SSH Claims Draw Open Source Ire

JDStone writes to tell us eWeek is reporting that claims of OpenSSH not being an 'enterprise-class product' by SSH Communications, the creators of SSH, is being met with a great deal of resistance. Theo de Raadt, of OpenBSD fame and a member of the OpenSSH development team was quoted saying "OpenSSH is built into all Unix and Linux vendor operating systems, and is also built into almost all larger managed network switches, from Cisco through Foundry. It comes on Linksys and D-Link wireless and security routers too."

Comments

Well it makes perfect sense

[Psx29]

I'm sure SSH Communications stands to make more money if they can discredit a free, opensource product.

Re:Well it makes perfect sense

[heelios]

Thank you much, Mr. Obvious!

Re:Well it makes perfect sense

[Psx29]

shhh, I got first post and managed to keep it on topic, I'm happy.

Re:Well it makes perfect sense

[ePhil_One]

I'm sure SSH Communications stands to make more money if they can discredit a free, opensource product.

Unfortunately, Theo de Raadt chose to counter his claims with "installed base" numbers, which do absolutely nothing to discredit their statements. Of course, the article doesn't have any of those statements either.

Re:Well it makes perfect sense

[ePhil_One]

THE PRESS RELEASE FROM http://www.ssh.com/

On May 10, 2005, The New York Times published an article concerning a breach at Cisco System, in which an intruder seized programming instructions for many of the computers that control the flow of Internet traffic. The attention was focused on a 16-year-old in Uppsala, Sweden, who was charged in March with breaking into university computers in his hometown. The crucial element in the attack that provided access at Cisco and elsewhere was the intruder's use of a vulnerable version of Secure Shell software.

Should organizations using Secure Shell become worried? Is this something that could also happen in your network?

SSH1 vs. SSH2
There are two versions of the Secure Shell protocol. The current version, Secure Shell version 2 (SSH2) introduced by SSH Communications Security in 1998 provides several security improvements compared to the original Secure Shell version 1 (SSH1). SSH Communications Security considers SecSh v1 vulnerable and does not recommend its use. The first step in eliminating vulnerabilities in your Secure Shell environment would be to upgrade all SSH1 to SSH2.

Security Maintenance Challenge
But it is not just environments running old SSH1 protocol versions that may be vulnerable against known exploits that can result in similar incidents like the one mentioned in The New York Times article.

For example, several vulnerabilities have been discovered over recent years in the widely used open-source implementation of Secure Shell protocol, OpenSSH.

Keeping OpenSSH environments secure requires constantly updating the environment with latest security patches. However, updating OpenSSH servers involves an extremely laborious and time-consuming process of source-code compilation, testing, installation, and configuration. In large-scale environments this leads to a heavy administrative burden and increased costs. As a result, during the times of constrained IT budgets many organizations have been forced to neglect frequent security patches and software updates making them vulnerable.

Even if organizations are willing to go through the costly process of manually maintaining the software on a regular basis, lack of centralized management can still present a risk. The New York Times writes:

"Government investigators and other computer experts watched helplessly while monitoring the activity, unable to secure some systems as quickly as others were found compromised."

Given the increased use of automation and sophistication of attacks, the window of opportunity for reacting to new security threats is becoming smaller. Therefore, centralized, real-time management of security systems is a critical building block in comprehensive enterprise security.

Solution - SSH Tectia
SSH Communications Security, the original developer of the Secure Shell protocol, provides end-to-end communications security solutions specifically for the enterprise. Its SSH Tectia solution has been developed to overcome the security and manageability issues of large-scale Secure Shell environments.

By standardizing on SSH Tectia throughout heterogeneous enterprise networks, including Windows, Unix, Linux, and IBM mainframes, organizations can cost-effectively implement secure practices for maintaining and using Secure Shell.
The key features and benefits of SSH Tectia for ensuring secure operation include:

Centralized Secure Shell software management enabling real-time updates to a large number of hosts and reducing the window of opportunity for exploits.

Centralized Secure Shell monitoring allowing fast identification of system anomalies.

Enterprise-class support and maintenance services including 24x7 support option enabling fast problem resolution.

FIPS 140-2 certification of cryptographic libraries serving as a proof of reliable implementation of cryptographic functions.

The enterprise-proven Secure Shell code of SSH Tectia is based on the 10 years to in-depth experience of the original development team of secure shell, and based fully on the secure, industry-proven SSH2 protocol.

Re:Well it makes perfect sense

[Anonymous Coward]

Unfortunately, Theo de Raadt chose to counter his claims with "installed base" numbers, which do absolutely nothing to discredit their statements.

They claimed OpenSSH was not "enterprise ready". Pointing out that many, many enterprises not only use it, but build it into their products is a fairly compelling rebuttal.

They are either using their own private definition of "enterprise" that doesn't include organisations like Cisco, or they are lying. Either way, they are discredited.

Re:Well it makes perfect sense

[Takumi2501]

For example, several vulnerabilities have been discovered over recent years in the widely used open-source implementation of Secure Shell protocol, OpenSSH.

Of course you're going to find vulnerabilities more easily in an open source implementaion. If you can't see the source, it's harder to find problems. It doesn't mean they're not there.

That being said, I can understand how the frequent patches can present a problem in a large-scale network. I'm just not a fan of security through obscurity.

Re:Well it makes perfect sense

[Atrus5]

"Keeping OpenSSH environments secure requires constantly updating the environment with latest security patches."
This is the only mention of the frequency of patches. They never claim that you have to patch their version less often.

However, updating OpenSSH servers involves an extremely laborious and time-consuming process of source-code compilation, testing, installation, and configuration.
This is the statement that upsets me the most. Distributions usually provide binaries. How are are these binaries different from recieving a binary from anywhere else? How does recieving a binary remove the need for testing? The only case I see the proprietary solution is when you have the same environment that the binary was tested in.

The remainder of that paragraph just claims that exorbitant costs ensue when you test updates. The obvious thing to do is, in some way, compare the values for each product:
(number of releases) * (cost of testing each release) + (probability of threat between releases) * (cost of compromise)

What else would SSH Communications say?

[CSHARP123]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

They are selling a product and they will say that to sell their product. Come on what else would you expect. This is like MS saying Windows is more Secure than Linux even though everybody knows the truth.

Re:What else would SSH Communications say?

[Husgaard]

They are selling a product and they will say that to sell their product. Come on what else would you expect.

We no longer just accept that corporations tell lies to the public. Now we also expect it...

Doesn't truth matter anymore?

Re:What else would SSH Communications say?

[Rodness]

Of course, "enterprise-scale" is a buzzword used by cathedral-style development houses who want to sell their products to "enterprise-scale" pointy-haired middle managers who have absolutely no idea how to parse buzzwords and hype with any degree of skepticism.

In my "enterprise", we prefer the open-source far-more-used-and-debugged combination of OpenSSH and PuTTY. SSH Communications is probably going to attack PuTTY next, spouting about how it's not as good as their shitty windows terminal either.

Re:What else would SSH Communications say?

[dgatwood]

This is like MS saying Windows is more Secure than Linux even though everybody knows the truth.

Nope. This is more like saying Mac OS X is more secure when used by an average desktop user than Linux. While it isn't always true, it isn't always false. It depends on the Linux variant. Similarly, the issue of enterprise readiness depends on what mechanism was used to install OpenSSH.

This software (assuming I read their ad copy correctly) provides built-in support for enterprise-wide deployment and detection of attempts to access the system by old, vulnerable versions. This means that the IT department can prevent security vulnerabilities from remaining unpatched much more easily than with software that doesn't have such features. All software should have a built-in automatic update mechanism, at least for security vulnerabilities. The lack thereof DOES make OpenSSH a poor choice for enterprise-scale deployment outside of the tech sector.

Don't get me wrong, OpenSSH and OpenSSL are cool, but the ONLY reason that enterprises use them in their products is that those enterprises have already build their own auto-update mechanisms for keeping things up-to-date, and thus, they don't need a separate mechanism for OpenSSH. While that works for an OS vendor like Cisco or a hardware vendor like Netgear, it doesn't work too well for a 500 person company in the financial sector, for example.

By itself, without the support of an OS vendor, OpenSSH is NOT enterprise-ready, and anyone who says otherwise is kidding him/herself.

Re:What else would SSH Communications say?

[Anonymous Coward]

Of course, "cathedral-style" is a buzzword used by dorky OSS hobbyists who want to be accepted by other dorky OSS hobbyists who have absolutely no idea how to parse buzzwords and group-think with any degree of skepticism.

Hypocrite.

Re:What else would SSH Communications say?

[bnjf]

So when will PuTTY have a "start file transfer here" option?

Oh right, when I write it!!

Re:What else would SSH Communications say?

[dgatwood]

1. But the OSes that actually USE OpenSSH DO include it, which is the point. Lack of builtin features to update installed apps is the fault of the operating system, not the individual app.

Not all of them. And recall that the product in question is predominantly for Windows deployment, which makes these Windows side ports the only thing worth considering as far as this subject is concerned.

I totally disagree that application update is the responsibility of the OS. Updating the OS and its components is the responsibility of the OS. Updating applications is the responsibility of the application. Only the application knows its own quirks---how to update its own configuration files when needed, etc. Blaming the OS for lack of update functionality in an app is ludicrous, particularly in an application whose entire purpose is security.

Not to mention, any admin that needs to update a typical app on 500 desktops by hand is completely worthless anyway, and you would have a lot more security problems than what implementation of SSH you are running.

Care to elaborate on that? I know how to automatically update Mac OS X in bulk using the built-in admin apps. I haven't seen such functionality for Linux without writing custom scripts. About the closest thing I've seen is groupvte, which might work for half a dozen machines, but at the 500 machine level... no prayer. Yes, somebody could write custom scripts to do it, but no matter how you do it, you're still talking about a script ssh'ing to each individual machine, running an update program, and trying to parse the results (to avoid you having to read through 10 pages of spew for each of 500 machines). It isn't an easy problem, and I have yet to see an adequate solution.

Auto-update mechanisms can introduce vulnerabilities as well. So, it's not a given that an auto-update mechanism is a good idea. The cons could very well outweigh the pros.

Doing any update could introduce new vulnerabilities. That's the nature of any update that changes code. That said, there's a 100% chance it will fix a vulnerability and only a small chance it will introduce a new one. It's not hard to weigh those odds.

Unless, of course, you mean that the update mechanism itself could be insecure. That's what package signing is for....

Er...

[Sanjuro]

Are they implyinng the DOD isn't an Enterprise class network?

Re:Er...

[Anonymous Coward]

I don't think it even qualifies as a Constitution class network.

*cue groaning*

Enterprise Product?

[emandres]

They claim that it's an enterprise product, another class of software than OpenSSH. They don't seem to have much of an argument for why it's so much different. The only comparison they manage to draw is that OpenSSH doesn't have very good SFTP, which they neglect to back by any comparison to their own. Straw man at best it seems. Anyway, what is so 'enterprise' about it that OpenSSH doesn't have? Seems to me that every 'enterprise' server running a *nix has it, so doesn't that make it enterprise enough?

Re:Enterprise Product?

[abirdman]

My experience is that the word "Enterprise" placed on any product means that the price gets multiplied by 10 or so. Sometimes they add some glitzy splash screen or GUI checkboxes so the "enterprise" admin can show off the shiny new software to the PHB's. But believe me, if it says "Product XYZ, Enterprise Edition" it means they figgered how to add another zero or two to the price of XYZ, without adding any other functionality.

Of course, I haven't RTFA yet, so I could be completely wrong about this.

Re:Enterprise Product?

[Hydrogenoid]

So we should all pay 10x the original price for openSSH and be done with the controversy!

Re:Enterprise Product?

[UnapprovedThought]

Anyway, what is so 'enterprise' about it that OpenSSH doesn't have?

Good question. It seems very enterprising to claim that a closed software product is "in a different class by itself" -- tantamount to saying it is more secure than an open source product.

The crucial difference for me is whether I can check the source code for gaping security holes. With open source software, it is relatively easy. At least you can get a third party to vouch for the lack of obvious security holes in an open source product. With a closed product, you get only the vendor's assurance. Maybe the vendor could leave some secret exploits in there to convince people that they need to upgrade every so often? You would have no choice but to pay up, after all, your "enterprise" depends on it now.

But does closed software retain some security through obscurity? Can blackhat hackers reverse engineer a closed software product anyway? Yes, they can, and I wonder if it is a coincidence if this happens close to a product upgrade cycle.

IMHO, they are using the enterprise buzzword to try to evoke images of an "Enterprise class" warship, bristling with weapons and rotating radars and the latest bleeping control center screens, roaming your coastline defending you against any possible attack. The only trouble is you are not allowed to inspect the ship to see if it has a leak, and if the ship sinks, they'd rather you didn't tell anyone because they might not meet their sales target for that quarter.... :)

Re:Enterprise Product?

[ckd]

My experience is that the word "Enterprise" placed on any product means that the price gets multiplied by 10 or so.

Either that, or it's complicated enough that only Scotty or Geordi can keep it from undergoing a warp core breach once a week.

This is my surprised face.

[mosch]

In other news, Axe body spray doesn't get you laid, and Red Bull doesn't give you wings.

Re:This is my surprised face.

[Comatose51]

Axe body spray doesn't get you laid

Damn. There goes Plan A.

but what about enterprise administration?

[louzerr]

Hey, I'm all for OpenSSH - use it every day on almost any PC I touch, but "ready for enterprise" can have more meanings than just how secure/usable a product is.

What may be missing from OpenSSH (and I'm not claiming to be an expert - just a user) is an enterprise manager ... which it sounds like the Commercial SSH version may offer.

I'm sure there's a way to enterprise-manage ssh other than passing keys around. But it doesn't seem to come out-of-the-box with OpenSSH just yet.

Re:but what about enterprise administration?

[fimbulvetr]

That's the whole thing about Linux/Unix. SSH isn't meant to have those types of tools. Just like grep shouldn't have a field separator (awk) or a line counter (though it now does:)). My configs are handled by rdist, rsync or cfengine.
Having all this crap built into one thing needlessly complicates things (Optional knee jerk for those who think the additional commands are the complications), and makes things a nightmare later on. Think Microsoft GUIs and the absolutely terrible configuration options when you think about how bad this can become.

Re:but what about enterprise administration?

[Zak3056]

Think Microsoft GUIs and the absolutely terrible configuration options when you think about how bad this can become.

While, personally, I'm alot more comfortable doing things the *nix way (for example, I find httpd.conf to be a much better administrative interface than MS's IIS Manager) Microsoft's MMC based tools are pretty good these days--they cover about 95% of everything your average admin is going to do in the lifetime of the application. They're "good enough" to get the job done, and I think that most people who say otherwise probably haven't used them recently... or are simply more comfortable using different tools to do the job and just aren't willing to sit down and learn the MS way of doing things.

Anyone in business knows..

[svvampy]

that "Enterprise class" is management-speak for pay-through-the-nose. There has and always will be a deep suspicion against low-cost or free(as in beer) products. There's plenty of stuff on the market that people can't give away that is sold to schmucks everywhere.

Name recognition

[shudde]

I realise I'm displaying my ignorance here but it should hopefully prove a point. I've used OpenSSH for years and until now I had no idea they didn't develop the protocol or that a commercial variant existed.

Couple that with the sheer number of servers and distributions using OpenSSH and the statements by Byron Rashed seem to have the ring of sour grapes.

Re:Name recognition

[ninja_assault_kitten]

You're missing the point. Popularity doesn't exactly equate to 'enterprise class'. Look at nmap, everyone knows and uses it. Is it enterprise class? No. Enterprise class means it's designed to be deployed across an entire enterprise/organization with centralized management, out of the box.

No, it's no

[winkydink]

Enterprise-class is management speak for "has a pretty GUI that a monkey can use". If one is managing thousands or tens of thousands of accounts, one doesn't want to pay somebody big bucks to do it using Open Source if said open source requires an $80k/yr person to administer it. It's a TCO calculation, nothing more.

Re:No, it's no

[winkydink]

No, an $80k/yr person costs a company a lot more than $80k/yr. Benefits, vacation, holdays, insurance, cost of the space you occupy and utilities you use, etc...

Re:No, it's no

[Col. Bloodnok]

Enterprise-class is management speak for "has a pretty GUI that a monkey can use".

Contrary to popular belief, Enterprise Class means 'supportable' in a large (enterprise) environment. Fancy going round 10,000 desktop PCs worldwide, applying 1 critical product patch personally? Or would you prefer to use some sort of 'enterprise-class' patch management software? Perhaps you'll be around to reset all those stalled PCs in that lights-out datacenter in the middle of nowhere, where you need to provide 48 hours notice just to enter the facility - or would you prefer to login to Sun boxes on the hardware console via an 'enterprise-class' LOM device?

Re:No, it's no

[tyler_larson]

if said open source requires an $80k/yr person...

Sounds like I need a raise.

Define enterprise

[russg]

Not that I'm defending SSH, but it really depends on what specifically you are speaking of when it comes to comparing the offering of OpenSSH and SSH Communications. The two products are fairly similiar for base installs and function about the same. The problems with OpenSSH come into play in the enterprise when you want to manage the SSH installs globally or integrate the SSH server with other products.

Two examples from my own experience. We attempted integration with RSA and OpenSSH had significant problems that we had to resolve and in the end we could not resolve the final problem which was a session would hang after exiting the shell if the session was authenticated using the RSA PAM module.

The other example is related to distribution and configuration managment. We have started using SSH communications central management center to distribute new versions of Tectia server as well as centrally manage the configuration for Tectia/ssh. This has reduced our management overhead considerably. This is an "enterprise" feature.

--russ

Re:Define enterprise

[Sinner]

Big spaceship. Bald captain.

Shades of McBride

[NoUse]

Did Darl finally move on to another project and change his name?

Theo for President!

[Anonymous Coward]

s/It comes on Linksys and D-Link wireless and security routers too/Don't forget about Poland

Obviously...

[Comatose51]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

Come on. Stop feeding the troll. He's a marketing droid. He comes from a tradition of making outlandish claims or at best distortion of truth. It's his job to drive sales for SSH. We should treat what marketing people say the same way we treat any advertisement. Take it with a block of salt. Obviously an open source implementation of SSH competes, and have done so very successfuly, with SSH. This is their attempt to win back the market. It's not worth giving too much thought to.

There *is* a license!

[DeafByBeheading]

Rashed acknowledged this but added, "Many vendors use it because it is free and they can use it without a license, so the number of users for remote access is quite large, but it does not provide very good SFTP or application connectivity usage."

No no no! You cannot use it without a license. It's released under the BSD license, and that license is just as important as a proprietary license. It just functions in a different way--to share the benefits of copyright rather than restrict them. Why do people keep saying that FOSS products don't have licenses?

Re:There *is* a license!

[Asgard]

FOSS programs generally don't have to connect to a 'license server' or have a paid-for 'license key' entered in a magic config file or dialog box. There is also not normally a hologram or fancy piece of paper that must be presented upon request.

Re:There *is* a license!

[Bogtha]

You cannot use it without a license.

Of course you can.

It's released under the BSD license

That grants you permission to distribute copies. You already have the right to use it. Free Software licenses like the BSD-style licenses aren't EULAs, they only come into play when you want to distribute copies.

Re:There *is* a license!

[Trailer Trash]

Why do people keep saying that FOSS products don't have licenses?

I suppose because I can use most FOSS products without a license. The GPL is a license relating to copying the code, it has nothing to do with usage. I can use it any way that I want, the license specifically states that you don't have to accept it to use the software.

He Said, She Said

[Doc Ruby]

You can tell the difference between news and Public Relations fairly easily these days. Either can look at a controversy like "SSH is enterprise-class software" (whatever that means, exactly). PR publishes a story about how one party claims it isn't, and another party irately claims it is, without telling the story of whether, in fact (or even in reliable opinion), it is or not. Actual news reporters investigate what "enterprise-class software" is, compare SSH to that, and tell the story of the software. Even including the opinions of experts, and inexpert stakeholders in the debate.

We know that eWeek, like most IT press, is PR. But it's instructive to compare eWeek's obvious PR to "mainstream media", which is now mostly just PR. Real reporting keeps the "fairness and balance" in the process of determining the real story. Then tells the real story, with evidence and witnesses to back it up. PR, and most MSM, just spouts endless hourse of newscycle reiteration of "sources" promoting their versions of the story.

Makes sense to me

[eyeball]

...claims of OpenSSH not being an 'enterprise-class product' by SSH Communications...

That's because almost everything that's 'enterprise-class' is crap.

Sheesh. If I had a nickel for every time upper management was impressed into buying a 3-million dollar equivelent of syslog, I'd be back in the dot-com boom.

I've used both...

[LABarr]

for quite a number of years. In networks both big,(huge) and small. (just to the room next door) And to be honest the are both pretty much configure and forget. But if I were deploying a world class enterprise, I'd stick with OpenSSH. If for no other reason than it is an off-shoot of the OpenBSD project and using that has conviced me what a truly first class OS looks like. OpenSSH is enterprise ready enough for virtually anyone on this planet.

--
Simulated Sig

Re:clear screen

[TMacPhail]

I was actually just looking for the code that clears the screen when you log out of a session (because I actually hate the automatic clear screen, and was hoping there was an option for it). I finally gave up in disgust.

Try looking in your .logout file. It isn't done by OpenSSH.

Re:Site won't let me in without a cookie.

[i.r.id10t]

Why are you so afraid of cookies? Just mark the file read-only or immutable (via chattr). You get the benefit of the cookie while your browser is open, but close the browser and re-open it and your previous sessions cookies are all gone.

Re:Enterprise - the key word of marketing BS

[techno-vampire]

Marketdroids call things "Enterprise class" to appeal to PhB's who grew up with Star Trek.

Re:Man, the universe loves me. :)

[Anonymous Coward]

Your informed opinion has no place in a Slashdot discussion.

"Enterprise-class" is a trademark.

[Strolls]

At least that's what Google AdWords keeps telling me. By a curious coincidence with this article I got an email from them today, saying I'm not allowed to use that term when describing the quality of the Linux-support for the ADSL modems that I sell.

I believe that I applied for an exemption for this term when I originally set up the ad with AdWords, but it's been running for months quite happily without bothering anyone.

When I Google for "enterprise-level" I (of course) get loads of hits discussing enterprise-ready email, whether Linux is enterprise-ready, firewalls & stuff, but I see the only advertiser is Enterprise Rent-A-Car UK. That makes me extremely tempted to trademark the term in the context of ADSL modems & then file a complaint about the Ford-pimping bastards. At least that way I might get a dialogue going with Google - as it is I confidently expect any complaints or protests about the matter to be ignored or get auto-responses; if I create a new advert with the words it gets suspended within half an hour.

If there's anyone reading this who works at Google then I'd be extremely grateful if you could have a little word with your censorship department for me, or give me a direct email address for them. Having an advert claiming "Outstanding Linux-support" simply doesn't satisfy me the way "Enterprise-level Linux support" does. And hey! Linux is a trademark, so I guess they'll be censoring that next week!!

Thank you for ignoring this rant. Please moderate it "funny" because i surely won't be so miffed at Google next week.

Re:Man, the universe loves me. :)

[pnatural]

You've been trolled. The openssh code base has plenty of comments, and it's a joy to read for most C programmers. It's nicely formatted, with plenty of consistency and thought put into the layout.

Re:Man, the universe loves me. :)

[Anonymous Coward]

Thats funny. I just looked at the source myself, and I saw plenty of comments. Not only that, but it was the furthest thing I could imagine from "spaghetti code". Very modular with a clean API.

But since this is slashdot I think concrete examples are in order. Lets say we want to find out about the buffer routines, where do we go? Oh, buffer.c. I wonder what is in that file?

Well, look at that! Its the buffer management API! WOW! Who would have thought it!

So, we want to add some data to an existing buffer. What function should we use? buffer_init() no...comment says /* Initializes the buffer structure. */ - clearly not what we want. Looking down we see buffer_append(). That sounds promising. But we can't expect people modifying the code to actually take the time to read and understand it, can we? So lets look at the comment to make certain sure. /* Appends data to the buffer, expanding it if necessary. */ I'm not sure, but I THINK that might just do what we wanted.

WOW that was SO hard, not helped one bit by all that blatant spaghetti code and total lack of comments!

Yeah, not enterprise class like Apache isn't...

[adam872]

This is just stupid. There are open source products out there that are clearly good enough to be used in "enterprise" settings and OpenSSH is one of them (Apache, Perl, Linux being some others). I've looked at what commercial SSH vs OpenSSH offers and I honestly can't think of a reason to use the commercial product. I agree (for once) with Theo and ask if it's not "enterprise class", why would O/S vendors include it in their products (Sun, Redhat etc)? For the record, all of my Solaris systems run OpenSSH supplied by Blastwave and the Linux machines have it already. It's all about the right tool for the job and open vs commercial is a secondary consideration (IMHO) over utility. In this case, the open source offering is at least as good as the commercial product.

What extra features do you need out of SSH anyway? I ask not to be a smart arse, but as a genuine inquiry.

Re:Man, the universe loves me. :)

[Nimrangul]

Gentlemen, behold! A troll being marked Insightful on Slashdot! OpenBSD are the ones with KNF, that's Kernel Normal Form, the style that all code in the base operating system (which includes OpenSSH) must conform to.

It does not help...

[jd]

...that a number of patches exist for OpenSSH (speedups, code cleanups, extensions, etc) that aren't getting folded into the baseline. Even if the patches (as they stand) don't meet the coding standards for OpenSSH (there are some?), you really should be seeing efforts to either get the patch writers to reformat to standards OR have core developers recode them.

OpenSSH is limited to IPv4 and IPv6. Limited? Well, yes. Linux supports many non-IP stacks, as do other *nix OS'. So long as you have some component to handle the making of connections and the sending of packets, the rest of OpenSSH doesn't need to care what sort of network you're using or what the transport mechanism is.

I believe OpenSSH can take advantage of some crypto hardware, but I don't recall seeing any announcements that it could use crypto drivers (or crypto functions) in the OS. It links to OpenSSL, but I don't recall seeing any provision for GnuTLS.

Is it the best crypto package out there (SSL included)? Yes. Is it the best it could be? Not by a long shot. Is it the best that it should be, given the code available (both for OpenSSH and as related libraries)? Not even close.

OpenSSH is every bit as "enterprise" as SSH - in fact, for some things, I'd say more so. Does that give the OpenSSH team any excuse to slack off? No - they should be so far ahead, by now, that SSH seems as ancient as the Pyramids and as user-friendly as a unicycle NASCAR.

Of course, we could settle the dispute by bribing^H^H^H^H^H^H^Hlobbying to make IPSec a Federally-mandated standard for all Internet-based computers. Then application-level crypto would cease to be important and we could get onto something useful, like Microsoft-bashing.

Re:It does not help...

[Nimrangul]

And where's your patch pickledick?

You're here whining, perhaps you should be at a terminal putting OpenSSH so far ahead that SSH.com seems like the ancient pyramids instead of complaining that people are working hard to put together something like OpenSSH at all.

OpenSSH's developers refuse shitty patches until they are sent in a manner that conform to the code standards and goal's of the project, if the people sending patches are too stupid to read and code properly before hand, why should the developers then hold hands and recode every shittily cobbled patch for them?

If you have a bug, you submit a report, if you want a feature you submit the patch - it's that simple.

You people just don't understand how to put up or shut up.

Re:It does not help...

[statemachine]

You are completely correct. This is OpenSSH's problem. Patches not getting folded in, responses like "where's YOUR patch, pickledick?", and the utter lack of OpenSSH programmers taking the initiative to fix stupid problems like cross-platform compiling on a non-target CPU.

I don't doubt that OpenSSH is enterprise-class when compared with the likes of Microsoft's offerings or SSH Corp., but immature responses from the supposed "OpenSSH developers" that don't further to solve the problems really put people off.

If OpenSSH would clean house of the wannabes and show some initiative and maturity, the OpenSSH team might get more respect from the outsiders.

Re:It does not help...

[Nimrangul]

It's not an abuse of power to say, "no, that idea goes against the goals of this project." The goals are out there, read the mailing list, there are even a few on their website where you can read them.

If you have different goals, start your own project.

If you're unable to spend the time to know how to properly submit a patch then it's your problem, not theirs, it's their project.

If you are wanting something to be accepted into it, you have to make it work the way the developers want it to work.

Your attitude is completely asshat backwards, it's not up to them to help you get what you want, it's up to you to get them what you want. But if you want to add in support for an algorithm that is patened, too bad, it won't happen. If you want to start favouring PAM, too bad. If you want to have it support the GnuTLS, too bad.

How hard is it to conform to the KNF? Are you saying it's so hard to conform to good coding guidelines that it's not worth adding the functionality you want? Fine, the functionality won't be added.

This isn't forcing their personal view on anyone, it's enforcing their views on their own project. No one is forcing you to be a user, there is no knife held to your neck waiting for the second you download lsh.

Don't like it? Go cry to your mother, maybe she can make it all better.

OpenSSH specifically supports enterprise admin

[Nailer]

I'm sure there's a way to enterprise-manage ssh other than passing keys around. But it doesn't seem to come out-of-the-box with OpenSSH just yet.

Kerberos. It's implementation in OpenSSH is a good example of how they specifically support enterprise admin. Kerberos is fairly poor security wise, using symmetric encryption and hence holding copies of user passwords on the server. It's poor security according to those with high standards, and inferior to PKI according to everybody. But OpenSSH supports it, because Kerberos is the most popular single sign on method used at corporates.

Interestingly, OpenSSH's market share is something like 76% of all SSH servers.

Re:Man, the universe loves me. :)

[X.25]

I'm really not trying to post flamebait here, but GAH, the people who work on that thing should hang their heads in embarrassment. Spaghetti code, no comments -- I'm talking a total mess. I was actually just looking for the code that clears the screen when you log out of a session (because I actually hate the automatic clear screen, and was hoping there was an option for it). I finally gave up in disgust.

And this comes from a person who looks into OpenSSH source instead of .bash_logout.

It must be credible source review, really...

Marketing Manager to /dev/null

[NullProg]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

Since when do we care what a Marketing manager says about anything.

Enjoy,

Depends

[Sycraft-fu]

Often it's "enterprise" because it makes managing your enterpirse easier. Not something home users would care much about, but in a large environtment it's valuable. Like we use Ghost Enterprise Server here for PC work. The way it works is you install a Ghost client on the computers (if they run a supported OS) or boot from a Ghost boot CD/USB key (if they don't) and then the server can start ghost tasks. It can pull and push images to many systems at one all remotely. So if someone screws up a system (which happens in student labs) we can get it back up quickly, if we need to switch a lab over for something (like switch a Windows lab to Linux for a presentation), no problem.

Now it's nothing we couldn't do by hand, of course, and something we could probably hack together from freely available software. However the advantage here is that it's ready to go as is. Given that we do not have the time to mess with this kind of thing, it's worth the money to us.

Now I'm sure some enterprise software is pure fluff, but often the "non-enterprise" solution is woefully short on capabilities. It'll have all the technical stuff it needs, but lack in the ease of configuration, use and management. If you are running one server for yourself, you can tinker with nit pickey shit as much as is required. However when you run 1000 systems that's just not the case. You don't have that kind of time. You need to be able to centrally deploy and manage shit easily.

That's the whole point of things like LDAP (or Microsoft's version of it, Active Directory). Sure, you could keep a local user DB on each computer, and just update it as needed. Works fine, needs no new software. However that gets to be a bitch if you are talking 500 computers and 3000 users. Much better to have a central system. In our case, we pay Sun for a product that synchs our Active Directory to our Sun LDAP database. Could we do it manually? Sure. Could something have been hacked to do it? Ya, but we lack the time, and the personel to do that. Better to just pay Sun for it.

Re:Depends

[Sycraft-fu]

What's wrong is we don't do Linux, for the most part, we do Windows. We also go back and forth, we'll have a Windows lab that needs to become a Linux lab for a weekend, then back to Windows on Monday.

As for OpenLDAP, talk to the Solaris admin, not my jursdiction. However I think you'd have a hard sell convincing the department to replace all the Solaris hardware, espically considering the apps we need are Sparc only in a number of cases. Same thing with replacing the Windows workstations, until you can find Linux versions of all the important apps (I'd say 1 in 20 has a Linux version) that's right out.

Ghost is excellent because it's lower level than an OS. I can have any OS or combination of OSes I like on an image. The management of any of the PC workstations is the same, I just pick the image I want and push it out.

My point isn't that Ghost is the only way to do things, my point is this is the reason someone would pay for the Enterprise version. This is what it does that normal Ghost does not, and it's something that doesn't ahve any readily available equivalant I'm aware of, except for other commercial, enterprise products like it.

I know that the DIY mentality is really popular on Slashdot, my point is that it doesn't always work. I DIY my systems at home, including hardware. I don't care to have an OEM dictate to me what kind of parts I'll have, or what will come installed on my computer. However at work, we buy OEM. Why? Well we lack the time to build systems ourselves, and the time to deal with RMAs on broken parts. RMAs for peicemeal hardware is a pain, usually if something breaks at home I buy a replacement, and then put the replacement part in another box when I finally get it. Can't do that at work so we buy OEM and if something breaks, an e-mail is all it takes to have a replacement part there next day.

Basically I'm just trying to help people see the situations where things like better, easier management really does matter. When you work in a small environment, it's easy to scoff at the waste of money these things are. I mean who the hell would pay $750 for an SSH server when OpenSSH is really pretty easy to set up, all said and done? However when you work in a larger environment, you often discover that the "easy" task is taking up an amazing amount of your time, and automating it would take even more time. It ends up being better to pay for a product that already does it, and that you know works.

This goes double if you don't have programmers on staff. I'm not sure where the misunderstanding that all or even most admins are competent programmers. Actually I find the opposite to be true. Most of the competent admins I know are at best mediocre programmers and most of the competent programmers I know are at best mediocre admins. There are a couple exceptions, but it seems for the most part when you spend your time doing one well, you don't have as much time to be good at doing the other. So if you staff is all support, no programmers, it makes even more sense to use off the shelf solutions. Better to spend $10,000 on a product that works than have 2 of your staff have 3 very unproductive months hacking something together that only sort of works.

Re:Man, the universe loves me. :)

[Suicyco]

What a dumbass.

If you can't figure out how to keep your screen from clearning (hint, NOT because of ssh) then what judge are you on the source code?

Ever seen the source code of the commercial SSH? Hmm. Is it even using the proper encryption algorithms? Is there a back door? We are talking heavy duty ENTERPRISE security here. You trust that level of security to a product that claims to protect your communications? Why not trust it to a product you KNOW protects your communications, because you can look right there in the source and then compile it yourself.

Re:hmmm... this sounds familiar...

[Chmarr]

Key-generation: there are TONS of ways to generate a key. All of them will give you a key in the end, but the process leading up to it can be done in different, and varying secure ways. Faster ones will use a Pseudo-RNG (insecure), while slower ones will use network events (semi-real-random, and far more secure), or something like mouse movements. Really, you can't compare the two.

File copying: again, it's MOSTLY a function of the encryption algorithm. If you're using a simpler, and less-secure algorithm, you'll get faster transfers, and less CPU utilisation doing those transfers.

It's this kind of thing that Microsoft uses when comparing, for example, IIS and Apache. Their comparisons using HTTPS were done with different hash and encryption algorithms, which make up a HUGE portion of the resource utilisation.

Corporations are people ...!!

[pbhj]

They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money".

People hide within the group and don't care if they have Nike shares and Nike abuses child labour (an example from the 90's). The people say "great, more money for me"; then when it becomes public they say "oh shame on Nike".

What is possibly worse is that we, as consumers, say "your doing great" by buying the mega-corps products. There are few markets where there isn't a _more_ ethical alternative.

If the corporations, the groups of people are soul-less ... that's because the individuals don't bring their souls into their finances. Spending power can change the world. Look at the Fair Trade movement (http://www.fairtrade.org.uk/) ... heck don't just look, do something about it.

Re:Corporations are people ...!!

[Mr. Slippery]

They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money".

They're not just groups of people, they are legal entities created by the state in a way that makes them unable to do anything but seek profit.

A business corporation that fails to screw over anyone it can in the name of profit can be sued by investors. Since for large corporations, those investors are often other profit-seeking-monster corporations, such suits would be a given if the corporation didn't plunder to within an inch of what the law allows - and even beyond what the law allows, if the penalty is less than the profit.

The modern large for-profit corporation is a Frankenstein's monster constructed of law rather than of corpses; and it's only by changing the law that we can tame these beasts.

Re:Corporations are people ...!!

[killjoe]

"They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money"."

You may have heard of a study done where it was shown that people are willing to deliver deadly amount of shocks to subjects if they can remain anonymous. Humans are like that. When relieved of responsibility and guaranteed anonymity they can be incredibly savage and cruel.

Corporations were invented to shirk responsiblity and to diffuse responsibility enough to maintain anonymity. Within the context of corporations human beings act in incredibly vile ways. This is why it's so easy to for a corporation to kill hundreds of people just to save 50 cents on a part.

Re:Corporations are people ...!!

[Anonymous Coward]

A business corporation that fails to screw over anyone it can in the name of profit can be sued by investors.

That is a Slashdot Myth. Often repeated. Completely untrue.

Shareholders dictate the rules of the company. If the shareholders decide that their company must be profit-maximizing no matter what cost, then what you say might be true. However such companies simply don't exist in the real world. More realistically the shareholders decide that there is a purpose for the company. Many companies have statutes in the foundation documents stating their primary purpose is to produce a best-of-breed product or to be the world leader in a particular niche. These companies aim to maximize value rather than profit. Value includes non-tangibles such as customer confidence, employee satisfaction, and the long-term sustainability of the company. If the managers of those companies "screwed anyone in the name of profit" like you say they should, then they could be sued by investors for destroying the company's value.

RSA PAM

[chowbok]

We attempted integration with RSA and OpenSSH had significant problems that we had to resolve and in the end we could not resolve the final problem which was a session would hang after exiting the shell if the session was authenticated using the RSA PAM module.

I had that problem too... we fixed it by turning on PrivilegeSeparation (I know the RSA docs say to turn it off, but ignore that).

In any event, that's a problem with RSA's buggy PAM module, not OpenSSH.

Any PR is Good PR for the Underdog...

[sednet]

the commercial ssh.com site appears to draw a bigger audience (and thus, a better alexa ranking) than the free openssh.com site. if the more popular, better-known software (ssh, commercial) wants to call attention to a free competitor (openssh, free), that's their mistake, and i hope the openssh community benefits from it!

Re:But they failed misserably

[thc69]

No, it's not the reporter.

One part is -- translating this from TFA:

These comments raised the ire of Theo de Raadt, leader of the OpenBSD operating system and a member of the OpenSSH development team.

into this headline from TFA and the /. post:

SSH Claims Draw Open Source Ire

Drawing Theo's ire and drawing "Open Source Ire" are very different things; everything draws Theo's ire. As a whole, the OSS community is much more tolerant.

On the topic of RSA PAM, and security in general

[Nailer]

Out of every company in the world, what's the last you would expect to not provide a crytographically signed package?

RSA's own PAM modules for RHEL are distributed as an unsigned tarball. Along with the stuff you're telling me above, I don't really have much trust in RSA as a security company (and hence any trust in RSA at all).

a few facts

[rsilverman]

There's a lot of exaggeration and vagueness on both sides of this little
tempest. What suffices for one enterprise may not for another, so it is
certainly silly for ssh.com to claim that OpenSSH is not
"enterprise-class" -- as Theo and others rightly point out, OpenSSH is
used successfully in many large contexts. On the other hand, it is a fact
that Tectia has a number of features OpenSSH lacks, some of which are
particularly relevant to large organizations (which is not the same as
simple widespread use). Here are a few of them:

* PKI support

Tectia can use X.509 certificates for both client and server
authentication. To add a new SSH server or change an existing one's host
key, all you need do is issue a certificate for it. Clients need only
have a copy of a single public key: the issuing CA certificate. No
constantly shifting mess of per-user and per-host known-host files to try
to keep in sync, no spurious "unknown host" or "host key changed messages"
confusing users and teaching them to ignore security warnings. It just
works.

For client authentication, there are no burgeoning copies of
authorized_keys files lying around, unmanaged, needing to be individually
tracked down whenever you want to turn off someone's access: instead, you
can simply revoke the user's certificate. And flexible rules can grant
access based on certificate attributes, like "anyone in the Foo Department
can log into this host."

The distributed-trust problem has been addressed abstractly by systems
like PKI and Kerberos. In a large (or even medium) scale environment, you
want to tie applications such as SSH into these systems, not have each one
use its own ad-hoc mechanism.

Note that both OpenSSH and Tectia support Kerberos. There is some
variation in how well they use it to address the above problems, though,
and I won't get into that here.

* Greater configuration flexibility

With the Tectia SSH server you can:

+ Modify almost all server parameters based on the client hostname and
address, or properties of the requested account (username and group
membership). Thus you can arrange that, accounts in one group permit
password authentication, while those in another group require
public-key -- or that connections coming from your internal network
allow a wide range of ciphers, while those coming from the outside
require a smaller, stronger set. You can accomplish some of this type
of thing with OpenSSH, but generally you have to run multiple
instances of the server on different ports.

+ Exert finer-grained control over what kinds of SSH services you
provide. You can forbid terminal access while still allowing sftp,
for example, by simply rejecting the corresponding SSH protocol
requests (shell and exec channels), rather than resorting to custom
shells or other hacks that have unwanted side effects.

+ Control port forwarding with ACLs that include permit/deny statements
and patterns matching user, target hostname, IP address, etc.

+ Require multiple forms of authentication for access (e.g. password and
public-key).

* SOCKS support for outgoing SSH connections (note this is different from
the OpenSSH -D feature, which Tectia has also).

* "chroot"-ed logins

* integrated support for RADIUS authentication

* Support for Windows-native Kerberos. Although OpenSSH can be built with
Kerberos support on Windows (with Cygwin), it does not

Everyone in IT knows...

[FellowConspirator]

... that "Enterprise Class Product" refers to the license cost, not quality or features. SSH Communications is right. OpenSSH doesn't cost enough to be "Enterprise Class".

wanna sell ssh? Then make it better!

[Danathar]

If they want people to buy a commercial version of SSH then they should provide something of value that OpenSSH does not provide!

Ideas...

1. How bout a hardware based SSH accelerator for fast SFTP/SCP transfers?

2. GUI configuration in X/QT/GTK...ect...

3. Performance monitoring tools

I pulled these out of my ass in 3 seconds. None of them may be worth the time but you get the idea!

Not much more protection than OpenSource

[cant_get_a_good_nick]

Though TFA mentions extra protection for rule sets like SOX and others, actually checking the license shows them pretty fairly lacking. Like most EULAs, you give up pretty much everything. This is what you get from: http://www.ssh.com/support/downloads/tectia-client /evaluation.mpl It looks like it is their normal license, plus an amendment for the temporary license period. I extracted some parts on liability, yadda yadda.

8. WARRANTY

LICENSOR EXPRESSLY DISCLAIMS, TO THE EXTENT PERMITTED BY APPLICABLE LAW, ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, OF FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS, AND ANY WARRANTY THAT MAY ARISE BY REASON OF TRADE USAGE, CUSTOM OR COURSE OF DEALING. LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE FREE FROM BUGS OR THAT ITS USE WILL BE UNINTERRUPTED NOR THAT THE SOFTWARE WILL OPERATE WITH ANY HARDWARE AND/OR OTHER SOFTWARE OR REGARDING THE USE, OR THE RESULTS OF THE USE, OF THE SOFTWARE OR DOCUMENTATION IN TERMS OF CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE. WITHOUT LIMITING THE FOREGOING, YOU ACKNOWLEDGE THAT THE SOFTWARE IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND.

9. LIMITATION OF LIABILITY

THE ENTIRE RISK AS TO RESULTS AND PERFORMANCE OF THE SOFTWARE IS ASSUMED BY YOU. ANY LIABILITY OF LICENSOR WITH RESPECT TO THE SOFTWARE, THE PERFORMANCE THEREOF OR DEFECTS THEREIN, OR UNDER THIS AGREEMENT, UNDER ANY WARRANTY, NEGLIGENCE, STRICT LIABILITY OR OTHER LEGAL THEORY SHALL BE LIMITED EXCLUSIVELY TO PRODUCT REPLACEMENT OR, IF REPLACEMENT IS INADEQUATE AS A REMEDY, OR, IN LICENSOR'S SOLE OPINION, IMPRACTICAL, TO A REFUND OF THE ACTUAL AMOUNT PAID BY YOU TO LICENSOR, IF ANY, FOR THE SOFTWARE OR SERVICES GIVING RISE TO THE CLAIM.

10. DISCLAIMER OF DAMAGES

UNDER NO CIRCUMSTANCES WILL LICENSOR OR ITS LICENSORS BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES OF ANY KIND OR NATURE WHATSOEVER, WHETHER BASED ON CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, ARISING OUT OF OR IN ANY WAY RELATED TO THE SOFTWARE, THIS AGREEMENT, WHETHER DUE TO A BREACH OF LICENSOR'S OBLIGATIONS HEREUNDER OR OTHERWISE, EVEN IF LICENSOR OR ITS LICENSORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE OR IF SUCH DAMAGE COULD HAVE BEEN REASONABLY FORESEEN, AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY EXCLUSIVE REMEDY PROVIDED IN THIS AGREEMENT. SUCH LIMITATION ON DAMAGES INCLUDES, BUT IS NOT LIMITED TO, DAMAGES FOR LOSS OF GOODWILL, LOST PROFITS, LOSS OF DATA OR SOFTWARE, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION OR IMPAIRMENT OF OTHER GOODS. IN NO EVENT WILL LICENSOR OR ITS LICENSORS BE LIABLE FOR THE COSTS OF PROCUREMENT OF SUBSTITUTE SOFTWARE OR SERVICES.

YOU ACKNOWLEDGE THAT THIS SOFTWARE IS NOT DESIGNED OR LICENSED FOR USE IN ON-LINE EQUIPMENT IN HAZARDOUS ENVIRONMENTS SUCH AS OPERATION OF NUCLEAR FACILITIES, AIRCRAFT NAVIGATION OR CONTROL, OR LIFE-CRITICAL APPLICATIONS. LICENSOR EXPRESSLY DISCLAIMS ANY LIABILITY RESULTING FROM USE OF THE SOFTWARE IN ANY SUCH ON-LINE EQUIPMENT IN HAZARDOUS ENVIRONMENTS AND ACCEPTS NO LIABILITY IN RESPECT OF ANY ACTIONS OR CLAIMS BASED ON THE USE OF THE SOFTWARE IN ANY SUCH ON-LINE EQUIPMENT IN HAZARDOUS ENVIRONMENTS BY YOU. FOR PURPOSES OF THIS PARAGRAPH, THE TERM "LIFE-CRITICAL APPLICATION" MEANS AN APPLICATION IN WHICH THE FUNCTIONING OR MALFUNCTIONING OF THE SOFTWARE MAY RESULT DIRECTLY OR INDIRECTLY IN PHYSICAL INJURY OR LOSS OF HUMAN LIFE.

Not sure what Online in Hazardous environments means. There's only a partial explanation; one additional interpretaion would have all of the Internet hazardous because of crackers. I like how some companies beat you over the head with "you can't sue anybody" then neglect to meantion you can't really sue them either. It's a true statement of most OSI licenses, but it's no worse than theirs in that regard.

Your user info

[Anonymous Coward]

Your "homepage" points at http://localhost/. For most normal network devices, the hostname "localhost" will resolve to the same device, typically using IP address 127.0.0.1. That means that if anyone clicks on your link, they'll be connecting to themselves!

Do you see how explaining at length a readily apparent joke is neither funny nor insightful? That indeed it is scarcely worth the time it takes to type and certainly contributes nothing to the signal-to-noise ratio here? You have a five digit uid, you can do better than this.

You're welcome

Centralised management is not necessarily good

[grahammm]

As far as security is concerned, is centralised (update and configuration) management not an additional vulnerability? If an attacker can attack the centralised control then they have just subverted all the systems managed by it.

Re:I am sorely tempted...

[jd]

I respect Theo as someone who gets things done, as someone who is great on the frontier of computer security, and as someone who is absolutely essential if software security is to be done right.

I neither respect him OR those who follow him for their attitudes, however. I don't know how long Theo's been in programming, but I believe it likely that I've hacked for longer, better and over a wider range of architectures and programming languages. I've probably worked on a wider range of networking infrastructures, a wider range of Operating Systems and in far more countries than most of the OpenBSD and OpenSSH folk.

Does that give me airs? No. Does that give me the right to question tactice? Oh, certainly. What use is having breadth of knowledge if you never employ it to correct those with depth of specialised knowledge? Specialists are great, nothing wrong with them and you often NEED them, but specialists need generalists in order to make the best use of their skills. Too limited a horizon can make for bad decisions that simply aren't visible to specialists.

A broad horizon, on its own, is equally useless, as you don't get the depth of vision. The ideal is for generalists and specialists to work together, each complimenting the other's skill sets. When that does not happen, the specialist needs to go first, the generalist can then make adjustments, but eventually you'll need to go back to a specialist to progress beyond a certain point.

The FOLK version of OpenSSH is the generalist stage. It will work towards making a more generalized OpenSSH, with a greater range of features, but sooner or later it will need to either re-merge with the classical OpenSSH -or- have a Theo-like person to take over, to drive it to where it needs to go. This is merely a course correction fork.