A Rough Year for SSH

In 2001, ssh was found to have several security flaws and has improved thanks to its trials.
Resources

SSH: The Secure Shell, The Definitive Guide January, 2001, ISBN 0-596-00011-1

OpenSSH Security Resources

Ssh Communications Security Resources

dsniff vs. ssh

Comment on SSH1 timing attacks

Jose Nazario is a biochemistry graduate student nearing the completion of his PhD. Side projects include Linux and other UNIX variants, software and security-related matters, and hobbies outside of his office like fly-fishing and photography.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Don't ignore lsh !!

Anonymous's picture

Why do you ignore lsh, which is GNU software, covered

by the regular GPL license? It does only support SSH2 since there are security problems inherent in the SSH1 protocol. If you don't have a problem with that, try it out! It is somewhat different to use than Ssh or OpenSSH, but well worth it.

The latest version can be donwloaded from http://www.lysator.liu.se/~nisse/archive/

and is today 1.3.6

How many security holes has lsh had this year? None. (AFAIK, I'm just a user)

Re: Don't ignore lsh !!

Anonymous's picture

Why? Licence bigotry does nothing to advance either security or Free software. The whole BSD vs GPL holy war results in far too much brainpower being wasted on unnecessary duplication of effort. The fact that no vulnerabilities have been found in Ish does not demonstrate that it is bug-free; it means that it's an unknown quantity. The fact that OpenSSH has had holes discovered (and plugged!) helps demonstrate it's maturity and gives concrete proof of it's ability to survive real-world attack scenerios. It would be foolish to rely on unknown and unproven software in a mission-critical role.

Re: Don't ignore lsh !!

Anonymous's picture

A note from the lsh home page:
LSH IS A WORK IN PROGRESS. IT WILL NOT PROVIDE ANY SECURITY ON SYSTEMS THAT LACK /dev/random. THERE MAY BE OTHER SERIOUS BUGS THAT MAKE IT TOTALLY INSECURE.

You may not want to depend on lsh just yet...

Re: A Rough Year for SSH

Anonymous's picture

Informative article.

Re: A Rough Year for SSH

Anonymous's picture

I have a GPL'd tool that installs ssh keys at http://www.stearns.org/ssh-keyinstall/ Additionally, I have some tutorials at
http://www.stearns.org/doc/

Webinar
One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Webinar
Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix