Low No Cost Tech

Securing your connections without a password

Posted by: Samiuela LV Taufa on August 09, 2007 1:33:50 PM

I'm kind of promoting that people don't use passwords for their connections, but to use keys instead ?

Environment:

Windows XP Desktop want to connect securely -to-
Unix Server running OpenSSH (e.g. Linux, BSD)

Why?

The primary rationale for promoting the use of keys amongst friends is the susceptibility of people to create less than 12 character passwords and easily fall into the habit of reusing or choosing simple passwords, which invariably increases the possibility that a hacker can automate an attack to get into your system.

By using keys, which are significantly more difficult to whack, you not only offer a higher level of security, but you can now use seriously difficult to crack passwords.

How?

PuTTY : I primarily use a little program called PuTTY for connecting onto a Unix server for personal and administrative work. PuTTY is secure, it's free, it's legal.

(from the FAQ) PuTTY is a client program for the SSH, Telnet and Rlogin network protocols. These protocols are all used to run a remote session on a computer, over a network. PuTTY implements the client end of that session: the end at which the session is displayed, rather than the end at which it runs.

In really simple terms: you run PuTTY on a Windows machine, and tell it to connect to (for example) a Unix machine. PuTTY opens a window. Then, anything you type into that window is sent straight to the Unix machine, and everything the Unix machine sends back is displayed in the window. So you can work on the Unix machine as if you were sitting at its console, while actually sitting somewhere else.

PuTTY HOWTO: Unfortunately the standard documentation for using putty, is completely accurate, correct and difficult to follow the first time around.

A nice, concise, step-by-step write-up has been published by Steve Friedl's Unixwiz.net Tech Tips titled Secure Linux/UNIX access with PuTTY and OpenSSH.

Installation and simple config/login

Providing for full passwordless, agent-based access requires a lot of steps, so we'll approach this in steps by first providing for regular passworded access to the system. This allows for testing of the initial installation and the ability to login before enabling the more advanced features.

Hey, they even help you download and install PuTTY if you've only just heard of it.

After installation, you should at least review the Putty User Manual (difficult to follow link above) since it provides more technical details and should help you with further securing your connections.

For those who still want to stick with generating keys in Windows, Leo Notenboom has also written-up a good summary / guide with the advantage of instructions for other Windows tools such as Putty, SecureCRT, PSFTP, WS_FTP.

Of course, if you're a Unix head, then you can just read the man pages.