SSH Username Enumeration

SSH Username Enumeration attack is used on OpenSSH Servers with public key authentication is enabled. This method was posted on 15 August 2018 and OpenSSH versions older than 7.7

An attacker may find valid SSH user names by sending malformed headers to SSH server, the ones that really doesn’t exists on the server may respond faster than the real users. This way the attacker can get user names by brute forcing the server.

Solution

You can permit specific IP addresses to use SSH server using /etc/hosts.deny and /etc/hosts.allow together. You and do it by adding allowed IP addresses to hosts.allow and deny the rest in hosts.deny file. Suppose that we want to add 10.10.10.10, 192.168.0.0/24 and 192.168.1.0/24 to allowed list:

/etc/hosts.allow:

sshd: 10.10.10.10, 11.11.11.11
sshd: 192.168.0.*
sshd: 192.168.1.0/255.255.255.0

/etc/hosts.deny

sshd : ALL