Slashdot Mirror
OpenSSH Going Strong After 10 Years With Release of v5.3
An anonymous reader writes "OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. It encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions. Version 5.3 marks the 10th anniversary of the OpenSSH project."
Thank you to everyone that's worked on OpenSSH over its lifetime - it's certainly made my (working) life easier.
And, unlike the Slashdot submission system, OpenSSH pretty much always works!
#DeleteChrome
This wonder-full versatile tool shaped the world of remote administration or the other way round.
Would you ?
1) Abandon SSH or OpenSSH
2) Loose an arm
3) I'm a snake
4) Telnet everywhere
5) I live in a data-center
Léa Gris
...it remembers what key goes with what server, rather than unconditionally giving each of a few dozen outside groups the ability to tell it that yes, your secure server really did just get a new key (so that new Russian IP address must be correct).
It does run on the openmoko.
http://michaelsmith.id.au
For the rest as well.
POKE 36879,8
To think we used to use telnet and rlogin to access everything.
OpenSSH is a far more significant technology than it has gotten credit for.
"To those who are overly cautious, everything is impossible. "
No matter the OS, no matter the exploit, that name alone in the title of an email to bugtraq can send shivers down the spine.
Don't Crease the Weasel!
i dont need ssh... for some reason inetd was installed with a call to bash, running as root. i can just telnet right in. it actually saves me a ton of time, since lately i can't even seem to remember what my password is.
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
Ditto for android.
Read the source.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
No idea what I would do without it.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Did OpenSSH ever fix the performance limitation on fast networks (>100Mbps)? They have static internal flow buffers that prevent fast scp/ssh! HPN has a patch but OpenSSH has to my knowledge never adopted it. http://www.psc.edu/networking/projects/hpn-ssh/
My hats off to probably the best open source package ever made
run on iPhone?
It sure does. TouchTerm, for example, uses OpenSSH.
http://jbrink.net/touchterm/
Yeap that will about do it for any geek. I mean my definition of computer porn is heading over to newegg. Does any one else feel there's a Futurama quote somewhere in there?
It was likely not far after openSSH became available, and the original SSH was starting to get less and less friendly. The great thing about SSH is is all started out free and open. Early on it was experimental (though very cool). This later changed when the original SSH became commercialized, and the licensing started closing up (thus my switching to openSSH). This was back in the days when an ssh client was something you had to hunt around for and much of the time all that was available was cruddy ssh1 clients.
We've come a long way since then. These days putty and SCP are available for any platform. I haven't even thought about the original ssh from Tatu for years, though I certainly used it so many years ago.
AccountKiller
run on iPhone?
It sure does. TouchTerm, for example, uses OpenSSH.
http://jbrink.net/touchterm/
Not the server though.
http://michaelsmith.id.au
Jailbreak it. OpenSSH is a package available via Cydia, including the server.
Just remember to install bsd-utils and change the password for root and mobile.
The openssh web page says:
Please take note of our Who uses it page, which list just some of the vendors who incorporate OpenSSH into their own products -- as a critically important security / access feature -- instead of writing their own SSH implementation or purchasing one from another vendor. This list specifically includes companies like Cisco, Juniper, Apple, Red Hat, and Novell; but probably includes almost all router, switch or unix-like operating system vendors. In the 10 years since the inception of the OpenSSH project, these companies have contributed not even a dime of thanks in support of the OpenSSH project (despite numerous requests).
Not wanting to troll but, you know, if openssh was GPL licensed said commercial vendors would have to release the source for openssh with their products, including any modifications they made. The project could also offer LGPL or BSD licensed versions in exchange for cold, hard, cash.
http://michaelsmith.id.au
I find sshfs to be a much easier to use ad-hoc network fileystem mounter than the other popular alternatives. And it's secure by default.
But it's too secure. Or rather, there are scenarios in which the network transfer doesn't need the ssh security, but encrypting it takes too long (or too much CPU from other tasks, especially on dinky embedded network devices). Is there a way to force sshfs to use a much less compute intensive encryption, or maybe even a null crypto module? Without hacking the source directly, that is - like an execution option, a compile option, a config rule, etc.
--
make install -not war
I love that they implemented multiplexing channels ... -R and -L are just awesome.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
is it better than telnet?????
One of the best things about SSH is rsync - you only need an SSH enabled login on a machine, with a copy of rsync, to be able to efficiently copy data with block-level incremental efficiency. Even better, there are excellent backup tools such as rsnapshot that build on rsync to store multiple versions of a file in the backup file tree, using hard links to avoid storing the same version twice - so every backup is a full backup in terms of easy recovery, but an incremental backup in terms of network and storage efficiency.
See http://slashdot.org/comments.pl?sid=1371703&cid=29451267 for more about rsnapshot and friends.
The fact that the editors thought that Slashdot needed an explanation of what OpenSSH is makes me feel dirty. It is like explaining what H2O is. If you don't know what OpenSSH is you should not be reading Slashdot, you bastards!
The Feds need security too. I'm sure, if there is any weaknesses (and this is theory mind you, not anything based in fact), it likely would be the larger organizations having knowledge (or specialized hardware like a TWIRL device which is just theory as of now) of how to factor public keys faster than conventional brute force ways. I'm pretty sure a lot of machines out there (especially ssh v1 boxes) still have 512 bit keys as their host key, and if someone targeted that box specifically, they could obtain the key, then try to insert themselves into the network stream for a MITM attack against people logging on via remote.
The SSH v2 protocol by itself has proven quite strong, and is one of the two bigger protocols for sending encrypted data over the Internet with decent security. Perhaps three, factoring in PPTP.
(The hackers claim 5.2 is safe, but for all we know, that could be a trick to make us upgrade to an even buggier version... the hack was in the name of avoiding full disclosure, so we'll probably never know exactly what they did, and thus not be sure it's fixed, and thus the incredibly anti-full-disclosure people demonstrate exactly why full disclosure is a good thing :-/ )
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
Unfortunately, on OSX, while the option (-w) is documented, OpenSSH still doesn't support tunneling, even after installing tuntap.
{{.sig}}
http://lwn.net/Articles/354891/
Otherwise, OpenSSH is fantastically secure. :)
OpenSSH is one of the few (only?) BSD projects that still use a license incompatible with the GPL.
When will we be able to tell that our password expired when connecting with sftp?
Seriously, how did parent get modded flamebate?
You Apple fanboys have to back off a little bit. Apple is a big company, they don't need you to rush to their defense every time some one posts a disparaging word.
And the truth, as the parent posted, can not be a flame.
Sig Battery depleted. Reverting to safe mode.
Yes but, does it run on Windows 7?
I tried installing sshwindows on Win7 the other day and the service wouldn't start. As far as I can tell, openssh has never officially supported Windows and never will.
Sure, it's useful for 'nix to 'nix connections, but I need my Windows PC in on the action, too.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Install cygwin or Microsoft'w own SFU (services for unix). They give you sshd under windows, init scripts, NFS mounting etc. SFU is actually based on openbsd userspace.
"Businesses really hate that viral open source thing in the GPL"
You meant to say
"Unscrupulous lechers, that wont pay for commercial software neither will contribute to community developed software, hate that viral open source thing in the GPL"
As for serious companies, you know, like multinational banks, oil companies, software developers, IT consultancies and the like, they all have embraced the GPL with open arms. (unless the Linux licence changed in the last 10 minutes).
IANAL but write like a drunk one.
You sound like one of those people living in abusive relationships, which after being badly beaten by their abusive partner will be the first one to defend him.
Honestly, read your elegy again....
IANAL but write like a drunk one.
Microsoft will release a version soon.
IANAL but write like a drunk one.
OpenSSH is nice, but how come there is no way to use anything else than software keys in a sensible manner with OpenSSH? Hardware tokens, HSM accelerators, smart cards? Where is PKCS#11 support in OpenSSH?
Shame, especially because there are patches available for years to do this. Check out https://bugzilla.mindrot.org/show_bug.cgi?id=1371
seems to be better on my netbook (smaller and faster anyway)
developer http://flamerobin.org
The thing about security is that it can be subjective. If I dream myself your master, then your security is my insecurity. The Feds want to be able to intercept communications, Apple want to control the iPhone experience, etc. Goals can be incompatible enough that for someone to win, someone else has to lose.
I think that's why the GP finds it remarkable that we, the users, won this small part of the crypto war. Most of use still don't encrypt our email or voice conversations, but we do have some of the transports locked down fairly well.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
The sad part is that it still has some problems.
/export/home/sftp/username1, you would normally do /export/home/sftp/./username1 as username1's path. Reading that, where should the chroot jail be? Well, it's the user's full path.
/export/home/sftp/ as the chroot jail, and in the user's directory? That would seem to be correct, however, this isn't out openssh does it.
For instance, if you want a chroot jail to terminate in a subsection, for example
Based on reading that, shouldn't it be at
I know they are just trying to protect their users, but it is at the cost of flexibility.
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty