LINUX SYSTEM ADMINISTRATION AND SECURITY SSH (The Secure Shell) - - PowerPoint PPT Presentation
LINUX SYSTEM ADMINISTRATION AND SECURITY SSH (The Secure Shell) -Lakshmana Rao Konda lkonda@cs.siu.edu Topics Covered Introduction Overview of features SSH Client and Server Model Cryptographic Keys Attacks SSH Agent
LINUX SYSTEM ADMINISTRATION
Introduction Overview of features SSH Client and Server Model Cryptographic Keys Attacks SSH Agent Architecture of SSH System Installation and Configuration Differences between SSH1 and SSH2 Conclusion
SSH, the secure shell, is a popular, powerful software
SSH is used to replace telnet, ftp and reexec. In telnet, ftp and reexec sends data (username and
SSH Solves this by encrypting all the
Privacy of your data, via strong encryption. Integrity of Communications , guaranteeing
Authentication, proof of identity by senders
Authorization, i.e.,access control to
Forwarding or tunneling to encrypt other
client server
Transport Layer Key exchange (SSH_MSG_KEXDH_INIT), e n p , g computes computes e = g^x mod p. f = g^y mod p K = e^y mod p H = hash(V_C || V_S || I_C || I_S || K_S || e || f || K) s = signature on H with its private host key. (SSH_MSG_KEXDH_REPLY), K_S || f || s verifies that K_S really is the host key computes: K = f^x mod p H = hash(V_C || V_S || I_C || I_S || K_S || e || f || K), and verifies the signature s
1 2 3 4
Payload, signature Pay load is:
SSH_MSG_USERAUTH_REQUES T, username, service,
"password", FALSE, plaintext password signature is: session identifier, payload encrypted with session key server checks whether the supplied password is acceptable for authentication, and if so, it checks whether the signature is correct. SSH_MSG_USERAUTH_SUCCESS OR _FAILURE
client server
request service if userauth_success User auth layer (using password) 5 6 7
Before you can use the public key authentication ,
SSHKeygen then creates your local SSH directory and
An agent is a program that keeps private keys in
Once the agent is running , its private key is loaded
SSH has following components- Server Client Session Keys Known Host Database
Key generator Agent Signer Random seed Configuration file
Man in the middle attack Eavesdropping Connection hijacking IP Spoofing
Alice requests ssh conn, with Bob Alice Trudy Bob Bob sends public key Trudy sends her public key instead
Alice gets the key for the first time, so she stores it as Bob’s key Alice sends username, password as plaintext in encrypted channel, that Trudy can decipher Trudy now has Alice’s username and password!!
Alice requests ssh connection with Bob Alice Trudy Trudy sends her public key claiming to be Bob Alice gets the key for the first time, so she stores it as Bob’s key Alice sends username, password as plaintext in encrypted channel, that Trudy can decipher Trudy now has Alice’s username and password!! Trudy sends authentication failure Alice sends credentials again as plaintext in the encrypted channel Trudy sends another authentication failure and disconnects Alice thinks she must have entered incorrect passwords!!
Extracting the files
Verifying with PGP
Building and Installing SSH1
Compile time configuration
X window support
Encryption and Ciphers
Authentication
Separate transport,
Any number of session
Supports public key
One monolithic protocol Exactly one session
It does not support.
Strong cryptographic
Periodic replacement
Authentication is
Weak CRC32
It does not provide
Client tries a
IP and TCP attacks Traffic Analysis Covert channels Carelessness