DOCSLIB.ORG

RF650VPN Internet Security Appliance User Guide

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
RF650VPN Internet Security Appliance User Guide RF650VPN Internet Security Appliance User Guide User Guide RouteFinder Model RF650VPN S000219D Revision D This publication may not be reproduced, in whole or in part, without prior expressed written permission from Multi-Tech Systems, Inc. All rights reserved. Copyright © 2001-2002 by Multi-Tech Systems, Inc. Multi-Tech Systems, Inc. makes no representations or warranty with respect to the contents hereof and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Furthermore, Multi-Tech Systems, Inc. reserves the right to revise this publication and to make changes from time to time in the content hereof without obligation of Multi-Tech Systems, Inc. to notify any person or organization of such revisions or changes. Record of Revisions Revision Date Description A 09/05/01 Manual released for RouteFinder software version 1.92. B 12/04/01 Manual revised for RouteFinder software version 2.00. Refer to Appendix C for a description of changes. C 02/25/02 Updated with changes to Appendixes A, E, and F. D 10/09/09 Removed examples that are now covered in separated Reference Guides. Patents This Product is covered by one or more of the following U.S. Patent Numbers: 6.219.708; 5.301.274; 5.309.562; 5.355.365; 5.355.653; 5.452.289; 5.453.986. Other Patents Pending. Trademarks Trademarks of Multi-Tech Systems, Inc.: Multi-Tech, the Multi-Tech logo, and RouteFinder. Windows is a registered trademark of Microsoft Corporation in the United States and other countries. All products or technologies are the trademarks or registered trademarks of their respective holders. World Headquarters Multi-Tech Systems, Inc. 2205 Woodale Drive Mounds View, Minnesota 55112 (763) 785-3500 or (800) 328-9717 Fax 763-785-9874 Tech Support (800) 972-2439 Internet Address: http://www.multitech.com Contents Chapter 1 – Introduction and Description ................................................................................................ 5 Introduction................................................................................................................................................ 5 Product Description ................................................................................................................................... 5 About this Manual and Related Manuals................................................................................................... 5 Front Panel ................................................................................................................................................ 6 Back Panel................................................................................................................................................. 7 Ship Kit Contents....................................................................................................................................... 7 Features..................................................................................................................................................... 8 Specifications............................................................................................................................................. 8 Pre-Installation Planning - the Organizational Security Policy ..................................................................9 RF650VPN Technology........................................................................................................................... 12 Chapter 2 - Installation ............................................................................................................................. 16 Introduction.............................................................................................................................................. 16 Address Table.......................................................................................................................................... 17 Safety Warnings ...................................................................................................................................... 18 Safety Recommendations for Rack Installations..................................................................................... 18 Hardware Installation Procedure ............................................................................................................. 19 Cabling Procedure................................................................................................................................... 19 Software Configuration ............................................................................................................................ 20 Chapter 3 – RouteFinder Software Operation........................................................................................ 34 Introduction.............................................................................................................................................. 34 System..................................................................................................................................................... 35 Definitions (Networks and Services) ....................................................................................................... 63 Network (Network Settings)..................................................................................................................... 74 Proxies (Application Gateways)............................................................................................................. 111 VPN (Virtual Private Networks) ............................................................................................................. 121 Help (The Online Help Functions) ......................................................................................................... 158 Chapter 4 - Troubleshooting.................................................................................................................. 161 RouteFinder FAQs................................................................................................................................. 161 Problem Solving .................................................................................................................................... 169 Error Messages ..................................................................................................................................... 171 Chapter 5 - PC Board Components, Upgrades, and Add-ons ............................................................ 182 Introduction............................................................................................................................................ 182 PC Board Components.......................................................................................................................... 182 Top Cover Removal / Replacement ...................................................................................................... 184 Upgrades ............................................................................................................................................... 184 Rack Mounting....................................................................................................................................... 185 Software Upgrades and Add-ons .......................................................................................................... 186 License Keys ......................................................................................................................................... 187 RouteFinder Maintenance ..................................................................................................................... 188 Chapter 5 - Service, Warranty, and Technical Support....................................................................... 190 Warranty ................................................................................................................................................ 190 On-line Warranty Registration ............................................................................................................... 190 Recording RouteFinder Information ...................................................................................................... 191 Contacting Tech Support via E-mail...................................................................................................... 191 Service................................................................................................................................................... 192 Multi-Tech on the Internet...................................................................................................................... 192 Repair Procedures................................................................................................................................. 192 Ordering Accessories ............................................................................................................................ 194 Appendix A – Application Examples and How to Use Remote Syslog ............................................. 195 Appendix B – Cable Diagrams............................................................................................................... 203 Appendix C - The WebAdmin Menu System ........................................................................................ 206 Appendix D - User Authentication Methods........................................................................................
Load more

Recommended publications
  • Secure Shell Encrypt and Authenticate Remote Connections to Secure Applications and Data Across Open Networks
    Product overview OpenText Secure Shell Encrypt and authenticate remote connections to secure applications and data across open networks Comprehensive Data security is an ongoing concern for organizations. Sensitive, security across proprietary information must always be protected—at rest and networks in motion. The challenge for organizations that provide access to applications and data on host systems is keeping the data Support for Secure Shell (SSH) secure while enabling access from remote computers and devices, whether in a local or wide-area network. ™ Strong SSL/TLS OpenText Secure Shell is a comprehensive security solution that safeguards network ® encryption traffic, including internet communication, between host systems (mainframes, UNIX ™ servers and X Window System applications) and remote PCs and web browsers. When ™ ™ ™ ™ Powerful Kerberos included with OpenText Exceed or OpenText HostExplorer , it provides Secure Shell 2 (SSH-2), Secure Sockets Layer (SSL), LIPKEY and Kerberos security mechanisms to ensure authentication security for communication types, such as X11, NFS, terminal emulation (Telnet), FTP support and any TCP/IP protocol. Secure Shell encrypts data to meet the toughest standards and requirements, such as FIPS 140-2. ™ Secure Shell is an add-on product in the OpenText Connectivity suite, which encrypts application traffic across networks. It helps organizations achieve security compliance by providing Secure Shell (SSH) capabilities. Moreover, seamless integration with other products in the Connectivity suite means zero disruption to the users who remotely access data and applications from web browsers and desktop computers. Secure Shell provides support for the following standards-based security protocols: Secure Shell (SSH)—A transport protocol that allows users to log on to other computers over a network, execute commands on remote machines and securely move files from one machine to another.
    [Show full text]
  • Telnet Client 5.11 Ssh Support
    TELNET CLIENT 5.11 SSH SUPPORT This document provides This document describes how to install and configure SSH support in Wavelink Telnet Client 5.11. information on the SSH support available in Telnet Client 5.11 OVERVIEW OF SSH SUPPORT Secure Shell (SSH) is a protocol developed for transmitting private information over the Internet. SSH OVERVIEW encrypts data that is transferred over the Telnet session. • Overview of SSH The Telnet Client supports SSH version 1 and 2 and will automatically select the most secure protocol Support that the SSH server supports. • Installing Windows SSH Support This document describes the following: • Configuring the host • Installing Windows SSH support utility profile for SSH • Configuring the host profile for SSH support support • Deploying Windows • Deploying Windows SSH support to the device through Avalanche or ActiveSync SSH Support • Revision History INSTALLING WINDOWS SSH SUPPORT Installing SSH support is a two-step process. First, install SSH support on the PC from which you will deploy Telnet. Once you install SSH support on the PC, use Avalanche or ActiveSync to deploy the utility to the device. To install SSH support on your PC: 1. Obtain the installation executable for SSH support. NOTE: To obtain the Wavelink SSH support utility install, go to http://www.wavelink.com/downloads/ files/sshagreement.aspx. 2. Install SSH support on the PC from which you will deploy the Telnet Client. CONFIGURING THE HOST PROFILE FOR SSH SUPPORT SSH support is configured from the Host Profiles window of the configuration utility. NOTE: SSH is only an active option if SSH support has been installed on the PC running the Telnet Client configuration utility.
    [Show full text]
  • Networking Telnet
    IBM i Version 7.2 Networking Telnet IBM Note Before using this information and the product it supports, read the information in “Notices” on page 99. This edition applies to IBM i 7.2 (product number 5770-SS1) and to all subsequent releases and modifications until otherwise indicated in new editions. This version does not run on all reduced instruction set computer (RISC) models nor does it run on CISC models. This document may contain references to Licensed Internal Code. Licensed Internal Code is Machine Code and is licensed to you under the terms of the IBM License Agreement for Machine Code. © Copyright International Business Machines Corporation 1998, 2013. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Telnet................................................................................................................... 1 What's new for IBM i 7.2..............................................................................................................................1 PDF file for Telnet........................................................................................................................................ 1 Telnet scenarios...........................................................................................................................................2 Telnet scenario: Telnet server configuration.........................................................................................2 Telnet scenario: Cascaded Telnet
    [Show full text]
  • Free Linux Based Ftp Server
    Free linux based ftp server Graphical UI based FTP Servers; Terminal/Console based FTP Servers Linux, AIX, UNIX, IBM i, VMware, EC2, Azure, Mac OS, Free FTP server with ​Graphical · ​Console/terminal-based · ​Summary board. The same source code compiles and runs on Linux, OpenBSD, NetBSD, one- disk router), ROOT Linux, Gentoo Linux and almost every other free operating system. Pure-FTPd can act as private FTP server and disallow all anonymous. Learn How FTP Server Works, Setup Open Source vsftpd Server in Linux, On Debian based distros like Ubuntu, you can install it like this. Welcome to the home of CrossFTP Server, the free secure FTP server for Windows, Mac, Linux, and more. almost everything: OS X - +, WinXP - Win+, Linux, Solaris, BSD, Unix, etc! CrushFTP is a robust file transfer server that makes it easy to setup secure is web based allowing you the ability to manage and monitor the server from You can see things like the number of active connections, free drive space. Download the latest and greatest of Linux FTP Server Software here. glFTPd is a free FTP server software for Linux and UNIX based systems. It is highly. Is there any sort of made for Linux FTP server software that features a GUI? I am a total newbie and I am getting my butt kicked by VSFTPD. vsftpd is a GPL licensed FTP server for UNIX systems, including Linux. It is secure and extremely fast. It is stable. Don't take my word for it, though. Below, we will. A glance at the common Linux ftp servers.
    [Show full text]
  • 1 KONFIGURACE GLFTPD a PZS-NG 1.1 Zadání 1.2 Teoretický
    1 KONFIGURACE GLFTPD A PZS-NG 1.1 Zadání 1. Proveďte nastavení portů pro pasivní režim přenosu. 2. Proveďte vytvoření uživatele a nastavení jeho hodnot ratio, num_logins. 3. Proveďte zabezpečení GlFTPd pomocí SSL/TLS. 4. Nakonfigurujte PZS-NG pro ověřování kontrolních součtů a propojte jejsFTP démonem GlFTPd. 1.2 Teoretický úvod FTP (File Transfer Protocol) je aplikačním protokolem vrstvového modelu TCP/IP (Transmission Control Protocol/Internet Protocol). Využívá dvě TCP spojení trans- portní vrstvy označované jako řídící (kontrolní) a datové.[1, 2] Jedná se o textově orientovaný protokol pracující na principu klient-server, tzn. existuje server, kam jsou připojeni jednotliví klienti (například osobní počítače). Textové příkazy jsou posílány v paketech, které mohou být odchyceny a bez větších problémů přečteny. Nejedná se o nový protokol. FTP byl definován v RFC 114 (Request for Comments). Aktuální je definice v RFC 959[1], které vyšlo v říjnu roku 1985 a s použitím aktu- alizačních RFC je dnes stále využíváno převážně ke sdílení souborů.[1] 1.2.1 Aktivní režim Jedná se většinou o preferovaný režim přenosu, jelikož server nemusí otevírat porty a nemůže být přetížen mnoha žádostmi o data. Jak je zobrazeno na obr. 1.1. Přes řídící spojení je mezi klientem a serverem dohodnuto, na jaké IP adrese a portu budou data k dispozici (pomocí příkazu PORT). Spojení je navázáno ze serveru na sdělenou IP a port, kde se stáhne nebo nahraje soubor. Role serveru a klienta jsou tedy pro datové spojení vyměněny.[2] Tento režim však může být problematický při používání NAT (Network Address Translation) nebo firewallu, kdy je bráněno otevření portu na klientovi a následnému připojení serveru.[2] 1.2.2 Pasivní režim Problém NATu, který je způsoben nemožností připojení na klienta, a firewallu je vyřešen přenosem v pasivním režimu, kdy si klient se serverem nevymění role, ty zůstanou zachovány.
    [Show full text]
  • SOCKS Protocol Version 6
    SOCKS Protocol Version 6 draft-olteanu-intarea-socks-6-08 Vladimir Olteanu IETF 106 What’s new ● DNS provided by SOCKS ● Options for Happy Eyeballs at the proxy Clients need DNS-like features ● A and AAAA – LD_PRELOAD for non-SOCKS-aware apps: gedaddrinfo() separate from connect() – Happy Eyeballs: need to do queries separately ● TXT – ESNI ● MX, Service Binding, etc. – <Insert future use case here> Providing DNS-like features ● Individual SOCKS options (removed in -08) – Have to keep up with use cases – Duplicate DNS functionality – Until -07: A, AAAA, PTR ● Having the client use DNS – Hard to convey policies: resolver IPs, plaintext / over TLS / over HTTPS etc., maybe credentials, etc. – Provide a DNS proxy Why not separate DNS from SOCKS? Client Proxy Server HTTP/SOCKS :1080 HTTP :80 DNS :53 Why not separate DNS from SOCKS? Client Proxy Server HTTP/SOCKS :1080 HTTP :80 DNS :53 WHICH TOR CIRCUIT? ● Need context for DNS query – Otherwise: privacy leaks, suboptimal CDN use DNS provided by SOCKS ● Clients make CONNECT request to 0.0.0.0:53 – Proxy needn’t provide a valid bind address ● Plaintext DNS over SOCKS (opt. over TLS) – TCP by default: SOCKS + UDP more cumbersome to use ● Implementation in Sixtysocks – Run separate DNS proxy locally – Translate 0.0.0.0:53 to 127.0.0.1:53 Happy Eyeballs ● RFC 8305: resolve and connect to a server using both IPv4 and IPv6, keep only one connection – Failover from IPv6 to IPv4 – Better responsiveness if one is faster ● Clients can implement Happy Eyeballs locally – Have DNS + CONNECT Happy Eyeballs:
    [Show full text]
  • Servicios De Red E Internet
    SERVICIOS DE RED E INTERNET Autor: Miguel Ángel García Felipe IES GREGORIO PRIETO Servicios de Transferencia de Ficheros SERVICIOS DE RED E INTERNET SERVICIOS DE TRANSFERENCIA DE FICHEROS ÍNDICE 1. Funcionalidad del servicio de transferencia de archivos. - Características. Componentes y funcionamiento. - Protocolo FTP. - Tipos de usuarios y accesos al servicio: Acceso anónimo y acceso autorizado. - Configuración del servicio de transferencia de archivos. Permisos y cuotas. - Conexiones y modos: Conexión de control y conexión de datos. Modos activo y pasivo. - Tipos de transferencia de archivos: ASCII y Binario. - Clientes FTP: en línea de comandos, entornos “gráficos” y navegadores / exploradores. - Monitorización y registro del servicio de transferencia de archivos. - Seguridad en FTP. - FTPS (FTP/SSL): FTPS Implícito. FTPS Explícito (FTPES) - Protocolo FXP (File eXchange Protocol). 2. Servicio TFTP (Trivial File Transfer Protocol). 3. Servicios SFTP/SCP. 4. Transferencia o distribución de archivos entre iguales (peer-to-peer). - Características. Protocolos. Software. Configuración. 2 SERVICIOS DE RED E SERVICIOS DE TRANSFERENCIA DE FICHEROS INTERNET 1. Funcionalidad del servicio de transferencia de archivos. - Características. Componentes y funcionamiento. Es una utilidad que permite la copia de un archivo desde un ordenador a otro a través de una red de computadoras. El servicio más usado para realizar este movimiento es el FTP (File Transfer Protocol), el cual consiste en un programa FTP alojado en un servidor -llamado FTP daemon- el cual se encarga de gestionar las transacciones que solicita el cliente. Los movimientos que podemos realizar a la hora de transferir archivos de un equipo a otro son: "download" (bajada de archivos de Internet), "upload" (subida de archivos a Internet), o intercambio de objetos entre dos o más usuarios.
    [Show full text]
  • New Techniques to Enhance the Capabilities of the Socks Network Security Protocol
    NEW TECHNIQUES TO ENHANCE THE CAPABILITIES OF THE SOCKS NETWORK SECURITY PROTOCOL Mukund Sundararajan and Mohammad S. Obaidat Computer Science Department, Monmouth University, West Long Branch, NJ, U.S.A. Keywords: Security protocols for computer networks, SOCKS, telecommunications, multicast, UDP tunneling. Abstract: SOCKS is an industry standard network security protocol used in private networks to allow secure traversal of application layer traffic through the boundaries of the network. Standardized by IETF in Request for Comments (RFC) 1928 (Leech et al., 1996) as SOCKS Version 5, this protocol has found widespread use in various security frameworks to allow a variety of application layer protocols to securely traverse a firewall. This paper is the result of research performed on the usability of the protocol in application domains such as multicast. We discuss some of the shortcomings of the SOCKS protocol and provide a framework and the methods for enhancing the capabilities of the protocol in areas such as multicast and advanced TCP and UDP capabilities not addressed by the current standard of the protocol. The methods proposed are being implemented in a reference implementation by the authors. 1 INTRODUCTION Operating in a client server mode, application nodes or computers within a SOCKS protected In today’s global and geographically dispersed network are ‘socksified’ by a socks client library that organizational world, network security is a key provides a transparent abstraction layer between the concern to organizations and individuals. With application and the kernel socket library and hides advances in technology, most of today’s the implementation details of the socks protocol from organizations have their key resources and data the application.
    [Show full text]
  • NBAR2 Standard Protocol Pack 1.0
    NBAR2 Standard Protocol Pack 1.0 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 © 2013 Cisco Systems, Inc. All rights reserved. CONTENTS CHAPTER 1 Release Notes for NBAR2 Standard Protocol Pack 1.0 1 CHAPTER 2 BGP 3 BITTORRENT 6 CITRIX 7 DHCP 8 DIRECTCONNECT 9 DNS 10 EDONKEY 11 EGP 12 EIGRP 13 EXCHANGE 14 FASTTRACK 15 FINGER 16 FTP 17 GNUTELLA 18 GOPHER 19 GRE 20 H323 21 HTTP 22 ICMP 23 IMAP 24 IPINIP 25 IPV6-ICMP 26 IRC 27 KAZAA2 28 KERBEROS 29 L2TP 30 NBAR2 Standard Protocol Pack 1.0 iii Contents LDAP 31 MGCP 32 NETBIOS 33 NETSHOW 34 NFS 35 NNTP 36 NOTES 37 NTP 38 OSPF 39 POP3 40 PPTP 41 PRINTER 42 RIP 43 RTCP 44 RTP 45 RTSP 46 SAP 47 SECURE-FTP 48 SECURE-HTTP 49 SECURE-IMAP 50 SECURE-IRC 51 SECURE-LDAP 52 SECURE-NNTP 53 SECURE-POP3 54 SECURE-TELNET 55 SIP 56 SKINNY 57 SKYPE 58 SMTP 59 SNMP 60 SOCKS 61 SQLNET 62 SQLSERVER 63 SSH 64 STREAMWORK 65 NBAR2 Standard Protocol Pack 1.0 iv Contents SUNRPC 66 SYSLOG 67 TELNET 68 TFTP 69 VDOLIVE 70 WINMX 71 NBAR2 Standard Protocol Pack 1.0 v Contents NBAR2 Standard Protocol Pack 1.0 vi CHAPTER 1 Release Notes for NBAR2 Standard Protocol Pack 1.0 NBAR2 Standard Protocol Pack Overview The Network Based Application Recognition (NBAR2) Standard Protocol Pack 1.0 is provided as the base protocol pack with an unlicensed Cisco image on a device.
    [Show full text]
  • Configuration and Management Suite Volume 2: Proxies and Proxy Services
    Blue Coat® Systems ProxySG® Appliance Configuration and Management Suite Volume 2: Proxies and Proxy Services Version SGOS 5.3.x Volume 2: Proxies and Proxy Services Contact Information Blue Coat Systems Inc. 420 North Mary Ave Sunnyvale, CA 94085-4121 http://www.bluecoat.com/support/contactsupport http://www.bluecoat.com For concerns or feedback about the documentation: [email protected] Copyright© 1999-2008 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of Blue Coat Systems, Inc. All right, title and interest in and to the Software and documentation are and shall remain the exclusive property of Blue Coat Systems, Inc. and its licensors. ProxyAV™, CacheOS™, SGOS™, SG™, Spyware Interceptor™, Scope™, ProxyRA Connector™, ProxyRA Manager™, Remote Access™ and MACH5™ are trademarks of Blue Coat Systems, Inc. and CacheFlow®, Blue Coat®, Accelerating The Internet®, ProxySG®, WinProxy®, AccessNow®, Ositis®, Powering Internet Management®, The Ultimate Internet Sharing Solution®, Cerberian®, Permeo®, Permeo Technologies, Inc.®, and the Cerberian and Permeo logos are registered trademarks of Blue Coat Systems, Inc. All other trademarks contained in this document and in the Software are the property of their respective owners. BLUE COAT SYSTEMS, INC. DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL BLUE COAT SYSTEMS, INC., ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF BLUE COAT SYSTEMS, INC.
    [Show full text]
  • Guidelines for the Secure Deployment of Ipv6
    Special Publication 800-119 Guidelines for the Secure Deployment of IPv6 Recommendations of the National Institute of Standards and Technology Sheila Frankel Richard Graveman John Pearce Mark Rooks NIST Special Publication 800-119 Guidelines for the Secure Deployment of IPv6 Recommendations of the National Institute of Standards and Technology Sheila Frankel Richard Graveman John Pearce Mark Rooks C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 December 2010 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Dr. Patrick D. Gallagher, Director GUIDELINES FOR THE SECURE DEPLOYMENT OF IPV6 Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-119 Natl. Inst. Stand. Technol. Spec. Publ. 800-119, 188 pages (Dec. 2010) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.
    [Show full text]
  • Secure Shell (SSH)
    Secure SHell (SSH) © André Zúquete Advanced Network Security SSH (Secure SHell, RFC 4251): Goals An application and a secure communication protocol over TCP/IP Allows the establishment of secure remote sessions Replacing insecure telnet/rlogin sessions Allows the multiplexing of many data flows over a secure session Secure tunneling Security mechanisms Confidentiality and integrity control Including data flow hiding Key distribution Session key Mutual authentication Server host (or server) Client user © André Zúquete Advanced Network Security SSH: Exploitation Secure remote logins Instead of telnet/rlogin Secure remote command execution Instead of rsh/rcmd/rexec Secure file transfer and backup Secure FTP / Secure copy Port forwarding and tunneling For adding security to multiple data flows through a single SSH session © André Zúquete Advanced Network Security SSH: History Created by Tatu Ylönen First version released in 1995 Second version released in 1998 Not compatible with the previous one Björn Grönvall developed OSSH in 1999 From the last open source release of SSH OpenBSD launched the OpenSSH project (www.openssh.org ) Extending OSSH © André Zúquete Advanced Network Security SSH: Architecture Client-server architecture Server usually on port 22 Services include login, ftp, file copy and TCP tunneling © André Zúquete Advanced Network Security SSH: Protocols Transport Layer Protocol (RFC 4253) Key distribution Session key computing with ephemeral DH values Server authentication With pre-distributed,
    [Show full text]