Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. This presentation is made as an assignment during our university course.

1. SSH
The Secure Shell
1
Platform: Linux and Unix

2. 2
Group Members:
Arnob Roy (201314025)
Md. Jahidul Islam (201414020)
Asif Kamal Chowdhury (201414040)
Asif Sanjary (201414043)
Mehedi Afzal Farazi (201414045)
Md. Shafiul Islam (201414049)

3. SSH
 Secure Shell (SSH) is a cryptographic network protocol for
operating network services securely over an unsecured
network.
 It is a secure alternative to the non-protected login protocols
(such as telnet, rlogin) and insecure file transfer methods (such
as FTP).

4. What is SSH?
 It is a protocol not a product.
 Software based approach to network security.
 Encrypts data sent between the computers.
 SSH is replacement for telnet, rsh, rlogin and can also replace
ftp.
 Client/ Server Architecture.
 Comes with all Linux distribution, Mac OS X, AIX, Sun Solaris,
OpenBSD and other Unix variants.
 Ported to other operating systems, such as Windows, Palm
OS, Amiga etc.

5. What is not SSH?
 It is not a true shell like csh, ksh, sh etc.
 It is not a command interpreter.
 It creates secure channel for running commands on remote
computer.
 It is not a complete security solution.
 It will not protect against Trojans, viruses etc.

6. Why SSH is a replacement for telnet, rsh,
rlogin and ftp?
6
 Telnet and others sends all data in clear text. But SSH sends data as cipher
text.
 In SSH host between sender and receiver cannot see what the traffic is.

7. HISTORY
7
 In 1995, Tatu Yionene, a researcher at Helsinki University designed the first
version of the protocol (now known as SSH-1).
 In July 1995, he released SSH1 as free software i.e. it was open source.
 In December of 1995, he formed SSH Communication Security (SCS) to
market and develop SSH.
 In 1996 SSH-2 was developed, but it was incompatible with SSH-1.
 SCS released SSH-2 in 1998 and had more restrictive license.
 OpenSSH, free implementation of SSH-2 protocol was released from
OpenBSD project.
 In 2006 SECSH group (group for standardizing protocol) released SSH-2 as
internet standard.

8. Some Necessary Terminology
8
 SSH- Generic term used for SSH protocols.
 ssh- Client Command for running remote command.
 sshd- Server program.
 SSH-1- Version 1 of the protocol.
 SSH-2- Version 2 of the protocol
 OpenSSH- Product from open BSD project.

9. SSH1 vs SSH2
9
SSH1 SSH2
Uses server and host keys to
authenticate system.
Uses only host keys.
Different protocols are used. So,
they are not compatible with each
other.
Different protocols are used.
SSH1 is not currently developed by
developers.
SSH2 is currently monitored and
developed by developers.
Less security, performance and
portability.
More security, performance and
portability.

10. SSH LAYERS
10
Application Layer
ssh-connection
Session multiplexing, X11 and port
forwarding, remote command
execution etc.
ssh-userauth
User authentication using public
key, password, host based etc.
ssh-transport
Initial key exchange and server
authentication, setup encryption
Transport Layer TCP
Internet Layer IP
Network Access Layer Ethernet

11. SSH BASIC ARCHITECTURE
11

12. INSTALING SSH
12
 Downloading Source Code
We can download the source code from-
http://www.openssh.com
 Building and installing OpenSSH
$ gtar –xyf openssh-4.5p1.tar.gz
$ cd openssh-4.5p1
$ ./configure
$ make
$ make install

13. HOW SSH PROTOCOL WORK?
13
 Works in the client-server model.
 SSH client drives the connection
setup process and uses public key
cryptography to verify the identity of
the SSH server.
 After the setup phase the SSH
protocol uses strong symmetric
encryption and hashing algorithms
to ensure the privacy and integrity
of the data that is exchanged
between the client and server.

14. SSH ENCRYPTION ALGORITHMS
14
Secure Shell uses the following ciphers for encryption:
Cipher SSH1 SSH2
DES yes no
3DES yes yes
IDEA yes no
Blowfish yes yes
Twofish no yes
Arcfour no yes
Cast128-cbc no yes

15. SSH ENCRYPTION ALGORITHMS
15
Secure Shell uses the following ciphers for authentication:
Cipher SSH1 SSH2
RSA yes no
DSA no yes

16. Functions
16
 Secure Command Shell
 Port Forwarding
 Agent Forwarding
 Secure file transfer.

17. Secure Command Shell
17
 Allow us to edit files.
 View the contents of directories.
 Custom based applications.
 Create user accounts.
 Change permissions.
 Anything can be done from command prompt can be done remotely and
securely.

18. Port Forwarding
18
 Powerful Tool.
 provide security to
TCP/IP applications
including e-mail, sales
and customer contact
databases, and in-
house applications.
 allows data from
normally unsecured
TCP/IP applications to
be secured.

19. Agent Forwarding
19
 Let, anyone want to login to
the computer at work from
home computer or from
hotel while travelling. The
computer at work is behind
the firewall so you cannot
connect to it directly.
 We are allowed to connect
to a bastion host, but are
not allowed to store private
keys on it.
 What can you do?

20. SECURE FILE TRANSFER & PROTOCOL
20
 Secure File Transfer Protocol (SFTP) is a subsystem of the Secure Shell
protocol.
 Separate protocol layered over the Secure Shell protocol to handle file
transfers.
 Secure extranet is one of the safest ways to make specific data available
to customers, partners and remote employees without exposing other
critical company information to the public network. Using SFTP on your
secure extranet machines effectively restricts access to authorized users
and encrypts usernames, passwords and files sent to or from them.

21. SECURITY BENEFITS
21
 User Authentication
 Host Authentication
 Data Encryption
 Data Integrity

22. USER AUTHENTICATION
22
 User Identity
 System verifies that access is only given to intended users and denied to
anyone else.

23. HOST AUTHENTICATION
23
 A host key is used by a server to prove its identity to a client and by a
client to verify a "known" host. Host keys are described as persistent
(they changed infrequently) and are asymmetric--much like the
public/private key pairs. If a machine is running only one SSH server, a
single host key serves to identify both the machine and the server. If a
machine is running multiple SSH servers, it may either have multiple
host keys or use a single key for multiple servers. Host authentication
guards against the Man-in-the-Middle attack.

24. HOST AUTHENTICATION
24
 To access an account on
a Secure Shell server, a
copy of the client's public
key must be uploaded to
the server. When the
client connects to the
server it proves that it
has the secret, or private
counterpart to the public
key on that server, and
access is granted.

25. DATA ENCRYPTION
25
 Encryption, sometimes referred to as privacy, means that our data is
protected from disclosure to a would-be attacker "sniffing" or
eavesdropping on the wire. Ciphers are the mechanism by which Secure
Shell encrypts and decrypts data being sent over the wire.
 When a client establishes a connection with a Secure Shell server, they
must agree which cipher they will use to encrypt and decrypt data. The
server generally presents a list of the ciphers it supports, and the client
then selects the first cipher in its list that matches one in the server's list.

26. DATA INTEGRITY
26
 Data integrity guarantees that data sent from one end of a transaction
arrives unaltered at the other end. Even with Secure Shell encryption,
the data being sent over the network could still be vulnerable to
someone inserting unwanted data into the data stream (See Insertion
and replay attacks for more details). Secure Shell version 2 (SSH2) uses
Message Authentication Code (MAC) algorithms to greatly improve upon
the original Secure Shell's (SSH1) simple 32-bit CRC data integrity
checking method.

27. PASSWORD AUTHENTICATION
27
 Passwords, in combination with a username, are a popular way to tell
another computer that you are who you claim to be.
 If the username and password given at authentication match the
username and password stored on a remote system, you are
authenticated and allowed access.

28. PUBLIC KEY AUTHENTICATION
28
 Public key authentication uses a pair of computer generated keys - one
public and one private. Each key is usually between 1024 and 2048 bits
in length.
 Most secure Method to authenticate using Secure Shell.
 To access an account on a Secure Shell server, a copy of the client's
public key must be uploaded to the server. When the client connects to
the server it proves that it has the secret, or private counterpart to the
public key on that server, and access is granted.

29. PROTECT AGAINST
29
 IPS Spoofing
 DNS Spoofing
 IP Source Routing

30. IPS Spoofing
30
 IP spoofing is a technique used to gain unauthorized access to
computers, whereby the intruder sends messages to a computer with an
IP address indicating that the message is coming from a trusted host.

31. DNS Spoofing
31
 DNS spoofing is a term used when a DNS server accepts and uses
incorrect information from a host that has no authority giving that
information. DNS spoofing is in fact malicious cache poisoning where
forged data is placed in the cache of the name servers. Spoofing attacks
can cause serious security problems for DNS servers vulnerable to such
attacks, for example causing users to be directed to wrong Internet sites
or e-mail being routed to non-authorized mail servers.

32. IPS SOURCE ROUTING
32
 Where a host can pretend that an IP packet comes from another, trusted
host.

33. OpenSSH Alternatives for windows
33
 PuTTY
 TTSSH
 Cygwin
 MSSH
 WinSCP
 FileZilla

34. ADVANTAGES
34
 Strong Encryption.
 Strong authentication. Closes several security holes (e.g., IP, routing,
and DNS spoofing).
 Improved privacy. All communications are automatically and
transparently encrypted.
 Both free and commercial version available.
 Proven technology.
 Multi-platform.
 Many authentication methods supported.
 Can use it instead of VPN.

35. Disadvantages
35
 Port ranges & dynamic ports can’t be forwarded.
 A client on the Internet that uses SSH to access the Intranet, can expose
the Intranet by port forwarding.

36. REFERENCES
36
 https://www.ssh.com/
 http://www.employees.org/
 openssh.com
 https://en.wikipedia.org/wiki/Secure_Shell
 http://yakko.cs.wmich.edu/presentations/20021107-ssh/slides/img7.html
 http://www.vandyke.com/solutions/ssh_overview/ssh_overview_function
alit
 http://michaelsteel.tripod.com/cgi-bin/

37. 37