Slashdot Mirror

← Back to Stories (view on slashdot.org)

SSH Secure Services on Windows 2K/XP?

Posted by Cliff on from the padlocking-the-packets dept.

jstockdale asks: "Lately I've been working on the security of the few Windows boxes I administer, specifically XP and 2000 stations. I havn't had much of a problem finding decent solutions for file/email/disk encryption (besides the fact that PGP is no longer selling their products), or for smartcard or smartcard+biometric solutions (besides the limitations on key size (2048-bit RSA maximum) and flexability). However when it comes to SSH services for remote administration, windows filesharing, and SFTP for file transfers I have hit a dead end. I have looked into SSH but their SSH for Windows Servers only runs on 2000, and costs $565. I ask what solutions have /.er's found in the realm of ssh network encryption, and also in integrating all these components simply and effectively."

153 of 238 comments (clear)

  1. CygWin by Darth+Troll · · Score: 2, Informative

    Works just dandy

    1. Re:CygWin by Frank+of+Earth · · Score: 2, Informative

      I don't run Cygwin on our prod servers but I do run it on my desktop and it works great.

      What I do is create a batch file called scmd [super command] that opens up a connection to localhost through ssh.

      Then I just create an alias to my /c and Im able to use all the great unix utilities under windows. You be surprised how something so simple like tail/head works so well when analysing log files in Windows.

      Not to get too offtopic, but it's all great for running cron jobs. The AT scheduler is the worst.

      --
      Live web cams
    2. Re:CygWin by Sir+Joltalot · · Score: 1

      Excuse me, I think you mean the Win32 version of Vim :)

      Otherwise, I agree, Cygwin is pretty neat. The only thing that ticks me off when using Cygwin is that when you run bash (or another shell) it's still in a Windows command prompt, and they don't really resize that well (at least not in 2k, dunno 'bout xp). And yeah, you can run X with xterms, but at that point you might as well run *nix...

      --
      "Caffeine is not an option. Caffeine is a way of life."
    3. Re:CygWin by roybadami · · Score: 1

      Though you do need to be aware of it's security limitations. That's not to say openssh under cygwin isn't a great way to remote admin machines, but you should probably only use it in circumstances where everyone who has access to the machine has legitimate admin privileges. (Of course, if the only person who has access to the machine is you then you needn't worry)

      http://cygwin.com/faq/faq_4.html#SEC80

      How secure is Cygwin in a multi-user environment?

      Cygwin is not secure in a multi-user environment. For example if you have a long running daemon such as "inetd" running as admin while ordinary users are logged in, or if you have a user logged in remotely while another user is logged into the console, one cygwin client can trick another into running code for it. In this way one user may gain the priveledge of another cygwin program running on the machine. This is because cygwin has shared state that is accessible by all processes.

    4. Re:CygWin by Strog · · Score: 1

      You can run sshd and use the server but you are right about getting to the underlying OS being an issue. It all depends on how much you are really trying to do with this box.

      You can do most everything with the command line under NT/2k but documentation often needs hunted down. You also need to get the Resource Kit(s) to get all the command-line tools and addons to really do what you want to do.

      The trouble with this is that you would have unixish tools available but really need to get to the nt/2k command line ones to administer the box. Maybe you can come in on ssh and have it connect to a local telnet that only accepts from localhost. Not perfect but better than telnet directly in.

  2. when you are too lazy to hit google by NullStream · · Score: 1

    cygwin

    --
    "Survival of the fittest Max, and we've got the fucking gun!" - Pi
    1. Re:when you are too lazy to hit google by Anonvmous+Coward · · Score: 5, Insightful

      Google helps you find stuff. Google does not give you informed recommendations from your peers. Duh.

    2. Re:when you are too lazy to hit google by Qrlx · · Score: 3, Insightful

      Google helps you find stuff. Google does not give you informed recommendations from your peers. Duh.

      Google search for "SSH Secure Services on Windows 2K" (cut and paste job from article title, leaving off /XP)

      Result number ten is called "How to setup SSH service on an Windows NT\2000 system." using cygwin etc.

      So there.

    3. Re:when you are too lazy to hit google by NullStream · · Score: 1

      And if you want impressions and suggestions then add "review" or "suggestions" to the search criteria. Joe Q. Internet hosting a site is about as acurate as your average slashdot user.

      Then again this site is all about "News for sheep and stuff that barely qualifies as news."

      Oh yeah.. BAAAAAAAAH!

      --
      "Survival of the fittest Max, and we've got the fucking gun!" - Pi
  3. www.Cygwin.com by aaron_pet · · Score: 3, Informative

    www.cygwin.com

    --
    Please use [ informative / summarizing ] SUBJECT LINES
    Flame me here
  4. openssh via cygwin. by ssklar · · Score: 2, Informative

    openssh works fine under cygwin. that is what we use.

    --
    Non impediti ratione cogitationis.
    1. Re:openssh via cygwin. by Telastyn · · Score: 4, Insightful

      One trick that helps is using NT resource kit's srvany to install SSHD as a service instead of cygwin's service installer. A google search can show you how. But then again a simple google search could've prevented this whole article...

    2. Re:openssh via cygwin. by redfood · · Score: 1

      Good information on installing an cygwin openssh server (sshd) can be found here:

      http://www.jfitz.com/tips/ssh_for_windows.html#S SH _Servers

  5. Putty by crouchingpenguin · · Score: 2, Informative

    You can get Putty here: http://www.chiark.greenend.org.uk/~sgtatham/putty/ .

    1. Re:Putty by UTPinky · · Score: 1

      I think he is referring to the need of a server, not a client

      --
      I'm only paranoid because everyone is against me...
    2. Re:Putty by Osty · · Score: 2, Informative

      And he can get a fancy alpha-blended PuTTY here. However, the way I understood it, he was asking for a server, not a client. PuTTY is only a client (ssh client, scp, sftp, etc).

  6. Tried VShell? by triffidsting · · Score: 5, Insightful

    http://www.vandyke.com/products/vshell/

    --
    Non, je ne veux pas coucher avec toi ce soir.
    1. Re:Tried VShell? by xee · · Score: 5, Informative

      Indeed, VShell is an awesome SSH server for windows. I've been using it in a production environment for a few months now and am very pleased with its performance and ability. It hasn't been a particularly smooth ride, but VanDyke tech support is excellent (you send them a logfile, they'll tell you how to fix the problem). They even supported me before I bought the product. That was impressive. I highly recommend VanDyke SSH products for windows.

      --
      Oh shit! I forgot to click "Post Anonymously"...
    2. Re:Tried VShell? by Frank+of+Earth · · Score: 1

      I agree. Vshell is great and integrates seamlessly. It's not terribly expensive and the software is top notch.

      If you need Windows sftp/ssh clients, they also have the best clients on the market.

      [Paying customer, but not affiliated with Vandyke, just been using their products for 5+ years now]

      --
      Live web cams
    3. Re:Tried VShell? by dmayle · · Score: 2, Informative

      I agree completely. I've been a huge fan of Vandyke products, and continue to recommend them to clients of mine who want Windows familiarity thrown in with their security (I implement security solutions for small to medium size businesses). All of their products that I've used (SecureFX, SecureCRT and VShell) have each gotten better with each version (which you often can't say about new software).

  7. Unless you work *real* cheap by Anonymous Coward · · Score: 2, Insightful
    $565 covers your employers costs for you for about a day (maybe a little more).

    If you need what SSH provides, buy the damn thing and get it over with. You'd spend a helluva lot more than 10 hours getting something else working - or even just looking for something else.

    1. Re:Unless you work *real* cheap by GigsVT · · Score: 2

      Cygwin with ssh takes like an hour to set up, max.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    2. Re:Unless you work *real* cheap by njdj · · Score: 1

      And oh, btw, $565 per day isn't cheap, it's like $135,000 a year in raw salary
      "Cost to the employer of $565/day" corresponds to a salary of $45k to $60k/year, depending on a lot of factors. Any manager who has costed a project will tell you this. To calculate the true cost of employing an engineer (say), you have to figure in the cost of providing office space/heating/air-con, desk space, infrastructure like HR department, line management, employer's social security tax and employment tax, and some of the benefits. All this usually adds up to a bit more than the actual salary. Then you have to figure that the average employee works about 1760 hours/year, allowing for vacation and sick leave. So if the actual salary is $60k/year, that's 60000/1760 = $34/hour or $272/day, the cost to the employer will be at least double that, usually significantly more.

  8. Bitvise is nice and reasonably priced by anaradad · · Score: 2, Informative

    I've been running a Bitvise WinSSHD server for a while and it works just fine. Integrates with the Windows login also, which is a nice plus. Easy to install, configure, and use.

  9. Cygwin! by BJH · · Score: 1

    I installed cygwin on my PC at work a couple of weeks ago (after the /. article). SSH client and server both work fine.

  10. Putty ssh client by bluegreenone · · Score: 1, Informative
    I know you are asking about server software specifically, but I thought I'd take the opportunity to mention Putty, a suite of useful SSH clients includind a SSH/telnet, Pageant their key manager, and plink their command-line version.

  11. Errr.... by zulux · · Score: 1, Redundant

    What's wrong with cygwin?

    --

    Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.

    1. Re:Errr.... by __aaaaxm1522 · · Score: 2

      Perhaps the poor guy just didn't know about it.

      It's not very well known in the Windows world - seems to be something that us Unix folk load onto Windows machines to make them feel a little more like "home". I hope it gains more recognition by the Windows "mainstream" types, as it's one excellent bundle of useful apps.

  12. It has Open SSH 3.4p1-4 by aaron_pet · · Score: 1


    I don't know if Cygwin opens other security holes in windows. Haven't heard anything about it.

    It has Apache, MySQL, Postgres...
    XFree86... bunch of stuff.

    --
    Please use [ informative / summarizing ] SUBJECT LINES
    Flame me here
  13. Windows Programming: A related question by Dwonis · · Score: 2, Offtopic

    My question is sort of off-topic, but I don't really know where to ask it: Where is the Windows programming community? How do Windows programmers get their information and help? I am familiar with how to get information for *nix programming: just search the web, look up the manpages, and post questions on the mailing lists/newsgroups. But I have a hell of a time writing Windows programs because I can't seem to find the mutual support network that is so common in the *nix world.

    1. Re:Windows Programming: A related question by bmwm3nut · · Score: 1

      www.codeguru.com - actually i don't know how good it is anymore. but about five years ago when i worked as a windows application developer i found alot of help there

    2. Re:Windows Programming: A related question by Col.+Panic · · Score: 1

      USENET, just like for everything else. comp.os.ms-windows.*

    3. Re:Windows Programming: A related question by Osty · · Score: 1

      www.codeguru.com - actually i don't know how good it is anymore. but about five years ago when i worked as a windows application developer i found alot of help there

      I've not used CodeGuru much, so I can't really comment there. However, The Code Project seems to be rather popular, and even has some (unofficial) support through Microsoft. Another good site is WinProg.NET, the website for EFNet's #Winprog and also a site with a number of good tutorials and resources.

      That said, there's really not much better than MSDN for looking up pretty much anything you want to know about developing for Windows. Of course, MSDN is more a reference than a tutorial site, so I can understand why new Windows programmers can feel lost in it. That's where sites like CodeGuru, The Code Project, et al come in.

    4. Re:Windows Programming: A related question by Brad1138 · · Score: 1

      When I have a question about any Windows OS (or any OS for that matter) I go to Computing.net. I usually get good answers to my probs. That is of course if slashdot is down and/or I can't get to it. :)

      --
      If you could reason with religious people, there would be no religious people
    5. Re:Windows Programming: A related question by RainbowSix · · Score: 2, Troll

      I've been thinking about this question as well. Here is what I currently believe:

      There are two main reasons people code. One is money. The second one is the appreciation of the theory and algorithms behind it.

      As a result, we have Microsoft which I see as full of people in it for the money. This leaves crappy code and security holes since as long as everybody gets their paycheck they do whatever it takes to keep them from getting fired (ie, Office Space the movie)

      Those people really don't care about the code, and so won't spend their free time contributing free software to the community. If they do write something, it will be for win32 and they will charge money so they can make a few dollars. They figure everything else costs money so why should theirs be free?

      On the other hand, we have people who like to code, and don't care so much about the money as much as the respect of their peers and for the beauty of the code. Therefore we have a lot of free stuff in linux. Sure, some of it also has win32 ports, but are there any free office suites and full fledged graphics packages soley for win32? The answer is no (I would imagine) because win32 has such a huge user base. With something like 90% of the desktop, somebody is bound to pay for your product, so why should anybody write a free application for win32?

      --
      --------
      It's OK to be social, just don't tell anyone about it.
    6. Re:Windows Programming: A related question by ergo98 · · Score: 1

      Probably the best source is the microsoft.* tree (add msnews.microsoft.com as one of your news server). I've found it very helpful for those few times that Deja comes up empty. Caveat: Messages have a strange habit of spontaneously disappearing from those servers-Several times now I've posted a question that was very much ontopic to find a day later that it disappeared (though sometimes orphaning some replies). Whether they have a weak cancel authentication system and someone is abusing it, or they have overly delete-hungry moderators I'm not sure.

    7. Re:Windows Programming: A related question by ssafarik · · Score: 1

      Have you looked at the MSDN Library? (http://msdn.microsoft.com). Has nearly exhaustive info on programming for all the various Windows components.

      Steve.

    8. Re:Windows Programming: A related question by daytrip00 · · Score: 1

      First, if you are a .NET programmer, one such community is dotNet247.com. They have excellent discussion threads. They, also, are indexed by google. If you use Google's Microsoft only search you'll be sure to easily find the answer to the question you are looking for.

      MSDN is also an invaluable resource. Not only do they have a stream of articles, but they are searchable, and it is generally rather easy to find the answer to the question you are looking for.

      I've had 99% of my programming experience in the Widnows world, so I actually suffer the reverse anomaly... I don't know where to look for my *nix answers.

    9. Re:Windows Programming: A related question by W2k · · Score: 4, Informative

      My sources for programming info and help/support:

      CodeGuru and CodeProject - both EXCELLENT sources of information, especially for MFC stuff. CodeProject also has lots on C#.

      Microsoft Developer Network is a great source of support (especially the KB) and the MSDN library holds a full reference for the Microsoft implementations of C/C++, C#, Visual Basic, et al. MSDN is also integrated into Visual Studio.NET, so I rarely feel the need to visit the website directly.

      Finally, lots of programmers gather in Usenet newsgroups and on IRC. I can recommend the channel #c++ on Quakenet (irc.quakenet.org) as a great source of help for Windows programmers, so long as you follow the (rather strict) channel rules. Don't miss the #c++ n00blist of people who have failed to observe these rules ... :)

      I hope this helps...

      --
      Quality, performance, value; you get only two, and you don't always get to pick.
    10. Re:Windows Programming: A related question by Reality+Master+101 · · Score: 1, Flamebait

      On the other hand, we have people who like to code, and don't care so much about the money as much as the respect of their peers and for the beauty of the code.

      Obviously you have never looked at the typical open source program. It is some of the UGLIEST code ever written. I'm sure there are some examples of some clean code out there, but all the ones I've looked at have been horrible, kludgy, undocumented pieces of crap. One in particular was Perl 4. Larry Wall might be a language genius, but his code is TERRIBLE. I think you can count the number of comments on one hand.

      --
      Sometimes it's best to just let stupid people be stupid.
    11. Re:Windows Programming: A related question by NineNine · · Score: 1

      There's a ton of support. It's not in one place because there are just so damn many Windows developers. You get all of the Windows developers in one place, and it'd dwarf the user base of Slashdot many times over. Saying the "Windows Community" is like saying the "human community".
      1. There are too many to form any kind of useful "community".
      2. There's no driving common interest, like here at Slashdot. You write code, it works, period.
      3. 99% of all *nix geeks can be described in a single paragraph. Windows users are all different kinds of people, with virtually nothing in common.

    12. Re:Windows Programming: A related question by slickwillie · · Score: 1, Troll

      Here's how you get Windoze programming help:

      - Get out your credit card(s)
      - Clear your calendar for the next week
      - Call Micro$oft
      - Sign up for MSDN (make sure your credit cards(s) have a high limit)
      - Wait for a large box full of disks (are they still using CD's or have they switched to DVD's?)
      - Try something (it wil fail)
      - Call M$, goto previous line forever

    13. Re:Windows Programming: A related question by Vinson+Massif · · Score: 1

      Apparently in the Perl FAQ: "Perl 4 is a dead, flea-bitten carcass". It's old, ancient.

      Please make the same comment about 5.8.0.

      --
      "Remember, any tool can be the right tool." -- Red Green
    14. Re:Windows Programming: A related question by Stonehand · · Score: 3, Insightful

      Pure, unadulterated bullshit of the worst sterotypical kind. Having actually /been/ there, and being aware of their recruitment procedures and also of their penchant for hiring damn fine academics who know their stuff, I can tell you that if you are a clod who can't think on his feet and doesn't know what he's doing, you won't get in. And the people that were there were pretty damn motivated to do well -- one has to be, in order to work at a company that's all but compared to the Third Reich these days.

      Compare that to the unclean drivel in the Linux kernel, laden with intelligent comments like "Sun fucking blows me", clearly broken VMs that get released despite all those allegedly useful eyes staring at the code and supposedly testing it, and the unprofessional spats between the dev community.

      And if you think caring about something means that it's so obviously superior, I would suggest that you consider the fanatical behavior of assorted cults throughout history -- or, alternately, the idiots on "American Idol" who clearly /care/ about their art, but can't do it worth a damn. The people who did the art for "Craft" and for that Warcraft clone and for that FreeCiv (clone...) probably /care/ about their art too, but graphically... there's no comparison with that produced by the pros.

      As for why I code, when I do -- it's a method. Algorithms aren't too interesting if never tested, and I'm sure as hell not doing large amounts of repetitive mathematics by hand. So for me, programming is merely an extremely efficient way of getting things done, and not an ends in of itself. When it comes to recreation, I find classic literature or photography much more interesting than implementing Nelder-Mead simplex routines for function minimization, or their ilk.

      --
      Only the dead have seen the end of war.
    15. Re:Windows Programming: A related question by tcc · · Score: 2

      Obviously the parent is a flamebait.

      Yes microsoft switched MSDN to DVD and even offers a substancial rebate for people to switch to DVD subscription.

      Depending on which kind of subscription you want, MSN can be in the 3 or 4 digits. The Universal subscription is huge and most of the people don't need it for simple application, as a matter of fact, having only the MSDN library on cd and a copy of visual studio is enough for most people. Unless you are writting huge-ass datacenter application or you need evey single microsoft product (server and client) readily installable, well usually you can shell out the money that will be needed to get such a package. No it's not open source, no it's not free, yes it's microsoft. While I don't really agree with some of their ways of doign things, if you don't like it, don't buy it and go find something else; if you can't, well now you know what it's going to cost you and you'll appreciate the litterature of the MSDN subscription. I find it very immature and non professional to post such biased comments, and even worse, people modding this up like mad.., when it's completely OT to the current subject and not helping in any case.

      The only negative thing I have to say about MSDN is when you get a universal subscription, they are trying to SELL you a magazine on top of that, and the Technet library isn't included, with all of the stuff they give, this is really lame :), aside from that, if you need MS documentation, grab the MSDN cd, it's not THAT expensive, and most of the stuff there is loaded with samples and it's more readable than most unix HOWTOs for the newbies.

      --
      --- Metamoderating abusive downgraders since my 300th post.
  14. Cygwin by ar · · Score: 1

    Like everyone says, cygwin is the winner.

    You might want to check here for some hints on installation. (In addition to the user guide and readmes of course).

  15. Check out the VanDyke products by mdb31 · · Score: 5, Informative

    You may want to have a look at vandyke.com; their VShell SSH server has a 'personal' edition which works very well for systems management and is cheaper than the SSH product. I've used their products for years on the server as well as client-side, and found them very reliable, as well as very well-behaved Windows services...

  16. Lots of Options by photon317 · · Score: 2


    There's lots of options available for SSH on Win32, a simple Google search turns them up. Specifically there's a free zipfile out there called ssh-win32.zip that contains a basic SSH terminal that works well. There's also GPL port-attempts of the unix commandline ssh tools, some of which work ok. In the cheapware/shareware category there's stuff like SecureCRT and F-Secure SSH. The list goes on and on... apparently some people like PuTTY.

    --
    11*43+456^2
  17. Same except for manpages. by jag111 · · Score: 1

    Search the web, look up things in the MSDN Library, and post questions on the mailing lists/newsgroups. =)

    1. Re:Same except for manpages. by Dwonis · · Score: 2

      Do you know what the licensing for code snippets from MSDN is? They always provide them but I can't find a copyright release anywhere. Maybe I'm not looking hard enough (or recently enough).

    2. Re:Same except for manpages. by SynKKnyS · · Score: 1

      They are free, unless they suddenly licensed the code to create a HWND.

  18. Have you looked at remotely anywhere? by slacker_bovine · · Score: 2, Informative

    Rather than some *cough* *cough*....I wish to actually try to provide some help. I've been using Remotely Anywhere for remote administration of my win2k network. It does a lot more than it sounds like you're asking for, but it is extremely useful and runs an ssh server. It is relatively cheap, but not free. Website

  19. Look again... by Psx29 · · Score: 1
    I have looked into SSH but their SSH for Windows Servers only runs on 2000, and costs $565.

    According the the link provided:

    SSH Secure Shell for Windows Servers provides strong Secure Shell version 2 connectivity, encryption and authentication for servers running Windows NT 4.0, 2000 and XP.

  20. CuteFTP Pro has SFTP by jaylen · · Score: 1

    CuteFTP pro has excellent very good Sftp cababilities, I use it all the time between work and home.

    Works fine for win2k, XP, and is cheap to buy.

    ______
    Jaylen

  21. OpenSSH + CygWin + libsectok by dmiller · · Score: 5, Informative

    As a few people have mentioned OpenSSH is supported on Windows via CygWin. What hasn't been mentioned is that OpenSSH supports smartcards through the use of libsectok. I use it with Schlumberger Cyberflex Access cards.

    I don't know whether libsectok has been built on Windows before, but it uses the standard /dev/tty interface so it should be too difficult to get working.

    1. Re:OpenSSH + CygWin + libsectok by philovivero · · Score: 4, Funny

      Mod parent up.

      Basically, I've gotten Cygwin with OpenSSH working on Win2K with zero problems.

      It's an eery feeling typing "ssh philov@win2kbox" and then getting a Bash prompt.

      Remember, once you install Cygwin to learn how to install *ANY* Unix server as a service on your Windows box. I got Apache and SSHd and a few others working trivially once I figured out that strange Cygwin addservice command.

      --
      fifth sigma, inc.
    2. Re:OpenSSH + CygWin + libsectok by ajs · · Score: 3, Interesting

      What's even scarier is being on an XP box, starting up a shell, typing "startx", get an xterm, run "ssh -XCfc blowfish me@linuxbox evolution" and getting a usable mail client on windows! :-)

    3. Re:OpenSSH + CygWin + libsectok by mikiN · · Score: 1

      ...it uses the standard /dev/tty interface so it should be too difficult to get working.

      Wow!, now that is what I call a teaser. Took me several times reading the post before I got it. Very funny!

      --
      The Hacker's Guide To The Kernel: Don't panic()!
    4. Re:OpenSSH + CygWin + libsectok by ajs · · Score: 2
      Evolution is the best mail client I've used, and I've used a LOT of them. I still use mutt a fair amount for quick things (the way I use vi for quick things and emacs for large work). I loved emacs' VM mode mailer, but evolution adopted it's virtual mailbox concept and made it easier to use (though not quite as powerful as emacs').

      MH was always a pain to use. pine and elm were more limited than mutt. Mozilla was nice, but too limited.

      The things I like about Evolution:
      • Virtual mailboxes -- insanely useful feature. I have a virtual mailbox for example that shows me any mail from a known list of friends across all of my IMAP and local mailboxes.
      • Wonderfully smooth and responsive IMAP and POP handling
      • Very good handling of attachments and all sorts of strange document types
      • Drag and drop between accounts
      • Well protected against malicious HTML mail (doesn't do javascript or load images by default, etc).
      • Excellent searching capabilities
      Had you had some problems with it that made you unhappy?
    5. Re:OpenSSH + CygWin + libsectok by philovivero · · Score: 1

      Hmmmm. You know, I hadn't even thought about that as being scary, but you know, it is.

      It's mighty cool having X working under Cygwin, I'll admit that.

      Saaay, why does RXVT run without X, but XTERM must run with X???

      Rambling rambling. Really, the thing that struck me is your post, which makes me laugh out loud is moderated "interesting" but my post, which I don't consider the slightest bit funny is moderated "funny."

      Moderation is... +1 funny.

      --
      fifth sigma, inc.
  22. This may seem incredibly obvious by david.given · · Score: 2
    ...but if you install Cygwin, fire up an rxvt and type 'ssh user@foo.bar.com', it Just Works.

    Although, I have had problems that if you try and resize the rxvt it stops responding, and stupid Windows doesn't kill the children if you kill the rxvt so you end up with dead processes hanging around if you're not careful, but in principle it all works fine. ssh, scp, the lot. It all interoperates with Unix beautifully.

  23. The Oxy* Project by Anonymous Coward · · Score: 1, Funny

    In unison, now: "Windows Security" : ....

  24. winscp (freeware) by hrdluk0 · · Score: 2, Informative

    There is a freeware windows scp program callled, not surprisingly, winscp. It is freeware and uses some code from Putty. Everyone I know has found this program very useful. Main web page: http://winscp.vse.cz/eng/ and download here: http://winscp.vse.cz/eng/download.php I found version 2.0 to be quite stable even though it is called beta.

  25. networksimplicity by meatspray · · Score: 1

    this guy packages openssh and cygwin hooks into one installer, we use it for all kinds of admin.

    1. Re:networksimplicity by homer_ca · · Score: 1

      I've used it too. It's the easiest install I've seen yet of the Cygwin+OpenSSH ports. www.networksimplicity.com

  26. But be careful by captain_craptacular · · Score: 2

    My unit recently started using the SSH product and had issues with it. When SFTP'ing files from our windows boxes to our *nix servers random sections of text files would mysteriously dissapear. Also the term client has been flaky for me, when I'm in emacs (my editor of choice) and I backscroll it will occasionally insert random sections of my backscroll into my emacs buffer... So if you go with SSH for Windows clients, watch your text ftp's and save before you scroll up ;)

    --
    They who would give up an essential liberty for temporary security, deserve neither liberty nor security
  27. Erm... by rakslice · · Score: 2

    OpenSSH on Cygwin. It's free. I'm not sure if Cygwin provides enough unixy hooks to support sftp, but I'd imagine it does...

    1. Re:Erm... by whatparadox · · Score: 1

      I run cygwin's SSH server at home on win2k and connect from schoolt using SSH.com's client that is command line and graphical file transfer.

  28. putty + cygwin by joe_n_bloe · · Score: 1

    putty is a nobrainer to install and use and now does tunneling.

    ssh under cygwin is also fine.

    It's not really a difficult problem, unless you are looking for a good product that you actually have to pay for. :-)

  29. Fingerprint Biometrics: DigitalPersona.com by Dr.+Ion · · Score: 2

    If you're looking for fingerprint login that integrates well with Win2k, check into the DigitalPersona U.are.U stuff.

    I have their inexpensive "UareU Pro" system, and it works great for (literally) one-touch Win2k logins. You can integrate it with your domain server to make fingerprint logins universal, but even just on a local workstation, it works fine.
    Unfortunately, zero Linux support.

    You can use the fingerprint biometrics for an encrypted virtual drive with additional software, but without any documentation or peer review of their encrypted storage, it's impossible to evaluate their security.

  30. What's wrong with Win2k server? by gcshaw2nd · · Score: 2, Interesting

    This is slightly off topic, but I'm curious as to why you went with 3rd party solutions for encryption and smartcard support instead of using Windows Server, which has those capabilities built in. Mostly I'm curious about the limitations of Windows Server products (this is not a troll, and I'm not interested in flames about M$).

    I always thought of PGP as a personal resource, not something capable of effectively encrypting entire network environments. Why do you choose not to use the EFS capabilities of Windows, which, to my knowledge, are very secure and transparent to the user (provided (s)he has permission to decrypt).

    The same question applies to Smartcard technology. Windows supports the PKINIT protocol, RSA and CryptoAPI etc. You can install Certificate Authority software as part of your install. Why specifically go with cryptoflex?

    And specifically regarding your SSH question, it's not SSH but Windows Server supports Remote Access services via which you could set up a VPN and have a secure connection to the company servers.

    Please share your knowledge.

    1. Re:What's wrong with Win2k server? by new500 · · Score: 4, Informative

      . . .

      I'm curious as to why you went with 3rd party solutions for encryption and smartcard support instead of using Windows Server, which has those capabilities built in. Mostly I'm curious about the limitations of Windows Server products

      Well for one thing, for every client that uses Windows Server for _authentication_ you have to pay up for an extra internet Client Access License. As far as I understand this (and I re- read the terms not so long back) that's each _individual_ client, not concurrent or pooled / proxied clients.

      Win2k has excellent smartcard suport, out of the box, highly recommended to lock down _physical access_. But, if like me, you're interested in smartcard authentication for a fair number of users _remotely_ it may not be the best solution to work with your existing toolchain (e.g. Cygwin, OpenSSH etc.)

      That's just what comes immediately to mind. I've not delved all I should, so further comment very welcome.

      I'll just part with the thought that in your example of installing Certificate Services, if you used this to authenticate users for a web site in even a small installation, you could be talking about hundreds of required licenses. Up to you, though, of course :)

    2. Re:What's wrong with Win2k server? by gcshaw2nd · · Score: 1
      I just read that there are two cases where a CAL is not required for access to Win2k Server: One, when the client makes http requests (ie the server is acting as a web server); Two, the client makes ftp requests.

      Certificate Services is, I believe, used to create authentication certificates for use on smartcards and similar access devices, not secure web transactions. But I could be wrong about that.

      And I thought that Win2k support for smartcards was especially for remote authentication, say on a laptop. I'm not sure what you mean by physical access, perhaps local access?

    3. Re:What's wrong with Win2k server? by Mr.+Firewall · · Score: 1

      I cannot answer the other questions, but I can answer this one:

      And specifically regarding your SSH question, it's not SSH but Windows Server supports Remote Access services via which you could set up a VPN and have a secure connection to the company servers.

      Actually, you DON'T have a secure connection to your servers through Windows RAS. Micro$oft uses weak encryption in their VPN tunnels, and it's not that difficult to crack it.

      To answer your question -- that, my friend, is what's wrong with Win2K server. What *I* would do is set up either a Cisco router or an OpenBSD server in front of it with an IPSec VPN, but I'm not you.

      Good luck with your project, and may the Force be with you.

      --
      In times of universal deceit, telling the truth gets you modded -1 Troll
    4. Re:What's wrong with Win2k server? by new500 · · Score: 2

      . . .

      And I thought that Win2k support for smartcards was especially for remote authentication, say on a laptop. I'm not sure what you mean by physical access, perhaps local access?

      You are partly right, no CAL is required for _anonymous_ access to Win2k. Reassuring isn't it? :-)

      I should have clarified my point a bit - in a heterogenous LAN / WAN it's not always practical to use Win2k services for all authentication. Quite apart from the expense of CALs, replicating ActiveDirectory to LDAP is a complete PITA. At a considerable price you can buy meta - directory products e.g. from SUN One and Novell to accomplish this more easily. For many instances you simply do not need to deliver NT services such as file and print or authentication to _everyone_ so then a meta - directory starts to feel like over - kill. Having *nix based smartcard tools, sans CAL costs can be a major project boon, for obvious reasons.

      As I understand it, contrary to your asertion, Cert Services under Win2k offers X.509 support for the web _and_ smartcard services. Integration is the key - either a massive boon if you wish to standardise, or a liability with the licensing cops if you mix up your distinctions :). Here's a quote http://www.microsoft.com/technet/treeview/default. asp?url=/TechNet/prodtechnol/windows2000serv/deplo y/depopt/2000cert.asp :

      Microsoft® Windows® 2000 Certificate Services offers customers an integrated public key infrastructure (PKI) that enables the secure exchange of information across the Internet, extranets, and intranets. Certificate Services verifies and authenticates the validity of each party involved in an electronic transaction and lets domain users log on to a domain using the additional security provided by smart cards.

      And some evidence that they are inseparable can be found by a search for KB Q228831 "Cannot Overwrite Smart Card Key During Certificate Services Setup" at their site, which appears broken now.

      A Laptop would not normally remote authenicate,except for web e.g., when on the move, so I don't see your point exactly, unless you mean that the laptop should be forced to call home to auth for OS login (useful to reduce risk damage from theft, and quite possible under Win2k). Smartcards are very useful for local access control under Win2k Workstation, standalone, which was my point. It's possible to use EFS to encrypt your data and locally install a X.509 cert locally to a machine, use that cert to authenticate your SSH sessions (hah!, finally back on topic :) and then use _without_ paying for more CAL's a neato smart card to secure _remote_ device access. Yup, there are subtle potential security flaws in that, as with any chain - of - systems but if your interest is not to move from machine to machine, and you keep an aggressive CRL for use with your SSH accounts, this idea is fairly useful, and way better than standard SSH + login and password. On a laptop especially you need every protection you can get :)

      Hope that clears up any confusion arising from my tiredness last night. If you simply want to manage X.509 and CRLs, there are many third party or free tools to accomplish this. If you're just setting out, I recommend you spend your money and time learning how the infrastructure works, then worry about implementations later. Knowledge wil make you free of any ties to a particular OS, or at least save you from the worst rent charges ;) For certs, he "X.509 style Guide" (sorry no link, Google is there for you), is a fine place to start. For some Smartcard background, take a gander here, for example : http://www.citi.umich.edu/projects/smartcard/

    5. Re:What's wrong with Win2k server? by gcshaw2nd · · Score: 1

      My friend, Windows 2000 default tunneling procedure utilizes L2TP for tunneling and IPSec for encryption.

      What's the difference between MS IPSec and OpenBSD IPSec? Is not IPSec a standard?

    6. Re:What's wrong with Win2k server? by Mr.+Firewall · · Score: 1

      My friend, Windows 2000 default tunneling procedure utilizes L2TP for tunneling and IPSec for encryption.
      What's the difference between MS IPSec and OpenBSD IPSec? Is not IPSec a standard?

      To paraphrase a favorite American President, "That depends upon what the definition of 'standard' is."

      Remember that M$ also claims that the W2K version of Kerberos is "standards-compliant," yet Kerberos will only work with Win2K machines if the KDC is on a W2K server!

      And isn't L2TP only a "standard" if you're using Windows 2000 servers AND Cisco routers?

      In the case of IPSec, the problem is that the maximum key length you can use in Win2K is 56 bits. That may or may not be adequate for your needs (it is certainly NOT adequate if you're a bank, defense contractor, or a member of dozens of other industries where trade secrets are worth Billions of $$$). 56-bit keys can now be cracked in about a day by a determined, well-financed adversary.

      As I said in my original post, just be aware. It may or may not be an issue for you.

      --
      In times of universal deceit, telling the truth gets you modded -1 Troll
  31. They have the same problems... by DrCode · · Score: 2

    Last time I had a Windows problem, I did look on the net (DejaNews). What I found were that several other people had the same problem, but nobody had posted a solution.

    Maybe this was because there was no solution!

    1. Re:They have the same problems... by kevin+lyda · · Score: 2

      uh, i think they did.

      --
      US Citizen living abroad? Register to vote!
  32. network simplicity by dirty · · Score: 1

    www.networksimplicity.com

    It's just OpenSSH ported using cygwin, but it's meant to be installed on machines without cygwin, and it is really easy.

    Then setup TightVNC for remote access. You can make ssh tunnel any connection so you can send VNC through ssh.

    --

    -matt
  33. winblows ssh server by Big_Horn_Dog · · Score: 1

    Try this link -
    http://www.freessh.org/windows.html

    I have been using the ssh server by Network Simplicity and it works fine.

    Horn_Dog

  34. Cygwin & TTSSH by cornice · · Score: 3, Informative

    For the server side use SSH from cygwin and for the client side I really like TTSSH as an extension to Teraterm. It also looks like there is now a TTX SSL and an SSL OTP available too. By the way, all of these have source available.

  35. Terminal Server by Anonymous Coward · · Score: 1, Informative

    The RDP protocol is encrypted by default.

    1. Re:Terminal Server by blowdart · · Score: 1

      Actually it's only users with local administrative rights to the box, not Domain Admins, it just so happens, of course, that if a machine is in a domain, then Domain Administrators have admin rights to every box.

  36. Re:He said it's for a server. NOT CLIENTS. by GrenDel+Fuego · · Score: 2

    I'm guessing that your point was that there are fewer servers than clients, but you have to realise that you don't know what he does for a living.

    I personally work to support a network of thousands of Linux and Windows servers. Definitly more servers than clients owned by us.

  37. OpenSSH - server and client by Nailer · · Score: 2

    You can run both CMD and bash via OpenSSH on Windows with Cygwin. It works reliably, and there's quite a few useful command line utilities for the newer versions of windows (2000, XP), especially if you grab the resource kits. However, if you have the bandwidth (and hopefully you do) why not run terminal services?

  38. Where to find the Windows programmers by Carnage4Life · · Score: 5, Informative
    Disclaimer: I work for Microsoft but this post contains my opinions and does not represent some official company statement

    In my opinion the best places to find out information about Microsoft technologies and products are

    1. Newsgroups: Most microsoft technologies have a newsgroup in the microsoft.public.* hierarchy that are read not only by Microsoft employees but by dozens of regular developers who just want to help others who are having problems. I personally monitor microsoft.public.xml and microsoft.public.dotnet.xml where I answer a lot of questions and pass many of those I can't answer to the actual devs who work on the applications and APIs in question.

    2. Online Communities: There are a number of strong online communities where Windows developers congregate to share information, tips and tricks. These range from Microsoft sponsored sites like GotDotNet, ASP.NET, and Windows Forms.NET that are run by MSFT employees who participate actively in these communities to independent sites like 4 Guys from Rolla, Code Project, Dev Hood, DevelopMentor and CodeGuru

    3. Microsoft Websites: Few places beat MSDN as a source of information about Microsoft technologies. By the way, if you are into XML check out my Extreme XML column

    4. Mailing Lists: There are number of mailing lists hosted by various parties about Microsoft technologies. The ones I've seen with the most vibrance have been the DevelopMentor mailing lists and the ASP Friends lists


    PS: So this post isn't offtopic I'll add something about SSH. OpenSSH in Windows is possible if one installs Cygwin.
    1. Re:Where to find the Windows programmers by Eil · · Score: 2


      Disclaimer: I work for Microsoft but this post contains my opinions and does not represent some official company statement

      Hmm, I see this getting modded down relatively quick...

      Oh, but he plugged cygwin so it's okay. :)

  39. A possible other alternative by Matey-O · · Score: 2

    While attending a security session put on by the SANS institute, they had a REALLY cool solution for protecting machine to machine communication in an 'unsafe' network environment.

    They used a feature of IPSEC that didn't encrypt the packets, but CRC'd them anyway. Then they configured the machines that were supposed to listen to the outside world (Business logic servers/ database servers) to punt all packets that didn't have an IPSEC crc on 'em.

    The system does the decoding at IIRC the 2nd or 3rd layer, using some very efficient code Microsoft got from Cisco. The teacher reported pounding on a laptop on a 100mbit segment with 6 orther attacking computers and the laptop registered about 12% utilization whil punting illegal packets.

    --
    "Draco dormiens nunquam titillandus."
  40. This should be in .NET server and ported to W2K by MsGeek · · Score: 2

    Now that Microsoft has woken up to the need for improved security it is imperative that they should have SSH as an integral part of .NET Server and back-port it, Security Configurator and Analysis-style, to W2K Server and NT4 Server.

    SSH, SFTP and SCP would be wonderful tools to have. Just yank out Telnet, yank out IIS FTP Server and so forth and put this in instead. Terminal Services is fine and all but sometimes you need to do remote file transfers. The current alternatives MS provides are just not any good.

    --
    Knowledge is power. Knowledge shared is power multiplied.
    1. Re:This should be in .NET server and ported to W2K by ergo98 · · Score: 2, Insightful

      Microsoft has already provided L2TP (and its predecessor PPTP) and IPSec: It is backwards, and quite frankly quite silly, to try to program encryption into every single program when you can utilize these system features to add encryption to any and all applications (and yes you can make it mandatory if you want. In 20 seconds I can configure my system to only allow IPSec high security communications to my HTTP server).

    2. Re:This should be in .NET server and ported to W2K by GigsVT · · Score: 1

      I guess you have never heard of ssh tunneling. Yes, there is slightly more overhead, but it works just fine, and doesn't force you to use closed source facist operating systems.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    3. Re:This should be in .NET server and ported to W2K by ergo98 · · Score: 2, Informative

      SSH tunneling is basically a predecessor to IPSec (and a hackish one at that). Both IPSec and L2TP are standards, and neither are proprietary to Windows: Both are supported in Linux, or any other major operating system, as well.

  41. Networksimplicity and a cake walk by GangstaLean · · Score: 1

    I've been using Network Simplicity's Openssh package to admin several win2k servers, plus tunneling for VNC. Works ace, no compliants. One thing, VNC gets kind of fussy about connecting to localhost ports that are tunneled, it requires a little tweaking on the server (WinVNC) side to make it work (you need to add a localloopback key). There's a registry hack that allows it, details on ORL's VNC site. Tunneling Terminal Server works without any modifications.

    --
    -- Bird in the Bush: The Renewable Energy Blog http://www.birdinthebush.org
  42. IPSec by ergo98 · · Score: 1

    You possibly are approaching this problem in a "like UNIX" sort of way, however security on Windows system depends more on all encompassing technologies like L2TP or IPSec: Take a look at IPSec. It separates encryption and payload integrity from the application, and of course works with all applications because they're unaware that it's acting as a pipe between systems. If you're concerned about performance then get yourself a NIC that offloads encryption processing. Note that your system can be configured to only allow connections to certain services if an IPSec connection has already been established: Launch an MMC console (Start/Run/mmc.exe) and add the snap-in "IP Security Policies" for the local computer and play around: The possibilities are endless.

    Next time you're at your local book store, take a look for the Microsoft training book for their exam number 70-220 : Designing Windows 2000 Network Security. Because XP is 2000 with a nice GUI it is entirely relevant.

    1. Re:IPSec by SuiteSisterMary · · Score: 2

      Yup, another classic example of 'when all you know how to use is a hammer, every problem starts to look like a nail.

      --
      Vintage computer games and RPG books available. Email me if you're interested.
    2. Re:IPSec by Mr.+Firewall · · Score: 1

      Be aware that Micro$oft's implementation of IPSec uses weak encryption.

      --
      In times of universal deceit, telling the truth gets you modded -1 Troll
  43. fsecure by E.S+Taog · · Score: 1

    I've found the F-Secure products to be very good. They also have excellent documentation and tech support.

  44. OpenDirectory Says. . .. by Com2Kid · · Score: 1

    The OpenDirectory (or at least Google's listing of it) gave me a list of two SSH servers (not exactly comprehensive I admit but. . . .)

    One of which was WinSSHD which has a $95 business license.

    --
    Need help treating your acne? Come here!
  45. How about filesystem encryption for Linux? by treat · · Score: 2

    How about filesystem encryption for Linux? Something that works effectively, well enough that it can be used in the real world. The kernel loopback encryption would be perfect, except it breaks with each kernel release and an indefinite time must be waited for patches - and patches might make old data unreadable. Is there any practical solution?

    1. Re:How about filesystem encryption for Linux? by Verizon+Guy · · Score: 1

      You fuckers. This was a question about Windows... which has encryption built in... yet you can't keep it in... sheesh!

      --

      Aw, fuck it. Let's go bowling. - The Big Lebowski

  46. Yep -- sshd configuration instructions by KMSelf · · Score: 4, Informative

    Second all of the above.

    For configuring sshd, see http://tech.erdelynet.com/cygwin-sshd.html.

    --

    What part of "gestalt" don't you understand?

    1. Re:Yep -- sshd configuration instructions by Halvard · · Score: 1

      While the instructions mentioned above, if you are clueful regarding an NT flavored MS product, you can work through the errors. Having a sshd running as a service is wonderful.

      Having a bash prompt didn't bug me in the least.

      This is by absolutely the way to go. You don't even have to install all of Cygwin to get it to work, just some select pieces.

    2. Re:Yep -- sshd configuration instructions by lobster_sew · · Score: 1

      I've just followed these instructions. Cutting a long story short, if you enable NTSEC and priviledge separation (and if not, why not?) then you'll need to take one more step to get the daemon working.

      Just do:
      chown 18:18 /var/empty
      chmod 755 /var/empty

      Kudos to Christopher Snyder. Check out his posting to the mailing list for more info.

  47. I set up SSHD on winnt... by rimdo · · Score: 1

    ...by using cygwin and this very informative site.

  48. Not a troll...just a suggestion by johnlcallaway · · Score: 3, Offtopic

    Our company had to set up a complete production system that was redundant and had to be administered remotely (120 miles away). That is why we went with Solaris servers and OpenSSH/VanDyke Windows client, and tossed MS for the servers out. Of course, we were fortunate enough that none of our applications had to run on a specific platform (web server, weblogic, Oracle, C++, and Java).

    Why am I telling you all this?? Not to bash MS. I ask that you look really close at your requirements and remote administration. Do they say 'I have to run on Windows??'. If not, maybe it's time to look elsewhere for solutions.

    Nothing to do with security or scalability or reliability (ok ... maybe a little) but when it came right down to brass tacks, Unix is far easier and has far more options to administer remotely than Windows. That darn command line thing where I can change any setting easily from using a 24K dialup modem is a godsend when doing remote administration.

    If you have to have a Windows solution, I saw a lot of good ones above that we use, Cygwin and VanDyke being my favorite.

    --
    I rarely read replies, it's my opinion and if you thought about your opinion a little more, I'm OK with that.
    1. Re:Not a troll...just a suggestion by emptybody · · Score: 2

      Unless you are installing oracle.
      they dropped commandline installation and require a graphical head for the Java install. Why does everything java have to be GUI? can't there be commandline variants to a java program?

      stupid oracle.

      --
      comment directly in my journal
  49. Get the Oreilly Book by Llama+Keeper · · Score: 2

    I too am an administrator of many Windows boxen and am very security conscious . The absolute best information I have found about Windows Security, was from this Oreilly book: Securing Windows NT/2000 Servers for the Internet
    A Checklist for System Administrators I know its primarilly about creating Windows Bastion hosts, but there is an aweful lot of general Windows security and remote administration information as well. Every Windows sysadmin needs to give it a read!

    --


    Rule of Life Number 2: Remember, it can all go to hell at any minute. --Jimmy Buffet
  50. stupid question.... by Emugamer · · Score: 2

    but what does ssh have over Terminal Services?

    Is it more "secure"? It seems that win2k has very little command prompt ability and most people don't even know anything other then a few basics... So I guess my question I guess is Why?

    1. Re:stupid question.... by extra88 · · Score: 2

      Win2k's command prompt is pretty good is fine, not as good as most UNIX shells, a lot better than DOS. If you're talking about non-gui apps for users, yes, there's not much there. NT and later sysadmins can and often do a lot at the command prompt. Therefore its useful for them to have something like an SSH server. Having an SFTP server is useful users who can't use windows file sharing, such as off-site users if there's no VPN server. I use it to move files from my Mac at home to Windows at work (no VPN client for Mac). Plus you can use SSH to tunnel other connections which lack their own encryption, like VNC.

      BTW, another vote for networksimplicity's OpenSSH installer. If you don't need CygWin for other stuff, it's the way to go, user account setup is so much easier.

  51. USE GOOGLE by Perdo · · Score: 1, Offtopic

    latealy ive bean warking on teh secarity of teh few windows boxes i administar liek expee and zk stations i have had much of a problem finding decant solutions far file emale disk ancryption stuped suck pgp si no longar sealling tehlr products, ar far stupiedcard ar smartypantcardtbiomealctrric solutions besides teh limitations on key sise zoa8-bit rsaa maximum and flexability wehn it comes too ssh services far remot administration stuped windows filesharing and sfptp far file transfers i have hit a prox mine i have looked into sshhh but tehlr ssshh far winblows servers only runs on 2000 and costs ssgs and si hard too fing on kasaa i ask what solutions have /.er's fuond in teh realm of ssh netwark ancryption, and also in integrating all tehse componants simply and effectivealy

    --

    If voting were effective, it would be illegal by now.

  52. winssh by beigeboy · · Score: 1

    winssh from bitvise is your inexpensive first class sshd solution, I've used it on 2000 and XP winssh.com

  53. OpenSSH from Network Simplicity by omniplex · · Score: 1

    I see that everyone wants to use cygwin, but there is also OpenSSH for windows that's been ported by Network Simplicity, you can go and get it at http://www.networksimplicity.com/openssh/
    It's reliable, doesn't require cygwin to be installed, runs as a service on NT4/win2k. It's also command line, and I've used it with GNU CVS as well.

  54. Stunnel, TLSWrap, SSLWrap, Safetp. by BrookHarty · · Score: 3, Interesting

    I personally use Stunnel on a few boxes, linux/windows/freebsd. It basically wraps your connection with ssl. You set it up on both servers, then connect to localhost:port and it forwards to the remote server ssl encrypted. Like ssh tunnels, but its a stand alone program. Also very transparent to the user.

    TLSwrap is another ssl wrapper, used for ftp, but can be used for other ports.
    Safetp seems to be a popular one with the college kids. Ive tested it out, and it does encrypt your session, and any ftp client will work since it encrypted the port.

    Personally, I dont want command line on windows, I want a GUI for windows. Tight VNC isnt encrypted, but you can use stunnel to take care of that. But I find remote desktop, using rdp 5.1, is fast as hell(compared to tightvnc) and is designed for windows. Very usable over a modem too.

    I Love computers and networking, 500 solutions to 1 problem.

  55. Cygwin by inkfox · · Score: 2
    Someone else mentioned Cygwin, but I thought I'd provide more data.

    You can download cygwin for free from cygwin.com. It includes both the client and the server for ssh. You can set up ssh as a service that runs even prior to login, so it's the real deal. All drives are accessible through the shell via the invisible /cygdrive/c, /cygdrive/d, etc directory. All the rest is explained on the Cygwin site. I believe commercial support for Cygwin is offered by Redhat, but it's worth noting that they have a very responsive free support list, frequented by all the major developers/porters.

    Give it a go. I think you'll be impressed.

    --
    Says the RIAA: When you EQ, you're stealing bass!
  56. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  57. Not Legal... by jmoore2333 · · Score: 1

    The Microsoft licensing agreement for windows XP says that you cannot use other remote desktop sharing unless it's the one built into windows, and if you are looking for security, you better off just giving someone your information and saving them 5 minutes of work.

  58. Good SSH based on Openssh Portability code... by RuneVitki · · Score: 1

    Try http://www.networksimplicity.com/openssh. Currently at 3.4p1. Works quite well actually.

  59. OpenSSH SERVER/Client for WIndows - FREE by RuneVitki · · Score: 1

    Based on OpenSSH portability code, currently at 3.4p1. Look at http://www.networksimplicity.com/openssh. Comes with windows installer/unistaller. Fairly good docs and they guy is very prompt in maintaining it. I've used it before works quite well if you have an OpenSSH environment on the unix side (I do, and key management is a pain....)..

  60. Is stilll a problem with Cygwin shared memory? by Anonymous Coward · · Score: 1, Interesting

    I see to remember a problem with the cygwin sshd was that due to the cygwin libs users didn't have partitioned memory, i.e. I could log in as "userA" and have access to the administrators/another users memory space. The would be a BIG problem when using ssh-agent and the like (or just about any program really!)
    Has this been fixed yet?

  61. what DO you use for secure filesystem/disk? by Artifex · · Score: 2

    I've looked at BestCrypt, Scramdisk, and DiskCrypt.
    What have you found that works for you?

    --
    Get off my launchpad!
  62. Cygwin is STANDARD on my Windows systems by BitMan · · Score: 3, Informative

    As a long-time NT administrator (original NT 3.1 beta tester), no Windows system goes on my network without Cygwin . In recent years, they've added XFree86 4.x (which works flawlessly nowdays), and other goodies like OpenSSH.

    And on Win/NT versions (NT, 2K, XP), you can setup OpenSSH in full server mode which is especially sweet for automation. You can find more information on how to configure OpenSSH as a server on NT/2K/XP here.

    There is not a week that goes by without me needing something (let alone another user on our local support list) that Cygwin doesn't solve quickly and effectively. Again, that's why its on all my Windows systems by default.

    --
    -- Bryan "TheBS" Smith
    Independent Author, Consultant and Trainer
    1. Re:Cygwin is STANDARD on my Windows systems by Verizon+Guy · · Score: 2, Insightful

      Personally, I think you're full of BS.

      --

      Aw, fuck it. Let's go bowling. - The Big Lebowski

  63. From Openssh.com by RedSynapse · · Score: 4, Informative
    The following "free" clients are recommended for interoperating with OpenSSH from Windows machines:

    • PuTTY is an SSH1+SSH2 implementation. PSCP, an scp-style program for Windows, is also available.

      PuTTY is available under the MIT licence (BSD-like).

      "PuTTY is a free implementation of Telnet and SSH for Win32 platforms, written and maintained primarily by Simon Tatham, who lives in Great Britain."

    • TTSSH (SSH1) is an SSH1-only implementation, by Robert O'Callahan.

      "TTSSH is a free SSH client for Windows. It is implemented as an extension DLL for Teraterm Pro. Teraterm Pro is a superb free terminal emulator/telnet client for Windows, and its source is available. TTSSH adds SSH capabilities to Teraterm Pro without sacrificing any of Teraterm's existing functionality. TTSSH is also free to download and use and its source is available too, with an open source license. Furthermore, TTSSH has been developed entirely in Australia [...]."

    • Cygwin (POSIX software on top of Windows)

      OpenSSH (SSH1 and SSH2 protocol) with Cygwin can run on Windows using the portable version of OpenSSH.

    • MSSH

      MSSH from the Metropolitan State College of Denver supports Windows 95 and Windows 98, supporting SSH1 protocol.

    • OpenSSH for Windows

      Another OpenSSH running on top of Windows..

    • Secure iXplorer

      Secure iXplorer is graphical front end to PuTTY's pscp.exe.

    • WinSCP

      WinSCP is a scp(1) program for Windows, with PuTTY integrated into it.

    The following clients are recommended for interoperating with OpenSSH from Mac machines:

    • NiftyTelnet 1.1 SSH is an SSH1-only implementation which comes with a scp-style program. Written by Jonas Wallden.

      "NiftyTelnet 1.1 SSH r3 is an enhanced version of Chris Newman's NiftyTelnet 1.1 application which adds support for encrypted terminal sessions using the SSH (Secure Shell) protocol. Please read the included Readme file before distributing this version."

    • MacSSH is an SSH2-only implementation.

      "MacSSH is a modified version of BetterTelnet with SSH2 support. [...] The only SSH2 client for MacOS that I could find is a commercial product thats costs more than $100, and it crashes my Mac when closing a session... Since it's best to do things by oneself, here's MacSSH."

    1. Re:From Openssh.com by RedSynapse · · Score: 2

      OpenSSH for Windows includes ssh, scp, and sftp servers for Win XP, NT, and 2000.

  64. SSH has much greater functionality than IPSEC. by kcurrie · · Score: 2, Informative

    The problem with using things like IPSEC is that you need IPSEC servers which are your choke points, unless you want to have a configuration nightmare and manage thousands of independant IPSEC configs on thousands of machines-- totally not practical. SSH gives you many handy things like X forwarding/arbitrary port forwarding, the ability to load a password into memory (via ssh-agent) and use it for automatic, passwordless authentication, file transfers (both with things like scp and sftp, and it can be used for a transport agent for things like rsync/unison, etc). It's easier to poke a SINGLE hole through a firewall on any port you want, with no compatability issues. Built in (variable) compression, very handy for speeding up your X sessions, as well as things like IMAP/POP mail transfers, etc. Using something like IPSEC, how can you say "I want to compress all IMAP and POP mail to hostA, but not web traffic on hostA, and I want X compressed to hostB, but not to hostC?" All of these things are easy to do with SSH.
    With SSH I can use one standard protocol/app set that will run on everything from cell phones to PDAs to huge servers, running all kinds of OS's, generally at little to no cost. Show me an IPSEC solution that can do that. SSH requires no kernal mods, or even anything that must be installed as a root/administrator on any platform. The code is open, and free for you to mod as well. If you must have VPN type functionality you CAN do things like PPP over SSH if you must, although this isn't the highest performing option, it is possible.
    The one thing SSH *IS* missing is the ability to forward UDP traffic.

    --
    -- I speak only for myself.
    1. Re:SSH has much greater functionality than IPSEC. by ergo98 · · Score: 1

      The problem with using things like IPSEC is that you need IPSEC servers which are your choke points, unless you want to have a configuration nightmare and manage thousands of independant IPSEC configs on thousands of machine

      I really don't see how either SSH or IPSec is different in this regard, unless you're claiming that instead you run SSH on every machine (just as I could run IPSec on every machine, and of course firewall wise they'd be identical: You open port 22 TCP to everyone, and I'd open port 500 UDP to everyone. Of course actually doing that would be insanity, but regardless). Personally I prefer IPSec to be on for all communications throughout the entire organization (versus just "from the Internet in". I'd do that via a L2TP VPN server). As far as "thousands of independant IPSec configs": In the Windows world this is a group policy, and can be applied to an entire domain in minutes. With literally a minimal amount of effort you can have every system communication, intranet/LAN or internet, via secure IPSec tunnels (for every application, and without any user interventions or even knowledge).

      I'm not sure what exactly you mean regarding cell phones, etc: Again, IPSec and L2TP are as big or bigger of standards than SSH.

      It's easier to poke a SINGLE hole through a firewall on any port you want, with no compatability issues.

      IPSec to DMZ machines is a simple "Pass in UDP port 500 to my DMZ netmask". Again, IPSec isn't some esoteric, proprietary fringe standard: It is highly deployed (BTW: PGP adds IPSec to pre Windows 2000 machines if you choose that option) and heavily supported.

      Regarding compression, authentication, etc: These are all separate elements of the communications layers, and personally I don't LIKE to see them all slammed together in some emacs type "cater to everyone" combination.

    2. Re:SSH has much greater functionality than IPSEC. by kcurrie · · Score: 2, Interesting

      > Personally I prefer IPSec to be on for all communications throughout the entire organization (versus just "from the Internet in". I'd do that via a L2TP VPN server).

      I too would agree with this statement-- in an ideal world with mixed platforms (Solaris, Linux, Windows, HPUX) IPSEC everywhere would be ideal, I just fear that cross platform management would be a nightmare. One of the most attractive aspects of using IPSEC is as you mention, that you can do all of this without you users even being aware of it, and no tool changes are required.
      I'm speaking out of my ass in a certain respect, as I haven't configured IPSEC on a mass scale for multiple platforms (but I have with SSH), but I'm not aware of any multiplatform (as mentioned above, all of them, not just a couple) IPSEC products where changes can be easily made by one person on one platform. Again, these may exist, and if you know of any, I'd be interested in hearing about them.

      Of course I understand that IPSEC is fully documented and heavily deployed (I work at a company that makes many IPSEC products), I was just speaking about the ease of ssh implementation and light weight of the required apps. I'm not aware of any Java or Regarding compression, authentication, etc: These are all separate elements of the communications layers, and personally I don't LIKE to see them all slammed together in some emacs type "cater to everyone" combination.

      It's all about what you want to use it for. Even in an all IPSEC environment, SSH is still very usefull ON TOP of it all for things like transparent X forwarding between machines (no more setting your $DISPLAY), authentication, etc.

      As I mentioned, I wouldn't use SSH for a VPN, although I specifically DO use SSH instead of a VPN for telecommuting-- and I work from home 4 days a week.

      --
      -- I speak only for myself.
    3. Re:SSH has much greater functionality than IPSEC. by Zeinfeld · · Score: 2
      It is amazing how the clue density in this thread appears to be minimal.

      IPSEC is an IETF standard, always has been. The standard has some problems, requiring servers that become bottlenecks is not on of them. IPSEC is peer to peer, always has been.

      SSH began as an attempt to run Telnet over SSL, back in the very early days. Then they discovered that there were problems with that approach and the SSH protocol is now an application level security protocol while SSL is transport layer and IPSeC packet layer.

      The big problem with IPSEC is that it is designed to be peer to peer and is not designed to support the VPN application as its priary objective. As a result it is sub-optimal as a VPN, but hardly sub-optimal enough to go to the hassle of installing something else. Certainly there is not going to be much advantage in running compressed X-Windows sessions off a Windows box...

      PPTP is a legacy protocolbuilt in the days when the export controls limited crypto to 40 bits. in those days a lot of broken protocols got developed, there was little point in paying someone competent huge bucks ($5K a day) to design the protocol if you knew it was going to be broken by law. The early versions of SSL were not much better. Ever heard of SSLv1? It was broken at MIT before Marc Andressen had finished explaining it, he spent the rest of the meeting trying to call up his security guru on his cell phone.

      The big problem with EFS, as with many Microsoft crypto products is that they don't give enough info on what it does and does not secure. Most people who use it don't even know that they have to export the master escrow certificate keys off the machine in order to get any security from it.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    4. Re:SSH has much greater functionality than IPSEC. by ergo98 · · Score: 2

      It is amazing how the clue density in this thread appears to be minimal.

      As a participant in this thread, let me say that it's even more amazing how much of a self-righteous dickhead you are, especially considering the fact that you posted a method absolutely void of any useful facts, nor even relating to the conversation that was being had.

      Piece of advice: The next time you feel the urge to show your self-promoted superiority, add something useful or at least relevant to the conversation.

    5. Re:SSH has much greater functionality than IPSEC. by Zeinfeld · · Score: 2
      As a participant in this thread, let me say that it's even more amazing how much of a self-righteous dickhead you are, especially considering the fact that you posted a method absolutely void of any useful facts, nor even relating to the conversation that was being had.

      I thought it was fairly relevant to the conversation to point out that on a Windows box the ability to compress X-Windows sessions was not going to be the first feature most users would be demanding. Equally if you are going to flame Microsoft over PPTP then you should also point out that many non-Microsoft protocols have come out with serious problems.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
  65. Bitvise WinSSHD by blowdart · · Score: 2

    I use Bitvise WinSSHD.

    Aside from dropping you straight to the Win2k command prompt, it has

    • Secure remote access via console (vt100, xterm and bvterm supported)
    • Secure remote access via GUI (WinVNC or XP Remote Desktop required)
    • Secure file transfer using SFTP and SCP (compatible with all major clients)
    • Secure TCP/IP connection tunneling (port forwarding)
  66. File and disk encryption program: BestCrypt by MoFoQ · · Score: 1

    BestCrypt has been around for quite some time. Some years ago, they also had a hardware version (the hardware helped speed things up). It's just like PGPDisk but with more features and it's the original. http://www.jetico.com They even have a Linux version. One of the few things I wished they add is the ability for ppl to write algorithms for it without a compiler (via a scripting language) though it'll take a performance hit.

  67. SFTP by goofy183 · · Score: 1

    Serv-U http://www.serv-u.com/ has completely re-worked there FTP server and has SFTP options avalable. FlashFXP http://www.flashfxp.com has V2RC1 of their FTP client out which supports SFTP. I've played with both and they work very well and offer 128 bit SSL encryption for both data and control connections.

  68. Linux or BSD with SSH, Xforward, Rdesktop by rliebsch · · Score: 1

    so, I don't put windows on the internet. who does? So, have a linux box which DOES NOT route and is locked down to the best of your ability. Run SSH and let it do X11 forwarding. Install rdesktop on the linux box. SSH to your host, rdesktop to your windows server. I do this over dialup, various DSL, through VPN beautiful and simple.

    --
    Robert Liebsch Systems Psychiatrist, Network Sociologist, Security Criminologist
  69. Win2K security by Mr.+Firewall · · Score: 2, Funny

    You might want to take the one-day class on securing Windows 2000 currently being run in various cities by the SANS Institute or you won't have to worry about having secure remote access to your server(s) -- someone else will.

    It won't help to have the best encryption in the world securing your front door to a system that has 120 vulnerabilities in the default install!

    --
    In times of universal deceit, telling the truth gets you modded -1 Troll
  70. It's easy with an SSH tunnel by Supp0rtLinux · · Score: 2, Informative

    I had a similar issue. My solution was to host all shared files on a Linux server running Samba. I then set up SSH tunnels for the WINS/NetBIOS ports. Windows clients didn't know it was secure, but I did. Most Windows clients wouldn't know if their stuff was secure or not anyways...

  71. Do what I did... by pjt48108 · · Score: 1

    ...and replace Win2k with Linux.

    OK, granted this was on my home PC, but still, why buy an expensive knock-off of what u can get for cheap?

    When it comes down to it, everyone is wedded to windows for some damn reasons, but usually, if you can convince the Powers That Be to let you do the research, you can prolly plan towards replacing such servicecs with open-source solutions.

    Sure, you can't walk into CompUSA or Best Buy to buy them, but why be like all the other lemmings???? Lately, my guiding philosophy has been to face the damn cliff and simply refuse to leap off it.

    The last lemming standing and staring down at the wrecked bodies of his brethren gets the gold.

    Or, in the case of Linux, the herring. ;-)

    --
    Mmmmmm... Bold, yet refreshing!
  72. EFS doesn't encrypt file names! by GekkePrutser · · Score: 1
    Why do you choose not to use the EFS capabilities of Windows, which, to my knowledge, are very secure and transparent to the user (provided (s)he has permission to decrypt).

    Well, as I recently found out, the Encrypted File System in Windows 2000 doesn't encrypt the file names. So if you want to use it to hide things like pr0n pictures or something, you're fucked :-)

    Anyone who uses the brilliant NTFSDOS tool can access the encrypted directories and list all the file names, which in the above example would be things like 'bigtit001.jpg'. In that case the encrypted content doesn't need to be known to inflict damage, the filename is enough to piss off your boss/wife/whatever ;-)

    Of course, NTFSDOS is incapable of showing the contents of the files.

  73. Addition: EFS doesn't encrypt file names! by GekkePrutser · · Score: 1
    Of course, NTFSDOS is incapable of showing the contents of the files.

    With this I meant that NTFSDOS can not open encrypted files, normal unencrypted files on NTFS work fine, of course. Also, the link for this program is here.

    GekkePrutser

  74. how about WinSSHD ? by BuR4N · · Score: 1

    http://www.bitvise.com has a great SSH (2) server.

    --
    http://www.intellipool.se/ - Intellipool Network Monitor
  75. Warning about Cygwin! by Ed+Avis · · Score: 3
    From the Cygwin FAQ:
    Cygwin is not secure in a multi-user environment. For example if you have a long running daemon such as "inetd" running as admin while ordinary users are logged in, or if you have a user logged in remotely while another user is logged into the console, one cygwin client can trick another into running code for it. In this way one user may gain the priveledge of another cygwin program running on the machine. This is because cygwin has shared state that is accessible by all processes.
    This means that Cygwin is not suitable for running an ssh daemon unless you're sure that only one person will use the machine, or you're happy for all the users to have the same privileges.
    --
    -- Ed Avis ed@membled.com
  76. Bitvise WinSSHD by scratchor · · Score: 1

    Try out WinSSHD from Bitvise.

    I've had very good experiences with this one, and it's got a 30 day evaluation program.

    --
    -- debian linux - vim powered
  77. oxy? by loconet · · Score: 1, Flamebait

    Secure * Windows ? is that not an Oxymoron?

    --
    [alk]
  78. This should be a USENET post, not slashdot! by Anonymous Coward · · Score: 1, Insightful

    You know, beginner technical questions like this should be posted to comp.security.ssh or something. Not on a giant billboard like slashdot.

  79. Cygwin instructions by rwa2 · · Score: 3, Insightful
    As mentioned before, getting up and running with Cygwin is a snap! Here are your easy instructions:
    • Go to the cygwin site and click on the "install now" box on the side of the screen. Run the setup.exe program off the site (don't bother to save it somewhere, it gets updated almost weekly).
    • Tell it to install from the internet. Choose a mirror. It'll download a list of packages. Choose the Net | OpenSsh package. If you want to run the server, you might also want to choose everything in the Admin section. I also find Net | rsync more useful than the scp that comes with openssh.
    • Once the install is complete, fire it up and run ssh-host-config to set up the server. It'll ask you a bunch of simple questions, generate your hostkey, and stick the server in the startup scripts.
    With just this, the whole install takes about 32MB.
    Enjoy!
  80. OpenSSH For Windows by DougReed · · Score: 2, Insightful

    OpenSSH For Windows is what I use. It works pretty well. The Server only works on NT/2000 I think, but the client works on everything.

    http://www.networksimplicity.com/openssh/

  81. Obvious answer... by oPless · · Score: 1, Flamebait

    FDISK ... install linux/*bsd :-)

  82. WinSSHD from www.bitvise.com by Elphin · · Score: 1

    WinSSHD from http://www.bitvise.com is pretty inexpensive (cheaper than VShell) and works flawlessly for me.

  83. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  84. Complete Help by Futurepower(R) · · Score: 2

    Freeware SSH and SCP for Windows 9x, NT, ME, 2000 and XP By John Fitzgibbon

  85. Admin Interface by ThePlumber2 · · Score: 1

    I have built an online web portal for just these things (In perl). BTW, for Windbloze, use cygwin.

    It is an administrative interface that lets you enter the name or ip of an ssh server, a username, and password. From there, you login and it gives you a directory listing of the home dir of the user (on the remote system) via a web based file manager. It has editting capabilities, delete, copy, archive, mail, etc, etc, etc, and runs without any java, javascript, frames, or cookies. Just straight HTML 3.0.....

    It's really great, but I have not finished it yet, the major parts are done, but I don't want to let it out till it's 100%.

    Also, it has a webterm that I made, and will let you travel the tree easily (in file view mode). It will be up in a couple of months and I will post it on freshmeat.net

    The site that hosts most of my stuff is

    http://www.fixyoursink.net

    One of the coolest web apps that I have made is popdot. It's an emailer that was built off of ATDOT, and is a simple emailer front end for your apached web server. You specify the pop server and your pop users can login and check mail, send mail, send attachements etc etc... All of this once again without java junk or any of the other "web pitfalls" that the major corps have "devised".

    Peace.

    --
    Thanks, Steve
  86. RemotelyAnywhere by Marton · · Score: 1

    ...at remotelyanywhere.com is dirt-cheap compared to others, does not rely on the cygwin junk, and provides a full ssh1/ssh2/sftp implementation as well as a bunch of other admin stuff.