Overview – SOE Openssh v7.1p1 September 2016

What is SOE Openssh? It’s a FREE version of the SSH connectivity tools Provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions. An Open Source replacement for both SSH and everything SSH can replace Implements v2 of the SSH protocol The SSH protocol encrypts all traffic between machines are encrypted. Telnet does not encrypt any information, passwords and account ids are passed in the clear. Using OpenSSH as a replacement for telnet, rlogin, rsh, rcp, ftp, X11.

What Security does SOE Openssh provide? Data Privacy through Encryption Data Integrity to guarantee unaltered communications Authentication of users and servers. Authorisation of user actions. Forwarding to protect other TCP/IP based applications Secure X11 sessions

How OpenSSH Differ from SSH? OpenSSH is Open Source OpenSSH has an active user community for support SSH offers commercial support contracts SSH has recently revised their license to allow for more free use on Linux and BSD platforms SSH is a commercial product with all the pros and cons associated with that An Open Source product can become an integral part of your security planning

SOE OpenSSH Composition Openssh-7.1p1 - Secure shell component OpenSSL-1.0.2g - Cryptography toolkit that implements Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Zlib-1.2.3 - Compression library that provides in-memory compression and de-compression functions Prngd-0.9.29 - Random number generator daemon for systems that lack the /dev/random device.

SOE OpenSSH Examples Remote host login $/opt/soe/local/bin/ssh Hostx File transfer $/opt/soe/local/bin/scp /etc/hosts hostx:/hosts.sourcehost Non-interactive file transfer without passphrase generate and distribute a public key $opt/soe/local/bin/ssh-keygen -t rsa –N "“ Copy the public key $/opt/soe/local/bin/scp ~/.ssh/id_rsa.pub hostx:~/.ssh/authorized_keys2 $/opt/soe/local/bin/scp /etc/hosts hostx:~/hosts.sourcehost Compression Test $ /opt/soe/local/bin/ssh -l userx -C hostx

SOE OpenSSH Supported OS Operating System Version Architecture Sun Solaris 8 Sun Sparc Solaris 9 Solaris 10 Sun Sparc/x86-64 Architecture Solaris 11 HP-UX HP-UX11i HP PA-RISC HP-UX11i V2 (11.23) HP PA-RISC/ HP Itanium HP-UX11i V3 (11.31)  AIX AIX 5.3 IBM pSeries AIX 6.1 AIX 7.1 Linux RHEL Server 5.x x86-64 Architecture RHEL Server 6.x RHEL Server 7.x RHEL Workstation 6.x RHEL Workstation 7.x Suse 10 Suse11 Cent OS 5.x(5.5 onwards) Cent OS 6.x Cent OS 7.x Oracle Enterprise Linux 5.x Oracle Enterprise Linux 6.x Oracle Enterprise Linux 7.x Zlinux Zlinux 6.x Zlinux 7.x Ubuntu Ubuntu 12.04,14.04

UnixSOE Openssh 7.1p1– What is New? New features Compiled Openssh v7.1p1 with openssl-1.0.2g. See http://www.openssl.org/ for detailed information.This is primarily a bugfix release. Major security fix is : IBM AIX OpenSSL Multiple Vulnerabilities IV, which has multiple OpenSSL vulnerabilities defined by CVE Numbers CVE-20 14-0195,CVE-2014-0224,CVE-2014-0221, CVE-2014-0198,CVE-2014-3470 See http://www.openssh.org/ for new features. ssh(1), sshd(8): this release removes the J-PAKE authentication code. This code was experimental, never enabled and had been unmaintained for some time. ssh(1): when processing Match blocks, skip 'exec' clauses other clauses predicates failed to match. ssh(1): if hostname canonicalisation is enabled and results in the destination hostname being changed, then re-parse ssh_config(5) files using the new destination hostname. This gives 'Host' and 'Match' directives that use the expanded hostname a chance to be applied. ssh(1): avoid spurious "getsockname failed: Bad file descriptor" in ssh -W. bz#2200, debian#738692 . sshd(8): allow the shutdown(2) syscall in seccomp-bpf and systrace sandbox modes, as it is reachable if the connection is terminated during the pre-auth phase. ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1 bignum parsing. Minimum key length checks render this bug unexploitable to compromise SSH 1 sessions. sshd_config(5): clarify behaviour of a keyword that appears in multiple matching Match blocks. bz#2184 . ssh(1): avoid unnecessary hostname lookups when canonicalisation is disabled. bz#2205 sshd(8): avoid sandbox violation crashes in GSSAPI code by caching the supported list of GSSAPI mechanism OIDs before entering the sandbox. bz#2107 . ssh(1): fix possible crashes in SOCKS4 parsing caused by assumption that the SOCKS username is nul-terminated. ssh(1): fix regression for UsePrivilegedPort=yes when BindAddress is not specified. ssh(1), sshd(8): fix memory leak in ECDSA signature verification. ssh(1): fix matching of 'Host' directives in ssh_config(5) files to be case-insensitive again (regression in 6.5).

Solution Pack Unix SOE & TI Services Questions & Feedback Product Support Helpline unixsoe@csc.com