I am trying to harden a webserver that has OpenSSH running.

Is there any benefit to spoofing the version string that is reported when running, say, nmap against the host?

If so, how do I do that? I am running Debian stable, so I would prefer to use apt-get to keep updated without needing to configure/make/make install with every security update.

I haven't had much luck with the man-pages or Google.

Thanks for any suggestions.
Steve

I'd have to say that crackers pay absolutely no attention to the information being returned to them. It looks to me like they always just take a rip at the IP address just to see if it breaks. If it does, then they pay attention, but if it doesn't, its on to the next IP address. The reason I say that is that I haven't hidden the fact that I have an Apache server running on Linux, yet my logs are filled with attempts to crack into IIS. I also keep a openSSH very well patched, yet every day at least one person has a go at it, even though they should be able to see I'm running an SSH version that doesn't have any known exploits.

Personally, I think your time and effort would be better spent on other security aspects. Sending bad information back just doesn't strike me as having any deterrent value.

Yes, I have seen that too.

That is true, I was just wondering if there was an easy way to add another layer. The less information given out the better. I must say, I might have phrased my initial question poorly. What I was hoping to do, was simply return, say, "SSH" in the string, rather than all the version details. If that was an easy fix, it might add a little more security.

Thanks for the comments.
Steve