SudoSecurity

SSH server checker

Audit an SSH server's key exchange, ciphers and MACs, and test for Terrapin.

We only read the algorithms the server advertises before login. No credentials are sent or tried.

What this checks

Every SSH server lists its supported algorithms before anyone logs in. We read that list and flag SHA-1 key exchange, CBC ciphers, MD5/SHA-1 MACs, Terrapin exposure and missing post-quantum key exchange.

To check the settings that aren't visible from outside (root login, password auth, timeouts), paste your config into the sshd_config checker, or run hardline audit on the server.