Slashdot Mirror
SSH and OpenSSH Comparisons?
Colonel Bleep asks: "My company is finally on the road to getting serious about Unix server security. Though there's a lot more to do, the current push is to replace telnet, ftp, rcp and the like with ssh. Problem is, the security team in charge of the transition is composed mostly of Microsoft-trained techicians that hold varying opinions of open source software. Non team members, such as myself, are kept abreast of developments via email. Input is encouraged. OpenSSH came up during a recent email exchange with the coordinator. It didn't take long for the "isn't proprietary is better?" mantra to rear its ugly head. Though I use OpenSSH at home I found myself at a loss to explain why the corp might want to consider using it over commercial SSH. That's aside from the obvious open source peer review argument, of course. I haven't been able to uncover any direct side-by-side reviews of the two products but I would very much like to pass such a comparison along. What say ye?" Update: 11/14 2:40p EDT by C : Users of SSHv1 may want to take a look at this security bulletin on a potential SSHv1 exploit that is rumored to be in the wild.
While the two are essentially the same in functionality from a user perspective, the commercial version does have a nice GUI. While it may not sound like much, it improves the usability, and probably reduces support costs.
Can You Say Linux? I Knew That You Could.
OpenSSH will save your company money. This has to be balanced against the lack of a commercial support contract, although I'm sure you could find someone prepared to sell you a supoprt contract for OpenSSH. Where the balance swings depends on your companies priorities.
OpenSSH gives you peace of mind that the software you're depending on isn't vulnerable to the financial failure of a commercial company.
Commercial ssh has a few features that aren't yet present in OpenSSH (twofish and IDEA ciphers, for example, or host based authentication).
"The invisible and the non-existent look very much alike." -- Delos B. McKown
The reality is that the differences are really minor, and, now that RSA is legal, openssh can be setup to act almost exactly the same as closedssh.
The only signicant difference between them for most peole is the price.
There used to be a fair bit of difference, but at least for unix, this is no longer true. Since 2.5 openssh has supported sftp. Since 3.0 it supports rekeying a session. With external PAM modules you can support smart cards and securid logins.
The one advantage that ssh has over openssh is that this is all integrated into one package. The smartcard support is built in, you don't have to go looking for support.
If you are not planning on using smartcards or tokens, then openssh wins based on price alone. You can get it pre-compiled for most platforms, so the compilation is not so much the issue. Otherwise you have to weigh the choices a little more carefully. Check to see if your required token/card is supported by both. If not, then it is likely to be easier to add support into openssh, having the source and all.
In terms of windows clients...that is one big differentiator. Again, mostly money! We use tera-term and that works quite well, but does not do ssh V2 protocols.
In either case, you are buying a big whack of security, but don't forget, passwords can be extremely weak! Don't let up on the other security policies just because you now have SSH. (And yes, I know that the poster is not responsible for this, this is just a general admonition :-)
Whatever you get, I wish you the best of luck.
Now for the gratuitous links: :-)
securid and openssh
some preliminary smartcard itegration with openssh
another smartcard and openssh link
Commercial SSH is open source, always has been from version 1, just under a propritary liscence. IMHO, commercial SSH3 just plain rocks. It has nice GUI features, and lots of other functionality that OpenSSH does not have. If your company has money to spend, Commercial SSH is the way to go.
This isn't a terribly insightful comment, but the technical differences between commercial ssh and openssh are minor, even trivial.
If spending money for support and proactive updates is easier for company than having a your current IT staff RTFM and monitor security-related mailing lists, then go with commercial ssh.
Remember too that in almost all cases openssh and commercial ssh can interoperate. So, you could buy commercial ssh on a few machines until you're confortable with using it, and then implement future installations using openssh.
-D
Lower cost
Peer Audited Code
If a bug is found its patched nearly same or next day usually
And I have never been able to get Closed SSH 3.0 to compile on Slackware, mandrake, or Stampede, always dies with weird complier errors.
OpenSSH works everytime.
Power Corrupts,Absolute Power Corrupts Absolutely, leaving one person(group)in charge is absolutely corrupt.
Comerical ssh has one good feature which is not supported by openssh. It supports chroot for sftp subsystem. It is not essential feature but still it is nice to have it.
--
Ilya Martynov (http://martynov.org/)
"Rumored to be in the wild"? I had a box rooted, and then re-rooted 2 weeks ago. Upgrade your SSH, please. I am still having nightmares.
As a server/client running on a unix system, i think openssh is a much better alternative. It is easy to install, configure, and manage. We have been using openssh as a default for over a year now. As a windows client, openssh does not even have an option. you have to find and alternative, and none of them (IMHO) even compare - especially since i couldn't find one that had a decent sftp interface like the commercial version. Just my .02
One additional point: OpenSSH and the ssh.com SSH (old version 1) come from the same origins.
OpenSSH is basically a very old ssh.com SSH with some improvements. The SSH technology as we know it wouldn't exist without ssh.com's efforts of developing and standardizing it in the first place. Some might consider that this alone is enough reason for buying the commercial version to support the development of the SSH technology.