Home ›

A Rough Year for SSH

Jan 02, 2002  By Jose Nazario
 in
In 2001, ssh was found to have several security flaws and has improved thanks to its trials.
Resources

SSH: The Secure Shell, The Definitive Guide January, 2001, ISBN 0-596-00011-1

OpenSSH Security Resources

Ssh Communications Security Resources

dsniff vs. ssh

Comment on SSH1 timing attacks

Jose Nazario is a biochemistry graduate student nearing the completion of his PhD. Side projects include Linux and other UNIX variants, software and security-related matters, and hobbies outside of his office like fly-fishing and photography.

email: jose@biocserver.BIOC.cwru.edu

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Don't ignore lsh !!

Anonymous's picture
Submitted by Anonymous on Fri, 01/11/2002 - 03:00.

Why do you ignore lsh, which is GNU software, covered

by the regular GPL license? It does only support SSH2 since there are security problems inherent in the SSH1 protocol. If you don't have a problem with that, try it out! It is somewhat different to use than Ssh or OpenSSH, but well worth it.

The latest version can be donwloaded from http://www.lysator.liu.se/~nisse/archive/

and is today 1.3.6

How many security holes has lsh had this year? None. (AFAIK, I'm just a user)

Re: Don't ignore lsh !!

Anonymous's picture
Submitted by Anonymous on Fri, 04/12/2002 - 02:00.

Why? Licence bigotry does nothing to advance either security or Free software. The whole BSD vs GPL holy war results in far too much brainpower being wasted on unnecessary duplication of effort. The fact that no vulnerabilities have been found in Ish does not demonstrate that it is bug-free; it means that it's an unknown quantity. The fact that OpenSSH has had holes discovered (and plugged!) helps demonstrate it's maturity and gives concrete proof of it's ability to survive real-world attack scenerios. It would be foolish to rely on unknown and unproven software in a mission-critical role.

Re: Don't ignore lsh !!

Anonymous's picture
Submitted by Anonymous on Thu, 02/28/2002 - 03:00.

A note from the lsh home page:
LSH IS A WORK IN PROGRESS. IT WILL NOT PROVIDE ANY SECURITY ON SYSTEMS THAT LACK /dev/random. THERE MAY BE OTHER SERIOUS BUGS THAT MAKE IT TOTALLY INSECURE.

You may not want to depend on lsh just yet...

Re: A Rough Year for SSH

Anonymous's picture
Submitted by Anonymous on Sat, 01/05/2002 - 03:00.

Informative article.

Re: A Rough Year for SSH

Anonymous's picture
Submitted by Anonymous on Thu, 01/03/2002 - 03:00.

I have a GPL'd tool that installs ssh keys at http://www.stearns.org/ssh-keyinstall/ Additionally, I have some tutorials at
http://www.stearns.org/doc/

Webcast
More Resources
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers

Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.

Learn More

Sponsored by AMD

White Paper
More Resources
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState