Details
Assignee
UnassignedUnassignedReporter
Tarus BalogTarus BalogLabels
Components
Affects versions
Priority
Major
Details
Details
Assignee
Unassigned
UnassignedReporter
Tarus Balog
Tarus BalogLabels
Components
Affects versions
Priority
PagerDuty
PagerDuty
PagerDuty
Created October 30, 2012 at 11:53 AM
Updated September 21, 2021 at 6:24 PM
The SSH Detector incorrectly detects SSH on some devices.
telnet 10.61.19.2 22
Trying 10.61.19.2...
Connected to 10.61.19.2.
Escape character is '^]'.
Connection closed by foreign host.
Note that there is a connection to port 22 but that it is immediately dropped. However, the service is added to OpenNMS.
The SSH detector should go beyond just a port check to test to see if there is, at a minimum, an SSH header. It should also exit cleanly as to avoid spurious SSH logs on the host device.
Workaround:
Modify the foreign source to use the TCP detector with a parameter of "banner" and a value of "SSH".