Subject: Hello, ssh & scp. Goodbye, telnet and (non-anonymous) ftp

From: Rick Moen <rick>
Date: Tue, 14 Sep 1999 01:13:17 -0700

Greetings, O Users.

You're about to make the acquaintance of ssh (secure sh=shell -- a secure
replacement for telnet) and scp (secure cp=copy -- a secure replacement 
for ftp & rcp).

Why?  Because I'm disabling all incoming telnet and ftp connections
(except for anonymous incoming ftp).  For security reasons.  

Any time you open a telnet or ftp connection, you send your password
in plaintext across the open Internet, allowing people sniffing 
passwords to effortlessly log your password and then pretend to be you.
So, I am closing off those protocols (in-bound), on this system.

You will (or may) need new client software.  Ordinary telnet clients
will not do ssh, and ordinary ftp clients will not do scp.  A complete
list of such software is at
http://linuxmafia.com/pub/linux/security/ssh-clients

A few obvious choices:

UNIX PLATFORMS (Linux, *BSD, etc.):

    SSH -- ftp://ftp.cs.hut.fi/pub/ssh/ssh-1.2.27.tar.gz or 
           http://linuxmafia.com/pub/linux/security/ssh-1.2.27.tar.gz
    (Heck, if you're on Unix, you probably already have it.)  
    Licence:  Effectively free.  Distributed as source code, sometimes
    also as binaries.

MICROSOFT WIN32 PLATFORMS (Win9x, WinNT):

    Chaffee SSH -- ftp://ftp.cs.hut.fi/pub/ssh/contrib/
                   ssh-1.2.22-Win32-Beta1.zip
    ...requires Cygnus-GNUWin32 DLLS from 
    ftp://sourceware.cygnus.com/pub/cygwin/latest/usertools.exe
    Licence:  Effectively free.  Binary or source.

MACINTOSH OS:

    NiftyTelnet SSH --
    http://www.lysator.liu.se/~jonasw/download/niftytelnet-1.1-ssh-r3.hqx
    Licence:  Free-usage, no charge.  Binary only.

All three of the above support _both_ ssh (remote shell) and scp
(file copying between machines).  Other clients on the list at
http://linuxmafia.com/pub/linux/security/ssh-clients sometimes do
only ssh, not scp.

SSH clients are available for:  Java, MacintoshOS, PalmOS, Unix, VMS,
Win32, and WinCE.

Anticipated Questions
---------------------

Q:  Does this mean I have to _buy_ new software?
A:  No.  The zero-cost ssh/scp client packages work just fine.
    (So do the payware proprietary ones, such as F-Secure SSH.)

Q:  How about for Windows 3.x?
A:  Run the Java client inside 16-bit Netscape for Windows.

Q:  scp doesn't allow me to view directories the way ftp does!
A:  So, open a second window, ssh here in that window, and do
    a directory listing in _that_.  ("ls -al")

Q:  But what if I'm visiting a machine that doesn't have an
    ssh client?
A:  Install one.  Open your Web browser to
    http://linuxmafia.com/pub/linux/security/, and browse the
    "ssh-clients" listing to find a suitable client package.

Q:  But what if they won't let me install software?
A:  Then you lose.  Suggest they join the 20th century before
    it's over.

Q:  Are you going to remove the telnet and ftp _clients_ from 
    your system?
A:  No.  I'm just disabling the servers for _incoming_ telnet
    and (non-anonymous) ftp connections.  Outgoing is unaffected.

Q:  Why is anonymous ftp OK, but all other ftp is bad?
A:  As with regular ftp, anonymous ftp transmits a password in
    plaintext, but that password has no security significance.
    (By convention, it's the user's e-mail address.)  The bad
    guys can sniff and log those all they want.

Q:  How do I run an ssh/scp _server_ on my end?
A:  On Unix, get and install ssh 1.2.27.  Otherwise, I have no idea.

Q:  What's the syntax for command-line ssh and scp?
A:  (Note that for some ssh or scp clients, such as PuTTY for 
    MS Windows and NiftyTelnet SSH for Macintosh OS, this is 
    irrelevant because they're GUI programs.)  Like this:
    ssh [email-masked]
    scp localfile [email-masked]:[directorypath][/remotefilename]

Q:  Are you doing this just to make my life complicated.
A:  No, that's just a fringe-benefit.  (Actually, it's necessary for
    some semblance of system security.)

Q:  Isn't the POP3 protocol equally a problem because of plaintext
    passwords?
A:  Regular POP3 is.  APOP (Advanced POP) isn't, and I'll be migrating
    towards that, soon.

Q:  Is there anything else I can or should do to help.
A:  Yes!  FOR CRYING OUT LOUD, _don't_ use the same password
    here as on other systems.  OK?

I'm sure y'all will have more questions.  Feel free to hit me
with 'em.

-- 
Cheers,                Linux:  It is now safe to turn on your computer.
Rick Moen
rick (at) linuxmafia.com