www.csua.berkeley.edu/ssh-howto.html
It provides strong authentication and secure communications over insecure channels. It is intended as a replacement for rlogin, rsh, and rcp. SSH protects the user from illicit network snooping ("packet sniffing"), whereby un-encrypted passwords and text can be read by unscrupulous persons. SSH is most useful for logging into a UNIX computer from a Windows or Mac computer or from another UNIX computer, where the traditional 'telnet' and 'rlogin' programs would not provide password and session encryption; SSH serves a purpose that is similar to Kerberos, but it works consistently amongst different operating systems and is easier to administer (no ticket- server is required, sysadmin privileges are not required to set it up). SSH Public and Private KEYS: --------------------------- When you first use ssh, it asks you to invent an "RSA indentity passphrase". The "identity" file should not be readable by anyone but you. On Windows, they are typically located in your lop-level home directory folder. Using SSH on UNIX ----------------- SSH and related programs are available on all CSUA systems in the /usr/local/bin directory. That password will be safely encrypted before it goes across the net to soda, and so will everything else you type once you are logged into soda. You can generate a public key (sort of like a Kerberos ticket) that will let you login to UNIX accounts that without typing your SSH password each time. When you first login to your local workstation, run "ssh-agent" and give it your passphrase. There are also free implementations of SSH for Windows available; To use F-Secure SSH for Windows: 1) Start the F-Secure program (click on icon, select from menu or etc). Enter the computer name, login name and password here and press "OK". Select "Properties" from the "Edit" menu and use "browse" to find these files under your home directory folder. The files are created the first time you use F-Secure in that particular account. MACINTOSH: - MacSSH is a modified version of BetterTelnet with SSH2 support. Features -------- SSH has a number of excellent security features beyond the basic encryption of your password and login session as they pass over the net. SSH can provide a stronger encryption algorithm ("RSA") and it can allow X11 and other network protocols to securely "tunnel" through your encrypted SSH session as they pass over the net. SSH commands include: sshd Server program run on the server machine. This listens for connections from client machines, and whenever it receives a connection, it performs authentication and starts serving the client. For more infomation, see the manual pages ssh, sshd, scp, ssh-keygen, ssh-agent, ssh-add, and make-ssh-known-hosts. It will fall back to standard rlogin/rsh when the remote host does not support SSH, and yet when the remote host *does* support rlogin/rsh, the differences between an SSH and an rsh connection are almost completely invisible to the user; In this system, you start an authentication broker called the 'ssh-agent' which responds to remote hosts' requests to authenticate you, and you authenticate yourself *once* to the ssh-agent at the beginning of your session on the workstation. Further authentications, as required, are directed to your ssh-agent, obviating the need for you to type your password at the start of each new network connection. How to Set Up SSH-Agent ----------------------- When you first use ssh-agent anywhere on the network, you will need to generate your SSH key pair. You can do this by typing 'ssh-keygen' to the shell prompt. Your workstation will grind for a bit and then ask you where to save the key; The security of your passphrase is of the utmost importance, because in order for ssh-agent to be of much use, your passphrase must serve to authenticate you to any machine you wish to use. This basically means that your SSH passphrase is a password that works on all the accounts of all the machines you use. Obviously, therefore, if someone figures out your SSH passphrase, they have access to all the machines you use; Therefore, you should take care never to type your SSH passphrase over an unencrypted network stream. If you do have insecure connections, don't enter your passphrase. Just hit return, and you can enter your UNIX password instead, or you can hit return again, log out of the insecure network connection, and try again from a secure host. Enabling Secure Remote Access Without Passwords ----------------------------------------------- As noted above, SSH RSA authentication relies on a broker known as the ssh-agent. This does not depend on your shell, and is a command of the form "ssh-add". However, in order for ssh-add to realize that it ought to bring up an X window to authenticate you, you have to redirect its standard input to /dev/null; Originally written 9/98 and revised 10/98 by the EECS Instructional & Electronics Support Group for the Instructional UNIX machines;
|
http://csua.com/feed/