head	1.8;
access;
symbols;
locks; strict;
comment	@# @;


1.8
date	99.06.08.00.33.24;	author ajfox;	state Exp;
branches;
next	1.7;

1.7
date	99.05.27.20.06.13;	author ajfox;	state Exp;
branches;
next	1.6;

1.6
date	99.04.09.15.07.02;	author ajfox;	state Exp;
branches;
next	1.5;

1.5
date	99.04.09.14.43.37;	author ajfox;	state Exp;
branches;
next	1.4;

1.4
date	99.03.12.19.16.39;	author ajfox;	state Exp;
branches;
next	1.3;

1.3
date	99.02.23.15.35.24;	author ajfox;	state Exp;
branches;
next	1.2;

1.2
date	99.02.17.19.47.52;	author ajfox;	state Exp;
branches;
next	1.1;

1.1
date	99.02.17.15.57.21;	author ajfox;	state Exp;
branches;
next	;


desc
@ssh notes on secure file transfer
@


1.8
log
@more space to improve anchors
@
text
@<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
            "http://www.w3.org/TR/REC-html40/loose.dtd">
<HTML>
<HEAD>  
   <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">

<TITLE>ACS Notes: Secure File Transfer</TITLE>
</HEAD>
<BODY TEXT="#32220A" BGCOLOR="#FFFFF7" LINK="#325A0a" vlink="#663300" ALINK="#
000000">
<CENTER><IMG SRC="../../topline3.gif" ALT="MIT - Academic Computing" WIDTH=640 HEIGHT=50></CENTER>

<!--Page content begins here-->
<H2 ALIGN=center>Secure File Transfer</H2>
<BR>

<hr>
<h2>Contents</h2>
<ul>
  <li> <a href="#ftp">Secure methods for transferring files to and from
       Athena</a>  
       <ul>
	 <li> <a href="#unix">between Athena and other UNIX systems</a>
	 <li> <a href="#micro">between Athena and a Mac or PC</a>
       </ul>
  <li> <a href="#kftp">Kerberized FTP</a>
  <li> <a href="#scp">SSH (Secure Shell), scp, and FTP</a>
</ul>
<hr>

<h2><a name="ftp">Tranferring files to and from Athena</a></h2>

Regular FTP (File Transfer Protocol) programs send data (including your
password) over the network "in the clear" but there are secure
alternatives described below.

<p>
If you are unable to use the methods below for any reason,
your safest alternative is to change your password just before you do
the file transfer, and change it back again as soon as possible.  This
will at least ensure that if your password is intercepted, it will be
valid only for a brief period of time.  Also see the guidelines on <a
href="http://web.mit.edu/network/passwords.html">choosing a good
password</a>.

<h3><a name="unix">Secure file transfer between Athena and UNIX
</a></h3> 

UNIX users can securely transfer files to and from Athena with <a
href="#kftp">kerberized FTP</a>, or the <a href="#scp">SSH scp
command</a>.  


<h3><a name="micro">Secure file transfer between Athena and a Mac or
PC</a></h3> 

There are currently no kerberized FTP clients for the PC, but a
kerberized version of <a
href="http://web.mit.edu/is/pubs/ns-54/">Fetch</a> for the Mac should be
available in the near future.

<p>

SSH clients for Mac and PC do exist (see our <a href="ssh.html">SSH
Overview</a> for some links).  They do not all provide scp, but some
provide <a href="ssh.html#filetransfer">other means for making secure
file transfers</a>.

<p>
In the absence of kerberized FTP or SSH, Mac and PC users can securely
copy files to and from Athena by performing the file transfer through
kerberized telnet clients (NCSA telnet on the Mac, HostExplorer on the
PC).  Step-by-step procedures are given on the following pages from the
CWIS group:

<ul>
  <li><a href="http://web.mit.edu/cwis/secure-xfer/mac-xfer.html">Secure
       file transfer on the Mac</a>   
  <li><a href="http://web.mit.edu/cwis/secure-xfer/pc-xfer.html">Secure
       file transfer on the PC</a>   
</ul>

If you don't already have kerberized NCSA telnet or HostExplorer
installed, see:

<ul>
  <li><a href="http://web.mit.edu/is/pubs/ns-35/">NCSA Telnet at
       MIT</a> (for Mac) 
  <li><a href="http://web.mit.edu/is/pubs/ns-55/">HostExplorer at
     MIT</a> (for PC)
</ul>

<h2><a name="kftp">Kerberized FTP</a></h2>
As explained above, there are currently no kerberized FTP clients for
the PC.  A kerberized version of <a
href="http://web.mit.edu/is/pubs/ns-54/">Fetch</a> for the Mac should be
available in early October, 1998.  In the meantime, you can <a
href="http://web.mit.edu/cwis/secure-xfer/">securely
transfer files through your kerberized telnet</a>.

<p>
Athena now supports kerberized ftp, but to connect securely from a
non-Athena UNIX machine to an Athena dialup or private workstation, it
is necessary to take the steps shown in <a href="#kftpeg1">example
1</a>.  (This is due to the fact that the existing ftp clients don't
encrypt the connection automatically before asking for a password. Note
that the Athena 8.2 ftp client has been specially modified to
auto-encrypt, so that these steps should not be necessary if you were to
ftp <em>from</em> Athena to a remote-access Athena workstation, or to
another machine running a kerberized ftp daemon; see <a
href="#kftpeg2">example 2</a>.)

<h3><a name="kftpeg1">example 1: kerberized ftp to Athena </a></h3>
<ol>
 <li> Use a kerberized ftp client. A krb4 version is available from the
 <a href="http://web.mit.edu/net-security/dist/kerberos-kits"> 
      net-security kerberos installation kits</a>, and a krb5 version is
      available in the krb5 locker.  This example was taken
      from a krb5 ftp client; the krb4 one works similarly.
 <br> <br>
 <li> Connect to the dialup or other remote-access workstation:
<pre>
      <strong>ftp ftp.dialup.mit.edu</strong>

      Connected to mass-toolpike.mit.edu.
      220 buzzword-bingo FTP server (Version 5.60) ready.
      334 Using authentication type GSSAPI; ADAT must follow
      GSSAPI accepted as authentication type
      GSSAPI error major: Miscellaneous failure
      GSSAPI error minor: Server not found in Kerberos database
      GSSAPI error: initializing context
      GSSAPI authentication succeeded
      Name (ftp.dialup.mit.edu:jqpublic): 
</pre>
      You can safely ignore the GSSAPI errors as long as it says
 `authentication succeeded' at the end. <br><br>

 <li> Enter your username but <strong>do not</strong> type your password.
Leave the Password entry blank (just press the Return key):
<pre>
      331 Password required for jqpublic.
      Password: <strong>[leave this blank!]</strong>
</pre>

It should respond:

<pre>
      530 Login incorrect.
      Login failed.
      ftp>
      
</pre>
 <li> Type `private' to encrypt the connection:
<pre>
      ftp> <strong>private</strong>
      200 Protection level set to Private (Encrypted).

</pre>
 <li> Now type `user' followed by your username to have it
 prompt you for your password again:
<pre>
      ftp> <strong>user jqpublic</strong>
      331 Password required for jqpublic.
      Password: 
</pre>
      and enter your password, which will now be encrypted.  
<pre>
      230 User jqpublic logged in.
      ftp>
</pre>
      You can now continue with the standard ftp commands.
</ol>

<h3><a name="kftpeg2">example 2: kerberized ftp from Athena </a></h3>

For comparison, this is how things look <em>from</em> the ftp client on
Athena (in this case, to a private Athena workstation).  The lines to
look for before typing your password are "GSSAPI authentication
succeeded" and "Protection level set to Private".

<pre>
      athena% ftp private-machine.mit.edu
      Connected to private.machine.MIT.EDU.
      220 private-machine.mit.edu FTP server (Version 5.60) ready.
      334 Using authentication type GSSAPI; ADAT must follow
      GSSAPI accepted as authentication type
      <strong>GSSAPI authentication succeeded</strong>
      <strong>200 Protection level set to Private</strong> (Encrypted).
      Name (private-machine.mit.edu:jqpublic):
</pre>

Note that the "(Encrypted)" in the message above is an Athena
customization; if you are connecting to a non-Athena machine it will
just say "Protection level set to Private".

<h2><a name="scp">SSH (Secure Shell), scp, and FTP</a></h2>

<strong>scp</strong> is a secure alternative to the regular UNIX rcp
command for copying files between hosts (scp uses ssh for authentication
and data encryption).  You can use it between any UNIX host with SSH
installed and an Athena dialup (or private workstation with
remote-access enabled).  At this writing, SSH clients for Mac and PC do
not all provide scp, but may support other means of secure file
transfer as demonstrated below.

<h3><a name="scpeg">scp example</a></h3>
To copy from the local machine to Athena:

<pre>
      scp localfilename athena.dialup.mit.edu:/path/to/remotefilename
</pre>
To copy from Athena to the local machine:
<pre>
      scp athena.dialup.mit.edu:/path/to/remotefilename localfilename

</pre>
To specify your Athena username (necessary if your username on the local
machine is not the same as your Athena username):
<pre>
      scp jqpublic@@athena.dialup.mit.edu:/path/to/remotefilename localfilename
</pre>

<h3><a name="securecrteg">using SecureCRT for Windows file transfers</a></h3>
Note: the following assumes you have already installed SecureCRT and set
up an ssh profile, as explained in the <a
href="ssh.html#securecrt">SecureCRT for Windows95/NT</a> section of the
ACS Notes on SSH.

<p>
SecureCRT includes support for zmodem file transfer which can be used in
conjunction with ssh for secure file transfer.  In order to use this
feature, you must add the sipb locker:

<pre>
      add sipb
</pre>

<p>

By default, SecureCRT will put files into the <strong>download</strong>
directory within the <strong>SecureCRT</strong> install directory (and
try to get files from the <strong>upload</strong> directory).  To change
this, go to the <strong>Options</strong> menu, select <strong>Session
Preferences</strong> and modify the settings listed under the
<strong>Files</strong> tab.  

<p>
To send a file from Athena to your PC:

<pre>
      sz -a <em>filename</em>       for ascii (text) files

      sz -b <em>filename</em>       for binary files
</pre>

<p>
To send a file from your PC to Athena:
<ul>
  <li> From the <strong>Transfer</strong> menu, select <strong>Zmodem
       Upload List...</strong>
  <li> Use the dialog box to select files to upload (the
       <strong>Add</strong> button puts the selected file on the list;
       use the <strong>Close</strong> button when the list is complete). 
  <li> From the <strong>Transfer</strong> menu, select <strong>Start
       Zmodem Upload</strong>.
  <li> The following will appear in your terminal window; it
       applies to command-line use of zmodem's rz/sz command pair and
       should be ignored here.  Once you see the athena% prompt, the
       file(s) should be in your current directory.
<pre> athena% rz
 rz ready. To begin transfer, type "sz file ..." to your modem program

 athena%
</pre>
</ul>       

<h3><a name="portfweg">securing the FTP channel (port forwarding)</a></h3>

If you have an FTP program which allows you to specify an arbitrary port
on the remote host, you can use this method to encrypt what you type
in an FTP session; note that it does not encrypt the files being
transferred.  This is a two-step process: 

<ol>
  <li> Set up the port forwarding through ssh.<br><br>
       For example:

       <pre>
       ssh -L 1234:ftp.dialup.mit.edu:21 ftp.dialup.mit.edu</pre>

       will log you in and forward connections made to port 1234 on your
       local machine to ftp.dialup (using the standard ftp port 21).<br><br>

  <li> Use your FTP program to connect to the port you've just forwarded
       on your local machine.<br><br>
       For example, in WS_FTP for Windows you should set up a Session
       Profile with: 

       <ul>
	 <li> <strong>Host Name: </strong><tt>localhost</tt>
	      
	 <li>  Advanced Profile Parameters (from the Session
	      Profile screen, hit the <strong>Advanced </strong> button)
	      <ul>
		<li>  <strong>Remote Port:</strong> <tt>1234</tt>
		<li>  <strong>Passive transfers</strong> (use checkbox to make
		     this active) 
	      </ul>
       </ul>
</ol>

<p>
For general information on securing the FTP channel, see the <a
href="http://www.uni-karlsruhe.de/~ig25/ssh-faq/ssh-faq-4.html#ss4.8">SSH
FAQ section on FTP</a> or man pages.
<br>
For help with specific Mac/PC clients, see the <a
href="http://www.datafellows.com/f-secure/support/ssh/faq/general.htm">F-Secure
SSH FAQ</a> or documentation from your SSH provider.
<br>
For more information on SSH see:
<ul>
  <li> <a href="ssh.html">SSH Overview</a> (ACS Notes, pointers to
       download sites for all platforms)
  <li> <a href="http://www.ssh.org">www.ssh.org</a> (general SSH info.,
       free UNIX versions)
  <li> <a
       href="http://www.datafellows.com/f-secure/fclintp.htm">F-Secure
       SSH</a> (commercial Mac and PC versions)  
</ul>

<hr>
<center>
<strong>related ACS notes: </strong><a href="index.html">Remote Access Overview</a> |
<a href="login.html">Remote Login Guide</a> | <a
href="ssh.html">SSH Overview</a> 
</center>

<!-- **** Begin Footer Section **** -->
<hr>
<center>
<A HREF="http://web.mit.edu"><IMG SRC="../../mit.gif" BORDER="1" ALT="MIT" 
HEIGHT="16" WIDTH="30" ALIGN=top></A><FONT SIZE=-1><STRONG>
 | <A HREF="http://web.mit.edu/acs/www/">Academic Computing</A> | <A HREF="comments.html">Contact us</A></strong></font>
</center>
<hr>


<EM><!-- hhmts start -->
Last modified: Mon Jun  7 20:28:21 1999
<!-- hhmts end --></EM>
<!-- **** Begin Footer Section **** -->

<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>

</BODY>
</HTML>
@


1.7
log
@added -a and -b flags to sz instrucionts, per lavin feedback
@
text
@d350 1
a350 1
Last modified: Thu May 27 16:05:39 1999
d354 36
@


1.6
log
@fixed AC link
@
text
@d251 3
a253 1
      sz <em>filename</em>
d350 1
a350 1
Last modified: Fri Mar 12 14:15:42 1999
@


1.5
log
@ fixed broken AC link
@
text
@d342 1
a342 1
 | <A HREF="http://web.mit.edu/acs/www/index.html">Academic Computing</A> | <A HREF="comments.html">Contact us</A></strong></font>
d350 4
a353 1
<!-- **** End Footer Section
@


1.4
log
@ stopgap attempt to improve navigation for securecrt info.
@
text
@d342 1
a342 1
 | <A HREF="index.html">Academic Computing</A> | <A HREF="comments.html">Contact us</A></strong></font>
d350 1
a350 4
<!-- **** End Footer Section **** -->
</BODY>
</HTML>

@


1.3
log
@never-ending attempt to deal with ssh and file transfer stuff
@
text
@d224 6
d231 2
a232 2
conjunction with ssh for secure file transfer.  In order to use
this feature, you must add the sipb locker:
d348 1
a348 1
Last modified: Tue Feb 23 10:34:28 1999
@


1.2
log
@added SecureCRT example
@
text
@d65 3
a67 6
Overview</a> for some links).  They do not all provide scp, but some may
allow you to secure the FTP command channel; this encrypts what you
type, but not the files being transferred.  For more information, see
the <a
href="http://www.datafellows.com/f-secure/support/ssh/faq/general.htm">F-Secure
SSH FAQ</a> or documentation from your SSH provider.
d203 2
a204 3
not all provide scp, but may still allow you to secure the FTP command
channel via port forwarding (this encrypts what you type, but not the
files being transferred).
d309 1
a309 1
For more information on Mac/PC clients, see the <a
d315 2
a316 2
  <li> <a href="ssh.html">SSH Overview</a> (ACS Notes, pointers to some
       free PC versions)
d342 1
a342 1
Last modified: Wed Feb 17 14:47:12 1999
@


1.1
log
@Initial revision
@
text
@d227 46
d274 1
d346 1
a346 1
Last modified: Thu Jan 28 17:57:35 1999
@
