SSH Claims Draw Open Source Ire

JDStone writes to tell us eWeek is reporting that claims of OpenSSH not being an 'enterprise-class product' by SSH Communications, the creators of SSH, is being met with a great deal of resistance. Theo de Raadt, of OpenBSD fame and a member of the OpenSSH development team was quoted saying "OpenSSH is built into all Unix and Linux vendor operating systems, and is also built into almost all larger managed network switches, from Cisco through Foundry. It comes on Linksys and D-Link wireless and security routers too."

Comments

Well it makes perfect sense

[Psx29]

I'm sure SSH Communications stands to make more money if they can discredit a free, opensource product.

Re:Well it makes perfect sense

[Anonymous Coward]

Unfortunately, Theo de Raadt chose to counter his claims with "installed base" numbers, which do absolutely nothing to discredit their statements.

They claimed OpenSSH was not "enterprise ready". Pointing out that many, many enterprises not only use it, but build it into their products is a fairly compelling rebuttal.

They are either using their own private definition of "enterprise" that doesn't include organisations like Cisco, or they are lying. Either way, they are discredited.

What else would SSH Communications say?

[CSHARP123]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

They are selling a product and they will say that to sell their product. Come on what else would you expect. This is like MS saying Windows is more Secure than Linux even though everybody knows the truth.

Re:What else would SSH Communications say?

[Husgaard]

They are selling a product and they will say that to sell their product. Come on what else would you expect.

We no longer just accept that corporations tell lies to the public. Now we also expect it...

Doesn't truth matter anymore?

Re:What else would SSH Communications say?

[Rodness]

Of course, "enterprise-scale" is a buzzword used by cathedral-style development houses who want to sell their products to "enterprise-scale" pointy-haired middle managers who have absolutely no idea how to parse buzzwords and hype with any degree of skepticism.

In my "enterprise", we prefer the open-source far-more-used-and-debugged combination of OpenSSH and PuTTY. SSH Communications is probably going to attack PuTTY next, spouting about how it's not as good as their shitty windows terminal either.

Re:What else would SSH Communications say?

[dgatwood]

This is like MS saying Windows is more Secure than Linux even though everybody knows the truth.

Nope. This is more like saying Mac OS X is more secure when used by an average desktop user than Linux. While it isn't always true, it isn't always false. It depends on the Linux variant. Similarly, the issue of enterprise readiness depends on what mechanism was used to install OpenSSH.

This software (assuming I read their ad copy correctly) provides built-in support for enterprise-wide deployment and detection of attempts to access the system by old, vulnerable versions. This means that the IT department can prevent security vulnerabilities from remaining unpatched much more easily than with software that doesn't have such features. All software should have a built-in automatic update mechanism, at least for security vulnerabilities. The lack thereof DOES make OpenSSH a poor choice for enterprise-scale deployment outside of the tech sector.

Don't get me wrong, OpenSSH and OpenSSL are cool, but the ONLY reason that enterprises use them in their products is that those enterprises have already build their own auto-update mechanisms for keeping things up-to-date, and thus, they don't need a separate mechanism for OpenSSH. While that works for an OS vendor like Cisco or a hardware vendor like Netgear, it doesn't work too well for a 500 person company in the financial sector, for example.

By itself, without the support of an OS vendor, OpenSSH is NOT enterprise-ready, and anyone who says otherwise is kidding him/herself.

Re:What else would SSH Communications say?

[Anonymous Coward]

Of course, "cathedral-style" is a buzzword used by dorky OSS hobbyists who want to be accepted by other dorky OSS hobbyists who have absolutely no idea how to parse buzzwords and group-think with any degree of skepticism.

Hypocrite.

Anyone in business knows..

[svvampy]

that "Enterprise class" is management-speak for pay-through-the-nose. There has and always will be a deep suspicion against low-cost or free(as in beer) products. There's plenty of stuff on the market that people can't give away that is sold to schmucks everywhere.

Obviously...

[Comatose51]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

Come on. Stop feeding the troll. He's a marketing droid. He comes from a tradition of making outlandish claims or at best distortion of truth. It's his job to drive sales for SSH. We should treat what marketing people say the same way we treat any advertisement. Take it with a block of salt. Obviously an open source implementation of SSH competes, and have done so very successfuly, with SSH. This is their attempt to win back the market. It's not worth giving too much thought to.

There *is* a license!

[DeafByBeheading]

Rashed acknowledged this but added, "Many vendors use it because it is free and they can use it without a license, so the number of users for remote access is quite large, but it does not provide very good SFTP or application connectivity usage."

No no no! You cannot use it without a license. It's released under the BSD license, and that license is just as important as a proprietary license. It just functions in a different way--to share the benefits of copyright rather than restrict them. Why do people keep saying that FOSS products don't have licenses?

Re:but what about enterprise administration?

[fimbulvetr]

That's the whole thing about Linux/Unix. SSH isn't meant to have those types of tools. Just like grep shouldn't have a field separator (awk) or a line counter (though it now does:)). My configs are handled by rdist, rsync or cfengine.
Having all this crap built into one thing needlessly complicates things (Optional knee jerk for those who think the additional commands are the complications), and makes things a nightmare later on. Think Microsoft GUIs and the absolutely terrible configuration options when you think about how bad this can become.

Marketing Manager to /dev/null

[NullProg]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

Since when do we care what a Marketing manager says about anything.

Enjoy,

Depends

[Sycraft-fu]

Often it's "enterprise" because it makes managing your enterpirse easier. Not something home users would care much about, but in a large environtment it's valuable. Like we use Ghost Enterprise Server here for PC work. The way it works is you install a Ghost client on the computers (if they run a supported OS) or boot from a Ghost boot CD/USB key (if they don't) and then the server can start ghost tasks. It can pull and push images to many systems at one all remotely. So if someone screws up a system (which happens in student labs) we can get it back up quickly, if we need to switch a lab over for something (like switch a Windows lab to Linux for a presentation), no problem.

Now it's nothing we couldn't do by hand, of course, and something we could probably hack together from freely available software. However the advantage here is that it's ready to go as is. Given that we do not have the time to mess with this kind of thing, it's worth the money to us.

Now I'm sure some enterprise software is pure fluff, but often the "non-enterprise" solution is woefully short on capabilities. It'll have all the technical stuff it needs, but lack in the ease of configuration, use and management. If you are running one server for yourself, you can tinker with nit pickey shit as much as is required. However when you run 1000 systems that's just not the case. You don't have that kind of time. You need to be able to centrally deploy and manage shit easily.

That's the whole point of things like LDAP (or Microsoft's version of it, Active Directory). Sure, you could keep a local user DB on each computer, and just update it as needed. Works fine, needs no new software. However that gets to be a bitch if you are talking 500 computers and 3000 users. Much better to have a central system. In our case, we pay Sun for a product that synchs our Active Directory to our Sun LDAP database. Could we do it manually? Sure. Could something have been hacked to do it? Ya, but we lack the time, and the personel to do that. Better to just pay Sun for it.

RSA PAM

[chowbok]

We attempted integration with RSA and OpenSSH had significant problems that we had to resolve and in the end we could not resolve the final problem which was a session would hang after exiting the shell if the session was authenticated using the RSA PAM module.

I had that problem too... we fixed it by turning on PrivilegeSeparation (I know the RSA docs say to turn it off, but ignore that).

In any event, that's a problem with RSA's buggy PAM module, not OpenSSH.

Re:Enterprise Product?

[UnapprovedThought]

Anyway, what is so 'enterprise' about it that OpenSSH doesn't have?

Good question. It seems very enterprising to claim that a closed software product is "in a different class by itself" -- tantamount to saying it is more secure than an open source product.

The crucial difference for me is whether I can check the source code for gaping security holes. With open source software, it is relatively easy. At least you can get a third party to vouch for the lack of obvious security holes in an open source product. With a closed product, you get only the vendor's assurance. Maybe the vendor could leave some secret exploits in there to convince people that they need to upgrade every so often? You would have no choice but to pay up, after all, your "enterprise" depends on it now.

But does closed software retain some security through obscurity? Can blackhat hackers reverse engineer a closed software product anyway? Yes, they can, and I wonder if it is a coincidence if this happens close to a product upgrade cycle.

IMHO, they are using the enterprise buzzword to try to evoke images of an "Enterprise class" warship, bristling with weapons and rotating radars and the latest bleeping control center screens, roaming your coastline defending you against any possible attack. The only trouble is you are not allowed to inspect the ship to see if it has a leak, and if the ship sinks, they'd rather you didn't tell anyone because they might not meet their sales target for that quarter.... :)

Re:Corporations are people ...!!

[Mr. Slippery]

They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money".

They're not just groups of people, they are legal entities created by the state in a way that makes them unable to do anything but seek profit.

A business corporation that fails to screw over anyone it can in the name of profit can be sued by investors. Since for large corporations, those investors are often other profit-seeking-monster corporations, such suits would be a given if the corporation didn't plunder to within an inch of what the law allows - and even beyond what the law allows, if the penalty is less than the profit.

The modern large for-profit corporation is a Frankenstein's monster constructed of law rather than of corpses; and it's only by changing the law that we can tame these beasts.

On the topic of RSA PAM, and security in general

[Nailer]

Out of every company in the world, what's the last you would expect to not provide a crytographically signed package?

RSA's own PAM modules for RHEL are distributed as an unsigned tarball. Along with the stuff you're telling me above, I don't really have much trust in RSA as a security company (and hence any trust in RSA at all).

Re:Corporations are people ...!!

[killjoe]

"They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money"."

You may have heard of a study done where it was shown that people are willing to deliver deadly amount of shocks to subjects if they can remain anonymous. Humans are like that. When relieved of responsibility and guaranteed anonymity they can be incredibly savage and cruel.

Corporations were invented to shirk responsiblity and to diffuse responsibility enough to maintain anonymity. Within the context of corporations human beings act in incredibly vile ways. This is why it's so easy to for a corporation to kill hundreds of people just to save 50 cents on a part.