Securing Connections from a Unix Box

Unix users are lucky, in that the SSH package for Unix is the reference package for the protocol. That means not only is it available for free, it is the best-tested and quite stable. It also comes with a collection of utilities to make like easier, like ssh-agent.

Replacing Telnet

So the first step in all this is to use the ssh program instead of telnet when connecting. If you don't have it already available ("which ssh" should tell you if it is), then you can either request it from your sysadmin, or if it's up to you, grab the SSH distribution from http://www.ssh.fi/ and build it for your system.

This collection doesn't really have a "GUI", but that's fine, you can just use it within your current xterms. You can also tunnel X over your SSH connection, so you can run X programs on taz remotely. See the SSH manual for information on how to do that. We don't recommend it, though, as it tends to be kinda slow. Also, if you do it, be sure and enforce that only local connections may be made to your X connection, otherwise port scanners may find an open port on taz connected to your SSH client.

Finally, it should be noted that we are using a protocol version 1 server on taz - while there are protocol version 2 SSH servers and clients out there, we haven't upgraded yet as we were unsure about the license and because there isn't yet a clear advantage to the new protocol. Version 2 clients should be backwards compatible, so it's not a big deal, but just keep this in mind if you get confused.

Securing FTP

When you install SSH, you will also install a program called "scp". This is a "secure" replacement for the "rcp" program, and acts exactly like it. With this, there should be no need to run an FTP program.

If you want to do some more advance synchronization between a local set of files and a directory on taz, you should look at the rsync program. It works very well with SSH, in fact I use it to mirror on my home machine all the public content from hyperreal for backup purposes.

Securing POP

We have the same problem here as the other platforms do; though all the main mail clients support POP, support for APOP is spotty (is it in pine?) and support for POP-over-SSL is rumored to exist in Netscape but we haven't had a chance to verify that. The great free package Fetchmail supports APOP, at least. Anyone with more information about APOP support on Unix, or better yet SPOP, please let us know.

If you must use regualr POP to access your mail, you can either use pine on taz by logging in over SSH, or you can consider tunnelling POP over SSH, using the same mechanism described for port-forwarding FTP over SSH, but using port 110 instead of port 21.