SshAudit
title: ssh-audit radar_quadrant: Tools radar_ring: Assess radar_position: inner created: 2026-05-26 last_updated: 2026-05-26 tags: [security, ssh, hardening, audit, homelab, vps] source_url: https://github.com/jtesta/ssh-audit
A CLI tool that audits SSH server and client configurations for weak cryptographic algorithms, deprecated key exchange methods, insecure ciphers, and vulnerable MACs. Connects to a target server (or reads a client config file), enumerates every algorithm it advertises, and outputs a colour-coded report of what to change in sshd_config to harden the configuration.
Scans key exchange algorithms, host key types (RSA key size, Ed25519 presence), symmetric ciphers, MAC algorithms, and SSH protocol banners. Flags each finding as: info (acceptable), warn (weak but not immediately exploitable), or fail (known-vulnerable, disable immediately). Also checks for known CVEs tied to specific algorithm combinations.
ssh-audit <hostname> # audit remote server
ssh-audit -c # audit local client config
Output includes per-algorithm status and a recommended sshd_config policy block. The project maintains a scoring matrix against current NIST and BSI recommendations.
Complements SecureByDesign and the Docker Security Hardening blip as the SSH-specific layer of a server hardening checklist. Pairs with WebCheck (broad OSINT + TLS auditing) for full server security surface coverage. Relevant to homelab operators following HomelabKubernetesPatterns and HomelabBackupStrategies who expose SSH-accessible infrastructure.
Placed in Tools / Assess / inner. Single-purpose, zero-dependency SSH hardening auditor with no equivalent on the radar. Inner position reflects direct applicability to any team or homelab operator with SSH-exposed infrastructure. Trial gate: audit run against a real server with at least one fail-level finding remediated and a clean re-audit confirmed.
