[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: SSH (Secure Shell) FAQ
From: Thomas =?ISO-8859-1?Q?K=F6nig?=
Date: 1995-12-10 20:54:34
[Download RAW message or body]
FYI.
Please regard this as an announcement; there won't be any repostings
of that particular FAQ on bugtraq (at least not by me :-)
Newsgroups: comp.security.unix,comp.security.misc
Subject: SSH (Secure Shell) FAQ - Frequently Asked Questions
Archive-name: computer-security/ssh-faq
Url: http://www.uni-karlsruhe.de/~ig25/ssh-faq/
Posting-frequency: every 14 days
-----BEGIN PGP SIGNED MESSAGE-----
Ssh (Secure Shell) FAQ - Frequently asked questions
by Thomas Koenig, Thomas.Koenig@ciw.uni-karlsruhe.de
$Id: ssh-faq.sgml,v 1.16 1995/12/07 10:54:21 ig25 Exp $
This document is a list of Frequently Asked Questions (plus hopefully
correct answers) about the Secure Shell, ssh.
1. Meta-questions
1.1. Where do I get this document?
1.2. Where do I send questions, corrections etc. about this document?
2. Ssh basics
2.1. What is ssh?
2.2. Why should I use it?
2.3. What kinds of attacks does ssh protect against?
2.4. What kind of attacks does ssh not protect against?
2.5. How does it work?
3. Obtaining and installing ssh
3.1. What is the latest version of ssh?
3.2. What systems does ssh run on?
3.3. May I legally run ssh?
3.4. Where can I obtain ssh?
3.5. How do I install it?
3.6. Where do I get help?
3.7. Are there any versions for other operating systems than UNIX?
4. Ssh Applications
4.1. Can I run backups over ssh?
4.2. Should I turn encryption off, for performance reasons?
4.3. Can I use ssh to communicate across a firewall?
4.4. Can I distribute files with ssh, as with rdist?
4.5. Can I use ssh to securely connect two subnets across the
Internet?
4.6. Can I use ssh to securely forward UDP-based services, such as NFS
or NIS?
4.7. Can I forward SGI OpenGL connections over ssh?
5. Problems
5.1. ssh otherhost xclient & does not work!
5.2. Ssh fails with "Resource temporarily unavailable" for Solaris 2.4
5.3. X11 forwarding does not work for an SCO binary with the iBCS2
emulator under Linux.
5.4. Ssh is doing wrong things for multi-homed hosts!
5.5. Userid swapping is broken under AIX!
5.6. ssh-keygen dumps core on Alpha OSF!
5.7. ssh-keygen dumps core on Solaris or SunOS
5.8. On Linux, compilation aborts with some error message about
libc.so.4
5.9. X authorization fails for HP-UX 9.05
6. Miscellaneous
6.1. Credits
1. Meta-questions
1.1. Where do I get this document?
The latest version of this document is available from http://www.uni-
karlsruhe.de/~ig25/ssh-faq/. It will also be posted, on a regular
basis, to the Usenet newsgroups comp.security.misc,
comp.security.unix, comp.answers and news.answers.
The original SGML file is at http://www.uni-karlsruhe.de/~ig25/ssh-
faq/ssh-faq.sgml.
Also of interest is the ssh home page, at http://www.cs.hut.fi/ssh/.
1.2. Where do I send questions, corrections etc. about this document?
Please send them to the maintainer, Thomas.Koenig@ciw.uni-karlsruhe.de
2. Ssh basics
2.1. What is ssh?
To quote the README file:
Ssh (Secure Shell) is a program to log into another computer over a
network, to execute commands in a remote machine, and to move files
from one machine to another. It provides strong authentication and
secure communications over insecure channels. It is intended as a
replacement for rlogin, rsh, and rcp.
2.2. Why should I use it?
The traditional BSD 'r' - commmands (rsh, rlogin, rcp) are vulnerable
to different kinds of attacks. Somebody who has root access to
machines on the network, or physical access to the wire, can gain
unauthorized access to systems in a variety of ways. It is also
possible for such a person to log all the traffic to and from your
system, including passwords (which ssh never sends in the clear).
The X window system also has a number of severe vulnerabilities. With
ssh, you can create secure remote X sessions which are transparent to
the user. As a side effect, using remote X clients with ssh is more
convenient for users.
Users can continue to use old .rhosts and /etc/hosts.equiv files;
changing over to ssh is mostly transparent for them. If a remote site
does not support ssh, a fallback mechanism to rsh is included.
2.3. What kinds of attacks does ssh protect against?
Ssh protects against:
o IP spoofing, where a remote host sends out packets which pretend to
come from another, trusted host. Ssh even protects against a
spoofer on the local network, who can pretend he is your router to
the outside.
o IP source routing, where a host can pretend that an IP packet comes
from another, trusted host.
o DNS spoofing, where an attacker forges name server records
o Interception of cleartext passwords and other data by intermediate
hosts.
o Manipulation of data by people in control of intermediate hosts
o Attacks based on listening to X authentication data and spoofed
connection to the X11 server.
In other words, ssh never trusts the net; somebody hostile who has
taken over the network can only force ssh to disconnect, but cannot
decrypted or play back the traffic, or hijack the connection.
The above only holds if you actually use encryption. Ssh does have an
option to use encryption of type "none" this is only for debugging
purposes, and should not be used.
2.4. What kind of attacks does ssh not protect against?
Ssh will not help you with anything that compromises your host's
security in some other way. Once an attacker has gained root access to
a machine, he can then subvert ssh, too.
If somebody malevolent has access to your home directory, then
security is nonexistent. This is very much the case if your home
directory is exported via NFS.
2.5. How does it work?
For more extensive information, please refer to the README and RFC
files in the ssh directory. The proposed RFC is also available as an
Internet Draft, as draft-ylonen-ssh-protocol-00.txt.
All communications are encrypted using IDEA or one of several other
ciphers (three-key triple-DES, DES, RC4-128, TSS). Encryption keys are
exchanged using RSA, and data used in the key exchange is destroyed
every hour (keys are not saved anywhere). Every host has an RSA key
which is used to authenticate the host. Encryption is used to protect
against IP-spoofing; public key authentication is used to protect
against DNS and routing spoofing.
The RSA keys are also used to authenticate hosts.
3. Obtaining and installing ssh
3.1. What is the latest version of ssh?
The latest officially released version is 1.2.0. The latest
development version is 1.2.12.
3.2. What systems does ssh run on?
Ssh currently runs on UNIX or related system. Ports have been
successful to all "mainstream" systems.
At present, there are no known working versions for other operating
systems (but see below).
3.3. May I legally run ssh?
Ssh is free software, and can be freely used by anyone for any
purpose.
However, in some countries, particularly France, Russia, Iraq, and
Pakistan, it may be illegal to use any encryption at all without a
special permit.
If you are in the United States, you should be aware that, while ssh
was written outside the United States using information publicly
available everywhere, the US Government may consider it a criminal
offence to export this software from the US once it has been imported,
including putting it on a ftp site. Contact the Office of Defence
Trade Controls if you need more information.
The algorithms RSA and IDEA, which are used by ssh, are claimed as
patented in different countries, including the US. Linking against the
RSAREF2 library, which is possible, may or may not make it legal to
use ssh for non-commercial purposes in the US. You may need to obtain
licenses for commercial use of IDEA; ssh can be configured to work
without it. Ssh works perfectly fine without IDEA, however.
For more detail, refer to the file COPYING in the ssh source
distribution.
For information on software patents in general, see the Leauge for
Programming Freedom's homepage at http://lpf.org/.
3.4. Where can I obtain ssh?
The central site for distributing ssh is ftp://ftp.cs.hut.fi/pub/ssh/.
Official releases are PGP-signed, with the key ID
DCB9AE01 1995/04/24 Ssh distribution key <ylo@cs.hut.fi>
Key fingerprint = C8 90 C8 5A 08 F0 F5 FD 61 AF E6 FF CF D4 29 D9
The latest development version is available from
ftp://ftp.cs.hut.fi/pub/ssh/snapshots/.
Ssh is also available via anonymous ftp from the following sites:
Australia:
ftp://coombs.anu.edu.au/pub/security/tools
Finland:
ftp://ftp.funet.fi/pub/unix/security/login/ssh
Germany:
ftp://ftp.cert.dfn.de/pub/tools/net/ssh
Hungary:
ftp://ftp.kfki.hu/pub/packages/security/ssh
Ireland:
ftp://odyssey.ucc.ie/pub/ssh
Poland:
ftp://ftp.agh.edu.pl/pub/security/ssh
Portugal:
ftp://ftp.ci.uminho.pt/pub/security/ssh
Russia:
ftp://ftp.kiae.su/unix/crypto
Slovenia:
ftp://ftp.arnes.si/security/ssh
United Kingdom:
ftp://ftp.exweb.com/pub/security/ssh
United States:
ftp://ftp.net.ohio-state.edu/pub/security/ssh
United States:
ftp://ftp.gw.com/pub/unix/ssh
Some mirrors may not have the most recent snapshots available.
3.5. How do I install it?
Get the file from a site near you, then unpack it with
gzip -c -d ssh-1.2.12.tar.gz | tar xvf -
then change into the directory ssh-1.2.12, read the file INSTALL, and
follow the directions.
3.6. Where do I get help?
First of all, read the documentation, this document :-) and the ssh
home page, at http://www.cs.hut.fi/ssh/.
If this doesn't help, you can send mail to the mailing list for ssh
users at ssh@clinet.fi. To subscribe, send mail to
majordomo@clinet.fi with the message
subscribe ssh
in the body of the message.
Before subscribing, you might like to take a look at the archives of
the mailing list, at http://www.cs.hut.fi/ssh/ssh-archive.
3.7. Are there any versions for other operating systems than UNIX?
Heikki Suonsivu (hsu@clinet.fi) and Michael Henits (moi@dio.com) each
offered a US$ 100 reward for the first stable, freely redistributable
version for either Windows or MacOS.
There is a preliminary version for Windows by Cedomir.Igaly@srce.hr,
available from http://public.srce.hr/~cigaly/ssh/; you might want to
test this.
Bernt.Budde@udac.uu.se is working on a Mac port.
A port to VMS, by Mark Martinec (Mark.Martinec@nsc.ijs.si), is being
worked on.
4. Ssh Applications
4.1. Can I run backups over ssh?
Yes. Since ssh is a drop-in replacement for rsh, backup scripts should
continue to work. If you use rdist, see below.
4.2. Should I turn encryption off, for performance reasons?
No; you should keep it turned on, for security reasons.
Today's CPUs are fast enough that performance losses (if any) only are
noticable for local Ethernet speeds, or faster.
You might want to specify RC4 encryption instead of the default, IDEA,
with -c rc4. At an actual measurement, this dropped sustainable
transfer speed between a P90 and a 486/100 (not the fastest CPUs
around) from 386 kb/s (for no encryption) to 318 kb/s.
Across a heavily loaded Ethernet, rc4 encryption together with
compression may actually be faster than using rcp.
If you don't encrypt your sessions, you are vulnerable to all the
attacks which are open on the "r" suite of utilities, and you might as
well not use ssh.
4.3. Can I use ssh to communicate across a firewall?
Yes; you can use TCP forwarding for that, by using its secure TCP
forwarding features.
4.4. Can I distribute files with ssh, as with rdist?
Stock rdist 6.1.0 does not work together with ssh, due to bugs in it.
You can use the Linux version of rdist (which should compile on any
system for which rdist also works), available from
ftp://sunsite.unc.edu/pub/Linux/system/Network/file-transfer/ as
rdist-6.1.0-linuxpl2.tar.gz.
4.5. Can I use ssh to securely connect two subnets across the Inter-
net?
This has been discussed on the ssh mailing list. A proposed solution
was to run ppp with TCP forwarding; however, this has not been
implemented yet.
4.6. Can I use ssh to securely forward UDP-based services, such as
NFS or NIS?
Forwarding UDP packets has been proposed, but has not been
implemented. There are two problems with this:
o Some UDP-based programs use the IP address of the incoming packet
and the port it was sent from as a form of authorization.
Forwarding such packets from local ports would tend to confuse
these (badly written :-) programs.
o UDP-based programs usually use a retransmit strategy if they do not
receive an answer for a predetermined time. This leads to
ineffiency if packets are forwarded across a reliable connection,
such as TCP. Somebody would have to implement lossy UDP forwarding
to avoid this.
4.7. Can I forward SGI OpenGL connections over ssh?
It is not likely that this will be implemented. OpenGL uses a totally
different protocol from X, and at least gld would have to be replaced.
5. Problems
If you don't find your problem listed below, please submit a bug
report to ssh-bugs@clinet.fi, giving full details of
o Version number of ssh and (if different) sshd
o What you expected ssh to do
o What ssh did instead (including all error messages)
o The system you use (for example, the output of uname -a), and the
output of config.guess.
o The compiler you used, plus any compilation flags
o The output of ssh -v
o The output of the sshd daemon when run in debug mode, as sshd -d
5.1. ssh otherhost xclient & does not work!
No, it doesn't. Use "ssh -f otherhost xclient" instead, or "ssh -n
otherhost xclient &" if you want a script to be compatible with rsh.
5.2. Ssh fails with "Resource temporarily unavailable" for Solaris
2.4
This is a kernel bug in Solaris. Get the patch 101945-32.
5.3. X11 forwarding does not work for an SCO binary with the iBCS2
emulator under Linux.
You need to set the hostname to the fully qualified domain name for
this to work. Some Linux distributions set the hostname to the first
part of the FQDN only.
5.4. Ssh is doing wrong things for multi-homed hosts!
Check whether gethostbyname() really returns the complete lists of
possible IP addresses (you might, for example, have your system
configured to search /etc/hosts first, which might contain only one of
the IP addresses).
5.5. Userid swapping is broken under AIX!
This is a bug in AIX 3.2.5, reported as APAR IX38941, and fixed by
patches U435001, U427862, U426915, and a few others. Contact your IBM
representative for details.
5.6. ssh-keygen dumps core on Alpha OSF!
For Alpha OSF/1 1.3.2, this is due to a bug in the vendor-supplied
compiler with maximum optimization.
Turn off all optimization for ssh-keygen, or use gcc.
5.7. ssh-keygen dumps core on Solaris or SunOS
This is a bug in gcc 2.7.0, which causes it to generated incorrect
code without optimization. Supply the "-O" or "-O -g" options to gcc
when compiling. Alternatively, upgrade to gcc 2.7.2.
5.8. On Linux, compilation aborts with some error message about
libc.so.4
This is an incorrectly configured Linux system; do a "cd /usr/lib; ln
-s libc.sa libg.sa" as root to remedy this.
5.9. X authorization fails for HP-UX 9.05
This one is known, but a fix is not available yet. If you can supply
any additional data, please send it to ssh-bugs@clinet.fi.
The symptoms, as known so far, are:
When the target machine is running HP-UX 9.05, it is most likely that
X authorization fails if the xauth list produces some lines of output
like "this_host:1 this_host:2 this_host:4", with gaps in the
lettering. X authorization keeps failing until a local display number
is higher than the highest already present number. Removing all xauth
data does not seem to help.
6. Miscellaneous
6.1. Credits
Most of the credit, of course, goes to Tatu Ylonen for writing ssh and
making it available to the public. I have also used parts of his text
from the documentation accompanying the ssh source distribution.
Thanks also for his corrections for this FAQ.
Also of invaluable help were corrections and additions from members of
the ssh mailing list, by Mark Martinec, Pedro Melo, Michael Soukas,
Adrian Colley, and Kenneth J. Hendrickson.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
iQCVAwUBMMbl5/Bu+cbJcKCVAQHGegQAmwrCuVd44aVYiQZE9/R5NEMOwOZmPVsJ
KVHMsF49tPcA70zl1+KkZji00LtSFQTi9Lw5ts8xMqEmrWtkA9YAVFM7i6FqKApr
yzvFUljNvH7yJFa152f0TXO78fA/yd5EFrNSjDY6gsmf6Nitg488p5fZGyH+X/3U
wbzx2fswdoc=
=szVP
-----END PGP SIGNATURE-----
--
Thomas König, Thomas.Koenig@ciw.uni-karlsruhe.de, ig25@dkauni2.bitnet.
The joy of engineering is to find a straight line on a double
logarithmic diagram.
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic