head	1.3;
access;
symbols;
locks; strict;
comment	@# @;


1.3
date	99.05.10.18.25.23;	author ajfox;	state Exp;
branches;
next	1.2;

1.2
date	99.04.09.15.08.11;	author ajfox;	state Exp;
branches;
next	1.1;

1.1
date	99.04.09.14.34.17;	author ajfox;	state Exp;
branches;
next	;


desc
@ACS remote access notes: secure lofin
@


1.3
log
@added "to Athena" in title
@
text
@<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
            "http://www.w3.org/TR/REC-html40/loose.dtd">
<HTML>
<HEAD>  
   <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">

<TITLE>ACS Notes: Secure Remote Login to Athena</TITLE>
</HEAD>
<BODY TEXT="#32220A" BGCOLOR="#FFFFF7" LINK="#325A0a" vlink="#663300" ALINK="#
000000">
<CENTER><IMG SRC="../../topline3.gif" ALT="MIT - Academic Computing" WIDTH=640 HEIGHT=50></CENTER>

<!--Page content begins here-->
<H2 ALIGN=center>Secure Remote Login to Athena</H2>
<BR>

<hr>
<h2>Contents</h2>
<ul>
  <li> <a href="#telnet">Telnet programs for remote login</a>  
       <ul>
	 <li> <a href="#micro">Kerberized telnet for Mac or PC</a>
	 <li> <a href="#unix">Kerberized telnet for UNIX</a>
       </ul>
  <li> <a href="#ssh">SSH (Secure Shell) for remote login</a>
  <li> <a href="#xwindows">Running X Windows applications remotely</a>
</ul>
<hr>


<h2><a name="telnet">Telnet</a></h2>
Regular telnet programs send data (including your password) over the
network "in the clear" where they can be intercepted and used to
compromise your account, the machine you're connecting to, and the
network as a whole.  Kerberized, encrypted telnet provides kerberos
authentication (to protect your password), and encryption to protect
your data.  For general information about kerberized telnet and related
security issues, see:

<ul>
  <li>
       <a
       href="http://web.mit.edu/is/help/ktelnet">Kerberized Telnet at
       MIT</a> 
       </li>
  <li><a
       href="http://web.mit.edu/is/isnews/v12/n06/43807.html">"Use 
       Kerberized Telnet When Logging onto Remote Hosts"</a> 
       article from i/s newsletter
       </li>
  <li><a
       href="http://web.mit.edu/is/isnews/v13/n02/43833.html">"Protect Your
       Computer from Packet Sniffing Programs"</a> article from i/s
       newslettter 
       </li>
</ul>

<h3><a name="micro">Kerberized telnet from Mac or PC</a></h3>
Kerberized telnet clients for Mac and PC (NCSA telnet and HostExplorer,
respectively) are available free of charge to the MIT community.  For
more information and to download the program for your machine, see the
I/S page on <a href="http://web.mit.edu/is/help/ktelnet">Kerberized
Telnet at MIT</a>.

<h3><a name="unix">Kerberized telnet from non-Athena UNIX systems</a></h3>

Installation kits for kerberized telnet and ftp software are available;
see the Network group's page on <a
href="http://web.mit.edu/network/telnet.html">Kerberized Telnet at
MIT</a>.  They also maintain a <a
href="http://web.mit.edu/network/unix_security.html">Security Primer for
UNIX system administrators at MIT</a>.

<h2><a name="ssh">SSH (Secure Shell)</a></h2>
SSH is a widely-used remote login program which provides authentication
(to protect your password) and encryption (to protect your data).  It
does not generally use Kerberos, although more recent versions include
this as an option.  

<p>
A free Unix version of SSH is available for most platforms from <a
href="http://www.ssh.org/">http://www.ssh.org/</a>.  At this writing,
only commercial clients are available for Mac and PC; trial versions
and more information are available from the <a
href="http://www.datafellows.com/f-secure/fclintp.htm">F-Secure SSH</a>
site.

<h3><a name="ssh">Using SSH on Athena</a></h3>

  Generally, ssh involves users generating public/private key pairs and
  using them to authenticate, but the default behavior on Athena is to
  use either Kerberos authentication (with forwardable tickets), or
  simple password authentication.  The reason for this is that
  you need to get Kerberos tickets to be able to do things like read
  your files and incorporate your mail, and you can't get tickets on the
  remote machine without either forwarding them from the machine you're
  already logged in to, or typing your password.
<p>  
  If you have forwardable Kerberos tickets on your machine (the default
  in Athena 8.2 and later), then ssh will use them to authenticate you
  and log you in. If you don't, it will fall back to password
  authentication (ssh always encrypts your connection, including any
  password you type).

<h4><a name="ssheg">Example</a></h4>
To connect to a dialup:
<pre>
      ssh athena.dialup.mit.edu
</pre>

To specify your Athena username (necessary if it is different from your
username on the local machine), use the flag -l (lowercase "L") followed
by your Athena username:

<pre>
      ssh athena.dialup.mit.edu -l jqpublic
</pre>
The first time you connect, you will see:
<pre>
      Host key not found from the list of known hosts.
      Are you sure you want to continue connecting (yes/no)? 
</pre>
Type `yes'. It will respond:
<pre>
      Host 'athena.dialup.mit.edu' added to the list of known hosts.
      jqpublic's password:
</pre>
Type your password now (ssh <em>always</em> encrypts your
connection, so it's safe to type it here).  You should then see the
usual login sequence, culminating in your favorite prompt:

<pre>
      athena%
</pre>

<p>  
To connect from Athena to a machine running SSH, you'd start similarly:

<pre>
      athena% ssh <em>hostname</em> -l <em>username</em>
</pre>

where <em>hostname</em> is the full address of the machine you're
connecting to, and <em>username</em> is your username on that machine,
if different from your Athena username.

<p>
If you see an "X11 forwarding error" when you connect, it probably means
your ssh client tried to arrange for X connections to go through the
encrypted ssh channel, but the remote machine refuses (e.g., because it
is a non-X dialup). 

<p>
For more information on SSH see:
<ul>
  <li> <a href="ssh.html">SSH Overview</a> (ACS Notes)
  <li> <a href="http://www.ssh.org">www.ssh.org</a> (general SSH info.,
       free UNIX versions)
  <li> <a
       href="http://www.datafellows.com/f-secure/fclintp.htm">F-Secure
       SSH</a> (commercial Mac and PC versions)  
</ul>

<h2><a name="xwindows">Running X Windows applications remotely</a></h2>

X connections are not generally secure (i.e., if you run X
applications remotely, what you do <em>within</em> those applications
goes across the network in the clear).  SSH, however, allows you to run
your X connection through an encrypted ssh channel.  If you use SSH to
connect to athena-x.dialup.mit.edu (or a private Athena workstation with
remote-access enabled), it should arrange this for you automatically.
<p>
See the OLC stock answer on <a
href="http://web.mit.edu/answers/dialup/networks_rlogin.html">running X
Windows remotely</a> for detailed instructions on setting up remote
display.

<hr>
<center>
<strong>related ACS notes: </strong><a href="index.html">Remote Access Overview</a> |
<a href="filetransfer.html">File Transfer Guide</a> | <a
href="ssh.html">SSH Overview</a> 
</center>

<!-- **** Begin Footer Section **** -->
<hr>
<center>
<A HREF="http://web.mit.edu"><IMG SRC="../../mit.gif" BORDER="1" ALT="MIT" 
HEIGHT="16" WIDTH="30" ALIGN=top></A><FONT SIZE=-1><STRONG>
 | <A HREF="http://web.mit.edu/acs/www/">Academic Computing</A> | <A HREF="comments.html">Contact us</A></strong></font>
</center>
<hr>


<EM><!-- hhmts start -->
Last modified: Mon May 10 14:24:36 1999
<!-- hhmts end --></EM>
<!-- **** Begin Footer Section **** -->

</BODY>
</HTML>
@


1.2
log
@fixed AC link
@
text
@d7 1
a7 1
<TITLE>ACS Notes: Secure Remote Login</TITLE>
d14 1
a14 1
<H2 ALIGN=center>Secure Remote Login</H2>
d196 1
a196 1
Last modified: Mon Oct 19 16:34:47 1998
@


1.1
log
@Initial revision
@
text
@d190 1
a190 1
 | <A HREF="index.html">Academic Computing</A> | <A HREF="comments.html">Contact us</A></strong></font>
d198 2
a199 1
<!-- **** End Footer Section **** -->
a201 2


@
