On Sun, 5 Sept 2021 at 12:26, Ronald Klop <[email protected]> wrote: > > I'm wondering why the FreeBSD project adds this information to the banner by > default. I learned that not exposing information about the running system is > good security practice. > Any thoughts about this? What is the gain of this banner?
Like many things it's a tradeoff. Adding the version to sshd's banner provides an easy way for an administrator to confirm that an update has been applied (assuming that the version is updated). Conversely, it's even easier (for an attacker) to connect and just attempt some misbehaviour than it would be to check this version string first. We introduced the VersionAddendum here: commit 933ca70f8f888b7fc1b06213198ba15ca346aeca Author: Brian Feldman <[email protected]> Date: Thu May 3 00:29:28 2001 +0000 Add a "VersionAddendum" configuration setting for sshd which allows anyone to easily change the part of the OpenSSH version after the main version number. The FreeBSD-specific version banner could be disabled that way, for example: # Call ourselves plain OpenSSH VersionAddendum Notes: svn path=/head/; revision=76227 Upstream adopted it here: commit 23528816dc10165b3bc009f2ab5fdf1653db418c Author: Damien Miller <[email protected]> Date: Sun Apr 22 11:24:43 2012 +1000 - [email protected] 2012/04/12 02:42:32 [servconf.c servconf.h sshd.c sshd_config sshd_config.5] VersionAddendum option to allow server operators to append some arbitrary text to the SSH-... banner; ok deraadt@ "don't care" markus@ Now, we support it for both the client and server while upstream supports it for the server only. I suspect there isn't a lot of value in the client-side support, and am considering removing it to reduce the differences between our in-tree ssh and upstream, and ease future OpenSSH updates. _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all To unsubscribe, send any mail to "[email protected]"
