Security

There have been several security issues identified with the SSH. Also Security web sites have noticed recently that hackers have been running scans searching the SSH service and trying to crack a login and password into systems. This brings up some all important issues when dealing with the SSH program.

First off the latest version of SSH should always be installed. As of this post the latest version of OpenSSH is 3.9 released Aug 17, 2004. The second thing to do is ensure your public and private keys are secured with proper file permissions.

These two steps fix the majority of the issues people have had with the SSH agent. Occasionally there are issues of password brute force attempts. Ensuring you use a strong password is the first step along with safeguarding your public and private keys.

The Network scanning site has identified several security issues with version 2.3.1, 2.5.x, 3.0.1 and port forwarding with 2.3.0.

I have also identified a security issue when you are using X11 Forwarding in that the connection is a two way connection and anyone you can connect to can connect back into you.
************************************* UPDATE **************************
Geekspeek.org has a post on some security steps to take when configuring SSH, the file which needs to be reconfigured is /etc/ssh/sshd_config. The one main difference which isn't covered in the configuration post is the line which reads: Protocol 2; if there is a 1 after the 2, remove the 1. This tells SSH which versions of SSH to run. there are too many security issues with the first version of SSH to even consider running. There is also a comment regarding the UsePrivilegeSeparation line which the only information I've been able to find is that this feature is not compatible with SSH version 3.2 or earlier.

To return to the main directory for SSH Tutorials.

Port Forwarding

Port Forwarding can be used to encrypt email, web or any other traffic through the internet. Port Forwarding can also be used to bypass restrictive firewalls.

There are two types of Port Forwarding: Local and Remote. Local forwarding allows you to open a port on YOUR machine and associate it with a port on some remote network. such as User => port on user's box => ssh => linuxbox => mail port on email server. Remote forwarding work the same way, but backwards.

The ssh program can be told to listen on any port either on the remote or local computer, forward any service or data through the encrypted connection, and sent it to some other destination from the other end.

The main command will be ssh -f -N -L9999:mailhost:9999
-f switch tells ssh to run in the background
-N switch tells ssh to not actually run the command just do the forwarding
-L switch tells ssh which local machine to connect to. You can specify as many -L lines as you like
-C switch tells ssh to use compression

a good example is ssh -f remotesystem cat secretdata | lpr
which tells ssh to connect to remotesystem and send the information in secretdata to the printer.

Another example is to set your Linux box up to accept ssh connections and then connect to your box through an IE browser to bypass firewall restrictions. Descriptions for such a connection can be found on the buzzsurf web site.

To return to the main directory for SSH tutorials.

X11 Forwwarding

X11 forwarding allows a user to connect to a remote machine and open a connection to the X11 interface on the remote machine.

Some uses for X11 forwarding are to set up VNC connections or for ethereal connections to capture packets.

Some security issues to remind users of are the fact that if you can see what is happening on someone else's machine through SSH, they can do the same to you. If you use weak file permissions this will allow someone to have access to your system. The Hacking Linux Exposed site covers this vulnerability. With this in mind let's look at how we can set up X11 Forwarding.

The guide can be found here.
Starting up an X11 connection is done through the command:
ssh -X

You also need to ensure X11 connections are enabled on the server you are conencting to.
On the machine you are going to connect to the sshd2_config file needs this line added:
AllowX11Forwarding yes

Also X11 forwarding needs to be enabled within your sshd_config file with the following line:
X11Forwarding yes

To return to the main directory for SSH tutorials.