Slashdot Mirror
Security Focus Interviews Damien Miller
An anonymous reader writes "The upcoming version 4.3 of OpenSSH will add support for tunneling allowing you to make a real VPN using OpenSSH without the need for any additional software. This is one of the features discussed in SecurityFocus' interview of OpenSSH developer Damien Miller. The interview touches on, among other things, public key crypto protocols details, timing based attacks and anti-worm measures."
For example, if you create a VPN with this latest OpenSSH, a lossy network will hold up your traffic. Despite the fact that TCP/IP will try to continue operating with dropped packets, with OpenSSH if you miss one packet the loss cascades into succeeding packets until the client and server are able to resync or the packet is delivered. This accumulation of tolerances is not a problem with IPsec, which is designed cipherwise to work around occasional packet loss.
Most experts agree the product of the best cryptography will be indistinguishable from random noise. This means that it is difficult to share the benefits of compression with file encryption because random noise compresses very poorly, as anyone who attempts to archive their MP3s of today's artists will attest. Additionally, if you accidentally store your encrypted files amongst files containing random noise you run the risk of generating new data during decryption.
The secret is to understand the technology before you use the technology. The problem with encryption is twofold -- some people are overconfident in what they're using and either lose data or risk more than they would if they were fully informed, and others think it's too difficult a topic to broach and leave themselves open to exploitation by network explorers. Certainly when I was in the second category I became convinced of the problem once I saw tools like 'tcpdump' and 'ethereal'.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
OpenSSH just keeps getting better. Not just a great shell client and server, but support for multiple streams, secure tunnels, SCP, SFTP, every authentication method you could want, and finally VPN (the next logical extension). OpenSSH ships with every Linux distribution I can name (well, except embedded ones), the BSDs, and MacOS, and is available for Windows (under Cygwin) and every other major UNIX and UNIX-like OS out there. The code is all available to anyone for any purpose with no real restrictions (other than giving some credit to the developers), so you could include it in any app you make, regardless of license (GPL included). Thanks, everyone who works on this valuable tool. I think I'll go buy a T-shirt
For those hackers who are already familiar with the forwarding features of ssh (-L, -R and -d options), and who are wondering what the hell is this new "support for tunneling", here is a hacker summary. Quoting TFA:
Tun(4) interfaces are indeed very convenient. That's all folks !
for those of you in search of a solution for exactly this problem that doesn't involve iptables hackery or whatnot, check out denyhosts: http://denyhosts.sourceforge.net/> . It's a cronjob/daemon that lurks over ssh logs and updates hosts.deny based on rules you specify. simple, quick, gets rid of most of the annoying sshd bots.
filter: +3. Hey, look! all the trolls went away!
Anyone seen this before?:
http://www.hamachi.cc/
Loos like a better way of doing VPN.. though ssh with in built vpn is going to be nice...
"Consider how lucky you are that life has been good to you so far. Alternatively, if life hasn't been good to you so far
Wrong, wrong, wrong, wrong, wrong. Please, amateurs this is one area where you can do the most harm by offering your "opinion" as fact. Please, whenever you find yourself wanting to tell people how smart you are about crypto, just post "Sorry, I'm a bit stupid about this, but I wanted to post" instead of whatever nonsense (like the above) you were going to choose.
When the code is good, clean, free and something the developers want.
I'm sick of following my dreams - I'm just going to ask them where they're going and hook up with them later.
You're spouting complete nonsense. A secure block cipher in a secure mode of operation revelals nothing about the similarities between files. Loock up CBC mode on Google - a large random initialization vector is used to ensure that identical (or similar) plaintext blocks encrypt completely differently. I also suggest a thorough reading of Applied Cryptography by Bruce Schneier.
OpenPGP, for example, uses gzip compression before encryption with every file. Yet PGP is widely considered very secure. Why? Because a secure mode of operation for the cipher (AES, 3DES, whatever) is used, with a random IV that ensures even identical files produce completely different ciphertext.
"I'd like to see something like easier tunneling of X of an SSH session"
WHAT???
You, "olde scholar" find too dificult just `ssh -X user@host` and then `startx`?
Now: how can it be any easier!?