https://cybertoolchain.io/tools/ssh-audit New releases and features in ssh-audit, tracked by The Cyber Toolchain. en Sat, 04 Jul 2026 21:32:58 GMT https://github.com/jtesta/ssh-audit/releases/tag/v3.9.0 https://github.com/jtesta/ssh-audit/releases/tag/v3.9.0 Sat, 04 Jul 2026 21:32:58 GMT ssh-audit v3.9.0 adds post-quantum warnings, UNIX socket scanning, SOCKS5 proxy support, and built-in hardening guides. • Adds warnings on all key exchanges lacking post-quantum protection, flagging exposure to Harvest Now, Decrypt Later attacks. • New `--list-hardening-guides` and `--get-hardening-guide` flags surface built-in hardening guides for common platforms (Debian, Ubuntu, Rocky Linux, OpenSSH) without requiring internet access. • Supports scanning SSH servers over UNIX sockets (e.g. `unix:///path/to/socket`), enabling auditing in containerized and CI/CD environments. • New `--socks5 host:port` flag enables scanning through a SOCKS5 proxy (implies `--skip-rate-test`). • Identifies 2 new post-quantum key exchanges: `mlkem768nistp256-sha256` and `mlkem1024nistp384-sha384`. • Identifies 11 new host key types including ML-DSA variants (`mldsa-44`, `mldsa-65`, `mldsa-87`, and OpenSSH-namespaced equivalents) and `webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com`. • Identifies 2 new ciphers: `AEAD_CAMELLIA_128_GCM` and `AEAD_CAMELLIA_256_GCM`. • Adds `allow_hostkey_subset_and_reordering` policy option, letting policy definitions accept targets with a stricter or differently-ordered host key list. • Adds built-in policies for OpenSSH 10.0 through 10.4 and new platform guides for Debian 13, Rocky Linux 10, and Ubuntu 26.04. • Removes SSHv1 support entirely. • Batch mode (`-b`) no longer implicitly enables verbose mode; use `-v` explicitly when needed. Breaking changes: • Support for Python 3.8 has been dropped, so setups running ssh-audit on Python 3.8 will no longer work. • Support for Python 3.9 has been dropped, so setups running ssh-audit on Python 3.9 will no longer work. • SSHv1 support has been removed, so any scans or configurations relying on SSHv1 scanning will no longer function. • Batch mode (`-b`) no longer automatically enables verbose mode, so scripts or workflows that depended on batch mode implying verbose output will see less output unless `-v` is explicitly added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit https://github.com/jtesta/ssh-audit/releases/tag/v3.9.0 https://github.com/jtesta/ssh-audit/releases/tag/v3.9.0 Sat, 04 Jul 2026 21:32:58 GMT ssh-audit v3.9.0 adds post-quantum warnings, UNIX socket scanning, SOCKS5 proxy support, and built-in hardening guides. • Adds warnings on all key exchanges lacking post-quantum protection, flagging exposure to Harvest Now, Decrypt Later attacks. • New `--list-hardening-guides` and `--get-hardening-guide` flags surface built-in hardening guides for common platforms (Debian, Ubuntu, Rocky Linux, OpenSSH) without requiring internet access. • Supports scanning SSH servers over UNIX sockets (e.g. `unix:///path/to/socket`), enabling auditing in containerized and CI/CD environments. • New `--socks5 host:port` flag enables scanning through a SOCKS5 proxy (implies `--skip-rate-test`). • Identifies 2 new post-quantum key exchanges: `mlkem768nistp256-sha256` and `mlkem1024nistp384-sha384`. • Identifies 11 new host key types including ML-DSA variants (`mldsa-44`, `mldsa-65`, `mldsa-87`, and OpenSSH-namespaced equivalents) and `webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com`. • Identifies 2 new ciphers: `AEAD_CAMELLIA_128_GCM` and `AEAD_CAMELLIA_256_GCM`. • Adds `allow_hostkey_subset_and_reordering` policy option, letting policy definitions accept targets with a stricter or differently-ordered host key list. • Adds built-in policies for OpenSSH 10.0 through 10.4 and new platform guides for Debian 13, Rocky Linux 10, and Ubuntu 26.04. • Removes SSHv1 support entirely. • Batch mode (`-b`) no longer implicitly enables verbose mode; use `-v` explicitly when needed. Breaking changes: • Support for Python 3.8 has been dropped, so setups running ssh-audit on Python 3.8 will no longer work. • Support for Python 3.9 has been dropped, so setups running ssh-audit on Python 3.9 will no longer work. • SSHv1 support has been removed, so any scans or configurations relying on SSHv1 scanning will no longer function. • Batch mode (`-b`) no longer automatically enables verbose mode, so scripts or workflows that depended on batch mode implying verbose output will see less output unless `-v` is explicitly added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit https://github.com/jtesta/ssh-audit/releases/tag/v3.9.0 https://github.com/jtesta/ssh-audit/releases/tag/v3.9.0 Sat, 04 Jul 2026 21:32:58 GMT ssh-audit v3.9.0 adds post-quantum warnings, UNIX socket scanning, SOCKS5 proxy support, and built-in hardening guides. • Adds warnings on all key exchanges lacking post-quantum protection, flagging exposure to Harvest Now, Decrypt Later attacks. • New `--list-hardening-guides` and `--get-hardening-guide` flags surface built-in hardening guides for common platforms (Debian, Ubuntu, Rocky Linux, OpenSSH) without requiring internet access. • Supports scanning SSH servers over UNIX sockets (e.g. `unix:///path/to/socket`), enabling auditing in containerized and CI/CD environments. • New `--socks5 host:port` flag enables scanning through a SOCKS5 proxy (implies `--skip-rate-test`). • Identifies 2 new post-quantum key exchanges: `mlkem768nistp256-sha256` and `mlkem1024nistp384-sha384`. • Identifies 11 new host key types including ML-DSA variants (`mldsa-44`, `mldsa-65`, `mldsa-87`, and OpenSSH-namespaced equivalents) and `webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com`. • Identifies 2 new ciphers: `AEAD_CAMELLIA_128_GCM` and `AEAD_CAMELLIA_256_GCM`. • Adds `allow_hostkey_subset_and_reordering` policy option, letting policy definitions accept targets with a stricter or differently-ordered host key list. • Adds built-in policies for OpenSSH 10.0 through 10.4 and new platform guides for Debian 13, Rocky Linux 10, and Ubuntu 26.04. • Removes SSHv1 support entirely. • Batch mode (`-b`) no longer implicitly enables verbose mode; use `-v` explicitly when needed. Breaking changes: • Support for Python 3.8 has been dropped, so setups running ssh-audit on Python 3.8 will no longer work. • Support for Python 3.9 has been dropped, so setups running ssh-audit on Python 3.9 will no longer work. • SSHv1 support has been removed, so any scans or configurations relying on SSHv1 scanning will no longer function. • Batch mode (`-b`) no longer automatically enables verbose mode, so scripts or workflows that depended on batch mode implying verbose output will see less output unless `-v` is explicitly added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit https://github.com/jtesta/ssh-audit/releases/tag/v3.3.0 https://github.com/jtesta/ssh-audit/releases/tag/v3.3.0 Tue, 15 Oct 2024 20:08:33 GMT ssh-audit v3.3.0 adds post-quantum key exchanges, IPv6 DHEat support, new built-in policies, and LANcom device recognition. • Adds built-in policies for Ubuntu 24.04 LTS server & client, OpenSSH 9.8, and OpenSSH 9.9. • Adds IPv6 support for DHEat and connection rate tests. • Adds TCP port information to JSON output from policy scans. • Adds LANcom LCOS server recognition and Ed448 key extraction. • Reports ECDSA and DSS fingerprints when running in verbose mode. • Adds support for post-quantum key exchanges `mlkem768x25519-sha256` and `sntrup761x25519-sha512`. • When scanning multiple targets with `-T`/`--targets`, the `-p`/`--port` option now sets the default port for all hosts that don't specify one explicitly. • Updated built-in policies for Amazon Linux 2023, Debian 12, Rocky Linux 9, and Ubuntu 22.04 to improve host key efficiency and quantum-attack cipher resistance. Breaking changes: • CVE information based on server/client version numbers has been removed entirely from output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit https://github.com/jtesta/ssh-audit/releases/tag/v3.2.0 https://github.com/jtesta/ssh-audit/releases/tag/v3.2.0 Mon, 22 Apr 2024 21:08:44 GMT ssh-audit v3.2.0 adds --dheat flag, custom policy directives, and new cipher/key exchange support • Added `--dheat` option to test targets for the DHEat denial-of-service attack • Added `allow_algorithm_subset_and_reordering` directive to custom policies to allow targets to pass with subset or re-ordered lists of host keys, kex, ciphers, and MACs • Added `allow_larger_keys` directive to custom policies to allow targets to pass with larger host keys, CA keys, and Diffie-Hellman keys • Color output is disabled if the `NO_COLOR` environment variable is set • Added 1 new key exchange algorithm: `gss-nistp384-sha384-*` • Added 1 new cipher: `aes128-ocb@libassh.org` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit https://github.com/jtesta/ssh-audit/releases/tag/v3.1.0 https://github.com/jtesta/ssh-audit/releases/tag/v3.1.0 Wed, 20 Dec 2023 18:37:34 GMT ssh-audit v3.1.0 adds Python 3.12 support and `additional_notes` field in JSON output • Adds Python 3.12 support, dropping Python 3.7. • Adds built-in policies for OpenSSH 9.5 and 9.6. Breaking changes: • Drops support for Python 3.7. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit https://github.com/jtesta/ssh-audit/releases/tag/v3.0.0 https://github.com/jtesta/ssh-audit/releases/tag/v3.0.0 Thu, 07 Sep 2023 12:16:35 GMT ssh-audit v3.0.0 adds notes to JSON output, 49 new algorithms, and multi-host scan fixes • Adds failure, warning, and info `notes` fields to the JSON output schema for banner protocol, "enc", and "mac" items. • Adds 12 new host key types: `ecdsa-sha2-curve25519`, `ecdsa-sha2-nistb233`, `ecdsa-sha2-nistb409`, `ecdsa-sha2-nistk163`, `ecdsa-sha2-nistk233`, `ecdsa-sha2-nistk283`, `ecdsa-sha2-nistk409`, `ecdsa-sha2-nistp224`, `ecdsa-sha2-nistp192`, `ecdsa-sha2-nistt571`, `ssh-dsa`, and `x509v3-sign-rsa-sha256`. • Adds 15 new key exchange algorithms including `curve448-sha512@libssh.org`, `ecdh-nistp256-kyber-512r3-sha256-d00@openquantumsafe.org`, and various Amazon Kyber implementations. • Adds 8 new ciphers: `aes192-gcm@openssh.com`, `cast128-12-cbc`, `cast128-12-cfb`, `cast128-12-ecb`, `cast128-12-ofb`, `des-cfb`, `des-ecb`, and `des-ofb`. • Adds 14 new MACs: `cbcmac-3des`, `cbcmac-aes`, `cbcmac-blowfish`, `cbcmac-des`, `cbcmac-rijndael`, `cbcmac-twofish`, `hmac-sha256-96`, `md5`, `md5-8`, `ripemd160`, `ripemd160-8`, `sha1`, `sha1-8`, and `umac-128`. • Adds built-in policy for OpenSSH 9.4 client algorithm prioritization. Breaking changes: • The JSON output schema changes: banner protocol, "enc", and "mac" fields now include `notes` arrays (failure, warning, info), breaking parsers expecting the old field structure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit https://github.com/jtesta/ssh-audit/releases/tag/v2.9.0 https://github.com/jtesta/ssh-audit/releases/tag/v2.9.0 Sat, 29 Apr 2023 17:32:43 GMT ssh-audit v2.9.0 adds `-g`/`--gex-test`, host key/CA cert support, and expanded policy coverage. • Adds `-g` and `--gex-test` flags for granular GEX modulus size tests • JSON output now includes 'recommendations' and 'CVE' fields • JSON 'target' field always includes the port number (e.g., 'host:22') • Adds support for mixed host key/CA key certificates (e.g., RSA host keys signed by ED25519 CAs) • Prints warnings for 2048-bit moduli during analysis • SHA-1 algorithms now trigger failure status in results • CBC mode ciphers downgraded to warning status instead of failure • Adds Ubuntu Server & Client 22.04 hardening policies to built-in set • Adds built-in policies for OpenSSH versions 8.8 through 9.3 • Updates generic failure/warning messages with specific cipher algorithm names • Increases coverage of known host keys, key exchanges, ciphers, and MACs Breaking changes: • Drops support for Python 3.6 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ssh-audit