SSH Scan Failed for ed25519-only servers

[532910]

Scan Failed: The Mozilla SSH Observatory scans from sshscan.rubidus.com at 45.55.176.164.
Many systems are configured with firewalls that block SSH access. To successfully scan with the SSH Observatory, access must be granted to Mozilla's scanning system.

[floatingatoll]

Hi, is there a question we can answer about this text?

[532910]

@floatingatoll if you asking me, then sorry, I didn't understand the question

[floatingatoll]

@532910 Hi, you've pasted an error message and help text from the Observatory website. Is there an issue you're trying to report? Is there something we can help you with? Do you have a question about this error message that we can help answer?

[532910]

The error I've pasted is the issue I'm trying to report.
I have no question, just like to report that SSH Observatory doesn't work on https://observatory.mozilla.org

[532910]

Aaa, it wants to say that ssh access to my host is firewalled --- it's lie, my ssh is widely opened!

[floatingatoll]

It works for the public SSH site at 'github.com':

https://observatory.mozilla.org/analyze/github.com#ssh

Without knowing the hostname you're attempting to scan, it's hard to say what's wrong. Is your SSH host configured in IPv6-only mode, or to use a port other than 22?

[532910]

I've tried 3 different hosts all with ssh on 22 port and without firewall. All of them gives the same error.
Two of them are dual-stack, one ipv4 only.

[532910]

outerface.net boo.outerface.net zip.outerface.net g.outerface.net

[532910]

https://www.isitblockedinrussia.com says sshscan.rubidus.com and 45.55.176.164 are not blocked in russia.

[532910]

% curl -X POST "https://sshscan.rubidus.com/api/v1/scan?target=outerface.net"                      
{"uuid":"2dd65519-9e3d-41e5-aff8-352995fa66fc"}
 curl "https://sshscan.rubidus.com/api/v1/scan/results?uuid=2dd65519-9e3d-41e5-aff8-352995fa66fc"
{"status":"UNKNOWN"}

[claudijd]

I no longer actively work on this project, but as an effort to help you solve the problem. I did a quick test using the ssh_scan binary that the SSH Observatory uses as it's engine...

$ ./bin/ssh_scan -t outerface.net

and I was able to get a successful scan result. My suspicion here is that the server infra is experiencing a disk usage issue, I'll pop on the server quick and see if I can address this.

[claudijd]

The web server appears to be serving static content here:

https://sshscan.rubidus.com/

[claudijd]

I was able to run the example client's that utilize the production API endpoint here to run a scan for ssh.mozilla.com:

$ python client.py
[+] Submitting scan request for ssh.mozilla.com
[+] Got 200 OK {"uuid":"1a35c92e-bc33-4391-9f9a-4bf951d7bb9b"}
[+] Checking for scan results
[+] Backing off for a half sec to let scan to complete
[+] Checking for scan results
[+] Backing off for a half sec to let scan to complete
[+] Checking for scan results
[+] Backing off for a half sec to let scan to complete
[+] Checking for scan results
[+] Backing off for a half sec to let scan to complete
[+] Checking for scan results
{"ssh_scan_version":"0.0.35","ip":"63.245.208.111","hostname":"ssh.mozilla.com","port":22,"server_banner":"SSH-2.0-OpenSSH_7.4","ssh_version":2.0,"os":"unknown","os_cpe":"o:unknown","ssh_lib":"openssh","ssh_lib_cpe":"a:openssh:openssh:7.4","key_algorithms":["curve25519-sha256@libssh.org","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","diffie-hellman-group-exchange-sha256"],"encryption_algorithms_client_to_server":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"encryption_algorithms_server_to_client":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"mac_algorithms_client_to_server":["hmac-sha2-512-etm@openssh.com","hmac-sha2-256-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512","hmac-sha2-256","umac-128@openssh.com"],"mac_algorithms_server_to_client":["hmac-sha2-512-etm@openssh.com","hmac-sha2-256-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512","hmac-sha2-256","umac-128@openssh.com"],"compression_algorithms_client_to_server":["none","zlib@openssh.com"],"compression_algorithms_server_to_client":["none","zlib@openssh.com"],"languages_client_to_server":[],"languages_server_to_client":[],"auth_methods":["publickey"],"fingerprints":{},"duplicate_host_key_ips":[],"compliance":{"policy":"Mozilla Modern","compliant":true,"recommendations":[],"references":["https://wiki.mozilla.org/Security/Guidelines/OpenSSH"],"grade":"A"},"start_time":"2020-05-27 20:12:02 +0000","end_time":"2020-05-27 20:12:04 +0000","scan_duration_seconds":1.748478882,"status":"COMPLETED"}

[claudijd]

Using the ruby client, I tried outerface.net:

$ ruby client.rb outerface.net
[+] Submitting scan request for outerface.net
[+] Got 200 {"uuid":"94b36633-74aa-4e5f-99e4-036608239a89"}
[+] Checking for scan results
[+] Backing off for a half sec to let scan to complete
...

But it never returns a successful response.