SSH stands for Secure SHell. It is a program
designed to allow users to log into another computer over a network,
to execute commands on that computer and to move files to and from
that computer. It effectively replaces telnet, ftp and the
rcp/rsh/remsh programs.
The difference between SSH and those other programs is that they
are clear text protocols where as SSH encrypts everything it sends
across the network. The problem with clear text is that anyone who is
"sniffing" the network can see every byte of data you transmit. That
can include all the commands you type. All the images you display
back to your local machine. And it can include your username
and password. There are obvious security problems with this
system.
SSH encrypts all of its data. While no encryption scheme is truly
100% secure, breaking the SSH encryptions would take a tremendous
amount of time and CPU power. The fact is that no casual hacker, or
for that matter very many of the serious ones, are going to have the
resources to dedicate to breaking your data.
SSH has the added benefit of being able to "tunnel" other
protocols. A tunnel is basically an opening on both the local and
remote machines, passing along the SSH connection, that allows other
protocols (example: X, FTP, SMTP and POP3) to piggy back along the
SSH line, encrypting the data all the way.
SSH establishes encrypted connections by the exchange of host
keys. When a remote system gives your local system its host
key it is basically telling your local system how to encrypt data
so that the remote system can then unencrypt it.
When you make an SSH connection to a remote machine, it sends you
its host key. You will then be prompted as to whether or not
you want to accept this key, and/or whether or not you want to store
it for later reference (for the next time you connect to that remote
system). In general you always want to say "yes" to both of these
questions.
Storing of keys is somewhat important. It is one way to make sure
that you are connecting to the correct system. Say someone takes
er4rh016 off line and then puts in their own linux box with the same
hostname (this would be referred to as a "trojan" system, named after
the proverbial horse) and then puts in an SSH daemon. Now when you
try to SSH to it, you are actually connecting to a different machine.
Where that trojan can get caught is that it doesn't have the same SSH
key pairing as the old system. So when you make your SSH connection,
it sends you back a different encryption key. At this point your SSH
client should prompt you saying something to the effect of "Warning,
the remote systems host key has changed. Do you still want to
connect?" At this point you have to decide if you think the remote
system is who it is supposed to be, or not. The safest course of
action is to contact the system's administrator and find out if the
key has been legitimately changed before you connect to the
machine.
For more details on what the SSH protocol is, what it can do, and
where it is going, please see the official SSH FAQ.
This section is written specifically for using SSH under Unix
within the Department of Electrical & Computer Engineering.
As with the programs it replaces, SSH under Unix is a command line
based package. There is no supplied GUI (Graphical User
Interface).
ssh is the SSH equivalent to telnet. It
is used to connect with a terminal session from one system to another.
You will primarily invoke it in one of the following ways:
ssh hostname
ssh -l username hostname
ssh username@hostname
The first simply connects you as though you were using the same
username on the local host as on the remote host. You will be
prompted for your password. The second and third have the same effect
of login you in as username instead of using your local
host's username.
For other options, read the man page.
sftp is the SSH replacement for ftp. It is
invoked in the same manner as ssh:
sftp hostname
sftp username@hostname
Once connected you can use most of the same commands as you do under ftp, including put, get, ls, and cd. You can read the man page for sftp to get a full listing.
scp replaces rcp in SSH. Its base syntax
is as follows:
scp file username@hostname:file
scp username@hostname:file file
The first copies a file from the local machine to the remote machine.
The second copies a file from the remote host to the local host. Full
paths may be put into either file name. username may be
omitted if it is the same on both system.
Again, you can read the man page for full details.
SSH under Unix automatically tunnels pursuant X sessions. Thus
if you ssh from one HP to another you need neither run
the xhost command on the local machine, nor do you need to set your
DISPLAY variable on the remote machine. All your X displays
(xterms, browsers, matlab, whatever) automatically go through your
SSH tunnel with no additional steps on your part.
- OpenSSH is a free version of the SSH protocol.
- ssh.com licenses their software for Academic and Non-Commercial use.
