Something else, if you are doing automated file transfers, as was my
example, the authentication is by RSA. In other words I have an identify
file on the starting end and a known_hosts file on the receiving end. Even
if the session key was turned off, I don't think the authentication
information could be extracted, can it?
Almost every system admin I have ever dealt with is overloaded with too much
work to do. Its been an uphill battle getting them to use SSH for
interactive logins. Everyone gets lip service to security until you ask
them to change how they do things. Asking them to install and maintain yet
another package to do bulk file transfers when "rsh" is built in is (as
Congress said to Reagan's budget proposals) "dead on arrival". Asking them
to turn a one hour backup window into a three hour backup window is just as
dead. What I've done is lower the encryption selected to Blowfish and I've
more than doubled the throughput in the cases I have used.
-----Original Message-----
From: David Bishop [mailto:[EMAIL PROTECTED]]
Sent: Friday, February 02, 2001 10:33 AM
To: [EMAIL PROTECTED]
Subject: Re: Can SSH be used just for encrypted authentication and then
let the rest of the session be unencrypted ?
On Thu, 1 Feb 2001 23:17:05 -0500, Pierre Abbat said:
> On Thu, 01 Feb 2001, David Bishop wrote:
> >Well, to replicate what I assume a lot of people here do (i.e., maintain
web
> >servers/ftp servers) it is crucial that you limit who can upload to the
> >machine, but not who sees what is *on* the machine. So the fact that
I'm
> >uploading a new index.html to my machine isn't sensitive at all, anyone
who
> >goes to my box can see that. However, I obviously don't want just
anyone to
> >be able to upload to my machine. To be honest, that is a *lot* more
common
> >for me than having actual sensitive data. If I didn't know that it
would be
> >taken advantage of by script kiddies and idiots, I would open up my
whole
> >machine to the 'net, cuz I frankly have nothing on there that I care if
> >anyone else sees. It's just limiting who can *change* it that I care
about.
>
> What I would do in this case, where the data have to go fast and can go
in the
> clear but the authentication must be encrypted, is use rsync without ssh
and
> set a password on the module. The password will be authenticated with a
> challenge-response protocol, then rsync will transmit whatever part of
the data
> has changed.
>
> phma
I was using the uploading to a web server as an example, but really, any
connexion I make could fall under the same umbrella of "need secure auth,
not
transport". With *all* of the insecure protocols I use (ftp, pop3, telnet,
etc) I don't care if you watch every single bit I send back and forth, just
so long as you can't steal my user/pass. I know in the Era of Privacy
Advocates it's odd to see someone who truly doesn't care, but I don't :-)
D.A.Bishop
*****************************************************************************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorized.
If you are not the intended recipient, any disclosure, copying, distribution
or any action taken or omitted to be taken in reliance on it, is prohibited
and may be unlawful. When addressed to our clients any opinions or advice
contained in this email are subject to the terms and conditions expressed in
the governing KPMG client engagement letter.
*****************************************************************************
