SSH for beginners - Revision history

Ebarrier: /* Summary */

2016-05-16T17:46:15Z

Summary

← Older revision		Revision as of 20:46, 16 May 2016
Line 198:		Line 198:
	==Summary==		==Summary==

	SSH is a must-know and a must-use protocol in nowadays information systems. It encrypts communications between two computers using encryption algorithms which are extremely hard to break. These encryption algorithms implement the concept of public and private keys to exchange data in a secure manner. Its free and open-source implementations make it widely used in the whole world and the main way to exchange data. SSH is present by default in Ubuntu and can be easily used on other platforms as well, either on CLI or GUI. It is very easy to use its basic features (see present article) while experienced users can use all the powerful features it also offers under the hood (see links below).		SSH is a must-know and a must-use protocol in nowadays information systems. It encrypts communications between two computers using encryption algorithms which are extremely hard to break. These encryption algorithms implement the concept of public and private keys to exchange data in a secure manner. Its free and open-source implementations make it widely used in the whole world and the main way to exchange data as a good security practice. SSH is present by default in Ubuntu and can be easily used on other platforms as well, either on CLI or GUI. It is very easy to use its basic features (see present article) while experienced users can use all the powerful features it also offers under the hood (see links below).

	==See also==		==See also==

Ebarrier at 17:39, 16 May 2016

2016-05-16T17:39:59Z

← Older revision		Revision as of 20:39, 16 May 2016
Line 195:		Line 195:

	<code>ssh-keygen –R <hostname></code>		<code>ssh-keygen –R <hostname></code>

			==Summary==

			SSH is a must-know and a must-use protocol in nowadays information systems. It encrypts communications between two computers using encryption algorithms which are extremely hard to break. These encryption algorithms implement the concept of public and private keys to exchange data in a secure manner. Its free and open-source implementations make it widely used in the whole world and the main way to exchange data. SSH is present by default in Ubuntu and can be easily used on other platforms as well, either on CLI or GUI. It is very easy to use its basic features (see present article) while experienced users can use all the powerful features it also offers under the hood (see links below).

	==See also==		==See also==

Ebarrier: /* SSH in practice */

2016-05-16T17:02:28Z

SSH in practice

← Older revision		Revision as of 20:02, 16 May 2016
Line 74:		Line 74:
	==SSH in practice==		==SSH in practice==

	~~We are covering several~~ study-cases which are the most common ones ~~you~~ may encounter. In all of them, it is assumed that SSH package is installed on your machine (comes by default on Ubuntu), and that the remote host (~~which we will call~~ "server" from now on) has also ~~enabled~~ SSH remote access.		Several study-cases which are the most common ones a user may encounter will be covered in this section. In all of them, it is assumed that SSH package is installed on your machine (comes by default on Ubuntu), and that the remote host (called "server" from now on) has also SSH remote access enabled.

	===Create/Generate SSH keys===		===Create/Generate SSH keys===
Line 84:		Line 84:
	<code>ssh-keygen</code>		<code>ssh-keygen</code>

	Then you will be asked a path where to save the key. ~~We suggest you~~ save it in the default location by just hitting <code>Enter</code>.		Then you will be asked a path where to save the key. It is suggested to save it in the default location by just hitting <code>Enter</code>.
	Then you will be asked to enter a passphrase, which ~~we recommend~~ to do, although it is not compulsory.		Then you will be asked to enter a passphrase, which is strongly recommended to do, although it is not compulsory.

	That's all, your keys are generated! The whole process looks like this in your terminal:		That's all, your keys are generated! The whole process looks like this in your terminal:
Line 182:		Line 182:

	Usually you create one pair of keys per computer you have. But you can create as many keys as you want if needed. To have several keys of the same type you can change their file name and/or file path. But SSH utility will look for the default key file names (''id_<keyType>'') in the default directory (''~/.ssh/'').		Usually you create one pair of keys per computer you have. But you can create as many keys as you want if needed. To have several keys of the same type you can change their file name and/or file path. But SSH utility will look for the default key file names (''id_<keyType>'') in the default directory (''~/.ssh/'').
	To connect to a server using a non-default private key, ~~we can specify~~ its path:		To connect to a server using a non-default private key, its path can be specified:

	<code>ssh -i <privateKeyPath> <user>@<hostname></code>		<code>ssh -i <privateKeyPath> <user>@<hostname></code>

Ebarrier: /* Background */

2016-05-16T16:59:25Z

Background

← Older revision		Revision as of 19:59, 16 May 2016
Line 6:		Line 6:
	This tutorial-like article is intended for beginner users who would like to learn about SSH cryptography protocol from scratch and/or get a deeper understanding of it.		This tutorial-like article is intended for beginner users who would like to learn about SSH cryptography protocol from scratch and/or get a deeper understanding of it.

	It has been made using Linux Ubuntu 14.04 distribution, therefore ~~we cannot guarantee~~ that the information is relevant for other Linux distributions or for Windows or MAC.		It has been made using Linux Ubuntu 14.04 distribution, therefore it is not guaranteed that the information is relevant for other Linux distributions or for Windows or MAC.

	It is assumed that you are already familiar with the basics of Linux command line terminal commands. The commands which are not directly related to SSH will not be explained.		It is assumed that you are already familiar with the basics of Linux command line terminal commands. The commands which are not directly related to SSH will not be explained.

Ebarrier: /* Authorized keys */

2016-05-16T16:57:39Z

Authorized keys

← Older revision		Revision as of 19:57, 16 May 2016
Line 54:		Line 54:
	===Authorized keys===		===Authorized keys===

	Your public key must be placed on all servers that you want to access remotely. More specifically, your public key must be insert in a new line of the file ''~/.ssh/'''authorized_keys''''' on the server. This file contains all the public keys of all the clients that are authorized to access the server via SSH. This is the reason why your private key must remain secret: anybody with your private key file can access all servers where your ~~private~~ key is written in the ''authorized_keys'' file. If your key gets stolen, you must remove the line where your key appears in this file on all servers where it is present.		Your public key must be placed on all servers that you want to access remotely. More specifically, your public key must be insert in a new line of the file ''~/.ssh/'''authorized_keys''''' on the server. This file contains all the public keys of all the clients that are authorized to access the server via SSH. This is the reason why your private key must remain secret: anybody with your private key file can access all servers where your public key is written in the ''authorized_keys'' file. If your key gets stolen, you must remove the line where your key appears in this file on all servers where it is present.

	===Known-host and key fingerprint/randomart===		===Known-host and key fingerprint/randomart===

Ebarrier: /* Types of encryption */

2016-05-16T16:54:52Z

Types of encryption

← Older revision		Revision as of 19:54, 16 May 2016
Line 34:		Line 34:
	===Types of encryption===		===Types of encryption===

	To encrypt the data, it can use different types of encryption: DSA, [http://searchsecurity.techtarget.com/definition/RSA RSA], RSA1, [https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet/ ECDSA] and [http://ed25519.cr.yp.to Ed25519]. The type of encryption depends on mathematical properties ~~that it uses~~ to generate random keys which are extremely hard to reverse engineer. The type RSA1 is from the SSH protocol version 1 which is obsolete and should not be used. All others are part of SSH protocol version 2 but [http://searchsecurity.techtarget.com/definition/Digital-Signature-Standard DSA] should not be used because it has vulnerabilities.<ref>[http://thread.gmane.org/gmane.linux.debian.devel.announce/1220/focus=127931 Vulnerability of DSA algorithm 1]</ref> <ref>[https://plog.sesse.net/blog/tech/2008-05-14-17-21_some_maths.html Vulnerability of DSA algorithm 2]</ref>		To encrypt the data, SSH can use different types of encryption: DSA, [http://searchsecurity.techtarget.com/definition/RSA RSA], RSA1, [https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet/ ECDSA] and [http://ed25519.cr.yp.to Ed25519]. The type of encryption depends on mathematical properties used to generate random keys which are extremely hard to reverse engineer. The type RSA1 is from the SSH protocol version 1 which is obsolete and should '''not''' be used. All others are part of SSH protocol version 2 but [http://searchsecurity.techtarget.com/definition/Digital-Signature-Standard DSA] should '''not''' be used because it has vulnerabilities.<ref>[http://thread.gmane.org/gmane.linux.debian.devel.announce/1220/focus=127931 Vulnerability of DSA algorithm 1]</ref> <ref>[https://plog.sesse.net/blog/tech/2008-05-14-17-21_some_maths.html Vulnerability of DSA algorithm 2]</ref>

	From the remaining RSA, ECDSA and Ed25519, RSA is the most widely used although it not as efficient and "strong" as the other ones (in theory). The main advantage of ECDSA and Ed25519 is that they provide the same level of security than RSA but with shorter keys (256-bit key for ECDSA/Ed25519 is equivalent to 3000-bit RSA key) <ref>[https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet blog.cloudflare.com] ECDSA vs RSA</ref>. But RSA remains the most popular type because all SSH clients are compatible with it and until now, it has remained unbreakable. RSA, ECDSA and Ed25519 types are all so far considered unbreakable.		From the remaining RSA, ECDSA and Ed25519, RSA is the most widely used although it not as efficient and "strong" as the other ones (in theory). The main advantage of ECDSA and Ed25519 is that they provide the same level of security than RSA but with shorter keys (256-bit key for ECDSA/Ed25519 is equivalent to 3000-bit RSA key) <ref>[https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet blog.cloudflare.com] ECDSA vs RSA</ref>. But RSA remains the most popular type because all SSH clients are compatible with it and until now, it has remained unbreakable. RSA, ECDSA and Ed25519 types are all so far considered unbreakable.

Ebarrier: /* Why use SSH to access a remote host? */

2016-05-16T16:52:23Z

Why use SSH to access a remote host?

← Older revision		Revision as of 19:52, 16 May 2016
Line 28:		Line 28:
	===Why use SSH to access a remote host?===		===Why use SSH to access a remote host?===

	The main reason to use SSH is '''security''', because the data between the two hosts is encrypted. SSH has almost completely replaced Telnet and FTP protocols which transfer data in plain text. With Telnet or FTP, if somebody listens to ~~your~~ traffic, it ~~will be~~ extremely easy to get all the data, including the passwords.		The main reason to use SSH is '''security''', because the data between the two hosts is encrypted. SSH has almost completely replaced Telnet and FTP protocols which transfer data in plain text. With Telnet or FTP, if somebody listens to someone else's traffic, it is extremely easy to get all the data, including the passwords.

	SSH has become a standard to establish a connection between two computers and a good practice regarding privacy and security standards.		SSH has become a standard to establish a connection between two computers and a good practice regarding privacy and security standards.

Ebarrier: /* A bit of history */

2016-05-16T16:51:06Z

A bit of history

← Older revision		Revision as of 19:51, 16 May 2016
Line 16:		Line 16:
	==A bit of history==		==A bit of history==

	The SSH protocol was invested in 1995 by the Finnish Tatu Ylönen who was a researcher at the Helsinki University of Technology in Finland.<ref>[http://docstore.mik.ua/orelly/networking_2ndEd/ssh/ch01_05.htm docstore.mik.ua] Short history of SSH</ref> He decided to develop his own remote connection protocol after an attack performed against his university. He published the source code if his protocol and everyone could use it for free. SSH gained popularity very rapidly and Tatu understood that SSH could become something much bigger. Consequently, he founded his company the same year, called SSH Communications Security, to develop and sell his service around SSH. Tatu Ylönen is still the [http://www.ssh.com/about/management CEO of the company].		The SSH protocol was invested in 1995 by the Finnish Tatu Ylönen who was a researcher at the Helsinki University of Technology in Finland.<ref>[http://docstore.mik.ua/orelly/networking_2ndEd/ssh/ch01_05.htm docstore.mik.ua] Short history of SSH</ref> He decided to develop his own remote connection protocol after an attack performed against his university. He published the source code of his protocol and everyone could use it for free. SSH gained popularity very rapidly and Tatu understood that SSH could become something much bigger. Consequently, he founded his company the same year, called SSH Communications Security, to develop and sell his service around SSH. Tatu Ylönen is still the [http://www.ssh.com/about/management CEO of the company].

	SSH version 1 was ~~relased~~ and documented in 1995 but its problems also emerged as it was used by a steadily number of users. Meanwhile, a working group called SECSH at the IETF ([https://www.ietf.org Internet Engineering Task Force]) started to work on the version 2. When ~~the~~ version ~~was released~~ in 1998, it was not widely adopted because its licensed was more restrictive than the first version: it is was not free for commercial use.		SSH version 1 was released and documented in 1995 but its problems also emerged as it was used by a steadily number of users. Meanwhile, a working group called SECSH at the IETF ([https://www.ietf.org Internet Engineering Task Force]) started to work on the version 2. When this latter version came out in 1998, it was not widely adopted because its licensed was more restrictive than the first version: it is was not free for commercial use.

	In the years 2000 however, the loosening of the license terms combined with the development of a fork of the first version under the OpenBSD license called OpenSSH, boosted its interest. As for today, the OpenSSH implementation is the most widely in the open-source world.		In the years 2000 however, the loosening of the license terms combined with the development of a fork of the first version under the OpenBSD license called OpenSSH, boosted its interest. As for today, the OpenSSH implementation is the most widely in the open-source world.

	==Concepts of SSH==		==Concepts of SSH==

Ebarrier: /* Background */

2016-05-16T16:48:53Z

Background

← Older revision		Revision as of 19:48, 16 May 2016
Line 8:		Line 8:
	It has been made using Linux Ubuntu 14.04 distribution, therefore we cannot guarantee that the information is relevant for other Linux distributions or for Windows or MAC.		It has been made using Linux Ubuntu 14.04 distribution, therefore we cannot guarantee that the information is relevant for other Linux distributions or for Windows or MAC.

	It is assumed that you are already familiar with the basics of Linux command line terminal commands. ~~We are not going to explain the~~ commands which are not directly related to SSH.		It is assumed that you are already familiar with the basics of Linux command line terminal commands. The commands which are not directly related to SSH will not be explained.

	SSH was built based on a client-server architecture and ~~we are focusing~~ only on the client side of SSH. See [https://help.ubuntu.com/community/SSH/OpenSSH/Configuring here for SSH on server side for Ubuntu.]		SSH was built based on a client-server architecture and this article focuses only on the client side of SSH. See [https://help.ubuntu.com/community/SSH/OpenSSH/Configuring here for SSH on server side for Ubuntu.]

	For any comments to the author of this article, please send an email to etienne(dot}barrier{at]itcollege[dot)ee.		For any comments to the author of this article, please send an email to etienne(dot}barrier{at]itcollege[dot)ee.

Ebarrier at 11:32, 1 May 2016

2016-05-01T11:32:06Z

← Older revision		Revision as of 14:32, 1 May 2016
Line 1:		Line 1:
	Author: Etienne Barrier		Author: Etienne Barrier

	Last modified: 26.04.2016		Last modified: 01.05.2016

	==Background==		==Background==