Ssh (The Secure Shell)

SSH The Secure Shell 1 Platform: Linux and Unix

2 Group Members: Arnob Roy (201314025) Md. Jahidul Islam (201414020) Asif Kamal Chowdhury (201414040) Asif Sanjary (201414043) Mehedi Afzal Farazi (201414045) Md. Shafiul Islam (201414049)

SSH  Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network.  It is a secure alternative to the non-protected login protocols (such as telnet, rlogin) and insecure file transfer methods (such as FTP).

What is SSH?  It is a protocol not a product.  Software based approach to network security.  Encrypts data sent between the computers.  SSH is replacement for telnet, rsh, rlogin and can also replace ftp.  Client/ Server Architecture.  Comes with all Linux distribution, Mac OS X, AIX, Sun Solaris, OpenBSD and other Unix variants.  Ported to other operating systems, such as Windows, Palm OS, Amiga etc.

What is not SSH?  It is not a true shell like csh, ksh, sh etc.  It is not a command interpreter.  It creates secure channel for running commands on remote computer.  It is not a complete security solution.  It will not protect against Trojans, viruses etc.

Why SSH is a replacement for telnet, rsh, rlogin and ftp? 6  Telnet and others sends all data in clear text. But SSH sends data as cipher text.  In SSH host between sender and receiver cannot see what the traffic is.

HISTORY 7  In 1995, Tatu Yionene, a researcher at Helsinki University designed the first version of the protocol (now known as SSH-1).  In July 1995, he released SSH1 as free software i.e. it was open source.  In December of 1995, he formed SSH Communication Security (SCS) to market and develop SSH.  In 1996 SSH-2 was developed, but it was incompatible with SSH-1.  SCS released SSH-2 in 1998 and had more restrictive license.  OpenSSH, free implementation of SSH-2 protocol was released from OpenBSD project.  In 2006 SECSH group (group for standardizing protocol) released SSH-2 as internet standard.

Some Necessary Terminology 8  SSH- Generic term used for SSH protocols.  ssh- Client Command for running remote command.  sshd- Server program.  SSH-1- Version 1 of the protocol.  SSH-2- Version 2 of the protocol  OpenSSH- Product from open BSD project.

SSH1 vs SSH2 9 SSH1 SSH2 Uses server and host keys to authenticate system. Uses only host keys. Different protocols are used. So, they are not compatible with each other. Different protocols are used. SSH1 is not currently developed by developers. SSH2 is currently monitored and developed by developers. Less security, performance and portability. More security, performance and portability.

SSH LAYERS 10 Application Layer ssh-connection Session multiplexing, X11 and port forwarding, remote command execution etc. ssh-userauth User authentication using public key, password, host based etc. ssh-transport Initial key exchange and server authentication, setup encryption Transport Layer TCP Internet Layer IP Network Access Layer Ethernet

INSTALING SSH 12  Downloading Source Code We can download the source code from- http://www.openssh.com  Building and installing OpenSSH $ gtar –xyf openssh-4.5p1.tar.gz $ cd openssh-4.5p1 $ ./configure $ make $ make install

HOW SSH PROTOCOL WORK? 13  Works in the client-server model.  SSH client drives the connection setup process and uses public key cryptography to verify the identity of the SSH server.  After the setup phase the SSH protocol uses strong symmetric encryption and hashing algorithms to ensure the privacy and integrity of the data that is exchanged between the client and server.

SSH ENCRYPTION ALGORITHMS 14 Secure Shell uses the following ciphers for encryption: Cipher SSH1 SSH2 DES yes no 3DES yes yes IDEA yes no Blowfish yes yes Twofish no yes Arcfour no yes Cast128-cbc no yes

SSH ENCRYPTION ALGORITHMS 15 Secure Shell uses the following ciphers for authentication: Cipher SSH1 SSH2 RSA yes no DSA no yes

Functions 16  Secure Command Shell  Port Forwarding  Agent Forwarding  Secure file transfer.

Secure Command Shell 17  Allow us to edit files.  View the contents of directories.  Custom based applications.  Create user accounts.  Change permissions.  Anything can be done from command prompt can be done remotely and securely.

Port Forwarding 18  Powerful Tool.  provide security to TCP/IP applications including e-mail, sales and customer contact databases, and in- house applications.  allows data from normally unsecured TCP/IP applications to be secured.

Agent Forwarding 19  Let, anyone want to login to the computer at work from home computer or from hotel while travelling. The computer at work is behind the firewall so you cannot connect to it directly.  We are allowed to connect to a bastion host, but are not allowed to store private keys on it.  What can you do?

SECURE FILE TRANSFER & PROTOCOL 20  Secure File Transfer Protocol (SFTP) is a subsystem of the Secure Shell protocol.  Separate protocol layered over the Secure Shell protocol to handle file transfers.  Secure extranet is one of the safest ways to make specific data available to customers, partners and remote employees without exposing other critical company information to the public network. Using SFTP on your secure extranet machines effectively restricts access to authorized users and encrypts usernames, passwords and files sent to or from them.

SECURITY BENEFITS 21  User Authentication  Host Authentication  Data Encryption  Data Integrity

USER AUTHENTICATION 22  User Identity  System verifies that access is only given to intended users and denied to anyone else.

HOST AUTHENTICATION 23  A host key is used by a server to prove its identity to a client and by a client to verify a "known" host. Host keys are described as persistent (they changed infrequently) and are asymmetric--much like the public/private key pairs. If a machine is running only one SSH server, a single host key serves to identify both the machine and the server. If a machine is running multiple SSH servers, it may either have multiple host keys or use a single key for multiple servers. Host authentication guards against the Man-in-the-Middle attack.

HOST AUTHENTICATION 24  To access an account on a Secure Shell server, a copy of the client's public key must be uploaded to the server. When the client connects to the server it proves that it has the secret, or private counterpart to the public key on that server, and access is granted.

DATA ENCRYPTION 25  Encryption, sometimes referred to as privacy, means that our data is protected from disclosure to a would-be attacker "sniffing" or eavesdropping on the wire. Ciphers are the mechanism by which Secure Shell encrypts and decrypts data being sent over the wire.  When a client establishes a connection with a Secure Shell server, they must agree which cipher they will use to encrypt and decrypt data. The server generally presents a list of the ciphers it supports, and the client then selects the first cipher in its list that matches one in the server's list.

DATA INTEGRITY 26  Data integrity guarantees that data sent from one end of a transaction arrives unaltered at the other end. Even with Secure Shell encryption, the data being sent over the network could still be vulnerable to someone inserting unwanted data into the data stream (See Insertion and replay attacks for more details). Secure Shell version 2 (SSH2) uses Message Authentication Code (MAC) algorithms to greatly improve upon the original Secure Shell's (SSH1) simple 32-bit CRC data integrity checking method.

PASSWORD AUTHENTICATION 27  Passwords, in combination with a username, are a popular way to tell another computer that you are who you claim to be.  If the username and password given at authentication match the username and password stored on a remote system, you are authenticated and allowed access.

PUBLIC KEY AUTHENTICATION 28  Public key authentication uses a pair of computer generated keys - one public and one private. Each key is usually between 1024 and 2048 bits in length.  Most secure Method to authenticate using Secure Shell.  To access an account on a Secure Shell server, a copy of the client's public key must be uploaded to the server. When the client connects to the server it proves that it has the secret, or private counterpart to the public key on that server, and access is granted.

PROTECT AGAINST 29  IPS Spoofing  DNS Spoofing  IP Source Routing

IPS Spoofing 30  IP spoofing is a technique used to gain unauthorized access to computers, whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host.

DNS Spoofing 31  DNS spoofing is a term used when a DNS server accepts and uses incorrect information from a host that has no authority giving that information. DNS spoofing is in fact malicious cache poisoning where forged data is placed in the cache of the name servers. Spoofing attacks can cause serious security problems for DNS servers vulnerable to such attacks, for example causing users to be directed to wrong Internet sites or e-mail being routed to non-authorized mail servers.

IPS SOURCE ROUTING 32  Where a host can pretend that an IP packet comes from another, trusted host.

OpenSSH Alternatives for windows 33  PuTTY  TTSSH  Cygwin  MSSH  WinSCP  FileZilla

ADVANTAGES 34  Strong Encryption.  Strong authentication. Closes several security holes (e.g., IP, routing, and DNS spoofing).  Improved privacy. All communications are automatically and transparently encrypted.  Both free and commercial version available.  Proven technology.  Multi-platform.  Many authentication methods supported.  Can use it instead of VPN.

Disadvantages 35  Port ranges & dynamic ports can’t be forwarded.  A client on the Internet that uses SSH to access the Intranet, can expose the Intranet by port forwarding.

REFERENCES 36  https://www.ssh.com/  http://www.employees.org/  openssh.com  https://en.wikipedia.org/wiki/Secure_Shell  http://yakko.cs.wmich.edu/presentations/20021107-ssh/slides/img7.html  http://www.vandyke.com/solutions/ssh_overview/ssh_overview_function alit  http://michaelsteel.tripod.com/cgi-bin/

Ssh (The Secure Shell)

In this document

More Related Content

What's hot

Similar to Ssh (The Secure Shell)

More from Mehedi Farazi

Recently uploaded

Ssh (The Secure Shell)