head	1.11;
access;
symbols;
locks; strict;
comment	@# @;


1.11
date	99.07.08.21.00.16;	author ajfox;	state Exp;
branches;
next	1.10;

1.10
date	99.07.08.20.51.38;	author ajfox;	state Exp;
branches;
next	1.9;

1.9
date	99.07.06.20.43.25;	author ajfox;	state Exp;
branches;
next	1.8;

1.8
date	99.06.08.00.32.48;	author ajfox;	state Exp;
branches;
next	1.7;

1.7
date	99.04.09.14.43.14;	author ajfox;	state Exp;
branches;
next	1.6;

1.6
date	99.03.12.19.16.08;	author ajfox;	state Exp;
branches;
next	1.5;

1.5
date	99.02.25.11.29.38;	author ajfox;	state Exp;
branches;
next	1.4;

1.4
date	99.02.23.15.34.53;	author ajfox;	state Exp;
branches;
next	1.3;

1.3
date	99.02.17.19.48.21;	author ajfox;	state Exp;
branches;
next	1.2;

1.2
date	99.02.17.15.57.06;	author ajfox;	state Exp;
branches;
next	1.1;

1.1
date	99.02.17.15.29.08;	author ajfox;	state Exp;
branches;
next	;


desc
@ACS notes on SSH
@


1.11
log
@fixed outdated f-secure link
@
text
@<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
            "http://www.w3.org/TR/REC-html40/loose.dtd">
<HTML>
<HEAD>  
   <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">

<TITLE>ACS Notes: SSH (Secure Shell)</TITLE>
</HEAD>
<BODY TEXT="#32220A" BGCOLOR="#FFFFF7" LINK="#325A0a" vlink="#663300" ALINK="#
000000">
<CENTER><IMG SRC="../../topline3.gif" ALT="MIT - Academic Computing" WIDTH=640 HEIGHT=50></CENTER>

<!--Page content begins here-->
<H2 ALIGN=center>SSH Overview</H2>
<BR>

<hr>

<h2><a name="ssh">SSH (Secure Shell)</a></h2>
SSH is a widely-used suite of remote access programs which provides
authentication (to protect your password) and encryption (to protect
your data).  It does not generally use Kerberos, although more recent
versions include this as an option.  For general information on SSH,
including mailing lists and FAQs, see the <a
href="http://www.ssh.org/">SSH Users Group</a> and
<a href="http://www.cs.hut.fi/ssh/">SSH Home Page</a>.  

<p>
A free Unix version of SSH is available for most platforms from <a
href="http://www.ssh.org/">http://www.ssh.org/</a>.

<p>Mac and PC versions are available from various sources including the
following.   Please note
that the Computing Helpdesk is not equipped to offer help with 
SSH on the level provided for <a href="http://web.mit.edu/is/products/">IS
supported software</a>.  
<ul>
  <li> <a
       href="http://www.datafellows.com/f-secure/">F-Secure
       SSH</a> (commercial clients for Mac and PC; trial versions are
       available)

  <li> <a href="#securecrt">SecureCRT</a>
       (Windows95/NT client including zmodem file transfer
       capabilities, available to the MIT community courtesy of the
       Media Lab)       

  <li> <a
       href="http://bmrc.berkeley.edu/people/chaffee/winntutil.html">http://bmrc.berkeley.edu/people/chaffee/winntutil.html</a>
       for PC (free, command-line only; can be configured with <a
       href="filetransfer.html#portfweg">port forwarding</a> to secure an
       FTP program such as WS_FTP)
       
  <li> <a
       href="http://www.zip.com.au/~roca/ttssh.html">http://www.zip.com.au/~roca/ttssh.html</a> for PC (free extension to the freeware <a href="http://hp.vector.co.jp/authors/VA002416/teraterm.html">Tera Term terminal emulator</a>)
  <li> <a
       href="http://www.doc.ic.ac.uk/~ci2/ssh/">http://www.doc.ic.ac.uk/~ci2/ssh/</a> for PC (free client)

</ul>

<h2><a name="ssh">Using SSH on Athena</a></h2>

  Generally, ssh involves users generating public/private key pairs and
  using them to authenticate, but the default behavior on Athena is to
  use either Kerberos authentication (with forwardable tickets), or
  simple password authentication.  The reason for this is that
  you need to get Kerberos tickets to be able to do things like read
  your files and incorporate your mail, and you can't get tickets on the
  remote machine without either forwarding them from the machine you're
  already logged in to, or typing your password.
<p>  
  If you have forwardable Kerberos tickets on your machine (the default
  in Athena 8.2 and later), then ssh will use them to authenticate you
  and log you in. If you don't, it will fall back to password
  authentication (ssh always encrypts your connection, including any
  password you type).

<h3><a name="login">Using SSH for remote login</a></h3>
<strong>ssh</strong> is a secure remote login program, which can be used
in place of regular telnet, or on systems where <a
href="login.html#telnet">kerberized telnet</a> is not readily
available.

<blockquote>
<a href="login.html#ssheg">Example of how to use ssh to login remotely to/from
Athena</a>
</blockquote>

<h4><a name="xwindows">Using SSH with remote X Windows
applications</a></h4>
You can run <a href="login.html#xwindows">X windows applications
remotely from ssh</a> to secure the X connection.

<h3><a name="filetransfer">Using SSH for file transfers</a></h3>

<strong>scp</strong> is a secure alternative to the regular UNIX rcp
command for copying files between hosts (scp uses ssh for authentication
and data encryption).  You can use it between any UNIX host with SSH
installed and the Athena dialups (or a private workstation with
remote-access enabled).

<blockquote>
<a href="filetransfer.html#scpeg">Example
of how to use scp to transfer files to/from Athena</a>.
</blockquote>

Most of the SSH clients currently available for Mac and PC do not
include an scp feature, but some provide other means for making secure
file transfers:

<ul>

<li> SecureCRT for Windows supports zmodem file transfer, which can be
     used for secure file transfer as demonstrated below.  Note: this
     example assumes you have already installed SecureCRT and set up an
     ssh profile as explained in the <a href="#securecrt">SecureCRT for
     Windows95/NT</a> section below.

<blockquote>
<a href="filetransfer.html#securecrteg">Example of how to use SecureCRT for
file transfer</a> 
</blockquote>

<li> Other ssh clients can be set up to secure the FTP command channel
(this encrypts the commands you type, but not the files being
transferred).  For more information on specific clients, see the <a
href="http://www.datafellows.com/f-secure/support/ssh/faq/general.htm">F-Secure
SSH FAQ</a> or vendor documentation.

For general information on securing the FTP command
channel in SSH, see the <a
href="http://www.uni-karlsruhe.de/~ig25/ssh-faq/ssh-faq-4.html#ss4.8">SSH
FAQ section on FTP</a> or man pages.  See also:

<blockquote>
<a href="filetransfer.html#portfweg">Example of how to set up port
fowarding to secure the FTP channel</a> 
</blockquote>

</ul>     
     
<h3><a name="securecrt">SecureCRT for Windows95/NT</a></h3>

SecureCRT is a terminal emulation program which includes ssh and has
zmodem file transfer capabilities.  The MIT Media Lab has extended its
license of this program client to make it available to the MIT
community.  MIT's <a
href="ftp://net-dist.mit.edu/mit/winNT/security/securecrt/">SecureCRT download
site</a> includes a README file which explains how to enter the MIT
license data.  Once you have downloaded the program and entered the
necessary license information, you'll need to set up a session profile
specifying <strong>ssh</strong> as the protocol:

<ul>
  <li> The <strong>Connect</strong> window may open automaticaly;
       otherwise, go to the <strong>File</strong> menu and select
       <strong>Connect</strong>.
  <li> Under the <strong>Session List</strong> tab, select
       <strong>New</strong>.
  <li> Under the <strong>Session</strong> tab, set the
       <strong>Protocol</strong> to <strong>ssh</strong>, and
       enter either the hostname for a private workstation or
       <em>athena.dialup.mit.edu</em>.  The other default settings
       should be correct.
</ul>       
       

<hr>
<center>
<strong>related ACS notes: </strong><a href="index.html">Remote Access Overview</a> |
<a href="login.html">Remote Login Guide</a> | <a
href="filetransfer.html">File Transfer Guide</a> 
</center>

<!-- **** Begin Footer Section **** -->
<hr>
<center>
<A HREF="http://web.mit.edu"><IMG SRC="../../mit.gif" BORDER="1" ALT="MIT" 
HEIGHT="16" WIDTH="30" ALIGN=top></A><FONT SIZE=-1><STRONG>
 | <A HREF="http://web.mit.edu/acs/www/index.html">Academic Computing</A> | <A HREF="comments.html">Contact us</A></strong></font>
</center>
<hr>


<EM><!-- hhmts start -->
Last modified: Thu Jul  8 16:59:33 1999
<!-- hhmts end --></EM>
<!-- **** End Footer Section **** -->


<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>

</body>
</html>








@


1.10
log
@shunting around PC links
@
text
@d39 1
a39 1
       href="http://www.datafellows.com/f-secure/fclintp.htm">F-Secure
d50 3
a52 3
       for PC (command-line only; can be configured with <a
       href="filetransfer.html#portfweg">port forwarding</a> to secure a
       graphical FTP program such as WS_FTP)
d186 1
a186 1
Last modified: Thu Jul  8 16:50:39 1999
@


1.9
log
@yet more space to improve anchors
@
text
@d47 1
d49 6
a60 8
<p> In addition to the above, there are free <a
href="http://bmrc.berkeley.edu/people/chaffee/winntutil.html">command-line
clients of ssh and scp</a> for Win95 and NT.  (These give you only a
terminal interface, but you can configure the ssh client to do port
forwarding for FTP, and then use a graphical FTP program such as WS-FTP for
secure file transfer.  See the <a
href="filetransfer.html#portfw">port forwarding example</a> in the File Transfer Guide.)  

d186 1
a186 1
Last modified: Tue Jul  6 16:06:35 1999
@


1.8
log
@more space to improve anchors
@
text
@d187 1
a187 1
Last modified: Mon Jun  7 20:31:57 1999
d192 4
@


1.7
log
@fixed broken AC link
@
text
@d187 1
a187 1
Last modified: Fri Apr  9 10:41:30 1999
d190 47
@


1.6
log
@stopgap attempt to improve navigation for securecrt info.
@
text
@d181 1
a181 1
 | <A HREF="index.html">Academic Computing</A> | <A HREF="comments.html">Contact us</A></strong></font>
d187 1
a187 1
Last modified: Fri Mar 12 14:09:32 1999
a189 4
</BODY>
</HTML>


@


1.5
log
@net-dist.mit.edu
@
text
@d114 5
a118 1
<li> SecureCRT for Windows supports zmodem file transfer:
d187 1
a187 1
Last modified: Thu Feb 25 06:29:33 1999
@


1.4
log
@never-ending attempt to deal with ssh and file transfer stuff
@
text
@d145 1
a145 1
href="ftp://net-dist/mit/winNT/security/securecrt/">SecureCRT download
d183 1
a183 1
Last modified: Tue Feb 23 10:28:23 1999
@


1.3
log
@modified SecureCRT stuff (details on usage)
@
text
@d109 2
a110 2
include an scp feature, but provide other means for making secure file
transfers:
d183 1
a183 1
Last modified: Wed Feb 17 14:05:49 1999
@


1.2
log
@added info. on secureCRT
@
text
@d41 3
a43 3
       available) 
  <li> <a
       href="ftp://net-dist/mit/winNT/security/securecrt/">SecureCRT</a>
d46 1
a46 1
       Media Lab)
d58 1
a58 1
forwading for FTP, and then use a graphical FTP program such as WS-FTP for
a61 2


a94 1

d110 1
a110 1
transfers.  
d112 1
a112 1
<p> SecureCRT for Windows supports zmodem file transfer:
d114 2
d121 1
a121 1
<p> Other ssh clients can be set up to secure the FTP command channel
d127 1
a127 1
<p> For general information on securing the FTP command
d137 28
d183 1
a183 1
Last modified: Wed Feb 17 10:56:31 1999
@


1.1
log
@Initial revision
@
text
@d43 5
d112 12
a123 2
include an scp feature, but can be set up to secure the FTP command
channel (this encrypts the commands you type, but not the files being
d127 1
a137 1

d156 1
a156 1
Last modified: Wed Nov 25 11:54:26 1998
@
