Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

SSH Secure Services on Windows 2K/XP? 270

Posted by Cliff from the padlocking-the-packets dept.
jstockdale asks: "Lately I've been working on the security of the few Windows boxes I administer, specifically XP and 2000 stations. I havn't had much of a problem finding decent solutions for file/email/disk encryption (besides the fact that PGP is no longer selling their products), or for smartcard or smartcard+biometric solutions (besides the limitations on key size (2048-bit RSA maximum) and flexability). However when it comes to SSH services for remote administration, windows filesharing, and SFTP for file transfers I have hit a dead end. I have looked into SSH but their SSH for Windows Servers only runs on 2000, and costs $565. I ask what solutions have /.er's found in the realm of ssh network encryption, and also in integrating all these components simply and effectively."
This discussion has been archived. No new comments can be posted.

SSH Secure Services on Windows 2K/XP? More

SSH Secure Services on Windows 2K/XP?

Comments Filter:

  • CygWin (Score:2, Informative)

    by Darth Troll ( 576144 )
    Works just dandy

    • Re:CygWin (Score:2, Informative)

      by Frank of Earth ( 126705 )
      I don't run Cygwin on our prod servers but I do run it on my desktop and it works great.

      What I do is create a batch file called scmd [super command] that opens up a connection to localhost through ssh.

      Then I just create an alias to my /c and Im able to use all the great unix utilities under windows. You be surprised how something so simple like tail/head works so well when analysing log files in Windows.

      Not to get too offtopic, but it's all great for running cron jobs. The AT scheduler is the worst.

  • www.Cygwin.com (Score:3, Informative)

    by aaron_pet ( 530223 ) <aaron_pet&hotmail,com> on Friday July 19, 2002 @08:01PM (#3920087) Homepage Journal
    www.cygwin.com

  • openssh via cygwin. (Score:2, Informative)

    by ssklar ( 13970 )
    openssh works fine under cygwin. that is what we use.

  • Putty (Score:2, Informative)

    by crouchingpenguin ( 322034 )
    You can get Putty here: http://www.chiark.greenend.org.uk/~sgtatham/putty/ [greenend.org.uk].
    • I think he is referring to the need of a server, not a client

    • Re:Putty (Score:2, Informative)

      by Osty ( 16825 )

      And he can get a fancy alpha-blended PuTTY here [daishar.com]. However, the way I understood it, he was asking for a server, not a client. PuTTY is only a client (ssh client, scp, sftp, etc).

    • You can run both CMD and bash via OpenSSH on Windows with Cygwin. It works reliably, and there's quite a few useful command line utilities for the newer versions of windows (2000, XP), especially if you grab the resource kits. However, if you have the bandwidth (and hopefully you do) why not run terminal services?

  • Tried VShell? (Score:5, Insightful)

    by triffidsting ( 594096 ) on Friday July 19, 2002 @08:04PM (#3920109)
    http://www.vandyke.com/products/vshell/

    • Re:Tried VShell? (Score:5, Informative)

      by xee ( 128376 ) on Friday July 19, 2002 @08:17PM (#3920167) Journal
      Indeed, VShell is an awesome SSH server for windows. I've been using it in a production environment for a few months now and am very pleased with its performance and ability. It hasn't been a particularly smooth ride, but VanDyke tech support is excellent (you send them a logfile, they'll tell you how to fix the problem). They even supported me before I bought the product. That was impressive. I highly recommend VanDyke SSH products for windows.

    • Re:Tried VShell? (Score:2, Informative)

      by dmayle ( 200765 )
      I agree completely. I've been a huge fan of Vandyke products, and continue to recommend them to clients of mine who want Windows familiarity thrown in with their security (I implement security solutions for small to medium size businesses). All of their products that I've used (SecureFX, SecureCRT and VShell) have each gotten better with each version (which you often can't say about new software).

  • Unless you work *real* cheap (Score:2, Insightful)

    by Anonymous Coward
    $565 covers your employers costs for you for about a day (maybe a little more).

    If you need what SSH provides, buy the damn thing and get it over with. You'd spend a helluva lot more than 10 hours getting something else working - or even just looking for something else.

  • I've been running a Bitvise WinSSHD [bitvise.com] server for a while and it works just fine. Integrates with the Windows login also, which is a nice plus. Easy to install, configure, and use.

  • Cygwin! (Score:1)

    by BJH ( 11355 )
    I installed cygwin on my PC at work a couple of weeks ago (after the /. article). SSH client and server both work fine.

  • Putty ssh client (Score:1, Informative)

    by bluegreenone ( 526698 )
    I know you are asking about server software specifically, but I thought I'd take the opportunity to mention Putty [greenend.org.uk], a suite of useful SSH clients includind a SSH/telnet, Pageant their key manager, and plink their command-line version.

  • Errr.... (Score:1, Redundant)

    by zulux ( 112259 )
    What's wrong with cygwin?

    • Perhaps the poor guy just didn't know about it.

      It's not very well known in the Windows world - seems to be something that us Unix folk load onto Windows machines to make them feel a little more like "home". I hope it gains more recognition by the Windows "mainstream" types, as it's one excellent bundle of useful apps.
  • My question is sort of off-topic, but I don't really know where to ask it: Where is the Windows programming community? How do Windows programmers get their information and help? I am familiar with how to get information for *nix programming: just search the web, look up the manpages, and post questions on the mailing lists/newsgroups. But I have a hell of a time writing Windows programs because I can't seem to find the mutual support network that is so common in the *nix world.
    • Search the web, look up things in the MSDN Library [microsoft.com], and post questions on the mailing lists/newsgroups. =)
      • Do you know what the licensing for code snippets from MSDN is? They always provide them but I can't find a copyright release anywhere. Maybe I'm not looking hard enough (or recently enough).
    • www.codeguru.com - actually i don't know how good it is anymore. but about five years ago when i worked as a windows application developer i found alot of help there
    • USENET, just like for everything else. comp.os.ms-windows.*
    • Last time I had a Windows problem, I did look on the net (DejaNews). What I found were that several other people had the same problem, but nobody had posted a solution.

      Maybe this was because there was no solution!
    • I've been thinking about this question as well. Here is what I currently believe:

      There are two main reasons people code. One is money. The second one is the appreciation of the theory and algorithms behind it.

      As a result, we have Microsoft which I see as full of people in it for the money. This leaves crappy code and security holes since as long as everybody gets their paycheck they do whatever it takes to keep them from getting fired (ie, Office Space the movie)

      Those people really don't care about the code, and so won't spend their free time contributing free software to the community. If they do write something, it will be for win32 and they will charge money so they can make a few dollars. They figure everything else costs money so why should theirs be free?

      On the other hand, we have people who like to code, and don't care so much about the money as much as the respect of their peers and for the beauty of the code. Therefore we have a lot of free stuff in linux. Sure, some of it also has win32 ports, but are there any free office suites and full fledged graphics packages soley for win32? The answer is no (I would imagine) because win32 has such a huge user base. With something like 90% of the desktop, somebody is bound to pay for your product, so why should anybody write a free application for win32?
      • Pure, unadulterated bullshit of the worst sterotypical kind. Having actually /been/ there, and being aware of their recruitment procedures and also of their penchant for hiring damn fine academics who know their stuff, I can tell you that if you are a clod who can't think on his feet and doesn't know what he's doing, you won't get in. And the people that were there were pretty damn motivated to do well -- one has to be, in order to work at a company that's all but compared to the Third Reich these days.

        Compare that to the unclean drivel in the Linux kernel, laden with intelligent comments like "Sun fucking blows me", clearly broken VMs that get released despite all those allegedly useful eyes staring at the code and supposedly testing it, and the unprofessional spats between the dev community.

        And if you think caring about something means that it's so obviously superior, I would suggest that you consider the fanatical behavior of assorted cults throughout history -- or, alternately, the idiots on "American Idol" who clearly /care/ about their art, but can't do it worth a damn. The people who did the art for "Craft" and for that Warcraft clone and for that FreeCiv (clone...) probably /care/ about their art too, but graphically... there's no comparison with that produced by the pros.

        As for why I code, when I do -- it's a method. Algorithms aren't too interesting if never tested, and I'm sure as hell not doing large amounts of repetitive mathematics by hand. So for me, programming is merely an extremely efficient way of getting things done, and not an ends in of itself. When it comes to recreation, I find classic literature or photography much more interesting than implementing Nelder-Mead simplex routines for function minimization, or their ilk.

    • Where to find the Windows programmers (Score:5, Informative)

      by Carnage4Life ( 106069 ) on Friday July 19, 2002 @09:02PM (#3920342) Homepage Journal
      Disclaimer: I work for Microsoft but this post contains my opinions and does not represent some official company statement

      In my opinion the best places to find out information about Microsoft technologies and products are

      1. Newsgroups: Most microsoft technologies have a newsgroup in the microsoft.public.* hierarchy that are read not only by Microsoft employees but by dozens of regular developers who just want to help others who are having problems. I personally monitor microsoft.public.xml [google.com] and microsoft.public.dotnet.xml [google.com] where I answer a lot of questions and pass many of those I can't answer to the actual devs who work on the applications and APIs in question.

      2. Online Communities: There are a number of strong online communities where Windows developers congregate to share information, tips and tricks. These range from Microsoft sponsored sites like GotDotNet [gotdotnet.com], ASP.NET [asp.net], and Windows Forms.NET [windowsforms.net] that are run by MSFT employees who participate actively in these communities to independent sites like 4 Guys from Rolla [4guysfromrolla.com], Code Project [codeproject.com], Dev Hood [devhood.com], DevelopMentor [developmentor.com] and CodeGuru [codeguru.com]

      3. Microsoft Websites: Few places beat MSDN [microsoft.com] as a source of information about Microsoft technologies. By the way, if you are into XML check out my Extreme XML column [microsoft.com]

      4. Mailing Lists: There are number of mailing lists hosted by various parties about Microsoft technologies. The ones I've seen with the most vibrance have been the DevelopMentor mailing lists [develop.com] and the ASP Friends lists [aspfriends.com]


      PS: So this post isn't offtopic I'll add something about SSH. OpenSSH in Windows is possible if one installs Cygwin [cygwin.com].

    • Re:Windows Programming: A related question (Score:4, Informative)

      by W2k ( 540424 ) on Friday July 19, 2002 @09:07PM (#3920355) Journal
      My sources for programming info and help/support:

      CodeGuru [codeguru.com] and CodeProject [codeproject.com] - both EXCELLENT sources of information, especially for MFC stuff. CodeProject also has lots on C#.

      Microsoft Developer Network [microsoft.com] is a great source of support (especially the KB) and the MSDN library [microsoft.com] holds a full reference for the Microsoft implementations of C/C++, C#, Visual Basic, et al. MSDN is also integrated into Visual Studio.NET, so I rarely feel the need to visit the website directly.

      Finally, lots of programmers gather in Usenet newsgroups and on IRC. I can recommend the channel #c++ on Quakenet (irc.quakenet.org) as a great source of help for Windows programmers, so long as you follow the (rather strict) channel rules [readme.tk]. Don't miss the #c++ n00blist [planetn00b.tk] of people who have failed to observe these rules ... :)

      I hope this helps...

  • Cygwin (Score:1)

    by ar ( 109152 )
    Like everyone says, cygwin is the winner.

    You might want to check here [infopop.net] for some hints on installation. (In addition to the user guide and readmes of course).

  • Check out the VanDyke products (Score:5, Informative)

    by mdb31 ( 132237 ) on Friday July 19, 2002 @08:10PM (#3920138)
    You may want to have a look at vandyke.com [vandyke.com]; their VShell SSH server has a 'personal' edition which works very well for systems management and is cheaper than the SSH product. I've used their products for years on the server as well as client-side, and found them very reliable, as well as very well-behaved Windows services...

  • There's lots of options available for SSH on Win32, a simple Google search turns them up. Specifically there's a free zipfile out there called ssh-win32.zip that contains a basic SSH terminal that works well. There's also GPL port-attempts of the unix commandline ssh tools, some of which work ok. In the cheapware/shareware category there's stuff like SecureCRT and F-Secure SSH. The list goes on and on... apparently some people like PuTTY.
  • Rather than some *cough* *cough*....I wish to actually try to provide some help. I've been using Remotely Anywhere for remote administration of my win2k network. It does a lot more than it sounds like you're asking for, but it is extremely useful and runs an ssh server. It is relatively cheap, but not free. Website [remotelyanywhere.com]
  • Comment removed based on user account deletion
    • My unit recently started using the SSH product and had issues with it. When SFTP'ing files from our windows boxes to our *nix servers random sections of text files would mysteriously dissapear. Also the term client has been flaky for me, when I'm in emacs (my editor of choice) and I backscroll it will occasionally insert random sections of my backscroll into my emacs buffer... So if you go with SSH for Windows clients, watch your text ftp's and save before you scroll up ;)
  • CuteFTP pro has excellent very good Sftp cababilities, I use it all the time between work and home.

    Works fine for win2k, XP, and is cheap to buy.

    ______
    Jaylen

  • OpenSSH + CygWin + libsectok (Score:5, Informative)

    by dmiller ( 581 ) <[gro.tordnim] [ta] [mjd]> on Friday July 19, 2002 @08:18PM (#3920173) Homepage

    As a few people have mentioned OpenSSH is supported on Windows via CygWin [cygwin.com]. What hasn't been mentioned is that OpenSSH supports smartcards through the use of libsectok [umich.edu]. I use it with Schlumberger Cyberflex Access cards.

    I don't know whether libsectok has been built on Windows before, but it uses the standard /dev/tty interface so it should be too difficult to get working.

    • Re:OpenSSH + CygWin + libsectok (Score:4, Funny)

      by philovivero ( 321158 ) on Friday July 19, 2002 @08:26PM (#3920214) Homepage Journal
      Mod parent up.

      Basically, I've gotten Cygwin with OpenSSH working on Win2K with zero problems.

      It's an eery feeling typing "ssh philov@win2kbox" and then getting a Bash prompt.

      Remember, once you install Cygwin to learn how to install *ANY* Unix server as a service on your Windows box. I got Apache and SSHd and a few others working trivially once I figured out that strange Cygwin addservice command.
      • What's even scarier is being on an XP box, starting up a shell, typing "startx", get an xterm, run "ssh -XCfc blowfish me@linuxbox evolution" and getting a usable mail client on windows! :-)

    • Yep -- sshd configuration instructions (Score:4, Informative)

      by KMSelf ( 361 ) <karsten@linuxmafia.com> on Friday July 19, 2002 @09:30PM (#3920411) Homepage

      Second all of the above.

      For configuring sshd, see http://tech.erdelynet.com/cygwin-sshd.html [erdelynet.com].

    • From the Cygwin FAQ [cygwin.com]:
      Cygwin is not secure in a multi-user environment. For example if you have a long running daemon such as "inetd" running as admin while ordinary users are logged in, or if you have a user logged in remotely while another user is logged into the console, one cygwin client can trick another into running code for it. In this way one user may gain the priveledge of another cygwin program running on the machine. This is because cygwin has shared state that is accessible by all processes.
      This means that Cygwin is not suitable for running an ssh daemon unless you're sure that only one person will use the machine, or you're happy for all the users to have the same privileges.
  • ...but if you install Cygwin, fire up an rxvt and type 'ssh user@foo.bar.com', it Just Works.

    Although, I have had problems that if you try and resize the rxvt it stops responding, and stupid Windows doesn't kill the children if you kill the rxvt so you end up with dead processes hanging around if you're not careful, but in principle it all works fine. ssh, scp, the lot. It all interoperates with Unix beautifully.

  • The Oxy* Project (Score:1, Funny)

    by Anonymous Coward
    In unison, now: "Windows Security" : ....

  • winscp (freeware) (Score:2, Informative)

    by hrdluk0 ( 257155 )
    There is a freeware windows scp program callled, not surprisingly, winscp. It is freeware and uses some code from Putty. Everyone I know has found this program very useful. Main web page: http://winscp.vse.cz/eng/ and download here: http://winscp.vse.cz/eng/download.php I found version 2.0 to be quite stable even though it is called beta.
  • OpenSSH on Cygwin. It's free. I'm not sure if Cygwin provides enough unixy hooks to support sftp, but I'd imagine it does...
  • If you're looking for fingerprint login that integrates well with Win2k, check into the DigitalPersona [digitalpersona.com] U.are.U stuff.

    I have their inexpensive "UareU Pro" system, and it works great for (literally) one-touch Win2k logins. You can integrate it with your domain server to make fingerprint logins universal, but even just on a local workstation, it works fine.
    Unfortunately, zero Linux support.

    You can use the fingerprint biometrics for an encrypted virtual drive with additional software, but without any documentation or peer review of their encrypted storage, it's impossible to evaluate their security.
  • This is slightly off topic, but I'm curious as to why you went with 3rd party solutions for encryption and smartcard support instead of using Windows Server, which has those capabilities built in. Mostly I'm curious about the limitations of Windows Server products (this is not a troll, and I'm not interested in flames about M$).

    I always thought of PGP as a personal resource, not something capable of effectively encrypting entire network environments. Why do you choose not to use the EFS capabilities of Windows, which, to my knowledge, are very secure and transparent to the user (provided (s)he has permission to decrypt).

    The same question applies to Smartcard technology. Windows supports the PKINIT protocol, RSA and CryptoAPI etc. You can install Certificate Authority software as part of your install. Why specifically go with cryptoflex?

    And specifically regarding your SSH question, it's not SSH but Windows Server supports Remote Access services via which you could set up a VPN and have a secure connection to the company servers.

    Please share your knowledge.

    • Re:What's wrong with Win2k server? (Score:4, Informative)

      by new500 ( 128819 ) on Friday July 19, 2002 @09:47PM (#3920460) Journal

      . . .

      I'm curious as to why you went with 3rd party solutions for encryption and smartcard support instead of using Windows Server, which has those capabilities built in. Mostly I'm curious about the limitations of Windows Server products

      Well for one thing, for every client that uses Windows Server for _authentication_ you have to pay up for an extra internet Client Access License. As far as I understand this (and I re- read the terms not so long back) that's each _individual_ client, not concurrent or pooled / proxied clients.

      Win2k has excellent smartcard suport, out of the box, highly recommended to lock down _physical access_. But, if like me, you're interested in smartcard authentication for a fair number of users _remotely_ it may not be the best solution to work with your existing toolchain (e.g. Cygwin, OpenSSH etc.)

      That's just what comes immediately to mind. I've not delved all I should, so further comment very welcome.

      I'll just part with the thought that in your example of installing Certificate Services, if you used this to authenticate users for a web site in even a small installation, you could be talking about hundreds of required licenses. Up to you, though, of course :)

  • Cygwin & TTSSH (Score:3, Informative)

    by cornice ( 9801 ) on Friday July 19, 2002 @08:31PM (#3920240)
    For the server side use SSH from cygwin [cygwin.com] and for the client side I really like TTSSH [zip.com.au] as an extension to Teraterm [vector.co.jp]. It also looks like there is now a TTX SSL [infoscience.co.jp] and an SSL OTP [nec.co.jp] available too. By the way, all of these have source available.

  • IBM Article (Score:5, Informative)

    by Random Bystander ( 548230 ) on Friday July 19, 2002 @08:42PM (#3920272)
    IBM had a great article about this a while ago. Quick search found the setup guide here [ibm.com].

    Their purpose was to have CVS over SSH to a Win2K box, but that is not its only use. And they use CygWin (as a plethora of people have already said to use).

    They even go as far as demonstrating the first few commands you're likely to need once it's set up.

  • Try Zebedee (ZBD) (Score:4, Informative)

    by jACL ( 75401 ) on Friday July 19, 2002 @08:45PM (#3920285)
    Not too many people know about it, but it works great, and it's for both Linux and Windows. After fighting (unsuccessfully) with SSH for key authenticated sessions only, I tried Zebedee [winton.org.uk] and had it up and running in an hour.

    • After fighting (unsuccessfully) with SSH for key authenticated sessions only, I tried Zebedee

      I fought with OpenSSH on Debian and Cygwin-OpenSSH and the commercial SSH on Windows machines for an hour at work today. To make a long story short:

      • Server-side OpenSSH on Linux, client-side OpenSSH on Windows: Generate RSA key pair on either system. Accept default filenames. No passphrase. On server, put id_rsa.pub in .ssh/ directory, and copy id_rsa.pub to authorized_keys (or append it, if authorized_keys file already exists). On client, put id_rsa file in .ssh/ directory.
      • Server-side OpenSSH on Linux, client-side commercial SSH on Windows: Generate RSA key pair on client. Copy public key over to Linux server and run ``ssh-keygen -i -f [pub_key_file_generated_by_commercial_ssh] > id_rsa.pub''. This converts the key from the commercial SSH key file format to the OpenSSH key file format. Remember to copy to authorized_keys. Add ``IdKey [private key file]'' to the identification file on the client side.

      Some help from the file descriptions at the end of man ssh made things clear for me.

  • Why not just use PPTP VPN? (Score:3, Insightful)

    by Syn Ack ( 3105 ) <slashdot@notFORTRANme.ca minus language> on Friday July 19, 2002 @08:45PM (#3920286) Homepage
    Why not use a PPTP VPN into your Windows environment and use remote desktop sharing from there to get access to the Windows boxes. Why reinvent the wheel?

    Paul
    • You don't need SSH, you just need an encrypted tunnel. VPN Works fine. If you need a console, use rcmdsvc. If you need to copy files, hit the admin shares on the machines. If you need a GUI use Terminal Services.

      SSH itself is somewhat limiting for Windows administration, considering that X-Forwarding ain't gonna happen.

      And while you're at it, use Windows Native encrytion instead of PGP.

      • Re:Damn Skippy (Score:2, Informative)

        by paenguin ( 311404 )
        You don't need SSH, you just need an encrypted tunnel. VPN Works fine.

        Actually, SSH is much more secure than VPN as far as attained rights are concerned. If you connect a VPN tunnel amongst a bunch of Windows machines, if one of them is compromised, all of them are compromised. This is not the case with SSH.

        Advocating using a VPN and opening access to everything on the other machine reflects a general lack of security knowledge. VPN on Windows throws open both barn doors for access to a service when you really only need a tiny well shuttered opening. Unfortunately, I find this poor security attitude/knowledge far too often among windows users and adminstrators.

  • OpenSSH on Windows (Score:3, Informative)

    by almeida ( 98786 ) on Friday July 19, 2002 @09:00PM (#3920338)
    Many people have mentioned cygwin, however I've always had trouble getting cygwin to work nicely on my Windows 2000 machines. It all just seemed like a big mess to me (cygwin, not Windows). I then found a project [networksimplicity.com] that gives you an OpenSSH port without the rest of cygwin. It uses the cygwin DLL but that's about it. In fact, you can't run this OpenSSH port and cygwin on the same computer (so says the author). I've been using it for a while now and it has always worked fine for me. The author updates regularly and keeps up with new releases and patches. I've gotten Windows version of rsync and bash to work with it as well. Give it a try.

    • Ya beat me to it (Score:3, Informative)

      by kjj ( 32549 )
      The first thing I did when i saw this question was head over to NoNags [nonags.com] and search for ssh and found several hits. Most were clients and one was the Network Simplicity package. I just want to say when download.com lets you down (most of the time) give NoNags a try. Just be aware it does have a few pop-ups.
  • While attending a security session put on by the SANS institute, they had a REALLY cool solution for protecting machine to machine communication in an 'unsafe' network environment.

    They used a feature of IPSEC that didn't encrypt the packets, but CRC'd them anyway. Then they configured the machines that were supposed to listen to the outside world (Business logic servers/ database servers) to punt all packets that didn't have an IPSEC crc on 'em.

    The system does the decoding at IIRC the 2nd or 3rd layer, using some very efficient code Microsoft got from Cisco. The teacher reported pounding on a laptop on a 100mbit segment with 6 orther attacking computers and the laptop registered about 12% utilization whil punting illegal packets.
  • Now that Microsoft has woken up to the need for improved security it is imperative that they should have SSH as an integral part of .NET Server and back-port it, Security Configurator and Analysis-style, to W2K Server and NT4 Server.

    SSH, SFTP and SCP would be wonderful tools to have. Just yank out Telnet, yank out IIS FTP Server and so forth and put this in instead. Terminal Services is fine and all but sometimes you need to do remote file transfers. The current alternatives MS provides are just not any good.
    • Microsoft has already provided L2TP (and its predecessor PPTP) and IPSec: It is backwards, and quite frankly quite silly, to try to program encryption into every single program when you can utilize these system features to add encryption to any and all applications (and yes you can make it mandatory if you want. In 20 seconds I can configure my system to only allow IPSec high security communications to my HTTP server).
  • How about filesystem encryption for Linux? Something that works effectively, well enough that it can be used in the real world. The kernel loopback encryption would be perfect, except it breaks with each kernel release and an indefinite time must be waited for patches - and patches might make old data unreadable. Is there any practical solution?

  • Not a troll...just a suggestion (Score:3, Offtopic)

    by johnlcallaway ( 165670 ) on Friday July 19, 2002 @09:33PM (#3920428)
    Our company had to set up a complete production system that was redundant and had to be administered remotely (120 miles away). That is why we went with Solaris servers and OpenSSH/VanDyke Windows client, and tossed MS for the servers out. Of course, we were fortunate enough that none of our applications had to run on a specific platform (web server, weblogic, Oracle, C++, and Java).

    Why am I telling you all this?? Not to bash MS. I ask that you look really close at your requirements and remote administration. Do they say 'I have to run on Windows??'. If not, maybe it's time to look elsewhere for solutions.

    Nothing to do with security or scalability or reliability (ok ... maybe a little) but when it came right down to brass tacks, Unix is far easier and has far more options to administer remotely than Windows. That darn command line thing where I can change any setting easily from using a 24K dialup modem is a godsend when doing remote administration.

    If you have to have a Windows solution, I saw a lot of good ones above that we use, Cygwin and VanDyke being my favorite.
    • Unless you are installing oracle.
      they dropped commandline installation and require a graphical head for the Java install. Why does everything java have to be GUI? can't there be commandline variants to a java program?

      stupid oracle.
  • I too am an administrator of many Windows boxen and am very security conscious . The absolute best information I have found about Windows Security, was from this Oreilly book: Securing Windows NT/2000 Servers for the Internet [oreilly.com]
    A Checklist for System Administrators I know its primarilly about creating Windows Bastion hosts, but there is an aweful lot of general Windows security and remote administration information as well. Every Windows sysadmin needs to give it a read!
  • but what does ssh have over Terminal Services?

    Is it more "secure"? It seems that win2k has very little command prompt ability and most people don't even know anything other then a few basics... So I guess my question I guess is Why?
    • Win2k's command prompt is pretty good is fine, not as good as most UNIX shells, a lot better than DOS. If you're talking about non-gui apps for users, yes, there's not much there. NT and later sysadmins can and often do a lot at the command prompt. Therefore its useful for them to have something like an SSH server. Having an SFTP server is useful users who can't use windows file sharing, such as off-site users if there's no VPN server. I use it to move files from my Mac at home to Windows at work (no VPN client for Mac). Plus you can use SSH to tunnel other connections which lack their own encryption, like VNC.

      BTW, another vote for networksimplicity's OpenSSH installer. If you don't need CygWin for other stuff, it's the way to go, user account setup is so much easier.

  • Stunnel, TLSWrap, SSLWrap, Safetp. (Score:3, Interesting)

    by BrookHarty ( 9119 ) on Friday July 19, 2002 @10:05PM (#3920539) Journal
    I personally use Stunnel [stunnel.org] on a few boxes, linux/windows/freebsd. It basically wraps your connection with ssl. You set it up on both servers, then connect to localhost:port and it forwards to the remote server ssl encrypted. Like ssh tunnels, but its a stand alone program. Also very transparent to the user.

    TLSwrap [freshmeat.net] is another ssl wrapper, used for ftp, but can be used for other ports.
    Safetp [berkeley.edu] seems to be a popular one with the college kids. Ive tested it out, and it does encrypt your session, and any ftp client will work since it encrypted the port.

    Personally, I dont want command line on windows, I want a GUI for windows. Tight VNC isnt encrypted, but you can use stunnel to take care of that. But I find remote desktop, using rdp 5.1, is fast as hell(compared to tightvnc) and is designed for windows. Very usable over a modem too.

    I Love computers and networking, 500 solutions to 1 problem.
  • Someone else mentioned Cygwin, but I thought I'd provide more data.

    You can download cygwin for free from cygwin.com [cygwin.com]. It includes both the client and the server for ssh. You can set up ssh as a service that runs even prior to login, so it's the real deal. All drives are accessible through the shell via the invisible /cygdrive/c, /cygdrive/d, etc directory. All the rest is explained on the Cygwin site. I believe commercial support for Cygwin is offered by Redhat, but it's worth noting that they have a very responsive free support list, frequented by all the major developers/porters.

    Give it a go. I think you'll be impressed.

  • I've looked at BestCrypt, Scramdisk, and DiskCrypt.
    What have you found that works for you?

  • Cygwin is STANDARD on my Windows systems (Score:3, Informative)

    by BitMan ( 15055 ) on Friday July 19, 2002 @11:20PM (#3920898)

    As a long-time NT administrator (original NT 3.1 beta tester), no Windows system goes on my network without Cygwin [cygwin.com] . In recent years, they've added XFree86 4.x (which works flawlessly nowdays), and other goodies like OpenSSH.

    And on Win/NT versions (NT, 2K, XP), you can setup OpenSSH in full server mode which is especially sweet for automation. You can find more information on how to configure OpenSSH as a server on NT/2K/XP here. [erdelynet.com]

    There is not a week that goes by without me needing something (let alone another user on our local support list) that Cygwin doesn't solve quickly and effectively. Again, that's why its on all my Windows systems by default.

  • From Openssh.com (Score:4, Informative)

    by RedSynapse ( 90206 ) on Friday July 19, 2002 @11:34PM (#3920954)
    The following "free" clients are recommended for interoperating with OpenSSH from Windows machines:

    • PuTTY [greenend.org.uk] is an SSH1+SSH2 implementation. PSCP, an scp [openbsd.org]-style program for Windows, is also available.

      PuTTY is available under the MIT licence (BSD-like).

      "PuTTY is a free implementation of Telnet and SSH for Win32 platforms, written and maintained primarily by Simon Tatham, who lives in Great Britain."

    • TTSSH (SSH1) [zip.com.au] is an SSH1-only implementation, by Robert O'Callahan.

      "TTSSH is a free SSH client for Windows. It is implemented as an extension DLL for Teraterm Pro. Teraterm Pro is a superb free terminal emulator/telnet client for Windows, and its source is available. TTSSH adds SSH capabilities to Teraterm Pro without sacrificing any of Teraterm's existing functionality. TTSSH is also free to download and use and its source is available too, with an open source license. Furthermore, TTSSH has been developed entirely in Australia [...]."

    • Cygwin (POSIX software on top of Windows) [cygwin.com]

      OpenSSH (SSH1 and SSH2 protocol) with Cygwin can run on Windows using the portable version of OpenSSH [slashdot.org].

    • MSSH [mscd.edu]

      MSSH from the Metropolitan State College of Denver supports Windows 95 and Windows 98, supporting SSH1 protocol.

    • OpenSSH for Windows [networksimplicity.com]

      Another OpenSSH running on top of Windows..

    • Secure iXplorer [i-tree.org]

      Secure iXplorer is graphical front end to PuTTY's [greenend.org.uk] pscp.exe.

    • WinSCP [winscp.vse.cz]

      WinSCP is a scp(1) program for Windows, with PuTTY integrated into it.

    The following clients are recommended for interoperating with OpenSSH from Mac machines:

    • NiftyTelnet 1.1 SSH [lysator.liu.se] is an SSH1-only implementation which comes with a scp [openbsd.org]-style program. Written by Jonas Wallden.

      "NiftyTelnet 1.1 SSH r3 is an enhanced version of Chris Newman's NiftyTelnet 1.1 application which adds support for encrypted terminal sessions using the SSH (Secure Shell) protocol. Please read the included Readme file before distributing this version."

    • MacSSH [macssh.com] is an SSH2-only implementation.

      "MacSSH is a modified version of BetterTelnet with SSH2 support. [...] The only SSH2 client for MacOS that I could find is a commercial product thats costs more than $100, and it crashes my Mac when closing a session... Since it's best to do things by oneself, here's MacSSH."

  • I use Bitvise WinSSHD [bitvise.com].

    Aside from dropping you straight to the Win2k command prompt, it has

    • Secure remote access via console (vt100, xterm and bvterm supported)
    • Secure remote access via GUI (WinVNC or XP Remote Desktop required)
    • Secure file transfer using SFTP and SCP (compatible with all major clients)
    • Secure TCP/IP connection tunneling (port forwarding)

  • You might want to take the one-day class on securing Windows 2000 currently being run in various cities by the SANS Institute [sans.org] or you won't have to worry about having secure remote access to your server(s) -- someone else will.

    It won't help to have the best encryption in the world securing your front door to a system that has 120 vulnerabilities in the default install!

  • I had a similar issue. My solution was to host all shared files on a Linux server running Samba. I then set up SSH tunnels for the WINS/NetBIOS ports. Windows clients didn't know it was secure, but I did. Most Windows clients wouldn't know if their stuff was secure or not anyways...

  • Cygwin instructions (Score:3, Insightful)

    by rwa2 ( 4391 ) on Saturday July 20, 2002 @09:35AM (#3922091) Homepage Journal
    As mentioned before, getting up and running with Cygwin is a snap! Here are your easy instructions:
    • Go to the cygwin [cygwin.com] site and click on the "install now" box on the side of the screen. Run the setup.exe program off the site (don't bother to save it somewhere, it gets updated almost weekly).
    • Tell it to install from the internet. Choose a mirror. It'll download a list of packages. Choose the Net | OpenSsh package. If you want to run the server, you might also want to choose everything in the Admin section. I also find Net | rsync more useful than the scp that comes with openssh.
    • Once the install is complete, fire it up and run ssh-host-config to set up the server. It'll ask you a bunch of simple questions, generate your hostkey, and stick the server in the startup scripts.
    With just this, the whole install takes about 32MB.
    Enjoy!

  • OpenSSH For Windows (Score:2, Insightful)

    by DougReed ( 102865 )
    OpenSSH For Windows is what I use. It works pretty well. The Server only works on NT/2000 I think, but the client works on everything.

    http://www.networksimplicity.com/openssh/

Slashdot Top Deals

For God's sake, stop researching for a while and begin to think!

Close