Interactive Login with SSH, Security and different Clients

Motivation

Direct, interactive login is the easiest way to connect to a remote server. The tool we learn here is SSH which stands for Secure SHell. You will learn what kind of clients are available and what the kind of security SSH even offers.

Interactive Login with SSH

If you have an account on a Linux server and the Linux sever offers SSH access you can login with, e.g.:

$ ssh anna@testbox.example.org

This assumes the username on the remote machine is anna and the remote server has a name testbox.example.org - The first time you connect it will ask you if you trust this machine and will show a cryptographic fingerprint of the public key that the remote machine uses. That fingerprint is stored in a file .ssh/known_hosts and the next time you connect it will know that it is the same machine. If you do not have a host name you can also use the IP address.

If the username on your local machine is the same as on the remote machine, in the case above: anna, then you can omit the username part.

If you do not have a remote maschine you could, for this example also ssh into the same machine where you are currently working. The IP address will be 127.0.0.1 or you could use localhost as your hostname.

What kind of Security does SSH offer?

The first S in SSH stands for secure. But what kind of protections does SSH offer? The S means that the connection to your server is encrypted. This means that someone on the network can not spy on you. The identity of the remote machines is also checked with the fingerprint of they key that was used on the first connection. This prevents man-in-the-middle attacks. The only real danger here is the first connection: If you do not know the fingerprint of the remote machine then an attacker could hijack the connection at the first attempt. You could protect yourself by distributing the fingerprints beforehand. Newer versions of ssh also allow for signed keys, but this is rarely used.

Of course, the SSH does not protect you against a local attacker. If the machine that you use is already compromised, an attacker can read all your keystrokes and see all the output from the remote machine. So you should not login form a public internet cafe or any other insecure machine.

The most sensible type of information that could be stolen, of course is your password. In a normal, interactive login with password, the passwords is typed in on your machine, then encrypted and de-crypted on the remote end, where the hash function is used to compare it to the hashed password in the /etc/shadow. This means, an attacker that has taken over the remote machine could have installed a compromised version of the sshd and read your passwords in plain!

You can use password-less login with public-key login to avoid this issue, but still if you use password based login then you should really have a different password on all the machines you use! Otherwise an attacker could use this to also compromise all other machines where you have login.