SSH
Introduction (Rog Smith)
Security is job one.
In a switched environment like UNC's campus network, the user generally doesn't have to worry too much about someone coming along and sniffing their connection. However, since all of our boxes are hanging off a hub, it is very easy for a telnet session to be sniffed and the user not even know. Suddenly, her account is compromised and quite possibly the integrity of the box as a whole.
That's where ssh comes in. As the readme says:
SSH (Secure Shell) is a program to log into another computer over a
network, to execute commands in a remote machine, and to move files
from one machine to another. It provides strong authentication and
secure communications over insecure channels. It is intended as a
replacement for rlogin, rsh, rcp, and rdist.
This file documents our adventures installing ssh and cranking the sshd for logins. You can view the script of our excursion here.
Narrative (Adam Fuller, Rajiv Zutshi)
Aquiring ssh was no biggie. Downloaded from ftp://metalab.unc.edu/pub/packages/security/ssh was a copy of ssh-1.2.26.tar.gz. We didn't install the latest version, 2.0.10, because Adam had noted how he never got that version to work. So we went with 1.2.26 since Adam knew how to install that and because it was still widely used and fairly bulletproof.
At the command line we ran these commands:
[magenta.ils.unc.edu]</usr/local/src>% gunzip -c ssh-1.2.26.tar.gz | tar xvf -
[magenta.ils.unc.edu]</usr/local/src>% cd ssh-1.2.26
We took a gander at the README file and then moved on to the INSTALL file. The instructions told us to just do the basic './configure; make; make install', but Adam advised against it, saying we had to run those commands in /usr/local/src/ssh-1.2.26/gmp-2.0.2-ssh-2 first.
When queried why we should do that, Adam professed ignorance, but we decided to go ahead and investigate the gmp-2.0.2-ssh-2 directory first. Turns out it is a crucial part of the encryption package:
[magenta.ils.unc.edu]</usr/local/src/ssh-1.2.26/gmp-2.0.2-ssh-2>% more README
THIS IS A MODIFIED VERSION OF GMP-2.0.2. THE MODIFICATIONS WERE MADE
TO INTEGRATE THIS CODE TO THE SSH SOFTWARE PACKAGE. PLEASE CONTACT
ssh-bugs@cs.hut.fi IF MORE INFORMATION IS NEEDED.
-------------------------------------------------------------------------
THE GNU MP LIBRARY
GNU MP is a library for arbitrary precision arithmetic, operating on signed
integers, rational numbers, and floating point numbers. It has a rich set
of functions, and the functions have a regular interface.
GNU MP is designed to be as fast as possible, both for small operands and for
huge operands. The speed is achieved by using fullwords as the basic
arithmetic type, by using fast algorithms, by carefully optimized assembly
code for the most common inner loops for a lots of CPUs, and by a general
emphasis on speed (instead of simplicity or elegance).
The speed of GNU MP is believed to be faster than any other similar library.
The advantage for GNU MP increases with the operand sizes for certain
operations, since GNU MP in many cases has asymptotically faster algorithms.
We ran the magical commands './configure; make' as instructed by the INSTALL file. We didn't compile a test program, and instead went ahead and cd .. and './configure; make; make install' the ssh distribution.
Everything compiled beautifully. A quick test proved our success:
[magenta.ils.unc.edu]</usr/local/src/ssh-1.2.26>% ssh mothra.metalab.unc.edu -l fuller
Host key not found from the list of known hosts.
Are you sure you want to continue connecting (yes/no)? yes
Host 'mothra.metalab.unc.edu' added to the list of known hosts.
Creating random seed file ~/.ssh/random_seed. This may take a while.
fuller@mothra.metalab.unc.edu's password:
Last login: Mon Feb 1 14:24:12 1999 from :0
Sun Microsystems Inc. SunOS 5.7 Generic October 1998
No mail.
mothra's uptime
7:43pm up 6 day(s), 6:32, 2 users, load average: 0.02, 0.01, 0.01
To Do
-------
- Fix rsync for kernel.org
- Upgrade President and Franklin to Solaris 2.7
- Rearrange sock drawer
- ResNet meeting Tuesday at 7pm
- Meet advisor Wednesday at 12:15
- TriLUG non-Intel architecture panel on Feb. 11!!
- eye appointment Feb 24, 10am
[mothra]</export/sunsite/users/fuller>%
Next we wanted to crank up the sshd server so we could login to magenta using ssh instead of the weak 'telnet'. INSTALL instructed us not to install and run the server through inetd, but rather to add it to whatever /etc/rc we use. We added it to /etc/rc.d/rc.local and rebooted:
[magenta.ils.unc.edu]</etc/rc.d>% tail rc.local
cp -f /etc/issue /etc/issue.net
echo >> /etc/issue
fi
# crank up sshd
/usr/local/sbin/sshd
# crank up apache
/usr/local/sbin/apachectl start
[magenta.ils.unc.edu]</etc/rc.d>%
A quick test proved our success:
[mothra]</export/sunsite/users/fuller>% ssh magenta.ils.unc.edu -l adam
adam@magenta.ils.unc.edu's password:
Last login: Mon Feb 1 14:17:57 1999 from mothra.metalab.unc.edu
"More than enough rope."
You have new mail.
[magenta.ils.unc.edu]</home/users/adam>%
Functionality (Travis Angle)
We installed a sniffer on our box to prove how essential ssh is. Normally, this specific sniffer (sniffit) could log input and output to any box hanging off our hub. We get everything decoded and in easy to read format. But while we monitored our connections, all we saw was undecipherable garbage:
*------------------------------------------------------------*
|.....z..q.K.......3#..6.}....d......s..C...4[.%...Od.....e..|
|92F~@.>.(F.+x2z....Ks...........*.k.m.*..=..q9.|JC..........|
|......K.G.h}O.>...7;4......0...I...;.N.....P...o.3...Th.x.$.|
|y.......$0.&......I.......v.Gv...&Y....K.......pSK..dy..,1..|
|..K....L..{b..CxJ)....L*5....j....IJ........t7..8......I.A..|
|......7t.`.+..W/Q....J.9.U=....O.I.T....g.G .o.n.v;..^.a....|
|...X/.g.....r?ej......6\.K.h. .+JT>..........?.tu..@ |
| |
*------------------------------------------------------------*
| 152.2.81.94 22 -> 152.19.254.67 1020 |
*------------------------------------------------------------*
This is just from us moving the cursor in vi up and down the screen!
SSH is essential, regardless. This proves it. While we were monitoring our connection, we could see our classmates logging into their boxes using telnet. We could see everything they typed. If only they had been using ssh, it wouldn't have been so easy for us to eavesdrop of them.
February 1, 1999