umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/core/external/checks/exposed_datastores.py

@@ -0,0 +1,55 @@
+"""External check: data stores reachable from the internet.
+
+A database/cache directly exposed to the public internet is one of the highest-
+signal outside-in findings — it routinely leads to data theft or ransom. We only
+test whether the port answers; we never authenticate or read data.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Common data-store ports that should never be open to the internet.
+_DATASTORES = {
+    6379: "Redis",
+    5432: "PostgreSQL",
+    3306: "MySQL/MariaDB",
+    27017: "MongoDB",
+    9200: "Elasticsearch",
+    11211: "Memcached",
+    9000: "ClickHouse",
+    5984: "CouchDB",
+}
+
+
+class ExposedDataStoresCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    id = "external_exposed_datastores"
+    title = "Data stores not exposed to the internet"
+    category = "external_network"
+    severity = Severity.CRITICAL
+    weight = 25
+    remediation = (
+        "Bind data stores to localhost or a private network and block their "
+        "ports at the host/edge firewall. Never expose Redis, PostgreSQL, MySQL, "
+        "MongoDB, Elasticsearch, or Memcached directly to the internet; put them "
+        "behind your application, a VPN, or an SSH tunnel."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        exposed: list[tuple[int, str]] = []
+        for port, name in _DATASTORES.items():
+            try:
+                if probe.tcp_connect(port):
+                    exposed.append((port, name))
+            except Exception:
+                continue  # a probe error for one port shouldn't sink the check
+        if exposed:
+            listing = ", ".join(f"{name} ({port})" for port, name in sorted(exposed))
+            return self._finding(
+                Verdict.FAIL, evidence=f"reachable from the internet: {listing}"
+            )
+        return self._finding(
+            Verdict.PASS, evidence="no common data-store ports reachable from the internet"
+        )

umbermark/core/external/checks/http_security_headers.py

@@ -0,0 +1,249 @@
+"""External check: HTTP security response headers.
+
+A single unauthenticated request to the site's HTTPS endpoint. Missing hardening
+headers don't breach anything on their own — they remove defenses against
+downgrade, clickjacking, and MIME-sniffing — so this is advisory (WARN, medium).
+
+A header that is present but set to a useless value (HSTS max-age=0, a CSP that
+allows any script, a bogus X-Frame-Options) gives no protection, so it is
+reported the same way as a missing one.
+"""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Header -> what it defends against, in report-friendly order.
+_EXPECTED = {
+    "strict-transport-security": "forces HTTPS (HSTS)",
+    "content-security-policy": "limits script/content sources (CSP)",
+    "x-frame-options": "blocks clickjacking",
+    "x-content-type-options": "stops MIME-sniffing",
+}
+
+# HSTS shorter than 6 months (Mozilla Observatory's floor, 15768000 s) is only a
+# note, not a WARN: Umbermark's own fix starts at max-age=300 on purpose, so a
+# mistake fixes itself, and tells the user to raise it once the site is stable.
+_MIN_HSTS_MAX_AGE = 15768000
+# Anchored to a directive start so "xmax-age=..." is not read as max-age.
+_MAX_AGE_RE = re.compile(r"(?:^|;)\s*max-age\s*=\s*\"?(\d+)\"?(?=\s*(?:;|,|$))",
+    re.IGNORECASE,
+)
+# Host-source with a bare "*" host: "*", "https://*", "http://*:443", "*:443".
+# Also a wildcard TLD ("https://*.com"): "*." plus a single label allows a whole TLD.
+_ANY_HOST_RE = re.compile(
+    r"^(?:[a-z][a-z0-9+.-]*:)?(?://)?\*(?:\.[a-z0-9-]+)?(?::|/|$)"
+)
+_ANY_SCHEME = {"http:", "https:", "data:", "blob:", "filesystem:"}
+_INTEGRITY_RE = re.compile(r"'(?:nonce|sha256|sha384|sha512)-[A-Za-z0-9+/_=-]+'")
+_XFO_OK = {"deny", "sameorigin"}
+
+
+def _first_header(value: str) -> str:
+    """First of several repeated headers (joined with ',').
+
+    RFC 6797 s8.1: a UA processes only the first Strict-Transport-Security
+    header and ignores the rest, so only that one is judged.
+    """
+    return value.split(",")[0]
+
+
+def _weak_hsts(value: str) -> str | None:
+    found = _MAX_AGE_RE.findall(_first_header(value))
+    if not found:
+        return "no valid max-age"
+    if len(found) > 1:
+        # RFC 6797 s6.1: each directive once; browsers ignore a non-conforming header.
+        return "max-age is repeated, so browsers ignore the header"
+    if int(found[0]) == 0:
+        return "max-age=0 switches HSTS off"
+    return None
+
+
+def _hsts_note(value: str) -> str | None:
+    """Advisory (not WARN) note for a sound but short HSTS max-age."""
+    found = _MAX_AGE_RE.findall(_first_header(value))
+    if len(found) == 1 and 0 < int(found[0]) < _MIN_HSTS_MAX_AGE:
+        return (f"note: Strict-Transport-Security max-age={int(found[0])} is short; "
+                "raise to >=6 months (15768000) when stable")
+    return None
+
+
+_UNRESOLVED = "no script-src/default-src"
+
+
+def _csp_policy(policy: str) -> tuple[bool, str | None]:
+    """Judge one CSP policy. Returns (has_script_policy, weakness)."""
+    directives: dict[str, list[str]] = {}
+    for part in policy.split(";"):
+        tokens = part.strip().split()
+        if tokens:
+            # First occurrence of a directive wins, per the CSP spec.
+            directives.setdefault(tokens[0].lower(), [t.lower() for t in tokens[1:]])
+    # CSP3 fallback chains differ per use, so judge each separately:
+    #   <script> elements : script-src-elem -> script-src -> default-src
+    #   inline handlers   : script-src-attr -> script-src -> default-src
+    #   eval()/string code: script-src -> default-src (never the -elem/-attr forms)
+    def pick(*names: str) -> list[str] | None:
+        for n in names:
+            if n in directives:
+                return directives[n]
+        return None
+
+    elem = pick("script-src-elem", "script-src", "default-src")
+    attr = pick("script-src-attr", "script-src", "default-src")
+    ev = pick("script-src", "default-src")
+    if elem is None and attr is None and ev is None:
+        # No script policy to judge (e.g. frame-ancestors only); _weak_csp decides.
+        return False, None
+    # Explicit weaknesses first: they count even when another chain is unresolved.
+    if ev is not None and "'unsafe-eval'" in ev:
+        return True, "script sources allow 'unsafe-eval'"
+    # CSP3: with 'strict-dynamic', browsers ignore host/scheme sources and
+    # 'unsafe-inline' (kept only as a fallback for old browsers). This is the
+    # recommended strict policy, so it is exempt, per list.
+    def inline_ok(sources: list[str]) -> bool:
+        # A nonce or hash makes browsers ignore 'unsafe-inline'.
+        # (a valid, non-empty base64 value is required; browsers drop invalid ones).
+        hardened = any(_INTEGRITY_RE.fullmatch(t) for t in sources)
+        return "'unsafe-inline'" not in sources or hardened
+
+    if elem is not None and "'strict-dynamic'" not in elem:
+        if any(t in _ANY_SCHEME or _ANY_HOST_RE.match(t) for t in elem):
+            return True, "script sources allow any origin (wildcard or bare scheme)"
+        if not inline_ok(elem):
+            return True, "script sources allow 'unsafe-inline'"
+    # Origins are meaningless for inline handlers; only 'unsafe-inline' matters.
+    if attr is not None and "'strict-dynamic'" not in attr and not inline_ok(attr):
+        return True, "script sources allow 'unsafe-inline' (inline event handlers)"
+    # A chain that resolves to nothing means that use has no restriction at all.
+    if elem is None:
+        return True, _UNRESOLVED + ": <script> elements are unrestricted"
+    if attr is None:
+        return True, _UNRESOLVED + ": inline event handlers are unrestricted"
+    if ev is None:
+        return True, _UNRESOLVED + ": eval() is unrestricted"
+    return True, None
+
+
+def _frame_ancestors(policy: str) -> list[str] | None:
+    """Sources of the first frame-ancestors directive in one policy, if any."""
+    for part in policy.split(";"):
+        toks = part.strip().lower().split()
+        if toks and toks[0] == "frame-ancestors":
+            return toks[1:]
+    return None
+
+
+def _weak_csp(value: str) -> str | None:
+    """Flag a CSP whose script controls let any / inline script run, or whose
+    frame-ancestors lets any site frame the page.
+
+    Several policies (repeated headers, folded with ',') are enforced together,
+    so the result is as strong as the strongest of them, in any order.
+    """
+    policies = value.split(",")
+    # Browsers enforce every policy: framing is allowed only if all of them allow
+    # it, so one restrictive frame-ancestors is enough (order does not matter).
+    fa = [f for f in (_frame_ancestors(p) for p in policies) if f is not None]
+    fa_restricts = any(
+        not any(t in _ANY_SCHEME or _ANY_HOST_RE.match(t) for t in srcs) for srcs in fa
+    )
+    if fa and not fa_restricts:
+        return "frame-ancestors allows any site to frame the page"
+
+    reasons: list[str] = []
+    for policy in policies:
+        judged, reason = _csp_policy(policy)
+        if judged and reason is None:
+            return None
+        if reason:
+            reasons.append(reason)
+    definite = [r for r in reasons if not r.startswith(_UNRESOLVED)]
+    if definite:
+        return definite[0]
+    if fa_restricts:
+        # A restrictive frame-ancestors is the deliberately conservative baseline
+        # Umbermark's own fix ships. It stays accepted when the policy only adds
+        # partial script directives: those leave nothing weaker than the baseline.
+        return None
+    if reasons:
+        return reasons[0]
+    return "no script-src, default-src or frame-ancestors: the policy restricts nothing"
+
+
+def _tokens(value: str) -> set[str]:
+    """Distinct lowercased comma-separated tokens (proxy + app may both set it)."""
+    return {t.strip().lower() for t in value.split(",") if t.strip()}
+
+
+def _weak_xfo(value: str) -> str | None:
+    toks = _tokens(value)
+    # Browsers accept a repeated identical value; conflicting/bad ones are weak.
+    if len(toks) != 1 or not toks <= _XFO_OK:
+        return f"value {value.strip()!r} is not DENY or SAMEORIGIN"
+    return None
+
+
+def _weak_xcto(value: str) -> str | None:
+    if _tokens(value) != {"nosniff"}:
+        return f"value {value.strip()!r} is not nosniff"
+    return None
+
+
+_VALUE_CHECKS = {
+    "strict-transport-security": _weak_hsts,
+    "content-security-policy": _weak_csp,
+    "x-frame-options": _weak_xfo,
+    "x-content-type-options": _weak_xcto,
+}
+
+
+class HttpSecurityHeadersCheck(ExternalCheck):
+    id = "external_http_security_headers"
+    title = "HTTP responses set the core security headers"
+    category = "external_web"
+    severity = Severity.MEDIUM
+    weight = 6
+    remediation = (
+        "Set the standard hardening headers on HTTPS responses: "
+        "Strict-Transport-Security (HSTS, max-age of at least 6 months), Content-Security-Policy, "
+        "X-Frame-Options (or CSP frame-ancestors), and X-Content-Type-Options: "
+        "nosniff. Add them at the web server or reverse proxy."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        headers = probe.http_headers(443, tls=True)
+        if headers is None:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="no HTTPS service answered on port 443",
+            )
+
+        lowered = {k.lower(): str(v) for k, v in headers.items()}
+        missing = [name for name in _EXPECTED if name not in lowered]
+        weak = [
+            f"{name} ({reason})"
+            for name, judge in _VALUE_CHECKS.items()
+            if name in lowered and (reason := judge(lowered[name]))
+        ]
+        if missing or weak:
+            parts = []
+            if missing:
+                listing = ", ".join(f"{n} ({_EXPECTED[n]})" for n in missing)
+                parts.append(f"missing security headers: {listing}")
+            if weak:
+                parts.append("weak header values: " + "; ".join(weak))
+            hsts = lowered.get("strict-transport-security")
+            note = _hsts_note(hsts) if hsts is not None else None
+            if note:
+                parts.append(note)
+            return self._finding(Verdict.WARN, evidence=" | ".join(parts))
+        evidence = "all core security headers present with sound values"
+        note = _hsts_note(lowered["strict-transport-security"])
+        if note:
+            evidence += f" ({note})"
+        return self._finding(Verdict.PASS, evidence=evidence)

umbermark/core/external/checks/legacy_services.py

@@ -0,0 +1,52 @@
+"""External check: legacy plaintext services exposed to the internet.
+
+Telnet, FTP, and the BSD r-services transmit credentials and data in the clear
+and have no place facing the public internet. We only test whether the port
+answers; we never authenticate.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Plaintext / legacy services that should never be internet-facing.
+_LEGACY = {
+    23: "Telnet",
+    21: "FTP",
+    69: "TFTP",
+    512: "rexec",
+    513: "rlogin",
+    514: "rsh",
+}
+
+
+class LegacyPlaintextServicesCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    id = "external_legacy_plaintext_services"
+    title = "No legacy plaintext services exposed (telnet, FTP, r-services)"
+    category = "external_network"
+    severity = Severity.HIGH
+    weight = 12
+    remediation = (
+        "Disable telnet, FTP, and the BSD r-services on the public interface. "
+        "Use SSH/SFTP instead, and block ports 21/23/69/512-514 at the firewall. "
+        "These protocols send credentials and data in cleartext."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        exposed: list[tuple[int, str]] = []
+        for port, name in _LEGACY.items():
+            try:
+                if probe.tcp_connect(port):
+                    exposed.append((port, name))
+            except Exception:
+                continue
+        if exposed:
+            listing = ", ".join(f"{name} ({port})" for port, name in sorted(exposed))
+            return self._finding(
+                Verdict.FAIL, evidence=f"plaintext service reachable: {listing}"
+            )
+        return self._finding(
+            Verdict.PASS, evidence="no legacy plaintext services reachable"
+        )

umbermark/core/external/checks/open_management_ports.py

@@ -0,0 +1,65 @@
+"""External check: remote-management interfaces exposed to the internet.
+
+The attack-surface inventory. Remote desktop, container/orchestrator control
+planes, and cluster databases should sit behind a VPN or firewall — not answer
+the public internet. Unlike the data-store (critical) and plaintext-legacy (high)
+checks, an open management port is expanded surface rather than a guaranteed
+breach, so this is advisory (WARN). We only test whether the port answers; we
+never authenticate.
+
+SSH (22) and the conventional web ports (80/443) are the expected baseline and
+are deliberately NOT flagged — open SSH is normal, and SSH crypto hygiene is
+covered separately.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Remote-management / control-plane ports that should not face the public
+# internet. Kept distinct from data stores (port-disjoint) and plaintext legacy.
+_MGMT = {
+    3389: "RDP",
+    5900: "VNC",
+    5901: "VNC",
+    2375: "Docker API (plaintext)",
+    2376: "Docker API (TLS)",
+    6443: "Kubernetes API",
+    10250: "Kubelet API",
+    2379: "etcd",
+}
+
+
+class OpenManagementPortsCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    id = "external_open_management_ports"
+    title = "Remote-management interfaces not exposed to the internet"
+    category = "external_network"
+    severity = Severity.MEDIUM
+    weight = 6
+    remediation = (
+        "Restrict remote-management interfaces (RDP, VNC, the Docker/Kubernetes "
+        "control plane, etcd) to a VPN or a trusted IP allow-list at the firewall. "
+        "These should never be reachable from the open internet — expose only the "
+        "ports your service actually needs (typically 80/443, plus SSH)."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        exposed: list[tuple[int, str]] = []
+        for port, name in _MGMT.items():
+            try:
+                if probe.tcp_connect(port):
+                    exposed.append((port, name))
+            except Exception:
+                continue  # one port's probe error shouldn't sink the check
+        if exposed:
+            listing = ", ".join(f"{name} ({port})" for port, name in sorted(exposed))
+            return self._finding(
+                Verdict.WARN,
+                evidence=f"management interface reachable from the internet: {listing}",
+            )
+        return self._finding(
+            Verdict.PASS,
+            evidence="no remote-management ports reachable from the internet",
+        )

umbermark/core/external/checks/ssh_alt_ports.py

@@ -0,0 +1,77 @@
+"""External check: weak SSH algorithms on alternate SSH ports (UMBR-38).
+
+``external_ssh_weak_algorithms`` only reads port 22. An external scanner has no
+shell on the host, so it cannot read sshd's ``Port`` directives or an
+``ssh.socket`` override. Instead this ACTIVE check probes a short list of the
+ports administrators commonly move SSH to and runs the same weak-algorithm
+evaluation on every one that answers with an SSH banner. The finding names the
+port. Port probing is gated behind verified ownership (UMBR-26): for an
+unverified target the engine skips this check with an explanatory reason.
+
+The on-box ``ssh_weak_ciphers`` check (``sshd -T``) already covers every
+configured port; this is the outside-in complement for hosts scanned without
+credentials.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.checks.ssh_weak_algorithms import find_weak_algorithms
+from umbermark.core.external.engine import ALT_SSH_UNVERIFIED_SKIP_REASON
+from umbermark.core.external.probe import ExternalProbe
+
+# Common non-default SSH ports (22 itself is covered by the passive check).
+_ALT_SSH_PORTS = (2222, 22222, 2022, 822, 2200, 22022, 2322)
+
+
+class SshAltPortsCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    unverified_skip_reason = ALT_SSH_UNVERIFIED_SKIP_REASON
+    id = "external_ssh_alt_ports"
+    title = "SSH on alternate ports offers no weak or deprecated algorithms"
+    category = "external_network"
+    severity = Severity.HIGH
+    weight = 12
+    remediation = (
+        "Apply the same algorithm restrictions to every SSH port. KexAlgorithms, Ciphers, MACs "
+        "and HostKeyAlgorithms in sshd_config apply to all ports sshd listens on: pin them to a "
+        "modern list (e.g. curve25519-sha256, chacha20-poly1305@openssh.com / aes256-gcm, "
+        "hmac-sha2-512-etm, ssh-ed25519 / rsa-sha2-512). If an extra SSH port is not needed, "
+        "remove its Port line (and any ssh.socket override) and close it at the firewall."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        found: list[int] = []  # ports that answered with an SSH banner
+        weak_by_port: dict[int, list[tuple[str, str]]] = {}
+        for port in _ALT_SSH_PORTS:
+            try:
+                algos = probe.ssh_algorithms(port)
+            except Exception:
+                continue  # one port's probe error shouldn't sink the check
+            if algos is None:
+                continue
+            found.append(port)
+            weak = find_weak_algorithms(algos)
+            if weak:
+                weak_by_port[port] = weak
+        if weak_by_port:
+            parts = [
+                f"port {port}: " + ", ".join(f"{n} ({cat})" for cat, n in weak)
+                for port, weak in sorted(weak_by_port.items())
+            ]
+            return self._finding(
+                Verdict.FAIL,
+                evidence="weak/deprecated SSH algorithms offered on alternate ports: "
+                + "; ".join(parts),
+            )
+        if found:
+            ports = ", ".join(str(p) for p in sorted(found))
+            return self._finding(
+                Verdict.PASS,
+                evidence=f"SSH on alternate port(s) {ports} offers only modern algorithms",
+            )
+        tried = ", ".join(str(p) for p in _ALT_SSH_PORTS)
+        return self._finding(
+            Verdict.PASS,
+            evidence=f"no SSH service answered on the alternate ports checked ({tried})",
+        )

umbermark/core/external/checks/ssh_weak_algorithms.py

@@ -0,0 +1,93 @@
+"""External check: weak/deprecated algorithms offered in the SSH handshake.
+
+Read entirely from the pre-auth KEXINIT — the public list of algorithms the
+server is willing to negotiate, the same thing ``nmap --script ssh2-enum-algos``
+sees. No login, no credentials. Offering a broken algorithm (SHA-1 key
+exchange, CBC ciphers, MD5/SHA-1 MACs, DSA/ssh-rsa host keys) leaves the
+connection open to downgrade even when stronger options are also advertised.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe, SshAlgorithms
+
+
+def _weak_kex(name: str) -> bool:
+    # SHA-1 key exchange (incl. the 1024-bit group1) is deprecated.
+    return "sha1" in name.lower()
+
+
+def _weak_cipher(name: str) -> bool:
+    n = name.lower()
+    return (
+        n.endswith("-cbc")
+        or n.startswith(("3des", "arcfour", "blowfish", "cast128"))
+        or "rc4" in n
+        or n == "none"
+    )
+
+
+def _weak_mac(name: str) -> bool:
+    n = name.lower()
+    return "md5" in n or "sha1" in n or n.startswith("umac-64") or n == "none"
+
+
+def _weak_host_key(name: str) -> bool:
+    # ssh-dss (DSA) is broken; ssh-rsa is the SHA-1 RSA signature OpenSSH
+    # disabled by default in 8.8. rsa-sha2-256/512 are the modern replacements.
+    return name.lower() in {"ssh-dss", "ssh-rsa"}
+
+
+def find_weak_algorithms(algos: SshAlgorithms) -> list[tuple[str, str]]:
+    """Every (category, name) pair in a KEXINIT offer that is weak/deprecated.
+
+    Shared by the port-22 check and the alternate-port check (UMBR-38) so both
+    apply exactly the same definition of "weak".
+    """
+    weak: list[tuple[str, str]] = []
+    weak += [("KEX", n) for n in algos.kex if _weak_kex(n)]
+    weak += [("cipher", n) for n in algos.ciphers if _weak_cipher(n)]
+    weak += [("MAC", n) for n in algos.macs if _weak_mac(n)]
+    weak += [("host-key", n) for n in algos.host_keys if _weak_host_key(n)]
+    return weak
+
+
+class SshWeakAlgorithmsCheck(ExternalCheck):
+    id = "external_ssh_weak_algorithms"
+    title = "SSH offers no weak or deprecated algorithms"
+    category = "external_network"
+    severity = Severity.HIGH
+    weight = 12
+    remediation = (
+        "Pin sshd to modern algorithms only. In sshd_config set KexAlgorithms, "
+        "Ciphers, MACs, and HostKeyAlgorithms to a curated modern list "
+        "(e.g. curve25519-sha256, chacha20-poly1305@openssh.com / aes256-gcm, "
+        "hmac-sha2-512-etm, ssh-ed25519 / rsa-sha2-512). Remove SHA-1 key "
+        "exchange, CBC ciphers, MD5/SHA-1 MACs, and the ssh-dss/ssh-rsa host keys."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        algos = probe.ssh_algorithms(22)
+        if algos is None:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason=(
+                    "SSH KEXINIT not readable on port 22 "
+                    "(host unreachable, filtered, or SSH on a non-standard port)"
+                ),
+            )
+        weak = find_weak_algorithms(algos)
+        if weak:
+            listing = ", ".join(f"{n} ({cat})" for cat, n in weak)
+            return self._finding(
+                Verdict.FAIL,
+                evidence=f"weak/deprecated SSH algorithms offered: {listing}",
+            )
+        return self._finding(
+            Verdict.PASS,
+            evidence=(
+                "SSH offers only modern algorithms (no SHA-1 key exchange, CBC "
+                "ciphers, MD5/SHA-1 MACs, or DSA/ssh-rsa host keys)"
+            ),
+        )