If I go inside the file /etc/ssh/ssh_config
, I can see "$OpenBSD" at the top of file. However, if I change the default port to a different value, it doesn't seem to work. A colleague informed me that's because Dropbear is the software server here, not OpenSSH.
Is there a way to be sure? I can't find an answer googling that.
Connect to the ssh port (e.g. 22) and inspect the banner.
Most (if not all?) SSH servers send some sort of version string immediately upon connecting. In a small research project of mine I tried to map SSH server version across a large IPv4 space, and what I did was basically
nc address port
.I baked it into a perl script with a timeout for easier processing on my side, as well as an optional timeout with a default value:
Testing it against a server on my network:
If you are on the server, look at the process attached to the network port where
ssh
is expected (22
or something else).You can use
netstat
orss
for that. You will then be able to find the full command line of the running server which may be enough to identify it or else you may use to other options:strings
on it is really the last course of actions but can yield results (you will most certainly find back also the string that is reported by the server remotely, as other answers show)/proc/$PID/fd
) which may yield either a link to a configuration file, or a logfile, and ideally the logfile would give enough information to pinpoint what process this is.Or depending on your system and setup, for example you can use
systemctl list-units
to see exactly what runs currently, and what is thessh
server (then by inspectingsystemd
unit file you will see what command line it is, and other information)If you are external to the server, then see other answers, but there is no guarantee that was is returned from remote server is the truth, it can displays itself as whatever it wants.
Another option remotely would be to do some "SSH fingerprinting". I haven't seen that directly, but I am sure it exists. Basically by testing various types of connections, one can determine some info from the remote part, besides what it claims to be. I guess multiple vulnerability scanners have things like that.
You can use
ps
to get the list of processes andgrep
the output forsshd
.With this, you will get the path to the executable binary {{ eg
/usr/sbin/sshd
or something like that }}.You can then execute this binary with
-?
to get the help & usage information. This output will contain the Definitive Name of the Package {{ eg OpenSSH or Dropbear or something like that }}.