SSH Operation The Swiss Army Knife of encryption tools…

SSH Features Command line terminal connection tool Replacement for rsh, rcp, telnet, and others All traffic encrypted Both ends authenticate themselves to the other end Ability to carry and encrypt non- terminal traffic

Brief History SSH.com’s SSH1, originally completely free with source code, then license changed with version SSH.com’s SSH2, originally only commercial, but now free for some uses. OpenSSH team took the last free SSH1 release, refixed bugs, added features, and added support for the SSH2 protocol.

Installation OpenSSH is included with a number of Linux distributions, and available for a large number of Unices On RPM-based linuxes: “rpm –Uvh openssh*.rpm”

Basic use ssh SshServerName ssh –l UserName SshServerName ssh SshServerName CommandToRun ssh –v SshServerName Server Host Key checks Uses same login password And if we need to encrypt other traffic?

Port Forwarding – real server on remote machine I want to listen on port 5110 on this machine; all packets arriving here get sent to mailserver, port 110: ssh –L 5110:mailserver:110 mailserver

Port Forwarding – real server on this machine All web traffic to my firewall should be redirected to the web server running on port 8000 on my machine instead: ssh –R 80:MyMachine:8000 firewall

X Windows forwarding No setup – already done! Run the X Windows application in the terminal window: xclock & The screen display shows up on your computer, and any keystrokes and mouse movements are sent back, all encrypted.

SSH key background Old way: password stored on server, user supplied password compared to stored version New way: private key kept on client, public key stored on server.

SSH key creation General command: ssh-keygen –b 1024 –c “Comment” –f ~/.ssh/identity_file Different forms for each of the SSH flavors Assign a hard-to-guess passphrase to the private key during creation. Key can be used for multiple servers

SSH key installation 3 versions of ssh: interoperability is good, but poorly documented ssh-keyinstall utility automates the creation and installation “ssh-keyinstall –s SshServerName” creates keys, if needed, and installs them on the remote server Need password during key install only

Using SSH keys ssh SshServerName Ssh –l UserName SshServerName ssh SshServerName CommandToRun Ssh –v SshServerName

ssh-agent Remembers your private key(s) Other applications can ask ssh-agent to authenticate you automatically. Unattended remote sessions. ssh-agent bash ssh-agent startx eval `ssh-agent`#Less preferred ssh-add [KeyName]

Fanout Runs command on multiple machines by opening separate ssh session to each fanout “machine1 machine2 “command params” Gives organized output from each machine

Links and references SSH, The Secure Shell, The Definitive Guide ssh-keyinstall, fanout and other apps at More docs at h-faq.html h-faq.html William Stearns