A Go-based tool to automatically scan networks for SSH servers with weak passwords and track credential vulnerabilities.
SSH Auditor is a command-line tool written in Go that scans network ranges for SSH servers and tests them against a database of weak username/password combinations. It helps system administrators identify vulnerable SSH configurations by automating the discovery and credential testing process, storing results in a SQLite database for ongoing monitoring.
System administrators, network security teams, and penetration testers responsible for securing SSH services on internal or external networks.
Developers choose SSH Auditor for its lightweight, automated approach to SSH security auditing, with features like incremental scanning, customizable check intervals, and duplicate key detection that reduce manual effort while providing continuous visibility into credential vulnerabilities.
The best way to scan for weak ssh passwords on your network
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Only re-tests new credentials on existing hosts and triggers full scans on version or key changes, minimizing redundant work as described in the automated re-scanning feature.
Allows setting per-credential scan intervals (e.g., default 14 days), enabling optimized audit frequency based on risk levels, as highlighted in the intelligent scheduling.
Tests both command execution and TCP tunneling to confirm credential validity, reducing false positives from non-standard SSH implementations, per the comprehensive testing feature.
Built for regular execution via cron jobs, making it easy to integrate into automated security workflows without complex daemons, as noted in the cron integration philosophy.
Relies solely on SQLite for storage, with MySQL/Postgres support listed as a TODO, hindering scalability and integration in enterprise environments.
Operates via batch scans scheduled via cron, lacking real-time monitoring or API hooks for immediate response to new SSH server detections, as implied by the design for periodic execution.
Requires manual updates for non-standard ports and static IP ranges during discovery, which can be cumbersome in dynamic or cloud-based networks, as noted in the usage instructions.