A Rough Year for SSH

In 2001, ssh was found to have several security flaws and has improved thanks to its trials.
Resources

SSH: The Secure Shell, The Definitive Guide January, 2001, ISBN 0-596-00011-1

OpenSSH Security Resources

Ssh Communications Security Resources

dsniff vs. ssh

Comment on SSH1 timing attacks

Jose Nazario is a biochemistry graduate student nearing the completion of his PhD. Side projects include Linux and other UNIX variants, software and security-related matters, and hobbies outside of his office like fly-fishing and photography.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Don't ignore lsh !!

Anonymous's picture

Why do you ignore lsh, which is GNU software, covered

by the regular GPL license? It does only support SSH2 since there are security problems inherent in the SSH1 protocol. If you don't have a problem with that, try it out! It is somewhat different to use than Ssh or OpenSSH, but well worth it.

The latest version can be donwloaded from http://www.lysator.liu.se/~nisse/archive/

and is today 1.3.6

How many security holes has lsh had this year? None. (AFAIK, I'm just a user)

Re: Don't ignore lsh !!

Anonymous's picture

Why? Licence bigotry does nothing to advance either security or Free software. The whole BSD vs GPL holy war results in far too much brainpower being wasted on unnecessary duplication of effort. The fact that no vulnerabilities have been found in Ish does not demonstrate that it is bug-free; it means that it's an unknown quantity. The fact that OpenSSH has had holes discovered (and plugged!) helps demonstrate it's maturity and gives concrete proof of it's ability to survive real-world attack scenerios. It would be foolish to rely on unknown and unproven software in a mission-critical role.

Re: Don't ignore lsh !!

Anonymous's picture

A note from the lsh home page:
LSH IS A WORK IN PROGRESS. IT WILL NOT PROVIDE ANY SECURITY ON SYSTEMS THAT LACK /dev/random. THERE MAY BE OTHER SERIOUS BUGS THAT MAKE IT TOTALLY INSECURE.

You may not want to depend on lsh just yet...

Re: A Rough Year for SSH

Anonymous's picture

Informative article.

Re: A Rough Year for SSH

Anonymous's picture

I have a GPL'd tool that installs ssh keys at http://www.stearns.org/ssh-keyinstall/ Additionally, I have some tutorials at
http://www.stearns.org/doc/

Free Dummies Books
Continuous Engineering

Learn:

  • What continuous engineering is
  • How to continuously improve complex product designs
  • How to anticipate and respond to markets and clients
  • How to get the most out of your engineering resources

Get your free book now

Sponsored by IBM

Free Dummies Books
Service Virtualization

Learn to:

  • Define service virtualization
  • Select the most beneficial services to virtualize
  • Improve your traditional approach to testing
  • Deliver higher-quality software faster

Get your free book now

Sponsored by IBM