Remote Access

1. Remote Access http://en.wikipedia.org/wiki/Telnet The old, “safe” world: telnet, rlogin, rsh, rcp

2. Telnet Telecommunications Network

3. TELNET • TELecommunicationNETwork • Network protocol used on Internet or LAN connections • Developed in 1969 beginning with RFC 15 • Standardized as IETFSTD 8 • One of the first Internet standards • The term telnet also refers to software which implements the client part of the protocol • TELNET clients have been available on most Unix systems for many, many years • Available for virtually all platforms • Most network equipment and OSs with a TCP/IP stack support some kind of TELNET service server for their remote configuration • Note: Secure Shell has begun to dominate remote access for Unix-based machines

4. TELNET • "To telnet“ - sometimes used as a verb • Establish or use a TELNET or other interactive TCP connection • "To change your password, telnet to the server and run the passwd command" • Typically a user will be telneting to a Unix-like server system or a simple network device such as a switch • User might "telnet in from home to check his mail at school" • Use a telnet client to connect local computer to a server • Once the connection is established • Log in with his account information • Execute commands remotely on that computer • E.g. ls or cd • Client may also be used to make interactive raw-TCP sessions • When that option is not available, telnet sessions are equivalent to raw TCP as long as byte value 255 never appears in the data • ? What is byte 255 ?

5. Protocol details

6. Protocol details • TELNET is a client-server protocol • Based on a reliable connection-oriented transport • Typically TCP port 23 • TELNET predates TCP/IP • Originally ran on NCP • Protocol has many extensions • Some adopted as Internet standards • IETF standards STD 27 through STD 32 • Define various extensions • Most are extremely common • Other extensions are proposed standards

7. Security

8. Security • TELNET initially developed in 1969 • Most networked computers at the time: • Computer departments of academic institutions • Large private and government research facilities • Security originally not as much of a concern • Most connections in a “secure” environment • Changed after the bandwidth explosion of the 1990s • Encrypted alternatives made necessary • Rise in the number of people with access to the Internet • Number of people attempting to crack other people's servers

9. Security • Experts in computer security1 recommend that the use of TELNET for remote logins should be discontinued under all normal circumstances for the following reasons: 1SANS Institute, members of the comp.os.linux.securitynewsgroup

10. Security • TELNET, by default, does not encrypt any data sent over the connection including passwords • Easy to eavesdrop on communications • Easy to intercept ids and passwords • Anybody with access to a router, switch, or gateway located on the network between the two hosts where TELNET is being used: • Can intercept the packets • Obtain login and password information • Any of several common utilities • E.g. tcpdump and Wireshark

11. Security • Most implementations of TELNET lack an authentication scheme • Cannot ensure that communication is carried out between the two desired hosts, and not intercepted in the middle • Commonly used TELNET daemons have several vulnerabilities discovered over the years

12. Security • Security-related shortcomings have seen the usage of the TELNET protocol drop rapidly • Especially on the public Internet • In favor of a the ssh protocol • First released in 1995 • SSH provides much of the functionality of telnet • Also has: • Strong encryption • Prevents sensitive data such as passwords from being intercepted • Public key authentication • Ensures that the remote computer is actually who it claims to be

13. Security • As has happened with other early Internet protocols • Extensions to the TELNET protocol provide TLS security and SASL authentication that address many security issues • Most TELNET implementations do not support these extensions • Relatively little interest in implementing these • SSH is adequate for most purposes • Main advantage of TLS-TELNET • Ability to use certificate-authority signed server certificates: • Authenticate a server host to a client that does not yet have the server key stored • SSH weakness: • User must trust the first session to a host when it has not yet acquired the server key

14. Current status

15. Current status • TELNET clients are still used • (as of 2010ish) • Often when diagnosing problems • Manually "talk" to other services without specialized client software • Sometimes used in debugging network services • SMTP, IRC or HTTP servers • Serves as a simple way to send commands to the server and examine the responses

16. Current status • Other software is finding greater favor with some system administrators for testing purposes • Examples: • nc (netcat) • socat on Unix • PuTTY on Windows • Can be called with arguments to not send any terminal control handshaking data • netcat does not distort the \377 octet • which allows raw access to TCP socket • unlike any standard-compliant TELNET software

17. Current TELNET status • Still very popular in enterprise networks to access host applications • IBM Mainframes • Typically within a secure internal environment • Still widely used for administration of network elements • Commissioning • Integration • Maintenance • Core network elements in mobile communication networks

18. Current status • TELNET is also heavily used for • MUD games played over the Internet • talkers, MUSHes, MUCKs, MOOes • Resurgent BBS community • Windows Vista and after • Telnet.exe no longer installed by default • Still available as an installable feature

19. rsh http://en.wikipedia.org/wiki/Remote_Shell Remote SHell

20. Remote Shell • rsh (remote shell): • Command line computer program • Executes shell commands • As another user • On another computer in a computer network • One command at a time • Remote system which rsh accesses • Must have the rshd daemon running • rsh uses well-known port TCP 514 • Note: rsh command shares the same name as another common UNIX utility, the restricted shell • First appeared in PWB/UNIX • System V Release 4 • Restricted shell is often located at /usr/lib/rsh

21. Remote Shell • rsh originated as part of the BSD Unix operating system, along with rcp, as part of the rlogin package on 4.2BSD in 1983 • rsh has been ported to other operating systems • rsh protocol is not secure for network use • Sends unencrypted information over the network • Some implementations also authenticate by sending unencrypted passwords over the network • rsh has largely been replaced by the very similar ssh (secure shell) program on untrusted networks like the internet

22. Remote Shell • rsh example: • Execute the command mkdir testdir as user remoteuser on the computer host.example.com: • rsh -l remoteuser host.example.com "mkdir testdir" • After the command has finished rsh terminates • If no command is specified then rsh will log in on the remote system using rlogin • Network location of the remote computer is looked up using the Domain Name System

23. rlogin http://en.wikipedia.org/wiki/Rlogin Remote Login

24. rlogin • rlogin: Unix software utility that allows users to log in on another host via a network • Communicates via TCP port 513 • First distributed as part of the 4.2BSD release • rlogin is also the name of the application layer protocol used by the software • part of the TCP/IP protocol suite • Authenticated users can act as if physically present at the computer • RFC 1258 states: • "The rlogin facility provides a remote-echoed, locally flow-controlled virtual terminal with proper flushing of output." • rlogin communicates with a daemon, rlogind, on the remote host. • rlogin • Similar to the Telnet command • Not customizable • Can connect only to Unix hosts

25. rlogin • Most commonly deployed on corporate or academic networks • User account information is shared between all the Unix machines on the network • often using NIS • Deployments essentially trust most other machines (and the network infrastructure itself) • the rlogin protocol relies on this trust • rlogind allows logins without password (where rlogind trusts a remote rlogin client) • if the remote host appears in the /etc/hosts.equiv file • if the user in question has a .rhosts file in their home directory

26. rlogin • rlogin has several serious security problems: • All information is transmitted unencrypted • Including passwords! • .rlogin (or .rhosts) file is easy to misuse • Potentially allows anyone to login without a password • Many corporate system administrators prohibit .rlogin files • actively search their networks for offenders • Protocol partly relies on the remote party's rlogin client providing information honestly (including source port and source host name) • A corrupt client is able to forge this and gain access • rlogin protocol has no means of authenticating other machines' identities, or ensuring that the rlogin client on a trusted machine is the real rlogin client • Common practice of mounting users' home directories via NFS exposes rlogin to attack by means of fake .rhosts files • Any of NFS' security faults automatically plague rlogin

27. rlogin • Due to these serious problems rlogin is rarely used across untrusted networks (like the public internet) • Even in closed deployments it has fallen into relative disuse • many Unix and Linux distributions no longer include it by default • Many networks which formerly relied on rlogin and telnet • Replaced them with SSH and its rlogin-equivalent slogin

28. rlogin • Original Berkeley package which provides rlogin also features rcp and rsh • Share the hosts.equiv and .rhosts access-control scheme • Suffer from the same security problems • Do connect to a different daemon, rshd • ssh suite contains suitable replacements for both: • scp replaces rcp • ssh itself replaces both rlogin and rsh

29. rcp http://en.wikipedia.org/wiki/Rcp_%28Unix%29 Remote Copy

30. rcp • rcp: the Unix ‘Remote CoPy' command • Command on the Unix used to remotely copy • Copy one or more files from one computer system to another • Typically uses • TCP/IP protocol • .rhosts file for authentication • Has been implemented to alternatively support Kerberos • rcp is not secure for network use • Sends unencrypted information over the network • Largely replaced by the ssh-based utility scp • Etymology: • rcp is a member of the BSD Unix family of 'r' (remote) commands • Name is a contraction of 'r' remote and 'cp' copy

31. ftp

32. ftp • File Transfer Protocol • FTP runs exclusively over TCP • Listens on port 21 (default) • Incoming connections from FTP clients • Responds on a dynamic port • Sent by client • Usually port 20 • Syntax • FTP [-options] [-s:filename] [-w:buffer] [host]

33. Typical use • Connect to an FTP server • ftp machineid • Login • Enter a valid user id an password • Interact with the FPT server • At the ftp> prompt

34. FTP Options • -s:filename • Run a text file containing FTP commands • host • Host name or IP address of the remote host. • -g • Disable filename wildcards. • -n • No auto-login. • -i • No interactive prompts during ftp. • -v • Hide remote server responses. • -w:buffer • Set buffer size to buffer (default=4096) • -d • Debug • -a • Use any local interface when binding data connection.

35. Typical FTP Commands • ? • request help or information about the FTP commands • append local-file [remote-file] • Append a local file to a file on the remote computer. • ascii • set the mode of file transfer to ASCII • the default • transmits seven bits per character • binary • set the mode of file transfer to binary • binary mode transmits all eight bits per byte • provides less chance of a transmission error • must be used to transmit files other than ASCII files • bye • exit the FTP environment • same as quit

36. Typical FTP Commands • cd • change directory on the remote machine • close • terminate a connection with another computer • close userid closes the current FTP connection with userid • still leaves you within the FTP environment • delete remote-file • delete a file in the current remote directory • same as rm in UNIX • dir [remote-directory] [local-file] • List a remote directory's files and subdirectories. • (or save the listing to local-file) • disconnect • Disconnect from the remote host, retaining the ftp prompt

37. Typical FTP Commands • get remote-file [local-file] • copy one file from the remote machine to the local machine • get ABC DEF copies file ABC in the current remote directory to (or on top of) a file named DEF in your current local directory • get ABC copies file ABC in the current remote directory to (or on top of) a file with the same name, ABC, in your current local directory • help [command] • request a list of all available FTP commands • lcd • change directory on your local machine • same as UNIX cd • ls • list the names of the files in the current remote directory • mdeleteremote-files [ ...] • Delete files on remote host

38. Typical FTP Commands • mdirremote-files [ ...] local-file • Display a list of a remote directory's files and subdirectories • (or save the listing to local-file) • Mdir allows you to specify multiple files. • mgetremote-files [ ...] • copy multiple files from the remote machine to the local machine • you are prompted for a y/n answer before transferring each file • mget * • copies all the files in the current remote directory to your current local directory, using the same filenames • Notice the use of the wild card character, *. • mkdirdirectory • make a new directory within the current remote directory • mlsremote-files [ ...] local-file • List a remote directory's files and folders. (short format)

39. Typical FTP Commands • mputlocal-files [ ...] • copy multiple files from the local machine to the remote machine • you are prompted for a y/n answer before transferring each file • open computer [port] • open a connection with another computer • open userid • opens a new FTP connection with userid • must enter a username and password for the useid account • unless it is to be an anonymous connection • prompt • Toggle prompting. • Ftp prompts during multiple file transfers to allow you to selectively retrieve or store files; mget and mput transfer all files if prompting is turned off. • By default, prompting is on. • put • copy one file from the local machine to the remote machine • pwd • find out the pathname of the current directory on the remote machine

40. Typical FTP Commands • pwd • find out the pathname of the current directory on the remote machine • quit • exit the FTP environment (same as bye) • remotehelp [command] • Display help for remote commands. • rename filename newfilename • Rename remote files. • rmdir • remove a directory in the current remote directory

41. Typical FTP Commands • send local-file [remote-file] • Copy a local file to the remote host. • status • Display the current status of FTP connections and toggles. • trace • Toggles packet tracing; trace displays the route of each packet • type [type-name] • Set or display the file transfer type: `binary' or `ASCII' (the default) • If type-name is not specified, the current type is displayed. • ASCII should be used when transferring text files. • In ASCII text mode, character-set and end-of-line characters are converted as necessary. • Use `Binary' for transferring executable files. • user user-name [password] [account] • Specifies a user to the remote host. • verbose • Toggle verbose mode. By default, verbose is on.

42. Telnet should never be use because it is unsafe: • True • False

43. ftp allows both the uploading and downloading of files to a remote computer • True • False

44. Summary • Host of insecure remote commands • Developed before security was a major concern • May be okay for “internal” use • On “secure” networks • May be better for speed • Where security is not a concern • Overall: • Use modern secure alternatives