Secure Shell Servers

Secure Shell or SSH is a network protocol that allows the exchange of data via a secure channel between two network devices. Mainly used in Linux and Unix-based systems to access shell accounts, SSH was designed as a replacement for Telnet and other insecure remote shell, which send information, especially passwords, in plain text form that makes it easy to be intercepted. Encryption used by SSH provides confidentiality and integrity of data over an insecure network such as the Internet.

SSH uses public key cryptography to authenticate the remote computer and allow the remote computer to authenticate the user, if necessary. SSH is typically used to log into a remote machine and execute commands, but it also supports tunneling, forwarding TCP ports and X11 connections; it can transfer files using the associated SFTP or SCP protocols. SSH uses a client-server model. Standard TCP port 22 has been set to contact the SSH server. An SSH client program is typically used to establish a connection to the SSH daemon to be diremote. Both are usually found on modern operating systems, including Mac OS X, Linux, FreeBSD, Solaris and OpenVMS. There are proprietary versions, freeware and open source for various levels of complexity and completeness.

Secure Shell or SSH is a network protocol that allows the exchange of data via a secure channel between two network devices. Mainly used in Linux and Unix-based systems to access shell accounts, SSH was designed as a replacement for Telnet and other insecure remote shell, which send information, especially passwords, in plain text form that makes it easy to be intercepted. Encryption used by SSH provides confidentiality and integrity of data over an insecure network such as the Internet.

SSH uses public key cryptography to authenticate the remote computer and allow the remote computer to authenticate the user, if necessary. SSH is typically used to log into a remote machine and execute commands, but it also supports tunneling, forwarding TCP ports and X11 connections; it can transfer files using the associated SFTP or SCP protocols. SSH uses a client-server model. Standard TCP port 22 has been set to contact the SSH server. An SSH client program is typically used to establish a connection to the SSH daemon to be diremote. Both are usually found on modern operating systems, including Mac OS X, Linux, FreeBSD, Solaris and OpenVMS. There are proprietary versions, freeware and open source for various levels of complexity and completeness.

In computer networks, a tunneling protocol allows a network user to access or provide a network service that the underlying network does not support or provide directly. One important use of a tunneling protocol is to allow a foreign protocol to run over a network that does not support that particular protocol; for example, running IPv6 over IPv4. Another important use is to provide services that are impractical or unsafe to be offered using only the underlying network services; for example, providing a corporate network address to a remote user whose physical network address is not part of the corporate network. Because tunneling involves repackaging the traffic data into a different form, perhaps with encryption as standard, a third use is to hide the nature of the traffic that is run through the tunnels.

The tunneling protocol works by using the data portion of a packet (the payload) to carry the packets that actually provide the service. Tunneling uses a layered protocol model such as those of the OSI or TCP/IP protocol suite, but usually violates the layering when using the payload to carry a service not normally provided by the network. Typically, the delivery protocol operates at an equal or higher level in the layered model than the payload protocol.

Technical overview

To understand a particular protocol stack imposed by tunneling, network engineers must understand both the payload and delivery protocol sets.

As an example of network layer over network layer, Generic Routing Encapsulation (GRE), a protocol running over IP (IP Protocol Number 47), often serves to carry IP packets, with RFC 1918 private addresses, over the Internet using delivery packets with public IP addresses. In this case, the delivery and payload protocols are the same, but the payload addresses are incompatible with those of the delivery network.

It is also possible to use link layer over network layer. the Layer 2 Tunneling Protocol (L2TP) allows link layer packets to be carried as data inside UDP datagrams. Thus L2TP runs over the transport layer. The IP in the delivery protocol could run over any data-link protocol from IEEE 802.2 over IEEE 802.3 (i.e., standards-based Ethernet) to the Point-to-Point Protocol (PPP) over a dialup modem link.

Tunneling protocols may use data encryption to transport insecure payload protocols over a public network (such as the Internet), thereby providing VPN functionality. IPsec has an end-to-end Transport Mode, but can also operate in a tunneling mode through a trusted security gateway.

Secure Shell tunneling

A Secure Shell (SSH) tunnel consists of an encrypted tunnel created through an SSH protocol connection. Users may set up SSH tunnels to transfer unencrypted traffic over a network through an encrypted channel. For example, Microsoft Windows machines can share files using the Server Message Block (SMB) protocol, a non-encrypted protocol. If one were to mount a Microsoft Windows file-system remotely through the Internet, someone snooping on the connection could see transferred files. To mount the Windows file-system securely, one can establish a SSH tunnel that routes all SMB traffic to the remote fileserver through an encrypted channel. Even though the SMB protocol itself contains no encryption, the encrypted SSH channel through which it travels offers security.

To set up a local SSH tunnel, one configures an SSH client to forward a specified local port (green in the images) to a port (purple in the images) on the remote machine (yellow in the image). Once the SSH tunnel has been established, the user can connect to the specified local port (green) to access the network service. The local port (green) does not have to be the same as the remote port (purple).

SSH tunnels provide a means to bypass firewalls that prohibit certain Internet services – so long as a site allows outgoing connections. For example, an organization may prohibit a user from accessing Internet web pages (port 80) directly without passing through the organization's proxy filter (which provides the organization with a means of monitoring and controlling what the user sees through the web). But users may not wish to have their web traffic monitored or blocked by the organization's proxy filter. If users can connect to an external SSH server, they can create an SSH tunnel to forward a given port on their local machine to port 80 on a remote web server. To access the remote web server, users would point their browser to the local port at http://localhost/

Some SSH clients support dynamic port forwarding that allows the user to create a SOCKS 4/5 proxy. In this case users can configure their applications to use their local SOCKS proxy server. This gives more flexibility than creating an SSH tunnel to a single port as previously described. SOCKS can free the user from the limitations of connecting only to a predefined remote port and server. If an application doesn't support SOCKS, a proxifier can be used to redirect the application to the local SOCKS proxy server. Some proxifiers, such as Proxycap, support SSH directly, thus avoiding the need for an SSH client.

In recent versions of OpenSSH it is even allowed to create layer 2 or layer 3 tunnels if both ends have enabled such tunnelling capabilities. This creates tun (layer 3, default) or tap (layer 2) virtual interfaces on both ends of the connection and allowing normal network management and routing to be used, and when used on routers, allowing entire subnetworks traffic being tunneled. A pair of tap virtual interfaces function like an Ethernet cable connecting both ends of the connection and can join kernel bridges.

Source: wikipedia

READ MORE

What The Meaning Of SSH (Secure Shell)

Secure Shell or SSH is a network protocol that allows the exchange of data via a secure channel between two network devices. Mainly used in Linux and Unix-based systems to access shell accounts,SSH was designed as a replacement for Telnet and other insecure remote shell, which send information, especially passwords, in plain text form that makes it easy to be intercepted. Encryption used by SSH provides confidentiality and integrity of data over an insecure network such as the Internet.

SSH uses public key cryptography to authenticate the remote computer and allow the remote computer to authenticate the user, if necessary. SSH is typically used to log into a remote machine and execute commands, but it also supports tunneling, forwarding TCP ports and X11 connections; it can transfer files using the associated SFTP or SCP protocols. SSH uses a client-server model. Standard TCP port 22 has been set to contact the SSH server. An SSH client program is typically used to establish a connection to the SSH daemon to be diremote. Both are usually found on modern operating systems, including Mac OS X, Linux, FreeBSD, Solaris and OpenVMS. There are proprietary versions, freeware and open source for various levels of complexity and completeness.

In computer networks, a tunneling protocol allows a network user to access or provide a network service that the underlying network does not support or provide directly. One important use of a tunneling protocol is to allow a foreign protocol to run over a network that does not support that particular protocol; for example, running IPv6 over IPv4. Another important use is to provide services that are impractical or unsafe to be offered using only the underlying network services; for example, providing a corporate network address to a remote user whose physical network address is not part of the corporate network. Because tunneling involves repackaging the traffic data into a different form, perhaps with encryption as standard, a third use is to hide the nature of the traffic that is run through the tunnels.

The tunneling protocol works by using the data portion of a packet (the payload) to carry the packets that actually provide the service. Tunneling uses a layered protocol model such as those of the OSI or TCP/IP protocol suite, but usually violates the layering when using the payload to carry a service not normally provided by the network. Typically, the delivery protocol operates at an equal or higher level in the layered model than the payload protocol.

Technical overview

To understand a particular protocol stack imposed by tunneling, network engineers must understand both the payload and delivery protocol sets.

As an example of network layer over network layer, Generic Routing Encapsulation (GRE), a protocol running over IP (IP Protocol Number 47), often serves to carry IP packets, with RFC 1918 private addresses, over the Internet using delivery packets with public IP addresses. In this case, the delivery and payload protocols are the same, but the payload addresses are incompatible with those of the delivery network.

It is also possible to use link layer over network layer. the Layer 2 Tunneling Protocol (L2TP) allows link layer packets to be carried as data inside UDP datagrams. Thus L2TP runs over the transport layer. The IP in the delivery protocol could run over any data-link protocol from IEEE 802.2 over IEEE 802.3 (i.e., standards-based Ethernet) to the Point-to-Point Protocol (PPP) over a dialup modem link.

Tunneling protocols may use data encryption to transport insecure payload protocols over a public network (such as the Internet), thereby providing VPN functionality. IPsec has an end-to-end Transport Mode, but can also operate in a tunneling mode through a trusted security gateway.

Secure Shell tunneling

A Secure Shell (SSH) tunnel consists of an encrypted tunnel created through an SSH protocol connection. Users may set up SSH tunnels to transfer unencrypted traffic over a network through an encrypted channel. For example, Microsoft Windows machines can share files using the Server Message Block (SMB) protocol, a non-encrypted protocol. If one were to mount a Microsoft Windows file-system remotely through the Internet, someone snooping on the connection could see transferred files. To mount the Windows file-system securely, one can establish a SSH tunnel that routes all SMB traffic to the remote fileserver through an encrypted channel. Even though the SMB protocol itself contains no encryption, the encrypted SSH channel through which it travels offers security.

To set up a local SSH tunnel, one configures an SSH client to forward a specified local port (green in the images) to a port (purple in the images) on the remote machine (yellow in the image). Once the SSH tunnel has been established, the user can connect to the specified local port (green) to access the network service. The local port (green) does not have to be the same as the remote port (purple).

SSH tunnels provide a means to bypass firewalls that prohibit certain Internet services – so long as a site allows outgoing connections. For example, an organization may prohibit a user from accessing Internet web pages (port 80) directly without passing through the organization's proxy filter (which provides the organization with a means of monitoring and controlling what the user sees through the web). But users may not wish to have their web traffic monitored or blocked by the organization's proxy filter. If users can connect to an external SSH server, they can create an SSH tunnel to forward a given port on their local machine to port 80 on a remote web server. To access the remote web server, users would point their browser to the local port at http://localhost/

Some SSH clients support dynamic port forwarding that allows the user to create a SOCKS 4/5 proxy. In this case users can configure their applications to use their local SOCKS proxy server. This gives more flexibility than creating an SSH tunnel to a single port as previously described. SOCKS can free the user from the limitations of connecting only to a predefined remote port and server. If an application doesn't support SOCKS, a proxifier can be used to redirect the application to the local SOCKS proxy server. Some proxifiers, such as Proxycap, support SSH directly, thus avoiding the need for an SSH client.

In recent versions of OpenSSH it is even allowed to create layer 2 or layer 3 tunnels if both ends have enabled such tunnelling capabilities. This creates tun (layer 3, default) or tap (layer 2) virtual interfaces on both ends of the connection and allowing normal network management and routing to be used, and when used on routers, allowing entire subnetworks traffic being tunneled. A pair of tap virtual interfaces function like an Ethernet cable connecting both ends of the connection and can join kernel bridges.

Source: wikipedia

READ MORE