CERN Accelerating science

Abstract

CERN recommends the use of secure shell (SSH) to replace less secure commands, such as telnet, ftp and the BSD r-commands (rsh, rlogin, rexec, rcp). This article explains how ssh improves security, the importance of installing and using ssh locally to secure your complete connection, and provides links to installation instructions for UNIX and Windows. Full information is available at http://cern.ch/security/ssh

Why use SSH?

Attackers routinely use passwords from legitimate users connecting to or from a CERN machine. These passwords are usually obtained from watching ("sniffing") the network traffic of that user. The user's account can then be used to attack other machines, both inside and outside CERN. To prevent attackers from obtaining these passwords, encryption must be used.

Secure shell (SSH) is a network protocol and tool suite to transparently encrypt network traffic. It is designed to replace telnet, ftp and the BSD r-commands (rsh, rlogin, rexec, rcp), all of which transmit passwords as cleartext and are vulnerable to connection hijacking. It offers secure port forwarding and can therefore be used to encrypt other network traffic (e.g. X11) as well.

Advice on using SSH securely

Using ssh does not automatically solve all security problems, and it has to be used correctly in order to be useful:

• ssh is only secure when used end to end, i.e. directly from one trusted computer to a trusted server. You are advised to install and use ssh on your local system. (Note that using telnet or X11 to connect to a remote ssh client computer will still expose passwords in cleartext, as these applications do not encrypyt.)
• Passwords must still be regularly changed: An already-stolen password will continue to work over ssh, and although the encryption mechanism is generally assumed to be secure, passwords may still be discovered. Password advice is at http://cern.ch/security/passwords.

Installing SSH at CERN

• Installing SSH on UNIX at CERN
• Installing SSH on Windows at CERN

Using SSH to encrypt other applications

• To encrypt X11 applications with ssh, see the web page Starting Remote X Applications at CERN

References

• The OpenSSH web page contains source, binaries, a FAQ and pointers to other implementations, including MS-Windows.
• The CERN FAQ on ssh
• An external Tutorial, written by Kimmo Suominen
• Man pages: ssh, sshd, scp, sftp, sftp-server, slogin, ssh-add, ssh-agent, ssh-askpass, ssh-keygen, ssh-keyscan, x11-ssh-askpass (also on most UNIX systems by typing "man command")
• A series of SSH Internet drafts describe the protocol and architecture.

Contact