|
Ssh (Secure Shell) is a program to log into another computer over a network, to execute commands in a remote machine, and to move files from one machine to another. It provides strong authentication and secure communications over unsecure channels. It is intended as a replacement for rlogin, rsh, and rcp. Additionally, ssh provides secure X connections and secure forwarding of arbitrary TCP connections.
The advantage of SSH over kerberos is that SSH does not require a central database of users, and users can use their regular passwd. However, SSH and kerberos can safely coexist.
The advantage of SSH of pptp is that it works today for both Unix and PCs.
The main disadvantage of SSH is that the Windows client costs money.
In December, 1997, a bulk purchase was negotiated between UCB and DataFellows for about $7/seat.
See the Winter '98 issue of Berkeley Computing & Communications
In April '01, we found that the University no longer had a contract with F-Secure. We asked about getting 100 licenses, and they do not charge by the seat any more, but the cost would be $7.50/seat/year (regularly $19.80/seat/year) for a Right To Use license with support.
The departmental Windows 2000 server at \\winsww
has a version of ssh that we have a campus license for.
To mount \\winsww, you must have a
EECS Windows 2000 domain account.
From: mshort (Michael Short) Subject: SSH 1.2.17 Newsgroups: ucb.cs.sww.announce Date: 7 Mar 97 23:32:15 GMT Organization: The Internet Gateway Service Path: agate!agateway!CS.Berkeley.EDU!mshort Message-ID: <199703072332.PAA03484@oceanus.CS.Berkeley.EDU> Sender: usenet Distribution: ucb Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 Lines: 38 SSH, version 1.2.17, has been added to the Software Warehouse for all supported operating systems. Ssh (Secure Shell) is a package for logging into a remote machine and for executing commands in a remote machine. It is intended to replace rlogin and rsh, and provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel. OS: HP-UX OSF/1 Solaris SunOS Ultrix Executables: ssh ssh-add sshd ssh-agent slogin ssh-keygen scp make-ssh-known-hosts Documentation: New users should first read the README and README.SWW files under /usr/sww/doc/security/SSH. (This directory also holds the release notes. There are manpages for all executables. As always, bug-sightings should be reported using the program `sww-bug.' Please remember there may be a one-day delay for filesystem updates to appear on individual systems, as software is distributed throughout the department by file server mirroring. Michael Short mshort@cs
/usr/sww/bin/ssh
/usr/sww/bin/sshd
/usr/sww/share/man/man1/ssh.1
/usr/sww/share/src/ssh
/usr/sww/share/etc/ssh_install
OpenSSH Portable version:
http://www.openssh.com/portable.html
You can also try getting it from
http://www.sunfreeware.com/programlistsparc8.html#openssh
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/OpenSSH/portable/
forney.eecs 7# /usr/local/ssh/openssh/bin/ssh-keygen -t dsa -f /etc/ssh_host_dsa_key -N "" /usr/local/ssh/openssh/bin/ssh-keygen: Exec format error forney.eecs 8# file /usr/local/ssh/openssh/bin/ssh-keygen /usr/local/ssh/openssh/bin/ssh-keygen: ELF 32-bit MSB executable SPARC32PLUS Version 1, V8+ Required, dynamically linked, stripped
./configure --prefix=/usr/local/openssh-3.1p1 --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/ssl --with-pid-dir=/etc
--prefix
--sysconfdir
--with-ssl-dir
--with-pid-dir
/etc/init.d/sshd will work
ftp://ftp.gw.com/pub/unix/ssh/
configure --prefix=/usr/eesww/share/etc/ssh/ssh-1.2.26 --exec_prefix=/usr/eesww/etc/ssh/ssh-1.2.26
See INSTALL for other flags:
The package comes with an Autoconf-generated configure script. The script accepts several options All standard options, including: --prefix=PREFIX where to install files (default: subdirs of /usr/local) --exec_prefix=PREFIX where to install executables (default: same as prefix) --srcdir=DIR find sources in DIR (default: where configure is) Specific options: --with-rsh=PATH Use rsh specified by PATH when needed --with-etcdir=PATH Store system files in the given dir (default: /etc) --with-path=PATH Default path to pass to user shell. --with-rsaref Use rsaref2 from rsaref2 subdirectory (see below). --with-libwrap[=PATH] Use libwrap (tcp_wrappers) and identd (see below). --with-socks4[=PATH] Include SOCKS (firewall traversal) support. --with-socks5[=PATH] Include SOCKS5 (firewall traversal) support. --without-idea Don't include IDEA (see below). --with-securid[=PATH] Support for the SecurID card (see README.SECURID). --with-tis=PATH Support for the Tis authsrv (see README.TIS). --enable-warnings Adds -Wall to CFLAGS if using gcc.
make
umount /usr/eesww/share umount /usr/eesww mount -o rw nexus:/eesww/solaris.sun4 /usr/eesww mount -o rw nexus:/eesww/share /usr/eesww/share
make install on dewitt
cd /usr/eesww/etc rm -f sshd ln -s ssh/ssh-1.2.26/sbin/sshd .
John writes:
It is possible to use ssh to perform remote checkout with cvs. To verify that this works in principle, I have tried it in Solaris:
- Run '
ssh-keygen' to generate your RSA encryption keys.- Copy
~/.ssh/identityto~/.ssh/authorized_keys.- Run
ssh-agent xtermto start an xterm inside an ssh agent.- In the new xterm, run '
ssh-add' to add your identity file to the agent.- Go '
setenv CVS_RSH ssh' to tell CVS to use ssh.- Run cvs. eg:
cvs -d :ext:brahe.eecs.berkeley.edu:/users/johnr/Repository checkout divaCVS uses ssh to connect to brahe and get the files. The reason for steps 3 and 4 is so that you don't have to type in your RSA password when ssh makes the connection -- the agent does it for you.
http://bmrc.berkeley.edu/people/chaffee/winntutil.html#sshnt
and created
ssh-1.2.27-win.patch.gz
Below are my notes on the process:
I had problems under Cygwin b20.1, so I patched under Solaris and then copied the distribution over to NT. The error I saw under cygwin was:
patching file `minfd.c' patching file `newchannels.c' missing header for unified diff at line 2969 of patch can't find file to patch at input line 2969 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |k_strerror(sock_lasterror())); | | /* Dup some descriptors to get the authentication fd to pfd, | because some shells arbitrarily close descriptors below that. -------------------------- File to patch:
TOOLS32 variable
TOOLS32=d:\\PROGRA~1\\MICROS~2\VC98 export TOOLS32 nmake -f makefile.vc
RhostsRSAAuthentication authentication
is turned on, then it should be possible to use ssh from
Windows to a Unix host without typing in your password.
However, the sshd server on the Unix side requires the connection to come in from a privileged port (a port less than 1024, port 22 is the default).
The patch has code in sshconnect.c that
turns disables privileged ports, probably because Winodws seems to
leave the port open.
ssh and the full hostname
of the remote machine e.g:
you@localmachine 1% ssh remotemachine.eecs.berkeley.edu
~/.shosts
file that contains the full name of the local machine
you@remotemachine 1% echo "localmachine.eecs.berkeley.edu" >> ~/.shosts
ssh and the full hostname
of the local machine
you@remotemachine 1% ssh localmachine.eecs.berkeley.edu
ssh -v remotemachine date
ssh -v debugging option:
ssh -v foo date
sshd -d option on the Unix server. If you have root
access, then you should stop any sshd processes that
are running and then start up sshd -d, which will
handle one connection and then exit. If you don't have root, then
you could try using the port options of ssh and
sshd to connect via a non-privileged port
I poked around, and I could not log in if I used added something like *.eecs.berkeley.edu to ~/.shosts. If this would work, then we could add things like *.ibm.net to ~/.shosts
My temporary workaround is to modify ~/.ssh/known_hosts and add*.ibm.net to the key for the laptop so that it looks like
xxx.berkeley.edu,*.ibm.net 1024 37 1417...Then I modified my .cshrc and placed the following command at the end.
# If we are logging in via ssh, this command adds the current host # to ~/.shosts /usr/local/bin/shostsadd
This script checks the value of SSH_CLIENT and if that variable is present, and the value of the variable is not in your .shosts file, the script adds it to your .shosts file so that the next time you log in, you will not need to type in your RSA passwd
#!/bin/sh
# Add a host to .shosts if necessary
#
# Call this script while logging in to add new hosts to .shosts so
# that we can connect via ssh easily from accounts like ibm.net
prog=$0
if [ "${SSH_CLIENT}x" != "x" ]; then
# SSH_CLIENT is set if we are logging in via ssh
REMOTE_HOSTIP=`echo $SSH_CLIENT | awk '{print $1}'`
grep -s $REMOTE_HOSTIP $HOME/.shosts > /dev/null
result=$?
if [ "$result" -eq 1 ]; then
if [ -f "/usr/local/bin/host" ]; then
REMOTE_HOSTNAME=`/usr/local/bin/host $REMOTE_HOSTIP | awk '{print $NR'}`
grep -s $REMOTE_HOSTNAME $HOME/.shosts > /dev/null
result=$?
if [ "$result" -eq 1 ]; then
echo "$0: Adding $REMOTE_HOSTIP to $HOME/.shosts"
echo "$REMOTE_HOSTIP" >> $HOME/.shosts
fi
else
echo "$0 Adding $REMOTE_HOSTIP to $HOME/.shosts"
echo "$REMOTE_HOSTIP" >> $HOME/.shosts
fi
fi
fi
In the example below, my .shosts file did not have the ip address of my laptop in it, so shostsadd added it. The second time I ran rsh, everything worked.
bash-2.02$ ssh maury date Enter passphrase for RSA key 'cxh@maury.eecs.berkeley.edu': ld.so.1: /usr/local/bin/xauth: warning: /usr/4lib/libXmu.so.4.0: has older revision than expected 10 /usr/local/bin/shostsadd: Adding 169.129.59.148 to /users/cxh/.shosts Sun Jun 13 17:25:06 PDT 1999 bash-2.02$ ssh maury date ld.so.1: /usr/local/bin/xauth: warning: /usr/4lib/libXmu.so.4.0: has older revision than expected 10 Sun Jun 13 17:25:15 PDT 1999 bash-2.02$The downside of this is that you will probably need to type in your passwd once each time you log in. The upside is that once you get your .shosts file set up, then you can run a script of cvs commands to add your changes.