What is ssh?
To quote the README file:
SSH (Secure Shell) is a program to log into another computer over a network, to execute commands in a remote machine, and to move files from one machine to another. It provides strong authentication and secure communications over unsecure channels. It is intended as a replacement for rlogin, rsh, and rcp.
Additionally, ssh provides secure X connections and secure forwarding of arbitrary TCP connections.
Why should I use it?
The traditional BSD 'r' - commmands (rsh, rlogin, rcp) are vulnerable to different kinds of attacks. Somebody who has root access to machines on the network, or physical access to the wire, can gain unauthorized access to systems in a variety of ways. It is also possible for such a person to log all the traffic to and from your system, including passwords (which ssh never sends in the clear).
The X Window System also has a number of severe vulnerabilities. With ssh, you can create secure remote X sessions which are transparent to the user. As a side effect, using remote X clients with ssh is more convenient for users.
Users can continue to use old .rhosts and /etc/hosts.equiv files; changing over to ssh is mostly transparent for them. If a remote site does not support ssh, a fallback mechanism to rsh is included.
What kinds of attacks does ssh protect against?
SSH protects against:
- IP spoofing, where a remote host sends out packets which pretend to come from another, trusted host. Ssh even protects against a spoofer on the local network, who can pretend he is your router to the outside.
- IP source routing, where a host can pretend that an IP packet comes from another, trusted host.
- DNS spoofing, where an attacker forges name server records
- Interception of cleartext passwords and other data by intermediate hosts.
- Manipulation of data by people in control of intermediate hosts
- Attacks based on listening to X authentication data and spoofed connection to the X11 server.
The above only holds if you actually use encryption. Ssh does have an option to use encryption of type "none" this is only for debugging purposes, and should not be used. 2.4 What kind of attacks does ssh not protect against?
Ssh will not help you with anything that compromises your host's security in some other way. Once an attacker has gained root access to a machine, he can then subvert ssh, too.
How does it work?
All communications are encrypted using IDEA or one of several other ciphers (three-key triple-DES, DES, RC4-128, TSS, Blowfish). Encryption keys are exchanged using RSA, and data used in the key exchange is destroyed every hour (keys are not saved anywhere). Every host has an RSA key which is used to authenticate the host when RSA host authentication is used. Encryption is used to protect against IP-spoofing; public key authentication is used to protect against DNS and routing spoofing.
RSA keys are also used to authenticate hosts.
sh - OpenSSH SSH client (remote login program)
ssh [-l login_name] hostname | user@hostname [command]
ssh [-afgknqstvxACNPTX1246] [-b bind_address] [-c cipher_spec] [-e escape_char] [-i identity_file] [-l login_name] [-m mac_spec] [-o option] [-p port] [-F configfile] [-L port:host:hostport] [-R port:host:hostport] [-D port] hostname | user@hostname [command]
ssh (SSH client) is a program for logging into a remote machine and for executing commands on a remote machine. It is intended to replace rlogin and rsh, and provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel.
ssh connects and logs into the specified hostname. The user must prove his/her identity to the remote machine using one of several methods depending on the protocol version used:
Tips & Tricks
PingUp gegen Verbindungsabbruch
Seit ich nicht mehr einen PC als Router nutze, sondern auf einen kleinen Hardware-Router umgestiegen bin, passiert mir bei allen ssh-Verbindungen folgendes: Wenn man länger als max 5 Minuten nichts tippt und keine neuen Zeichen vom Server zu mir gesendet werden, dann bricht die Verbindung ab. Das merkt man dann in dem Moment, wenn man wieder was tippen möchte. Der Client meldet dann
Read from remote host 123.de: Connection reset by peer Connection to 123.de closed.
und beendet sich.
Abhilfe: Man füge einfach in die Datei /etc/ssh/ssh_config (je nach Distribution ggf. etwas anderer Name oder Pfad) folgendes ein:
Das kann dann z.B. so aussehen:
Host * ServerAliveInterval 60 ForwardX11 yes ForwardX11Trusted yes Protocol 2,1 StrictHostKeyChecking no
Wenn dir dasselbe mit Putty passiert, dann bietet es dafuer eine Funktion "Keep Alive" Packets zu setzen, wenn man das zB auf 60 Sekunden setzt hat man auch keine idle disconnects mehr.