

With the secureCodeBox we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues.

The secureCodeBox project is running on Kubernetes⁠. To install it you need Helm⁠, a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure.

⁠Quickstart with secureCodeBox on Kubernetes

You can find resources to help you get started on our documentation website⁠ including instruction on how to install the secureCodeBox project⁠ and guides to help you run your first scans⁠ with it.

⁠Supported Tags

• latest (represents the latest stable release build)
• tagged releases, e.g. 3.0.0, 2.9.0, 2.8.0, 2.7.0

⁠How to use this image

This scanner image is intended to work in combination with the corresponding parser image to parse the scanner findings to generic secureCodeBox results. For more information details please take a look at the project page⁠ or [documentation page][].

docker pull securecodebox/scanner-ssh-audit

⁠What is SSH-audit?

ssh-audit is a tool for ssh server & client configuration auditing.

To learn more about the ssh-audit scanner itself visit ssh-audit GitHub⁠.

⁠Scanner Configuration

The following security scan configuration example are based on the ssh-audit Documentation⁠, please take a look at the original documentation for more configuration examples.

usage: ssh-audit.py [options] <host>

   -h,  --help             print this help
   -1,  --ssh1             force ssh version 1 only
   -2,  --ssh2             force ssh version 2 only
   -4,  --ipv4             enable IPv4 (order of precedence)
   -6,  --ipv6             enable IPv6 (order of precedence)
   -b,  --batch            batch output
   -c,  --client-audit     starts a server on port 2222 to audit client
                               software config (use -p to change port;
                               use -t to change timeout)
   -d,  --debug            Enable debug output.
   -g,  --gex-test=<x[,y,...]>  dh gex modulus size test
                   <min1:pref1:max1[,min2:pref2:max2,...]>
                   <x-y[:step]>
   -j,  --json             JSON output (use -jj to enable indents)
   -l,  --level=<level>    minimum output level (info|warn|fail)
   -L,  --list-policies    list all the official, built-in policies
        --lookup=<alg1,alg2,...>    looks up an algorithm(s) without
                                    connecting to a server
   -m,  --manual           print the man page (Windows only)
   -M,  --make-policy=<policy.txt>  creates a policy based on the target server
                                    (i.e.: the target server has the ideal
                                    configuration that other servers should
                                    adhere to)
   -n,  --no-colors        disable colors
   -p,  --port=<port>      port to connect
   -P,  --policy=<"policy name" | policy.txt>  run a policy test using the
                                                   specified policy
   -t,  --timeout=<secs>   timeout (in seconds) for connection and reading
                               (default: 5)
   -T,  --targets=<hosts.txt>  a file containing a list of target hosts (one
                                   per line, format HOST[:PORT])
        --threads=<threads>    number of threads to use when scanning multiple
                                   targets (-T/--targets) (default: 32)
   -v,  --verbose          verbose output

⁠Community

You are welcome, please join us on... 👋

• GitHub⁠
• OWASP Slack (Channel #project-securecodebox)⁠
• Mastodon⁠

secureCodeBox is an official OWASP⁠ project.

⁠License

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.