{"id":66,"date":"2013-04-01T00:55:36","date_gmt":"2013-04-01T05:55:36","guid":{"rendered":"https:\/\/www.softwareab.net\/wordpress\/?p=66"},"modified":"2013-05-01T13:50:23","modified_gmt":"2013-05-01T18:50:23","slug":"quick-primer-on-ssh","status":"publish","type":"post","link":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/","title":{"rendered":"Quick Primer on SSH…"},"content":{"rendered":"

Here’s an oldie but goodie! I have to solve this problem of sharing sensitive information with other folks safely frequently. In our organization, we use not so much a really expensive cryptosystem as an <\/span>internal<\/i> system. That is, we’re a Microsoft ActiveDirectory shop so we get a CA for the cost of the server license and we use that to generate keys. From an email point of view, Exchange allows us to sign mail messages with the receiver’s public key and that seems to work well with the Government \/ DoD customers. So the real question seems to be if I wanted to setup secure communications with someone who was using just plain old hotmail or gmail. (That’s my take, at least.)<\/span><\/p>\n

I think we see where this question is going: that’s right, we want to talk about PGP (“Pretty Good Privacy” and establishing a little Web of Trust. So let’s take that as read: we both pull down PGP, generate a keypair, and then we have to work out how we <\/span>authoritatively<\/i> setup the public key exchanges (since we don’t have a PKI). We can use the root server that Dr. Kabay listed to perform this exchange, and that’s the hard part (done!). From that point on, we sign \/ encrypt messages as per usual (sign with our private key, encrypt with the receiver’s public key) and we have our secure message transfer.<\/span><\/p>\n

Let’s go one step further and say that I want to expose secure access to a system with someone external to my organization. To keep this in scope with the question, let’s say I want to setup a secure drop box we can exchange clever witticisms from (that’s communications of a sort, at least). Here’s how I’d do it (remember, this is all on Windoze, not *NIX):<\/p>\n

    \n
  1. On my side, download Cygwin and install the OpenSSH package.Then use <\/span>ssh-host-config<\/b> to setup the <\/span>sshd <\/i>daemon and install it as a service. Run the sshd service (preferably on a non-standard port, but that will probably not be allowed by your firewall policy).<\/span><\/li>\n
  2. Create a <\/span>local<\/i> account for the person I want to let in. Not a domain account, not a privileged account, just an account with minimal privileges but allowed to login (\u00e2\u20ac\u0153Access this computer from the network\u00e2\u20ac\u009d user right). Give that local account a very strong password (for example, Steve Gibson has a great generator you can use below). After all, this password will never be used directly.<\/span><\/li>\n
  3. Use the <\/span>mkpasswd -l | grep [local_user] >> \/etc\/passwd<\/b> command to create a mapping between the account I want to grant access and the Cygwin pseudo-UNIX environment.<\/span><\/li>\n
  4. Modify <\/span>\/etc\/sshd_config<\/b> to reference a nice, scary logon banner, specify the <\/span>AllowUsers<\/i> and set <\/span>PasswordAuthenticate<\/i> to \u00e2\u20ac\u0153no.\u00e2\u20ac\u009d<\/span><\/li>\n
  5. Tell my counterpart to download the complete Putty package (see below). Use <\/span>puttygen<\/i> to generate a strong keypair (say 2048 bits, SSH-2 RSA even though Dr. Kabay indicates RSA is not the latest).<\/span>
    \n\"puttygen\"<\/a><\/li>\n
  6. Have my counterpart send me the public key from puttygen. That should occur out-of-band, but I’m thinking that we can do this pretty easily, I’ll have him encrypt the message with a secret key that we agree to on the phone.<\/span><\/li>\n
  7. On my new user’s home directory, create the requisite .ssh<\/b> directory and cat<\/b> the received public key into the authorized_keys2<\/i> file. Now the SSH daemon, when presented with my new user’s logon ID, will automatically challenge based on that key (that’s how we get the public key protection).<\/li>\n<\/ol>\n

    My new user can now logon to my SSH server using public key, and all for free! Have her use the Putty SCP (Secure CoPy) to be able to transfer files to our drop box (my new user has write privileges only to her local home directory, and read privileges for very little else).<\/p>\n

    Here’s a picture of my using (free!) public key support to login to my own box (localhost):
    \n    \"ssh_access\"<\/a><\/p>\n

     <\/p>\n

    References:<\/i><\/b><\/p>\n

    \u00e2\u20ac\u0153PGP Desktop Trial Software (Client Only)\u00e2\u20ac\u009d – http:\/\/www.pgp.com\/downloads\/desktoptrial\/desktoptrial2.html<\/a><\/p>\n

    \u00e2\u20ac\u0153GNU + Cygnus + Windows = cygwin\u00e2\u20ac\u009d – <\/span>http:\/\/www.cygwin.com\/<\/a><\/p>\n

    \u00e2\u20ac\u0153Putty: a free telnet\/ssh client\u00e2\u20ac\u009d – <\/span>http:\/\/www.chiark.greenend.org.uk\/~sgtatham\/putty\/<\/a><\/p>\n

    \u00e2\u20ac\u0153Perfect Passwords – GRC’s Ultra High Security Password Generator\u00e2\u20ac\u009d – <\/span>https:\/\/www.grc.com\/passwords.htm<\/a>. Steve Gibson is a legend in the PC security industry. Read his site, he’s got a lot of thought-provoking articles.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Here’s an oldie but goodie! I have to solve this problem of sharing sensitive information with other folks safely frequently. In our organization, we use not so much a really expensive cryptosystem as an internal system. That is, we’re a …<\/p>\n

    Quick Primer on SSH…<\/span> Read More »<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[25,24],"yoast_head":"\nQuick Primer on SSH... - softwareab<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Quick Primer on SSH... - softwareab\" \/>\n<meta property=\"og:description\" content=\"Here’s an oldie but goodie! I have to solve this problem of sharing sensitive information with other folks safely frequently. In our organization, we use not so much a really expensive cryptosystem as an internal system. That is, we’re a … Quick Primer on SSH… Read More »\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/\" \/>\n<meta property=\"og:site_name\" content=\"softwareab\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cloudraticsolutions\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/cloudraticsolutions\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-04-01T05:55:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2013-05-01T18:50:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen-300x288.jpg\" \/>\n<meta name=\"author\" content=\"Andrew Bruce\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@realcloudratics\" \/>\n<meta name=\"twitter:site\" content=\"@realcloudratics\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andrew Bruce\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/\"},\"author\":{\"name\":\"Andrew Bruce\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\"},\"headline\":\"Quick Primer on SSH…\",\"datePublished\":\"2013-04-01T05:55:36+00:00\",\"dateModified\":\"2013-05-01T18:50:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/\"},\"wordCount\":732,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\"},\"image\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen-300x288.jpg\",\"keywords\":[\"remote access\",\"ssh\"],\"articleSection\":[\"Teknocratica\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/\",\"name\":\"Quick Primer on SSH... - softwareab\",\"isPartOf\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen-300x288.jpg\",\"datePublished\":\"2013-04-01T05:55:36+00:00\",\"dateModified\":\"2013-05-01T18:50:23+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen.jpg\",\"contentUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen.jpg\",\"width\":483,\"height\":464},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.softwareab.net\/wordpress\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"remote access\",\"item\":\"https:\/\/www.softwareab.net\/wordpress\/tag\/remote-access\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Quick Primer on SSH…\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#website\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/\",\"name\":\"softwareab\",\"description\":\"Technocratica, Technopolitik, Technophobia\",\"publisher\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.softwareab.net\/wordpress\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600\",\"name\":\"Andrew Bruce\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg\",\"contentUrl\":\"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg\",\"width\":400,\"height\":330,\"caption\":\"Andrew Bruce\"},\"logo\":{\"@id\":\"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/\"},\"description\":\"Team-oriented systems mentor with deep knowledge of numerous software methodologies, technologies, languages, and operating systems. Excited about turning emerging technology into working production-ready systems. Focused on moving software teams to a higher level of world-class application development. Specialties:Software analysis and development...Product management through the entire lifecycle...Discrete product integration specialist!\",\"sameAs\":[\"http:\/\/cloudraticsolutions.net\/\",\"https:\/\/www.facebook.com\/cloudraticsolutions\/\",\"https:\/\/twitter.com\/realcloudratics\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Quick Primer on SSH... - softwareab","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/","og_locale":"en_US","og_type":"article","og_title":"Quick Primer on SSH... - softwareab","og_description":"Here’s an oldie but goodie! I have to solve this problem of sharing sensitive information with other folks safely frequently. In our organization, we use not so much a really expensive cryptosystem as an internal system. That is, we’re a … Quick Primer on SSH… Read More »","og_url":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/","og_site_name":"softwareab","article_publisher":"https:\/\/www.facebook.com\/cloudraticsolutions\/","article_author":"https:\/\/www.facebook.com\/cloudraticsolutions\/","article_published_time":"2013-04-01T05:55:36+00:00","article_modified_time":"2013-05-01T18:50:23+00:00","og_image":[{"url":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen-300x288.jpg"}],"author":"Andrew Bruce","twitter_card":"summary_large_image","twitter_creator":"@realcloudratics","twitter_site":"@realcloudratics","twitter_misc":{"Written by":"Andrew Bruce","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#article","isPartOf":{"@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/"},"author":{"name":"Andrew Bruce","@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600"},"headline":"Quick Primer on SSH…","datePublished":"2013-04-01T05:55:36+00:00","dateModified":"2013-05-01T18:50:23+00:00","mainEntityOfPage":{"@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/"},"wordCount":732,"commentCount":0,"publisher":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600"},"image":{"@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage"},"thumbnailUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen-300x288.jpg","keywords":["remote access","ssh"],"articleSection":["Teknocratica"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/","url":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/","name":"Quick Primer on SSH... - softwareab","isPartOf":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage"},"image":{"@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage"},"thumbnailUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen-300x288.jpg","datePublished":"2013-04-01T05:55:36+00:00","dateModified":"2013-05-01T18:50:23+00:00","breadcrumb":{"@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#primaryimage","url":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen.jpg","contentUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2013\/04\/puttygen.jpg","width":483,"height":464},{"@type":"BreadcrumbList","@id":"https:\/\/www.softwareab.net\/wordpress\/quick-primer-on-ssh\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.softwareab.net\/wordpress\/"},{"@type":"ListItem","position":2,"name":"remote access","item":"https:\/\/www.softwareab.net\/wordpress\/tag\/remote-access\/"},{"@type":"ListItem","position":3,"name":"Quick Primer on SSH…"}]},{"@type":"WebSite","@id":"https:\/\/www.softwareab.net\/wordpress\/#website","url":"https:\/\/www.softwareab.net\/wordpress\/","name":"softwareab","description":"Technocratica, Technopolitik, Technophobia","publisher":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.softwareab.net\/wordpress\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/1337443eaeb75104e0410b508e67f600","name":"Andrew Bruce","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/","url":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg","contentUrl":"https:\/\/www.softwareab.net\/wordpress\/wp-content\/uploads\/2024\/03\/andy-cartoon.jpg","width":400,"height":330,"caption":"Andrew Bruce"},"logo":{"@id":"https:\/\/www.softwareab.net\/wordpress\/#\/schema\/person\/image\/"},"description":"Team-oriented systems mentor with deep knowledge of numerous software methodologies, technologies, languages, and operating systems. Excited about turning emerging technology into working production-ready systems. Focused on moving software teams to a higher level of world-class application development. Specialties:Software analysis and development...Product management through the entire lifecycle...Discrete product integration specialist!","sameAs":["http:\/\/cloudraticsolutions.net\/","https:\/\/www.facebook.com\/cloudraticsolutions\/","https:\/\/twitter.com\/realcloudratics"]}]}},"_links":{"self":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts\/66"}],"collection":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/comments?post=66"}],"version-history":[{"count":4,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts\/66\/revisions"}],"predecessor-version":[{"id":222,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/posts\/66\/revisions\/222"}],"wp:attachment":[{"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/media?parent=66"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/categories?post=66"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.softwareab.net\/wordpress\/wp-json\/wp\/v2\/tags?post=66"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}