SlideShare a Scribd company logo
Secure Shell (SSH)
Presented By
Scott Duckworth
April 19, 2007
April 19, 2007 Scott Duckworth 2
What is SSH?
 “SSH is a protocol for secure remote
login and other secure network services
over an insecure network.” – RFC 4251
 Secure channel between two computers
• Provides data confidentiality and integrity
 Many uses other than remote shell
April 19, 2007 Scott Duckworth 3
History
 SSH-1 designed in 1995 by Tatu Ylönen
• In response to a password-sniffing attack
• Replacement for rlogin, telnet, and rsh
• Released as freeware in July 1995
• ~20,000 users in 50 countries by the end of
the year
 Ylönen founded SSH Communications
Security in December 1995
• Code became increasingly more proprietary
April 19, 2007 Scott Duckworth 4
History (continued)
 SSH-2 designed in 1996
• Incompatible with SSH-1
• Security and feature improvements
 Open source implementations (OSSH
and OpenSSH) created in 1999
• OSSH is now obsolete
• OpenSSH is the most popular SSH
implementation as of 2005
April 19, 2007 Scott Duckworth 5
Current Implementations (2007)
 OpenSSH – common on UNIX systems
 SSH Tectia – commercial implementation
 PuTTY – client only, Windows
 MindTerm – client only, Java applet
April 19, 2007 Scott Duckworth 6
Layering of SSH Protocols
 Transport Layer Protocol
• Provides server authentication, confidentiality,
and integrity
 User Authentication Protocol
• Authenticates the client-side user to the server
 Connection Protocol
• Multiplexes the tunnel into logical channels
 New protocols can coexist with the
existing ones
April 19, 2007 Scott Duckworth 7
Transport Layer Protocol
 Public-key host authentication
• Lets the client know the correct server is on the other end
• DSS or RSA, raw or through OpenPGP
 Strong symmetric encryption
• Uses Diffie-Hellman algorithm for secure key exchange
• Many ciphers are supported: 3des, blowfish, twofish, aes,
etc., most with multiple key sizes
• New keys generated every 1 GB or 1 hour
 Data integrity via MACs (message authentication
codes)
• SHA-1 and MD5 are supported
April 19, 2007 Scott Duckworth 8
User Authentication Protocol
 Multiple authentication methods
• public-key, password, host-based
• Extensible
 Server tells client which methods can be
used, client picks the most convenient
 Provides a single authenticated channel
to the connection protocol
April 19, 2007 Scott Duckworth 9
Connection Protocol
 Provides multiple channels:
• interactive login sessions
• remote execution of commands
• forwarded X11 connections
• forwarded TCP/IP connections
 All channels are multiplexed into a single
encryption tunnel
April 19, 2007 Scott Duckworth 10
Attacks on SSH
 Man-in-the-middle
• Very easy if the client
does not have the
server’s public key
prior to connecting
• Attacker masquerades
between the client and
server
 Denial of service
 Covert channels Server
Attacker
Client
April 19, 2007 Scott Duckworth 11
System Configuration Files
(OpenSSH)
 /etc/ssh/
• sshd_config – SSH server configuration
• ssh_config – SSH client configuration
• ssh_host_*_key – private host keys
• ssh_host_*_key.pub – public host keys
• ssh_known_hosts – list of known public host
keys
April 19, 2007 Scott Duckworth 12
User Configuration Files
(OpenSSH)
 ~/.ssh/
• id_* - private authentication keys
• id_*.pub – public authentication keys
• known_hosts – list of known public host keys
• authorized_keys – list of allowed public
authentication keys
April 19, 2007 Scott Duckworth 13
Public-Key Authentication Howto
$ ssh-keygen -t rsa
...
$ cat ~/.ssh/id_rsa.pub | ssh <remote-host> 'cat - >> ~/.ssh/authorized_keys‘
...
$ ssh <remote-host>
...
Accept the defaults and
leave the passphrase blank
Enter your password
one last time
Enjoy not having to enter
a password
April 19, 2007 Scott Duckworth 14
References and Resources
 RFC 4250-4254
 SSH: The Secure Shell – The Definitive
Guide
• http://www.snailbook.com/index.html
 http://en.wikipedia.org/wiki/Secure_Shell
 http://www.cs.clemson.edu/~duckwos/ssh_lab/
Ad

More Related Content

What's hot (20)

Introduction to SSH
Introduction to SSHIntroduction to SSH
Introduction to SSH
Hemant Shah
 
SSH - Secure Shell
SSH - Secure ShellSSH - Secure Shell
SSH - Secure Shell
Peter R. Egli
 
(Mis)trusting and (ab)using ssh
(Mis)trusting and (ab)using ssh(Mis)trusting and (ab)using ssh
(Mis)trusting and (ab)using ssh
morisson
 
Telnet & SSH Configuration
Telnet & SSH ConfigurationTelnet & SSH Configuration
Telnet & SSH Configuration
Vinod Gour
 
Derbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active Directory
Will Schroeder
 
Basics of ssl
Basics of sslBasics of ssl
Basics of ssl
n|u - The Open Security Community
 
Dns security
Dns securityDns security
Dns security
Dhaval Kapil
 
SSH.ppt
SSH.pptSSH.ppt
SSH.ppt
joekr1
 
Secure shell ppt
Secure shell pptSecure shell ppt
Secure shell ppt
sravya raju
 
SSL TLS Protocol
SSL TLS ProtocolSSL TLS Protocol
SSL TLS Protocol
Devang Badrakiya
 
Ssh cookbook
Ssh cookbookSsh cookbook
Ssh cookbook
Jean-Marie Renouard
 
Room 2 - 1 - Phạm Quang Minh - A real DevOps culture in practice
Room 2 - 1 - Phạm Quang Minh - A real DevOps culture in practiceRoom 2 - 1 - Phạm Quang Minh - A real DevOps culture in practice
Room 2 - 1 - Phạm Quang Minh - A real DevOps culture in practice
Vietnam Open Infrastructure User Group
 
Ssh tunnel
Ssh tunnelSsh tunnel
Ssh tunnel
Amandeep Singh
 
Telnet & SSH
Telnet & SSHTelnet & SSH
Telnet & SSH
NetProtocol Xpert
 
Ip sec and ssl
Ip sec and  sslIp sec and  ssl
Ip sec and ssl
Mohd Arif
 
SIP over TLS
SIP over TLSSIP over TLS
SIP over TLS
Hossein Yavari
 
Tcpdump
TcpdumpTcpdump
Tcpdump
Sourav Roy
 
Linux User Management
Linux User ManagementLinux User Management
Linux User Management
Gaurav Mishra
 
Secure socket layer
Secure socket layerSecure socket layer
Secure socket layer
Nishant Pahad
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHound
DirkjanMollema
 

Similar to ssh.ppt (20)

Team 5 presentation
Team 5 presentationTeam 5 presentation
Team 5 presentation
rob420
 
0696-ssh-the-secure-shell.pdf
0696-ssh-the-secure-shell.pdf0696-ssh-the-secure-shell.pdf
0696-ssh-the-secure-shell.pdf
AnasElbaz
 
Telnet presentation
Telnet presentationTelnet presentation
Telnet presentation
travel_affair
 
Ssh
SshSsh
Ssh
gh02
 
Linux Servers
Linux ServersLinux Servers
Linux Servers
Shafaan Khaliq Bhatti
 
An Introduction to BLUETOOTH TECHNOLOGY
An Introduction to BLUETOOTH TECHNOLOGYAn Introduction to BLUETOOTH TECHNOLOGY
An Introduction to BLUETOOTH TECHNOLOGY
Vikas Jagtap
 
Amit
AmitAmit
Amit
Vikas Jagtap
 
Share File easily between computers using sftp
Share File easily between computers using sftpShare File easily between computers using sftp
Share File easily between computers using sftp
Tushar B Kute
 
CryptoStandards and protocols for digital secure communications
CryptoStandards and protocols for digital secure communicationsCryptoStandards and protocols for digital secure communications
CryptoStandards and protocols for digital secure communications
bipinbhattarai12
 
linux pppt for introduction of the Linux
linux pppt for introduction of the Linuxlinux pppt for introduction of the Linux
linux pppt for introduction of the Linux
harjinderkaur06126
 
Linux - Introductions to Linux Operating System
Linux - Introductions to Linux Operating SystemLinux - Introductions to Linux Operating System
Linux - Introductions to Linux Operating System
Vibrant Technologies & Computers
 
Ipc
IpcIpc
Ipc
Spoorthi Sham
 
Linux basics
Linux basicsLinux basics
Linux basics
BiplabaSamantaray
 
Meeting 5.2 : ssh
Meeting 5.2 : sshMeeting 5.2 : ssh
Meeting 5.2 : ssh
Syaiful Ahdan
 
Linux Operating System.pptx
Linux Operating System.pptxLinux Operating System.pptx
Linux Operating System.pptx
PuneetVishwakarma11
 
Filr 2015
Filr 2015 Filr 2015
Filr 2015
Finceptum Oy
 
Mail server on linux
Mail server on linux Mail server on linux
Mail server on linux
Roshni17
 
History of L0phtCrack
History of L0phtCrackHistory of L0phtCrack
History of L0phtCrack
cwysopal
 
IP security and VPN presentation
IP security and VPN presentation IP security and VPN presentation
IP security and VPN presentation
KishoreTs3
 
Status of Embedded Linux
Status of Embedded LinuxStatus of Embedded Linux
Status of Embedded Linux
LinuxCon ContainerCon CloudOpen China
 
Team 5 presentation
Team 5 presentationTeam 5 presentation
Team 5 presentation
rob420
 
0696-ssh-the-secure-shell.pdf
0696-ssh-the-secure-shell.pdf0696-ssh-the-secure-shell.pdf
0696-ssh-the-secure-shell.pdf
AnasElbaz
 
Ssh
SshSsh
Ssh
gh02
 
An Introduction to BLUETOOTH TECHNOLOGY
An Introduction to BLUETOOTH TECHNOLOGYAn Introduction to BLUETOOTH TECHNOLOGY
An Introduction to BLUETOOTH TECHNOLOGY
Vikas Jagtap
 
Share File easily between computers using sftp
Share File easily between computers using sftpShare File easily between computers using sftp
Share File easily between computers using sftp
Tushar B Kute
 
CryptoStandards and protocols for digital secure communications
CryptoStandards and protocols for digital secure communicationsCryptoStandards and protocols for digital secure communications
CryptoStandards and protocols for digital secure communications
bipinbhattarai12
 
linux pppt for introduction of the Linux
linux pppt for introduction of the Linuxlinux pppt for introduction of the Linux
linux pppt for introduction of the Linux
harjinderkaur06126
 
Mail server on linux
Mail server on linux Mail server on linux
Mail server on linux
Roshni17
 
History of L0phtCrack
History of L0phtCrackHistory of L0phtCrack
History of L0phtCrack
cwysopal
 
IP security and VPN presentation
IP security and VPN presentation IP security and VPN presentation
IP security and VPN presentation
KishoreTs3
 
Ad

Recently uploaded (20)

Level 1-Safety.pptx Presentation of Electrical Safety
Level 1-Safety.pptx Presentation of Electrical SafetyLevel 1-Safety.pptx Presentation of Electrical Safety
Level 1-Safety.pptx Presentation of Electrical Safety
JoseAlbertoCariasDel
 
Smart_Storage_Systems_Production_Engineering.pptx
Smart_Storage_Systems_Production_Engineering.pptxSmart_Storage_Systems_Production_Engineering.pptx
Smart_Storage_Systems_Production_Engineering.pptx
rushikeshnavghare94
 
Fort night presentation new0903 pdf.pdf.
Fort night presentation new0903 pdf.pdf.Fort night presentation new0903 pdf.pdf.
Fort night presentation new0903 pdf.pdf.
anuragmk56
 
IntroSlides-April-BuildWithAI-VertexAI.pdf
IntroSlides-April-BuildWithAI-VertexAI.pdfIntroSlides-April-BuildWithAI-VertexAI.pdf
IntroSlides-April-BuildWithAI-VertexAI.pdf
Luiz Carneiro
 
ELectronics Boards & Product Testing_Shiju.pdf
ELectronics Boards & Product Testing_Shiju.pdfELectronics Boards & Product Testing_Shiju.pdf
ELectronics Boards & Product Testing_Shiju.pdf
Shiju Jacob
 
theory-slides-for react for beginners.pptx
theory-slides-for react for beginners.pptxtheory-slides-for react for beginners.pptx
theory-slides-for react for beginners.pptx
sanchezvanessa7896
 
DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...
DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...
DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...
charlesdick1345
 
Process Parameter Optimization for Minimizing Springback in Cold Drawing Proc...
Process Parameter Optimization for Minimizing Springback in Cold Drawing Proc...Process Parameter Optimization for Minimizing Springback in Cold Drawing Proc...
Process Parameter Optimization for Minimizing Springback in Cold Drawing Proc...
Journal of Soft Computing in Civil Engineering
 
Reagent dosing (Bredel) presentation.pptx
Reagent dosing (Bredel) presentation.pptxReagent dosing (Bredel) presentation.pptx
Reagent dosing (Bredel) presentation.pptx
AlejandroOdio
 
DSP and MV the Color image processing.ppt
DSP and MV the  Color image processing.pptDSP and MV the  Color image processing.ppt
DSP and MV the Color image processing.ppt
HafizAhamed8
 
"Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E...
"Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E..."Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E...
"Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E...
Infopitaara
 
Lidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptx
Lidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptxLidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptx
Lidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptx
RishavKumar530754
 
AI-assisted Software Testing (3-hours tutorial)
AI-assisted Software Testing (3-hours tutorial)AI-assisted Software Testing (3-hours tutorial)
AI-assisted Software Testing (3-hours tutorial)
Vəhid Gəruslu
 
RICS Membership-(The Royal Institution of Chartered Surveyors).pdf
RICS Membership-(The Royal Institution of Chartered Surveyors).pdfRICS Membership-(The Royal Institution of Chartered Surveyors).pdf
RICS Membership-(The Royal Institution of Chartered Surveyors).pdf
MohamedAbdelkader115
 
International Journal of Distributed and Parallel systems (IJDPS)
International Journal of Distributed and Parallel systems (IJDPS)International Journal of Distributed and Parallel systems (IJDPS)
International Journal of Distributed and Parallel systems (IJDPS)
samueljackson3773
 
211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf
211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf
211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf
inmishra17121973
 
ADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITY
ADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITYADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITY
ADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITY
ijscai
 
Smart Storage Solutions.pptx for production engineering
Smart Storage Solutions.pptx for production engineeringSmart Storage Solutions.pptx for production engineering
Smart Storage Solutions.pptx for production engineering
rushikeshnavghare94
 
π0.5: a Vision-Language-Action Model with Open-World Generalization
π0.5: a Vision-Language-Action Model with Open-World Generalizationπ0.5: a Vision-Language-Action Model with Open-World Generalization
π0.5: a Vision-Language-Action Model with Open-World Generalization
NABLAS株式会社
 
Value Stream Mapping Worskshops for Intelligent Continuous Security
Value Stream Mapping Worskshops for Intelligent Continuous SecurityValue Stream Mapping Worskshops for Intelligent Continuous Security
Value Stream Mapping Worskshops for Intelligent Continuous Security
Marc Hornbeek
 
Level 1-Safety.pptx Presentation of Electrical Safety
Level 1-Safety.pptx Presentation of Electrical SafetyLevel 1-Safety.pptx Presentation of Electrical Safety
Level 1-Safety.pptx Presentation of Electrical Safety
JoseAlbertoCariasDel
 
Smart_Storage_Systems_Production_Engineering.pptx
Smart_Storage_Systems_Production_Engineering.pptxSmart_Storage_Systems_Production_Engineering.pptx
Smart_Storage_Systems_Production_Engineering.pptx
rushikeshnavghare94
 
Fort night presentation new0903 pdf.pdf.
Fort night presentation new0903 pdf.pdf.Fort night presentation new0903 pdf.pdf.
Fort night presentation new0903 pdf.pdf.
anuragmk56
 
IntroSlides-April-BuildWithAI-VertexAI.pdf
IntroSlides-April-BuildWithAI-VertexAI.pdfIntroSlides-April-BuildWithAI-VertexAI.pdf
IntroSlides-April-BuildWithAI-VertexAI.pdf
Luiz Carneiro
 
ELectronics Boards & Product Testing_Shiju.pdf
ELectronics Boards & Product Testing_Shiju.pdfELectronics Boards & Product Testing_Shiju.pdf
ELectronics Boards & Product Testing_Shiju.pdf
Shiju Jacob
 
theory-slides-for react for beginners.pptx
theory-slides-for react for beginners.pptxtheory-slides-for react for beginners.pptx
theory-slides-for react for beginners.pptx
sanchezvanessa7896
 
DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...
DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...
DATA-DRIVEN SHOULDER INVERSE KINEMATICS YoungBeom Kim1 , Byung-Ha Park1 , Kwa...
charlesdick1345
 
Reagent dosing (Bredel) presentation.pptx
Reagent dosing (Bredel) presentation.pptxReagent dosing (Bredel) presentation.pptx
Reagent dosing (Bredel) presentation.pptx
AlejandroOdio
 
DSP and MV the Color image processing.ppt
DSP and MV the  Color image processing.pptDSP and MV the  Color image processing.ppt
DSP and MV the Color image processing.ppt
HafizAhamed8
 
"Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E...
"Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E..."Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E...
"Boiler Feed Pump (BFP): Working, Applications, Advantages, and Limitations E...
Infopitaara
 
Lidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptx
Lidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptxLidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptx
Lidar for Autonomous Driving, LiDAR Mapping for Driverless Cars.pptx
RishavKumar530754
 
AI-assisted Software Testing (3-hours tutorial)
AI-assisted Software Testing (3-hours tutorial)AI-assisted Software Testing (3-hours tutorial)
AI-assisted Software Testing (3-hours tutorial)
Vəhid Gəruslu
 
RICS Membership-(The Royal Institution of Chartered Surveyors).pdf
RICS Membership-(The Royal Institution of Chartered Surveyors).pdfRICS Membership-(The Royal Institution of Chartered Surveyors).pdf
RICS Membership-(The Royal Institution of Chartered Surveyors).pdf
MohamedAbdelkader115
 
International Journal of Distributed and Parallel systems (IJDPS)
International Journal of Distributed and Parallel systems (IJDPS)International Journal of Distributed and Parallel systems (IJDPS)
International Journal of Distributed and Parallel systems (IJDPS)
samueljackson3773
 
211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf
211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf
211421893-M-Tech-CIVIL-Structural-Engineering-pdf.pdf
inmishra17121973
 
ADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITY
ADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITYADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITY
ADVXAI IN MALWARE ANALYSIS FRAMEWORK: BALANCING EXPLAINABILITY WITH SECURITY
ijscai
 
Smart Storage Solutions.pptx for production engineering
Smart Storage Solutions.pptx for production engineeringSmart Storage Solutions.pptx for production engineering
Smart Storage Solutions.pptx for production engineering
rushikeshnavghare94
 
π0.5: a Vision-Language-Action Model with Open-World Generalization
π0.5: a Vision-Language-Action Model with Open-World Generalizationπ0.5: a Vision-Language-Action Model with Open-World Generalization
π0.5: a Vision-Language-Action Model with Open-World Generalization
NABLAS株式会社
 
Value Stream Mapping Worskshops for Intelligent Continuous Security
Value Stream Mapping Worskshops for Intelligent Continuous SecurityValue Stream Mapping Worskshops for Intelligent Continuous Security
Value Stream Mapping Worskshops for Intelligent Continuous Security
Marc Hornbeek
 
Ad

ssh.ppt

  • 1. Secure Shell (SSH) Presented By Scott Duckworth April 19, 2007
  • 2. April 19, 2007 Scott Duckworth 2 What is SSH?  “SSH is a protocol for secure remote login and other secure network services over an insecure network.” – RFC 4251  Secure channel between two computers • Provides data confidentiality and integrity  Many uses other than remote shell
  • 3. April 19, 2007 Scott Duckworth 3 History  SSH-1 designed in 1995 by Tatu Ylönen • In response to a password-sniffing attack • Replacement for rlogin, telnet, and rsh • Released as freeware in July 1995 • ~20,000 users in 50 countries by the end of the year  Ylönen founded SSH Communications Security in December 1995 • Code became increasingly more proprietary
  • 4. April 19, 2007 Scott Duckworth 4 History (continued)  SSH-2 designed in 1996 • Incompatible with SSH-1 • Security and feature improvements  Open source implementations (OSSH and OpenSSH) created in 1999 • OSSH is now obsolete • OpenSSH is the most popular SSH implementation as of 2005
  • 5. April 19, 2007 Scott Duckworth 5 Current Implementations (2007)  OpenSSH – common on UNIX systems  SSH Tectia – commercial implementation  PuTTY – client only, Windows  MindTerm – client only, Java applet
  • 6. April 19, 2007 Scott Duckworth 6 Layering of SSH Protocols  Transport Layer Protocol • Provides server authentication, confidentiality, and integrity  User Authentication Protocol • Authenticates the client-side user to the server  Connection Protocol • Multiplexes the tunnel into logical channels  New protocols can coexist with the existing ones
  • 7. April 19, 2007 Scott Duckworth 7 Transport Layer Protocol  Public-key host authentication • Lets the client know the correct server is on the other end • DSS or RSA, raw or through OpenPGP  Strong symmetric encryption • Uses Diffie-Hellman algorithm for secure key exchange • Many ciphers are supported: 3des, blowfish, twofish, aes, etc., most with multiple key sizes • New keys generated every 1 GB or 1 hour  Data integrity via MACs (message authentication codes) • SHA-1 and MD5 are supported
  • 8. April 19, 2007 Scott Duckworth 8 User Authentication Protocol  Multiple authentication methods • public-key, password, host-based • Extensible  Server tells client which methods can be used, client picks the most convenient  Provides a single authenticated channel to the connection protocol
  • 9. April 19, 2007 Scott Duckworth 9 Connection Protocol  Provides multiple channels: • interactive login sessions • remote execution of commands • forwarded X11 connections • forwarded TCP/IP connections  All channels are multiplexed into a single encryption tunnel
  • 10. April 19, 2007 Scott Duckworth 10 Attacks on SSH  Man-in-the-middle • Very easy if the client does not have the server’s public key prior to connecting • Attacker masquerades between the client and server  Denial of service  Covert channels Server Attacker Client
  • 11. April 19, 2007 Scott Duckworth 11 System Configuration Files (OpenSSH)  /etc/ssh/ • sshd_config – SSH server configuration • ssh_config – SSH client configuration • ssh_host_*_key – private host keys • ssh_host_*_key.pub – public host keys • ssh_known_hosts – list of known public host keys
  • 12. April 19, 2007 Scott Duckworth 12 User Configuration Files (OpenSSH)  ~/.ssh/ • id_* - private authentication keys • id_*.pub – public authentication keys • known_hosts – list of known public host keys • authorized_keys – list of allowed public authentication keys
  • 13. April 19, 2007 Scott Duckworth 13 Public-Key Authentication Howto $ ssh-keygen -t rsa ... $ cat ~/.ssh/id_rsa.pub | ssh <remote-host> 'cat - >> ~/.ssh/authorized_keys‘ ... $ ssh <remote-host> ... Accept the defaults and leave the passphrase blank Enter your password one last time Enjoy not having to enter a password
  • 14. April 19, 2007 Scott Duckworth 14 References and Resources  RFC 4250-4254  SSH: The Secure Shell – The Definitive Guide • http://www.snailbook.com/index.html  http://en.wikipedia.org/wiki/Secure_Shell  http://www.cs.clemson.edu/~duckwos/ssh_lab/