Slashdot Mirror

← Back to Stories (view on slashdot.org)

SSH Secure Services on Windows 2K/XP?

Posted by Cliff on from the padlocking-the-packets dept.

jstockdale asks: "Lately I've been working on the security of the few Windows boxes I administer, specifically XP and 2000 stations. I havn't had much of a problem finding decent solutions for file/email/disk encryption (besides the fact that PGP is no longer selling their products), or for smartcard or smartcard+biometric solutions (besides the limitations on key size (2048-bit RSA maximum) and flexability). However when it comes to SSH services for remote administration, windows filesharing, and SFTP for file transfers I have hit a dead end. I have looked into SSH but their SSH for Windows Servers only runs on 2000, and costs $565. I ask what solutions have /.er's found in the realm of ssh network encryption, and also in integrating all these components simply and effectively."

77 of 238 comments (clear)

  1. CygWin by Darth+Troll · · Score: 2, Informative

    Works just dandy

    1. Re:CygWin by Frank+of+Earth · · Score: 2, Informative

      I don't run Cygwin on our prod servers but I do run it on my desktop and it works great.

      What I do is create a batch file called scmd [super command] that opens up a connection to localhost through ssh.

      Then I just create an alias to my /c and Im able to use all the great unix utilities under windows. You be surprised how something so simple like tail/head works so well when analysing log files in Windows.

      Not to get too offtopic, but it's all great for running cron jobs. The AT scheduler is the worst.

      --
      Live web cams
  2. www.Cygwin.com by aaron_pet · · Score: 3, Informative

    www.cygwin.com

    --
    Please use [ informative / summarizing ] SUBJECT LINES
    Flame me here
  3. openssh via cygwin. by ssklar · · Score: 2, Informative

    openssh works fine under cygwin. that is what we use.

    --
    Non impediti ratione cogitationis.
    1. Re:openssh via cygwin. by Telastyn · · Score: 4, Insightful

      One trick that helps is using NT resource kit's srvany to install SSHD as a service instead of cygwin's service installer. A google search can show you how. But then again a simple google search could've prevented this whole article...

  4. Putty by crouchingpenguin · · Score: 2, Informative

    You can get Putty here: http://www.chiark.greenend.org.uk/~sgtatham/putty/ .

    1. Re:Putty by Osty · · Score: 2, Informative

      And he can get a fancy alpha-blended PuTTY here. However, the way I understood it, he was asking for a server, not a client. PuTTY is only a client (ssh client, scp, sftp, etc).

  5. Tried VShell? by triffidsting · · Score: 5, Insightful

    http://www.vandyke.com/products/vshell/

    --
    Non, je ne veux pas coucher avec toi ce soir.
    1. Re:Tried VShell? by xee · · Score: 5, Informative

      Indeed, VShell is an awesome SSH server for windows. I've been using it in a production environment for a few months now and am very pleased with its performance and ability. It hasn't been a particularly smooth ride, but VanDyke tech support is excellent (you send them a logfile, they'll tell you how to fix the problem). They even supported me before I bought the product. That was impressive. I highly recommend VanDyke SSH products for windows.

      --
      Oh shit! I forgot to click "Post Anonymously"...
    2. Re:Tried VShell? by dmayle · · Score: 2, Informative

      I agree completely. I've been a huge fan of Vandyke products, and continue to recommend them to clients of mine who want Windows familiarity thrown in with their security (I implement security solutions for small to medium size businesses). All of their products that I've used (SecureFX, SecureCRT and VShell) have each gotten better with each version (which you often can't say about new software).

  6. Unless you work *real* cheap by Anonymous Coward · · Score: 2, Insightful
    $565 covers your employers costs for you for about a day (maybe a little more).

    If you need what SSH provides, buy the damn thing and get it over with. You'd spend a helluva lot more than 10 hours getting something else working - or even just looking for something else.

    1. Re:Unless you work *real* cheap by GigsVT · · Score: 2

      Cygwin with ssh takes like an hour to set up, max.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
  7. Bitvise is nice and reasonably priced by anaradad · · Score: 2, Informative

    I've been running a Bitvise WinSSHD server for a while and it works just fine. Integrates with the Windows login also, which is a nice plus. Easy to install, configure, and use.

  8. Windows Programming: A related question by Dwonis · · Score: 2, Offtopic

    My question is sort of off-topic, but I don't really know where to ask it: Where is the Windows programming community? How do Windows programmers get their information and help? I am familiar with how to get information for *nix programming: just search the web, look up the manpages, and post questions on the mailing lists/newsgroups. But I have a hell of a time writing Windows programs because I can't seem to find the mutual support network that is so common in the *nix world.

    1. Re:Windows Programming: A related question by RainbowSix · · Score: 2, Troll

      I've been thinking about this question as well. Here is what I currently believe:

      There are two main reasons people code. One is money. The second one is the appreciation of the theory and algorithms behind it.

      As a result, we have Microsoft which I see as full of people in it for the money. This leaves crappy code and security holes since as long as everybody gets their paycheck they do whatever it takes to keep them from getting fired (ie, Office Space the movie)

      Those people really don't care about the code, and so won't spend their free time contributing free software to the community. If they do write something, it will be for win32 and they will charge money so they can make a few dollars. They figure everything else costs money so why should theirs be free?

      On the other hand, we have people who like to code, and don't care so much about the money as much as the respect of their peers and for the beauty of the code. Therefore we have a lot of free stuff in linux. Sure, some of it also has win32 ports, but are there any free office suites and full fledged graphics packages soley for win32? The answer is no (I would imagine) because win32 has such a huge user base. With something like 90% of the desktop, somebody is bound to pay for your product, so why should anybody write a free application for win32?

      --
      --------
      It's OK to be social, just don't tell anyone about it.
    2. Re:Windows Programming: A related question by W2k · · Score: 4, Informative

      My sources for programming info and help/support:

      CodeGuru and CodeProject - both EXCELLENT sources of information, especially for MFC stuff. CodeProject also has lots on C#.

      Microsoft Developer Network is a great source of support (especially the KB) and the MSDN library holds a full reference for the Microsoft implementations of C/C++, C#, Visual Basic, et al. MSDN is also integrated into Visual Studio.NET, so I rarely feel the need to visit the website directly.

      Finally, lots of programmers gather in Usenet newsgroups and on IRC. I can recommend the channel #c++ on Quakenet (irc.quakenet.org) as a great source of help for Windows programmers, so long as you follow the (rather strict) channel rules. Don't miss the #c++ n00blist of people who have failed to observe these rules ... :)

      I hope this helps...

      --
      Quality, performance, value; you get only two, and you don't always get to pick.
    3. Re:Windows Programming: A related question by Stonehand · · Score: 3, Insightful

      Pure, unadulterated bullshit of the worst sterotypical kind. Having actually /been/ there, and being aware of their recruitment procedures and also of their penchant for hiring damn fine academics who know their stuff, I can tell you that if you are a clod who can't think on his feet and doesn't know what he's doing, you won't get in. And the people that were there were pretty damn motivated to do well -- one has to be, in order to work at a company that's all but compared to the Third Reich these days.

      Compare that to the unclean drivel in the Linux kernel, laden with intelligent comments like "Sun fucking blows me", clearly broken VMs that get released despite all those allegedly useful eyes staring at the code and supposedly testing it, and the unprofessional spats between the dev community.

      And if you think caring about something means that it's so obviously superior, I would suggest that you consider the fanatical behavior of assorted cults throughout history -- or, alternately, the idiots on "American Idol" who clearly /care/ about their art, but can't do it worth a damn. The people who did the art for "Craft" and for that Warcraft clone and for that FreeCiv (clone...) probably /care/ about their art too, but graphically... there's no comparison with that produced by the pros.

      As for why I code, when I do -- it's a method. Algorithms aren't too interesting if never tested, and I'm sure as hell not doing large amounts of repetitive mathematics by hand. So for me, programming is merely an extremely efficient way of getting things done, and not an ends in of itself. When it comes to recreation, I find classic literature or photography much more interesting than implementing Nelder-Mead simplex routines for function minimization, or their ilk.

      --
      Only the dead have seen the end of war.
    4. Re:Windows Programming: A related question by tcc · · Score: 2

      Obviously the parent is a flamebait.

      Yes microsoft switched MSDN to DVD and even offers a substancial rebate for people to switch to DVD subscription.

      Depending on which kind of subscription you want, MSN can be in the 3 or 4 digits. The Universal subscription is huge and most of the people don't need it for simple application, as a matter of fact, having only the MSDN library on cd and a copy of visual studio is enough for most people. Unless you are writting huge-ass datacenter application or you need evey single microsoft product (server and client) readily installable, well usually you can shell out the money that will be needed to get such a package. No it's not open source, no it's not free, yes it's microsoft. While I don't really agree with some of their ways of doign things, if you don't like it, don't buy it and go find something else; if you can't, well now you know what it's going to cost you and you'll appreciate the litterature of the MSDN subscription. I find it very immature and non professional to post such biased comments, and even worse, people modding this up like mad.., when it's completely OT to the current subject and not helping in any case.

      The only negative thing I have to say about MSDN is when you get a universal subscription, they are trying to SELL you a magazine on top of that, and the Technet library isn't included, with all of the stuff they give, this is really lame :), aside from that, if you need MS documentation, grab the MSDN cd, it's not THAT expensive, and most of the stuff there is loaded with samples and it's more readable than most unix HOWTOs for the newbies.

      --
      --- Metamoderating abusive downgraders since my 300th post.
  9. Check out the VanDyke products by mdb31 · · Score: 5, Informative

    You may want to have a look at vandyke.com; their VShell SSH server has a 'personal' edition which works very well for systems management and is cheaper than the SSH product. I've used their products for years on the server as well as client-side, and found them very reliable, as well as very well-behaved Windows services...

  10. Lots of Options by photon317 · · Score: 2


    There's lots of options available for SSH on Win32, a simple Google search turns them up. Specifically there's a free zipfile out there called ssh-win32.zip that contains a basic SSH terminal that works well. There's also GPL port-attempts of the unix commandline ssh tools, some of which work ok. In the cheapware/shareware category there's stuff like SecureCRT and F-Secure SSH. The list goes on and on... apparently some people like PuTTY.

    --
    11*43+456^2
  11. Have you looked at remotely anywhere? by slacker_bovine · · Score: 2, Informative

    Rather than some *cough* *cough*....I wish to actually try to provide some help. I've been using Remotely Anywhere for remote administration of my win2k network. It does a lot more than it sounds like you're asking for, but it is extremely useful and runs an ssh server. It is relatively cheap, but not free. Website

  12. OpenSSH + CygWin + libsectok by dmiller · · Score: 5, Informative

    As a few people have mentioned OpenSSH is supported on Windows via CygWin. What hasn't been mentioned is that OpenSSH supports smartcards through the use of libsectok. I use it with Schlumberger Cyberflex Access cards.

    I don't know whether libsectok has been built on Windows before, but it uses the standard /dev/tty interface so it should be too difficult to get working.

    1. Re:OpenSSH + CygWin + libsectok by philovivero · · Score: 4, Funny

      Mod parent up.

      Basically, I've gotten Cygwin with OpenSSH working on Win2K with zero problems.

      It's an eery feeling typing "ssh philov@win2kbox" and then getting a Bash prompt.

      Remember, once you install Cygwin to learn how to install *ANY* Unix server as a service on your Windows box. I got Apache and SSHd and a few others working trivially once I figured out that strange Cygwin addservice command.

      --
      fifth sigma, inc.
    2. Re:OpenSSH + CygWin + libsectok by ajs · · Score: 3, Interesting

      What's even scarier is being on an XP box, starting up a shell, typing "startx", get an xterm, run "ssh -XCfc blowfish me@linuxbox evolution" and getting a usable mail client on windows! :-)

    3. Re:OpenSSH + CygWin + libsectok by ajs · · Score: 2
      Evolution is the best mail client I've used, and I've used a LOT of them. I still use mutt a fair amount for quick things (the way I use vi for quick things and emacs for large work). I loved emacs' VM mode mailer, but evolution adopted it's virtual mailbox concept and made it easier to use (though not quite as powerful as emacs').

      MH was always a pain to use. pine and elm were more limited than mutt. Mozilla was nice, but too limited.

      The things I like about Evolution:
      • Virtual mailboxes -- insanely useful feature. I have a virtual mailbox for example that shows me any mail from a known list of friends across all of my IMAP and local mailboxes.
      • Wonderfully smooth and responsive IMAP and POP handling
      • Very good handling of attachments and all sorts of strange document types
      • Drag and drop between accounts
      • Well protected against malicious HTML mail (doesn't do javascript or load images by default, etc).
      • Excellent searching capabilities
      Had you had some problems with it that made you unhappy?
  13. This may seem incredibly obvious by david.given · · Score: 2
    ...but if you install Cygwin, fire up an rxvt and type 'ssh user@foo.bar.com', it Just Works.

    Although, I have had problems that if you try and resize the rxvt it stops responding, and stupid Windows doesn't kill the children if you kill the rxvt so you end up with dead processes hanging around if you're not careful, but in principle it all works fine. ssh, scp, the lot. It all interoperates with Unix beautifully.

  14. winscp (freeware) by hrdluk0 · · Score: 2, Informative

    There is a freeware windows scp program callled, not surprisingly, winscp. It is freeware and uses some code from Putty. Everyone I know has found this program very useful. Main web page: http://winscp.vse.cz/eng/ and download here: http://winscp.vse.cz/eng/download.php I found version 2.0 to be quite stable even though it is called beta.

  15. Re:Same except for manpages. by Dwonis · · Score: 2

    Do you know what the licensing for code snippets from MSDN is? They always provide them but I can't find a copyright release anywhere. Maybe I'm not looking hard enough (or recently enough).

  16. But be careful by captain_craptacular · · Score: 2

    My unit recently started using the SSH product and had issues with it. When SFTP'ing files from our windows boxes to our *nix servers random sections of text files would mysteriously dissapear. Also the term client has been flaky for me, when I'm in emacs (my editor of choice) and I backscroll it will occasionally insert random sections of my backscroll into my emacs buffer... So if you go with SSH for Windows clients, watch your text ftp's and save before you scroll up ;)

    --
    They who would give up an essential liberty for temporary security, deserve neither liberty nor security
  17. Re:Errr.... by __aaaaxm1522 · · Score: 2

    Perhaps the poor guy just didn't know about it.

    It's not very well known in the Windows world - seems to be something that us Unix folk load onto Windows machines to make them feel a little more like "home". I hope it gains more recognition by the Windows "mainstream" types, as it's one excellent bundle of useful apps.

  18. Erm... by rakslice · · Score: 2

    OpenSSH on Cygwin. It's free. I'm not sure if Cygwin provides enough unixy hooks to support sftp, but I'd imagine it does...

  19. Re:when you are too lazy to hit google by Anonvmous+Coward · · Score: 5, Insightful

    Google helps you find stuff. Google does not give you informed recommendations from your peers. Duh.

  20. Fingerprint Biometrics: DigitalPersona.com by Dr.+Ion · · Score: 2

    If you're looking for fingerprint login that integrates well with Win2k, check into the DigitalPersona U.are.U stuff.

    I have their inexpensive "UareU Pro" system, and it works great for (literally) one-touch Win2k logins. You can integrate it with your domain server to make fingerprint logins universal, but even just on a local workstation, it works fine.
    Unfortunately, zero Linux support.

    You can use the fingerprint biometrics for an encrypted virtual drive with additional software, but without any documentation or peer review of their encrypted storage, it's impossible to evaluate their security.

  21. What's wrong with Win2k server? by gcshaw2nd · · Score: 2, Interesting

    This is slightly off topic, but I'm curious as to why you went with 3rd party solutions for encryption and smartcard support instead of using Windows Server, which has those capabilities built in. Mostly I'm curious about the limitations of Windows Server products (this is not a troll, and I'm not interested in flames about M$).

    I always thought of PGP as a personal resource, not something capable of effectively encrypting entire network environments. Why do you choose not to use the EFS capabilities of Windows, which, to my knowledge, are very secure and transparent to the user (provided (s)he has permission to decrypt).

    The same question applies to Smartcard technology. Windows supports the PKINIT protocol, RSA and CryptoAPI etc. You can install Certificate Authority software as part of your install. Why specifically go with cryptoflex?

    And specifically regarding your SSH question, it's not SSH but Windows Server supports Remote Access services via which you could set up a VPN and have a secure connection to the company servers.

    Please share your knowledge.

    1. Re:What's wrong with Win2k server? by new500 · · Score: 4, Informative

      . . .

      I'm curious as to why you went with 3rd party solutions for encryption and smartcard support instead of using Windows Server, which has those capabilities built in. Mostly I'm curious about the limitations of Windows Server products

      Well for one thing, for every client that uses Windows Server for _authentication_ you have to pay up for an extra internet Client Access License. As far as I understand this (and I re- read the terms not so long back) that's each _individual_ client, not concurrent or pooled / proxied clients.

      Win2k has excellent smartcard suport, out of the box, highly recommended to lock down _physical access_. But, if like me, you're interested in smartcard authentication for a fair number of users _remotely_ it may not be the best solution to work with your existing toolchain (e.g. Cygwin, OpenSSH etc.)

      That's just what comes immediately to mind. I've not delved all I should, so further comment very welcome.

      I'll just part with the thought that in your example of installing Certificate Services, if you used this to authenticate users for a web site in even a small installation, you could be talking about hundreds of required licenses. Up to you, though, of course :)

    2. Re:What's wrong with Win2k server? by new500 · · Score: 2

      . . .

      And I thought that Win2k support for smartcards was especially for remote authentication, say on a laptop. I'm not sure what you mean by physical access, perhaps local access?

      You are partly right, no CAL is required for _anonymous_ access to Win2k. Reassuring isn't it? :-)

      I should have clarified my point a bit - in a heterogenous LAN / WAN it's not always practical to use Win2k services for all authentication. Quite apart from the expense of CALs, replicating ActiveDirectory to LDAP is a complete PITA. At a considerable price you can buy meta - directory products e.g. from SUN One and Novell to accomplish this more easily. For many instances you simply do not need to deliver NT services such as file and print or authentication to _everyone_ so then a meta - directory starts to feel like over - kill. Having *nix based smartcard tools, sans CAL costs can be a major project boon, for obvious reasons.

      As I understand it, contrary to your asertion, Cert Services under Win2k offers X.509 support for the web _and_ smartcard services. Integration is the key - either a massive boon if you wish to standardise, or a liability with the licensing cops if you mix up your distinctions :). Here's a quote http://www.microsoft.com/technet/treeview/default. asp?url=/TechNet/prodtechnol/windows2000serv/deplo y/depopt/2000cert.asp :

      Microsoft® Windows® 2000 Certificate Services offers customers an integrated public key infrastructure (PKI) that enables the secure exchange of information across the Internet, extranets, and intranets. Certificate Services verifies and authenticates the validity of each party involved in an electronic transaction and lets domain users log on to a domain using the additional security provided by smart cards.

      And some evidence that they are inseparable can be found by a search for KB Q228831 "Cannot Overwrite Smart Card Key During Certificate Services Setup" at their site, which appears broken now.

      A Laptop would not normally remote authenicate,except for web e.g., when on the move, so I don't see your point exactly, unless you mean that the laptop should be forced to call home to auth for OS login (useful to reduce risk damage from theft, and quite possible under Win2k). Smartcards are very useful for local access control under Win2k Workstation, standalone, which was my point. It's possible to use EFS to encrypt your data and locally install a X.509 cert locally to a machine, use that cert to authenticate your SSH sessions (hah!, finally back on topic :) and then use _without_ paying for more CAL's a neato smart card to secure _remote_ device access. Yup, there are subtle potential security flaws in that, as with any chain - of - systems but if your interest is not to move from machine to machine, and you keep an aggressive CRL for use with your SSH accounts, this idea is fairly useful, and way better than standard SSH + login and password. On a laptop especially you need every protection you can get :)

      Hope that clears up any confusion arising from my tiredness last night. If you simply want to manage X.509 and CRLs, there are many third party or free tools to accomplish this. If you're just setting out, I recommend you spend your money and time learning how the infrastructure works, then worry about implementations later. Knowledge wil make you free of any ties to a particular OS, or at least save you from the worst rent charges ;) For certs, he "X.509 style Guide" (sorry no link, Google is there for you), is a fine place to start. For some Smartcard background, take a gander here, for example : http://www.citi.umich.edu/projects/smartcard/

  22. They have the same problems... by DrCode · · Score: 2

    Last time I had a Windows problem, I did look on the net (DejaNews). What I found were that several other people had the same problem, but nobody had posted a solution.

    Maybe this was because there was no solution!

    1. Re:They have the same problems... by kevin+lyda · · Score: 2

      uh, i think they did.

      --
      US Citizen living abroad? Register to vote!
  23. Cygwin & TTSSH by cornice · · Score: 3, Informative

    For the server side use SSH from cygwin and for the client side I really like TTSSH as an extension to Teraterm. It also looks like there is now a TTX SSL and an SSL OTP available too. By the way, all of these have source available.

  24. Re:He said it's for a server. NOT CLIENTS. by GrenDel+Fuego · · Score: 2

    I'm guessing that your point was that there are fewer servers than clients, but you have to realise that you don't know what he does for a living.

    I personally work to support a network of thousands of Linux and Windows servers. Definitly more servers than clients owned by us.

  25. OpenSSH - server and client by Nailer · · Score: 2

    You can run both CMD and bash via OpenSSH on Windows with Cygwin. It works reliably, and there's quite a few useful command line utilities for the newer versions of windows (2000, XP), especially if you grab the resource kits. However, if you have the bandwidth (and hopefully you do) why not run terminal services?

  26. Where to find the Windows programmers by Carnage4Life · · Score: 5, Informative
    Disclaimer: I work for Microsoft but this post contains my opinions and does not represent some official company statement

    In my opinion the best places to find out information about Microsoft technologies and products are

    1. Newsgroups: Most microsoft technologies have a newsgroup in the microsoft.public.* hierarchy that are read not only by Microsoft employees but by dozens of regular developers who just want to help others who are having problems. I personally monitor microsoft.public.xml and microsoft.public.dotnet.xml where I answer a lot of questions and pass many of those I can't answer to the actual devs who work on the applications and APIs in question.

    2. Online Communities: There are a number of strong online communities where Windows developers congregate to share information, tips and tricks. These range from Microsoft sponsored sites like GotDotNet, ASP.NET, and Windows Forms.NET that are run by MSFT employees who participate actively in these communities to independent sites like 4 Guys from Rolla, Code Project, Dev Hood, DevelopMentor and CodeGuru

    3. Microsoft Websites: Few places beat MSDN as a source of information about Microsoft technologies. By the way, if you are into XML check out my Extreme XML column

    4. Mailing Lists: There are number of mailing lists hosted by various parties about Microsoft technologies. The ones I've seen with the most vibrance have been the DevelopMentor mailing lists and the ASP Friends lists


    PS: So this post isn't offtopic I'll add something about SSH. OpenSSH in Windows is possible if one installs Cygwin.
    1. Re:Where to find the Windows programmers by Eil · · Score: 2


      Disclaimer: I work for Microsoft but this post contains my opinions and does not represent some official company statement

      Hmm, I see this getting modded down relatively quick...

      Oh, but he plugged cygwin so it's okay. :)

  27. A possible other alternative by Matey-O · · Score: 2

    While attending a security session put on by the SANS institute, they had a REALLY cool solution for protecting machine to machine communication in an 'unsafe' network environment.

    They used a feature of IPSEC that didn't encrypt the packets, but CRC'd them anyway. Then they configured the machines that were supposed to listen to the outside world (Business logic servers/ database servers) to punt all packets that didn't have an IPSEC crc on 'em.

    The system does the decoding at IIRC the 2nd or 3rd layer, using some very efficient code Microsoft got from Cisco. The teacher reported pounding on a laptop on a 100mbit segment with 6 orther attacking computers and the laptop registered about 12% utilization whil punting illegal packets.

    --
    "Draco dormiens nunquam titillandus."
  28. This should be in .NET server and ported to W2K by MsGeek · · Score: 2

    Now that Microsoft has woken up to the need for improved security it is imperative that they should have SSH as an integral part of .NET Server and back-port it, Security Configurator and Analysis-style, to W2K Server and NT4 Server.

    SSH, SFTP and SCP would be wonderful tools to have. Just yank out Telnet, yank out IIS FTP Server and so forth and put this in instead. Terminal Services is fine and all but sometimes you need to do remote file transfers. The current alternatives MS provides are just not any good.

    --
    Knowledge is power. Knowledge shared is power multiplied.
    1. Re:This should be in .NET server and ported to W2K by ergo98 · · Score: 2, Insightful

      Microsoft has already provided L2TP (and its predecessor PPTP) and IPSec: It is backwards, and quite frankly quite silly, to try to program encryption into every single program when you can utilize these system features to add encryption to any and all applications (and yes you can make it mandatory if you want. In 20 seconds I can configure my system to only allow IPSec high security communications to my HTTP server).

    2. Re:This should be in .NET server and ported to W2K by ergo98 · · Score: 2, Informative

      SSH tunneling is basically a predecessor to IPSec (and a hackish one at that). Both IPSec and L2TP are standards, and neither are proprietary to Windows: Both are supported in Linux, or any other major operating system, as well.

  29. Re:IPSec by SuiteSisterMary · · Score: 2

    Yup, another classic example of 'when all you know how to use is a hammer, every problem starts to look like a nail.

    --
    Vintage computer games and RPG books available. Email me if you're interested.
  30. How about filesystem encryption for Linux? by treat · · Score: 2

    How about filesystem encryption for Linux? Something that works effectively, well enough that it can be used in the real world. The kernel loopback encryption would be perfect, except it breaks with each kernel release and an indefinite time must be waited for patches - and patches might make old data unreadable. Is there any practical solution?

  31. Yep -- sshd configuration instructions by KMSelf · · Score: 4, Informative

    Second all of the above.

    For configuring sshd, see http://tech.erdelynet.com/cygwin-sshd.html.

    --

    What part of "gestalt" don't you understand?

  32. Not a troll...just a suggestion by johnlcallaway · · Score: 3, Offtopic

    Our company had to set up a complete production system that was redundant and had to be administered remotely (120 miles away). That is why we went with Solaris servers and OpenSSH/VanDyke Windows client, and tossed MS for the servers out. Of course, we were fortunate enough that none of our applications had to run on a specific platform (web server, weblogic, Oracle, C++, and Java).

    Why am I telling you all this?? Not to bash MS. I ask that you look really close at your requirements and remote administration. Do they say 'I have to run on Windows??'. If not, maybe it's time to look elsewhere for solutions.

    Nothing to do with security or scalability or reliability (ok ... maybe a little) but when it came right down to brass tacks, Unix is far easier and has far more options to administer remotely than Windows. That darn command line thing where I can change any setting easily from using a 24K dialup modem is a godsend when doing remote administration.

    If you have to have a Windows solution, I saw a lot of good ones above that we use, Cygwin and VanDyke being my favorite.

    --
    I rarely read replies, it's my opinion and if you thought about your opinion a little more, I'm OK with that.
    1. Re:Not a troll...just a suggestion by emptybody · · Score: 2

      Unless you are installing oracle.
      they dropped commandline installation and require a graphical head for the Java install. Why does everything java have to be GUI? can't there be commandline variants to a java program?

      stupid oracle.

      --
      comment directly in my journal
  33. Get the Oreilly Book by Llama+Keeper · · Score: 2

    I too am an administrator of many Windows boxen and am very security conscious . The absolute best information I have found about Windows Security, was from this Oreilly book: Securing Windows NT/2000 Servers for the Internet
    A Checklist for System Administrators I know its primarilly about creating Windows Bastion hosts, but there is an aweful lot of general Windows security and remote administration information as well. Every Windows sysadmin needs to give it a read!

    --


    Rule of Life Number 2: Remember, it can all go to hell at any minute. --Jimmy Buffet
  34. stupid question.... by Emugamer · · Score: 2

    but what does ssh have over Terminal Services?

    Is it more "secure"? It seems that win2k has very little command prompt ability and most people don't even know anything other then a few basics... So I guess my question I guess is Why?

    1. Re:stupid question.... by extra88 · · Score: 2

      Win2k's command prompt is pretty good is fine, not as good as most UNIX shells, a lot better than DOS. If you're talking about non-gui apps for users, yes, there's not much there. NT and later sysadmins can and often do a lot at the command prompt. Therefore its useful for them to have something like an SSH server. Having an SFTP server is useful users who can't use windows file sharing, such as off-site users if there's no VPN server. I use it to move files from my Mac at home to Windows at work (no VPN client for Mac). Plus you can use SSH to tunnel other connections which lack their own encryption, like VNC.

      BTW, another vote for networksimplicity's OpenSSH installer. If you don't need CygWin for other stuff, it's the way to go, user account setup is so much easier.

  35. Stunnel, TLSWrap, SSLWrap, Safetp. by BrookHarty · · Score: 3, Interesting

    I personally use Stunnel on a few boxes, linux/windows/freebsd. It basically wraps your connection with ssl. You set it up on both servers, then connect to localhost:port and it forwards to the remote server ssl encrypted. Like ssh tunnels, but its a stand alone program. Also very transparent to the user.

    TLSwrap is another ssl wrapper, used for ftp, but can be used for other ports.
    Safetp seems to be a popular one with the college kids. Ive tested it out, and it does encrypt your session, and any ftp client will work since it encrypted the port.

    Personally, I dont want command line on windows, I want a GUI for windows. Tight VNC isnt encrypted, but you can use stunnel to take care of that. But I find remote desktop, using rdp 5.1, is fast as hell(compared to tightvnc) and is designed for windows. Very usable over a modem too.

    I Love computers and networking, 500 solutions to 1 problem.

  36. Cygwin by inkfox · · Score: 2
    Someone else mentioned Cygwin, but I thought I'd provide more data.

    You can download cygwin for free from cygwin.com. It includes both the client and the server for ssh. You can set up ssh as a service that runs even prior to login, so it's the real deal. All drives are accessible through the shell via the invisible /cygdrive/c, /cygdrive/d, etc directory. All the rest is explained on the Cygwin site. I believe commercial support for Cygwin is offered by Redhat, but it's worth noting that they have a very responsive free support list, frequented by all the major developers/porters.

    Give it a go. I think you'll be impressed.

    --
    Says the RIAA: When you EQ, you're stealing bass!
  37. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  38. Re:when you are too lazy to hit google by Qrlx · · Score: 3, Insightful

    Google helps you find stuff. Google does not give you informed recommendations from your peers. Duh.

    Google search for "SSH Secure Services on Windows 2K" (cut and paste job from article title, leaving off /XP)

    Result number ten is called "How to setup SSH service on an Windows NT\2000 system." using cygwin etc.

    So there.

  39. what DO you use for secure filesystem/disk? by Artifex · · Score: 2

    I've looked at BestCrypt, Scramdisk, and DiskCrypt.
    What have you found that works for you?

    --
    Get off my launchpad!
  40. Cygwin is STANDARD on my Windows systems by BitMan · · Score: 3, Informative

    As a long-time NT administrator (original NT 3.1 beta tester), no Windows system goes on my network without Cygwin . In recent years, they've added XFree86 4.x (which works flawlessly nowdays), and other goodies like OpenSSH.

    And on Win/NT versions (NT, 2K, XP), you can setup OpenSSH in full server mode which is especially sweet for automation. You can find more information on how to configure OpenSSH as a server on NT/2K/XP here.

    There is not a week that goes by without me needing something (let alone another user on our local support list) that Cygwin doesn't solve quickly and effectively. Again, that's why its on all my Windows systems by default.

    --
    -- Bryan "TheBS" Smith
    Independent Author, Consultant and Trainer
    1. Re:Cygwin is STANDARD on my Windows systems by Verizon+Guy · · Score: 2, Insightful

      Personally, I think you're full of BS.

      --

      Aw, fuck it. Let's go bowling. - The Big Lebowski

  41. From Openssh.com by RedSynapse · · Score: 4, Informative
    The following "free" clients are recommended for interoperating with OpenSSH from Windows machines:

    • PuTTY is an SSH1+SSH2 implementation. PSCP, an scp-style program for Windows, is also available.

      PuTTY is available under the MIT licence (BSD-like).

      "PuTTY is a free implementation of Telnet and SSH for Win32 platforms, written and maintained primarily by Simon Tatham, who lives in Great Britain."

    • TTSSH (SSH1) is an SSH1-only implementation, by Robert O'Callahan.

      "TTSSH is a free SSH client for Windows. It is implemented as an extension DLL for Teraterm Pro. Teraterm Pro is a superb free terminal emulator/telnet client for Windows, and its source is available. TTSSH adds SSH capabilities to Teraterm Pro without sacrificing any of Teraterm's existing functionality. TTSSH is also free to download and use and its source is available too, with an open source license. Furthermore, TTSSH has been developed entirely in Australia [...]."

    • Cygwin (POSIX software on top of Windows)

      OpenSSH (SSH1 and SSH2 protocol) with Cygwin can run on Windows using the portable version of OpenSSH.

    • MSSH

      MSSH from the Metropolitan State College of Denver supports Windows 95 and Windows 98, supporting SSH1 protocol.

    • OpenSSH for Windows

      Another OpenSSH running on top of Windows..

    • Secure iXplorer

      Secure iXplorer is graphical front end to PuTTY's pscp.exe.

    • WinSCP

      WinSCP is a scp(1) program for Windows, with PuTTY integrated into it.

    The following clients are recommended for interoperating with OpenSSH from Mac machines:

    • NiftyTelnet 1.1 SSH is an SSH1-only implementation which comes with a scp-style program. Written by Jonas Wallden.

      "NiftyTelnet 1.1 SSH r3 is an enhanced version of Chris Newman's NiftyTelnet 1.1 application which adds support for encrypted terminal sessions using the SSH (Secure Shell) protocol. Please read the included Readme file before distributing this version."

    • MacSSH is an SSH2-only implementation.

      "MacSSH is a modified version of BetterTelnet with SSH2 support. [...] The only SSH2 client for MacOS that I could find is a commercial product thats costs more than $100, and it crashes my Mac when closing a session... Since it's best to do things by oneself, here's MacSSH."

    1. Re:From Openssh.com by RedSynapse · · Score: 2

      OpenSSH for Windows includes ssh, scp, and sftp servers for Win XP, NT, and 2000.

  42. SSH has much greater functionality than IPSEC. by kcurrie · · Score: 2, Informative

    The problem with using things like IPSEC is that you need IPSEC servers which are your choke points, unless you want to have a configuration nightmare and manage thousands of independant IPSEC configs on thousands of machines-- totally not practical. SSH gives you many handy things like X forwarding/arbitrary port forwarding, the ability to load a password into memory (via ssh-agent) and use it for automatic, passwordless authentication, file transfers (both with things like scp and sftp, and it can be used for a transport agent for things like rsync/unison, etc). It's easier to poke a SINGLE hole through a firewall on any port you want, with no compatability issues. Built in (variable) compression, very handy for speeding up your X sessions, as well as things like IMAP/POP mail transfers, etc. Using something like IPSEC, how can you say "I want to compress all IMAP and POP mail to hostA, but not web traffic on hostA, and I want X compressed to hostB, but not to hostC?" All of these things are easy to do with SSH.
    With SSH I can use one standard protocol/app set that will run on everything from cell phones to PDAs to huge servers, running all kinds of OS's, generally at little to no cost. Show me an IPSEC solution that can do that. SSH requires no kernal mods, or even anything that must be installed as a root/administrator on any platform. The code is open, and free for you to mod as well. If you must have VPN type functionality you CAN do things like PPP over SSH if you must, although this isn't the highest performing option, it is possible.
    The one thing SSH *IS* missing is the ability to forward UDP traffic.

    --
    -- I speak only for myself.
    1. Re:SSH has much greater functionality than IPSEC. by kcurrie · · Score: 2, Interesting

      > Personally I prefer IPSec to be on for all communications throughout the entire organization (versus just "from the Internet in". I'd do that via a L2TP VPN server).

      I too would agree with this statement-- in an ideal world with mixed platforms (Solaris, Linux, Windows, HPUX) IPSEC everywhere would be ideal, I just fear that cross platform management would be a nightmare. One of the most attractive aspects of using IPSEC is as you mention, that you can do all of this without you users even being aware of it, and no tool changes are required.
      I'm speaking out of my ass in a certain respect, as I haven't configured IPSEC on a mass scale for multiple platforms (but I have with SSH), but I'm not aware of any multiplatform (as mentioned above, all of them, not just a couple) IPSEC products where changes can be easily made by one person on one platform. Again, these may exist, and if you know of any, I'd be interested in hearing about them.

      Of course I understand that IPSEC is fully documented and heavily deployed (I work at a company that makes many IPSEC products), I was just speaking about the ease of ssh implementation and light weight of the required apps. I'm not aware of any Java or Regarding compression, authentication, etc: These are all separate elements of the communications layers, and personally I don't LIKE to see them all slammed together in some emacs type "cater to everyone" combination.

      It's all about what you want to use it for. Even in an all IPSEC environment, SSH is still very usefull ON TOP of it all for things like transparent X forwarding between machines (no more setting your $DISPLAY), authentication, etc.

      As I mentioned, I wouldn't use SSH for a VPN, although I specifically DO use SSH instead of a VPN for telecommuting-- and I work from home 4 days a week.

      --
      -- I speak only for myself.
    2. Re:SSH has much greater functionality than IPSEC. by Zeinfeld · · Score: 2
      It is amazing how the clue density in this thread appears to be minimal.

      IPSEC is an IETF standard, always has been. The standard has some problems, requiring servers that become bottlenecks is not on of them. IPSEC is peer to peer, always has been.

      SSH began as an attempt to run Telnet over SSL, back in the very early days. Then they discovered that there were problems with that approach and the SSH protocol is now an application level security protocol while SSL is transport layer and IPSeC packet layer.

      The big problem with IPSEC is that it is designed to be peer to peer and is not designed to support the VPN application as its priary objective. As a result it is sub-optimal as a VPN, but hardly sub-optimal enough to go to the hassle of installing something else. Certainly there is not going to be much advantage in running compressed X-Windows sessions off a Windows box...

      PPTP is a legacy protocolbuilt in the days when the export controls limited crypto to 40 bits. in those days a lot of broken protocols got developed, there was little point in paying someone competent huge bucks ($5K a day) to design the protocol if you knew it was going to be broken by law. The early versions of SSL were not much better. Ever heard of SSLv1? It was broken at MIT before Marc Andressen had finished explaining it, he spent the rest of the meeting trying to call up his security guru on his cell phone.

      The big problem with EFS, as with many Microsoft crypto products is that they don't give enough info on what it does and does not secure. Most people who use it don't even know that they have to export the master escrow certificate keys off the machine in order to get any security from it.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    3. Re:SSH has much greater functionality than IPSEC. by ergo98 · · Score: 2

      It is amazing how the clue density in this thread appears to be minimal.

      As a participant in this thread, let me say that it's even more amazing how much of a self-righteous dickhead you are, especially considering the fact that you posted a method absolutely void of any useful facts, nor even relating to the conversation that was being had.

      Piece of advice: The next time you feel the urge to show your self-promoted superiority, add something useful or at least relevant to the conversation.

    4. Re:SSH has much greater functionality than IPSEC. by Zeinfeld · · Score: 2
      As a participant in this thread, let me say that it's even more amazing how much of a self-righteous dickhead you are, especially considering the fact that you posted a method absolutely void of any useful facts, nor even relating to the conversation that was being had.

      I thought it was fairly relevant to the conversation to point out that on a Windows box the ability to compress X-Windows sessions was not going to be the first feature most users would be demanding. Equally if you are going to flame Microsoft over PPTP then you should also point out that many non-Microsoft protocols have come out with serious problems.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
  43. Bitvise WinSSHD by blowdart · · Score: 2

    I use Bitvise WinSSHD.

    Aside from dropping you straight to the Win2k command prompt, it has

    • Secure remote access via console (vt100, xterm and bvterm supported)
    • Secure remote access via GUI (WinVNC or XP Remote Desktop required)
    • Secure file transfer using SFTP and SCP (compatible with all major clients)
    • Secure TCP/IP connection tunneling (port forwarding)
  44. Win2K security by Mr.+Firewall · · Score: 2, Funny

    You might want to take the one-day class on securing Windows 2000 currently being run in various cities by the SANS Institute or you won't have to worry about having secure remote access to your server(s) -- someone else will.

    It won't help to have the best encryption in the world securing your front door to a system that has 120 vulnerabilities in the default install!

    --
    In times of universal deceit, telling the truth gets you modded -1 Troll
  45. It's easy with an SSH tunnel by Supp0rtLinux · · Score: 2, Informative

    I had a similar issue. My solution was to host all shared files on a Linux server running Samba. I then set up SSH tunnels for the WINS/NetBIOS ports. Windows clients didn't know it was secure, but I did. Most Windows clients wouldn't know if their stuff was secure or not anyways...

  46. Warning about Cygwin! by Ed+Avis · · Score: 3
    From the Cygwin FAQ:
    Cygwin is not secure in a multi-user environment. For example if you have a long running daemon such as "inetd" running as admin while ordinary users are logged in, or if you have a user logged in remotely while another user is logged into the console, one cygwin client can trick another into running code for it. In this way one user may gain the priveledge of another cygwin program running on the machine. This is because cygwin has shared state that is accessible by all processes.
    This means that Cygwin is not suitable for running an ssh daemon unless you're sure that only one person will use the machine, or you're happy for all the users to have the same privileges.
    --
    -- Ed Avis ed@membled.com
  47. Cygwin instructions by rwa2 · · Score: 3, Insightful
    As mentioned before, getting up and running with Cygwin is a snap! Here are your easy instructions:
    • Go to the cygwin site and click on the "install now" box on the side of the screen. Run the setup.exe program off the site (don't bother to save it somewhere, it gets updated almost weekly).
    • Tell it to install from the internet. Choose a mirror. It'll download a list of packages. Choose the Net | OpenSsh package. If you want to run the server, you might also want to choose everything in the Admin section. I also find Net | rsync more useful than the scp that comes with openssh.
    • Once the install is complete, fire it up and run ssh-host-config to set up the server. It'll ask you a bunch of simple questions, generate your hostkey, and stick the server in the startup scripts.
    With just this, the whole install takes about 32MB.
    Enjoy!
  48. OpenSSH For Windows by DougReed · · Score: 2, Insightful

    OpenSSH For Windows is what I use. It works pretty well. The Server only works on NT/2000 I think, but the client works on everything.

    http://www.networksimplicity.com/openssh/

  49. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  50. Complete Help by Futurepower(R) · · Score: 2

    Freeware SSH and SCP for Windows 9x, NT, ME, 2000 and XP By John Fitzgibbon