Dist-Detect is an active commandline scanner to detect the Linux or Unix distribution running on a remote host by looking at the banners or responses of typical Unix netowrk services.
Dist-Detect is currently work in progress. For now only the SSH
service is supported and works already quite well in detecting Debian
and derivatives (Ubuntu, Raspbian, etc.), but HTTP/HTTPS, DNS (
dig version.bind ch txt +short @<IP>) and SMTP might be a good data
source as well.
Quickly get an idea …
… of the Linux/BSD/Unix distribution and distribution release of a remote system …
… if the admin applies security updates regularily …
… if the remote system is running an EoL release …
… just by looking at the responses of a few common network services, i.e. very fast.
This is especially useful in heterogenous networks (e.g. with BYOD or many self-managed machines) as common in academia, data-centers with a lot of internet-facing, rented servers/racks, etc.
Focus on Low Hanging Fruits
- If the scanner finds something bad, it's quite sure → nearly no False Positives
- Unknown or unclear versions stay unknown or unclear → will contain False Negatives
7.4p1 Debian as well as the
deb9 clearly show that this is a
Debian 9 Stretch. From the banner you can determine the according
package version to be
Now you can check against the version in the Debian 9 Stretch (security) repositories (e.g. in the Debian Package Tracker if it's the latest one (it's not as of this writing) and hence if OpenSSH security updates as provided by Debian have been applied.
This tools tries to automate this kind of analysis and is hence allowing to scan your whole network quickly for obviously outdated machines. I call this Low Hanging Fruits Scanning.
Work in Progress
As of now, this work in progress.
The inital prototype used hardcoded (and handcoded :-) regular expression (which were outdated quite quicly).
Currently the package repositories of Debian, Ubuntu and Raspbian are checked for the current OpenSSH versions and then the result is stored in an SQLite database. This database is then queried when translating OpenSSH banners into package versions and uptodateness information.
Especially the database schema will likely still change without migration path between each incarnation at the current stage of development. (But since the database can be easily regenerated, this should be no real issue.)
apt install libclass-c3-perl libdpkg-perl libdpkg-parse-perl libfile-touch-perl libio-socket-inet6-perl libmojolicious-perl libmojo-sqlite-perl libnet-cidr-set-perl libnet-dns-perl libparams-validate-perl libtry-tiny-perl libyaml-perl
Dist-Detect is written in Perl (5.14 or a higher 5.x version) and requires the following non-core Perl modules (CPAN distributions and Debian packages names in parentheses):
¹) Only available since Debian 10 Buster.
None yet. Use it just from the checked out git repository by calling
the scripts in
bin/ with their relative or full path.
Add package list downloaders and scrapers for CentOS, openSUSE and macOS.
Distinguish between repos where SSH signatures changes often (active security mirrors of Debian and derivatives) and where they change seldomly (old-releases.ubuntu.com / archive.debian.org).
Make output more human readable. Maybe use a commandline switch to produce either machine or human readable output. The human readable output could be still machine readable by e.g. using YAML instead of purely line-based formats.
Debian Jessie is at the moment available on the normal mirrors and in the historical archive and hence gets flagged EOL even if that might be wrong depending on the (not easily detectable) architecture. Handle this better.
Store most current OpenSSH release version in database
The bin/newest-openssh-version-on-*.pl scripts are a good start for that.
Consider Further Services
If e.g. the SSH banner was
SSH-2.0-OpenSSH_7.4, this could be (at
least) a RHEL 7.4 or higher, or a macOS 10.12.4 to 10.12.6. So other
protocols should add more confidence or limit the list of possible
operating systems and distributions.
HTTP / HTTPS
$ HEAD http://ssh-was-ambiguous/ 200 OK Connection: close Date: […] Server: Apache/2.4.6 (Red Hat Enterprise Linux)
Here, port 80 told us the distribution even though the SSH banner was ambiguous.
HEAD http://somecentos6/ 200 OK Date: […] Server: Apache/2.2.15 (CentOS)
$ echo QUIT | nc mymailserver 25 220 mymailserver ESMTP Postfix (Debian/GNU) 221 2.0.0 Bye $ echo QUIT | nc afriendsmailserver 25 220-afriendsmailserver ESMTP Proxmox 221 2.0.0 Bye $ echo QUIT | nc anothermailserver 25 220 anothermailserver ESMTP Exim 4.86_2 Ubuntu Thu, 10 Oct 2019 17:35:32 +0200 221 anothermailserver closing connection
We often don't get the version, but at least the Linux distribution. Again helpful if the SSH banner is ambiguous.
$ dig +short -t txt -c chaos version.bind @ams.sns-pb.isc.org "9.9.7-P2" $ dig +short version.bind CH TXT @a.iana-servers.net "Knot DNS 2.6.3" dig +short version.bind CH TXT @ns.nlnetlabs.nl "NSD 4.2.2" $ dig +short version.bind CH TXT oneofmydnsservers "9.9.5-9+deb8u18-Debian" $ dig +short version.bind CH TXT somerhel7 "9.11.4-P2-RedHat-9.11.4-9.P2.el7" $ dig +short version.bind CH TXT anotherrhel7 "9.9.4-RedHat-9.9.4-74.el7_6.2" $ dig version.bind ch txt +short @127.0.0.1 "unbound 1.9.4" $ dig version.bind ch txt +short @192.168.1.1 "dnsmasq-2.78"
Please note that fpdns is about as
nmap for this purpose (but much faster): It does
real fingerprinting and not evaluating the actual data it can retrieve
from a DNS server.
An exception would be cases like these:
$ dig +short version.bind CH TXT @220.127.116.11 $ dig +short version.bind CH TXT @a.ns.nic.cz $ dig +short version.bind CH TXT @ns2.switch.ch "contact email@example.com" $ dig +short version.bind CH TXT @a.nic.de "ns-1.de.nl1.bind"
Also store results and scan dates in a database.
Someone suggested to also look at SIP, NTP, MDNS (Synology devices seem to be quite chatty) and SSDP ports.
Parse package changelogs for existing versions.
Add optional scanning backends.
Maybe use https://repology.org/api and https://repology.org/project/openssh/versions instead of or in addition to scraping package lists. Probably filter returned list to only use these package names:
openssh-portableThe following list is questionable as they're patched versions which may lag behind the unpatched version:
- Probably less reliable than repology because likely only manual / crowd-sourced data updates.
Add support for more Debian derivatives:
- Supported derivatives ones like Trisquel, Linux Mint, and Kali Linux.
- Live-CDs like Tails, Grml and Knoppix
- Discontinued ones (you also want to detect them) like Tanglu
Let the package list parser optionally generate rules from every banner of a non-up-to-date or end-of-life version for SNORT (and hence also Suricata) and/or Zeek (formerly known as Bro).
Maybe also take the output of ssh-audit as a signature for an OS. Needs a collection of signatures, though.
scanhost.plto read scan targets from
STDINor use a configuration file for batch scans, too.
- A way to detect that some Linux distribution is running inside the Windows Subsystem for Linux (WSL).
License and Copyright
Dist-Detect is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
Dist-Detect is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
Files with Different Licenses
- Jakob Dhondt for the project name suggestion.
- The SWITCH Open Source Security Tools Hackathon 2019 for providing the right atmosphere to get the project away from the Proof of Concept state. :-)
Slide Decks about Dist-Detect
- ssh-version (probably too slow to be used as backend, more thought as small and simple commandline tool)