Securing Connections from Windows 95 or NT

Win32 is the platform with perhaps the most options available for security. That doesn't make it the best platform, by a long shot. But it does mean that most people looking for solutions should be able to find one pretty easily.

Replacing Telnet

So the first step in this is to replace your telnet application with something secure. The primary way to do it is to locate a client that supports the "SSH" protocol. Here are some links:

Free:

Commercial:

Not recommended (currently, this may change):

If you have any contributions to make to this list, let us know. You might also see references to "SSH 2" when looking around. This is a next-generation of the SSH protocol. Currently, I'm not running an SSH 2 server, since there is not a demonstrable benefit or need for it, and since SSH 2 clients are not free, or at least "as free" as the SSH 1.x family. Let me know if you know of a reason why we might want to support SSH 2, other than "because 2 > 1". However, if you plan on purchasing a commercial SSH client from F-Secure/Datafellows, then you might as well get the SSH 2 version since it can be used on 1.x SSH servers.

Securing FTP

There is no generally useful totally secure replacement for FTP yet. When development tools using WEBDAV start coming out (like Office 2000) then conceivably they could become "secure" by publishing to a secure HTTP server. For the time being, we have to rely on the use of SSH to tunnel FTP connections. See this document for more details on how to configure your SSH client to handle FTP.

Not all FTP clients, though, support this FTP tunnelling. I haven't yet found a completely free FTP client that works, that also has a typical nicer FTP interface than Netscape has. Here is a list of clients we have tested, and whether they worked or not:

Working:

Doesn't work:

Let us know if you have others to add to this list, or updates on the "doesn't work" list. Some of the SSH vendors appear to be working on their own type of secure-file-transfer program, which would encrypt the files along with the control connection, but nothing like that is currently available.

Finally, you could consider FTP'ing from hyperreal to a server sitting on your personal computer. This will only work if you don't have a firewall between you and Hyperreal which might prevent incoming FTP connections; it would probably also not work for ISP's like AOL that use "network address translation" to make a bunch of computers look like the same IP number to the outside world. Otherwise, this should work; just be sure to change passwords on your FTP server frequently, and of course to take it down when you're not using it!

A good FTP server for Win32 is at http://home.sol.no/~jarlaase/tftpd.htm.

Securing POP

POP, or Post Office Protocol, is the protocol used for downloading email from the server to your desktop. It is used by Eudora, by Netscape, by Outlook, by Pine, by just about every decent mail user-agent out there.

There are two mechanisms for securing the password in POP:

Each page above explains how to configure it. If you have a mail program other than Eudora or Netscape, please let us know if they support any type of security protocol, like APOP or SPOP. If they don't, there is still a way to secure POP, much the same way we secured FTP. Follow the instructions we gave for FTP, but instead of using port 21, use port 110, which is the default port used by POP. This will cause your POP connection to tunnel over your SSH connection to fetch your email locally. However, like the FTP tunnel, this means you must be logged in via SSH in order to use this.