How to set a custom SSH connection response string?

Question

Is it possible to modify the string that the OpenSSH server displays when a raw connection is established?

_{It is not about the text banner displayed after the connection is established and which can be configured by the Banner parameter in sshd_config, but about the raw output the SSH server sends on a connection attempt before the handshake.}

For example, given a raw telnet connection

$ telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.2p2

is there a way to reduce identifying information to the bare minimum?

My understanding is that SSH-2.0- must be present because it is required by the SSH protocol, but the string that follows - OpenSSH_7.2p2 - is probably not required by the protocol but I can't see a way to change or remove it without recompiling.

The intent is to avoid providing more info than strictly necessary for the protocol to work.

Answer 1

No. The version string is defined in version.h of OpenSSH source as

#define SSH_VERSION "OpenSSH_7.4".

You could change it, but it requires recompiling.

It is then send put together via:

snprintf(buf, sizeof buf, "SSH-2.0-%.100s\r\n", SSH_VERSION)

(ssh_api.c line 381, in function _ssh_send_banner)

See also: Prevent SSH from advertising its version number.

Answer 2

Recent OpenSSH versions allow adding custom text via VersionAddendum, but do not allow removing the product name/version. You'll have to patch the source code for that.