Secure Communication through SSH

Infrastructure consolidation is a key trend nowadays, and
just about every enterprise is doing it. This has turned simple server rooms
into complex data centers. Managing them therefore has become a key challenge.
Plus, in allowing your remote offices to access them raises security concerns.
This has created a need for secure remote management solutions, and in this
article, we'll talk about one such solution called SSH Tectia client/server.
It provides end-to-end secure communication within a corporate network. You can
have secure system administration, secure application connectivity and secure
file transfers. As the name suggests, the software uses Secure Shell (SecSh)
technology to provide secure communication. Secure Shell secures connections
over the Internet by encrypting passwords and other data. It provides strong
authentication and secure communications over unsecured networks (like the
Internet). It provides security at the application layer of the TCP/IP protocol
stack.

Version overview

The SSH Tectia client/server solution is available for Unix, Linux, Windows
and Solaris. It comes in three versions-A, F,  and T. SSH Tectia Server
(A) is designed for secure system administration, enabling system administrators
to remotely administer application servers and other network resources using
secure terminal and file transfer connections. Server F version provides file
transfers when used in conjunction with SSH Tectia Client with version A
capabilities. And the T version provides Application tunneling and includes all
features of F and A. In server side authentication, SSH Tectia uses
cryptographic authentication for server hosts. Each server has a cryptographic
key pair (a public key and a private key) that identifies the server. Whenever a
Secure Shell client connects to a Secure Shell server, the server authenticates
itself to the client cryptographically. This ensures that encryption and
integrity protection are provided end-to-end between the client and the intended
server, and eliminates the possibility to perform certain types of attacks.

Authentication

In order for the cryptographic authentication to work, the client must know
the server's public key so that it can securely authenticate the server. The
public key of the server has to be distributed to each client. For user
authentication SSH Tectia has different types of methods. These authentication
methods can be combined or used separately, depending on the level of
functionality and security you want. User authentication methods used by the
client by default are GSSAPI, public-key, keyboard-interactive, and password
authentication. Public-key and certificate authentication are combined into the
public-key authentication method. To provide secure file transfers, it has a SSH
Tectia file transfer client which is a FTP look like application. It can work
with any versions of SSH tectia Server.

SSH Tectia uses many different kinds of authentication methods to ensure that it provides a secure connection

User application protection

It also has an application called SSH Tectia Connector, which can be used to
protect user applications that use TCP as the transport protocol. However,
applications that start as a system service before the user is logged on to the
workstation or those that use UDP cannot be secured with SSH Tectia Connector.
SSH Tectia Connector is a transparent end-user client that provides dynamic
tunneling of client/server connections witho ut the need to re-configure the
tunneled applications. It starts automatically when the user logs on to a
Windows workstation.

It works silently in the background, protecting network
connections according to the security policies. It can also be used for
application protection using its static application tunneling features. All
that's required is to configure the application to connect to a local port
running SSH Tectia Client, and then the Client can be used to tunnel the
application to a specified remote host.

Setup

You can install Tectia on a Windows Server 2003 box from this month's
PCQEnterprise CD. After installation, run the SSH Tectia Configuration tool from
the Programs menu.

Cryptographic keys

Configure the maximum number of connections to Tectia Server from the
General tab. You can additionally enable the FIPS mode (FIPS 140-2) by checking
that option. You also need to add the host keys (public and private) and
certificates. Do this from the Identity page. You can also generate your own
2048 bit DSA key pairs from the same screen. The

default keys provided with Tectia are located in the installation directory
(C:\Program Files\SSHCommunications Security\SSHTectia\SSH Tectia Server).

Network interfaces

Now we need to configure the network interfaces. Use the Network tab for
this and add as many interfaces as you want Tectia to listen on. If you have
only one Network interface in your server, you do not need to specify the IP
addresses here.

Connections and Encryption

To configure the connections and encryption used in these connections, use
the Connections and Encryption tab and create new connections. Here, you can add
the interfaces to be used for the connection (setup from the Network tab).

Also configure the ciphers and MACs that will be allowed
for each connection. Here you will see something called 'Rkey Interval'
which is the number of seconds or transferred bytes after which the key exchange
will be done again. If values for both seconds and bytes are specified, rekeying
is done whenever one of the values is reached (first one to be reached). You can
customize this value, by default is 3600 seconds and 1 GB.

If you want to turn off the Rekey requests just enter a
zero as the value. But this will not prevent the client from requesting rekeys.
Select the ciphers and MACs from the Encryption tab as you require.

Authentication rules

New authentication rules can be added. There are two sub-pages for this to
be setup. You can use the Selectors tab to add the interfaces for which rules
are being created. You must define here if authentication is allowed or denied.
Next, use the parameters tab to configure the settings for each rule. There is a
choice between using password authentication or public-key authentication or
host-based authentication.

The client

Once the server is configured, you will have to configure the client in a
similar

fashion. On the client you can create multiple profiles for different servers if
you are using different method of authentication for every server.

To start using the SSH Tectia Server, open the SSH Tectia
Client, and click on the Quick Connect button. Provide the hostname, username
and the port number where the

Tectia server is running and click on Connect. Or if you
have created a profile, just click on that profile from the profile menu and it
will automatically connect you to the server. Similarly, you can use the File
Transfer SSH Tectia Client to transfer files in a secure way.

Swapnil Arora