From owner-freebsd-security Sat Mar 30 7:38:45 2002 Delivered-To: freebsd-security@freebsd.org Received: from m5.andara.com (m5-real.eastlink.ca [24.222.0.25]) by hub.freebsd.org (Postfix) with ESMTP id DB0DD37B405 for ; Sat, 30 Mar 2002 07:38:34 -0800 (PST) Received: from xeno (u206n232.hfx.eastlink.ca [24.222.206.232]) by m5.andara.com (8.12.1/8.12.1) with SMTP id g2UFaLju020045; Sat, 30 Mar 2002 11:36:21 -0400 (AST) Message-ID: <004101c1d800$a4a71ee0$6401a8c0@router.unknown.ca> From: "N. J. Cash" To: "Fernando Gleiser" , "Jesper Wallin" Cc: References: <20020328201100.E6672-100000@cactus.fi.uba.ar> Subject: Re: SSH or Telnet? Date: Sat, 30 Mar 2002 11:36:20 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_003E_01C1D7DF.1D16D900" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org This is a multi-part message in MIME format. ------=_NextPart_000_003E_01C1D7DF.1D16D900 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I would also recomend that you restrict access to ssh using = /etc/hosts.allow if you would like some added security to just who all = can ssh to your box. Also, if you're going with ssh *which you should* I would only enable = protocol 2 and restrict user access to ssh using /etc/ssh/sshd_config as = well. AllowUsers user1 user2 user3 etc... DenyUsers root nobody etc... At least if you're really parioned about sshd those steps will let you = sleep a little better at night! : ) N. J. Cash ncash@pei.eastlink.ca ----- Original Message -----=20 From: Fernando Gleiser=20 To: Jesper Wallin=20 Cc: security@FreeBSD.ORG=20 Sent: Thursday, March 28, 2002 7:42 PM Subject: Re: SSH or Telnet? On Thu, 28 Mar 2002, Jesper Wallin wrote: > Hey! > > > I've heard and seen alot of security problems related to SSH = (OpenSSH) and > many of my friends have been playing with alot of 0day exploits for = it.. > Right now I'm running the latest port version of it on a = non-standard port > and hope to be secured with it.. I don't accualy see the reason to = not use > Telnet.. All I know tells me it's old and recommend me running = OpenSSH > instead.. Telnet also had some remote root vulnerabities. Every program has bugs. You need to keep them up to date and apply all = the security fixes. Also, having sshd runing in a non standard port doesn't buy you much. There are scanners which try to verify which service is which port and they will find out it's ssh even if it is listening in port 31337. = =3D0) > > What is the best solution? Ofcause peoples are able to attack me = with > brute-force attacks and it's not encrypted.. well, all the peoples = who've > shell/ssh access are trusted and I think they know what they do.. The people may be trusted, but are you sure you can trust the networks = they are loging in from? Besides sniffing, ssh protects you against other threats: 1. ssh has some protection against IP spoofing. 2. ssh has stronger authentication methods. 3. ssh protects you against session hijacking. 4. ssh lets you authenticate the server to the client. 5. ssh lets you tunnel an insecure protocol (POP, IMAP) through an = encrypted connection You can use an SSL enabled telnet or IPSec for the first four, but I = find ssh easier to set up if all you need is remote login/shell/file = transfer. Fer > > > Anyone have any idea/suggestion? > > //Jesper aka Z3l3zT > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message ------=_NextPart_000_003E_01C1D7DF.1D16D900 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
I would also recomend = that=20 you restrict access to ssh using /etc/hosts.allow if you would like = some=20 added security to just who all can ssh to your box.
 
Also, if you're going = with ssh=20 *which you should* I would only enable protocol 2 and restrict user = access to=20 ssh using /etc/ssh/sshd_config as well.
 
AllowUsers user1 user2 = user3=20 etc...
DenyUsers root nobody etc...
 
At least if you're = really parioned=20 about sshd those steps will let you sleep a little better at night! :=20 )
 
 
 
N. J. Cash
ncash@pei.eastlink.ca
----- Original Message -----
From:=20 Fernando Gleiser
To: Jesper Wallin
Sent: Thursday, March 28, 2002 = 7:42=20 PM
Subject: Re: SSH or = Telnet?

On Thu, 28 Mar 2002, Jesper Wallin wrote:

>=20 Hey!
>
>
> I've heard and seen alot of security = problems=20 related to SSH (OpenSSH) and
> many of my friends have been = playing with=20 alot of 0day exploits for it..
> Right now I'm running the = latest port=20 version of it on a non-standard port
> and hope to be secured = with it..=20 I don't accualy see the reason to not use
> Telnet.. All  I = know=20 tells me it's old and recommend me running OpenSSH
>=20 instead..

Telnet also had some remote root = vulnerabities.
Every=20 program has bugs. You need to keep them up to date and apply all=20 the
security fixes.

Also, having sshd runing in a non = standard port=20 doesn't buy you much.
There are scanners which try to verify which = service=20 is which port and
they will find out it's ssh even if it is = listening in=20 port 31337. =3D0)

>
> What is the best solution? = Ofcause peoples=20 are able to attack me with
> brute-force attacks and it's not=20 encrypted.. well, all the peoples who've
> shell/ssh access are = trusted=20 and I think they know what they do..

The people may be trusted, = but are=20 you sure you can trust the networks they are
loging in = from?

Besides=20 sniffing, ssh protects you against other threats:

1. ssh has = some=20 protection against IP spoofing.
2. ssh has stronger authentication=20 methods.
3. ssh protects you against session hijacking.
4. ssh = lets you=20 authenticate the server to the client.
5. ssh lets you tunnel an = insecure=20 protocol (POP, IMAP) through an encrypted
  =20 connection

You can use an SSL enabled telnet or IPSec for the = first=20 four, but I find
ssh easier to set up if all you need is remote=20 login/shell/file = transfer.





Fer
>
>
>=20 Anyone have any idea/suggestion?
>
> //Jesper aka=20 Z3l3zT
>
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> = with=20 "unsubscribe freebsd-security" in the body of the=20 message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with=20 "unsubscribe freebsd-security" in the body of the=20 message
------=_NextPart_000_003E_01C1D7DF.1D16D900-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message