Configuration

By default, all alerts are disabled and the preprocessor checks traffic on port 22.

The available configuration options are described below.

104.

server_ports $\{ <$port$> [<$port$> <...>] \}$

This option specifies which ports the SSH preprocessor should inspect traffic to.

105.

max_encrypted_packets $<$ number $>$

The number of encrypted packets that Snort will inspect before ignoring a given SSH session. The SSH vulnerabilities that Snort can detect all happen at the very beginning of an SSH session. Once max_encrypted_packets packets have been seen, Snort ignores the session to increase performance. The default is set to 25. This value can be set from 0 to 65535.

106.

max_client_bytes $<$ number $>$

The number of unanswered bytes allowed to be transferred before alerting on Challenge-Response Overflow or CRC 32. This number must be hit before max_encrypted_packets packets are sent, or else Snort will ignore the traffic. The default is set to 19600. This value can be set from 0 to 65535.

107.

max_server_version_len $<$ number $>$

The maximum number of bytes allowed in the SSH server version string before alerting on the Secure CRT server version string overflow. The default is set to 80. This value can be set from 0 to 255.

108.

autodetect

Attempt to automatically detect SSH.

109.

enable_respoverflow

Enables checking for the Challenge-Response Overflow exploit.

110.

enable_ssh1crc32

Enables checking for the CRC 32 exploit.

111.

enable_srvoverflow

Enables checking for the Secure CRT exploit.

112.

enable_protomismatch

Enables checking for the Protocol Mismatch exploit.

113.

enable_badmsgdir

Enable alerts for traffic flowing the wrong direction. For instance, if the presumed server generates client traffic, or if a client generates server traffic.

114.

enable_paysize

Enables alerts for invalid payload sizes.

115.

enable_recognition

Enable alerts for non-SSH traffic on SSH ports.

The SSH preprocessor should work by default. After max_encrypted_packets is reached, the preprocessor will stop processing traffic for a given session. If Challenge-Response Overflow or CRC 32 false positive, try increasing the number of required client bytes with max_client_bytes.