CHAPTER 15 IN THIS CHAPTER . Setting Up a Telnet Server Remote Access with SSH . Telnet Versus SSH and Telnet . Setting Up an SSH Server . The SSH Tools . Remote X The ability to control your system remotely is one of the . Reference high points of Ubuntu—you can connect from any Linux box to another Linux box in a variety of ways. If you just want to check something quickly or if you have limited bandwidth, you have the option of using only the command line, but you can also connect directly to the X server and get full graphical control. Understanding the selection of tools available is largely a history lesson. For example, Telnet was an earlier way of connecting to another computer through the command line, but that has since been superseded by SSH. That is not to say that you should ignore Telnet; you need to know how to use it so you have it as a fallback. However, SSH is preferred because it is more secure. We cover both in this chapter. Setting Up a Telnet Server You will find the Telnet server installation packages in Synaptic under the telnetd package. Once installed, select Administration, Services and enable Telnet. Note your IP address while you are here (run ifconfig with sudo). With that done, you can now fire up your other Linux box and type telnet <your IP>. You are prompted to enter your username and password. The whole conversation should look like this: [paul@susannah ~]$ telnet 10.0.0.1 Trying 10.0.0.1… Connected to 10.0.0.1 (10.0.0.1) Escape character is ‘^]’. 356 CHAPTER 15 Remote Access with SSH and Telnet Welcome to Caitlin Running Ubuntu * All access is logged * login: paul Password: Last login: Sat Jul 9 12:05:41 from 10.0.0.5 [paul@caitlin ~]$ TIP Note that the server responds with Welcome to Caitlin, running Ubuntu, which is a customized message. Your machine will probably respond with Ubuntu and some version information. This is insecure: giving away version numbers is never a smart move. In fact, even saying Ubuntu is questionable. Edit the issue and issue.net files in your /etc directory to change these messages. Running the w command now shows you as connecting from the external IP address. Telnet Versus SSH Although Telnet is worth keeping around as a fail-safe, last resort option, SSH is superior in virtually every way. Telnet is fast but also insecure. It sends all your text, including your password, in plain text that can be read by anyone with the right tools. SSH, on the other hand, encrypts all your communication and so is more resource-intensive but secure—even a government security agency sniffing your packets for some reason would still have a hard time cracking the encryption. Andy Green, posting to the fedora-list mailing list, summed up the Telnet situation perfectly when he said, “As Telnet is universally acknowledged to encourage evil, the service telnetd is not enabled by default.” It is worthwhile taking the hint: Use Telnet as a last resort only. Setting Up an SSH Server If not installed already, the OpenSSH server can be installed through Synaptic by adding the openssh-server package. If you have disabled it, you can re-enable it by selecting System, Administration, Services and selecting the Remote Shell Server box. As you might have gathered, sshd is the name for the SSH server daemon. Two different versions of SSH exist, called SSH1 and SSH2. The latter is newer, is more secure, comes with more features, and is the default in Ubuntu. Support for SSH1 clients is best left disabled so older clients can connect. This is set up in the /etc/ssh/sshd_ config file on this line: #Protocol 2,1 The SSH Tools 357 For maximum security, that line should read: Protocol 2 This removes the comment sign (#) and tells sshd that you want it to only allow SSH2 connections. Save the file and exit your editor. The next step is to tell sshd to reread its configuration file, by executing this command: kill –HUP `cat /var/run/sshd.pid` If this returns cat: /var/run/sshd.pid: No such file or directory, it means you didn’t have sshd running. Next time you start it, it reads the configuration file and uses SSH2 only. You can test this change by trying to connect to your SSH server in SSH1 mode. From the same machine, type this: ssh -1 localhost The -1 switch forces SSH1 mode. If you successfully forced the SSH2 protocol, you should 15 get the message Protocol major versions differ: 1 vs. 2. The SSH Tools To the surprise of many, OpenSSH actually comprises a suite of tools. We have already seen ssh, the secure shell command that connects to other machines, and sshd, the SSH server daemon that accepts incoming SSH connections. However, there is also sftp, a replacement for ftp, and scp, a replacement for rcp. You should already be familiar with the ftp command because it is the lowest-common- denominator system for handling FTP file transfers. Like Telnet, though, ftp is insecure: It sends your data in plain text across the network and anyone can sniff your packets to pick out a username and password. The SSH replacement, sftp, puts FTP traffic over an SSH link, thus securing it. The rcp command might be new to you, largely because it is not used much anymore. Back in its day, rcp was the primary way of copying a single file to another server. As with ftp, scp replaces rcp by simply channeling the data over a secure SSH connection. The difference between sftp and scp is that the former allows you to copy many files, whereas the latter just sends one. Using scp to Copy Individual Files Between Machines The most basic use of the scp command is to copy a file from your current machine to a remote machine. You can do that with the following command: scp test.txt 10.0.0.1: 358 CHAPTER 15 Remote Access with SSH and Telnet The first parameter is the name of the file you want to send, and the second is the server to which you want to send it. Note that there is a colon at the end of the IP address. This is where you can specify an exact location for the file to be copied. If you have nothing after the colon, as in the previous example, scp copies the file to your home directory. As with SSH, scp prompts you for your password before copying takes place. You can rewrite the previous command so you copy test.txt from the local machine and save it as newtest.txt on the server: scp test.txt 10.0.0.1:newtest.txt Alternatively, if there is a directory where you want the file to be saved, you can specify it like this: scp test.txt 10.0.0.1:subdir/stuff/newtest.txt The three commands so far have all assumed that your username on your local machine is the same as your username on the remote machine. If this is not the case, you need to specify your username before the remote address, like this: scp test.txt [email protected]:newtest.txt You can use scp to copy remote files locally, simply by specifying the remote file as the source and the current directory (.) as the destination: scp 10.0.0.1:remote.txt . The scp command is nominally also capable of copying files from one remote machine to another remote machine, but this functionality has yet to be properly implemented in Ubuntu. If a patch is released—and we hope one is eventually—the correct command to use would be this: scp 10.0.0.1:test.txt 10.0.0.2:remotetest.txt That copies test.txt from 10.0.0.1 to remotetest.txt on 10.0.0.2. If this works, you are asked for passwords for both servers. Using sftp to Copy Many Files Between Machines sftp is a mix between ftp and scp. Connecting to the server uses the same syntax as scp—you can just specify an IP address to connect using your current username, or you can specify a username using username@ipaddress. You can optionally add a colon and a directory, as with scp. After you are connected, the commands are the same as ftp: cd, put, mput, get, quit, and so on. In one of the scp examples, we copied a remote file locally. You can do the same thing with sftp with the following conversation: [paul@susannah ~]$ sftp 10.0.0.1 Connecting to 10.0.0.1... The SSH Tools 359 [email protected]’s password: sftp> get remote.txt Fetching /home/paul/remote.txt to remote.txt /home/paul/remote.txt 100% 23 0.0KB/s 00:00 sftp> quit paul@susannah ~]$ Although FTP remains prominent because of the number of systems that do not have support for SSH (Windows, specifically), SFTP is gaining in popularity. Apart from the fact that it secures all communications between client and server, SFTP is popular because the initial connection between the client and server is made over port 22 through the sshd daemon. Someone using SFTP connects to the standard sshd daemon, verifies himself, and then is handed over to the SFTP server. The advantage to this is that it reduces the attack vectors because the SFTP server cannot be contacted directly and so cannot be attacked as long as the sshd daemon is secure.