RECUENTO HISTORICO DE LOS ACUERDOS COMERCIALES CON OTRAS

Once you have downloaded the SSH client from www.ssh.com or www.openssh .com on a Unix operating system, it must first be extracted. (The letters XYZ that follow are a variable that signifies the version number of the SSH client you will be downloading):

#gunzip –c ssh-XYZ.tar.gz | tar xvf –

After extraction, change directories to the SSH folder. Once inside the SSH folder, the binary must be compiled and created:

#cd ssh-XYZ #./configure

Unix, the file can be located at /usr/local/bin/ssh2. OpenSSH client binary is called ssh on both Unix and Windows. On Windows, the file can be located at \Program Files\OpenSSH\bin\ssh.exe. On Unix, the file can be located at /usr/local/bin/ssh. Once you have located the SSH client binary, type ssh2 –hfor the SSH Communications’ binary or ssh –h for OpenSSH’s binary. The following help should appear:

Usage: ssh2 [options] [user@]host[#port] [command]

Options:

-l login_name Log in using this user name. -n Redirect input from /dev/null.

+a Enable authentication agent forwarding. -a Disable authentication agent forwarding.

+x Enable X11 connection forwarding (treat X11 clients as UNTRUSTED).

+X Enable X11 connection forwarding (treat X11 clients as TRUSTED).

-x Disable X11 connection forwarding.

-i file Identity file for public key authentication -F file Read an alternative configuration file. -t Tty; allocate a tty even if command is given. -v Verbose; display verbose debugging messages. Equal to ‘-d 2’

-d level Set debug level.

-V Display version string.

-q Quiet; don’t display any warning messages. -f[o] Fork into background after authentication.

With optional ‘o’ argument, goes to “one-shot” mode. -e char Set escape character; ‘none’ = disable (default: ~). -c cipher Select encryption algorithm. Multiple -c options are

allowed and a single -c flag can have only one cipher. -m MAC Select MAC algorithm. Multiple -m options are

allowed and a single -m flag can have only one MAC. -p port Connect to this port. Server must be on the same port. -S Don’t request a session channel.

-L listen-port:host:port Forward local port to remote address -R listen-port:host:port Forward remote port to local address -g Gateway ports, i.e. remote hosts may connect to locally

array of options that SSH can provide. In its simplest sense, SSH can connect an SSH server listening on its default port, which is 22. The –p switch is required in order to specify a port other than 22; however, if –p is not used, port 22 will be used as the default. Similarly, the –l switch needs to be used in order to specify a username. If you do not use the –l switch, the current user that the command is being executed from will be used:

ssh 10.0.0.3 –l cdwivedi –p 22 cdwivedi’s password:

Authentication successful.

Last login: Thurs June 12 05:52:06 2003 from 172.16.11.17

As an alternative, the same command can be written without any switches, using SSH defaults:

ssh [email protected]#22

–l and –p are two of the various switches used with the SSH client. The following section describes some of the more important switches used throughout the rest of this book.

The first switch is –i. The –i switch can be used to point to a pubic-key file used to authenticate to an SSH server. A copy of the public-key file needs to exist on the SSH server for public-key authentication, discussed further in Chapter 4. An example of the –i switch follows:

ssh 10.0.0.3 –l cdwivedi –p 60599 –i publickey.pub

The –L and –R switches are used for local port forwarding and remote port forwarding. Port forwarding is discussed in Chapter 6; however, a general understanding of its syntax is required now. Local port forwarding allows the local connection to a port to be forwarded to a remote server on any remote port through the SSH server. For example, a mail server that has the IP address 10.0.0.100 and is listening on port 143 can be accessed using SSH. The SSH

ssh 10.0.0.3 –l cdwivedi –R 139:127.0.0.1:139

Options can be also set for the type of encryption desired as well as the type of MAC algorithm. For example, if the SSH server accepts only connections using Triple-DES (3DES), the –c switch should be used. Triple-DES is an algorithm that can be used to encrypt data. This allows 3DES to be used to encrypt data that traverses the network. If more than one type of encryption is supported, multiple –c options can be used. The following are two examples of the encryption options:

ssh 10.0.0.3 –l cdwivedi –c 3DES

ssh 10.0.0.3 –l cdwivedi –c 3DES –c Blowfish

The MAC algorithms used can either be MD5 or SHA1. Both MD5 and SHA1 are algorithms that can be used to verify the integrity of data. MD5 uses a 128-bit message digest from data input that is unique to the data. SHA1 uses a 160-bit message digest from data input that is also unique to the data. This allows the MD5 and SHA1 hashes to be used as a fingerprint for a partic- ular piece of data. To use the MAC algorithms, the –m flag should be used with the specific option (hmac-md5 or hmac-sha1) in order to hash the data that will be transferred between to entities. The following are two examples of the MAC options:

ssh 10.0.0.3 –l cdwivedi –m hmac-md5 ssh 10.0.0.3 –l cdwivedi –m hmac-sha1

The –F switch is used to point to a different configuration file for the SSH session. Every SSH session uses a configuration file as input when attempting to establish a connection. Configuration files are discussed in the next section, “SSH Client Configuration File.” If an end user needs to connect to two or more SSH servers that have different parameters, such as listening on different ports, it is easier to point to a different configuration file than to remember the input parameters required for the SSH servers. Let’s say that SSH server A lis- tens on port 101, enables local forwarding to the mail server, and requires

some process. Using two configuration files significantly eases the log in process and user experience, as shown in the following example:

ssh 10.0.0.3 –l cdwivedi –F mail.config ssh 10.0.0.4 –l cdwivedi –F file.config

The next two switches are quite simple when you are using them with IP version 4 or IP version 6. Using IP version 6 assumes that an IP version 6 net- work is in use, which is beyond the scope of this book and SSH; however, SSH provides support for IP version 6 packets. IP version 4 is the default packet type, but both flags can be used if the networks are available. Following are two examples of the switches:

ssh 10.0.0.3 –l cdwivedi –4 ssh 10.0.0.3 –l cdwivedi -6

The next switches do not add functionality to the SSH client, but they do provide the opportunity to gather additional information regarding the con- nection. The –d switch sets the debug level for a connection. The higher the debug value, the greater the amount of information that will be printed on the screen regarding the connection. The following is an example of the –d switch. Notice all the information that comes before the password request:

ssh 10.0.0.3 –l cdwivedi –d 1

debug: Connecting to 10.0.0.3, port 22... (SOCKS not used) debug: client supports 3 auth methods:* ‘publickey,keyboard- interactive,password’

debug: Ssh2Common/sshcommon.c:537/ssh_common_wrap: local ip = 10.0.0.3, local port = 1077

debug: Ssh2Common/sshcommon.c:539/ssh_common_wrap: remote ip = 10.0.0.3, remote port = 22

debug: Remote version: SSH-1.99-OpenSSH_3.4p1 debug: OpenSSH: Major: 3 Minor: 4 Revision: 0

publickey,password,keyboard-interactive’. cdwivedi’s password:

The next informational switch, -V, displays the version of the remote SSH server. This is helpful when you are trying to understand what version the remote SSH server is running for patching and security purposes. The follow- ing is an example of the –V switch:

ssh 10.0.0.3 –V

ssh: SSH Secure Shell 3.2.3 (non-commercial version) on i686-pc-linux-gnu

The last informational switch discussed here is –q. In essence, it tells the SSH server to be quiet and not display any warning messages to the end-user. If the –q switch is used, the SSH server will display only the request for the user’s password. The following is an example of the –q switch:

ssh 10.0.0.3 –q root’s password: