SSH - Secure Shell

Secure Shell (ssh) is a secure replacement for telnet, rlogin, rsh, and rcp. It uses encryption to keep information that you send over the network from being seen by others. It also uses public and private keys to validate that the host and client machines are who they say they are. If you do not yet have Secure Shell installed on your system then please request it from your system manager. BaBar users are strongly encouraged to use Secure shell for all their connections.

Using SSH

Ssh can be used as a replacement for telnet, rlogin, rsh, and rcp. There may be some additional dialogues about host keys, but most of those are already set up for you, and require no additional thought on your part. This table gives the equivalent ssh command for the ones that you have been using.

`telnet host (followed by a prompt for a userid)`	`ssh -l userid host`
`rlogin host`	`slogin host (or ssh host)`
`rsh host command`	`ssh host command`
`rcp remote-file local-file`	`scp remote-file local-file`

X forwarding

One of the very nice features of ssh is that it takes care of X forwarding. No more messing around with the DISPLAY environment variable. With ssh you just log in and your X connections work straight away.

If you are used to do xhost +csfsun.rl.ac.uk on your local machine you can also take that away as ssh do not use it and it poses a security problem.

Problems

Secure Shell identifies the machines you are connecting to and makes sure that no one redirects your connection. If the machine pointed to by an alias changes you will get errors of the type

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: HOST IDENTIFICATION HAS CHANGED!         @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle
attack)!
It is also possible that the host key has just been changed.
Please contact your system administrator.

This is normally caused by a change of the hardware you connect to but if you are not aware of any changes this is a warning you should take seriously.

To get rid of the warning and be able to use X11 connections again you go into your .ssh/known_hosts and delete the long line that starts with the host you connect to. The lines in this file are very long. Take care not to break the other lines with your editor. If you have a system-wide known_hosts file you might need to get your system administrator to do this.

Navigation links: [BaBar UK Home] [Software at RAL] [ Secure Shell in BaBar] [ Secure Shell at SLAC]

http://hepunx.rl.ac.uk/BaBar/ssh.html last modified 5th Feb 1999 by

Ulrik Egede, <U.Egede@rl.ac.uk>