sshcatch 0.2.1__tar.gz → 0.3.0__tar.gz

{sshcatch-0.2.1 → sshcatch-0.3.0}/CHANGELOG.md

@@ -4,6 +4,64 @@ All notable changes to **sshcatch** are documented here.
 This project follows [Keep a Changelog](https://keepachangelog.com/) and
 [Semantic Versioning](https://semver.org/).
 
+## [0.3.0] - 2026-08-02
+
+Pose as another SSH server.
+
+### Added
+
+- **`--mimic debian` / `--mimic dropbear`** poses as a real OpenSSH 8.4p1 (Debian 11) or
+  Dropbear 2024.86 server: version banner, KEXINIT/HASSH, offered host keys and auth
+  methods match a capture of the real server. After authentication `sshcatch` differs from a
+  real server anyway, so `--mimic` only works pre-auth. Every modification to asyncssh,
+  the reasoning and the captures are in
+  [`mimic-refs/mimic-notes.md`](https://github.com/LorenzMap/sshcatch/blob/main/mimic-refs/mimic-notes.md).
+- `select_host_keys()` offers only the host-key types the mimicked server has, in its order.
+
+### Changed
+
+- **asyncssh is pinned to 2.24.0 exactly** - `--mimic` patches library internals, so a
+  different version could break the disguise silently. If a patched internal is gone,
+  sshcatch refuses to start.
+- The sdist ships only what is needed to install the package (no `mimic-refs/`).
+- The startup summary shows the active mimic preset.
+
+### Removed
+
+- **`--version-banner` presets** (`ubuntu`, `debian`, `dropbear`, `windows`, `macos`)
+  are dropped and the flag now takes a literal string only, `--mimic` sets a fitting
+  banner itself.
+
+
+## [0.2.2] - 2026-07-31
+
+Multiple host keys now used as default.
+
+### Added
+
+- **Three host keys instead of one.** ed25519, RSA-3072 and ecdsa-nistp256 are
+  generated on first run if missing and stored together in one `sshcatch_host_key`
+  file, so clients can pick their algorithm. Existing key files are read with
+  `read_private_key_list()` and may hold any number of keys.
+
+### Changed
+
+- The startup summary prints the fingerprint of each key.
+- **Startup failures go through a single handler.** `PermissionError` is no longer
+  special-cased: it always blamed the port, even when the host key file was the
+  real problem. The underlying error is shown instead - it already names the
+  address and port.
+
+### Fixed
+
+- An empty, unreadable or passphrase-protected host key file now ends in a clean
+  error message instead of a traceback.
+- `authorized_keys` lines that do not start with a key say why they were refused.
+  Options in front of the key (`from="..."`, `restrict`, ...) remain unsupported -
+  sshcatch cannot enforce them, so such keys are rejected rather than silently
+  accepted without their restrictions.
+
+
 ## [0.2.1] - 2026-07-29
 
 Forwarding hardening and help/logging polish.

{sshcatch-0.2.1 → sshcatch-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sshcatch
-Version: 0.2.1
+Version: 0.3.0
 Summary: Quick-deploy SSH server for tunneling and simple SCP transfers - never opens a shell.
 Project-URL: Homepage, https://github.com/LorenzMap/sshcatch
 Project-URL: Repository, https://github.com/LorenzMap/sshcatch
@@ -21,7 +21,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: System :: Networking
 Requires-Python: >=3.10
-Requires-Dist: asyncssh<2.25.0,>=2.21.0
+Requires-Dist: asyncssh==2.24.0
 Description-Content-Type: text/markdown
 
 # sshcatch
@@ -39,6 +39,28 @@ Built on [asyncssh](https://github.com/ronf/asyncssh).
 This is a pentesting tool. Only point it at systems and networks you are authorized 
 to test.
 
+## Why this tool exists
+
+- During engagements and CTFs I love to use 'simple' tools on my host that just work
+  - http-server -> `python3 -m http.server`
+  - smb-server -> `impacket-smbserver`
+  - ssh-server -> ??? (now `sshcatch`)
+
+- `sshd` can be used, but:
+  - configuring it through `sshd_configs` is a pain
+  - multiple use-cases require different configs (tunnel direction? sftp direction? different ports?) 
+  - logins are controlled by the OS so a user must be created (and secured)
+  - ForceCommands need to be set up to restrict the shell
+
+- My solution: `sshcatch`
+  - Simply configure through clear flags and arguments on the commandline
+    - restrictive defaults, every feature must be enabled consciously
+  - Never allow shells (or commands)
+  - Forward/Reverse tunnels can be individually activated 
+  - SCP/SFTP file uploads and downloads can be individually activated
+    - restrictive upload handling to prevent overwriting
+    - symlinks denied
+
 ## Install
 
 With `pipx` (recommended, installs into an isolated environment and puts
@@ -62,8 +84,9 @@ cd sshcatch
 pipx install .          # or: pip install .
 ```
 
-Needs Python 3.10+. A host key is auto-generated in the working directory on
-first run (or point `--host-key` at your own).
+Needs Python 3.10+. Three host keys (ed25519, RSA, ECDSA) are auto-generated
+into a single file in the working directory on first run (or point `--host-key`
+at your own file).
 
 ## How it works
 
@@ -99,6 +122,21 @@ Uploads **never overwrite** an existing file. The new file gets a numeric suffix
 
 Renames, deletes and directory removal are denied.
 
+## Word of Warning
+
+Only using `--version-banner` obviously isn't enough deception against a sufficiently
+sophisticated observer because some of the data transferred in cleartext on the wire
+during connection establishment is a clear tell. Use `--mimic` if that's something you
+want to try and dodge in an engagement. Check out
+[`mimic-refs/mimic-notes.md`](https://github.com/LorenzMap/sshcatch/blob/main/mimic-refs/mimic-notes.md)
+for details about `--mimic`.
+
+Also: `sshcatch` is **NOT** designed to be a **honeypot**. Advanced deception, long-term logging 
+and everything else a real honeypot needs are deliberately out of scope. There are other
+projects that can be used: [Cowrie](https://github.com/cowrie/cowrie),
+[cyanide-framework](https://github.com/tanhiowyatt/cyanide-framework) and probably a lot more!
+
+
 ## Examples
 
 Let one user pull/put files from the current directory via SCP/SFTP:
@@ -130,7 +168,7 @@ and saving them into a file:
 
 ```
 # Server
-sshcatch -1 -u arthur:42 --version-banner debian \
+sshcatch -1 -u arthur:42 --version-banner 'heart_of_gold' \
          --pre-auth-banner "What is the answer to life the universe and everything" \
          --post-auth-banner "flag{So_Long_and_Thanks_for_All_the_Fish}" \
          -o sshcatch.log -t
@@ -138,11 +176,11 @@ sshcatch -1 -u arthur:42 --version-banner debian \
 
 
 My favorite one: Reverse tunnel and SCP uploads for the keys in
-`./authorized-keys` while posing as an Ubuntu SSH server on port 2222:
+`./authorized_keys` on port 2222:
 
 ```
 # Server
-sshcatch --reverse --authorized-keys ./authorized-keys --scp-upload --version-banner ubuntu -p 2222
+sshcatch --reverse --authorized-keys ./authorized_keys --scp-upload -p 2222
 
 # Client
 ssh -NR 9000:localhost:22 user@host -p 2222     # reverse tunnel
@@ -156,15 +194,15 @@ scp -P 2222 loot.tar user@host:.                # upload
 The full reference below is `sshcatch --help`:
 
 ```
-usage: sshcatch [-h] [--help] [-p PORT] [-b BIND] [-1] [--host-key FILE]
-                [--version] [-u USER:PASS] [--open-auth]
+usage: sshcatch [-h] [--help] [-p PORT] [-b BIND] [-1] [--mimic PRESET]
+                [--host-key FILE] [--version] [-u USER:PASS] [--open-auth]
                 [--authorized-keys FILE] [--forward] [--reverse]
                 [--scp-upload] [--scp-download] [--scp-dir DIR]
                 [--version-banner STRING] [--pre-auth-banner STRING]
                 [--post-auth-banner STRING] [-q | -v] [-o FILE] [-t] [--plain]
 
 sshcatch - a quick-deploy SSH server for tunneling (local/remote/dynamic)
-and simple SCP transfers (NEVER opens a shell!).
+and simple SCP/SFTP transfers (NEVER opens a shell!)
 By default all features are disabled. Use flags to enable features.
 
 options:
@@ -174,7 +212,14 @@ options:
   -b BIND, --bind BIND  bind address (default: all IPv4/v6 interfaces)
   -1, --single          close the listener after first successful auth (and
                         exit when that connection ends)
-  --host-key FILE       server host key file (default: auto-generate)
+  --mimic PRESET        pose as another SSH server - presets (case-
+                        insensitive): debian, dropbear, none - match the
+                        preset's pre-auth (banner, KEXINIT, server-sig-algs,
+                        ...) exactly - banner can be overridden by --version-
+                        banner - check Github repository for details
+  --host-key FILE       server host key file, may hold several keys - auto-
+                        generated if missing - uses ./sshcatch_host_key by
+                        default
   --version             show program's version number and exit
 
 authentication:
@@ -200,10 +245,7 @@ SCP / SFTP file transfer:
 
 banners:
   --version-banner STRING
-                        sent as 'SSH-2.0-STRING' version banner - only first-
-                        glance deception, it can still be identified as
-                        asyncssh - presets (case-insensitive): ubuntu, debian,
-                        dropbear, windows, macos
+                        manually set 'SSH-2.0-STRING' version banner
   --pre-auth-banner STRING
                         banner shown to every client before login
   --post-auth-banner STRING
@@ -225,8 +267,7 @@ examples: (also check README on Github)
   sshcatch --open-auth --forward             Allow ANYONE! to tunnel through this SSH server
   # My favorite one
   #   Allows reverse tunnels and uploads via SCP for the keys in ./authorized_keys
-  #   while posing shallowly as an Ubuntu SSH server on port 2222
-  sshcatch --reverse --authorized-keys ./authorized-keys --scp-upload --version-banner ubuntu -p 2222
+  sshcatch --reverse --authorized-keys ./authorized_keys --scp-upload -p 2222
 ```
 
 ## License

{sshcatch-0.2.1 → sshcatch-0.3.0}/README.md

@@ -13,6 +13,28 @@ Built on [asyncssh](https://github.com/ronf/asyncssh).
 This is a pentesting tool. Only point it at systems and networks you are authorized 
 to test.
 
+## Why this tool exists
+
+- During engagements and CTFs I love to use 'simple' tools on my host that just work
+  - http-server -> `python3 -m http.server`
+  - smb-server -> `impacket-smbserver`
+  - ssh-server -> ??? (now `sshcatch`)
+
+- `sshd` can be used, but:
+  - configuring it through `sshd_configs` is a pain
+  - multiple use-cases require different configs (tunnel direction? sftp direction? different ports?) 
+  - logins are controlled by the OS so a user must be created (and secured)
+  - ForceCommands need to be set up to restrict the shell
+
+- My solution: `sshcatch`
+  - Simply configure through clear flags and arguments on the commandline
+    - restrictive defaults, every feature must be enabled consciously
+  - Never allow shells (or commands)
+  - Forward/Reverse tunnels can be individually activated 
+  - SCP/SFTP file uploads and downloads can be individually activated
+    - restrictive upload handling to prevent overwriting
+    - symlinks denied
+
 ## Install
 
 With `pipx` (recommended, installs into an isolated environment and puts
@@ -36,8 +58,9 @@ cd sshcatch
 pipx install .          # or: pip install .
 ```
 
-Needs Python 3.10+. A host key is auto-generated in the working directory on
-first run (or point `--host-key` at your own).
+Needs Python 3.10+. Three host keys (ed25519, RSA, ECDSA) are auto-generated
+into a single file in the working directory on first run (or point `--host-key`
+at your own file).
 
 ## How it works
 
@@ -73,6 +96,21 @@ Uploads **never overwrite** an existing file. The new file gets a numeric suffix
 
 Renames, deletes and directory removal are denied.
 
+## Word of Warning
+
+Only using `--version-banner` obviously isn't enough deception against a sufficiently
+sophisticated observer because some of the data transferred in cleartext on the wire
+during connection establishment is a clear tell. Use `--mimic` if that's something you
+want to try and dodge in an engagement. Check out
+[`mimic-refs/mimic-notes.md`](https://github.com/LorenzMap/sshcatch/blob/main/mimic-refs/mimic-notes.md)
+for details about `--mimic`.
+
+Also: `sshcatch` is **NOT** designed to be a **honeypot**. Advanced deception, long-term logging 
+and everything else a real honeypot needs are deliberately out of scope. There are other
+projects that can be used: [Cowrie](https://github.com/cowrie/cowrie),
+[cyanide-framework](https://github.com/tanhiowyatt/cyanide-framework) and probably a lot more!
+
+
 ## Examples
 
 Let one user pull/put files from the current directory via SCP/SFTP:
@@ -104,7 +142,7 @@ and saving them into a file:
 
 ```
 # Server
-sshcatch -1 -u arthur:42 --version-banner debian \
+sshcatch -1 -u arthur:42 --version-banner 'heart_of_gold' \
          --pre-auth-banner "What is the answer to life the universe and everything" \
          --post-auth-banner "flag{So_Long_and_Thanks_for_All_the_Fish}" \
          -o sshcatch.log -t
@@ -112,11 +150,11 @@ sshcatch -1 -u arthur:42 --version-banner debian \
 
 
 My favorite one: Reverse tunnel and SCP uploads for the keys in
-`./authorized-keys` while posing as an Ubuntu SSH server on port 2222:
+`./authorized_keys` on port 2222:
 
 ```
 # Server
-sshcatch --reverse --authorized-keys ./authorized-keys --scp-upload --version-banner ubuntu -p 2222
+sshcatch --reverse --authorized-keys ./authorized_keys --scp-upload -p 2222
 
 # Client
 ssh -NR 9000:localhost:22 user@host -p 2222     # reverse tunnel
@@ -130,15 +168,15 @@ scp -P 2222 loot.tar user@host:.                # upload
 The full reference below is `sshcatch --help`:
 
 ```
-usage: sshcatch [-h] [--help] [-p PORT] [-b BIND] [-1] [--host-key FILE]
-                [--version] [-u USER:PASS] [--open-auth]
+usage: sshcatch [-h] [--help] [-p PORT] [-b BIND] [-1] [--mimic PRESET]
+                [--host-key FILE] [--version] [-u USER:PASS] [--open-auth]
                 [--authorized-keys FILE] [--forward] [--reverse]
                 [--scp-upload] [--scp-download] [--scp-dir DIR]
                 [--version-banner STRING] [--pre-auth-banner STRING]
                 [--post-auth-banner STRING] [-q | -v] [-o FILE] [-t] [--plain]
 
 sshcatch - a quick-deploy SSH server for tunneling (local/remote/dynamic)
-and simple SCP transfers (NEVER opens a shell!).
+and simple SCP/SFTP transfers (NEVER opens a shell!)
 By default all features are disabled. Use flags to enable features.
 
 options:
@@ -148,7 +186,14 @@ options:
   -b BIND, --bind BIND  bind address (default: all IPv4/v6 interfaces)
   -1, --single          close the listener after first successful auth (and
                         exit when that connection ends)
-  --host-key FILE       server host key file (default: auto-generate)
+  --mimic PRESET        pose as another SSH server - presets (case-
+                        insensitive): debian, dropbear, none - match the
+                        preset's pre-auth (banner, KEXINIT, server-sig-algs,
+                        ...) exactly - banner can be overridden by --version-
+                        banner - check Github repository for details
+  --host-key FILE       server host key file, may hold several keys - auto-
+                        generated if missing - uses ./sshcatch_host_key by
+                        default
   --version             show program's version number and exit
 
 authentication:
@@ -174,10 +219,7 @@ SCP / SFTP file transfer:
 
 banners:
   --version-banner STRING
-                        sent as 'SSH-2.0-STRING' version banner - only first-
-                        glance deception, it can still be identified as
-                        asyncssh - presets (case-insensitive): ubuntu, debian,
-                        dropbear, windows, macos
+                        manually set 'SSH-2.0-STRING' version banner
   --pre-auth-banner STRING
                         banner shown to every client before login
   --post-auth-banner STRING
@@ -199,8 +241,7 @@ examples: (also check README on Github)
   sshcatch --open-auth --forward             Allow ANYONE! to tunnel through this SSH server
   # My favorite one
   #   Allows reverse tunnels and uploads via SCP for the keys in ./authorized_keys
-  #   while posing shallowly as an Ubuntu SSH server on port 2222
-  sshcatch --reverse --authorized-keys ./authorized-keys --scp-upload --version-banner ubuntu -p 2222
+  sshcatch --reverse --authorized-keys ./authorized_keys --scp-upload -p 2222
 ```
 
 ## License

{sshcatch-0.2.1 → sshcatch-0.3.0}/pyproject.toml

@@ -25,7 +25,8 @@ classifiers = [
     "Topic :: Security",
     "Topic :: System :: Networking",
 ]
-dependencies = ["asyncssh>=2.21.0,<2.25.0"]
+# Pinned exactly due to mimic monkey-patches on asyncssh internals (see mimic-refs/mimic-notes.md)
+dependencies = ["asyncssh==2.24.0"]
 
 [project.urls]
 Homepage = "https://github.com/LorenzMap/sshcatch"
@@ -40,3 +41,6 @@ path = "sshcatch.py"
 
 [tool.hatch.build.targets.wheel]
 only-include = ["sshcatch.py"]
+
+[tool.hatch.build.targets.sdist]
+only-include = ["sshcatch.py", "README.md", "CHANGELOG.md", "LICENSE"]

{sshcatch-0.2.1 → sshcatch-0.3.0}/sshcatch.py

@@ -1,14 +1,16 @@
 #!/usr/bin/env python3
 """
 sshcatch - a quick-deploy SSH server for tunneling (local/remote/dynamic)
-and simple SCP transfers (NEVER opens a shell!).
+and simple SCP/SFTP transfers (NEVER opens a shell!).
 """
 
 import argparse
 import asyncio
+import functools
 import logging
 import os
 import posixpath
+import re
 import sys
 import time
 from pathlib import Path
@@ -16,7 +18,7 @@ from itertools import count
 
 import asyncssh
 
-__version__ = "0.2.1"
+__version__ = "0.3.0"
 
 # ── Logging ───────────────────────────────────────────────────────────
 
@@ -251,8 +253,7 @@ class SFTPCatchServer(asyncssh.SFTPServer):
         self._ensure_parent(new)
         target = old.decode(errors="replace")
         Path(os.fsdecode(self.map_path(new))).write_text(f"symlink -> {target}\n")
-        self._log_scp(f"SYMLINK {self._local_path(new)} -> {target} (placeholder)",
-                      logging.WARNING)
+        self._log_scp(f"SYMLINK {self._local_path(new)} -> {target} (placeholder)", logging.WARNING)
 
     def setstat(self, path, attrs):
         # Allow (upload only): perms/timestamps on uploaded files
@@ -366,10 +367,11 @@ def make_server_factory(args, single_future=None):
     if args.authorized_keys:
         for i, line in enumerate(args.authorized_keys.read_text().splitlines(), 1):
             line = line.strip()
-            if not line or line.startswith('#'):
-                continue
+            if not line or line.startswith('#'): continue
+            key_only = re.search(r"^\S+ AAAA\S+", line)
             try:
-                k = asyncssh.import_public_key(line)
+                if not key_only: raise ValueError("Must start with 'keytype base64' (no options)")
+                k = asyncssh.import_public_key(key_only.group())
                 fp = k.get_fingerprint()
                 auth_keys_fps.add(fp)
                 log_info(f"Loaded key     line={i}  fingerprint={fp}")
@@ -468,6 +470,11 @@ def make_server_factory(args, single_future=None):
             # always accept passwords so we can log them
             return True
 
+        def kbdint_auth_supported(self):
+            # force  publickey,password auth for mimic (drop keyboard-interactive)
+            if not args.mimic == "none": return False
+            return super().kbdint_auth_supported()
+            
         def validate_password(self, username, password):
             accepted = accept_password(username, password)
             if accepted:
@@ -543,24 +550,32 @@ def make_server_factory(args, single_future=None):
 
 # ── Server start ──────────────────────────────────────────────────────
 
+GENERATE_KEYS = ("ssh-ed25519", "ssh-rsa", "ecdsa-sha2-nistp256")
+GENERATE_OPTS = {"ssh-rsa": {"key_size": 3072}}
+
 async def start_server(args):
-    # Handle Host key
+    # Handle Host keys
     key_path = args.host_key if args.host_key else Path.cwd()
-    if key_path.is_dir(): 
+    if key_path.is_dir():
         key_path = key_path / "sshcatch_host_key"
     if not key_path.parent.is_dir():
         raise FileNotFoundError(f"Host key directory does not exist: {key_path.parent}")
 
     if key_path.is_file():
-        host_key = asyncssh.read_private_key(str(key_path))
-        log_info(f"Read host key: {key_path}")
+        try: host_keys = asyncssh.read_private_key_list(str(key_path))
+        except ValueError as e: raise ValueError(f"Could not read host key file {key_path}: {e}") from None
+        if not host_keys: raise ValueError(f"No usable host key in {key_path}")
+        log_info(f"Read host key: {key_path} ({len(host_keys)} key{'s'*(len(host_keys)!=1)})")
     else:
-        host_key = asyncssh.generate_private_key("ssh-ed25519")
-        host_key.write_private_key(str(key_path))
-        log_info(f"Generated host key: {key_path}")
+        host_keys = [asyncssh.generate_private_key(a, **GENERATE_OPTS.get(a, {})) for a in GENERATE_KEYS]
+        key_path.write_bytes(b"".join(k.export_private_key() for k in host_keys))
+        log_info(f"Generated host keys file: {key_path}")
         if os.name == "posix": key_path.chmod(0o600)
         else: log_info("Please make sure the permissions on the host key are securely set!", level=logging.WARNING)
-    fingerprint = host_key.get_fingerprint()
+
+    # Choose which keys to expose and what host-key algorithms to advertise
+    exposed_keys, host_key_algs = select_host_keys(host_keys, args.mimic)
+    fingerprints = [(k.get_algorithm(), k.get_fingerprint()) for k in exposed_keys]
 
     # for single-connection mode - resolving releases the bind on the listen port
     single_future = asyncio.get_running_loop().create_future() if args.single else None
@@ -569,12 +584,15 @@ async def start_server(args):
     server_factory, n_users, n_keys = make_server_factory(args, single_future)
     opts = {
         "server_factory": server_factory,
-        "server_host_keys": [host_key],
+        "server_host_keys": exposed_keys,
         # SFTPv3 only so all transfers use open() and not open56()
         "sftp_version": 3,
     }
-    if args.version_banner: 
+    if args.version_banner:
         opts["server_version"] = args.version_banner
+    if args.mimic != "none":
+        opts.update(MIMIC_PRESETS[args.mimic][1])
+        apply_mimic_patches(args.mimic, host_key_algs)
 
     has_scp = args.scp_upload or args.scp_download
     if has_scp:
@@ -634,10 +652,12 @@ async def start_server(args):
     if args.single: summary.append("Mode .......... single-connection")
     if has_scp: summary.append(f"SCP dir ....... {args.scp_dir.resolve()}")
     summary.append(f"Version ....... SSH-2.0-{options.version.decode()}")
+    summary.append(f"Mimic ......... {args.mimic}")
     if args.pre_auth_banner: summary.append(f"Pre-auth ...... {banner_preview(args.pre_auth_banner)}")
     if args.post_auth_banner: summary.append(f"Post-auth ..... {banner_preview(args.post_auth_banner)}")
-    summary.append(f"Host key ...... {fingerprint}")
     summary.append(f"Key file ...... {key_path}")
+    for algo, fp in fingerprints: summary.append(f"Host key ...... {fp} ({algo})")
+    summary.append(f"\n")
     log_info("sshcatch\n" + "\n".join(f"  {line}" for line in summary), level=logging.WARNING)
 
     acceptor = await asyncssh.listen(host=args.bind, port=args.port, options=options)
@@ -656,18 +676,124 @@ async def start_server(args):
 
 # ── Main ──────────────────────────────────────────────────────────────
 
-# Quick --version-banner presets: keyword -> realistic 'SSH-2.0-<value>' banner.
-VERSION_PRESETS = {
-    "ubuntu":   "OpenSSH_9.6p1 Ubuntu-3ubuntu13.5",
-    "debian":   "OpenSSH_9.2p1 Debian-2+deb12u3",
-    "dropbear": "dropbear_2022.83",
-    "windows":  "OpenSSH_for_Windows_9.5",
-    "macos":    "OpenSSH_9.8",
+# ── Mimic presets ─────────────────────────────────────────────────────
+# - algorithm lists below shape the cleartext KEXINIT
+# - apply_mimic_patches() handles the monkey-patches of asyncssh
+# - for full reasoning see 'mimic-refs/mimic-notes.md'
+
+DEBIAN_ALGS = {
+    "kex_algs": ["curve25519-sha256", "curve25519-sha256@libssh.org",
+                 "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521",
+                 "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512",
+                 "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256"],
+    "encryption_algs": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr",
+                        "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"],
+    "mac_algs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com",
+                 "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com",
+                 "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com",
+                 "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"],
+    "compression_algs": ["none", "zlib@openssh.com"],
+    "signature_algs": ["ssh-ed25519", "sk-ssh-ed25519@openssh.com", "ssh-rsa",
+                       "rsa-sha2-256", "rsa-sha2-512", "ssh-dss",
+                       "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521",
+                       "sk-ecdsa-sha2-nistp256@openssh.com",
+                       "webauthn-sk-ecdsa-sha2-nistp256@openssh.com"],
+}
+
+DROPBEAR_ALGS = {
+    "kex_algs": ["curve25519-sha256", "curve25519-sha256@libssh.org",
+                 "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256",
+                 "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1"],
+    "encryption_algs": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes256-ctr"],
+    "mac_algs": ["hmac-sha1", "hmac-sha2-256"],
+    "compression_algs": ["zlib@openssh.com", "none"],
+    "signature_algs": ["ssh-ed25519", "sk-ssh-ed25519@openssh.com",
+                       "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521",
+                       "sk-ecdsa-sha2-nistp256@openssh.com", "rsa-sha2-256", "ssh-rsa"],
+}
+
+MIMIC_PRESETS = {
+    "debian":   ("OpenSSH_8.4p1 Debian-5+deb11u7", DEBIAN_ALGS),   # Debian 11 (bullseye)
+    "dropbear": ("dropbear_2024.86", DROPBEAR_ALGS),               # Dropbear 2024.86
+    "none":     None                                               # asyncssh defaults
 }
 
+ADVERTISED_HOSTKEY_ALGS = {
+    "ssh-ed25519":         [b"ssh-ed25519"],
+    "ecdsa-sha2-nistp256": [b"ecdsa-sha2-nistp256"],
+    "ssh-rsa":             [b"rsa-sha2-512", b"rsa-sha2-256", b"ssh-rsa"],
+}
+
+MIMIC_HOSTKEYS = {
+    "debian":   ["ssh-rsa", "ecdsa-sha2-nistp256", "ssh-ed25519"],      # debian: rsa+ecdsa+ed25519
+    "dropbear": ["ssh-ed25519"],                                        # dropbear: ed25519 only
+}
+
+
+def select_host_keys(host_keys, mimic):
+    # Select fitting host keys for the mimicked server and order them in the default way
+    keys_by_algo = {k.get_algorithm(): k for k in host_keys}
+    wanted = MIMIC_HOSTKEYS.get(mimic, [])
+    missing = [a for a in wanted if a not in keys_by_algo]
+    if missing:
+        log_info(f"Host-keys missing: {missing} - a real {mimic} server provides "
+                 f"those (delete the host-key file to auto-generate all types)",
+                 level=logging.WARNING)
+    order = [a for a in wanted if a in keys_by_algo]
+    # return (keys_to_expose, advertised_algs)
+    if not order: return host_keys, None
+    return ([keys_by_algo[a] for a in order],
+            [alg for a in order for alg in ADVERTISED_HOSTKEY_ALGS[a]])
+
+
+def apply_mimic_patches(mimic, host_key_algs=None):
+    # Monkey-patch asyncssh internals so the cleartext/pre-auth transport matches the mimicked server
+    from asyncssh.connection import SSHConnection, SSHServerConnection
+    from asyncssh.constants import MSG_IGNORE
+
+    def wrap(cls, name, fn):
+        orig = getattr(cls, name, None)
+        if orig is None:
+            raise RuntimeError(
+                f"Cannot apply --mimic {mimic}: asyncssh internal '{name}' changed. "
+                f"Refusing to run a fingerprintable disguise (use '--mimic none' to bypass)")
+        setattr(cls, name, functools.partialmethod(fn, orig))
+
+    def kex(self, orig):
+        # 1. Modify KEXINIT to match mimicked server
+        algs = [a for a in orig(self) if a != b"ext-info-s"]
+        if self.is_server() and mimic == "dropbear":
+            algs = [b"kexguess2@matt.ucc.asn.au"] + algs
+        return algs
+    wrap(SSHConnection, "_get_extra_kex_algs", kex)
+
+    def ext_info(self, orig):
+        # 2. Strip asyncssh 'global-requests-ok' from EXT_INFO
+        self._extensions_to_send.pop(b"global-requests-ok", None)
+        return orig(self)
+    wrap(SSHConnection, "_send_ext_info", ext_info)
+
+    def send_packet(self, orig, pkttype, *a, **kw):
+        # 3. Suppress asyncssh's SSH_MSG_IGNORE traffic-analysis chaff (added with
+        #   OpenSSH 9.5). Safe to drop all because asyncssh only sends MSG_IGNORE
+        #   as this chaff using self.send_packet() before each real packet
+        if pkttype != MSG_IGNORE:
+            return orig(self, pkttype, *a, **kw)
+    wrap(SSHConnection, "send_packet", send_packet)
+
+    if host_key_algs is not None:
+        # 4. Pin the advertised server host-key algorithms
+        algs = list(host_key_algs)
+        def init(self, orig, *a, **kw):
+            orig(self, *a, **kw)
+            self._server_host_key_algs = [x for x in algs if x in self._server_host_keys]
+        wrap(SSHServerConnection, "__init__", init)
+
+# ── Startup and arguments ─────────────────────────────────────────────
+
 _description="""\
 sshcatch - a quick-deploy SSH server for tunneling (local/remote/dynamic)
-and simple SCP transfers (NEVER opens a shell!).
+and simple SCP/SFTP transfers (NEVER opens a shell!)
 By default all features are disabled. Use flags to enable features.
 """
 
@@ -682,12 +808,11 @@ examples: (also check README on Github)
   %(prog)s --open-auth --forward             Allow ANYONE! to tunnel through this SSH server
   # My favorite one
   #   Allows reverse tunnels and uploads via SCP for the keys in ./authorized_keys
-  #   while posing shallowly as an Ubuntu SSH server on port 2222
-  %(prog)s --reverse --authorized-keys ./authorized-keys --scp-upload --version-banner ubuntu -p 2222
+  %(prog)s --reverse --authorized-keys ./authorized_keys --scp-upload -p 2222
 """
 
 def build_parser(full=False):
-    # Help got to long so splitting it into '-h' and '--help'
+    # Help got too long so splitting it into '-h' and '--help'
     def help_text(short_help=None, long_help=""):
         if full: return (f"{short_help} " if short_help else "") + long_help
         else: return short_help if short_help else argparse.SUPPRESS
@@ -709,8 +834,16 @@ def build_parser(full=False):
     parser.add_argument("-1", "--single", action="store_true",
                         help=help_text(short_help="close the listener after first successful auth",
                                        long_help="(and exit when that connection ends)"))
+    parser.add_argument("--mimic", metavar="PRESET", type=str.lower,
+                         choices=list(MIMIC_PRESETS), default="none",
+                         help=help_text(long_help="pose as another SSH server "
+                                        f"- presets (case-insensitive): {', '.join(list(MIMIC_PRESETS))} "
+                                        "- match the preset's pre-auth (banner, KEXINIT, server-sig-algs, ...) "
+                                        "exactly - banner can be overridden by --version-banner "
+                                        "- check Github repository for details"))
     parser.add_argument("--host-key", metavar="FILE", type=Path,
-                        help=help_text(long_help="server host key file (default: auto-generate)"))
+                        help=help_text(long_help="server host key file, may hold several keys "
+                                       "- auto-generated if missing - uses ./sshcatch_host_key by default"))
     parser.add_argument("--version", action="version",
                         version=f"%(prog)s {__version__}", 
                         help=help_text(long_help="show program's version number and exit"))
@@ -742,9 +875,7 @@ def build_parser(full=False):
 
     banners = parser.add_argument_group("banners")
     banners.add_argument("--version-banner", metavar="STRING",
-                         help=help_text(long_help="sent as 'SSH-2.0-STRING' version banner - "
-                             "only first-glance deception, it can still be identified as asyncssh - "
-                             f"presets (case-insensitive): {', '.join(VERSION_PRESETS)}"))
+                         help=help_text(long_help="manually set 'SSH-2.0-STRING' version banner"))
     banners.add_argument("--pre-auth-banner", metavar="STRING",
                          help=help_text(long_help="banner shown to every client before login"))
     banners.add_argument("--post-auth-banner", metavar="STRING",
@@ -781,10 +912,9 @@ def main():
     configure_logging(output=args.output, timestamps=args.timestamps,
                       plain=args.plain, console_level=console_level)
 
-    # Handle version-banner presets
-    if args.version_banner:
-        args.version_banner = VERSION_PRESETS.get(
-            args.version_banner.lower(), args.version_banner)
+    # Handle --mimic version-banner
+    if args.mimic != "none" and not args.version_banner:
+        args.version_banner = MIMIC_PRESETS[args.mimic][0]
 
     # Validate user format
     if args.user:
@@ -803,10 +933,10 @@ def main():
         parser.error(f"Authorized-keys file not found: {args.authorized_keys}")
 
     try: asyncio.run(start_server(args))
-    except PermissionError:
-        parser.error(f"Permission denied - port {args.port} requires root")
-    except OSError as e:
+    except (OSError, ValueError) as e:
         parser.error(f"Could not start server: {e}")
+    except RuntimeError as e:
+        parser.error(str(e))
     except KeyboardInterrupt:
         print()