SSH™ allows users to log into host systems remotely. Unlike
rlogin or telnet SSH encrypts the
login session, making it impossible for intruders to collect clear-text
passwords.
SSH is designed to replace older, less secure terminal applications used
to log into remote systems, such as telnet or
rsh. A related program called
scp replaces older programs designed to copy files
between hosts, such as ftp or
rcp. Because these older applications do not
encrypt passwords between the client and the server, you should avoid them
whenever possible. Using secure methods to remotely log into other systems
will decrease the security risks for both your system and the system you
are logging into.
Features of SSH
SSH (or Secure SHell) is a
protocol for creating a secure connection between two systems using a
client server architecture. Under the SSH protocol, the client machine
initiates all connections to a server.
The SSH protocol provides the following safeguards:
After an initial connection, the client verifies it is
connecting to the same server during subsequent sessions.
The client transmits its authentication information to the
server, such as a username and password, in an encrypted format.
All data sent and received during the connection is transferred
using strong, 128 bit encryption, making intercepted transmissions
extremely difficult to decrypt and read.
The client has the ability to use X11
[1] applications launched from the shell prompt. This
technique, called X11 forwarding, provides a
secure means to use graphical applications over a
network.
Because the SSH protocol encrypts everything it sends and receives, it
can be used to secure otherwise insecure protocols. Using a technique
called port forwarding, an SSH server can become
a conduit to secure insecure protocols, like POP, increasing
overall system and data security.
Red Hat Linux 8.0 includes the general OpenSSH package
(openssh), the OpenSSH server
(openssh-server) and client
(openssh-clients) packages. Please see the chapter
titled OpenSSH in the
Official Red Hat Linux Customization Guide for instructions on installing and
deploying OpenSSH. Also note that the OpenSSH packages require the
OpenSSL package (openssl). OpenSSL installs several
important cryptographic libraries that help OpenSSH provide encrypted
communications.
A large number of client and server programs can use the SSH
protocol. Several different SSH client versions are available for
almost every major operating system in use today. Even if the users
connecting to your system are not running Red Hat Linux, they can still find and
use an SSH client native for their operating system.
Why Use SSH?
Nefarious computer users have a variety of tools at their disposal to
disrupt, intercept, and re-route network traffic in an effort to gain
access to your system. In general terms, these threats can be
categorized as follows:
Interception of communication between two
systems — In this scenario, the attacker can be
somewhere on the network between the communicating entities,
copying any information passed between them. The attacker may
intercept and keep the information or alter the information and
send it on to the intended recipient.
This can be attack can be mounted through the use of a packet
sniffer — a common network utility.
Impersonation of a particular host
— Using this strategy, an attacker's system is configured to
pose as the intended recipient of a transmission. If this strategy
works, the user's system will remain unaware it is communicating
with the wrong host.
This can be attack can be mounted through techniques known as
DNS poisoning
[2]
or IP spoofing
[3].
Both techniques intercept potentially sensitive information, and if the
interception is for hostile reasons, the results can be disastrous.
If SSH is used for remote shell login and file copying, these security
threats can be greatly diminished. This is because the SSH client and
server use digital signatures to verify their identity. Additionally,
all communication between the client and server systems is
encrypted. Attempts to spoof the identity of either side of a
communication will not work, since each packet is encrypted using a
key known only by the local and remote systems.
