6.16. SSH Keywords¶
Suricata has several rule keywords to match on different elements of SSH connections.
6.16.1. ssh.proto¶
Match on the version of the SSH protocol used. ssh.proto
is a sticky buffer,
and can be used as a fast pattern. ssh.proto
replaces the previous buffer
name: ssh_proto
. You may continue to use the previous name, but it’s
recommended that existing rules be converted to use the new name.
Format:
ssh.proto;
Example:
The example above matches on SSH connections with SSH version 2.0.
6.16.2. ssh.software¶
Match on the software string from the SSH banner. ssh.software
is a sticky
buffer, and can be used as fast pattern.
ssh.software
replaces the previous keyword names: ssh_software
&
ssh.softwareversion
. You may continue to use the previous name, but it’s
recommended that rules be converted to use the new name.
Format:
ssh.software;
Example:
The example above matches on SSH connections where the software string contains “openssh”.
6.16.3. ssh.protoversion¶
Matches on the version of the SSH protocol used. A value of 2_compat
includes SSH version 1.99.
Format:
ssh.protoversion:[0-9](\.[0-9])?|2_compat;
Example:
The example above matches on SSH connections with SSH version 2 or 1.99.
The example above matches on SSH connections with SSH version 1.10 only.
6.16.4. ssh.softwareversion¶
This keyword has been deprecated. Please use ssh.software
instead. Matches
on the software string from the SSH banner.
Example: